Some part of the firmware is still hidden!

steddy · Post by **steddy** » Sat May 28, 2005 8:18 am

Something odd struct me today (and no it didn't hurt).

On the 1.0 firmware, from what I can tell ALL the .prx modules in the kernel directory are encrypted ~PSP files. There doesn't appear to be any executable code on there that isn't.

If this is the case, where the heck is the code that is decoding these files??? It can't be encrypted the same way itself, or it wouldn't be able to decode itself. So if we have a dump of Flash0 and Flash1 and it ain't there, then there must be another area we are missing.

Steddy

Vampire · Post by **Vampire** » Sat May 28, 2005 8:33 am

nem wrote:There is bootstrap area with equipment serial IDs in the flash chip, and the area is unreachable by this software.

http://forums.ps2dev.org/viewtopic.php?t=1623

MindWall · Post by **MindWall** » Sat May 28, 2005 9:42 am

so even loser's lflash does not get to everything?
like kbooti.bin ?

Vampire · Post by **Vampire** » Sat May 28, 2005 9:47 am

MindWall wrote:so even loser's lflash does not get to everything?

yes

zigzag · Post by **zigzag** » Sat May 28, 2005 3:28 pm

MindWall wrote:so even loser's lflash does not get to everything?
like kbooti.bin ?

No, lflash should be able to get at everything. Correct me if I am wrong.

konfig · Post by **konfig** » Sat May 28, 2005 3:51 pm

"bootstrap area with equipment serial IDs in the flash chip"

What is the equipment serial ID? Is it a hardware matter or a software matter? Can this area be read by electrical means?

If there is really no code to perform decryption, maybe there is some hardware implemented decryption protocol between the psp system and the firmware files.

Post by **mrbrown** » Sat May 28, 2005 4:56 pm

zigzag wrote:
MindWall wrote:so even loser's lflash does not get to everything?
like kbooti.bin ?
No, lflash should be able to get at everything. Correct me if I am wrong.

You're wrong.

steddy · Post by **steddy** » Sat May 28, 2005 5:43 pm

Thanks for the link to PSPDUMP and apologies for covering something mentioned at the top of that thread. Its so long since I read that one I forgot all about it.

How are you so sure its no in the lflash mrbrown? The forum post referenced is only talking about the flash0 / flash1 device interface, not the block interface that was uncovered in the 'list of known devices' thread.

Has anyone got the source to a piece of code that will read the lflash block level device that I can compile? I have a 1.0 PSP now and I would like to dump my own flash. Sorry guys I won't post this up if I do it since thats against the rules.

Cheers
Steddy

Post by **mrbrown** » Sat May 28, 2005 7:40 pm

I've dumped lflash, and there's no bootstrap information there. We've also discussed this at length with nem, who will also confirm that the bootstrap is inaccessible from lflash. However, you're more than welcome to go ahead and examine it :).

steddy · Post by **steddy** » Sat May 28, 2005 10:39 pm

I've dumped lflash, and there's no bootstrap information there. We've also discussed this at length with nem, who will also confirm that the bootstrap is inaccessible from lflash. However, you're more than welcome to go ahead and examine it :).

I'd love to :) Do you have the source you used to dump it please?

Cheers
Steddy

Post by **mrbrown** » Sun May 29, 2005 2:58 am

My test harness isn't it a state where I can give it out. Here's the relevant code:

Code: Select all

        int fd = sceIoOpen&#40;"lflash&#58;", O_RDONLY, 0&#41;;
        if &#40;fd < 0&#41; &#123;
                scr_printf&#40;"Error during open&#58; %x", fd&#41;;
                goto done;
        &#125;

        int chunk_size = 32 * 1024;
        void *buf = malloc&#40;chunk_size&#41;;
        if &#40;!buf&#41; &#123;
                scr_printf&#40;"Error alloc'ing read buffer"&#41;;
                goto done;
        &#125;
        int bytes_requested = 16 * 1024 * 1024;
        int read_offset = 0;//2 * 1024 * 1024 * 1024;
        int total_read = sceIoLseek&#40;fd, read_offset, SEEK_SET&#41;;
        int size = 0;

        int fd2 = sceIoOpen&#40;"ms0&#58;/flash-part1.bin", O_CREAT | O_WRONLY | O_TRUNC, 0777&#41;;
        if &#40;fd2 < 0&#41; &#123;
                scr_printf&#40;"Error opening ms file&#58; %x", fd2&#41;;
                goto done;
        &#125;

        while &#40;bytes_requested > 0&#41; &#123;
                int read_size = bytes_requested;
                if &#40;&#40;total_read >= read_offset && read_size > chunk_size&#41; || &#40;total_read < read_offset&#41;&#41; &#123;
                        read_size = chunk_size;
                &#125;

                res = sceIoRead&#40;fd, buf, read_size&#41;;
                if &#40;res < 0&#41; &#123;
                        scr_printf&#40;str, "Error during read&#58; %x", res&#41;;
                        sceIoClose&#40;fd2&#41;;
                        break;
                &#125; 
 
                if &#40;total_read >= read_offset&#41; &#123;
                        bytes_requested -= res;
                        read_offset += res;
                        sceIoWrite&#40;fd2, buf, res&#41;;
                &#125;
                
                total_read += res;
        &#125;
        sceIoClose&#40;fd2&#41;;

done&#58;   
        if &#40;fd >= 0&#41; &#123;
                sceIoClose&#40;fd&#41;;
        &#125;

Because I have only a 32MB memory stick, I dumped out 16MB at a time. Dumping past 32MB (actually a bit earlier than that) won't break anything, but will only read zeros from the device. At 0xffffffff it wraps around to 0.

The only thing this nets you different than flash0: and flash1: is the underlying FAT filesystem itself. There is nothing else of interest here.

subbie · Post by **subbie** » Sun May 29, 2005 5:34 am

quesiton. You used a malloc. Is this your own fuction or did you figure out how to get the system to allocate?

steddy · Post by **steddy** » Sun May 29, 2005 6:58 am

Thanks for the code mrbrown. Appreciated.

Steddy

Post by **mrbrown** » Sun May 29, 2005 8:07 am

subbie wrote:quesiton. You used a malloc. Is this your own fuction or did you figure out how to get the system to allocate?

I figured out how games do it.

subbie · Post by **subbie** » Sun May 29, 2005 9:51 am

mrbrown wrote:
subbie wrote:quesiton. You used a malloc. Is this your own fuction or did you figure out how to get the system to allocate?
I figured out how games do it.

Mind sharing (if you haven't already)? pretty please! :)

Post by **mrbrown** » Sun May 29, 2005 10:02 am

Hmm, I don't think it's a good idea for me to post code I reversed from a game. The reasons are a bit complicated, and more than I care to explain, sorry. But malloc() is easily found if you look at the routines calling into the "SysMemUserForUser" library.

jimmygoon · Post by **jimmygoon** » Sun May 29, 2005 12:36 pm

So whats the story? Sorry but have or haven't we dumped all of the firmware and what potential goodies are there?

subbie · Post by **subbie** » Sun May 29, 2005 4:17 pm

mrbrown wrote:Hmm, I don't think it's a good idea for me to post code I reversed from a game. The reasons are a bit complicated, and more than I care to explain, sorry. But malloc() is easily found if you look at the routines calling into the "SysMemUserForUser" library.

Thanks, At least you gave me a start to hack it out myself.