any idea on what exactly it check and how it checks it ryoko?
damn... nem... thats freakin bad ass... nice work :o
Read PSP NAND Flash DATA to PC
-
TeamOverload
- Posts: 41
- Joined: Thu Apr 20, 2006 10:31 pm
- Location: CT
-
ryoko_no_usagi
- Posts: 65
- Joined: Tue Nov 29, 2005 4:47 pm
Maybe serial number/UMD/region identification. Reports say that switching motherboards has had the effect of disabling the UMD drive. The people laichung referred to earlier in this thread apparently flashed a Japanese 1.5 fw onto their Chinese 2.60 PSPs which also disabled the UMD drive.
One part of the firwmare reads 48 bytes from one page to a buffer then reads 136 bytes from a different page and concatenates the two parts. Then it runs opcode 18 on them. The second part is a subset of the data touched by the UMD driver. I don't know what it used for and it might be encrypted, but it appears Kirk could be in command of Spock :)
Complete speculation, opcode 18 might be SHA-384, based on nothing more than the 384 bits of the first part and that changing the value of bytes causes the return value to differ from 0. That wouldn't be much of security though would it, and attempts to calc SHA-384 manually on that data were negative...
I don't know how opcode 18 knows the size of the input data either. I don't have much time for experiments.
One part of the firwmare reads 48 bytes from one page to a buffer then reads 136 bytes from a different page and concatenates the two parts. Then it runs opcode 18 on them. The second part is a subset of the data touched by the UMD driver. I don't know what it used for and it might be encrypted, but it appears Kirk could be in command of Spock :)
Complete speculation, opcode 18 might be SHA-384, based on nothing more than the 384 bits of the first part and that changing the value of bytes causes the return value to differ from 0. That wouldn't be much of security though would it, and attempts to calc SHA-384 manually on that data were negative...
I don't know how opcode 18 knows the size of the input data either. I don't have much time for experiments.
trick the psp?
yeah, I'm a noob with the whole psp scene, so flame away, but I know the way I downgraded my ipods firmware is there's a file the updater checks to see what firmware you have, and I edited it to say it was lower than the one that I wanted to downgrade to and I just installed it with the updater. I'm sure it's already been explored, but has anybody disassembled the official updater to see what it accesses to check the firmware version before it updates? If we could find this out, would it be possible to edit it to tell the updater that it was say 1.0 or something like that, thus letting it reflash? Just a random thought.
