System.dreg/Font Discussion

i thought it could copy them but they wouldnt make any sense cuz of encryptions :S or(as always) im wrong? :'(

Ya you can copy some files from the flash0..how do you think we got the fonts

FYI: There was some turmoil tonight over at PSP3D. Some kid used TO's guide about replacing 0x00 with 0x20 and claimed that he had a working font exploit on 2.50. Unfortunately for him, he only uploaded the SYSTEM.DREG file - no SYSTEM.IREG - and every 0x00 in the file was replaced with 0x20.

Anyways, I had to step in and call his bluff. There was a bunch of flaming and insults, but I generally kept pretty cool and just gave him some evidence that he was lying and we're the ones who are doing this.

Also FYI: Skylark managed to figure out the checksums and we've had some awesome progress.

Zitat:

Zitat von PSP3D

Zitat:

Zitat von Mo

Regarding the 2.5 font hack thread:

I'd like to know whats what here, and honestly. I've seen noob hex fragments before, and you seem to have legit files (edu folder too), but who came up with the entire hack originally?

I hate to watch an immature fight between you and kid101, so, please, explain it all truthfully.

I'll then take the appropriate action.

The idea for the font hack came from TeamOverload, a member over at PSPUpdates. He realized that the PSP's registry contains a path to a FONT folder stored in the firmware.

After a bunch of tinkering, he managed to change the path without the PSP crashing right away. However, he couldn't access a lot of his system options.

As a regular visitor to Fanjita's IRC channel, I've gotten to know Skylark, one of the three toc2rta members who created the 2.00 TIFF exploit. I presented the problem to him. He asked me for some registry dumps and I gladly obliged.

Within a single day, he managed to put together a program (in C) that could not only read the registry, but spit out all the contents within it. I asked him to make an XML version, and so he tweaked it to spit out an XML page. The program is right here.

I then made an XML transformation stylesheet (in XSLT) that turned it into a web page. Example here. It seems to display properly in Firefox, if you want to check it out.

The one barrier we hit was that the data in the registry is validated by a checksum. We didn't know what type of checksum it was. He tried out simple CRCs and things like that, but things died for a few days because he couldn't figure it out.

Then today, both of us realized that the checksum function had to be referenced in the REGISTRY.PRX file in the firmware. We noticed that this file imported a PSP system function for the SHA1 algorithm.

After about an hour, Skylark coded up another version of the program that calculated the SHA1 checksums for the registry file and checked to see if the data was valid. He then adjusted this so that it could also write valid checksums. This program is right here.

At this point, we could edit the PSP's registry by inserting any data we wanted through a hex editor, then run Skylark's program to mark all the data as valid.

I tested out some modified registries on a simulated 2.00 using the MPH firmware loader, and noticed a few funny things (e.g. that a network connection's name can only be 15 characters, but you can store about 48 characters in its place in the registry).

Examples: modified 2.00 registry before being fixed, and the same one after being fixed.

Edit: Again, you may need Firefox to view these, since Internet Explorer seems to hate XML files. Note that there are blocks in the "unfixed" file marked in red. These are the blocks that were edited, and would thus show up as corrupt. Now, note that the same blocks in the "fixed" file are not marked in red. That's because Skylark's program fixed the blocks with a proper SHA1 and made them valid :)

Zitat:

Zitat von PSP3D

I then decided to take a leap and modify the registry of my actual PSP. I changed the path that TeamOverload had noticed to point to ms0:/fontmod . I ran Skylark's program. I copied the fonts from flash0:/font to my MS in a folder called 'fontmod', then I copied my modified registry to my PSP and rebooted.

It loaded perfectly fine. I noticed that some parts of the XMB took a little while to load. For example, the Network Update screen took about 10 seconds to load, and the MS light was blinking the whole time.

Then I decided to mess around in the System Language menu, and the results were pretty obvious. You can check them out here.

We're still not sure what we have. We have a long way to go before there is a viable exploit here, but we're now able to load files from the MS that are only intended to be loaded by the PSP's firmware itself.

Wow..this is coming along very nicely. Maybe a new exploit, but if not, it's still quite useful either way.

Wow, this seems to be moving very quickly. Can't wait to see with what you guys come up with next.

Skylark has put together an excellent piece of documentation about the research thus far. Check it out here.

Sometimes I wonder why really smart people like FreePlay even go here! :p

Because I love this community and want to see it continue to grow and flourish.

http://mirror.toc2rta.com/index.php/PspReg
Erm dont have teamover load credit?

TeamOverload = Skylark? *shrugs*