 |
forums.ps2dev.org
Homebrew PS2, PSP & PS3 Development Discussions
|
| View previous topic :: View next topic |
| Author |
Message |
0okm0000
Joined: 13 Jan 2006
Posts: 116
|
 Posted: Wed Jul 05, 2006 3:41 am Post subject: FW100_ipl_update (update :P) |
 |
|
CAUTION :
人柱版。实验用。超危险。无保证，责任自负。
任何事也会发生。最好避免使用。
安全出口 → http://www.playstation.jp/psp/
人柱版。実験用。超危険。無保証自己責任。
なにが起きても知りません。避けて通るのが吉。
非常出口 → http://www.playstation.jp/psp/
To sacrifice yourself. Experimental. Extremely dangerous.
No warranty. Use on your own risk and responsibility.
Anything may happen. We recommend you to avoid seeing/downloading/using this.
Emergency exit -> http://www.playstation.jp/psp/
* this CAUTION copy from SEC(nem) :p
| groepaz wrote: | there is no "mix". its just about programming the 1.0 ipl into another firmware, which is pretty much pointless other than for seeing it actually works (or not). merely an interisting experiment for people who know what they are doing.
if you dont know exactly what it does and what you could use it for by looking at the posted code, forget it. you dont need it at all. |
Don't use "IPL Data" from "ridge racers's kbooti.bin"
it will brick your PSP !!!
| Code: |
// most of code from moonlight & PspPet
#include <pspkernel.h>
#include <psptypes.h>
#include <stdlib.h>
#include <string.h>
#include <stdio.h>
#include <pspdebug.h>
PSP_MODULE_INFO("FW100_ipl_update", 0x1000, 1, 1);
PSP_MAIN_THREAD_ATTR(0);
PSP_HEAP_SIZE_KB(0);
#define printf pspDebugScreenPrintf
int (* sceIplUpdateClearIpl)(void);
int (* sceIplUpdateSetIpl)(void);
/*** This function from PspPet PSARDUMPER ***/
static u32 FindProc(const char* szMod, const char* szLib, u32 nid)
{
SceModule* modP = sceKernelFindModuleByName(szMod);
if (modP == NULL)
{
printf("Failed to find mod '%s'\n", szMod);
return 0;
}
SceLibraryEntryTable* entP = (SceLibraryEntryTable*)modP->ent_top;
while ((u32)entP < ((u32)modP->ent_top + modP->ent_size))
{
if (entP->libname != NULL && strcmp(entP->libname, szLib) == 0)
{
// found lib
int i;
int count = entP->stubcount + entP->vstubcount;
u32* nidtable = (u32*)entP->entrytable;
for (i = 0; i < count; i++)
{
if (nidtable[i] == nid)
{
u32 procAddr = nidtable[count+i];
printf("entry found: '%s' '%s' = $%x\n", szMod, szLib, (int)procAddr);
return procAddr;
}
}
printf("Found mod '%s' and lib '%s' but not nid=$%x\n", szMod, szLib, nid);
return 0;
}
entP++;
}
printf("Found mod '%s' but not lib '%s'\n", szMod, szLib);
return 0;
}
void ErrorExit(char *error)
{
printf("%s\n", error);
sceKernelDelayThread(30 * 1000 * 1000);
sceKernelExitGame();
}
int main()
{
pspDebugScreenInit();
SceKernelModuleInfo modinfo;
u32 base;
SceUID fd;
SceUID mod;
mod = sceKernelLoadModule("ms0:/UPDATE/FW150_ipl_update.prx", 0, NULL);
if (mod < 0)
ErrorExit("Error loading update module.\n");
if (sceKernelQueryModuleInfo(mod, &modinfo) < 0)
ErrorExit("Cannot query module info.\n");
base = modinfo.text_addr;
printf("modinfo.text_addr : %.8X\n", modinfo.text_addr);
fd = sceIoOpen("ms0:/UPDATE/FW100_ipl.bin", PSP_O_RDONLY, 0777);
if (fd < 0)
ErrorExit("Cannot read IPL Data\n");
printf("Reading IPL Data...\n\n");
sceIoRead(fd, (void *)(base+0x900), 0x37000);
sceIoClose(fd);
fd = sceIoOpen("ms0:/UPDATE/FW100_ipl_update.elf", PSP_O_WRONLY | PSP_O_CREAT | PSP_O_TRUNC, 0777);
if (fd < 0)
ErrorExit("Cannot save ELF\n");
printf("Writing ELF...\n\n");
sceIoWrite(fd, (void *)(base), 0x40000);
sceIoClose(fd);
mod = sceKernelStartModule(mod, 0, NULL, NULL, NULL);
if (mod < 0)
ErrorExit("Error Start update module.\n");
sceIplUpdateClearIpl = (void *)FindProc("IplUpdater", "sceIplUpdate_driver", 0x26093B04);
sceIplUpdateSetIpl = (void *)FindProc("IplUpdater", "sceIplUpdate_driver", 0xEE7EB563);
printf("start sceIplUpdateClearIpl & sceIplUpdateSetIpl\n");
sceIplUpdateClearIpl();
sceIplUpdateSetIpl();
ErrorExit("Finished. Exiting in 30 seconds\n");
return 0;
}
|
i test it with my FW1.50PSP, it's work
& find 1.00IPL can work with FW1.50 :D
now my psp is FW1.50 + 1.00IPL :P
more information
About the 1.00 downgrade idea
http://mphwebsite.tuxfamily.org/punBB/viewtopic.php?pid=12110
sceLflashFatfmtStartFatfmt
http://forums.ps2dev.org/viewtopic.php?p=41886&highlight=iplupdate#41886
| moonlight wrote: | Also, the 1.50 updater call to these functions from iplupdate.prx:
sceIplUpdateClearIpl() -- no parameters, it erases the blocks of the ipl.
sceIplUpdateSetIpl() -- no parameters. it writes the 1.50 ipl which is embedded in the own iplupdater.prx (contrary to the +2.00 updaters, where the ipl is in the psar)
The iplupdater also exports sceIplUpdateUpdateIpl, but the updater doesn't import it, and it seems that it's not called, it doesn't seem to be an export available for vsh mode. (maybe it's called inside the iplupdater, but i haven't seen that call). Looking at the dissasembly, that function doesn't write to the flash, not at least using the sceNand functions.
Another difference between the 1.50 updater and the 2.XX updaters, is that the iplupdater from 1.50 doesn't use any verification function from sceNand, like sceNandVerifyEcc, etc. (I don't know if it does another kind of verification).
In theory, and only in theory, we can use the following procedure for a 1.00 downgrader:
- Extract iplupdater.prx and flashfmt.prx from the 1.50 update.
- Load them, and hack in ram the iplupdater.prx writing the 1.00 ipl on its "iplbuffer", which is easy to locate looking at the disassembly.
- call sceLflashFatfmtStartFatfmt
- Write the flash0 files of an 1.00 dump using sceIo
- call sceIplUpdateClearIpl
- call sceIplUpdateSetIpl
Using sony code to write the ipl and formatting the flash prior to writing the files should be safer, but it won't be me who tries it :) |
_________________
PSP hardware hack
http://0okm.blogspot.com/
Last edited by 0okm0000 on Wed Jul 05, 2006 4:05 pm; edited 4 times in total |
|
| Back to top |
|
 |
ghost333
Joined: 07 Apr 2006
Posts: 1
|
| Posted: Wed Jul 05, 2006 4:42 am Post subject: |
|
|
does this work?
u tested? |
|
| Back to top |
|
|
Alcahest
Joined: 25 Mar 2005
Posts: 135
|
| Posted: Wed Jul 05, 2006 4:47 am Post subject: |
|
|
Hmm what would this allow us to do?
Launch PBPs on 1.50 without the need for the Kxploit?
Sounds interesting! :D
Later,
Alcahest |
|
| Back to top |
|
|
kururin
Joined: 05 Jul 2006
Posts: 36
|
| Posted: Wed Jul 05, 2006 7:22 am Post subject: |
|
|
looks like someone was right and new about it :
http://forums.ps2dev.org/viewtopic.php?t=4249&start=150
| Mathieulh wrote: | Well the IPL itself changes in every fw versions, just because it performs a checksum of most of the critical prx in flash0:/kd/
Of course special IPL revisions (kbooti.bin) does not perform those checksums :) And one of them has a flaw allowing to run decrypted prx :)
However the newer retail IPLs requires to run encrypted prx that matches the checksum otherwise the psp wont boot, that's why you can't run an 1.00 fw with the 1.50 IPL (even if it does have the 1.00 prx keys required to load those)
Some IPL such as the one from v2.00 adds some securities such as ELF = USER mode..... or 2.50 IPL that adds Version = 2.50 .....
They also add/change some failsafe features from 1.50 to 2.50
But mostly every IPL revisions do the same job
BTW: The DEM-100 Kbooti.bin and the psp kboot.bin shares the same encryption keys so a kbooti.bin from a debug unit can be flashed into a retail psp :) Interesting isn't it ?
(If the mods wanna know how I got this information I just decrypted the kbooti.bin located in the japanese version of the ridge racers UMD's modules, it's the DEM-100's 1.0.2's IPL revision (the 1.00 fw is the same as the DEM-100 1.0.3 so it's a pre 1.00 IPL)) |
|
|
| Back to top |
|
|
TestType
Joined: 13 Dec 2005
Posts: 23
Location: Iceland
|
| Posted: Wed Jul 05, 2006 8:02 am Post subject: |
|
|
0okm0000 released this on his website about a month ago or more and has updated it since.
It's a upgrader/downgrader for fw 1.0 units. It enables 1.0 users to upgrade to 1.5 while being able to go back to fw 1.5. It does not however work as a downgrader for 1.5 units to fw 1.0. Something due to the bad sectors of the flash having to be the same as before and this program backs up your flash to match them, I've forgotten the details unfortunately.
Taken from pspupdates post of the update:
| Quote: |
For those who don't know, this application allows you to safely upgrade your 'rare' 1.0 PSP to 1.5, try out whatever you want, and then, come back to 1.0. Great, isn't it? The only catch is that you can't just downgrade any PSP. You need to have a backup of your own firmware. Anyone else's backup won't work. |
_________________
PSP: Japanese Firmware 1.0 :: 1gb SanDisk Memory Stick |
|
| Back to top |
|
|
Alcahest
Joined: 25 Mar 2005
Posts: 135
|
| Posted: Wed Jul 05, 2006 8:08 am Post subject: |
|
|
No i think this is something different.
I've used Ookm's DHT prog on my 1.0.
But now, it's about having a mix of fw 1.0 & fw 1.50 apparently.
Later,
Alcahest |
|
| Back to top |
|
|
groepaz
Joined: 01 Sep 2005
Posts: 305
|
| Posted: Wed Jul 05, 2006 2:22 pm Post subject: |
|
|
there is no "mix". its just about programming the 1.0 ipl into another firmware, which is pretty much pointless other than for seeing it actually works (or not). merely an interisting experiment for people who know what they are doing. if you dont know exactly what it does and what you could use it for by looking at the posted code, forget it. you dont need it at all.
_________________
http://www.hitmen-console.org
http://hitmen.c02.at/files/yapspd/ |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
Powered by phpBB © 2001, 2005 phpBB Group
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
