Japan Wipeout Downloads Released, New User Agent ... (more)

volksport · Post by **volksport** » Sat Apr 09, 2005 1:18 am

Note: The person responsible for all of this wants to remain anonymous for his own reasons, so I am being a proxy for his discoveries by request. If you know WHO I am talking about, please keep it to yourself, again I am merely respecting this person's wishes, as should you.

Japan Wipeout Downloads are available now. Starting with Gamma Pack 1, there will be one per month for six months.

New User-Agent for Japan Wipeout: SCEJ PSP BROWSER 0105 UCJS10007

The browser uses this link on the web page: proc://command/http://wipeoutpurepsp.scej-online.jp/do ... oad.pspdif

So now we have a new protocol link to play with: proc://command/xxxxx

Japan Wipeout Pure Download URL: http://wipeoutpurepsp.scej-online.jp/?s ... in=Default

The PSPID is blanked out, but is not required. In fact you can simply browse to http://wipeoutpurepsp.scej-online.jp and it will take you to the downloads.

When you request a download it downloads this file: http://wipeoutpurepsp.scej-online.jp/do ... oad.pspdif
which appears to be encrypted, then that initiates a request to
http://wipeoutpurepsp.scej-online.jp/do ... ata.pspdat which is a ZIP file.

Code: Select all

0        PSP/SAVEDATA/UCJS10007DGAMMAPACK1/ 
1440     PSP/SAVEDATA/UCJS10007DGAMMAPACK1/ICON0.PNG 
4912     PSP/SAVEDATA/UCJS10007DGAMMAPACK1/PARAM.SFO 
16       PSP/SAVEDATA/UCJS10007DGAMMAPACK1/TEST.BIN 
3659264  PSP/SAVEDATA/UCJS10007DGAMMAPACK1/PI.WAD 
21040    PSP/SAVEDATA/UCJS10007DGAMMAPACK1/PIC1.PNG

if you replace the download file then it downloads it, and the light flashes so it looks like it's writing to the memory stick, but then throws you back at the "select a connection" screen, and seems to delete it off the memory stick, he replaced it with a 3 meg file, and it seemed to write it to the stick for ages but when he checked it on his pc it wasn't there anymore.
It is called "gamma pack 1".

if you go to download it again it asks "OVERWRITE EXISTING FILES "GAMMA PACK 1" 3776KB ... OK/CANCEL... in the PSP GUI.

Links:
http://wipeoutpurepsp.scej-online.jp/

http://wipeoutpurepsp.scej-online.jp/index.html

http://wipeoutpurepsp.scej-online.jp/download.html

http://wipeoutpurepsp.scej-online.jp/do ... oad.pspdif

http://wipeoutpurepsp.scej-online.jp/do ... ata.pspdat

beatwho · Post by **beatwho** » Sat Apr 09, 2005 1:47 am

handy tip:

if you have wget you can download it using something like this:

wget --user-agent="SCEJ PSP BROWSER 0105 UCJS10007" http://wipeoutpurepsp.scej-online.jp/do ... ata.pspdat

dlrm42 · Post by **dlrm42** » Sat Apr 09, 2005 2:10 am

Hi,

you can access the page also with the firefox useragent switch extension, which some are using allready.
anyway, the pure data doesn't seem to do anything. I grabbed the file and put in on the psp, then I started wipeout (us) and nothing happens. renameing the folder from UCJS... to UCUS... presented the same result.
in the savegame explorer on the psp, the gamepack dir. presents itself as corrupt data. so my guess is if the download.pspdif file isn't processed by the ingame browser it doesn't effect the game.

Post by **mrbrown** » Sat Apr 09, 2005 2:13 am

Uh, what does this download add to the game?

Post by **mrbrown** » Sat Apr 09, 2005 2:18 am

dlrm42 wrote:Hi,

you can access the page also with the firefox useragent switch extension, which some are using allready.
anyway, the pure data doesn't seem to do anything. I grabbed the file and put in on the psp, then I started wipeout (us) and nothing happens. renameing the folder from UCJS... to UCUS... presented the same result.
in the savegame explorer on the psp, the gamepack dir. presents itself as corrupt data. so my guess is if the download.pspdif file isn't processed by the ingame browser it doesn't effect the game.

Or that it's only meant for the Japanese version of the game.

dlrm42 · Post by **dlrm42** » Sat Apr 09, 2005 2:21 am

I guess new tracks,skins and racers, at least that is known from different articles/interviews about wipeout pure.

Or that it's only meant for the Japanese version of the game

yep , you might be right mrbrown, but at least the psp sould recognize it as addon pack for wipeout, but there could be some more reasons why it doesn't work.

1.) not for us game ( might be quite obvious :) )
2.) its a test , could be because the update contains a test.bin which looks a bit strange to me for a final release
3.) the psp and/or wipeout doesn't know its there , because of the corrupted data tag in the savegame browser. maybe that every game has some sort of access to a restriced area in the psp to tell it that the data is actuall a game addon and not chunk ( download.pspdif comes to my mind here )

volksport · Post by **volksport** » Sat Apr 09, 2005 2:23 am

mrbrown wrote:Uh, what does this download add to the game?

New Ship: Tigron
New Park: Statun(?)
New Skin: Piranha

originalself · Post by **originalself** » Sat Apr 09, 2005 3:59 am

First I would just like to say hi as this is my first post here...anyway. I have made a small site hosting one psp formated video and I used the new command from the wipe out site and it tried to download it.

Code: Select all

<a href="proc&#58;//command/http&#58;//users.adelphia.net/~originalself/M4V22323.MP4">VIDEO</a>

Well after a few seconds and a garbled screen it resets the system. I am guessing they have some sort of compression used for online video download, if its even supported.

darkfader · Post by **darkfader** » Sat Apr 09, 2005 5:09 am

I noticed that "proc" too, but I cannot try anything here. I wonder if it's an libhttp extension or game specific. And I wonder if there are more commands like that.

angelfly · Post by **angelfly** » Sat Apr 09, 2005 5:19 am

darkfader wrote:I noticed that "proc" too, but I cannot try anything here. I wonder if it's an libhttp extension or game specific. And I wonder if there are more commands like that.

I've been attempting different types but just results in going back to the connection selection screen.

Also like the poster above I attempted to have the psp download my own file. Since the pspdat was only a zip file I made one and change the extension and at first the ms activity light blink for a bit then it shutdown.

the contents of the file:

Code: Select all

PSP
&#9492;&#9472;&#9472;&#9472;photo
        psp-close-up-look-20040614001233819.jpg

Post by **ooPo** » Sat Apr 09, 2005 5:26 am

The download.pspdif file is the important part, not the zip file. It may be a small bit of executable code, or a batch file of some sort. Perhaps equivalent to the pif files on windows.

Pointing it to a valid EBOOT.PBP file - Small blip of loading, blank screen, shuts the psp down after a minute or so.

Pointing it to a valid UNKNOWN.PSP file - Loads longer, but puts random coloured dots on the screen while it loads. Then stops, shuts the psp down.

kry.sys · Post by **kry.sys** » Sat Apr 09, 2005 6:10 am

ooPo wrote:The download.pspdif file is the important part, not the zip file. It may be a small bit of executable code, or a batch file of some sort. Perhaps equivalent to the pif files on windows.

Pointing it to a valid EBOOT.PBP file - Small blip of loading, blank screen, shuts the psp down after a minute or so.

Pointing it to a valid UNKNOWN.PSP file - Loads longer, but puts random coloured dots on the screen while it loads. Then stops, shuts the psp down.

beat me to it :P

i didnt get random dots when i pointed it at a valid psp file though. interesting results (psp screen flashed then reloaded twice) when i pointed it at a 1GB garbage pbp file

oh.. and proc (Proc://)= process | (command/)=run.

the line

proc://command/http://jojo.com/psp.pspdif

means process and run the following handle (which downloads the file then runs it in proc)

sooo im working on a way to do somehting like

proc://command/file:///whatever/somedir/blah.pspdif

the file:/// is more my speudo word for referencing a storage device.. mainly the memory stick... i havent seen anyone anywhere post the name for this so im not going there until someone figures it out.

Post by **ooPo** » Sat Apr 09, 2005 6:11 am

The eboot and psp files were from the jp 1.5 upgrade image, btw.

kry.sys · Post by **kry.sys** » Sat Apr 09, 2005 6:21 am

ooPo wrote:The eboot and psp files were from the jp 1.5 upgrade image, btw.

i wanna see the pretty dots man!.. ill try again.. i prolly used the wrong one need to sort out my pbp and psp files... (im kinda messy on my pc)

anyone want to see this 1g file get the boot into a loop? i guess ill post a movie cause people arent gonna want to dl this and its probably not even really needing to be 1g.. but so far its the onyl way i can get it to do this.

asmodi · Post by **asmodi** » Sat Apr 09, 2005 6:26 am

I see no reason why Wipeout should know these filetypes, but as the transfer is probebly done through an API function, it could however be the case. Can you try with more random files ooPo, or did you already try that? I just borrowed Wipeout earlier to day, so I can't test it. I will however get it monday morning.

Post by **ooPo** » Sat Apr 09, 2005 6:33 am

I see a good reason. The psp uses these standard interfaces, like the save game loading and web browsing interfaces. So why wouldn't it understand standard file types?

It wasn't a complete shot in the dark, but I will admit I didn't expect success. :)

asmodi · Post by **asmodi** » Sat Apr 09, 2005 6:36 am

That was what I ment with the use of the API. Seems a little dumb to make use of the function for some maps and cars (planes?).

It sounds like the webbrowser indeed is in the firmware already...

Mr_Bogus · Post by **Mr_Bogus** » Sat Apr 09, 2005 6:58 am

asmodi wrote: It sounds like the webbrowser indeed is in the firmware already...

I don't think that it is in the firmware yet, because there are different user-agent stings from the US and JPN version of the game.

Post by **ooPo** » Sat Apr 09, 2005 7:18 am

Apparently the region-specific parts of these standard screens can be specified by the game itself, allowing them to still be in firmware.

I thought that too when I saw the loading screens on Japanese and US games using different buttons for 'ok'. (X/O) I was soon corrected when I mentioned this on #pspdev. :)

Klimru · Post by **Klimru** » Sat Apr 09, 2005 7:30 am

Has anyone made heads or tails out of the pspdif file?710 bytes, but, it must be some kind of code or something.

kry.sys · Post by **kry.sys** » Sat Apr 09, 2005 7:46 am

Mr_Bogus wrote:
asmodi wrote: It sounds like the webbrowser indeed is in the firmware already...

I don't think that it is in the firmware yet, because there are different user-agent stings from the US and JPN version of the game.

Im not saying you are right or wrong... but the firmware is different between jp and na hardware as well. it is possible that the browser is part of the system then called with arguments pointing to an animation file to replace the loading animation and a default webpage and a user agent to send... psuedo example

_httpapi(wpanilogo.sfo,http://wipeoutpure.com/ingame/,'psp-my cool game id')

in this case httpapi could be part of the firmware os or the software game.

just something to think about.
most likely its a function written by sony that devs can bundle into thier games.... all speculaiton of course.

kry.sys · Post by **kry.sys** » Sat Apr 09, 2005 7:52 am

originalself wrote:First I would just like to say hi as this is my first post here...anyway. I have made a small site hosting one psp formated video and I used the new command from the wipe out site and it tried to download it.
Code: Select all
<a href="proc&#58;//command/http&#58;//users.adelphia.net/~originalself/M4V22323.MP4">VIDEO</a>
Well after a few seconds and a garbled screen it resets the system. I am guessing they have some sort of compression used for online video download, if its even supported.

try something to the effect "proc://media" or maybe "proc://movie" etc etc

your not trying to process a command.. but an mp4 file ;) id like to be more specific.. sorry

asmodi · Post by **asmodi** » Sat Apr 09, 2005 7:53 am

kry.sys wrote: _httpapi(wpanilogo.sfo,http://wipeoutpure.com/ingame/,'psp-my cool game id')

in this case httpapi could be part of the firmware os or the software game.

I too believe this is the case, no other way sounds logical. But who knows, we can be totally wrong.

Klimru · Post by **Klimru** » Sat Apr 09, 2005 7:54 am

Quick idea...

Since the data file is a zip file that is (if i read this correctly) unzipped onto the memory stick... has anyone tried any proxy/dns redirection of any kind to get a different zip file downloaded?

If so, I recall there being various overflow exploits involving low memory unzip libraries and craftily made archives.

Would be interesting.

asmodi · Post by **asmodi** » Sat Apr 09, 2005 7:58 am

Klimru wrote:Quick idea...

Since the data file is a zip file that is (if i read this correctly) unzipped onto the memory stick... has anyone tried any proxy/dns redirection of any kind to get a different zip file downloaded?

If so, I recall there being various overflow exploits involving low memory unzip libraries and craftily made archives.

Would be interesting.

Did you really read the entire thread?

Klimru · Post by **Klimru** » Sat Apr 09, 2005 8:03 am

asmodi wrote:Did you really read the entire thread?

Yah, actually.

I see mention of replacing the download file with something to be written to the stick. Although, it wasnt clear as if it was another ZIP file or simply an arbitray file of similar size or something.

I guess I'll have to go buy Wipeout to try this one myself.

I'd like to see the results of simply replacing one of the files in the original archive with one of an identical size and such. Or simply recreating the same data in that archive using Winzip or linux zip. Perhaps the pspdif file (program?) contains a checksum of the archive in its entirety? The individual files? The file list? Or something.

If anyone knows, I'd be interested to find out.

Klimru · Post by **Klimru** » Sat Apr 09, 2005 8:06 am

Also, I'm not sure if the people testing are directly linking to the pspdat file or using DNS fudging to put the pspdif file and the dat file in the locations the normal process would follow (on the correct URL), then accessing the pspdif file.

LiquidIce · Post by **LiquidIce** » Sat Apr 09, 2005 9:19 am

Did the new PSP user agent appear when they got the firmware update, or did it start reporting the new user-agent after they installed the Wipeout update?

Someone who has this update should run it through some of the tests on MomDad's page to see if anything has changed (if any new browser/javascript/iframe features are now supported).

If someone could figure out how to play or download movies that would be sweet. Does the proc://command stuff work on a US PSP yet? I'll start trying some different links.

Also, does it write the data to the memory stick as it downloads, or does it download it into ram then dump it on the stick?

plmars · Post by **plmars** » Sat Apr 09, 2005 9:44 am

I am a newbie here so please no flaming. LOL. Here is what i found out. Everything seem to take place in the "param.sfo" file. I assume you can just dump unziped data onto you memory stick and dont even change folder name (maybe u will have to but thats not a big thing). When i just copied it like that the save game manager sees it without the problem. Now here is the question. Wipeout doesnt detect the Game Pack because:
a) folder name is not what its supposed to be (better option)
b) it has to be added to the main param.sfo file (not so good option).

In case 'a' everything would be so much easier because all you will have to change would be the folder name and the folder name hardcoded into the param.sfo file. The problem with this is that param.sfo seems to have a wired checks on it. If you change one latter, even the one in the diescription, it becomes corrupted (as reported by save game manager). I am working hard to crack this.

In case 'b' it would really suck cause I have no idea where to include that information. I wont just drop it between bunch of "00". LOL. In this case we will need someone with Japanese version to help us out.

I'm trying to focus onto param.sfo cracking because it can help so much in the future. One little update on it. Every single param.sfo has the same exact langth which makes reverse engineering so much easier.

plmars · Post by **plmars** » Sat Apr 09, 2005 9:47 am

Sorry for double posting but to add some stuff up.

The parts that seem to change from one param.sfo to another are located between 57Dh and 58Ch and then between 11C0h and 11DFh. Check them out. We need to crack that integrity checking algorithm.

edit: Never mind. More stuff changes. Need to research it more.