| View previous topic :: View next topic |
| Author |
Message |
steddy
Joined: 04 Apr 2005
Posts: 139
|
 Posted: Sat May 28, 2005 8:18 am Post subject: Some part of the firmware is still hidden! |
 |
|
Something odd struct me today (and no it didn't hurt).
On the 1.0 firmware, from what I can tell ALL the .prx modules in the kernel directory are encrypted ~PSP files. There doesn't appear to be any executable code on there that isn't.
If this is the case, where the heck is the code that is decoding these files??? It can't be encrypted the same way itself, or it wouldn't be able to decode itself. So if we have a dump of Flash0 and Flash1 and it ain't there, then there must be another area we are missing.
Steddy |
|
| Back to top |
|
 |
Vampire
Joined: 12 Apr 2005
Posts: 138
|
|
| Back to top |
|
|
MindWall
Joined: 10 May 2005
Posts: 70
|
| Posted: Sat May 28, 2005 9:42 am Post subject: |
|
|
so even loser's lflash does not get to everything?
like kbooti.bin ? |
|
| Back to top |
|
|
Vampire
Joined: 12 Apr 2005
Posts: 138
|
| Posted: Sat May 28, 2005 9:47 am Post subject: |
|
|
| MindWall wrote: | | so even loser's lflash does not get to everything? |
yes |
|
| Back to top |
|
|
zigzag
Joined: 26 Jan 2005
Posts: 129
|
| Posted: Sat May 28, 2005 3:28 pm Post subject: |
|
|
| MindWall wrote: | so even loser's lflash does not get to everything?
like kbooti.bin ? |
No, lflash should be able to get at everything. Correct me if I am wrong. |
|
| Back to top |
|
|
konfig
Joined: 06 Jan 2005
Posts: 68
|
| Posted: Sat May 28, 2005 3:51 pm Post subject: |
|
|
"bootstrap area with equipment serial IDs in the flash chip"
What is the equipment serial ID? Is it a hardware matter or a software matter? Can this area be read by electrical means?
If there is really no code to perform decryption, maybe there is some hardware implemented decryption protocol between the psp system and the firmware files. |
|
| Back to top |
|
|
mrbrown
Joined: 17 Jan 2004
Posts: 1536
|
| Posted: Sat May 28, 2005 4:56 pm Post subject: |
|
|
| zigzag wrote: | | MindWall wrote: | so even loser's lflash does not get to everything?
like kbooti.bin ? |
No, lflash should be able to get at everything. Correct me if I am wrong. |
You're wrong. |
|
| Back to top |
|
|
steddy
Joined: 04 Apr 2005
Posts: 139
|
| Posted: Sat May 28, 2005 5:43 pm Post subject: |
|
|
Thanks for the link to PSPDUMP and apologies for covering something mentioned at the top of that thread. Its so long since I read that one I forgot all about it.
How are you so sure its no in the lflash mrbrown? The forum post referenced is only talking about the flash0 / flash1 device interface, not the block interface that was uncovered in the 'list of known devices' thread.
Has anyone got the source to a piece of code that will read the lflash block level device that I can compile? I have a 1.0 PSP now and I would like to dump my own flash. Sorry guys I won't post this up if I do it since thats against the rules.
Cheers
Steddy |
|
| Back to top |
|
|
mrbrown
Joined: 17 Jan 2004
Posts: 1536
|
| Posted: Sat May 28, 2005 7:40 pm Post subject: |
|
|
| I've dumped lflash, and there's no bootstrap information there. We've also discussed this at length with nem, who will also confirm that the bootstrap is inaccessible from lflash. However, you're more than welcome to go ahead and examine it :). |
|
| Back to top |
|
|
steddy
Joined: 04 Apr 2005
Posts: 139
|
| Posted: Sat May 28, 2005 10:39 pm Post subject: |
|
|
| Quote: | | I've dumped lflash, and there's no bootstrap information there. We've also discussed this at length with nem, who will also confirm that the bootstrap is inaccessible from lflash. However, you're more than welcome to go ahead and examine it :). |
I'd love to :) Do you have the source you used to dump it please?
Cheers
Steddy |
|
| Back to top |
|
|
mrbrown
Joined: 17 Jan 2004
Posts: 1536
|
| Posted: Sun May 29, 2005 2:58 am Post subject: |
|
|
My test harness isn't it a state where I can give it out. Here's the relevant code:
| Code: |
int fd = sceIoOpen("lflash:", O_RDONLY, 0);
if (fd < 0) {
scr_printf("Error during open: %x", fd);
goto done;
}
int chunk_size = 32 * 1024;
void *buf = malloc(chunk_size);
if (!buf) {
scr_printf("Error alloc'ing read buffer");
goto done;
}
int bytes_requested = 16 * 1024 * 1024;
int read_offset = 0;//2 * 1024 * 1024 * 1024;
int total_read = sceIoLseek(fd, read_offset, SEEK_SET);
int size = 0;
int fd2 = sceIoOpen("ms0:/flash-part1.bin", O_CREAT | O_WRONLY | O_TRUNC, 0777);
if (fd2 < 0) {
scr_printf("Error opening ms file: %x", fd2);
goto done;
}
while (bytes_requested > 0) {
int read_size = bytes_requested;
if ((total_read >= read_offset && read_size > chunk_size) || (total_read < read_offset)) {
read_size = chunk_size;
}
res = sceIoRead(fd, buf, read_size);
if (res < 0) {
scr_printf(str, "Error during read: %x", res);
sceIoClose(fd2);
break;
}
if (total_read >= read_offset) {
bytes_requested -= res;
read_offset += res;
sceIoWrite(fd2, buf, res);
}
total_read += res;
}
sceIoClose(fd2);
done:
if (fd >= 0) {
sceIoClose(fd);
}
|
Because I have only a 32MB memory stick, I dumped out 16MB at a time. Dumping past 32MB (actually a bit earlier than that) won't break anything, but will only read zeros from the device. At 0xffffffff it wraps around to 0.
The only thing this nets you different than flash0: and flash1: is the underlying FAT filesystem itself. There is nothing else of interest here. |
|
| Back to top |
|
|
subbie
Joined: 05 May 2005
Posts: 122
|
| Posted: Sun May 29, 2005 5:34 am Post subject: |
|
|
| quesiton. You used a malloc. Is this your own fuction or did you figure out how to get the system to allocate? |
|
| Back to top |
|
|
steddy
Joined: 04 Apr 2005
Posts: 139
|
| Posted: Sun May 29, 2005 6:58 am Post subject: |
|
|
Thanks for the code mrbrown. Appreciated.
Steddy |
|
| Back to top |
|
|
mrbrown
Joined: 17 Jan 2004
Posts: 1536
|
| Posted: Sun May 29, 2005 8:07 am Post subject: |
|
|
| subbie wrote: | | quesiton. You used a malloc. Is this your own fuction or did you figure out how to get the system to allocate? |
I figured out how games do it. |
|
| Back to top |
|
|
subbie
Joined: 05 May 2005
Posts: 122
|
| Posted: Sun May 29, 2005 9:51 am Post subject: |
|
|
| mrbrown wrote: | | subbie wrote: | | quesiton. You used a malloc. Is this your own fuction or did you figure out how to get the system to allocate? |
I figured out how games do it. |
Mind sharing (if you haven't already)? pretty please! :) |
|
| Back to top |
|
|
mrbrown
Joined: 17 Jan 2004
Posts: 1536
|
| Posted: Sun May 29, 2005 10:02 am Post subject: |
|
|
| Hmm, I don't think it's a good idea for me to post code I reversed from a game. The reasons are a bit complicated, and more than I care to explain, sorry. But malloc() is easily found if you look at the routines calling into the "SysMemUserForUser" library. |
|
| Back to top |
|
|
jimmygoon
Joined: 26 May 2005
Posts: 8
|
| Posted: Sun May 29, 2005 12:36 pm Post subject: |
|
|
| So whats the story? Sorry but have or haven't we dumped all of the firmware and what potential goodies are there? |
|
| Back to top |
|
|
subbie
Joined: 05 May 2005
Posts: 122
|
| Posted: Sun May 29, 2005 4:17 pm Post subject: |
|
|
| mrbrown wrote: | | Hmm, I don't think it's a good idea for me to post code I reversed from a game. The reasons are a bit complicated, and more than I care to explain, sorry. But malloc() is easily found if you look at the routines calling into the "SysMemUserForUser" library. |
Thanks, At least you gave me a start to hack it out myself. |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
