I hadn't seen anyone else approach it from this direction, but what if the data.bin in the updater EBOOT is what performs the decryption of the flashrom (data.psar) image. That way, sony could encrypt the flashes with something that would be completely seperate from the onboard "keys".
Perhaps disassembling the data.bin could give us what we need to decrypt the data.psar and obtain an unencrypted flash image?
I'm just thinking that the flash updater program is going to be something that runs at the lowest level on the PSP no?
I'll update here after I try some things out.
Just a thought though, feel free to poke holes in this idea :D
Cheers
Perhaps Data.bin holds some clues
All of the code to decrypt data.psar is in the PSP's kernel and the updater itself. The entire update process is handled from the updater (data.psp), nothing else.
The updater must be placed in the UPDATE directory, because it runs with more modules than a normal game on MS or UMD. vshbridge allows it to get away with things it normally couldn't in user mode.
The updater must be placed in the UPDATE directory, because it runs with more modules than a normal game on MS or UMD. vshbridge allows it to get away with things it normally couldn't in user mode.