Hackers Boot Custom Firmware on PSP 3000 Using GripShift

Kris Erickson • Jan 13, 2009 • Comments (2)

If the video below turns out to be real, then it looks like the PSP 3000's recent run of 87 days without being hacked has come to an end. A team of French hackers have succeeded in booting custom firmware and running homebrew software on a PSP 3000 unit by exploiting a buffer overflow bug in the game GripShift. The team used a European copy of the game to achieve the result, however the same hack could also work with the American version of the game (currently selling for more than $100 on ebay).

The hacker group, which calls itself PSPGEN, has designed what they are calling the GripShift HEN loader. This code functions in a manner very similar to early homebrew loaders like Dev Hook. It allows the user to reboot the PSP 3000 into a homebrew-enabled mode, which allows unauthorized code to be run on the device.

The HEN loader does not flash the PSP firmware, so the team is not yet ready to call it “custom firmware”. This is because the Pre IPL security on the PSP 3000 has not yet been decrypted. The team is also refusing to release their exploit to the public, arguing that once it comes out, Sony would be quickly able to patch the security flaw and block further progress. Presumably, the team is waiting until they are able to effectively flash a new firmware to the device before releasing their code.

We expect that Sony will be issuing an update to the official firmware very soon.