forums.ps2dev.org

You are right about that compiler version, it works and I just got the dump. This is great! It's not like I am the only one who has no clue of why the ipl sdk doesn't really work the way it should (well, the pandora recovery menu works on the phat, not the slim; the bios dumper simple fails to work ...

to use booster's ipl sdk, you have to compile it with gcc 4.0.2. it didn't work with gcc 4.3.2 (for me at least). i spend 2 days, to find that out! :( Damn it! I got a gcc 4.1.0 :'( Man, that sucks! I have spent 4 days looking for a way to dump that thing and ended up with failure. It leaves me no ...

Sorry for bumping this thread. I think I have reverse engineered almost all of the wanted MIPS code in the ipl, all I need is the pre-ipl. I have a 2k slim, and I tried booster's ipl sdk, but didn't work (not sure what I did wrong). I did the search and have read through the results, didn't really h...

Thanks for the tip! You should also use the part2* file of psardumper, it is quite poorly named and really the part1* file shouldn't even be saved. The part1* file is the same as the part2* except it still includes a header for each decrypted IPL block which just tells the preIPL where in memory to ...

For 2.00 and 2.50 updaters, psardumper will dump and fully decrypt the IPL. From 2.60 onwards the IPL was further encrypted which used the contents of the pre-IPL as a seed so psardumper cannot fully decrypt those IPL's. For these fw, psardumper will dump the IPL and decrypt the block decryption of...

Did you watch TyRaNiD's presentation about breaking the security model of the PSP? I guess you can find some useful information on how they messy up the original IPL and create a custom one.

Oh, so, this is the story why they only manage to partially decrypt the 5.55fw, although some people might have fully decrypted it in their own privacy.

Thanks for sharing the knowledge though, I will make sure to do more research before asking dumb questions.

Yeah, that's what I was suspecting...
Does psardumper decrypt the ipl?

Oh, I see. mesg_led.prx is probably decrypted by some other means.

Thank you, really helpful info you have here!
I got a little question though.
Isn't this file a firmware file? Then how does it get decrypted in the first place before anybody can use its decrypt functions?

Anyone kind enough to tell me what these 2 functions do?

sceMesgd_driver_102DC8AF
sceNwman_driver_9555D68D

It would be really nice if someone can point me to some useful info about this module without asking me to reverse engineer it :)

yup, it works this time.

really nice work!

i remember last year i also did a little decompiler, but that was a bit lame, i just did the decompile thing out of the output from prxtool! i guess that way i can just copy & paste a piece of the disassembly output and decompile it without any problems.

Well the real problem is the program header is garbage. No idea what you used to build it, most likely as the ELF is not loaded at the "standard" address you have a custom linker script? Or is this "third party code"? I am sure I am paranoid, but I would swear some of the change...

just give an example elf here. and i tracked down the error: LoadExports() returns false in CProcessPrx::LoadFromFile(const char *szFilename) and thats because in CProcessPrx::LoadExports(), pExport == NULL at some point. here is the debug output: PRXTool v1.1 : (c) TyRaNiD 2...

@ hnaves i just tried out your patch, maybe it doesn't work with the boot file i was trying to disassemble last July. well, i got an "Couldn't load elf file structures" error. well, maybe it only works with prx's but not elf files? anyway, i was away from the psp stuff for a while and didn...

hi hnaves, thanks for the effort!

I check out the newest version and built it, i got a "Couldn't load elf file structures" message when I tried to disassemble my old boot.

Did anyone try it and got this error?

I sort of know it is used after sceKernelCreateFpl(), can anyone tell me where does this function allocate memory from? from the kernel memory or the user memory? If someone can point me to more infos about this function would be awesome, thinks!

Will there be a quick fix anyway? :P

For variables you actually have to add the data section address to the variable address to get the proper address. I think this is no longer the case for fw3.70+ (according to you). Variable addresses appear to be the real addresses, as their values are all above 0x8804000. Can I modify some part o...

I believe I am using the newest build. I think prxtool is a very useful tool because it has the ability to detect data references and gives me some level of information about it. So good jobs you guys! This feature doesn't work anymore (I don't know since which firmware). It is a bit annoying withou...

looks like the current version of prxtool doesn't fully support some of the later firmwares, any plan to fix that?