PBP Exploit Success... but only on 1.0 psp :(

Discuss the development of new homebrew software, tools and libraries.

Moderators: cheriff, TyRaNiD

malloc
Posts: 23
Joined: Thu Apr 28, 2005 2:40 am

PBP Exploit Success... but only on 1.0 psp :(

Post by malloc »

Hi,

I managed to execute .elf executables on a retail PSP, by replacing
the DATA.PSP in the 1.5 update PBP, by a simple .elf psp executable.
It does work, but only on 1.0 retail psp, I couldn't start anything on
a 1.5 (the exe starts, but return in the menu, with the 80020001 error).
I think the old firmware could execute unsigned (not encrypted) code
for a reason I don't quite understand (a bug?).

This is a real problem, because 1.0 retail won't be able to execute new
games (they'll ask for the 1.5 update installation), which means you'll
have to have one old PSP 1.0 to develop and execute code, and another
if you want to play :( Also those 1.0 a rare (there's only one left in my
office on the 6 PSPs we have)

I have access to a psp developpement kit, that's why I could compile
a simple demo with the S D K and try it at the office on my spare time.
I can't of course give anything (the .elf), or tell much more because I
would break Sony NDA, and I don't want to loose my job.

But I posted this so that you know :
1- official developper would like to execute code on retail PSP as much
as you do (they can't and it's a real pain... )
2- it looks like sony patched this hole in 1.5, so it's not really usefull
anymore to look at PBP exploit

I hope this helps... I'd like to be able to develop on PSP on my spare
time, and hope somebody will find a way to allow homebrew dev.


PS : please don't ask for files or anything, I can't provide anything,
because I have nothing to prove, and like I said I don't want to loose
my job ;)
Neila
Posts: 79
Joined: Sat Apr 23, 2005 3:36 am
Location: Canada

Post by Neila »

wow =) this is great!
I assume there were no modifications made to the SFO?

can you do another test please?

test it again with the 1.5ver but CHANGE the SFO's parameters to execute on version 1.5! :)
(you need to patch the SFO)

and if still nothing runs try with restarting the unit to try to boot from there... not sure how bootable is your elf... (if you know it won't mess-up the OS and the unit won't die of course) =)

keeping fingers crossed
x
malloc
Posts: 23
Joined: Thu Apr 28, 2005 2:40 am

Post by malloc »

I tried many many things with SFO. But no luck :(

I started with the SFO of the 1.5 update. Of course on a 1.5 PSP
it would not run (1.5 update is already installed).
I then changed the 1.50 string in the SFO to 1.60, and it worked,
the PSP screen appears, the .elf loads (memory stick access),
but then after 2 seconds of blank screen, it would return to the
menu with the error (game can't be executed) instead of executing
the small program.

I then tried the SFO of the leaked firmware. Same thing.

I tried also to regenerate a SFO with the correct tool (provided in
the S D K) thinking it there was some kind of CRC in the SFO (I had
to create a script with all the parameters found in the SFO of the 1.5
update, and of the leaked firmware). But it doesn't run either :(

I tried to use an old version of the S D K thinking the tools or
the libs included new things to prevent running on 1.5, same thing
with the old S D K from a few months back.

I don't think it's possible anymore on the retail 1.5 :(
If only I did find out this before, I wouldn't have updated my own
personal PSP to 1.5 !
Neila
Posts: 79
Joined: Sat Apr 23, 2005 3:36 am
Location: Canada

Post by Neila »

aww... thats... SAD.... =/
even when you restarted? ooPo had some leaked bad update that won't run, but when he restarting the unit the update ran anyhow and flashed the system blank from what I understand
so security may be weaker when the system is restarting.

but at least there's some hope on the horizon :)
vvuk
Posts: 13
Joined: Mon Apr 25, 2005 3:57 pm
Location: Foster City, CA

Post by vvuk »

I've tried doing exactly this, but my PSP was 1.5 out of the box. I couldn't repeat the blank screen error either though; I'll try again, as perhaps there was something that I missed.
jason
Posts: 28
Joined: Thu Apr 14, 2005 3:48 am

Post by jason »

How can I downgrade the firmware to 1.0?
ooPo
Site Admin
Posts: 2023
Joined: Sat Jan 17, 2004 9:56 am
Location: Canada
Contact:

Post by ooPo »

Currently, you can't.

For the record, this is yet to be confirmed as working and is most likely fake.

Don't go out buying a v1.0 unit or anything silly like that.
cyod
Posts: 36
Joined: Fri Apr 29, 2005 5:46 am

Post by cyod »

Can someone confirm or deny this? I know most people will not be able to as it would require a leaked sdk and jp psp but someone should before anyone gets excited.

If it works on the 1.0 firmware and not the 1.5, its possible that it has to do with the file you are modifying being the to 1.5 firmware update (probably not, but theres always hope...)

I doubt any games will require you to have the 1.5 firmware, as that would require the user to either have wireless internet, or a way to write to their memory stick (which probably should have been included with the psp in the first place). Many people would probably be angry to discover that they cannot play the newest game they bought without also buying a cable/memory stick reader.
ooPo
Site Admin
Posts: 2023
Joined: Sat Jan 17, 2004 9:56 am
Location: Canada
Contact:

Post by ooPo »

Unless the latest game offers to update you when you boot it up...
Neila
Posts: 79
Joined: Sat Apr 23, 2005 3:36 am
Location: Canada

Post by Neila »

unless the games were made on the 1.5 SDK and have 1.5 ver as required set in the SFO.
not that they won't be able to run on 1.0, but they won't after the version check.

I don't think we should write off people that easy as fakes.
after all especially here it makes sense. the PSP is "loader" and hence "executable" withtin the parameters of the SFO.
if you find a proper ELF (and not some dwarf in disguise ;) ) it should run if not checked properly by the the OS.
cyod
Posts: 36
Joined: Fri Apr 29, 2005 5:46 am

Post by cyod »

Then all of the 'latest games' would have to use up space on the umd for the required firmware, although thats easily possible considering the size of it...
if you find a proper ELF (and not some dwarf in disguise ;) ) it should run if not checked properly by the the OS.
Except any binaries should be encrypted, so why would the update be any different? SONY would have no real reason to allow unencrypted programs to run off the memory stick...
jason
Posts: 28
Joined: Thu Apr 14, 2005 3:48 am

Post by jason »

cyod wrote:Then all of the 'latest games' would have to use up space on the umd for the required firmware, although thats easily possible considering the size of it...
if you find a proper ELF (and not some dwarf in disguise ;) ) it should run if not checked properly by the the OS.
Except any binaries should be encrypted, so why would the update be any different? SONY would have no real reason to allow unencrypted programs to run off the memory stick...
I don't care about games, I want to run my own elf binaries. Also, the dude said that 1.0 (unlike 1.5) doesn't check for encryption, is that true/possible?
cyod
Posts: 36
Joined: Fri Apr 29, 2005 5:46 am

Post by cyod »

Its possible, highly unlikely and completely unconfirmed as far as I know. Wait for someone to confirm it before throwing a party.
jason
Posts: 28
Joined: Thu Apr 14, 2005 3:48 am

Post by jason »

cyod wrote:Its possible, highly unlikely and completely unconfirmed as far as I know. Wait for someone to confirm it before throwing a party.
Man, if it's true, party's on me. Alright, anybody knows what's up with that? Does firmware 1.0 checks for encryption in binaries? Where to get a firmware 1.0? And how would I be able to downgrade (even if I have to flash an eeprom or anything like that, it's fine with me)?
User avatar
ChaosKnight
Posts: 142
Joined: Thu Apr 14, 2005 2:08 am
Location: Florida, USA

Post by ChaosKnight »

This is kinda pointless IMHO.

#1 Not a lot of people have 1.0 PSPs.
#2 Your code still won't run on a normal person's (1.5) PSP.
#3 Like oopo said, it's either fake or useless for the above reasons.

Even if someone could dump the firmware, then you'd have to have a flasher for it (not possible ATM) because it's likely no flasher was ever made for it (being 1.0 and all)...

Of course, I like everyone else would like to believe it and develop using this info, but it's a waste of time unless we can all make our PSPs 1.0.
w00t
Neila
Posts: 79
Joined: Sat Apr 23, 2005 3:36 am
Location: Canada

Post by Neila »

are you kidding....?

the point would be not to flash it back, but learn from it... it would be priceless.
jason
Posts: 28
Joined: Thu Apr 14, 2005 3:48 am

Post by jason »

Neila wrote:are you kidding....?

the point would be not to flash it back, but learn from it... it would be priceless.
I absolutely agree on that, there's not only a lot to learn, but honeslty, I didn't buy a psp for the games, or whatever, just in the hope that one day I would run my own apps on it.
cyod
Posts: 36
Joined: Fri Apr 29, 2005 5:46 am

Post by cyod »

I absolutely agree on that, there's not only a lot to learn, but honeslty, I didn't buy a psp for the games, or whatever, just in the hope that one day I would run my own apps on it.
There IS a lot to learn if you dont plan on using the official sony sdk illegally. If you really just wanted to dev for psp you should have waited for anything resembling homebrew before buying it and you probably would have saved a shiny penny... or maybe just bought an NDS sience that already has a functional dev library...
PinkPeach
Posts: 23
Joined: Wed Mar 02, 2005 10:36 pm

Post by PinkPeach »

If you just replace elf then maybe someone with 1.0 can try the one i just built (URL DELETED)

It loads up completely into memory but it indeed doesn t work on my 1.5 PSP (error 80020001, execution failure).

Which heap and stack sizes ? Any particular boot code or kernel attributes ?

You are pretty vague about your elf :)

Ho btw you can remove the link whenever you wish, this is built with the sony SDK (but does nothing particular except setting up thread in debug mode, writing few lines, and that s it). That s for the sole purpose of knowing if indeed a PSP executable can be boot off memory stick with a 1.0 firmware.
Last edited by PinkPeach on Fri Apr 29, 2005 9:40 am, edited 1 time in total.
geran
Posts: 4
Joined: Wed Apr 27, 2005 1:16 am

Post by geran »

PinkPeach wrote:If you just replace elf then maybe someone with 1.0 can try the one i just built (URL DELETED)

It loads up completely into memory but it indeed doesn t work on my 1.5 PSP (error 80020001, execution failure).

Which heap and stack sizes ? Any particular boot code or kernel attributes ?

You are pretty vague about your elf :)

Ho btw you can remove the link whenever you wish, this is built with the sony SDK (but does nothing particular except setting up thread in debug mode, writing few lines, and that s it). That s for the sole purpose of knowing if indeed a PSP executable can be boot off memory stick with a 1.0 firmware.
That link doesnt work. Any one got a psp w. 1.0 firmare?

edit, the linked should be: (URL DELETED)
Last edited by geran on Fri Apr 29, 2005 9:40 am, edited 1 time in total.
PinkPeach
Posts: 23
Joined: Wed Mar 02, 2005 10:36 pm

Post by PinkPeach »

Sorry, fixed, caps are important for my host ^^
asmodi
Posts: 52
Joined: Mon Feb 07, 2005 3:39 am
Location: Göteborg/Oslo - Se/No

Post by asmodi »

Read the pm Peach :)
It's not in my nature to be mysterious, but I can't talk about it, and I can't talk about why.
engstrom
Posts: 9
Joined: Sat Apr 23, 2005 9:31 am

Post by engstrom »

I read another post by malloc on another forum this afternoon(been down the pub all night so I can't remember which but I shall check my history when I get into work) where he mentions a specific example program in the PSP SDK. I happen to work near an internal Sony development studio and I shall ask one of the coders there if such an example exists in the SDK. If it does exist then at least that bolsters the case for it not being fake.

BTW Asmodi;don't keep us in suspense.What was your PM? Did it work? :-)
lshian
Posts: 5
Joined: Fri Apr 29, 2005 10:25 am

Post by lshian »

I still have my Jap set PSP 1.0. :) I dont bother to update as it doesn't have any major update.
engstrom
Posts: 9
Joined: Sat Apr 23, 2005 9:31 am

Post by engstrom »

So...you willing to give it a try? ;-)
asmodi
Posts: 52
Joined: Mon Feb 07, 2005 3:39 am
Location: Göteborg/Oslo - Se/No

Post by asmodi »

There is a difference between the 1.5 and 1.0 when running a specific elf file, that much is for sure. There is no point in discussing this further yet, but malloc can very well be right. Don't put your hopes up to much tho!
It's not in my nature to be mysterious, but I can't talk about it, and I can't talk about why.
cyod
Posts: 36
Joined: Fri Apr 29, 2005 5:46 am

Post by cyod »

Ah the suspense is killing me! Can't you reveal more than just "He might be right" ?
De_BuG
Posts: 2
Joined: Fri Apr 29, 2005 11:33 am

Post by De_BuG »

Just tried the EBOOT file posted on Version 1 psp after removing the PSAR and my displayed the usual loading logo before crashing no reset though but maybe i did not wait long enough for it to time out.
asmodi
Posts: 52
Joined: Mon Feb 07, 2005 3:39 am
Location: Göteborg/Oslo - Se/No

Post by asmodi »

It never timesout, and it dosen't freeze.
It's not in my nature to be mysterious, but I can't talk about it, and I can't talk about why.
geran
Posts: 4
Joined: Wed Apr 27, 2005 1:16 am

Post by geran »

asmodi: Any more info? What happens? Is it stuck at the loading loading screen?

edit: learned to read =)
Locked