QJ.net Game Discussion - PSP, Xbox, Wii, PS3, PSP Homebrew, and PSP Guides

**xsecret** · 09-23-2005, 08:42 AM

Here is a feeling :

With all the recent fakers, we still don't know how to downgrade a PSP, but we know how to brick a PSP. A PSP is bricked when the firmware is corruped. This may happen if you shut it off while flashing the firmware.

I use to work on many PC BIOS. All recent EEPROM (where the BIOS is located) have a "boot block". A boot block is a small write-protected part of the EEPROM. At boot stage, if the unit finds the BIOS code corrupted, it will skip the part and load this small boot-block. Usually, the boot block is only able to reflash the main BIOS using only very simple access to device (no video, no keyboard, only floppy, for exemple). You just need a specially formatted floppy with a single file with a specific name.

I'm working on many firmware like ADSL Router or DVD drive. They all have a boot-block in order to revert a hand-user flash error. If you brick the PSP and send it back to Sony, i'm sure they will not rework the EEPROM BGA and they have a way to reflash the main firmware with a kind of boot-block build into the main EEPROM.

To be sure, we need to check 3 things on a bricked PSP :

1/ Check if the boot-block try to read from USB
2/ Check if the boot-block try to read from MS
3/ Check if the boot-block try to read from UMD

I think there is more chance to find a read form the MS, that's easier with a small size of code like on a boot-block. With an MS Emulator, you will be able to see WHICH file it searchs.

More, there is no enough space on a boot block to implement security check...

PS : Check about boot-block on google to know more
http://www.pcguide.com/ref/mbsys/bios/compBoot-c.html

**markymanxxx** · 09-23-2005, 08:50 AM

Sony reflash bricked PSPs using their Serial device (which connects through the serial port - the headphone connector).

**xsecret** · 09-23-2005, 08:57 AM

Quote:

Originally Posted by markymanxxx

Sony reflash bricked PSPs using their Serial device (which connects through the serial port - the headphone connector).

Is it a verified information ?

If this is the case, that's even better.

**xsecret** · 09-23-2005, 09:10 AM

http://nil.rpc1.org/psp/remote.html

Really easy hardware to build.

Did anyone tryed to check what is sent to this port on a bricked psp ?

The handshake between client and host should be simple and that may be a solution to send a firmware.

**endymion** · 09-23-2005, 09:11 AM

Sony reflashing through the serial port was conjecture only on the PS2dev forum - based on how Sony reflash other pieces of equipment. It has never been confirmed.

PSP has an IPL file in the 2.0 firmware update that appears to patch some kind of "boot block" and give it the ability to decrypt the latest PRX files in the firmware.

The only way PSP has ever been reflashed out of Sony HQ was by reverse engineering the two Samsung chips and manually reflashing them with working images. This too has been discussed on PS2dev.

**dmbfan36_23** · 09-23-2005, 09:12 AM

EDIT: <nevermind>

**endymion** · 09-23-2005, 09:14 AM

Verified where? By whom? As I said, this was discussed many months ago on the PS2dev forum and it was only put forward as a possibility based on how Sony reflashes other items in its range.

**markymanxxx** · 09-23-2005, 10:17 AM

Hmm...in that case, sorry that I stated it as fact.

I guess I just accepted it as fact a while ago...

Seems probable though. Sony are able to reflash the firmware to 'unbrick' a PSP that bricked during update.

There are other ways they do this, but the serial port seemed a safe definate. But maybe it could be USB?

Such information should have been leaked by now, surely?

Well, carry on your research about the PSP's most basic boot...good luck!

EDIT - another thing, the headphone connector (serial) is not a standard plug...look on that remote analysis link (http://nil.rpc1.org/psp/remote.html - thanks xsecret!) to see how to make the connector for PC-PSP via serial connections.

09-23-2005, 08:42 AM	#1
xsecret Join Date: Sep 2005 Posts: 77 Trader Feedback: 0	PSP EEPROM and Boot block Here is a feeling : With all the recent fakers, we still don't know how to downgrade a PSP, but we know how to brick a PSP. A PSP is bricked when the firmware is corruped. This may happen if you shut it off while flashing the firmware. I use to work on many PC BIOS. All recent EEPROM (where the BIOS is located) have a "boot block". A boot block is a small write-protected part of the EEPROM. At boot stage, if the unit finds the BIOS code corrupted, it will skip the part and load this small boot-block. Usually, the boot block is only able to reflash the main BIOS using only very simple access to device (no video, no keyboard, only floppy, for exemple). You just need a specially formatted floppy with a single file with a specific name. I'm working on many firmware like ADSL Router or DVD drive. They all have a boot-block in order to revert a hand-user flash error. If you brick the PSP and send it back to Sony, i'm sure they will not rework the EEPROM BGA and they have a way to reflash the main firmware with a kind of boot-block build into the main EEPROM. To be sure, we need to check 3 things on a bricked PSP : 1/ Check if the boot-block try to read from USB 2/ Check if the boot-block try to read from MS 3/ Check if the boot-block try to read from UMD I think there is more chance to find a read form the MS, that's easier with a small size of code like on a boot-block. With an MS Emulator, you will be able to see WHICH file it searchs. More, there is no enough space on a boot block to implement security check... PS : Check about boot-block on google to know more http://www.pcguide.com/ref/mbsys/bios/compBoot-c.html

09-23-2005, 08:50 AM	#2
markymanxxx Join Date: Aug 2005 Location: London, UK Posts: 309 Trader Feedback: 0	Sony reflash bricked PSPs using their Serial device (which connects through the serial port - the headphone connector).

09-23-2005, 09:10 AM	#4
xsecret Join Date: Sep 2005 Posts: 77 Trader Feedback: 0	http://nil.rpc1.org/psp/remote.html Really easy hardware to build. Did anyone tryed to check what is sent to this port on a bricked psp ? The handshake between client and host should be simple and that may be a solution to send a firmware.

09-23-2005, 09:11 AM	#5
endymion Join Date: Aug 2005 Posts: 52 Trader Feedback: 0	Sony reflashing through the serial port was conjecture only on the PS2dev forum - based on how Sony reflash other pieces of equipment. It has never been confirmed. PSP has an IPL file in the 2.0 firmware update that appears to patch some kind of "boot block" and give it the ability to decrypt the latest PRX files in the firmware. The only way PSP has ever been reflashed out of Sony HQ was by reverse engineering the two Samsung chips and manually reflashing them with working images. This too has been discussed on PS2dev.

09-23-2005, 09:12 AM	#6
dmbfan36_23 Join Date: Jul 2005 Posts: 50 Trader Feedback: 0	EDIT: <nevermind>

09-23-2005, 09:14 AM	#7
endymion Join Date: Aug 2005 Posts: 52 Trader Feedback: 0	Verified where? By whom? As I said, this was discussed many months ago on the PS2dev forum and it was only put forward as a possibility based on how Sony reflashes other items in its range.

09-23-2005, 10:17 AM	#8
markymanxxx Join Date: Aug 2005 Location: London, UK Posts: 309 Trader Feedback: 0	Hmm...in that case, sorry that I stated it as fact. I guess I just accepted it as fact a while ago... Seems probable though. Sony are able to reflash the firmware to 'unbrick' a PSP that bricked during update. There are other ways they do this, but the serial port seemed a safe definate. But maybe it could be USB? Such information should have been leaked by now, surely? Well, carry on your research about the PSP's most basic boot...good luck! EDIT - another thing, the headphone connector (serial) is not a standard plug...look on that remote analysis link (http://nil.rpc1.org/psp/remote.html - thanks xsecret!) to see how to make the connector for PC-PSP via serial connections.

QJ.net Game Discussion - PSP, Xbox, Wii, PS3, PSP Homebrew, and PSP Guides

PSP EEPROM and Boot block