2.6 Kernel access - Proof of concept

Kernal!...New Eloader!... WMA!!!...2.6!.....Cant wait..gna burst

anyway, has anything at all happened since the last update? ;)

no but it is linked to isos

people jus wait and see...get some patience

Mod Edit: Banned for violating several Forum Policies.

http://forums.qj.net/showthread.php?t=2047
http://forums.qj.net/psp-homebrew-hacks-discussion/9733-operation-positive-posting.html

getting full kernel access is just a matter of patching loadexec from the kernel space ram to make it load any elfs in kernel mode, the best is just to patch it and get back to vsh so the patch remains until the psp reboots. That way anyone can just run kernel mode elfs from the "game" area on vsh.

About downgrading it's a matter of faking the version directly in ram so that psp displays v 1.00 even if the index.dat remains unchanged so there is no need of flash0:/ access or to bother with index.dat new encryption, then you can run the 1.50 update.
Of course if you patch loadexec and get full kernel mode you can also run a homemaid updater that wouldn't need to fake the version.

Cheers :)

If you want the Spamming to stop... stop the Thread until Fanjita has some Results to show off...

Why so fragile this Time? Dont ask Peaple to stop - Make em stop...

Peaple... Let us just wait... else the Mods probably are going to blast like a Bubble Gum Bubble... :P

I didn't agree at start but it seems that this thread needs to be moved to the dungeon to prevent spamming, however that unfortunately wont prevent the spammers of opening other threads :/

Zitat:

---

Zitat von mathieulh

I didn't agree at start but it seems that this thread needs to be moved to the dungeon to prevent spamming, however that unfortunately wont prevent the spammers of opening other threads :/

---

You are correct. I think it should remain here for now, but feel free to create another developer only discussion thread in the Dungeon if you want. I have no problems with that because this thread has taken up a lot of my time over the last day.

Dark_Alex has just posted his 2.6 prx dycrpter http://forums.maxconsole.net/showthread.php?t=22912

Zitat:

---

Zitat von rivera_129

Dark_Alex has just posted his 2.6 prx dycrpter http://forums.maxconsole.net/showthread.php?t=22912

---

It doesn't work 100% according to the author but it's still a nice piece of work :)

Zitat:

---

Zitat von mathieulh

getting full kernel access is just a matter of patching loadexec from the kernel space ram to make it load any elfs in kernel mode, the best is just to patch it and get back to vsh so the patch remains until the psp reboots. That way anyone can just run kernel mode elfs from the "game" area on vsh.

About downgrading it's a matter of faking the version directly in ram so that psp displays v 1.00 even if the index.dat remains unchanged so there is no need of flash0:/ access or to bother with index.dat new encryption, then you can run the 1.50 update.
Of course if you patch loadexec and get full kernel mode you can also run a homemaid updater that wouldn't need to fake the version.

Cheers :)

---

About launching apps from the GAME menu, exactly. People are saying this and that about GTA LCS, but technically you'll only need to run it like once.

what does the decrpytor do though?

Zitat:

---

Zitat von muratcan

About launching apps from the GAME menu, exactly. People are saying this and that about GTA LCS, but technically you'll only need to run it like once.

---

once everytime you reboot your psp. its like no kxploit kind of.

Zitat:

---

Zitat von QJ_Haseo

what does the decrpytor do though?

---

it decrypts part of the 2.6 firmware

We need an encryptor!

Zitat:

---

Zitat von t-devil

We need an encryptor!

---

Why would we need/want to do that? Sony does that for us already. :confused:

Zitat:

---

Zitat von mathieulh

About downgrading it's a matter of faking the version directly in ram so that psp displays v 1.00 even if the index.dat remains unchanged

---

Yeah, no. The IPL changed in version 2.50. The boot process from 2.50 and up will refuse to boot lower firmware versions. Do this and your PSP is a brick.

Zitat:

---

Zitat von FreePlay

Yeah, no. The IPL changed in version 2.50. The boot process from 2.50 and up will refuse to boot lower firmware versions. Do this and your PSP is a brick.

---

THE BINARY MESSIAH HAS SPOKEN!

so how long till we get this patch thing going :D am watching tv in school atm and i wana turn there tv over..

Zitat:

---

Zitat von Paradox.psp

so how long till we get this patch thing going :D am watching tv in school atm and i wana turn there tv over..

---

To quote the policies:

Zitat:

---

3) Do not ask:
When an emulator, game or hack will be made or released, for a special emulator or game to be written/ported for you, when a downgrader will work on 2.01/2.50/2.60/2.70/2.71. Do not ask when homebrew will be available to 2.70/2.71 users or for help with anything that is covered in the FAQ's or can be easily found by searching the forums and reading the stickied threads.

---

The reason for this is it can be rather annoying and no one can provide a definite answer; even those people involved. Patience is key.

how could you do that?

when was that added?

EDITED: ah well ok sry m8 :D

want me to edit my post?

Zitat:

---

Zitat von Paradox.psp

when was that added?

---

If you're speaking about the policies; that was added from the beginning. Apparently you've never read them..

paradox i know what u mean :P
im always doing that,but with a universal remote controller..belive me , it rocks xD

The decrypter does work (partially), nice work.

whats universal remote?

It's a remote that controls the universe. No actually it is a remote that can control any TV.

Zitat:

---

Zitat von QJ_Haseo

whats universal remote?

---

its an IR app.

Zitat:

---

Zitat von QJ_Haseo

whats universal remote?

---

allows you to control literally every TV/VCR/PVR etc. that has IR port (which they mostly do!)

dude the remote control is crap period..

I wish someone would write a real one,

I bought this thing at http://cgi.ebay.co.uk/NEW-TINY-UNIVE...QQcmdZViewItem

and it sits on my keyring, works 99% of tvs ive tried, i have fun in the pub with it but yet the size of it is tiny and the psp cant get anywhere near the function ability of this £1.95 remote

Zitat:

---

Zitat von QJ_Haseo

whats universal remote?

---

Take a day off for continually derailing this thread and not reading/adhering to any of the warnings that myself or NeilR have given.

Use the Search Button next time you have a simple question, or even Google for that matter.

Bans will now be issues to any Off Topic posts in this thread, no more warnings. If you had read the thread from the beginning you would have seen plenty of them from me.

Please take the time to read the Posting Guidelines linked in my signature on your day off.

Zitat:

---

Zitat von FreePlay

Yeah, no. The IPL changed in version 2.50. The boot process from 2.50 and up will refuse to boot lower firmware versions. Do this and your PSP is a brick.

---

You are wrong, first of all, all that changes is the ram content (at least until you run the updater but then your psp wil be flashed with 1.50 IPL)
Beside as the psp allready started, nothing will prevent you from changing the version displayed in ram, all the 2.50 IPL checks is the flash0:/vsh/etc/index.dat which remains unchaged.

No you wont end up with a brick by just modifying some of the ram content.

Tested on my 2.6 UK 1003 PSP - Worked perfectly.

Fantastic work, good luck to the devs using this POC to create something great!

I love the PSP community - Just when I thought it was slowing right down, *BAM* Modchip! Then *BAM* Kernal Mode in 2.6!

I was unfortunate enough to have to get a replacement unit from Sony due to my 2.01 breaking, of course when I received the new one it was a 2.6... Now, I dont mind so much. :)

Zitat:

---

Zitat von BiSkiT

Tested on my 2.6 UK 1003 PSP - Worked perfectly.

Fantastic work, good luck to the devs using this POC to create something great!

I love the PSP community - Just when I thought it was slowing right down, *BAM* Modchip! Then *BAM* Kernal Mode in 2.6!

I was unfortunate enough to have to get a replacement unit from Sony due to my 2.01 breaking, of course when I received the new one it was a 2.6... Now, I dont mind so much. :)

---

Im lucky. a few weeks ago I had 2.70, I updated to 2.71 to brick it on purpose. My new PSP I was aiming for a 2.00 or lower. I got 2.60 and thought Eloader is enough. Now Im thinking wooooooooooooooot.

Also about the PSP community slowing day. I guess we have learnt never to underestimate it.

Zitat:

---

Zitat von FreePlay

Yeah, no. The IPL changed in version 2.50. The boot process from 2.50 and up will refuse to boot lower firmware versions. Do this and your PSP is a brick.

---

The point is to trick the PSP in RAM, then get it to flash the IPL and firmware all in one, without rebooting. That way, hopefully, your IPL and firmware are in step again when it next comes to check.

Of course, I know next to nothing about the IPL checks, and some rumours I've heard suggest that the 2.5+ hardware might well have unflashable checks for this stuff.

So it's all conjecture at this point, until someone tries it.

Fanjita, are you planning to develop this "KLoader" further?

Zitat:

---

Zitat von Fanjita

The point is to trick the PSP in RAM, then get it to flash the IPL and firmware all in one, without rebooting. That way, hopefully, your IPL and firmware are in step again when it next comes to check.

Of course, I know next to nothing about the IPL checks, and some rumours I've heard suggest that the 2.5+ hardware might well have unflashable checks for this stuff.

So it's all conjecture at this point, until someone tries it.

---

Hopefuly I know about it :)
The 2.50 IPL checks if index.dat version = 2.50 if not it refuses to start the firmware.
Beside 2.50 index.dat uses another encryption, thus you cannot just replace it by 1.00 index.dat or by a decrypted index.dat version (a version.txt renamed as index.dat)
you can be sure that these protections also exist in newer IPLs (which we can't decrypt at this time)

There are other limitations in 2.50 IPL especially regarding module modes.

Cheers :)

P.S. Fanjita : Get on msn :)

Zitat:

---

Zitat von WowserBowser

Fanjita, are you planning to develop this "KLoader" further?

---

That's a silly question don't you think?

Anyways...

Zitat:

---

Zitat von Fanjita

Rumour clear-up time : this was posted in the pspdev IRC, so that people who know what they're doing can play with it if they want. I don't mind it being spread around, but if you don't understand how sceKernelLoad* apply security checks, then it's probably not for you.

It's work-in-progress, it's not an eLoader beta, it's just a more convenient way of experimenting with the exploit (maybe), and also an effort to test some in-RAM hacks to remove some security checks.

It doesn't seem to work at the moment, and the main thing that needs to be done is to investigate why - presumably, there's a problem with the format of the ELFs being loaded.

Kernel.elf is just an arbitrary ELF - nothing I've tried so far has worked, feel free to try your own.

The source that's given is just the source of the function that's attempting to do stuff with the exploit - it doesn't show any of the exploit code, and is not a complete app in its own right.

Hope that clears it up, now I need to get on with some work so that I have some time to experiment with this at home tonight.

EDIT: And it will be done when it's done. I don't predict release dates. And continually asking when it's done just makes it take longer.

---

Zitat:

---

Zitat von QJ_Haseo

whats universal remote?

---

could you see the number of your post?




666

Zitat:

---

Zitat von Sauron13

could you see the number of your post?




666

---

Bye.

Please refer to my previous post about OT posts in this thread. See you tomorrow.