forums.ps2dev.org

PspPet · Joined: 30 Mar 2005 Posts: 210

7 new core PRX modules, 10 new VSH modules.
Not as much as I hoped, but some things look promising for reuse.
[still no USB Hosting ;-< ]

Files added (from 1.52 to 2.00):

gandalf the grey · Joined: 12 Apr 2005 Posts: 34

Do you think it will be possible to flash over just the browser, background, theme functions?
_________________
Fly you fools...

xecuterbox · Joined: 29 Mar 2005 Posts: 10

Are te prx files encrypted in a way we dont know yet, Im not a hardcore coder, but im just wondering if dev peeps might be able to use the prx's to make better homebrew ie web browsers ;)
_________________
owner and administrator of The PSP Place

www.pspplace.com

Matrixdub · Joined: 13 May 2005 Posts: 60

Can you tell me how you were able to dump the flash on a 2.0 machine? Or was it a PBP analyser?

EdwardFMA · Joined: 06 Jul 2005 Posts: 40

has anyone tried comparing flash0:/kd/loadexec.prx with 1.5's flash0:/kd/loadexec.prx i think if we replace all the files,but that one we should still be able to load hombrew and have the Web browser ;) Just a guess might work *shrugs*
_________________
EdwardFMA/IchigoKurosaki - PSP Expert
Athlon 64 - Socket 939 - 3000+
1GB 333 DDR-Ram
Geforce 6600 GT PCI-Express

Orbis PSP Development
Open-Source Development

PspPet · Joined: 30 Mar 2005 Posts: 210

General comment:
My first goal is to learn how the new parts of the system work. After that it *may* be possible to reuse some of the newer modules, loaded from memory stick, in a homebrew app that will only run on a Homebrew capable PSP (1.0 or 1.50 firmware).
LEGAL NOTE: This is copyright friendly since you do all the work (ie. *you* have to download the firmware from the Sony site, and do the ripping on your machine -- don't post the binary bits, they are Sony copyrighted material)
As we learn more, downgrading or other reflashing tricks may be possible, but not yet.
---
> Do you think it will be possible to flash over just the browser, background, theme functions?
Probably not. In general reflashing is too dangerous. Similar to other "downgrading" attempts.
Also some of the higher level components 2.00 (like the web browser) may require updated (2.00) versions of the system components. A hybrid may be possible (loaded from memory stick).

> Are te prx files encrypted in a way we dont know yet
Looks to be the standard way (PRX=encrypted ELF). The core boot/reboot loader needs them to be in encrypted form, otherwise this would be a lot easier.

> Can you tell me how you were able to dump the flash on a 2.0 machine?
Nope. No 2.00 exploit to run homebrew code.
> Or was it a PBP analyser?
Yes, dumping the EBOOT.PBP from the updater (aka PSAR dumping) -- see this thread for more info: http://forums.ps2dev.org/viewtopic.php?t=931&start=30

> has anyone tried comparing flash0:/kd/loadexec.prx with 1.5's flash0:/kd/loadexec.prx i think if we replace all the files,but that one we should still be able to load hombrew and have the Web browser ;) Just a guess might work *shrugs*
Still working on a more detailed analysis, but looking at the size of the PRXs I am doubtful (Version 1.0 is 8KB, Version 2.0 is 63KB !!, compressed PRX size)
I doubt a single file replacement will work for other reasons, and reflashing is too dangerous for random configuration testing.

BTW: This has been suggested before (cut and paste PSAR contents, for downgrading attempts), with few gutsy enough to try the reflashing part.
Originally it was tried with the 1.00 bogus update and the 1.50 contents. This technically can't work because of the way the data is keyed. Fortunately all the current releases (1.50, 1,52, 2.00) use the same encryption key so cut-and-paste tricks *may* be possible. Exploit research is no longer discussed on this BBS, so I'll leave it at that ;->

Krevnik · Joined: 09 Mar 2005 Posts: 71

The huge difference in loadexec must mean something, and I am not talking exploit trash either. Is this responsible for understanding how files are accessed beyond just PSP executable files (multimedia files keyed here to find out how to handle them, perhaps)? If it is strictly tied to executable files, then the huge increase makes no sense, even with the security patches. It is almost as if they are working in support for something that isn't public yet.

Agoln · Joined: 08 Jun 2005 Posts: 326 Location: Fort Wayne, IN

DigitalFoundry · Joined: 20 Jan 2005 Posts: 47

Krevnik · Joined: 09 Mar 2005 Posts: 71

I think Digital Foundary might be onto something, but a difference of *8 times* is far too big for just that. I guess we will find out if someone gets a little curious and takes a peek. (As I am still completely stuck out of the homebrew scene to try it myself, for a couple reasons now) The sort of size difference would practically have to be related to some new format support.

DigitalFoundry · Joined: 20 Jan 2005 Posts: 47

In Sony's eyes, the fact we can run any kind of executable code on 1.0/1.5 PSPs is a bad thing. A very bad thing. The fact that it is possible to read off UMD is another bad thing, whether or not the resultant dumps can be run or not.

Surely the only way to prevent both would be to change the layout of the UMD - the file system itself - in addition to toughening up the validation of encrypted executables. Perhaps the goal is to make all future games incompatible on every level with 1.0/1.5 firmware PSPs.

In this sense, the homebrew and piracy sections of the PSP market would be isolated and contained, and Sony could even make a few extra shekels by getting people who insist on keeping their 1.5 PSPs to buy secondary machines for games playing.

Perhaps that might explain the larger module.

Warren · Joined: 24 Jan 2004 Posts: 173 Location: San Diego, CA

PspPet · Joined: 30 Mar 2005 Posts: 210

RETRACTION:
>> Are the prx files encrypted in a way we dont know yet ?
> Looks to be the standard way (PRX=encrypted ELF). ...

Oops, spoke too soon.
Sony *did* change the ~PSP file format, including new keying options. The existing "prxdecrypter" technology does not work for the PSP 2.0 binaries !-<

Bummer, that makes reusing those libraries on Homebrew compatible PSPs much more difficult.
----
Will post a PSAR dumper soon if someone wants to look at it. The dumper decrypts the PSAR and saves the files that would be written to "flash0:". Will double decrypt the PRXs for disassembly/analysis where it can (not for 2.00).
=======
How this gets re-bootstrapped to handle the new format .PRX files is interesting. If you look in the 2.00 update file list, there is an update to the "IPL" (file is encrypted in some unique way, <256KB in size)
> ipl:/psp_ipl.bin
Very interesting...

Krevnik · Joined: 09 Mar 2005 Posts: 71

Krevnik · Joined: 09 Mar 2005 Posts: 71

I just realized something... Sony is definitely tightening up the PSP a bit from what I am seeing so far, and has created another catch-22 in the process for homebrewers:

2.0 uses an updated encryption mechanism to break the methods currently in use for reverse engineering. This new mechanism exists within the 2.0 update, meaning some modules that are encrypted cannot be decrypted without 2.0 running the software. Ooops.

I am starting to think that there isn't much to see with 2.0 and homebrew for awhile until other issues get tackled, or some people start really doing some interesting Javascript work again.

Warren · Joined: 24 Jan 2004 Posts: 173 Location: San Diego, CA

PspPet · Joined: 30 Mar 2005 Posts: 210

> Sony is definitely tightening up the PSP a bit from what I am seeing so far,...
You bet. They are paid to make homebrew impossible.
They are responsive/reactive as well. They check the public BBSs and tighten up the holes that homebrew hackers find. Even the PSAR format was scrambled to make it harder to understand. I suspect future updates will make it even harder.

Consider this: since the PSP original release (~8 months), there have been 4 firmware updates, all of which have tightened the holes.
[compare that to the NDS or XBOX or PS2 or most other console - many of which are running original release firmware]

---
> The modules that the updater program uses are encrypted with the v1.x keys and the modules inside of the PSAR file are encrypted with the v2.0 keys. I fail to see a catch 22 here.
The problem is that DOUBLE encryption.

The V2.00 update program itself is single encrypted (can be decoded using prxdecrypter on a 1.0/1.50 device, otherwise it wouldn't run)
Some of the V2.00 update data is single encrypted (the bitmaps, .rco files etc)

The more interesting parts are the V2.00 .prx files and they are DOUBLE encrypted. "PSAR Dumper" (the upcoming tool that runs on a Homebrew capable PSP) will extract and decrypt one half of the double encryption.
Those .prx files aren't usable on a Homebrew capable machine because it doesn't understand the 2.00 PRX format.
They are potentially useful on a 2.00 machine, which can't do Homebrew ("catch 22")

My guess/theory is that the IPL update changes a 1.x machine to a 2.x compatible machine. Part of this process will close off the known "homebrew" exploits (1.00 and 1.50), forcing an upgrade to all 2.0 encrypted prx files.
[recap: the Sony engineers are paid to make homebrew impossible]

EdwardFMA · Joined: 06 Jul 2005 Posts: 40

Ok because my curiosity really got to me i upgraded to Version 2 and so far the only thing i've been able to get is how to make it so that your homebrew won't be seen as Corrupted Data and Thats by changing the offset 0x0000004C in PARAM.SFO to "x" or Hex:"78". BTW i love the Browser haven't tried out anything else yet.
_________________
EdwardFMA/IchigoKurosaki - PSP Expert
Athlon 64 - Socket 939 - 3000+
1GB 333 DDR-Ram
Geforce 6600 GT PCI-Express

Orbis PSP Development
Open-Source Development

Warren · Joined: 24 Jan 2004 Posts: 173 Location: San Diego, CA

PspPet · Joined: 30 Mar 2005 Posts: 210

re: double encrypted terminology

The PRXs files are encrypted ELF files, stored as .prx files in flash0 ROM.
For the flash update those pre-encrypted files are stored inside the "PSAR container". The PSAR data is itself encrypted (using a different process)

I call that "double encrypted" -- they are encrypted TWICE using two *different* encryption keys. You may or may not like the term.
You need *both* decryption keys to view them as plain ELF files (to disassemble, find NIDs etc)
For the 1.51/1.52 updates, we have both -- no problem. PSAR dumper will do both steps for you (ie. double-decrypt where necessary giving plain ELF files)
For the 2.00 update, we only have one -- problem.

Warren · Joined: 24 Jan 2004 Posts: 173 Location: San Diego, CA

Souls85 · Joined: 30 Jul 2005 Posts: 21

pardon my n00bness but couldnt you extract the psp encription key from a umd game? somehow?

Agoln · Joined: 08 Jun 2005 Posts: 326 Location: Fort Wayne, IN

Krevnik · Joined: 09 Mar 2005 Posts: 71

shifty · Joined: 16 Jun 2005 Posts: 32 Location: MIT

hi,

we know 2.0japan can upgrade
to 2.0american, thanks to sony's announcement (as fwded by
pspupdates), but what if someone in japan upgrades to
2.0american...can they get 2.0japan back? It might be
nice if we could flip back and forth repeatedly to observe
things...

mrbrown · Joined: 17 Jan 2004 Posts: 1536

Thread has veered way off-topic. Locked.