| View previous topic :: View next topic |
| Author |
Message |
nem
Joined: 13 Jan 2005
Posts: 73
|
 Posted: Fri May 06, 2005 10:46 pm Post subject: Firmware file system access via wipeout browser |
 |
|
As Vampire posted at dev forum, UMD file system can be accessed via wipeout browser using file://disk0:/...
Firmware, or on-board flash chip file system can be accessed by same way using flash0 as drive string.
| Code: | | <a HREF="file://flash0:/vsh/etc/version.txt">version.txt</a><br> |
Only .txt can be accessed. .cer .prx .rco .bmp unreachable maybe because browser does not follow link if extention is not txt or png or so. I tried some but I can not, but there could be a way.
flash0: is system file volume. config file volume also can be accessed i think but i have not tried.
It is pretty useless but for your interest. |
|
| Back to top |
|
 |
nem
Joined: 13 Jan 2005
Posts: 73
|
| Posted: Fri May 06, 2005 10:57 pm Post subject: |
|
|
I should post some specimen.
| Quote: | Firmware version 1.00
release:1.00:
build:228,0,3,1,0:root@psp-vsh
system:17919@release_103a,0x01000300:
vsh:p4029@special_day1,v9972@special_day1,20041201: |
| Quote: | Firmware version 1.50, updated from 1.00
release:1.50:
build:376,0,3,1,0:root@psp-vsh
system:20182@release_150,0x01050001:
vsh:p4201@release_150,v11079@release_150,20050201: |
| Quote: | version.txt of Leaked firmware. Not obtained by browser. FYI :)
release:1.00:
build:106,1:root@psp-vsh
system:16214,0x00100000:
vsh:2004_1104_s16214_p3883_v8335: |
|
|
| Back to top |
|
|
Drakonite
Site Admin
Joined: 17 Jan 2004
Posts: 989
|
| Posted: Sat May 07, 2005 1:59 am Post subject: |
|
|
Has anyone tried setting up a link that posts a file?
I would assume the browser probably doesn't support the right HTTP stuff, but assumptions are dangerous and I don't have one here to try with..
_________________
Shoot Pixels Not People!
Makeshift Development |
|
| Back to top |
|
|
ooPo
Site Admin
Joined: 17 Jan 2004
Posts: 2032
Location: Canada
|
| Posted: Sat May 07, 2005 4:27 am Post subject: |
|
|
| Leaked firmware, eh? How did you manage that? :) |
|
| Back to top |
|
|
vvuk
Joined: 25 Apr 2005
Posts: 13
Location: Foster City, CA
|
| Posted: Sat May 07, 2005 4:38 am Post subject: |
|
|
| ooPo wrote: | | Leaked firmware, eh? How did you manage that? :) |
Is this the leaked breaks-your-PSP firmware? Or another? If it's the leaked one, it certainly seems like someone packaged together a 1.0 firmware... perhaps it's the firmware for the PSP development boxen? |
|
| Back to top |
|
|
Warren
Joined: 24 Jan 2004
Posts: 173
Location: San Diego, CA
|
| Posted: Sat May 07, 2005 4:45 am Post subject: |
|
|
| ooPo: I think by leaked firmware he's referring to the same FW that killed your PSP |
|
| Back to top |
|
|
ooPo
Site Admin
Joined: 17 Jan 2004
Posts: 2032
Location: Canada
|
| Posted: Sat May 07, 2005 4:47 am Post subject: |
|
|
| I'm impressed he took the effort of flashing with it to dump it off the chip. |
|
| Back to top |
|
|
Warren
Joined: 24 Jan 2004
Posts: 173
Location: San Diego, CA
|
| Posted: Sat May 07, 2005 5:51 am Post subject: |
|
|
| Nem: have you tried the elf loader from 1.0 on a 1.5 system? |
|
| Back to top |
|
|
nem
Joined: 13 Jan 2005
Posts: 73
|
| Posted: Sat May 07, 2005 5:59 am Post subject: |
|
|
Ah, I already menthioned flashing in another thread. I need more sleep. my head sucks.
I have not try to replace loader after I can execute some PBPs on 1.0. Listed in TODO list. |
|
| Back to top |
|
|
Herman
Joined: 05 Apr 2005
Posts: 13
Location: Montreal, Canada
|
|
| Back to top |
|
|
lmx
Joined: 01 Apr 2005
Posts: 25
|
| Posted: Sun May 08, 2005 1:16 pm Post subject: |
|
|
theres firmware images in the official sdk, for devkit, most likely will hang consumer units.
don't forget umds contain firmware updates too, so flash your firmware, play a game off umd, and patch mismatch skullduggery beckons |
|
| Back to top |
|
|
Pikoro
Joined: 13 Jan 2005
Posts: 56
|
| Posted: Sun May 08, 2005 5:01 pm Post subject: |
|
|
| Drakonite wrote: | Has anyone tried setting up a link that posts a file?
I would assume the browser probably doesn't support the right HTTP stuff, but assumptions are dangerous and I don't have one here to try with.. |
Yah, volksport (pspirc.com) and I spent about 4 hours going over this and trying to find a way to get the psp to send a file. Sony has blocked text input into a file input box.
On top of that, you can't autofill the field with either value= or any type of javascript.
This is to prevent people from automatically downloading files from people's systems.
But the little extra of not allowing anyone to fill in the inputbox at all was extremely frustrating.
here's the link to my test stuff: http://www.psphacks.net/forums/viewtopic.php?t=718 |
|
| Back to top |
|
|
Phour20
Joined: 06 May 2005
Posts: 26
|
| Posted: Sun May 08, 2005 5:07 pm Post subject: |
|
|
i havent sent a file but using a form on my website that can be found in a dif link, I was able to have the a Text file that i filled out on my PSP sent to the webserver.. Not sure if this is much help but the form was something that frontpage had set up for me.. I just left it.. It prob creates it server side.. But I did find it interesting that it did indeed work..
edit - just wanted to add a link to the text file that was created using the form..
http://home.new.rr.com/pspscene/feedback.txt |
|
| Back to top |
|
|
Shine
Joined: 03 Dec 2004
Posts: 728
Location: Germany
|
| Posted: Mon May 09, 2005 6:18 am Post subject: |
|
|
| Pikoro wrote: | On top of that, you can't autofill the field with either value= or any type of javascript.
|
You can send data created by javascript, see for example this thread. But this may not help in sending files from the PSP to a server. |
|
| Back to top |
|
|
Phour20
Joined: 06 May 2005
Posts: 26
|
| Posted: Mon May 09, 2005 10:54 am Post subject: |
|
|
playing w/ the script above I am able to look at the new text files posted from the file list dump of the 1.0
in //flash0:/KD/
pspbtcnf.txt
pspbtcnf_game.txt
pspbtcnf_updater.txt
pspcnf_tbl.txt
what I found is anywhere there is a space in the file name.. UNDERSCORE must be used.. I was getting the Network Connection screen when just using spaces.. These files can be viewed and exist on the 1.5 firmware also but I have know clue what happens if you view them on 1.0.. in 1.5 they seem to be encrypted cuz I dont get plain text and they arent readable..
I wanted to see what was contain'd in them due to the fact that they seem to hold config data for button configurations (thats my guess from the names)
Hope this can be of some help.. prob not but anyways..
Thanks NEM for givin us so much to play with.. |
|
| Back to top |
|
|
skippy911
Joined: 06 May 2005
Posts: 46
|
| Posted: Mon May 09, 2005 11:48 am Post subject: |
|
|
| Phour20 wrote: | playing w/ the script above I am able to look at the new text files posted from the file list dump of the 1.0
in //flash0:/KD/
pspbtcnf.txt
pspbtcnf_game.txt
pspbtcnf_updater.txt
pspcnf_tbl.txt
what I found is anywhere there is a space in the file name.. UNDERSCORE must be used.. I was getting the Network Connection screen when just using spaces.. These files can be viewed and exist on the 1.5 firmware also but I have know clue what happens if you view them on 1.0.. in 1.5 they seem to be encrypted cuz I dont get plain text and they arent readable..
I wanted to see what was contain'd in them due to the fact that they seem to hold config data for button configurations (thats my guess from the names)
Hope this can be of some help.. prob not but anyways..
Thanks NEM for givin us so much to play with.. |
They are encrypted on the 1.0 firmware as well. |
|
| Back to top |
|
|
Phour20
Joined: 06 May 2005
Posts: 26
|
| Posted: Mon May 09, 2005 12:16 pm Post subject: |
|
|
| thanks for checkin that out skippy... |
|
| Back to top |
|
|
laichung
Joined: 06 May 2005
Posts: 123
|
| Posted: Mon May 09, 2005 1:29 pm Post subject: |
|
|
I have a question.
if we got the same name file on firmware 1.0 and firmware 1.5
and if we know that two files should have same content.
if we can decrypted file from 1.5 to 1.0 , is that mean we found the key?
and if all the file on firmware 1.5 is encrypted but 1.0 not, the loading speed of 1.5 should be much slower than 1.0 since machine need time to decode the file. is that right? |
|
| Back to top |
|
|
Cogboy
Joined: 19 Jan 2005
Posts: 45
|
| Posted: Mon May 09, 2005 3:55 pm Post subject: |
|
|
I'm not sure if the loading times would be that different as the psp uses a hardware decoder which is a lot faster than doing it through software. as for comparing two similar files in order to extrapolate the key, the above is pretty much the limit of my knowledge on the subject. Maybe someone else knows something?
_________________
"the sony PSP was built by god, to determine who on earth had the best skills to defeat the armies of satan" - Saint Peter. |
|
| Back to top |
|
|
laichung
Joined: 06 May 2005
Posts: 123
|
| Posted: Mon May 09, 2005 4:34 pm Post subject: |
|
|
hardware decode must consume some time , since all the files need decode , but we dont know how much they need. I just assume it will double the time. Anyway , it doesnt matter , the true is that most files inside 1.5 is encoded.
And I hope someone can extract the key soon so that we can run app in 1.5 too.
| Cogboy wrote: | | I'm not sure if the loading times would be that different as the psp uses a hardware decoder which is a lot faster than doing it through software. as for comparing two similar files in order to extrapolate the key, the above is pretty much the limit of my knowledge on the subject. Maybe someone else knows something? |
|
|
| Back to top |
|
|
Shine
Joined: 03 Dec 2004
Posts: 728
Location: Germany
|
| Posted: Mon May 09, 2005 8:28 pm Post subject: |
|
|
| laichung wrote: | | hardware decode must consume some time , since all the files need decode , but we dont know how much they need. I just assume it will double the time. Anyway , it doesnt matter , the true is that most files inside 1.5 is encoded. |
Why do you think that hardware decoding must consume some time? It could be simply one more element in the pipeline from memory, cache etc. to CPU and because it is optimized hardware, it could run at full DMA speed, so there may be perhaps some microseconds latency at start for the addtional pipeline element, but encrypted continuous memory transfer could be as fast as unencrypted. |
|
| Back to top |
|
|
laichung
Joined: 06 May 2005
Posts: 123
|
| Posted: Mon May 09, 2005 8:47 pm Post subject: |
|
|
why I think that decode must consume time , because it will need few more cpu instructions before it can run.
consider two cases:
case 1 : before PSP app run , it will decode all the files it need to run , and then put it into the main memory to run , then the boot time of the app. should be longer that that dont need decode. In this case , the app will run at normal speed , since the file is already decode when in run.
case 2 : those files decode JIT(just in time) , what i mean is , those file will decode when it use , or when PSP access to it.
Then some cpu power will be used to decode the file. But this will make some error if the cpu power is heavily used by other process.
OK , if PSP have a extra chip to decode , and it can decode JIT, this extra cpu should have same clock to the core cpu (or faster , if not , the core cpu may need to wait the decode cpu , this should not be happen)
| Shine wrote: | | laichung wrote: | | hardware decode must consume some time , since all the files need decode , but we dont know how much they need. I just assume it will double the time. Anyway , it doesnt matter , the true is that most files inside 1.5 is encoded. |
Why do you think that hardware decoding must consume some time? It could be simply one more element in the pipeline from memory, cache etc. to CPU and because it is optimized hardware, it could run at full DMA speed, so there may be perhaps some microseconds latency at start for the addtional pipeline element, but encrypted continuous memory transfer could be as fast as unencrypted. |
|
|
| Back to top |
|
|
pixel
Joined: 30 Jan 2004
Posts: 791
|
| Posted: Mon May 09, 2005 8:59 pm Post subject: |
|
|
Nowadays, decoding is like just as fast as a badly coded memcpy. So, when the console reads the crypted module from disc/bios/whatever and load it in memory, the loading could be done via simple crypto (note that rsa is usually employed to do the crypto of a big key which in turn is used in a simplier crypto layer) without too much trouble via an unencryption routine similar to what memcpy should do when loading an unencrypted module.
And if it's an external chip which does the crypto work (just like on ps2 mind you) nowadays some people are able to code rc4 on a quarter of a small asic's surface which work full speed basically.
So, your "it would be much slower" is wrong, human-wise speaking (it's right though, machine-wise speaking: 15ms is much slower than 1ms for a device)
_________________
pixel: A mischievous magical spirit associated with screen displays. The computer industry has frequently borrowed from mythology. Witness the sprites in computer graphics, the demons in artificial intelligence and the trolls in the marketing department. |
|
| Back to top |
|
|
iedoc
Joined: 12 May 2005
Posts: 18
|
| Posted: Sat May 14, 2005 12:14 am Post subject: |
|
|
| i don't know if you guys have figured anything out, but im pretty good at decrypting code, so if you gave me the encrypted code from one file on the v1.0 version, and encrypted code from the same file that should have the same contents from v1.5, i might be able to write a program or just figure out how to decrypt it. |
|
| Back to top |
|
|
pixel
Joined: 30 Jan 2004
Posts: 791
|
| Posted: Sat May 14, 2005 12:21 am Post subject: |
|
|
Wow.
_________________
pixel: A mischievous magical spirit associated with screen displays. The computer industry has frequently borrowed from mythology. Witness the sprites in computer graphics, the demons in artificial intelligence and the trolls in the marketing department. |
|
| Back to top |
|
|
zigzag
Joined: 26 Jan 2005
Posts: 129
|
| Posted: Sat May 14, 2005 1:47 am Post subject: |
|
|
| iedoc wrote: | | i don't know if you guys have figured anything out, but im pretty good at decrypting code, so if you gave me the encrypted code from one file on the v1.0 version, and encrypted code from the same file that should have the same contents from v1.5, i might be able to write a program or just figure out how to decrypt it. |
Anything to back up a claim like that? |
|
| Back to top |
|
|
iedoc
Joined: 12 May 2005
Posts: 18
|
| Posted: Sun May 15, 2005 3:31 am Post subject: |
|
|
| sorry, i thought it was worth a try. i don't have any proof to back it up, but im not very good at this hacking stuff, i know im pretty good at decifering things though. i don't have a v1.0 psp, so i couldn't get a file from that, but i have a v1.5 psp, and if i knew how, i might be able to get a file off of it. |
|
| Back to top |
|
|
Shine
Joined: 03 Dec 2004
Posts: 728
Location: Germany
|
| Posted: Sun May 15, 2005 4:17 am Post subject: |
|
|
| iedoc wrote: | | i might be able to write a program or just figure out how to decrypt it. |
Ok, maybe it is AES encrypted. I don't have the PSP code, but just a quick warm-up for you:
| Code: |
unencrypted: This is a secret text
encrypted: lpclfmgfjddoelfdpnhdhjeokbmoolfmfdckldakbbijknegnahimbbcelfpjndj
|
And something you don't get as easy from the PSP, some Java code, which created the encryption (I've omitted trivial things like class declaration, imports etc.):
| Code: |
public static String asciiEncodeBytes(byte[] bytes) {
StringBuffer out = new StringBuffer(bytes.length * 2);
for (int i = 0; i < bytes.length; i++) {
int high = (((int) bytes[i]) & 0xf0) >> 4;
int low = bytes[i] & 0xf;
out.append((char) (high + 'a'));
out.append((char) (low + 'a'));
}
return out.toString();
}
public static byte[] asciiDecodeBytes(String bytes) {
int len = bytes.length() / 2;
byte[] result = new byte[len];
int j = 0;
for (int i = 0; i < len; i++) {
int high = (int) (bytes.charAt(j++) - 'a');
int low = (int) (bytes.charAt(j++) - 'a');
result[i] = (byte) ((high << 4) | low);
}
return result;
}
private static Cipher cip;
private static Key key;
private static void initAes() throws InvalidKeySpecException, NoSuchAlgorithmException, NoSuchPaddingException {
if (cip == null) {
// create key
final byte keyArray[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
key = new Key() {
public byte[] getEncoded() {
return keyArray;
}
public String getAlgorithm() {
return "AES";
}
public String getFormat() {
return "RAW";
}
};
// create cipher object
cip = Cipher.getInstance("AES/ECB/PKCS5Padding");
}
}
public static String aesEncrypt(String text) throws IOException, GeneralSecurityException {
if (text == null)
return text;
initAes();
cip.init(Cipher.ENCRYPT_MODE, key);
byte[] input = text.getBytes("utf8");
ByteArrayOutputStream outs = new ByteArrayOutputStream();
CipherOutputStream cout = new CipherOutputStream(outs, cip);
cout.write(input);
cout.close();
return asciiEncodeBytes(outs.toByteArray());
}
public static String aesDecrypt(String text) throws IOException, GeneralSecurityException {
if (text == null)
return text;
initAes();
cip.init(Cipher.DECRYPT_MODE, key);
byte[] input = asciiDecodeBytes(text);
ByteArrayOutputStream out = new ByteArrayOutputStream();
CipherOutputStream cout = new CipherOutputStream(out, cip);
cout.write(input);
cout.close();
return new String(out.toByteArray(), "utf8");
}
|
Now you only have to find the right keyArray values. Bonus: encrypt some own text, I'll verify it. If you've managed this, you can start to think about the PSP crypting. |
|
| Back to top |
|
|
iedoc
Joined: 12 May 2005
Posts: 18
|
| Posted: Mon May 16, 2005 11:22 am Post subject: |
|
|
| i don't do java |
|
| Back to top |
|
|
iedoc
Joined: 12 May 2005
Posts: 18
|
| Posted: Mon May 16, 2005 1:01 pm Post subject: |
|
|
| i almost had it, but i guess not. i might be able to figure it out if i know what out.append((char) was and & 0xf was, im sorry, but i don't anything about java, except it seems to be alot like c++. |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
