---

Wow, this was quick… apparently some guys managed to override the PSP Tiff patch implemented in the 2.50 firmware by using a modified save game file

Tradional PBP and SAVEGAME Layout
-ULUS100xxxx or EBOOT
–Param.SFO (tells how the psp handles the file: e.g. title – update ver. 2.51)
–icon0.PNG (icon)
–icon1.PMF (almost like a short movie clip <500kb
–pic1.PNG (background for pile that appears when you look at the file)
–SND0 (background sound-not in most saves or EBOOTs)
–Data file/data.psp (name vary depending on game saves…data.psp is the name when in eboots)
–Data.psar(only in eboots)

Well my Exploit contains…
–Param.SFO (tells how the psp handles the file: e.g. title – update ver. 2.51)
–icon0.PNG (icon-overflow.tif)
–icon1.PMF (blank PMF found in iso rip kits)
–pic1.PNG (background for file-framebuffer)
–SND0.AT3 ( small randow sound clip)
–Data file/data.psp (from v1.5)
–Data.psar(from v1.5)
and…
–Pic0.PNG (overflow.tif)

My Original Idea For The Exploit
1)the icon0 would be set to the overflow.tif
2)pic1 the framebuffer image
3)the 2 data files as 1.50s data files
4)SND0.AT3 a music file >20mb
5)ICON1 the blank pmf found in iso rip kits
6)Param file set to be read as updater version 2.51
7)pic0 overflow.tif resized to 272×480

Only one thing from my original blueprint wasn’t used : the AT3 file is 5kb

How This Works
This
works by overloading the psp audio with a glitch sound, and overloading
the image handler with overflow.tif, thus in conjuction overriding the
TIF patch.

In other news: Sony releases the PSP 2.51 firmware update in a week from now which blocks the new exploit and according to Sony “protects your PSP from malicious software”…