Psychic Paper: iOS Sandbox Escape

Re:Psychic Paper: iOS Sandbox Escape by Negitivefrags on Friday May 01, 2020 @05:39PM (#23046800)

This reminds me a lot of one of the original ways to run unsigned code on the Sony PSP.

If you made two directories:

    SomeApp
    SomeApp%

And then launch the folder with the % sign then the code that checks for valid signatures will check in the directory without the %, but the code that actually launches the binary will still run the code in the directory with the %.

So all you need to do is get any binary with a valid sig and put it in the SomeApp folder while putting the code you actually want to run in SomeApp%.

[ Parent | on HN ]

Re:Psychic Paper: iOS Sandbox Escape by ancarda on Saturday May 02, 2020 @08:14AM (#23051287)

Why did this happen? Was "%" significant in some way? i.e. maybe it was passing the path to sprintf?

[ Parent | on HN ]

Re:Psychic Paper: iOS Sandbox Escape by Negitivefrags on Saturday May 02, 2020 @03:08PM (#23054102)

Yep, that’s exactly it. And of course a lesson on why you need to understand the progeny of any string you pass as a format argument.

[ Parent | on HN ]

Re:Psychic Paper: iOS Sandbox Escape by DividableMiddle on Friday May 01, 2020 @09:55PM (#23048404)

Any other PSP homebrew facts or resources you could share? The psp scene was my introduction to running modding.

[ Parent | on HN ]