PSP: exploit for 1.00 - 2.7 psp!

ok
so this is really the first time to ever use a thread on any game site so here i go!

--------------------------------------------------------------

Below is a basic message I've sent out to many sites about my exploit. And before you flamers jump in, I want you to carefully read the following. All of it. I mean it, don't skip or don't read. Now lets get it going then. Again, this is the message.

--------------------------------------------------------------

Dear reader,
Please read through this whole letter before making any assumptions. There are links provided to two videos of this taking place. I am [-----My real name-------], also known as crait. I have found an exploit in the PSP Firmware Update to version 2.71, and would like to share this with you. Unfortianally, this only works on a certain 'type' of PSP, a certain model... I am unsure. I've tried this modified update for all of my three PSP Systems, and have found something very interesting. This 'modded' update confuses the PSP, making the psp think it is corrupted. This Eboot opens but, as usual comes to a hault by an error. But that's where the mod comes in! It tells the PSP to look for the wrong error message which disply as the following:
---------------------------------------------------------
--------------------------------------
Update cannot start.
Data is corrupt.
---------------------------------------

X: Enter O: Cancel
---------------------------------------------------------

OPPOSED TO:

---------------------------------------------------------
--------------------------------------
Data is corrupt.
(398742398472972Jumble)
---------------------------------------

O: Back
---------------------------------------------------------

Now, your thinking, "Ok, a minor glitch? Nothing would come of this."
Well, if I was correct about that part, your wrong. Let me explain the functions at the bottum of the screen, then I will give you some information on how this could be the exploit for 2.7 and another for 2.6/2.5 which will actually save people money, believe it or not!
Onto the fuctions... At the Bottum of the top error message, it states "X: Enter O:Cancel". If i were to press the X key, nothing would result, therefore it has no value or function. And onto the O key... If I were to press that button, instead of heading back to the menu, crossbar-thing, I would restart my PSP.
Wierd. Yeah, I know... Ok. Now for how this could be an exploit.
Because this Eboot is already corrupt, I can go within it, and change it as I please. What I am going to do, is, change the X key, on that error, to actually have a function. That function being to either open up the eMenu made by Fanjita and Ditlew, which will be modded too, or to open up a new entire program that will be similar.
But what about the 19 Mb it takes up? Well. I could just go in and take out the Playstation Archive file! (Data.psar) That would cut down on serious size! We're talking 17-18 megs here.

Now for the Proof!

I first would like to point out a few things. Firstly, the two videos both depict PSP's, which are both 1.5 PSP'S, not 2.7. I cannot find a 2.7 with the specifications needed to test this properly, and to it's full potential, though this will work on a 2.7 PSP ((Man that is a run-on scentance.)) The screens are way too blurry to see the system information, but it's very clear what version PSP it is. (e.i. no network icon, and modded font, and bg) The movies are also a bit blurry, but its otay otay. Also the videos make a lot more since if you watch them in the order I display them to you.

The first link shows the error, the modded error, appear on on of my PSP systems. It also shows the viewer what the functions are.
http://www.youtube.com/watch?v=DFAN29f8lNY

The second shows how this exploit is only usable on a certain type of psp, and not all of them. ((heehee sry for the broken screen one.. lol))
http://www.youtube.com/watch?v=5-7WAH0K-wE

Signal me back when you get this message, we'll chat about it, maybe find what the model exactly is that runs this exploit, etc. If you do actually even read this and you are wanting to contact me, you can reach me at the information under this line : )

Aim Screen Name: the crait (on aim)
GMail Sevice: [BLOCKED]@gmail.com
or my alternative,Yahoo: [BLOCKED]@yahoo.com

Please contact me back! : )
-crait

OH SNAP! about saving people money! if this error is to occure on a 2.5/2.6 PSP you can access homebrew, without the need of GTA: LCS! : ) yay for them!

hmm....I don't know what to think.....

what zion said

ill move to emu and homebrew forum for more investigation

otay otay
i love your site, its put together well
and i love your icon

some1 just give me a brief explanation of this them videos are a bit shit aswell

this opens up a update file (to 2.71)
the file is curropted
the psp, of course pulls, up an error
this corruptment makes the psp pull up the wrong error
that error has two keys to press opposed to the normal one key
i can change the code to make the key do something
and because its corrupt already, it will not matter
this is good and all, but does not work on all models

if my psp came origonally with fw 1.52 can i use this

ok

not so sure....
i think all firmware under 2.71 should be able to do this,
as long as the psp model is the right one...
and i dont know which model works...
if some one knows a way to figure out a model a psp is
i would love to talk to you
my aim is: thecrait
also i need some beta testers, any firmware under 2.71 of course!

the model number is at the bottom of the psp were the bar code is by the end it starts with psp my modle number is psp1001

wait.. how is this going to help do anything? the way i see it is all you did was make an eboot corrupt and crashed your psp?

naw man, this doesnt crash it
the update tells the psp that it has two options
X: Enter O: Cancel
but X: does nothing, and O: restarts

so i'm going to open the file, and make the X button actually do something, like open an emenu, or something similar


and i know that the psp model is like psp1001

i mean model as in TA-082

I'll beta-test. I have a 1.50 and a 2.71, both factory 1.50.

Quote:

---

Originally Posted by crait

naw man, this doesnt crash it
the update tells the psp that it has two options
X: Enter O: Cancel
but X: does nothing, and O: restarts

so i'm going to open the file, and make the X button actually do something, like open an emenu, or something similar


and i know that the psp model is like psp1001

i mean model as in TA-082

---

So the corruption thing works on the new TA-082 boards? And your going to trick the PSP into executing some other function with the "x" button? I assume that is what your saying? So this may be the path for anyone with a TA-082 board to execute homebrew code. Which could possibly lead to "more" with the new board PSP's?

this is something that cant be abandoned....
great work dude

I really like your approach here, I will keep my eye on this to see what comes of it. :)

crap ive got 2.71

yes sounds like this exploit could get u some where i've had a idea somewhat like that but u've though it through alot better than me :)

Smart idea, I thought of it too but only after reading your idea fully was it clear in my head...:cool: (;) ). I hope you can get it sorted cause my psps 2.71 :( , and for the record 'flamers' I didn't upgrade my psp. I bought it second hand and the pillock that originally had it did or the shopkeeper did but thankfully it's not the TA-082 model . Anyway I'm interested why you are so sure that it should work for 1.50 and 2.7 etc but not 2.71?. Is it just you've not tested it on a 2.71 yet? Best of luck with it anyway...:D (obviously)..

good luck with it. idk if you get anything out of it, but good luck. btw, how are you going to make the PSP execute your code after it restarts?

Hmm, this could be something big...

Quote:

---

Originally Posted by dalejrrocks

good luck with it. idk if you get anything out of it, but good luck. btw, how are you going to make the PSP execute your code after it restarts?

---

Only "O" restarts the PSP "X" has no function he is going to try and assign a function to "X" and get it to do something such as run an eboot etc.

Very, interesting idea...I've never programmed for the PSP (Only C++ & VB on my PC), however from what I can tell this could work. How do you plan on editing the eboot though? I suppose you could modify it in a hex editor since its already compiled. Good luck, and PM me if you need any help.

ok everyone, im going to be out of town, doing something fun... but leave a reply, and i will try to answer all of the questions you have! : )

next, thanks all you peeps applauding me! yay

ok, now... The reason it will not work on 2.71 is because i cannot change the update file's SFO file to say something like "update to 2.8"
if you dont know what that is, it basically tells the psp, what the eboot is... ex. title, regoin, and parental level.
if i do change it the psp will load the file, but it would ultimately be corrupted, and nothing, not even the exploit will run....
but is there another way? well the psp update file contains code that tells the psp to check to see if the eboot is consistant every nth second... this also makes sure the memory card was not taken out. this might be changed to were it says to check the eboot every 500,000,000 seconds. lol. but i would have to look into this, and it might be hard to change, but if i do change it, it should work, as i said though i have to look into it

also i dont know what board the psp needs for this, and my psp i use it on was purchased from someone else, then downgraded from version 2.6 to 1.5, therefore, i dont know what the original version of the psp was

next, there are many approaches im going to have on running an eboot, one is changing the update file itself, another one is changing another eboot to make the psp believe its a UMD.... lol because after I press the O button, and the psp restarts, the psp loads the UMD, but says to me i need to update the software, even though i have the parental level as high as i can, and it doesnt ask for the password hmmmm lol by the way the game is sims 2, so it doesnt work on a 1.5 psp, except with a ziso loader and stuff like that
i have other ideas to get around it too, some im sure will work, others im not too certain with

last thanks indian cheese, talk to me on aim later when i get home, my sn is 'thecrait'

that's why I had doubts in this. You couldn't change the eboot without it being corrupted and the PSP would see that just like you said.

I would like to become a beta tester but will only do it if u can garuntee me that i will not brick my psp

Quote:

---

Originally Posted by benh

I would like to become a beta tester but will only do it if u can garuntee me that i will not brick my psp

---

What are you planning on beta testing if this doesn't work? Read the previous posts.

it would be cool if he got this to work though, good luck crait

Quote:

---

Originally Posted by crait

naw man, this doesnt crash it
the update tells the psp that it has two options
X: Enter O: Cancel
but X: does nothing, and O: restarts

so i'm going to open the file, and make the X button actually do something, like open an emenu, or something similar


and i know that the psp model is like psp1001

i mean model as in TA-082

---

Does the corrupt update actually change any code, because error messages are coded into the PSP. If that error message comes up, with that data, it may have been an error from alpha or beta testing the PSP that was accidentally left in.

I highly doubt you can apply code to run during the error. The fact that X doesn't work, is that when any error that halts the system is come across, O is the only functioning button, for Cancel.

Perhaps the error that comes up is one that persisted through out the entire development of the PSP and as such, remained a 'bug error'.

I don't mean to rain on your parade or anything, but I just cannot see it as being anything more than that. The sheer fact that error codes and messages are stored in flash and not the programs or games that are run on the PSP proves that it will do nothing.

Quote:

---

Originally Posted by crait

ok, now... The reason it will not work on 2.71 is because i cannot change the update file's SFO file to say something like "update to 2.8"
if you dont know what that is, it basically tells the psp, what the eboot is... ex. title, regoin, and parental level.
if i do change it the psp will load the file, but it would ultimately be corrupted, and nothing, not even the exploit will run....
but is there another way? well the psp update file contains code that tells the psp to check to see if the eboot is consistant every nth second... this also makes sure the memory card was not taken out. this might be changed to were it says to check the eboot every 500,000,000 seconds. lol. but i would have to look into this, and it might be hard to change, but if i do change it, it should work, as i said though i have to look into it

---

This probably wont work. For starters, once the update is tampered with, the signature and encryption is destroyed, thus being invalid. The check for the eboot every nth second, seems to me, to be an extra precaution Sony added in after they found out about the Swaploit.

Quote:

---

next, there are many approaches im going to have on running an eboot, one is changing the update file itself, another one is changing another eboot to make the psp believe its a UMD.... lol because after I press the O button, and the psp restarts, the psp loads the UMD, but says to me i need to update the software, even though i have the parental level as high as i can, and it doesnt ask for the password hmmmm lol by the way the game is sims 2, so it doesnt work on a 1.5 psp, except with a ziso loader and stuff like that
i have other ideas to get around it too, some im sure will work, others im not too certain with

---

Uh... When the PSP starts, it automatically boots any UMD in the drive... You should have known this if you are wholeheartedly trying to exploit the system. Since you don't know this, I am beginning to doubt that you know what you are doing.

As well, making an eboot think its a UMD would require mounting the eboot as the UMD drive filesystem, which, wouldn't you know, requires unsigned code to run, thus making this exploit useless from the get-go.(since it already requires an exploit to work...)

Quote:

---

Originally Posted by dalejrrocks

that's why I had doubts in this. You couldn't change the eboot without it being corrupted and the PSP would see that just like you said.

---

i meant you cannot change the update's SFO file, because the psp checks for consistancy every nth second
i can still continue to change the file, just not that part, or the parts that conflict with the security checks

and to F9zDark, if you would have watched the movies i provided, and not have jumped to conclusions, you would have noticed that i changed the update file, and successfully loaded it onto one of my psp's, yet on another psp i have, it didn't work! so i did change the file, and i still had the security signiture in its original state! so nannanannana poopoo poo lol
and as i said, it starting up a pbp as though it were to be a umd is just an idea. just an idea.

ok, this should not brick your psp, and i would love beta testers!
and also pre alpha testers, like to help me figure out what model, or mother board is required for this psp hack

aim: thecrait

does it matter what fw u have as long as it's anything under 2.71 or does it matter on the motherboard only?

Quote:

---

Originally Posted by Blazed247

does it matter what fw u have as long as it's anything under 2.71 or does it matter on the motherboard only?

---

um.. right now, i think yes. actually
because anything can update to a 2.71 thats under a 2.71...
also the motherboard, i think, has to be the correct one to pull up the wrong error

Hmmm unfort. I have my doubts because the minute you touch the eboot the SONY signature is destroyed also I have seen someone try this before and then they said it was impossible for a certain reason I'll get back to you on that one ;). Well I wish you the best of lcuk though because anybody that is trying to help the scene is indeed great =D

Quote:

---

Originally Posted by pkmaximum

Hmmm unfort. I have my doubts because the minute you touch the eboot the SONY signature is destroyed also I have seen someone try this before and then they said it was impossible for a certain reason I'll get back to you on that one ;). Well I wish you the best of lcuk though because anybody that is trying to help the scene is indeed great =D

---

OMG!

FOR THE LAST TIME PPL
WATCH THE MOVIES
IT SHOWS YOU THAT I HAVE INDEED CHANGED THE UPDATE FILE, YET IT STILL ALLOWS ME TO LOAD THE UPDATE! ONLY CERTAIN MOTHERBOARDS BLOCK THE EDITED FILE!

grrr lol sry bout the caps but ppl, cmon i want you to watch both movies, and thoroly read the first post, you might want to read all the other posts so information does not have to be repeated
word up yo

It's not gonna work because the EBOOTS WILL BECOME CORRUPTED! just like everyone else is saying.

grrr
ok
watch the second movie i provided in the original post!
it shows that the update file is curropt on one psp, whilst on the other psp, its not!
just, just watch the movie, as ive been trying to make people do!

crait I just want you to know me and a few other people are rooting for you. It's not just that we got 2.71+........:D . Damn it!. Seriously though people like you give us all hope so my fingers are crossed. Guys let's try being abit more optermistic. If we all had understanding at the same level then by all means critique but while we all have talents we don't all think the same and it's apparent he already answered your doubts, just give him time to prove his method. What will be will be. The End. :p

I watched both of your vids, and I gotta say you're defenately up to something here, bro...Good luck with this. BTW, where can I get that awesome gameboot with the slashing and blood? It kicks major butt...is it from a game?