Custom Firmware - The proof of concept

[Ralan]

clearly i have to repeat myself again.
You can load your own SHELLS on boot, maybe even one day an emulator to run decrypted firmwares off of the memory stick

but you cannot, and will never be able to flash a completely decrypted firmware to the psp.

No cmplete replacement BUT but someone could make a shell or a tiny customization boot without loading most of the XMB corrrect?

[DJShrimpy]

You meen like when you turn it on, the XMB just pops up, as if your exiting sleep mode?

Can someone please answer my question?

[Nevada]

No cmplete replacement BUT but someone could make a shell or a tiny customization boot without loading most of the XMB corrrect?

as i've said the vshmain.prx is one of the very last modules to load, by the time it runs your custom code pretty much all of the original, ENCRYPTED firmware has already been loaded to memory.

[djthegreatidiot]

Can someone please answer my question?

Yes, it is like exiting sleep mode. Loads just a little slower though.

[jaxxster]

surely if this ever supports more than 10 prxs loading up then maybe we can load up the decrypted 2.7 prxs to get the 2.7 xmb and features with 1.5 homebrew?

[mathieulh]

as i've said the vshmain.prx is one of the very last modules to load, by the time it runs your custom code pretty much all of the original, ENCRYPTED firmware has already been loaded to memory.

Those modules can be easely unloaded while the ELF is running, then others can be loaded instead.

[DJShrimpy]

Cool. And also it says "hiding currupt icons", but before that it said it runs 1.00 EBOOTs??

[Ralan]

as i've said the vshmain.prx is one of the very last modules to load, by the time it runs your custom code pretty much all of the original, ENCRYPTED firmware has already been loaded to memory.

So i could i run PSIX or SNESx9tyl 0.4 one day without going to the XMb

[Nevada]

Those modules can be easely unloaded while the ELF is running, then others can be loaded instead.

they can indeed but for something like a second firmware, you'd need alot more space than whats left in the flash, which would mean loading the custom firmware from the memory stick, how would that be any different from using devhook or any other firmware emulator, other than it doing so on boot?

The announcement of "custom firmware" has everyone and their sister thinking they'll be able to replace the psp's firmware with something else, which just isn't true.

So i could i run PSIX or SNESx9tyl 0.4 one day without going to the XMb

you can already read the readme alex distrobuted with the files.
they just need to be ran from the memory stick, not flash.

[jaxxster]

So i could i run PSIX or SNESx9tyl 0.4 one day without going to the XMb

you can already

[DeMoN X]

However, when trying to go into Recovery mode (which doesn't work, the light just keeps flashing and flashing) when I let go of the R button, the emulated firmware loaded the application (in my case, PSP Osx).

I wonder why Recovery mode's not working using devhook, Anyone got any ideas?

[Ralan]

they can indeed but for something like a second firmware, you'd need alot more space than whats left in the flash, which would mean loading the custom firmware from the memory stick, how would that be any different from using devhook or any other firmware emulator, other than it doing so on boot?

The announcement of "custom firmware" has everyone and their sister thinking they'll be able to replace the psp's firmware with something else, which just isn't true.

No what we (or atlest I) think as a custom firmware is any customized firmware running on the PSP with no exicution form the XMB required.

OMG.... Im going to put PSIX on my MS and let that be my "custom firmware" by my deffinition.

[niemand0815]

hmm. what if someone would replace one of the first modules which the psp loads upon boot?
and then programs a kind of "minimal" os without the sony prx'es.

that would then be a completely custom firmware. all of the original sony modules could be removed from flash (well, possible most of them) including the original xmb.
(you could still emulate official firmwares via devhook if it would be done right. maybe a modified version of devhook would be needed though).

that would indeed be my dream of a "psp linux" :-)

next question:
which part of the psp decides which prx'es are loaded upon boot?
if that is a prx, can we replace it?

[DJShrimpy]

I still don't get this. It says it runs 1.00 EBOOTs, then under it it says it hides currupt data. Where the hell is the currupt data gonna come from!?!?

[Dylema]

you can run 1.5 and 1.0 eboots. The hide currupt icons is for the 1.5 eboots.

[DeMoN X]

I still don't get this. It says it runs 1.00 EBOOTs, then under it it says it hides currupt data. Where the hell is the currupt data gonna come from!?!?

The 1.50 Kxploited EBOOT's.

[DJShrimpy]

Cool I guess. But I still think that this thing is just pointless. Good day everyone.

[dasurfrdude27]

O.K.

Fluff, this question is directed at you since you look/talk like you know what your doing.

I remember when everybody was hyped up about editing the dreg and ireg.

Someone had said this registry contained information that was something like an MD5 for all the flash0 files.

You get what I'm saying?

The registry verified that the files in the flash0 are original.

This is probably wrong, but for some reason I remeber someone saying that.

So, if we edit some of those "MD5s" (yes, I know they are not MD5, but I don't know what to call them) couldn't we load a custom PRX?

Thanks for your patience.

Peace.

[Chathurga]

I still don't get this. It says it runs 1.00 EBOOTs, then under it it says it hides currupt data. Where the hell is the currupt data gonna come from!?!?

It does both!
Loads 1.0 eboots
Loads 1.5 (hidden corrupt icon)

Edit: DeMoN X beat me to it.

[niemand0815]

@dsshrimpy:
you can choose between running 1.5 and 1.0 eboots. if you run 1.5 eboots you can hide the corrupt data.

@ralan:
if fact i think the xmb is running if you configure autoload. just that you dont see it as it immediately starts some homebrew for you (if i understand right when exiting your shell, you will be at the xmb thus the xmb is active on the psp).
so this is a customized/modified firmware, but not a custom firmware in my definition. a custom firmware would not need any original files any more (well, maybe a bootloader of some kind), but would use own functions as replacement.

[FreePlay]

O.K.

Fluff, this question is directed at you since you look/talk like you know what your doing.

I remember when everybody was hyped up about editing the dreg and ireg.

Someone had said this registry contained information that was something like an MD5 for all the flash0 files.

You get what I'm saying?

The registry verified that the files in the flash0 are original.

This is probably wrong, but for some reason I remeber someone saying that.

So, if we edit some of those "MD5s" (yes, I know they are not MD5, but I don't know what to call them) couldn't we load a custom PRX?

Thanks for your patience.

Peace.

Completely wrong, actually....

1. The registry does nothing with flash0 apart from tell the PSP where the fonts are.
2. They're SHA1s, not MD5s
3. The firmware is encrypted, not signed. You have to re-encrypt a modified PRX, not reapply an MD5.

[Ralan]

@dsshrimpy:
you can choose between running 1.5 and 1.0 eboots. if you run 1.5 eboots you can hide the corrupt data.

@ralan:
if fact i think the xmb is running if you configure autoload. just that you dont see it as it immediately starts some homebrew for you (if i understand right when exiting your shell, you will be at the xmb thus the xmb is active on the psp).
so this is a customized/modified firmware, but not a custom firmware in my definition. a custom firmware would not need any original files any more (well, maybe a bootloader of some kind), but would use own functions as replacement.

Yes but as math said you could clear the firmware data the was loaded into ram and in theroy have a "Custom firmware".

[dasurfrdude27]

Completely wrong, actually....

1. The registry does nothing with flash0 apart from tell the PSP where the fonts are.
2. They're SHA1s, not MD5s
3. The firmware is encrypted, not signed. You have to re-encrypt a modified PRX, not reapply an MD5.

Wow.

Thank you very much.

So if we could get this algorithm to encrypting PRXs, could we encrypt our own?

Er...

Couldn't we just use the PSP to encrypt PRXs, like how we use it decrypt them?

Thanks again for your patience.

It's always good to learn!

Peace.

[comthre3]

hmm, no one answered this Q, does anyone know which prx's can we load from the 2.71 firmware (devhook) so that we can play 2.+ games directly on our 1.5? or is it not possible?

[Chathurga]

Wow.

Thank you very much.

So if we could get this algorithm to encrypting PRXs, could we encrypt our own?

Er...

Couldn't we just use the PSP to encrypt PRXs, like how we use it decrypt them?

Thanks again for your patience.

It's always good to learn!

Peace.

The PSP wouldn't need to encrypt them so it wouldn't naturaly have the ability.

[oNyxia]

Got a question it said u can unbrick ur psp?
Ive written a bad gameboot file so could this help me then?

[Dylema]

I don't think you can upload any higher firmware prx right now. Their is another thred were they have been trying to get any other prx loaded from higher firmwares. All they got was a black screen.

[dasurfrdude27]

comthre3..

I believe we cannot.

This is because 2.0+ uses a different method of encryption in the firmware for loading games, modules, etc.

The 1.5 firmware could not decrypt 2.0+ modules...

I hope I awnsered your question correctly!

Peace.

[EM1L]

Got a question it said u can unbrick ur psp?
Ive written a bad gameboot file so could this help me then?

No, since you cant launch any programs

[oNyxia]

great oh well 2 bad need to get the modchip then....

thx