Tony Hawk's Pro Strcpy (icode4.coffee)

Article summary

The article describes the process of exploiting a buffer overflow vulnerability in the game Tony Hawk's Pro Skater 4 to gain arbitrary code execution on the original Xbox console. The vulnerability is caused by the use of the strcpy function, which copies a string from a game save file to a buffer on the stack without checking its length. The author of the article used this vulnerability to create a save game exploit that can be used to run unsigned code on the console. The exploit was also tested on other games in the Tony Hawk series, including Tony Hawk's Pro Skater 3 and Tony Hawk's Underground 1 & 2.

Main themes

• Xbox exploitation
• Buffer overflow vulnerability
• String copying functions
• Game save exploits
• Console hacking
• Code execution

What commenters say

• The use of strncpy is not safer than strcpy because it can produce unterminated strings when it hits the maximum length.
• The preferred solution for safe string copying is to use a function like strlcpy, which prevents buffer overflows and ensures null-termination.
• Some commenters argue that strlcpy is still flawed and that a better approach would be to use a function that returns the number of bytes copied and indicates whether the copy was truncated.
• Others suggest using a proper C string library like SDS or moving to a language like C++ with bounds checking enabled.
• There is disagreement over the best way to handle string truncation, with some arguing that it is better to facilitate the use case of reallocating the buffer to fit the truncated string, while others think it is better to close the connection and log an error message.
• Some commenters recommend using strlen and memcpy instead of strlcpy for performance reasons on superscalar platforms with branch prediction.
• The use of stralloc, as seen in the qmail code, is suggested as a good approach for general-purpose string handling, but it requires checking every single copy or concatenation operation for out-of-memory errors.
• It is argued that getting out-of-memory handling correct is very difficult and that it may be better to abort inside the memory allocation function if memory runs out.