Secrets of PSP Firmware 3.71

[wraggster]

Freeplay one of the PSP Scenes best for hacking has decided to share all his investigations into the new PSP firmware 3.71, heres the full details:

Well, like I did way back with 2.80/2.81 and 3.30, I've dug through all the module files in firmware 3.71 to see what I could find.

Here's what I've found hidden in 3.71 so far. Take away from this whatever you want; hopefully it'll stir up some speculation and get people interested.

* An official screenshot plugin, which saves either JPEG or PNG images to ms0:/PSP/SCREENSHOT, named *_####.JPG or *_####.PNG
* Hints at an official web-based content service, possibly for buying music/videos
* An Xbox Live style network gaming service, including the browser useragent strings related to it (PS3Community-agent/1.0.0 and PSP NP/1.0), using an XML-based method of communicating with the central server

* When you stop viewing an image and return to the list, the image fades out instead of disappearing.

* Custom themes are saved to flash1:/vsh/theme/custom_theme.dat . The 3.71 fw comes with the 'cookies' theme preinstalled, saved as flash0:/vsh/resource/custom_theme.dat .

* The web browser reports the PSP's version as 3.70.

* Registering your PSP with a LocationFree base station makes a file called ms0:/MSSONY/LF/REGISTER/REGISTME.ERD (??? not confirmed, just a guess).

* The HTTP user agent for the LocationFree connection is "LFX HTTP Tunnel Client 1; model=LF-PSP, modeltype=6, generation=3, support=1/2/3, codec=0/2".

* The exact Flash version is "Shockwave Flash 6.0 r72".

* Licenses for DRM-enabled video will be stored as "/PSP/LICENSE/*.PNL", and the video *might* be stored as "ms0:/MPE_ROOT/100AEV01/*.MLV".

* There's a reference to "ms0:/MP_ROOT/105ANV01/MAQ00991.MP4' for ... some ... reason.

* The following game IDs listed in umdcache.prx, for whatever reason:
** UCAS-40025 (Ghost in the Shell: Standalone Complex - Territory of Hunter [Asia])
** UCES-00152 (Go! Sudoku [Europe])
** UCJS-10001 (Mina no Golf Portable [Japan])
** UCJS-10036 (Kazuo, a.k.a. Go! Sudoku [Japan])
** ULAS-42067 (Unknown [Asia])
** ULAS-42096 (UEFA Champions League 2006-2007 [Asia])
** ULES-00147 (Madden NFL '06 [Europe])
** ULES-00468 (Every Extend Extra [Europe])
** ULES-00599 (Star Wars - Lethal Alliance [Europe])
** ULES-00647 (Capcom Puzzle World [Europe])
** ULES-00699 (UEFA Champions League 2006-2007 [Europe])
** ULJM-05087 (Untold Legends: Brotherhood of the Blade [Japan])
** ULJM-05170 (Legend of Heroes, a.k.a. Eiyuu Densetsu - Sora no Kiseki FC [Japan])
** ULJM-05185 (Akudaikan Manyuuki [Japan])
** ULJM-05254 (Crisis Core: Final Fantasy VII, 10th anniversary bundle version [Japan])
** ULJM-05275 (Crisis Core: Final Fantasy VII, solo version [Japan])
** ULJS-00060 (Daito Giken Koushiki Pachi-Slot Simulator Yoshimune Portable [Japan])
** ULJS-00113 (Disgaea: Hour of Darkness Portable Tsuusin Taisen Hajimemasita [Japan])
** ULKS-46015 (Untold Legends - Brotherhood of the Blade [Korea])
** ULKS-46076 (Unknown [Korea])
** ULKS-46116 (DJ Max Portable 2 [Korea])
** ULUS-10024 (Madden NFL '06 [USA])
** ULUS-10095 (Go! Sudoku [USA])
** ULUS-10147 (Every Extend Extra [USA])
** ULUS-10184 (Coded Arms - Contagion [USA])
** ULUS-10217 (Capcom Puzzle World [USA])
** ULUS-10221 (UEFA Champions League 2006-2007 [USA])

* audio.prx refers to ULJS-00019 (School Rumble: Nesan Jiken Desu [Japan]) for... some reason
* isofs.prx refers to:
** ULES-00123 (Rengoku - The Tower of Purgatory [Europe])
** ULJM-05006 (Rengoku - The Tower of Purgatory [Japan])
** ULJM-05063 (SSX On Tour [Japan])
** ULJM-05127 (Dragon Quest & Final Fantasy in Itadaki Street Portable [Japan])
** ULUS-10013 (Rengoku - The Tower of Purgatory [USA])
** ULUS-10042 (SSX On Tour [USA])


* utility.prx pays special attention to all the different regional versions of Tekken 5 Dark Resurrection. It's been suggested that this is because of the way the game uses PSP-specific savedata.
* it also pays attention to:
** ULES00016 (Darkstalkers Chronicle: The Chaos Tower [Europe])
** ULJM05005 (Vampire Chronicle: The Chaos Tower [Japan])
** ULJM05026 (Star Soldier [Japan)
** ULUS10005 (Darkstalkers Chronicle: The Chaos Tower [USA])
** ULUS10021 (Midnight Club 3: Dub Edition [USA])

* Some interesting registry entries:
** /CONFIG/NETWORK/GO_MESSENGER

* References to files that don't exist, either because they're not made yet or because they're for the devkit only:
** flash0:/kd/npdrm_tool.prx
** flash0:/kd/usbserial.prx
** flash0:/kd/usbgps_serial.prx

* lfatfs.prx refers to flashfat4, flashfat5, lflash0:0,4 and lflash0:0,5. These devices don't exist on the slim; at least, I couldn't assign them as devices myself. Attempting to do so returns error 0x8001000D.

* loadexec_02g.prx refers to a new execution mode - 'umdemu', to go along with game, vsh, and updater.

* mpegbase_260.prx refers to ULJS00006 (Soukyuu no Fafner [Japan])

* np_auth.prx refers to all sorts of weird stuff, like:
** the words "Lediatio Lunto Ritna"
** something called X-I-5, with a version of 2.1, which appears to be related to submitting 'tickets' to https://auth.??.ac.playstation.ne t/nav/auth; probably related to logging onto the network play service

* the pops plugin uses a PS1 BIOS called 'System ROM Version 4.5 05/25/00 J', which is apparently the same as the 3.70 one (as indicated by the partial SVN path 'branches/pops-370/src(r5808)' in pops.prx)

* both umdman.prx and umdcache.prx contain the entire UMD_DATA.BIN file from ULJS-00001 (Ridge Racers [Japan])

* content_browser.prx appears to be some sort of convoluted multifunction plugin... I've found references to widgets/MusicAlarmTime.cpp which implies some sort of musical alarm clock, but also to what appears to be a music player (maybe) including a list of compatible formats:
** msgmusic_info_codec_atrac 3
** msgmusic_info_codec_wav_l inearpcm
** msgmusic_info_codec_1.4m
** msgmusic_info_codec_mp3
** msgmusic_info_codec_aac
** msgmusic_info_codec_wma
** msgmusic_info_codec_unkno wn
** msgmusic_info_codec_atrac 3plus
** msgmusic_info_codec_5.1ch
** msgmusic_info_codec_3m
** msgmusic_info_codec_4.6m
** msgmusic_info_codec_wav_a dpcm

* references to /PSP/APP, which is also created when you run the 1SEG player (downloadable apps, anyone?)

* references to /MSSSJ/GUIDE and /MSSSJ/PE ... whatever they are

* as before, references to /PSP/MINIGAME

* new registry categories:
** /CONFIG/NP, containing keys named account_id, login_id, and password
** /NETWORK/GO_MESSENGER ... containing unknown keys

There's probably a lot more that I've overlooked, but this is the stuff that caught my attention.

and also this:

More diggings, this time into the RCO files!

game_plugin.rco:
The application software and all related data will be deleted from the
Memory Stick™.
Are you sure you want to continue?

msvideo_main_plugin.rco:
Progressive Download
maybe like how you can play a video on Xbox Live while it's downloading?

The download could not be completed.
You must save a valid user key before downloading.
see, DRM!

This content cannot be accessed on your account.

To use this content, you must activate the system.

This video is protected.
Are you sure you want to delete the video?

The effective period of the user key has elapsed.
%1

The effective period has not started. Progressive download is not available.
The system will download without playback.

This video includes copyright protection.
Are you sure you want to delete it?

This video is set with a password. You cannot do progressive download.
The video will download without playing.

The copyright protection information is invalid.

This content has a time limit.
Go to [Settings] > [Date & Time Settings] > [Date and Time], and select [Set via Internet] to set the date and time.

The content has expired and is no longer available.

This video cannot be played.
The region code is not correct.

music_browser_plugin.rco:
This track cannot be played.
The service registration is invalid.

Delete failed.
The copyright protection information is invalid.

This track cannot be played.
The copyright protection information is invalid.

This track cannot be played.
The number of plays is restricted.

npsignin_plugin.rco [NEW]:
Sign in to PLAYSTATION®Network.

The connection with PLAYSTATION®Network timed out.

PLAYSTATION®Network is closed.

Use of PLAYSTATION®Network has been suspended.
Try to sign in again later.

PLAYSTATION®Network is busy.
Try to sign in again later.

You cannot use PLAYSTATION®Network with this account.

Use of PLAYSTATION®Network is suspended for this account.

An error has occurred. You have been signed out of PLAYSTATION®Network.

premo_plugin.rco:
<contains an image of a SixAxis controller>

To continue use of PLAYSTATION®Network, you must sign in again on the PS3™ system.

screenshot_plugin.rco [NEW]:
<msg_screenshot and msg_savescreenshot_conf are just "Pending".>

topmenu_icon.rco:
<CONTAINS A SKYPE ICON - tex_fcs_skype>

Discuss all the details above via Comments
via freeplay

[xcjzerox]

wow thats alot of stuff does this include the fat one as well

[IDidMyTime]

wow thats alot of stuff does this include the fat one as well

I doubt half of that is needed in the original model, especially everything to do with the umd cache.


* Some interesting registry entries:
** /CONFIG/NETWORK/GO_MESSENGER

I dont see why thats interesting, Go Messenger has been confirmed by SCEE to be used with the PSP Camera for online vid chat.

[Prasoc]

woah nice features (apart from drm). good article!

[Veskgar]

Wow, very cool findings. Its nice to get a detailed picture of all the stuff hidden inside a firmware.

I'm really excited about the "XBOX Live" type of service for the PSP. The PSP has long needed something like that for playing with friends/family over infrastructure.

[Johnny Rash]

Some interesting things in there, I think. Sony should have it's own PSP messenger.

[mike03$$$]

nice find! looking forward for a m33 update

[DPyro]

Yay, their adding the ability to sign into the PSN on PSP

[jungletek]

Some Skype would be leet... however, I thought Sony had announced with BT about collaboration on some VOIP app for PSP.

Curious to see how official apps pan out, among other things.

[mike03$$$]

Yay, their adding the ability to sign into the PSN on PSP

thats kinda cool but the battery will waste out i might need this when going away but i have remote play for that oh well anything new thats going to be in 4.00 sounds great