Libertas/WLAN hacking as done in DA's MacSpoofer

[crazyc]

I do see the Express Logic line, but it isn't at the end of the file; it's @ offsett 0x530a [in the middle of the file], Is it normal, or did I get get the partial rom

That string is a little more then half way though at offset 21228.

However, there's hope for others with Marvell 88w8010 :D

The psp does have an 88w8010 but that is the radio. It's the 88w8380, the MAC controller, that is the problem. According to what I've read, the 88w8380 and 88w8381 don't support g while the 88w8385 and 88w8388 do.

I've found a photo of the wlan ic in the slim and it's the 88w8686 and does support 802.11g.

[KickinAezz]

[4m psp max 255 chars]
CrazyC,
You mentioned that some AVC has to be investigated. Please look into it.

Is it theoretically possible for us to uncap 54g based on the present findings? Does FAT psps hardware support it?

[crazyc]

You mentioned that some AVC has to be investigated. Please look into it.

I have and can't make enough sense of it.

Is it theoretically possible for us to uncap 54g based on the present findings? Does FAT psps hardware support it?

Fat psps do not. Slim psps possibly

[KickinAezz]

Hopefully we have a Sony Customer Survey and may be they'll listen to us :)

I dont see them being so dedicated to consumers either.

[bbtgp32465]

Actually, the AVC hasn't been figured out yet ether, but that is even harder. Anyway, if you want to know.

1) in psplink (1.5 kernel only) with the wlan switch off do

Code: Select all

pokew 0x88196474 0x46c06841
pokew 0x8818df48 0x46c046c0

(hopefully these address will be the same)

2) switch on the wlan and do

Code: Select all

thsusp @SceWlanMac
thsusp @SceWlanHal

3) run this program

Code: Select all

.....

4) in psplink do

Code: Select all

savemem 0x890DF4C 0x8000 wlan_builtin_rom

sorry for bumping this old topic.

i was wondering what the purpose of these 2 pokes where for?

Code: Select all

pokew 0x88196474 0x46c06841
pokew 0x8818df48 0x46c046c0

thanks

[crazyc]

i was wondering what the purpose of these 2 pokes where for?

Code: Select all

pokew 0x88196474 0x46c06841
pokew 0x8818df48 0x46c046c0

thanks

They patch a command in the libertas firmware to allow reading of the full ARM address space.

[marteljorge]

So, can I or anyone put the slim psp onto promiscuous mode at CF 5.00 M33-3 without putting the hardware inside-out?