Secrets of PSP Firmware 3.71

Printable View

September 14th, 2007, 23:49
wraggster

Secrets of PSP Firmware 3.71

Freeplay one of the PSP Scenes best for hacking has decided to share all his investigations into the new PSP firmware 3.71, heres the full details:

Well, like I did way back with 2.80/2.81 and 3.30, I've dug through all the module files in firmware 3.71 to see what I could find.

Here's what I've found hidden in 3.71 so far. Take away from this whatever you want; hopefully it'll stir up some speculation and get people interested.

* An official screenshot plugin, which saves either JPEG or PNG images to ms0:/PSP/SCREENSHOT, named *_####.JPG or *_####.PNG
* Hints at an official web-based content service, possibly for buying music/videos
* An Xbox Live style network gaming service, including the browser useragent strings related to it (PS3Community-agent/1.0.0 and PSP NP/1.0), using an XML-based method of communicating with the central server

* When you stop viewing an image and return to the list, the image fades out instead of disappearing.

* Custom themes are saved to flash1:/vsh/theme/custom_theme.dat . The 3.71 fw comes with the 'cookies' theme preinstalled, saved as flash0:/vsh/resource/custom_theme.dat .

* The web browser reports the PSP's version as 3.70.

* Registering your PSP with a LocationFree base station makes a file called ms0:/MSSONY/LF/REGISTER/REGISTME.ERD (??? not confirmed, just a guess).

* The HTTP user agent for the LocationFree connection is "LFX HTTP Tunnel Client 1; model=LF-PSP, modeltype=6, generation=3, support=1/2/3, codec=0/2".

* The exact Flash version is "Shockwave Flash 6.0 r72".

* Licenses for DRM-enabled video will be stored as "/PSP/LICENSE/*.PNL", and the video *might* be stored as "ms0:/MPE_ROOT/100AEV01/*.MLV".

* There's a reference to "ms0:/MP_ROOT/105ANV01/MAQ00991.MP4' for ... some ... reason.

* The following game IDs listed in umdcache.prx, for whatever reason:
** UCAS-40025 (Ghost in the Shell: Standalone Complex - Territory of Hunter [Asia])
** UCES-00152 (Go! Sudoku [Europe])
** UCJS-10001 (Mina no Golf Portable [Japan])
** UCJS-10036 (Kazuo, a.k.a. Go! Sudoku [Japan])
** ULAS-42067 (Unknown [Asia])
** ULAS-42096 (UEFA Champions League 2006-2007 [Asia])
** ULES-00147 (Madden NFL '06 [Europe])
** ULES-00468 (Every Extend Extra [Europe])
** ULES-00599 (Star Wars - Lethal Alliance [Europe])
** ULES-00647 (Capcom Puzzle World [Europe])
** ULES-00699 (UEFA Champions League 2006-2007 [Europe])
** ULJM-05087 (Untold Legends: Brotherhood of the Blade [Japan])
** ULJM-05170 (Legend of Heroes, a.k.a. Eiyuu Densetsu - Sora no Kiseki FC [Japan])
** ULJM-05185 (Akudaikan Manyuuki [Japan])
** ULJM-05254 (Crisis Core: Final Fantasy VII, 10th anniversary bundle version [Japan])
** ULJM-05275 (Crisis Core: Final Fantasy VII, solo version [Japan])
** ULJS-00060 (Daito Giken Koushiki Pachi-Slot Simulator Yoshimune Portable [Japan])
** ULJS-00113 (Disgaea: Hour of Darkness Portable Tsuusin Taisen Hajimemasita [Japan])
** ULKS-46015 (Untold Legends - Brotherhood of the Blade [Korea])
** ULKS-46076 (Unknown [Korea])
** ULKS-46116 (DJ Max Portable 2 [Korea])
** ULUS-10024 (Madden NFL '06 [USA])
** ULUS-10095 (Go! Sudoku [USA])
** ULUS-10147 (Every Extend Extra [USA])
** ULUS-10184 (Coded Arms - Contagion [USA])
** ULUS-10217 (Capcom Puzzle World [USA])
** ULUS-10221 (UEFA Champions League 2006-2007 [USA])

* audio.prx refers to ULJS-00019 (School Rumble: Nesan Jiken Desu [Japan]) for... some reason
* isofs.prx refers to:
** ULES-00123 (Rengoku - The Tower of Purgatory [Europe])
** ULJM-05006 (Rengoku - The Tower of Purgatory [Japan])
** ULJM-05063 (SSX On Tour [Japan])
** ULJM-05127 (Dragon Quest & Final Fantasy in Itadaki Street Portable [Japan])
** ULUS-10013 (Rengoku - The Tower of Purgatory [USA])
** ULUS-10042 (SSX On Tour [USA])

* utility.prx pays special attention to all the different regional versions of Tekken 5 Dark Resurrection. It's been suggested that this is because of the way the game uses PSP-specific savedata.
* it also pays attention to:
** ULES00016 (Darkstalkers Chronicle: The Chaos Tower [Europe])
** ULJM05005 (Vampire Chronicle: The Chaos Tower [Japan])
** ULJM05026 (Star Soldier [Japan)
** ULUS10005 (Darkstalkers Chronicle: The Chaos Tower [USA])
** ULUS10021 (Midnight Club 3: Dub Edition [USA])

* Some interesting registry entries:
** /CONFIG/NETWORK/GO_MESSENGER

* References to files that don't exist, either because they're not made yet or because they're for the devkit only:
** flash0:/kd/npdrm_tool.prx
** flash0:/kd/usbserial.prx
** flash0:/kd/usbgps_serial.prx

* lfatfs.prx refers to flashfat4, flashfat5, lflash0:0,4 and lflash0:0,5. These devices don't exist on the slim; at least, I couldn't assign them as devices myself. Attempting to do so returns error 0x8001000D.

* loadexec_02g.prx refers to a new execution mode - 'umdemu', to go along with game, vsh, and updater.

* mpegbase_260.prx refers to ULJS00006 (Soukyuu no Fafner [Japan])

* np_auth.prx refers to all sorts of weird stuff, like:
** the words "Lediatio Lunto Ritna"
** something called X-I-5, with a version of 2.1, which appears to be related to submitting 'tickets' to https://auth.??.ac.playstation.ne t/nav/auth; probably related to logging onto the network play service

* the pops plugin uses a PS1 BIOS called 'System ROM Version 4.5 05/25/00 J', which is apparently the same as the 3.70 one (as indicated by the partial SVN path 'branches/pops-370/src(r5808)' in pops.prx)

* both umdman.prx and umdcache.prx contain the entire UMD_DATA.BIN file from ULJS-00001 (Ridge Racers [Japan])

* content_browser.prx appears to be some sort of convoluted multifunction plugin... I've found references to widgets/MusicAlarmTime.cpp which implies some sort of musical alarm clock, but also to what appears to be a music player (maybe) including a list of compatible formats:
** msgmusic_info_codec_atrac 3
** msgmusic_info_codec_wav_l inearpcm
** msgmusic_info_codec_1.4m
** msgmusic_info_codec_mp3
** msgmusic_info_codec_aac
** msgmusic_info_codec_wma
** msgmusic_info_codec_unkno wn
** msgmusic_info_codec_atrac 3plus
** msgmusic_info_codec_5.1ch
** msgmusic_info_codec_3m
** msgmusic_info_codec_4.6m
** msgmusic_info_codec_wav_a dpcm

* references to /PSP/APP, which is also created when you run the 1SEG player (downloadable apps, anyone?)

* references to /MSSSJ/GUIDE and /MSSSJ/PE ... whatever they are

* as before, references to /PSP/MINIGAME

* new registry categories:
** /CONFIG/NP, containing keys named account_id, login_id, and password
** /NETWORK/GO_MESSENGER ... containing unknown keys

There's probably a lot more that I've overlooked, but this is the stuff that caught my attention.

and also this:

More diggings, this time into the RCO files!

game_plugin.rco:
The application software and all related data will be deleted from the
Memory Stick™.
Are you sure you want to continue?

msvideo_main_plugin.rco:
Progressive Download
maybe like how you can play a video on Xbox Live while it's downloading?

The download could not be completed.
You must save a valid user key before downloading.
see, DRM!

This content cannot be accessed on your account.

To use this content, you must activate the system.

This video is protected.
Are you sure you want to delete the video?

The effective period of the user key has elapsed.
%1

The effective period has not started. Progressive download is not available.
The system will download without playback.

This video includes copyright protection.
Are you sure you want to delete it?

This video is set with a password. You cannot do progressive download.
The video will download without playing.

The copyright protection information is invalid.

This content has a time limit.
Go to [Settings] > [Date & Time Settings] > [Date and Time], and select [Set via Internet] to set the date and time.

The content has expired and is no longer available.

This video cannot be played.
The region code is not correct.

music_browser_plugin.rco:
This track cannot be played.
The service registration is invalid.

Delete failed.
The copyright protection information is invalid.

This track cannot be played.
The copyright protection information is invalid.

This track cannot be played.
The number of plays is restricted.

npsignin_plugin.rco [NEW]:
Sign in to PLAYSTATION®Network.

The connection with PLAYSTATION®Network timed out.

PLAYSTATION®Network is closed.

Use of PLAYSTATION®Network has been suspended.
Try to sign in again later.

PLAYSTATION®Network is busy.
Try to sign in again later.

You cannot use PLAYSTATION®Network with this account.

Use of PLAYSTATION®Network is suspended for this account.

An error has occurred. You have been signed out of PLAYSTATION®Network.

premo_plugin.rco:
<contains an image of a SixAxis controller>

To continue use of PLAYSTATION®Network, you must sign in again on the PS3™ system.

screenshot_plugin.rco [NEW]:
<msg_screenshot and msg_savescreenshot_conf are just "Pending".>

topmenu_icon.rco:
<CONTAINS A SKYPE ICON - tex_fcs_skype>

Discuss all the details above via Comments
via freeplay
September 14th, 2007, 23:53
xcjzerox

wow thats alot of stuff does this include the fat one as well
September 14th, 2007, 23:56
IDidMyTime

Quote:

Originally Posted by xcjzerox

wow thats alot of stuff does this include the fat one as well

I doubt half of that is needed in the original model, especially everything to do with the umd cache.

* Some interesting registry entries:
** /CONFIG/NETWORK/GO_MESSENGER

I dont see why thats interesting, Go Messenger has been confirmed by SCEE to be used with the PSP Camera for online vid chat.
September 14th, 2007, 23:58
Prasoc

woah nice features (apart from drm). good article!
September 15th, 2007, 00:05
Veskgar

Wow, very cool findings. Its nice to get a detailed picture of all the stuff hidden inside a firmware.

I'm really excited about the "XBOX Live" type of service for the PSP. The PSP has long needed something like that for playing with friends/family over infrastructure.
September 15th, 2007, 00:07
Johnny Rash

Some interesting things in there, I think. Sony should have it's own PSP messenger.
September 15th, 2007, 00:09
mike03$$$

nice find! looking forward for a m33 update
September 15th, 2007, 00:16
DPyro

Yay, their adding the ability to sign into the PSN on PSP :D
September 15th, 2007, 00:36
jungletek

Some Skype would be leet... however, I thought Sony had announced with BT about collaboration on some VOIP app for PSP.

Curious to see how official apps pan out, among other things.
September 15th, 2007, 02:25
mike03$$$

Quote:

Originally Posted by $n!pR

Yay, their adding the ability to sign into the PSN on PSP :D

thats kinda cool but the battery will waste out i might need this when going away but i have remote play for that oh well anything new thats going to be in 4.00 sounds great
September 15th, 2007, 02:53
carlitx

wow sony actually impressed me with the creativity of this update :D good job for once yah crazy Japanese bastards XD ( i say this in the most unraciest way, its just me joking around)
September 15th, 2007, 03:10
FreePlay

Quote:

Originally Posted by IDidMyTime

I dont see why thats interesting, Go Messenger has been confirmed by SCEE to be used with the PSP Camera for online vid chat.

It's interesting because it's not announced in the update info for 3.70 or 3.71. Same for pretty much everything here.
September 15th, 2007, 03:26
yoshinatsu

Really nice features, I wanted a slim one from the very beginning! :)
September 15th, 2007, 03:57
Buddy4point0

sounds so cool, i desperately need a slim
September 15th, 2007, 10:21
DarthPaul

PlayStation Network! :eek:
September 15th, 2007, 13:27
omracer

Quote:

Originally Posted by Buddy4point0

sounds so cool, i desperately need a slim

you don't need a slim for the update but i see where ur coming from since you want another psp to test out 3.71.
if anyone can give me a turorial on make a cfw i will make cfw for 3.71.
September 15th, 2007, 14:26
lamentofking

Quote:

Originally Posted by omracer

you don't need a slim for the update but i see where ur coming from since you want another psp to test out 3.71.
if anyone can give me a turorial on make a cfw i will make cfw for 3.71.

forget the tutorial. what we really need is the downgrader first. then a cfw.
September 15th, 2007, 16:28
jurkevicz

What I need is Pandora compatible with 3.70 slim. Witch it isn't at the moment.
September 15th, 2007, 16:33
scarph

Quote:

Originally Posted by omracer

you don't need a slim for the update but i see where ur coming from since you want another psp to test out 3.71.
if anyone can give me a turorial on make a cfw i will make cfw for 3.71.

lol that was the funniest thing ive seen in a while.

if someone would just teach me how to make a 3.71 cfw i would make one.
September 16th, 2007, 02:18
openboxfilms

Cool, higher flash player, maybe one day we can have YouTube.
September 16th, 2007, 02:22
xg917

Quote:

Originally Posted by openboxfilms

Cool, higher flash player, maybe one day we can have YouTube.

we already have it.
September 17th, 2007, 04:42
F9zDark

With all those features packed in there, its really gonna suck when fat PSPs run out of flash space. Which might be sooner than we think, since Sony put double the flash in the Slim...
September 17th, 2007, 21:54
kjetil1991

but it looks like maybe they are going to give the fat a chance but well see what the future brings
December 19th, 2011, 20:55
davidbrown22257

Well, like I did way back with 2.80/2.81 and 3.30, I've dug through all the module files in firmware 3.71 to see what I could find.

Here's what I've found hidden in 3.71 so far. Take away from this whatever you want; hopefully it'll stir up some speculation and get people interested.

* An official screenshot plugin, which saves either JPEG or PNG images to ms0:/PSP/SCREENSHOT, named *_####.JPG or *_####.PNG
* Hints at an official web-based content service, possibly for buying music/videos
* An Xbox Live style network gaming service, including the browser useragent strings related to it (PS3Community-agent/1.0.0 and PSP NP/1.0), using an XML-based method of communicating with the central server

* When you stop viewing an image and return to the list, the image fades out instead of disappearing.

* Custom themes are saved to flash1:/vsh/theme/custom_theme.dat . The 3.71 fw comes with the 'cookies' theme preinstalled, saved as flash0:/vsh/resource/custom_theme.dat .

* The web browser reports the PSP's version as 3.70.

* Registering your PSP with a LocationFree base station makes a file called ms0:/MSSONY/LF/REGISTER/REGISTME.ERD (??? not confirmed, just a guess).

* The HTTP user agent for the LocationFree connection is "LFX HTTP Tunnel Client 1; model=LF-PSP, modeltype=6, generation=3, support=1/2/3, codec=0/2".

* The exact Flash version is "Shockwave Flash 6.0 r72".

* Licenses for DRM-enabled video will be stored as "/PSP/LICENSE/*.PNL", and the video *might* be stored as "ms0:/MPE_ROOT/100AEV01/*.MLV".