Breaking News in the PS2 Scene, as a NEW MemoryCard Exploit for Protokernel PS2s (SCPH-10000, SCPH-15000, and DTL-H10000(S)) just got released!!! It took 25 years to reach this point, but NOW ALL PS2s including ALL special models (Arcade, Prototype, Debug, Consumer-model, "special/custom builds") can load Homebrew WITHOUT DISCS!
The exploit created by developer @pcm720 - who is known for "(H)OSDmenu" and NHDDL - has now titled the new MemoryCard Exploit as "ProtoPwn", This exploit will AUTOMATICALLY boots if present on the MemoryCard and it works from ANY MemoryCard so MagicGate support is not required for this Exploit to work!
You can even simply copy the Exploit "Save" to another MemoryCard, for example with the PS2's own "Browser"!
The exploit created by developer @pcm720 - who is known for "(H)OSDmenu" and NHDDL - has now titled the new MemoryCard Exploit as "ProtoPwn", This exploit will AUTOMATICALLY boots if present on the MemoryCard and it works from ANY MemoryCard so MagicGate support is not required for this Exploit to work!
You can even simply copy the Exploit "Save" to another MemoryCard, for example with the PS2's own "Browser"!
-
ProtoPwnUsage
An exploit for the Protokernel PlayStation 2 systems (SCPH-10000, SCPH-15000, and DTL-H10000(S)) that enables arbitrary code execution through a flaw in the OSDSYS Browser update code.
- Run make
- Copy BIEXEC-SYSTEM to the root of your memory card
- Copy the payload you want to run to BOOT/BOOT.ELF
How it works
ProtoPwn consists of a fairly simple two-stage payload and a packer tool:
-
MBROWS replacement
- Runs from 0x7a0000
- Patches OSDSYS code to execute a custom function in the main thread
- Applies the EELOAD kernel patch
- Deinitializes OSDSYS
- Finds the target ELF on mc0 or mc1
- Executes the embedded ELF loader
-
Embedded ELF loader
- Cleans up after OSDSYS
- Loads the target ELF
- Resets the IOP
- Executes the target ELF
- Simple packer script
- Does the bare minimum required to get OSDSYS to accept and "decompress" our payload
- Actually increases the file size
BOOT_PATH must be relative to mc0/mc1, e.g. BOOT/BOOT.ELF
Browser update
During initialization, protokernel OSDSYS checks for a Browser (MBROWS) update manifest in mc1:/BIEXEC-SYSTEM/ and mc0:/BIEXEC-SYSTEM/.
The manifest file is called OSBROWS and consists of just three lines:
101 — module version, must be higher than 100
PROTPWN — module filename, relative to `BIEXEC-SYSTEM`. Cannot exceed 7 characters
007a0000 — module load address
When this file exists, OSDSYS will parse it, load the specified file at 0x1000000 and decompress it to the specified load address. This module is then executed as the OSD Browser thread function.
When this file exists, OSDSYS will parse it, load the specified file at 0x1000000 and decompress it to the specified load address. This module is then executed as the OSD Browser thread function.
Similar to __mbr, this module must be headerless, with its entry point located at the beginning of the payload.
For some reason, unlike system updates, the Browser update is completely unencrypted, has no intergrity or validity checks and uses a fairly unsophisitcated compression scheme that can be easily bypassed.
Thus, it is possible to get code execution just by creating a custom payload that will run in the Browser thread.
Module compression
OSD modules are always compressed. The compression scheme is block-based and structured as follows:
<4-byte uncompressed payload length in little endian>
<4-byte block descriptor>
<30-byte block>
<4-byte block descriptor>
<30-byte block>
...
The block descriptor marks whether the byte in this block is compressed and contains the byte shift and byte mask used to unpack the bytes.
The block descriptor marks whether the byte in this block is compressed and contains the byte shift and byte mask used to unpack the bytes.
The OSDSYS unpacker stops processing right after reaching the declared payload length, ignoring all trailing bytes.
To bypass the compression, the uncompressed payload can be written as-is, with the length header at the start of the payload and four null bytes preceding each 30-byte block.
See osdpack code for more details.
Credits
- Julian Uy for reverse-engineering the OSDSYS decompression code
- Matías Israelson for giving me a reason to explore this further
Sources & Additional Details:
.
- GitHub: https://github.com/pcm720/protopwn
- Video:
- Discussion thread: https://www.psx-place.com/threads/protopwn.47696
Last edited by a moderator:
