researched exploit a possibility?

[masterj001]

ok. I'll keep looking into it.

Advertising

[m0skit0]

Ahm... still

it loads all the data from flash1 into flash0

makes no sense.

Anyway, this could only work if the thread loading f1 files you want to exploit actually has f0 permissions.

Advertising

[bluemimmosa]

Whats the point of loading flash 1 files in flash0 or having write access in flash0 until u cant influence the chain of trust or u cant load a self created arbitary module, which seems to be impossible without a kernel exploit.

[some1]

Ahm... still

it loads all the data from flash1 into flash0

makes no sense.

I agree with m0skit0, that doesn't really make sense.

However, if this were to happen, it would depend on the module that you are exploiting. If it is a kernel module, then I guess you might be able to gain kernel access, but if it was a vsh module, then you'd still have to trigger a kernel exploit. Although, if this were to be done, no point at all to release it now, only to save some lazy ppl 20~ seconds.

[Strangelove]

I doubt you'll be able to exploit the registry itself, that kind of code isn't likely to be exploitable.

But I was thinking about what TIPI said about fonts. It looks like you are able to control which fonts the VSH uses via the registry (haven't confirmed this btw.) and so you should be able to load a specially crafted font file during boot of VSH. The chances of finding exploits in the font rendering code should be much better.

[m0skit0]

I doubt you'll be able to exploit the registry itself, that kind of code isn't likely to be exploitable.

You're wrong. The exploitable target is the code handling the registry values. As any other code, it's vulnerable.

The chances of finding exploits in the font rendering code should be much better.

True, but despite TiPi's hard tries back on advancedpsp, he did not succeed in finding exploitable vulnerabilities.