| View previous topic :: View next topic |
| Author |
Message |
Thanhda
Joined: 09 Apr 2005
Posts: 331
Location: Canada
|
 Posted: Sun May 08, 2005 3:24 am Post subject: |
 |
|
| nem wrote: | | Orion_ wrote: | I can't understand how work the call to kernel function.
does the numbers in startup.s are the address of the functions in kernel/memory ?
how did you find them and what was their parameters ? |
I dumped the firmware of PSP by electrical means. Peel off the memory chip from PSP mainboard, connect wires to the chip, find which ball is what, and dumped. In the dumped firmware, there are executables. They are mostly encrypted but there does exist unencrypted executables, by which I learned how dynamic link is done.
Another key stayed in 'PBP Exploit Success... but only on 1.0 psp :(' thread. The posts in the thread brought to me inspiration and valuable information. I want to express my best thanks to them all. Unless they point out that ELF file can be executed, it would take more time.
Importing system call seems to be done by loader of PSP system as follows:
- Module or system call group is choosed by ascii string 'module' of STUB_START
- Systemcall is specified by 32bit ID, 'funcid' of STUB_FUNC, and loader searchs from the list
- Loader patches nop in .text.stub to syscall |
hey nem why dont you upgrade to 1.5 and do the same, then hopefully we could start programming in 1.5
_________________
There are 10 types of people in the world: Those who understand binary, and those who don't... |
|
| Back to top |
|
 |
Orion_
Joined: 27 Jan 2005
Posts: 69
|
| Posted: Sun May 08, 2005 3:34 am Post subject: |
|
|
you don't understand that 1.5 run only Encrypted program !?!
you must encrypt the elf, else it will not work ... |
|
| Back to top |
|
|
Thanhda
Joined: 09 Apr 2005
Posts: 331
Location: Canada
|
| Posted: Sun May 08, 2005 3:37 am Post subject: |
|
|
ah damn thats sucks. man, i need a 1.0 then.
_________________
There are 10 types of people in the world: Those who understand binary, and those who don't... |
|
| Back to top |
|
|
Krevnik
Joined: 09 Mar 2005
Posts: 71
|
| Posted: Sun May 08, 2005 5:58 am Post subject: |
|
|
| Actually, what we really need is a dump of 1.5, so it doesn't matter. Sure 1.5 only runs encrypted apps (because of a bug fixed in 1.0), but we kinda need to know where that bug was (we can compare the two and find the spots that changed, and probably hit on the bugfix) to help us find where encryption takes place on the PSP, and get code running on 1.5+ firmware. |
|
| Back to top |
|
|
Herman
Joined: 05 Apr 2005
Posts: 13
Location: Montreal, Canada
|
| Posted: Sun May 08, 2005 12:18 pm Post subject: |
|
|
| Can you at least give us the file/directory structure? |
|
| Back to top |
|
|
lmx
Joined: 01 Apr 2005
Posts: 25
|
| Posted: Sun May 08, 2005 1:31 pm Post subject: |
|
|
file directory to the firmware? it might have a set of modules all linked together in binary block.
you may as well ask for a hexdump |
|
| Back to top |
|
|
Herman
Joined: 05 Apr 2005
Posts: 13
Location: Montreal, Canada
|
|
| Back to top |
|
|
nem
Joined: 13 Jan 2005
Posts: 73
|
| Posted: Sun May 08, 2005 2:31 pm Post subject: |
|
|
There are strong inquiry for dumped firmware.
I am very sorry to say that I can not email/share/post the dumped firmware to anyone, at least for now.
Not only ooPo, but someone may claim distribution of dump as a intellectual property right infringement.
Technically speaking, I can not distinguish someone :) from someone :( . So I can not respond to even a personal request by private message or something like that. Your understanding is most appreciated.
Most part of firmware is organized as FAT12 filesystem. There is a way to get firmware files by software means, I think. Every key you need is already available in this forum. All we need is just to write some small code for that. Briefly, use flash0: and sceIo functions. |
|
| Back to top |
|
|
mrbrown
Joined: 17 Jan 2004
Posts: 1536
|
| Posted: Mon May 09, 2005 6:59 am Post subject: |
|
|
| Repeated warnings ignored, split and locked. |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
