Custom Firmware - The proof of concept

Zitat:

---

Zitat von hexecal

but it IS custom firmware - it is an edited version of the 1.50 firmware on the flash drive therefore making it custom

---

By those standards, anything that modifys data on flash0 or flash1 is "custom" firmware.
As far as the firmwares operations go itself, it isn't, i ask, does it add menu items?, no, does it add functionality? no (don't say yes because patching like nokxploit isn't adding a feature).
vshmain.prx is one of the FEW modules that the psp actually executes upon bootup, rather than just loading, but it's also one of the last to load on bootup, and still requires the original prx to be loaded afterwards so the psp does not brick.

This is proof that piggybacking code on the firmware is possible, if ever a modification was made to run decrypted/modified firmware, it would need to do so from the memory stick (much like devhook), because to execute the code, the psp needs to run all of it's modules right up until vshmain.prx before it will run your own code.

This is a small step towards custom firmwares as far as work required to do it is concerned, so don't get your hopes up and run around in circles wetting yourselves over the prospect of flashing a completely hacked firmware to the psp.

Zitat:

---

Zitat von jaxxster

i have to agree with everyone, it is indeed custom. Its a 1.0 firmware with customable features

---

It's this kind of crap that i'm talking about, it is NOT 1.0 firmware, it is simply loading an elf file, which patches some functions then loads the file it replaced to prevent the psp bricking.

Zitat:

---

Zitat von Fluff

By those standards, anything that modifys data on flash0 or flash1 is "custom" firmware.
As far as the firmwares operations go itself, it isn't, i ask, does it add menu items?, no, does it add functionality? no (don't say yes because patching like nokxploit isn't adding a feature).
vshmain.prx is one of the FEW modules that the psp actually executes upon bootup, rather than just loading, but it's also one of the last to load on bootup, and still requires the original prx to be loaded afterwards so the psp does not brick.

This is proof that piggybacking code on the firmware is possible, if ever a modification was made to run decrypted/modified firmware, it would need to do so from the memory stick (much like devhook), because to execute the code, the psp needs to run all of it's modules right up until vshmain.prx before it will run your own code.

This is a small step towards custom firmwares as far as work required to do it is concerned, so don't get your hopes up and run around in circles wetting yourselves over the prospect of flashing a completely hacked firmware to the psp.

---

Yes, More like a huge step, the first real modifyed flash 0 PRX running is a HUGE step

It adds a feature in X-Flash... the feature of flashing it :) lol.

The recovery mode is a new feature, it's a dual boot, even if it's the effect of
a dirty hack, or the absence of something.
It also means those pictures you flashed over didn't matter in the long run.

Hmm, I thought the makers of shells would be most excited over this.

Zitat:

---

Zitat von Ralan

Yes, More like a huge step, the first real modifyed flash 0 PRX running is a HUGE step

---

it's not a modifying prx for crying out loud, WE CANNOT EDIT SONY'S PRX'S TO DO WHAT WE WANT, it renames the real prx and loads it after it has loaded itself.
i repeat, we CANNOT EDIT THE REAL PRX's

Zitat:

---

Zitat von The Milkman

The digg post

DIGG IT

---

YEH!!

Zitat:

---

Zitat von Art

It adds a feature in X-Flash... the feature of flashing it :) lol.

The recovery mode is a new feature, it's a dual boot, even if it's the effect of
a dirty hack, or the absence of something.
It also means those pictures you flashed over didn't matter in the long run.

Hmm, I thought the makers of shells would be most excited over this.

---

Yeah, time that those shells come in handy. :)

Zitat:

---

Zitat von Fluff

it's not a modifying prx for crying out loud, WE CANNOT EDIT SONY'S PRX'S TO DO WHAT WE WANT, it renames the real prx and loads it after it has loaded itself.
i repeat, we CANNOT EDIT THE REAL PRX's

---

But we can create our own ones to do what we want, Correct? Such as the recovery.elf for example.

Zitat:

---

Zitat von jaxxster

i have to agree with everyone, it is indeed custom. Its a 1.0 firmware with customable features

---

No its not. I dont see 2-3 sec gameboot screens.

jesus fluff, no need to go off on one. Seems like you're really upset about it. Didnt realise people calling this a custom firmware could upset someone so deeply.

Zitat:

---

Zitat von DeMoN X

But we can create our own ones to do what we want, Correct? Such as the recovery.elf for example.

---

But can you replace the original firmware completly with it?

Don't get me wrong, i appreciate alex's work and think he's doing a great job with it, i just think his definition of what it actually is, was a bad choice of words.

Zitat:

---

Zitat von Fluff

it's not a modifying prx for crying out loud, WE CANNOT EDIT SONY'S PRX'S TO DO WHAT WE WANT, it renames the real prx and loads it after it has loaded itself.
i repeat, we CANNOT EDIT THE REAL PRX's

---

O.0 I just came home i i havn't been monitering this but if this it true we could make a fully "Custom firmware".

Testing the features from the POC in DevHook, I can say that SCE skip works, no corrupt icons works as well, and the screenshot feature (added via POC, not Devhook) worked as well.

Now for the weird part:
Normal Auto-Eboot load doesn't work, it always loads into the emulated XMB. However, when trying to go into Recovery mode (which doesn't work, the light just keeps flashing and flashing) when I let go of the R button, the emulated firmware loaded the application (in my case, PSP Osx).

I don't want to risk my PSP just to get rid of my % folders.

Zitat:

---

Zitat von DeMoN X

But we can create our own ones to do what we want, Correct? Such as the recovery.elf for example.

---

No, I'm sorry, its not a PRX, but an ELF.

I'm probably wrong, but I skimmed across the readme and what I think I read is that he made an ELF, and simply renamed it to a PRX and the PSP loaded it.

Again though, I'm probably wrong, I barely read it.

Could someone correct me?

Thanks!

Peace.

Zitat:

---

Zitat von Ralan

O.0 I just came home i i havn't been monitering this but if this it true we could make a fully "Custom firmware".

---

clearly i have to repeat myself again.
You can load your own SHELLS on boot, maybe even one day an emulator to run decrypted firmwares off of the memory stick

but you cannot, and will never be able to flash a completely decrypted firmware to the psp.

Ok, so I stop playing Conquer Online and now I see this!? :icon_surp :Jump:

it doesnt only rid you of % folders,it allows you to autoboot anything so you can show off to your freinds

Zitat:

---

Zitat von DJShrimpy

I don't want to risk my PSP just to get rid of my % folders.

---

There Is no risk as long as you do not turn your PSP off for the few seconds it flashes the files to the firmware!

And recovery mode works great for me! Saying that I don't have anything on autostart

You meen like when you turn it on, the XMB just pops up, as if your exiting sleep mode?

Im still kind of amazed. :dj:

Zitat:

---

Zitat von Fluff

clearly i have to repeat myself again.
You can load your own SHELLS on boot, maybe even one day an emulator to run decrypted firmwares off of the memory stick

but you cannot, and will never be able to flash a completely decrypted firmware to the psp.

---

No cmplete replacement BUT but someone could make a shell or a tiny customization boot without loading most of the XMB corrrect?

Zitat:

---

Zitat von DJShrimpy

You meen like when you turn it on, the XMB just pops up, as if your exiting sleep mode?

---

Can someone please answer my question?

Zitat:

---

Zitat von Ralan

No cmplete replacement BUT but someone could make a shell or a tiny customization boot without loading most of the XMB corrrect?

---

as i've said the vshmain.prx is one of the very last modules to load, by the time it runs your custom code pretty much all of the original, ENCRYPTED firmware has already been loaded to memory.

Zitat:

---

Zitat von DJShrimpy

Can someone please answer my question?

---

Yes, it is like exiting sleep mode. Loads just a little slower though.

surely if this ever supports more than 10 prxs loading up then maybe we can load up the decrypted 2.7 prxs to get the 2.7 xmb and features with 1.5 homebrew?

Zitat:

---

Zitat von Fluff

as i've said the vshmain.prx is one of the very last modules to load, by the time it runs your custom code pretty much all of the original, ENCRYPTED firmware has already been loaded to memory.

---

Those modules can be easely unloaded while the ELF is running, then others can be loaded instead.

Cool. And also it says "hiding currupt icons", but before that it said it runs 1.00 EBOOTs?? :confused: :confused: :confused:

Zitat:

---

Zitat von Fluff

as i've said the vshmain.prx is one of the very last modules to load, by the time it runs your custom code pretty much all of the original, ENCRYPTED firmware has already been loaded to memory.

---

So i could i run PSIX or SNESx9tyl 0.4 one day without going to the XMb

Zitat:

---

Zitat von mathieulh

Those modules can be easely unloaded while the ELF is running, then others can be loaded instead.

---

they can indeed but for something like a second firmware, you'd need alot more space than whats left in the flash, which would mean loading the custom firmware from the memory stick, how would that be any different from using devhook or any other firmware emulator, other than it doing so on boot?

The announcement of "custom firmware" has everyone and their sister thinking they'll be able to replace the psp's firmware with something else, which just isn't true.

Zitat:

---

Zitat von Ralan

So i could i run PSIX or SNESx9tyl 0.4 one day without going to the XMb

---

you can already read the readme alex distrobuted with the files.
they just need to be ran from the memory stick, not flash.

Zitat:

---

Zitat von Ralan

So i could i run PSIX or SNESx9tyl 0.4 one day without going to the XMb

---

you can already

Zitat:

---

Zitat von DarkDragon-X

However, when trying to go into Recovery mode (which doesn't work, the light just keeps flashing and flashing) when I let go of the R button, the emulated firmware loaded the application (in my case, PSP Osx).

---

I wonder why Recovery mode's not working using devhook, Anyone got any ideas?

hmm. what if someone would replace one of the first modules which the psp loads upon boot?
and then programs a kind of "minimal" os without the sony prx'es.

that would then be a completely custom firmware. all of the original sony modules could be removed from flash (well, possible most of them) including the original xmb.
(you could still emulate official firmwares via devhook if it would be done right. maybe a modified version of devhook would be needed though).

that would indeed be my dream of a "psp linux" :-)

next question:
which part of the psp decides which prx'es are loaded upon boot?
if that is a prx, can we replace it?

Zitat:

---

Zitat von Fluff

they can indeed but for something like a second firmware, you'd need alot more space than whats left in the flash, which would mean loading the custom firmware from the memory stick, how would that be any different from using devhook or any other firmware emulator, other than it doing so on boot?

The announcement of "custom firmware" has everyone and their sister thinking they'll be able to replace the psp's firmware with something else, which just isn't true.

---

No what we (or atlest I) think as a custom firmware is any customized firmware running on the PSP with no exicution form the XMB required.

OMG.... Im going to put PSIX on my MS and let that be my "custom firmware" by my deffinition.

I still don't get this. It says it runs 1.00 EBOOTs, then under it it says it hides currupt data. Where the hell is the currupt data gonna come from!?!?

you can run 1.5 and 1.0 eboots. The hide currupt icons is for the 1.5 eboots.

Zitat:

---

Zitat von DJShrimpy

I still don't get this. It says it runs 1.00 EBOOTs, then under it it says it hides currupt data. Where the hell is the currupt data gonna come from!?!?

---

The 1.50 Kxploited EBOOT's.

Cool I guess. But I still think that this thing is just pointless. Good day everyone.

O.K.

Fluff, this question is directed at you since you look/talk like you know what your doing.

I remember when everybody was hyped up about editing the dreg and ireg.

Someone had said this registry contained information that was something like an MD5 for all the flash0 files.

You get what I'm saying?

The registry verified that the files in the flash0 are original.

This is probably wrong, but for some reason I remeber someone saying that.

So, if we edit some of those "MD5s" (yes, I know they are not MD5, but I don't know what to call them) couldn't we load a custom PRX?

Thanks for your patience.

Peace.

Zitat:

---

Zitat von DJShrimpy

I still don't get this. It says it runs 1.00 EBOOTs, then under it it says it hides currupt data. Where the hell is the currupt data gonna come from!?!?

---

It does both!
Loads 1.0 eboots
Loads 1.5 (hidden corrupt icon)

Edit: DeMoN X beat me to it.

@dsshrimpy:
you can choose between running 1.5 and 1.0 eboots. if you run 1.5 eboots you can hide the corrupt data.

@ralan:
if fact i think the xmb is running if you configure autoload. just that you dont see it as it immediately starts some homebrew for you (if i understand right when exiting your shell, you will be at the xmb thus the xmb is active on the psp).
so this is a customized/modified firmware, but not a custom firmware in my definition. a custom firmware would not need any original files any more (well, maybe a bootloader of some kind), but would use own functions as replacement.