Flash after Auth

DrEggman · Post by **DrEggman** » Sun May 15, 2005 4:23 pm

http://www.psphacks.net/files/psp2.avi

In this video you will see a US 1.5 get flashed with a JPN 1.5.1. You will notice the HASH check at the beginning of the video before the program starts. Once it starts flashing it simply dumps the firmware from the memory card. Wouldn't it be safe to say that if we could inject a previous firmware before the flash but after the check, that it should work? This is not too dissimular from how we run homebrew on the Nintendo DS.

If you don't think this will work, please explain why. Flaming just degrades the forum and the person posting.

RATiX · Post by **RATiX** » Sun May 15, 2005 4:34 pm

I don't see why that wouldn't work, unless there is a check on the firmware every X seconds.

Any way to test it??

Orion_ · Post by **Orion_** » Sun May 15, 2005 4:37 pm

because we must encrypt the firmware first ?

DrEggman · Post by **DrEggman** » Sun May 15, 2005 6:44 pm

The firmware is stored in a .PSAR file. These files are already encrypted.

Pikoro · Post by **Pikoro** » Sun May 15, 2005 6:48 pm

Sounds good to me. Could this be tested by flashing a 1.51 firmware down to a 1.5?

Cheers

Histo · Post by **Histo** » Sun May 15, 2005 6:52 pm

So your talking about using the PSAR from the 1.0 firmware with the data.psp from the 1.5 firmware?

Orion_ · Post by **Orion_** » Sun May 15, 2005 6:58 pm

Histo > that's why I say that, we have Not the psar of the 1.0 firmware

DrEggman > sorry I thought you wanted to use this to go back to firmware 1.0

EdZ · Post by **EdZ** » Sun May 15, 2005 7:47 pm

Histo > that's why I say that, we have Not the psar of the 1.0 firmware

We could use the firmware dump, but then the files wouldn't be in a compliant PSAR (though we might be able to pack them ourselves), and we may not have all the files (read thread here)

PSP_killer · Post by **PSP_killer** » Mon May 16, 2005 2:29 am

can some one test and see if you can down grade from a 1.51 to a 1.5 since we have both of those updates on our hands if it works then we can work on the 1.0 fimeware. If it doesn't than we have to look for another way.

RATiX · Post by **RATiX** » Mon May 16, 2005 3:12 am

^^I like that idea, and I'm making a EBOOT.PBP with the 1.51 .SFO and .PSP crossed with the 1.50 .PSAR.

The only problem??
I believe that when you try to run the firmware, it checks the .SFO file AND the .PSP file. .SFO's are editable, but I'm not too sure about .PSP files. Assuming we can't change a .PSP file, it would be sending a message to the PSP saying that it's firmware 1.51 (I'm using the 1.51 .PSP file). Of course, on a 1.51 system, it won't run anything newer than 1.52, so we're still screwed there.

We have 2 options - get a working 1.00 PSAR file, use 1.51's .SFO and .PSP files, and it should run. Other choice is to wait for firmware 1.60 and then run a 1.60 SFO/PSP <-> 1.50 PSAR PBP on a 1.51 system.

alexmae · Post by **alexmae** » Mon May 16, 2005 3:35 am

i've tried your method without editing the sfo or any file: it gives an error "Update can not be done. Data is corrupted" then it reboots

RATiX · Post by **RATiX** » Mon May 16, 2005 3:42 am

This is what I did.
THIS DID NOT WORK AS EXPECTED!!

Packaged a EBOOT.PBP file with the PBP unpacker util.
Contents:

ICON0.PNG - same for both versions, I *think*
DATA.PSP - 1.51JP
PARAM.SFO - 1.51JP
DATA.PSAR - 1.50JP

Here's a movie of it being run on a 1.50 Japanese System.

Streaming - http://www.putfile.com/media.php?n=Fake-PBP-Movie
Downloadable - http://x200.putfile.com/videos/13412451131.avi

Thanhda · Post by **Thanhda** » Mon May 16, 2005 4:08 am

hmm just regular firmware update doesnt even work for the US psp. gives error 80020148. but the thing i find different is that it fade out. any other game of mine just shut black.

DrEggman · Post by **DrEggman** » Mon May 16, 2005 4:36 am

This would NOT work to downgrad a 1.5.1.
You cant modify the data before the AUTH proccess. At best, you can trick a 1.5 into thinking your flashing to 1.5.1 but re-flash it with 1.5 again. This is not the complete solution at this point, but could be means to install custom firmware in the future.

You need to have at least one update above your current firmware for this to even work. You need it to start the software, otherwhise you will have "Current Version" or "Currupted Data" errors. If you updated to 1.5.1, then you will have to wait until yet another update is available.

DrEggman · Post by **DrEggman** » Mon May 16, 2005 4:44 am

I dont think most of you understand.
YOU CANT MODIFY THE EBOOT.PBP. You need it so the PSP passes it through authorization. Then you swap your memory card with a modified EBOOT.PBP.

Now, we would still need a way to convince the PSP that the memory card was never removed. While that may be difficult, it sure is easier than cracking the AES encryption.

So you need:

1 Memory card with 1.5.1 unmodified (use this to boot the update program)

2 A memory card with 1.5.1 but the data.psar replaced with the data.psar from 1.5 update

3 A way to swap memory sticks without PSP having a hissy fit.

First boot 1.5.1 update (unmodified). Once the screen is up telling you what updates will be applied, swap your memory card with the one containing your 1.5.1 update with the 1.5 DATA.PSAR inside the EBOOT.PBP. This should trick your 1.5 into thinking its updating to 1.5.1 but instead, it will be re-writing to 1.5.

If this works, then we will be able to downgrade to any official releases in the future.

RATiX · Post by **RATiX** » Mon May 16, 2005 4:45 am

Uhh.. DrEggman, that's what I'm trying to do.

Basically I took a 1.51 PBP, replaced the PSAR with the PSAR from the 1.50 update, and repackaged it as EBOOT.PBP.

I then ran it on a 1.50 system, and I got an error message, as you can see in the short film clip.

All update data was Japanese, and it was run on a 1.50 Japanese PSP from the original made-in-Japan batch.

EDIT ^^ Nevermind then.... I dunno how we'd do a MS swap.

alexmae · Post by **alexmae** » Mon May 16, 2005 4:52 am

the swap method could work and i'd try it but i'm not going to update to 1.51 from 1.51 because i think that there's the same flaw in 1.5 just not in the same way. that's the reason why 1.51 was released

DrEggman · Post by **DrEggman** » Mon May 16, 2005 4:54 am

If you have a 1.5.1, you can't try it anyways since the software won't even start until something newer comes out.

alexmae · Post by **alexmae** » Mon May 16, 2005 6:36 am

i have 1.50 now and i've tried your methid and it didn't work

EdZ · Post by **EdZ** » Tue May 17, 2005 4:02 am

The swap method sounds promising. Is there an image format for memory sticks (as ISOs are to CDs)? IF you could make sure the entire contents of a memory stick are exactly the same except for the EBOOT.PSP, then you could use a simple switch (well, maybe not simple. It'd have to be high-speed and with no bounce, but that shouldn't be too much of a problem) to change between them. The PSP wouldn't know the difference (as long as everything else is in the same place) and if you switched at the correct time (maybe have a computer snooping on the data transfer) you could effective 'swap' one file for the other.

Skye · Post by **Skye** » Tue May 17, 2005 4:19 am

Just curious, but has anyone figured out how to broadcast data from a pc to the memory stick reader?
Do that, and maybe you could run the update and swap the file with the computer, and the psp would never get a lost connection.

sq377 · Post by **sq377** » Thu May 19, 2005 2:23 am

uhh, maybe i misread... but isn't this suggesting to rip out the card when flashing?

Post by **mrbrown** » Thu May 19, 2005 11:49 am

Also moved to new Exploit forum. DO NOT YANK OUT YOUR MEMORY STICK WHILE IT IS BEING ACCESSED. STUPIDITY KILLS ... GOOD MEMORY STICKS.

sq377 · Post by **sq377** » Thu May 19, 2005 12:39 pm

heh, i wasn't planning on it... Im not touching my psp until i see complete proof that 1.5 is working. I dont want a paperwieght.

konfig · Post by **konfig** » Thu May 19, 2005 6:17 pm

DrEggman wrote:I dont think most of you understand.

If this works, then we will be able to downgrade to any official releases in the future.

Any version except 1.0.

Once we know how to encrypt a psp executable file, we can downgrade to 1.0. But once we know how to do it, downgrading to 1.0 will mean nothing.

ole · Post by **ole** » Sat May 21, 2005 11:44 pm

Swap trick: don't forget that file must be stored exactly on the same sectors of the media. So you have to have some proggy that saves the card1 image to you PC disk, then "inject" the new software on the same sectors of the image, then writes the image to the (new) card2...

Jinnai · Post by **Jinnai** » Sun May 22, 2005 12:50 am

In the other thread about network updating a bad bios was flashed with some rather simple editing, and I'm pretty sure it was garbage data and not something encrypted. To sum up what I got out of that other thread as it applies to this:

1) The upgrade to version was arbitrary based on the initial editing which means it could be done to a 1.51 currently
2) The data flashed was bad but managed to get past the psp checks. I'm not sure exactly how it managed to get past the checks but this suggests to me that it doesnt have to be some sort of encrypted data since I don't believe we know how to properly encrypt for the PSP yet.

Soon as someone gets an actual flash image that's not encrypted. Yeah... right... Then we can test it needing to be encrypted.

The more I read about the exploit attempts the more I think it's going to have to be a hardware solution. Especially with Sony able to force flash updates via UMDs if you want to play your games.

threeballspin · Post by **threeballspin** » Sun May 22, 2005 6:32 am

Why not just update when you want to play a game, and then reflash when you want to play emu's?

Danj · Post by **Danj** » Sun May 22, 2005 6:50 am

threeballspin wrote:Why not just update when you want to play a game, and then reflash when you want to play emu's?

I don't think anybody's developed a way to downgrade to 1.0 yet...?

threeballspin · Post by **threeballspin** » Sun May 22, 2005 7:58 am

I meant once its done.

forums.ps2dev.org

Flash after Auth

Do you think this would work?

Flash after Auth