Flarejune returns with his indispensable plugin: Freecheat.
It allows, among others, to use cheats, read texts, connect USB,
taking screenshots and anytime for a game or from the XMB.

Installation:

# Download Freecheat Ver. 1.0.12.18

# Connect your PSP to your computer via USB,

# Right-click on the file you downloaded,

# Choose "Extract files ...", (WinRAR must be installed)

# Select destination (PC Desktop/PSP).

# Press OK and wait for the extraction of files.

# Copy FreeCheat folder to ms0:\
(ms0:\ = drive of your psp)

# Go to ms0:\SEPLUGINS folder on your PSP

# Open the file VSH.txt (create it if it does not exist) and add the following line:
ms0: / FreeCheat/fc_3xx.prx (If you're above CFW 3.80 M33)
ms0: / FreeCheat/fc_371.prx (If you're on CFW 3.71 M33-4)

# Open the file GAME.txt (create it if it does not exist) and add the following line:
ms0: / FreeCheat/fc_3xx.prx (If you're above CFW 3.80 M33)
ms0: / FreeCheat/fc_371.prx (If you're on CFW 3.71 M33-4)

# Open the file GAME150.txt (create it if it does not exist) and add the following line:
ms0: / FreeCheat/fc_3xx.prx (If you're above CFW 3.80 M33)
ms0: / FreeCheat/fc_371.prx (If you're on CFW 3.71 M33-4)

# Open the file POPS.txt (create it if it does not exist) and add the following line:
ms0: / FreeCheat/fc_3xx.prx (If you're above CFW 3.80 M33)
ms0: / FreeCheat/fc_371.prx (If you're on CFW 3.71 M33-4)

# Turn off your PSP.


# Go to Recovery Menu (Shut Down PSP then Hold Rtrigger then Power on)

# Go to Plugins and activate your desired plugin (press X/O to enable)

Remember:

fc_3xx.prx (If you're above CFW 3.80 M33)
fc_371.prx (If you're on CFW 3.71 M33-4)

Ex. CFW 3.71 M33

fc_371.prx [VSH.TXT]
fc_3xx.prx or fc_371.prx [GAME.TXT]
fc_3xx.prx or fc_371.prx [GAME150.TXT]
fc_3xx.prx or fc_371.prx [POPS.TXT]

# Then exit Recover Menu

Use:

* To launch the plugin, press the note button, this button is configurable in:

just go to FreeCheat Options> Hotkeys Setup> FC activate hotkeys> Press your desired hotkeys.

-translation by-
SPIDEY @ PINOYPSP/PSP4NOOBZ

http://bbs.levelup.cn/showtopic-641513.aspx

Description:

You know what this is :3.

Upgrades from previous release
--Player GFX
--HUD
--Guns.txt
--Particles

Ok, binary loader, hello world and SDK finished, get it here. Read the readme for the imporant stuff.
It's encrypted and works on the US version only.
Get the SDK here.

Old post for nostalgia:

Quote:
So, happy new year. I think presenting a new usermode exploit on the PSP is a good way to start 2009

GripShift has a buffer overflow vulnerability when loading savegames. The savegame contains the profile name which can be easily used to overwrite .
The savegame file is pretty big (25kB) so you have lots of space to put your code there. I wrote a simple blob of code to paint the framebuffer completely white (to just indicate that arbitrary code is running ).
The return address is located at offset 0xA9 in the file. In this poc it points to 0x08E4CD50 (which is only a few bytes after the return address), and the code starts at 0xCC in the file.

It was tested on 4.01M33-2 with US version of GripShift (ULUS10040), and psplink.prx, usbhostfs.prx and deemerh.prx loaded (also without psplink and usbhostfs). The decrypted savegame (sorry, couldn't [be bothered to] get Shine's savegame tool working so it's in plaintext form) is in the SDDATA.BIN form which Hellcat's Savegame-Deemer produces (thanks to him, if the program didn't exist I wouldn't have bothered with this. ). Just copy the ULUS10040SAVE00 directory to /PSP/SAVEPLAIN/ and run the game. EDIT: yeah, don't forget to have Savegame-Deemer working, duh.

Credits go to those who deserve them.

Hello World on PSP FW 1.52-5.02
The Spartaaaaaaaaaaaaaaaaaaaa!!! Exploit

by MaTiAz & FreePlay

Instructions
------------
1. Copy the contents of MS_ROOT into the root of your memory stick.
(This will overwrite the first GripShift savegame slot).
2. Launch the US version of GripShift.
3. Load up the game (if it doesn't autoload).
4. See your PSP run unsigned code.

It'll autoexit after some time. You can use the home button to exit too if
you've seen enough.

FAQ
---
Q: Will this allow downgrading?
A: No, because this is an usermode exploit and functions required to downgrade are
only available in kernel mode.

Q: Why the name?
A: Because the original exploit was found by overwriting the player name with
"this is spartaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaa".

Q: Can/Will Sony block this?
A: Yes.

Q: I wanna make homebrew using the exploit. How?
A: Get FreePlay's GS SDK: http://f6y.ath.cx/pspdev/sparta_sdk.zip
It has some constraints though, check the readme.
The Hello World was written with it.

Credits
-------
Exploit and binary loader: MaTiAz
SDK: FreePlay
Greets go to Dark_AleX, Mathieulh, jas0nuk, Hellcat, etc. etc. etc, you know.

QLeap published a new unofficial version of AnyRegion Change that will allow you as its name suggests to change various settings for your system, of course, the region and language.

This version improves the original level of support for Wii and Korean support Systemmenü patched with tools such as StarFall.

News / corrections:

- Region Free full Wii / NGC (mod04)
- Autoboot systematic fashion Recovery (mod04)
- Fixed some bugs particularly when replacing a 3.3k Systemmenü another 3.3k, SD cards are no longer mounted correctly.
- Improved Region Free with some modchips.

Next up, we have an updated uLaunchELF by dlanor and E P!

We'll do a direct quote of the changes because no one explains it better than they do.


Quote:
LaunchELF v4.31 (2009.01.04)
-Added new "MISC/About uLE" subprogram, displaying a program credits screen
-Enhanced FileBrowser to support multiple hotplugged USB mass drives
-Upgraded usbhdfsd to SVN rev 1490 by radad, for multiple USB drive support. Note that this may require running the new "setup.sh" script, for those who wish to compile uLE themselves. (Or use the new script "upgrade_usbhdfsd.sh".)
-Fixed various issues with TextEditor (inability to insert CRLF at CRLF etc)
-Fixed a partition unmounting issue, that sometimes caused non-fatal failure of the TextEditor to show proper partition contents when browsing for a text file

First up we'll catch you up to speed with ffgriever's In Game Reset! He's now updated it to work with HDL. Well, at least to an extent for now. But he's done what no one else has, given regular users the ability to soft reset games back to the HDL menu without getting out of their chairs.

Here's a bit of his changes:


Quote:
Updated 04 January 2009:

IGR for HDLoader rev2.

DNAS games should work now
Fixed some games that were giving blue screen (eg. ico)
Fixed some games that were giving bsods
Fixed some games that didn't react to combo press at all
Everything should be more stable
New method of unhooking hdloader
Name of hdloader file has been changed to "HDLOADER.ELF", as suggested by dlanor.

Out of these, only the last one (new unhook method) can cause some problems. I tested it on v7 and v10 only.

BTW. HDLoader doesn't unhook itself properly even in mode 3. That's why proper unhooking has to be done by IGR even when mode 3 is enabled. But fortunately we always have unchanged copy of kernel in rom . So I'm just copying whatever I have to.

Version 2.00 beta.2 2009/01/04

Start the application that can be tied to an external file extension. (MoonShell2 is still not able to come back) (/ moonshl2/extlink/readme.txt).
As related apps, ImageViewer (extension IPK) were added.
Bonus features "to reverse the screen up or down the file list" [/ auxiliary tools / bonus features / SwapDisp.txt] added.
Even the disk format to a small cluster size is the most 8GByte to start. (SDFormatter recommended)
When the next image file of less than 512 pixels, to fill the launcher as a wallpaper file list.
The touch screen text (non-scroll bar area) that can scroll.
When you close the panel, L / R has an option to disable the button.
Launch_Tab0_Launch.png and Launch_Tab1_NDS.png change the image size of 256x192 pixels.
3 seconds or more in any SELECT of the screen to save the screen capture button and continue. (Help create skins)

A + B + L + R Fixed a bug that did not work properly initialize command of the entire set at the same time when you start pressing.
And the option to hide the file extensions, a bug fix will not appear until the folder name extension.
Fixed a bug that appears in the list of file extension is not supported.

V2.0: 04/01/2009
* Mode graphics with alpha lerp for better readability
* Updating the intro like that of my other emulators
* Switch to the standard library management via DLDI FAT
* Sort files in the selection and transition to 512 files displayed
* Added sending the compatibility of a game via WIFI
(see http://www.portabledev.com/pages/ds/...ers-thomds.php)
* Improved emulation buzzer (try the speech software Vox
to see ^ ^)
* Improved display speed (direct and assembler)
* The directory THOMDS is no longer required, files can be everywhere
* Added the management of state backup MO5 (load / save state) with
save 999 files per tape
* Add the moving of the tape
* Mode stylus via R & L
* Management of the stylus on the screen after the most accurate screen mode
* Management mode of the DS (the cover closed pauses execution)