forums.ps2dev.org

moonlight · Joined: 26 Oct 2005 Posts: 567

Do you know what the vshAvcResumeDebugGetVTimerBase (from sceVshBridge) does?

It... executes the games/homebrews in the memory stick!!!

Yeah, the code of this function (which can be called from vsh mode), simply sets the kernel mode and then execute the function LoadExecForKernel_28D0D249, which requires kernel mode and it's the one that does the real thing.

My question for those md5 experts... How big is the posibility of a collision between two strings that have sense? Do you think this is more probably a false name to fake us?

kuroitenchi · Joined: 23 Apr 2006 Posts: 10

Great finding ! :) I think Mathieulh spoke somewhere on this forum of some hidden debug functions within vshbridge (without giving further details) it seems to be one of them.
I am no expert but I presume that it is just a forgotten debug function forgotten in the retail firmwares that doesn't do what it was meant to.

Anyway it's a great step into running kernel mode in 2.00 :)

moonlight · Joined: 26 Oct 2005 Posts: 567

kuroitenchi · Joined: 23 Apr 2006 Posts: 10

so, vshAvcResumeDebugGetVTimerBase cannot actually be used to run homebrews on 2.00 because LoadExecForKernel_28D0D249 wont run decrypted elfs ?

moonlight · Joined: 26 Oct 2005 Posts: 567

kuroitenchi · Joined: 23 Apr 2006 Posts: 10

Well from my point of view I don't think that fw 1.00 was what I'd call secured. You could run any decrypted elfs as long as it was packed within a pbp and reverse engeneering the how the pbp is done isn't rocket science.

I wonder what LoadExecForKernel_28D0D249 in newer firmwares need to actually execute an elf, does the elf only need to be encrypted, or does it needs to comply some other restrictions ?

TyRaNiD · Joined: 18 Jan 2004 Posts: 918

There are alot of collisions in the md5 brute forcing because only 32bits of the md5sum are used by the nid. In all likelyhood it is the same function name as the unknown sceLoadExec one just with vsh at the front. We may never know the real name :(

And the elf will probably always need to in a ~PSP wrapper on the 2.0+ (and possible 1.51+) firmwares, that isn't to say of course that the elf has to be encrypted but we have yet to really determine what all the fields mean. Perhaps if people look hard enough there might be an exploit in the decryption code. Who knows if noone looks too hard :)

moonlight · Joined: 26 Oct 2005 Posts: 567

jas0nuk · Joined: 27 Apr 2006 Posts: 137

I'm not too knowledgable when it comes to the VSH and how ELFs are executed... does this mean that the ELF must be encrypted so that the header begins ~PSP instead of ~ELF before it can run through this method?