On the historical PSP (PlayStation Portable) console on firmware version 5.03 there used to be a thumbnail-based exploit called HEN-C. It worked (under a race condition I presume since it didn't work every single time) by viewing a picture thumbnail of an splashed egg and a binary encoded (?) picture thumbnail, which was the payload itself I would presume. The exploit was used to load so called CFW (custom firmware) onto the device, which is basically a jailbroken/modified ROM.

My questions would be:

  • I'm guessing the exploit used a flaw in the thumbnail parser, is that correct?
  • How did it actually work?
  • What was the exact flaw/programming mistake in the firmware that allowed this?
  • Was there been any similar exploits on PC as well? (yes I've searched exploit-db.com already with no avail...)
  • Is it possible to find the source code for it somewhere for historical reasons?

All I could find online, that is relevant (besides lots of YouTube videos with annoying buzzing in the background) is this source code for the newer procfw https://github.com/wicanr2/procfw, which appears to be irrelevant to the exploit apparently...

  • 1
    Sounds like a buffer overflow exploit, where data loaded into memory is not bounds checked and overflows into memory reserved for code. When the code is run, the data is interpreted instead. Jan 24, 2022 at 20:32
  • And indeed it is... myce.com/news/… Jan 24, 2022 at 22:52
  • 1
    @MarkWilliams this is firmware version 2 it seems? Also on the Security StackExchange there was already a comment that supposedly it was a memory corruption bug, so there's a conflict kind of here. But thanks for the info nonetheless. Jan 25, 2022 at 18:28
  • 3
    @SirMuffington Well, a buffer overflow is a type of memory corruption bug...
    – user23900
    Jan 25, 2022 at 20:49


You must log in to answer this question.

Browse other questions tagged .