aki teneis para los que no pierden la esperanza:
Originally Posted by FreePlay
Fanjita,
I sort of doubt that you'll read this thread again (since you're of the opinion that it's not going to help), but I've got a question for you. In the scePaf module, there are a number of functions related to PNG images:True, most of these seem just like libpng functions, and are of little use to us. However, the sce_png_read function could (as unlikely as it is) have something vulnerable in it.
If you've any more input to give, great. If not, also OK.
---------------------------------
Interesting spot, it could be useful I guess. If you're able to find the sce_png_read func and get some disassembly of it, I'd be interested to see it.
If you want to find out how to go about finding classic vulnerabilities, then generally it's worth doing these 2 things:
- read various issues of Phrack. Smashing the Stack is the classic, but there are many other interesting articles to be found.
- Google for the Smashing the Stack doc. You'll turn up lots of interesting material in the various archives that hold that doc.
If you're looking for classic stack overflows (and let's face it , they're the easiest, usually) then typically you'll search for stack allocations of an interesting size. Stuff < 100 bytes is usually just local variable allocation, but larger than that can sometimes be an interesting vulnerable stack -based buffer (as in the GTA case).
Stack manipulation instructions will usually be
ADDIU SP, SP, (or -) - pretty easy to grep for in disassembly.
---------------------------------
Pues aqui lo teneis valorando la idea de FreePlay sobre la libreria png q podria estar usando sony y q podria estar modificada, fanjita dice q si freeplay es capaz de desamblar y averiguar la funcion de sce_png_read estaria muy interesado en echarle un vistazo. Despues le da una explicacion breve de como encontrar una vulnerabilidad y donde localizarla (esto para los que no han perdio la esperanza del nuevo bug )
PD:post copiado de otro espero que me perdone el autor