forums.ps2dev.org

Long time passed after I appeared the scene. Here is how I find to get into service mode. Pretty long. ;) There was a rumor that battery may be involved to service mode, so firstly I examined battery communication. Text below was written long time ago and includes some obsolete descriptions. Battery...

Mainboard mod for 'Titan Base', my attempt to interrupt flash line:

http://sec.pn.to/pw/?plugin=attach&pcmd ... efer=Bases

FYI :) unsigned long ecctbl&#91;4096&#93;; /*&#31639;&#20986;&#29992;&#12486;&#12540;&#12502;&#12523;&#12398;&#28310;&#20633;*/ void make_ecctbl&#40;&#41; &#123; int i; for &#40;i=0; i<4096; i++&#41; &#123; ecctbl&#91;i&...

Dr. Vegetable,

You would better to add power pads for flash, GND and Vdd is for DRAM. Vcc(+3.3V) is used for some I/O including daughter board.

Sorry for late. Following is a brief memo (could be obsolete partly) for memory chip of PSP, reversed result. Note that there may be misunderstanding and/or mistakes. Please confirm yourself before applying hardware hacks for the PSP. SAMSUNG MCP memory chip pinout, flash related &#40;Top view&a...

CPU chip reads the memory chip to retrieve IPL on cold start, when you press the power switch.
Power is only applied to CPU chip after pressing the power switch, and I observe no access to memory chip when battery placed, external power connected, and so on.

Any need for hardware hack? :)

The session was good to see.
See you later at Maker Faire at EuroOSCON ;)

Theoretically, decryption of IPL enables us to decrypt all files on further versions, until sony thinks out something spechial anti-hack measure. If sony do not have some sort of secret weapon, this could be difficult to achieve. I was so excited that I became insane and wrote like that. Possibly s...

There are various way to get the IPL dumped. For I am out now, explaining briefly. Direct hardware access, by which I firstly got the dump, is a little annoying to do. You have to peel off the memory chip, or need to interrupt the pattern on the PSP main board. The more convenient way is to read by ...

I have successed to decrypt IPL. Here is how. This article is mostly based on my guess, so there could be some errors. IPL overview Within the on-board flash ROM, there exist non fat organized area which contains encrypted bootstrap code, or IPL; Initial Program Loader. While booting up CPU reads th...

Great work!
How did you manage to get the table?
IPL hack or something like that?

Sorry about your bricked PSP, Yoshihiro :( Here is how to setup PSP to enable recovering bad flash. A little hard way though. ;) If you have direct hardware access to flash chip, it is possible to reflash. You will need to interrupt physically the lines between CPU chip and MCP memory chip if you wa...

I think error code 0xfffffed3 is related to decryption.
Could be something like 'key type number not found' I guess.

Found function names of sceAudio. API name for sceAudio STUB_FUNC 0xCB2E439E,sceAudioSetChannelDataLen STUB_FUNC 0x13F592BC,sceAudioOutputPannedBlocking STUB_FUNC 0x95FD0C2D,sceAudioChangeChannelConfig STUB_FUNC 0x136CAF51,sceAudioOutputBlocking STUB_FUNC 0xE9D97901,sceAudioGetChannelRestLen STUB_FU...

A demo program to output sound can be downloaded from: http://anon.ug.to/sec/index.html Enjoy! :) API's not yet documented... Briefly, sceAudio_2 sceAudio/0x13F592BC Output sound, blocking sceAudio_3 sceAudio/0x5EC81C55 Initialize channel and allocate buffer sceAudio_4 sceAudio/0x6FC46853 Terminate ...

Thanks all :) Now I'm away from our Titan base and have limited access to resources. Narrow connection to the net also prevents me from even reading the forum. Things go too fast to catch up. :( Source code. I need some brush-ups of the code. Maybe later. skippy911: Thanks for your list. Good work! ...

Not responsible.
So far I did not kill PSP by this software.

** WARNING ** This software accesses to system memory and firmware, which may cause SEVERE DAMAGE TO YOUR EQUIPMENT. There are some possibilities of PERMANENT DESTRUCTION OF THE PSP. NO WARRANTY. USE AT YOUR OWN RISK! ** WARNING ** PSP Dump released. Only for PSP 1.00. Firmware files can be dumped b...

There are strong inquiry for dumped firmware. I am very sorry to say that I can not email/share/post the dumped firmware to anyone, at least for now. Not only ooPo, but someone may claim distribution of dump as a intellectual property right infringement. Technically speaking, I can not distinguish s...

how about flashing the chip back with firmware ver1.0? Is that possible? It is possbile but difficult, and need a lot of effort to do so. First, you need to get firmware dump of 1.00 PSP. Sacrifice a 1.00 PSP and get dumped by means of previously mentioned. Please, please do not ask me to copy/shar...

Another q. To the people who made this - is the elf a normal ps2 elf? Or something a little modified? Not same. Please refer to outpatch.cpp and startup.s of the source code package, and the executable itself. I've been using Elf2PBP to convert a few PS2 apps this morning, and haven't had any succe...

I can't understand how work the call to kernel function. does the numbers in startup.s are the address of the functions in kernel/memory ? how did you find them and what was their parameters ? I dumped the firmware of PSP by electrical means. Peel off the memory chip from PSP mainboard, connect wir...

For your interest, notes for PSP ELF format and program loader. Some need confirmation. - ELF Type: EXEC(0x0002) NB:PRX have 0xffa0,0xff81, etc. - ELF Flags: seems not to be used - any section name, any section deploying is allowed, except .rodata.sceModuleInfo for module information - .rodata.sceMo...

some stub as follows: STUB_START "sceCtrl",0x40010000,0x00020005 STUB_FUNC 0x6A2774F3,sceCtrlSetSamplingCycle STUB_FUNC 0x1F803938,sceCtrlReadBufferPositive STUB_END STUB_START "sceDisplay",0x40010000,0x00030005 STUB_FUNC 0x0E20F177,sceDisplaySetMode STUB_FUNC 0x289D82FE,sceDispl...

Ah, I already menthioned flashing in another thread. I need more sleep. my head sucks.

I have not try to replace loader after I can execute some PBPs on 1.0. Listed in TODO list.

The bitmap in the code is 5551 formatted short. You'll find in the code how rgb is assigned to. I do not know about tools. I wrote some small code to convert the image.

Thanks for you all :) Discussions and infos in this forum enabled me to make Hello World. There are some inquiries about source code. Here you are: http://anon.ug.to/sec/pub/hellopsp_src_Rel1.zip To build the code, I used ps2dev toolchain for PS2. There is no devtool for PSP yet. PS2 and PSP both us...

I should post some specimen. Firmware version 1.00 release:1.00: build:228,0,3,1,0:root@psp-vsh system:17919@release_103a,0x01000300: vsh:p4029@special_day1,v9972@special_day1,20041201: Firmware version 1.50, updated from 1.00 release:1.50: build:376,0,3,1,0:root@psp-vsh system:20182@release_150,0x0...

As Vampire posted at dev forum, UMD file system can be accessed via wipeout browser using file://disk0:/... Firmware, or on-board flash chip file system can be accessed by same way using flash0 as drive string. <a HREF="file&#58;//flash0&#58;/vsh/etc/version.txt">version.txt</a><br...