Ook PSP met 2.0-firmware gekraakt

First Homebrew Code on 2.00
-----------------------------

1. Set wallpaper to frame_buffer.png (without overflow.tif present
in the PHOTO directory, or it will crash).
2. Add overflow.tif to the PHOTO directory, and open into the photo viewer. Custom code to paint the screen! Or to write a homebrew app! Not to run illegal games.

How It Works?
---------------

1. The PNG contains a small amount of code in a known, fixed place (the VRAM). If to look closely at the wallpaper, sees small coloured pixels in the right down. The pixels are Allegrex opcodes, with the highest byte all zero for the ALPHA. These pixels do:

syscall 0x20C7 ;sceKernelDcacheWritebackInvalidateAll
slt a0, zero, sp ; put 1 into a0
sll a0, a0, 6 ; put 64 into a0
addiu a0, sp, a0 ; get screen painter address over SP
jr a0 ; jump to the screen painter
nop ; branch delay slot


2. The TIFF contains also some code and a buffer to trigger the known BitsPerSample overflow in libtiff in the photo viewer. The buffer makes a jump to the VRAM which has the PNG colours by overwriting the safed ra (return address) on the stack. The VRAM code uses SP and calculates the address of the buffer then runs it. Then it jumps there. The screen is yellow as the colour was 0x12345678 in Hex.