forums.ps2dev.org

Krevnik · Joined: 09 Mar 2005 Posts: 71

Seriously, forget attempting to hack 1.51 or 1.52 for the time being. Think about 2.0.

Why? The web browser. This gives us another vector of attack on the PSP, and if there are flaws in the browser's buffering system, we can use a good old buffer overflow exploit. Now, this assumes that there is a flaw in the browser in 2.0, which there might not be.

However, the catch is that this would require essentially a custom web server that would be able to inject malicious data into an HTTP response header or something similar. Still, it might prove to be an easier target than bashing an entrance that Sony has already covered up quite well on us.

Anyone agree, or think I am absolutely nuts on this?

TheDevilsJester · Joined: 06 Apr 2005 Posts: 16

Nuts. Really.

First you would have to be by a wifi hotspot to access a webpage, just to run homebrew. That fact alone shoots any webbrowser or javascript exploit full of holes.

Those of use doing homebrew (coding and playing) are very few comparitivly right now, imagine if a wireless network was a requirement, the community would slow to a crawl.

Not to mention any exploit we managed would be fixed in 2.1

Trying to hack each new version of the firmware we will always be a dog chasing its tail. We wont progress.

What we need to focus on is trying to trick the PSP into thinking our code is signed. This is not an easy task and may take years..., but its the only way we will get a real working homebrew system.

zacay · Joined: 17 Jul 2005 Posts: 10

[ADMIN: You need to do a bit of growing yourself]

mrbrown · Joined: 17 Jan 2004 Posts: 1536

Thanhda · Joined: 09 Apr 2005 Posts: 331 Location: Canada

i agree i think its a good idea to try to hack the lastest firmware, not only because you can use the web browsers, you will still be able to play the latest games that are soon to come out.
_________________
There are 10 types of people in the world: Those who understand binary, and those who don't...

TheDevilsJester · Joined: 06 Apr 2005 Posts: 16

pyrosama · Joined: 13 May 2005 Posts: 66

Our target should be what ever each indaviduals strengths puts them in the best position of achiving something. Whether it be knowlege or a new exploit.

Let ppl do there thing. Good things come to those who wait.

PyroSama

Famicom DS · Joined: 13 May 2005 Posts: 18

Here is a very simple solution to enjoy homebrew + all the neat new stuff that sony's up to date firmware will provide

READY!

buy 2 (two) psp's one for homebrew and the other for all the up to date features sony's new firmware will provide

problem solved

Warren · Joined: 24 Jan 2004 Posts: 173 Location: San Diego, CA

I would rather install a modchip in my PSP than buy 2 PSP.

I think buying 2 PSP is stupid because it costs an extra couple of hundred dollars just to run home brew and who wants to carry around 2 PSPs on the chance they want to play homebrew or UMD games?

Woogie · Joined: 24 Jul 2005 Posts: 6

TBH, I don't see how a modchip is going to work. On the original Playstation, Sony were stupid enough to use static data, which could easily be faked with the most basic of Microcontrollers (think PIC12C508). PS2 was more difficult, but could still be done quite easily in a small FPGA or CPLD.

On the PSP, the (encrypted) ELF file is loaded into memory, and then the digital signature is checked, so the only way of faking it is to fake the digital signature, or to find an exploit like we already have. As well all know, faking a digital signature will take too long to be practical, and even though firmware 1.51+ still contains the "formatted string bug", they no longer will run an unencrypted ELF, which is the exploit we have used from 1.00 to 1.50.

Now before you say that the Nintendo DS also uses signed code and was hacked by the hardward PassMe system, Nintendo were stupid enough not to bother to include the header in the signature (as it was easier to support GBA ROMs that way), and only the header was hacked. Since the header contains the execution address, changing this address to point to the GBA slot lets the DS check the signature on the code it thinks it's going to launch and then launch yours instead.

Unless we can find an equivalent exploit on the PSP, the only hardware hack we'll be able to do is a small switch on the side of the console to switch between different firmware versions. Have fw1.00 or 1.5 for homebrew, and 2.0 or whatever for commercial.

Now, does anyone know if the firmware flash is seperate on the PSP, or whether it is munged in a big silicon blob along with other support chips like Nintendo like to do?

TheDevilsJester · Joined: 06 Apr 2005 Posts: 16

F9zDark · Joined: 02 Apr 2005 Posts: 127

mrbrown · Joined: 17 Jan 2004 Posts: 1536

This thread has degenerated into something you'd find on a PSP homebrew fan site, so you're probably better off moving it to one of those sites, where I'm sure there are active threads whining about the same thing.

Locked.