forums.ps2dev.org

qubitz · Joined: 03 Apr 2005 Posts: 32

Has anyone tried assembling a simple program and using it as data.psp? In our effort to port Linux to the PSP (sf.net/projects/psplinux), we've been looking for ways to get code running on the PSP and one of our experiments yeilded an interesting result. We assembled a simple code, such as this:

annerajb · Joined: 31 Mar 2005 Posts: 40

if you could guide us on how did you did that it will be great .

pixel · Joined: 30 Jan 2004 Posts: 791

Or maybe it got "decrypted", which led to invalid instructions, shutting off the psp...
_________________
pixel: A mischievous magical spirit associated with screen displays. The computer industry has frequently borrowed from mythology. Witness the sprites in computer graphics, the demons in artificial intelligence and the trolls in the marketing department.

ChaosKnight · Joined: 14 Apr 2005 Posts: 142 Location: Florida, USA

Interesting. I'm looking at the header of the PSP critically now. It may be possible to run an unencrypted file, so something like this would be helpful. Can anyone post some kind of assembly loop code in hex? Something like

label0: jmp label0

Would be good, just enough to get it to hang.
_________________
w00t

pixel · Joined: 30 Jan 2004 Posts: 791

Awww, come on... be a bit serious. You guys have no idea about what you're doing, are you ?

qubitz · Joined: 03 Apr 2005 Posts: 32

I never claimed that it was executing my code. I know about ELF files, as and ld. Sorry I didn't get too technical in my post. I just figured that anyone who might be able to help me would know what I was talking. I'll make sure to sound more technical, to establish more credibility with you, mmkay pixel?

I knew that something strange was going on causing the PSP to shut off, and I knew that it wasn't executing the code. But I did know that the PSP was shutting off when the file wasn't linked, which meant to me that it was treating it differently. Sure, it could have been random garbage that came out when the PSP tried to decrypt it, but of all the tests I've done, all the code I tried, it always came out the same way when it wasn't linked. So I doubt that the changes from the linker caused it to decrypt differently and not crash.

I thought that this information was important enough to share. So if you don't want to scare people from sharing new information, maybe you would refrain from flaming them as soon as they do so.

qubitz · Joined: 03 Apr 2005 Posts: 32

Also, it's not the j 0 that causes the crash. I've run other tests that did not contain that command that came up with the same results.

ChaosKnight · Joined: 14 Apr 2005 Posts: 142 Location: Florida, USA

Pixel, are you sure it's an ELF? If they are using a loader (most OSes do) it's very likely doing a few things using the header first.

Seems like there are three offsets from what MelGibson/oopo have put together which I can only assume are .bss, .text, .data, in whatever order. So maybe ELF wrapped in something else?

Here's a brief based on what I saw MelGibson put together (he used long, i use int) of what the suspected header is:
char[4] = "~PSP"
int = 0x00080000 (version?)
short = 0x0101 (?)
char[28] = Text
short = 0x0102 (?)
int = File Size - 336
int = File Size
int x 3 = Offsets?
short x 2 = 0x40 (64)
int x 2 = 0x00000000
int = 1067008
int x 2 = 0
int = 1067008
int = 2553296
int x 8 = 0
int = 12
int x 12 = Encrypted Data? MD5 Checksum?
int = File Size - 336
int = 0x80 (128) Encryption?
int x 6 = 0x00000000

But you seem to know a lot pixel, maybe you can hack together some kind of test, that's what I'll be doing. Also I was asking for hex codes (as in hand-built assembly) but I'll do that myself after studying up on this processor and its instruction set and related subjects for hand-building assembled instructions.
_________________
w00t

Neil Stevens · Joined: 27 Jan 2005 Posts: 79 Location: California

Uh, what makes ELF binaries incompatible with a "loader?" How do you think ELF-formatted code gets into memory? Osmosis?

ChaosKnight · Joined: 14 Apr 2005 Posts: 142 Location: Florida, USA

Neil - The ELF is likely wrapped in the PSP file and not a "plain-vanilla" ELF. The PSP file seems to have offsets to support ELF sections.
_________________
w00t

pixel · Joined: 30 Jan 2004 Posts: 791

Okay, now, you sound more reasonable. Beause all in your first post lead to "it's running our code!". Look at ChaosKnight reply: he's actually thinking the code was run.

Now, for me, it's REALLY doubtful that the PSP run ELF files bare, or that would be a real, big, ugly, mistake from SONY.

SO, to get back on track: yes, you got a file that can get the psp to shut down. Okay, now, I suggest you take this file, and change some bytes in it, in order to get what EXACTLY is getting the PSP to shut down. Because I guess the normal elf headers won't really be useful, especially since you're having a .o file here.
_________________
pixel: A mischievous magical spirit associated with screen displays. The computer industry has frequently borrowed from mythology. Witness the sprites in computer graphics, the demons in artificial intelligence and the trolls in the marketing department.

ChaosKnight · Joined: 14 Apr 2005 Posts: 142 Location: Florida, USA

qubitz · Joined: 03 Apr 2005 Posts: 32

Origionally I said:

pixel · Joined: 30 Jan 2004 Posts: 791

I think it's just a coincidence: please try other tests.
_________________
pixel: A mischievous magical spirit associated with screen displays. The computer industry has frequently borrowed from mythology. Witness the sprites in computer graphics, the demons in artificial intelligence and the trolls in the marketing department.

qubitz · Joined: 03 Apr 2005 Posts: 32

Well since I'm sure that its not the j 0 that does it, and I've assembled a variety of code samples and tried lots of things, and the only consistency that I have come up with is that when I don't link I get the crash, what other tests do you think I should try?

I'm looking for suggestions.

pixel · Joined: 30 Jan 2004 Posts: 791

So, every time you don't link, you get the shut down, that's about it ?
_________________
pixel: A mischievous magical spirit associated with screen displays. The computer industry has frequently borrowed from mythology. Witness the sprites in computer graphics, the demons in artificial intelligence and the trolls in the marketing department.

qubitz · Joined: 03 Apr 2005 Posts: 32

pixel · Joined: 30 Jan 2004 Posts: 791

Okay. There's only a small flag which differentiate a .o from a .elf file. You can try to tweak this flag to see what happens in the psp. Still, as "flag", I still think it's a coincidence that this byte just happen to do something special in the PSP.

If you look at any elf header (.o or linked .elf file), you should get the following magic:

qubitz · Joined: 03 Apr 2005 Posts: 32

Thanks for that bit of info. I checked it out and the ELF type doesn't change. It was x01 after assembly, and remained x01 after linking. So it must be something else...

qubitz · Joined: 03 Apr 2005 Posts: 32

Here's a sample. For some reason though, there are about FFF zero bytes in the linker output before the symbol table. I'm not sure why this would happen...

Anyways..here is the sample asm:

pixel · Joined: 30 Jan 2004 Posts: 791

Okay. More details requested. What do you call "when I put it thru ld" ? because the second file is still a .o file.
_________________
pixel: A mischievous magical spirit associated with screen displays. The computer industry has frequently borrowed from mythology. Witness the sprites in computer graphics, the demons in artificial intelligence and the trolls in the marketing department.

qubitz · Joined: 03 Apr 2005 Posts: 32

qubitz · Joined: 03 Apr 2005 Posts: 32

Ooops I meant to write -T and not -x.

pixel · Joined: 30 Jan 2004 Posts: 791

Okay, sorry: I misread my code. The byte telling if an ELF file is a .o or a linked .elf is the 16th one. And, indeed, you can see that there's a 01 in the first file, and a 02 in the second one. My bad.
_________________
pixel: A mischievous magical spirit associated with screen displays. The computer industry has frequently borrowed from mythology. Witness the sprites in computer graphics, the demons in artificial intelligence and the trolls in the marketing department.

qubitz · Joined: 03 Apr 2005 Posts: 32

Ah yes..I did notice that it changed from 01 to 02. So its linking correctly...

lmx · Joined: 01 Apr 2005 Posts: 25

umm, lol. so you think it's running decrypted program code?

psp kernel bails as soon as it finds something awry with an encrypted elf. you are just getting executabe corrupt errors.

try again

qubitz · Joined: 03 Apr 2005 Posts: 32

Not exactly. There's no way that these decryption errors only appear when a file has not been linked.

Think about it. A non-linked ELF: Crash the PSP. A Linked ELF: Loading error that doesn't crash the PSP.

The PSP is reading the ELF file regardless of encryption.

Try again.

ChaosKnight · Joined: 14 Apr 2005 Posts: 142 Location: Florida, USA

pixel · Joined: 30 Jan 2004 Posts: 791

Test it: take a linked elf file, change that 02 into a 01, and run it. See what happens...
_________________
pixel: A mischievous magical spirit associated with screen displays. The computer industry has frequently borrowed from mythology. Witness the sprites in computer graphics, the demons in artificial intelligence and the trolls in the marketing department.

qubitz · Joined: 03 Apr 2005 Posts: 32

I've never claimed that it's actually running the code, or that it even will. But I am claiming that the PSP does care that the file is not linked, which to me indicates that it's reading the ELF file.

However, I am doing more experiments and I will post back with my findings. I'd like it if anyone else tried to repeat my experiment and see what they get.