Re-Flashing the Flash

Klimru · Post by **Klimru** » Fri Jun 17, 2005 4:33 am

Ok, so I've been fooling around with lflash and reading the forums and such. Obviously, lflash doesnt let you access the entire firmware.

Well, what does?

Does anyone have any ideas?

I've dumped the entire lflash to a bin file on my memory stick (1.50) and mounted the partitions in linux. Pretty cool, for one. But as mentioned in another thread, there are two small sections at the end that are 00. Is this possibly just being obscured by the kernel?

I've been looking around and I don't really see another avenue, but one has to exist. I assume the firmware updater programs are using some other method of accessing the flash chip directly that we don't know about?

And, granted, I've been working on this PSP Dev stuff for about a day, I kind of know what I'm doing. I'm 21 and I've been coding and doing hardware projects for years on all sorts of different platforms. </useless-information>

I'm writing a low level fat12 driver for accessing (with read/write) the partitions on lflash directly. Scarey, but, it should work. If for nothing else it could be used for changing the backgrounds. But maybe in the future replace modules and other info easily. Not sure if I'm actually going to finish it because I don't see an immediate use for it. Although, it would be nifty to get the backgrounds changed.

Anyway... has anyone found out any alternate method of accessing the flash with write access, aside from lflash? I'd be happy with something as low level as accessing the I/O data/address/we/ce/etc pins directly and doing the timings by hand.

Hope we find something!

-Klim

Post by **mrbrown** » Fri Jun 17, 2005 4:45 am

The kernel sceNand_driver library is the low-level interface used to read and write flash directly. The updater includes modules that update flash using this library.

And there is already a FAT12 FS driver that reads and writes lflash, the first two partitions are exposed as flash0: and flash1:. flash0: is setup as read-only, flash1: is writeable. The last two partitions don't appear to be used for anything.

You might be able to get away with changing your background by writing a .bmp to flash1:/vsh/theme/wallpaper.bmp. I have not verified this, and you do so at your own risk.

Klimru · Post by **Klimru** » Fri Jun 17, 2005 5:15 am

Well, the reason for making code to access FAT12 through lflash would be to basicly write to the flash0 area easily. I dont see any other way to do it, unless I'm just missing something. There is a module for the MS FAT access, but I dont see anything else for writing flash0. Has someone already writen something? Or am I missing something?

I've poked around on flash1 a bit... i cluttered it up a little by throwing random files on it to see if it would work. But anyway...

Ok, as far as these functions go:

Code: Select all

0xa513bb12  sceNandInit  
0xd305870e  sceNandEnd  
0x73a68408  sceNandSuspend  
0x0f9bbbbd  sceNandResume  
0xae4438c7  sceNandLock  
0x41ffa822  sceNandUnlock  
0xe41a11de  sceNandReadStatus  
0x7af7b77a  sceNandReset  
0xfcdf7610  sceNandReadId  
0x89bdca08  sceNandReadPages  
0x8af0ab9f  sceNandWritePages  
0x766756ef  sceNandReadAccess  
0x0adc8686  sceNandWriteAccess  
0xeb0a0022  sceNandEraseBlock  
0x5182c394  sceNandReadExtraOnly  
0xef55f193  sceNandCalcEcc  
0xce9843e6  sceNandGetPageSize  
0x716cd2b2  sceNandWriteBlock  
0x01f09203  sceNandIsBadBlock  
0x9b2ac433  sceNandTestBlock

Do you or anyone have any information on them? operands and such? I'll go poking around and seeing if I can reverse any of it if no one has any information. I dont see hardly anything about any of them listed on the forums anywhere.

I'd really like to get ahold of the full flash contents. I've thought about ripping the chip off and doing it physically with a microcontroller and some simple code to rip it and send it over a serial port to my PC. (ATmega8515 or something). I'm not quite that brave yet though. Because I know theres pretty much no way I'd get it back on the board, and I dont have the cash for another PSP at the moment.

Anyway...

Thanks,

-Klim

Post by **mrbrown** » Fri Jun 17, 2005 6:06 am

I have some info on their params, yeah ... I'll have to write something up. Maybe even prod the powers that be for the Wiki they keep promising :P.

Klimru · Post by **Klimru** » Fri Jun 17, 2005 6:42 am

Much appreciated.

Klimru · Post by **Klimru** » Fri Jun 17, 2005 7:09 am

Writing a bmp to flash1:/vsh/theme/wallpaper.bmp didn't seem to work.

I used the following code:

Code: Select all

#include "wallpaper.c"

void writewallpaper&#40;void&#41; &#123;
	int fd;
	fd = sceIoOpen&#40;"flash1&#58;/vsh/theme/wallpaper.bmp", O_CREAT | O_WRONLY, 0777&#41;;
	if &#40;fd < 0&#41; goto endit;
	sceIoWrite&#40;fd, newwall, 6174&#41;;
	sceIoClose&#40;fd&#41;;
endit&#58;
	pgWaitVn&#40;100&#41;;
&#125;

wallpaper.c (snipped)

Code: Select all

unsigned char newwall&#91;6174&#93; =
&#123;
    0x42, 0x4D, 0x1E, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x36, 0x00, 0x00, 0x00, 0x28, 0x00,
    0x00, 0x00, 0x3C, 0x00, 0x00, 0x00, 0x22, 0x00, 0x00, 0x00, 0x01, 0x00, 0x18, 0x00, 0x00, 0x00,
    0x00, 0x00, 0xE8, 0x17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2E, 0x74, 0x98, 0x2E, 0x74, 0x98, 0x2E, 0x74, 0x98, 0x2E,
    0x74, 0x98, 0x2E, 0x74, 0x98, 0x2E, 0x74, 0x98, 0x2E, 0x74, 0x98, 0x2E, 0x74, 0x98, 0x2E, 0x74,
.....
.....
.....
    0x4A, 0x77, 0x18, 0x4A, 0x77, 0x18, 0x4A, 0x77, 0x18, 0x4A, 0x77, 0x18, 0x4A, 0x77,
&#125; ;

its just a copy of flash0:/vsh/resources/11.bmp. I dumped flash1 again and its definately there as wallpaper.bmp.

Hopefully this is useful info. lol

-Klim

Post by **mrbrown** » Fri Jun 17, 2005 7:12 am

Hmm, there might be registry settings associated with activating it.

Klimru · Post by **Klimru** » Fri Jun 17, 2005 7:21 am

Are the formats for system.dreg/system.ireg known at all?

Just glancing at system.dreg, theres the string "theme_type". About all I see that could be related.

Not sure how to mod it though.

Post by **mrbrown** » Fri Jun 17, 2005 7:55 am

I haven't looked at the format yet, but there's a user mode API (sceReg) for accessing the registry. I haven't gotten many name hits on it yet though. Does anyone else have names for sceReg?

Yeah, the theme strings were in the vsh modules (vshmain.prx and sysconf_plugin.prx).

Lex · Post by **Lex** » Fri Jun 17, 2005 8:01 am

http://pspdev.ofcode.com/api.php?type=2&id=149

Klimru · Post by **Klimru** » Fri Jun 17, 2005 10:12 am

Finally got it to work... lol

Maybe when i get bored i'll make a little prog to copy backgrounds from the MS...

EDIT: Oh, i put it in the video section beause if you have a pic loaded with the photo viewer, and its in the background, when you go to something else (like the video part) it unloads it... just to prove its actually the 11.bmp on the flash.

Fluff · Post by **Fluff** » Fri Jun 17, 2005 11:52 am

Nice Klimru, if i remember correctly either Nem or soeone else from saturn changed their background with a similar method to their logo, dont remember where the pic of it is though.

It would be nice to make a homebrew app for the specific task of replacing wallpapers, just be sure to code in a filesize/type/format check, to make sure the image is the correct dimensions and bit depth, i dread to think what would happen if someone replaced one of the 12 bitmaps with a bitmap the actual size of the screen.

if you were going to try that though, i'd do it for say, 11, and set the date/time to the last day of november at 23:58pm, so if it for some reason screwed up, theres a chance it would work okay again if you left it off for a few minutes, given that the small image is stretched, i get a sneaky feeling that it would infact work, i may go try it ;)

Fluff · Post by **Fluff** » Sat Jun 18, 2005 1:58 am

found that pic i was talking about

dzer0 · Post by **dzer0** » Sat Jun 18, 2005 2:24 am

man that wud be awesome to have an app that did this....

un1que · Post by **un1que** » Sat Jun 18, 2005 6:41 am

welll............

can someone give me step by step instructions on how to do this.....

Squall333 · Post by **Squall333** » Sat Jun 18, 2005 6:48 am

If you search around this forum you can find out how to do this. Do you think klimru does magic? He had to learn from somewhere

EDIT: Heres the link http://forums.ps2dev.org/viewtopic.php?t=2161

Sonikku_a · Post by **Sonikku_a** » Sat Jun 18, 2005 8:25 am

You do realise you linked back to this same thread? :-)

Post by **Drakonite** » Sat Jun 18, 2005 8:26 am

un1que wrote:welll............

can someone give me step by step instructions on how to do this.....

If you have to ask you'll probably end up with a brick. It's not an easy full proof opporation, lots can go wrong very easily.

Squall333 · Post by **Squall333** » Sat Jun 18, 2005 8:33 am

Well thats just embarassing..

0xdeadface · Post by **0xdeadface** » Sat Jun 18, 2005 8:51 am

But also incredibly funny! :op

greycellgreen · Post by **greycellgreen** » Sat Jun 18, 2005 2:32 pm

You could have claimed it was deliberate, and we'd have been none the wiser.

pyrosama · Post by **pyrosama** » Sat Jun 18, 2005 6:57 pm

Now I am usuming that you wrote 11.jpg not wallpaper.jpg to the flash so what esle could be placed in theme?

I would asume that it would be more than just the BG I noticed that the floating line things (technical name) are 3d renders comming from (cant remember the name off hand) but it may be posible to put a diff prx (I belive it was prx) in its place.

Dunno.

Good job btw.

PyroSama

gotxp · Post by **gotxp** » Sun Jun 19, 2005 1:17 am

isnt the ##.bmp tiled? (nvrmind its stretched :P)

Re-Flashing the Flash

Re-Flashing the Flash

flash1:/vsh/theme/wallpaper.bmp

Wow...