psp-dev have released their exploit for ver. 1.5

AzureBlaze · Post by **AzureBlaze** » Wed Jun 15, 2005 9:07 pm

http://www.only4.info/psp-dev/

I don't have a second MS
Can someone confirm it?

Vampire · Post by **Vampire** » Wed Jun 15, 2005 9:28 pm

confirmed...

Cogboy · Post by **Cogboy** » Wed Jun 15, 2005 9:32 pm

confirmed again. This is great!

Raoul · Post by **Raoul** » Wed Jun 15, 2005 9:32 pm

Hi

What will happen if instead of doing this swap trick, we build an EBOOT.PBP file with inside another EBOOT.PBP file which is in fact the DATA.PSP just renamed (like in the psp-dev trick)??

Actually I can't test it, because I can't find a way to insert a PBP file inside another one... but still digging.

Regards

radui2 · Post by **radui2** » Wed Jun 15, 2005 9:37 pm

lol... How did you get it working?
I tried it 2 ways:
#1: Launch the 'launcher' and then immediatily swap the MS's, and I wait for about 4-5 seconds in front on the PSP screen, and then it just shuts off (not reboots)
#2: Launch the 'launcher', what until after the MS light flashes, and the try to replace the MS's, but I'm never fast enough... it just says 'The game could not be started'
I'm trying to run SNES9x
How did you do it?

MDave · Post by **MDave** » Wed Jun 15, 2005 9:43 pm

I'm having the same problem too (but with nem's helloworld)

Is there a difference between japanese 1.5 and us 1.5 firmware? :o

radui2 · Post by **radui2** » Wed Jun 15, 2005 9:45 pm

Don't think so...
Maybe we just have to be faster at swapping the MS's
Right.....?

MDave · Post by **MDave** » Wed Jun 15, 2005 9:49 pm

I'm swapping as fast as humanly possible, but just dosn't work. hehe.
I got japanese 1.5 firmware btw. You have US firmware radiu2?

radui2 · Post by **radui2** » Wed Jun 15, 2005 9:56 pm

MDave wrote:I'm swapping as fast as humanly possible, but just dosn't work. hehe.
I got japanese 1.5 firmware btw. You have US firmware radiu2?

Yeah, I've got the US one

Raoul · Post by **Raoul** » Wed Jun 15, 2005 10:06 pm

Well can't find a way to put an EBOOT.PBP inside another EBOOT.PBP...

BTW, I have tested the trick with two MS and it is working fine.

For those who can't make it run be sure to hav exactly the same path:

MS1 => \PSP\GAME\TEST\EBOOT.PSP from the MS1 folder
MS2 => \PSP\GAME\TEST\EBOOT.PSP from the MS2 folder

If you do not succeed, you are very unluky or very awkward, I did test on an 1.5 JP and works fine at the first test.

MDave · Post by **MDave** » Wed Jun 15, 2005 10:13 pm

ahaa, found out what the problem is. if you use the manual method for making the eboot.pbp on the ms2 it works :) the program that makes it for you seems to not do it right.

check manual on how to: basically just take the data.psp file out of a eboot, and rename it to eboot.pbp and use that in the ms2

So there you go :)

MindWall · Post by **MindWall** » Wed Jun 15, 2005 10:14 pm

I hear that Snes9x and some other programs have .. "problems" when being converted by the program (the M2 part).

however if you do it "manually" as described in the PDFs you should be able to run them.

g'luck

MDave · Post by **MDave** » Wed Jun 15, 2005 10:20 pm

I can't get over how simple this exploit is, I even tried doing memory stick swapping a while ago, with no results. But taking the data.psp out of an eboot.pbp and renaming it? Now thats clever, yet simple :P

Now, the next step I see being done is using this exploit to load a homebrew app that can flash the firmware files to 1.0, since its now possible to extract and flash firmware :) Saves having to swap memory sticks every time.

MindWall · Post by **MindWall** » Wed Jun 15, 2005 10:24 pm

ok.. but i'm not the one testing that idea.. hehe :)

it would be nice if something simple like this will make possible watching hi-q movies, or even starting boot.bin
could not be as simple as renaming the boot.bin to eboot.pbp and using the same procedure... could it?

Shazz · Post by **Shazz** » Wed Jun 15, 2005 10:24 pm

I don't really understand what the SwapTool does to the original EBOOT.PBP, it seems it extract the .PSP/.ELF file to copy it in the MS2 dir but the last bytes seems modified...(why ? CRC ?)

But if the 2nd method works, it doesn't matter, I understood you just need :
1. a regular pbp archive with only the picture (PNG) and the descriptor (SFO) [and NO .PSP file) on the 1st MS
2. your homebrew elf application renamed as EBOOT.PBP (which is NOT a real PBP file)

Maybe I miss something, seems so easy...

So does the firmware acts in 2 steps ?

1. Read EBOOT.PBP on the memory stick and be sure it is a real one (SFO+PNG) to display it

2. Want to run this pbp ?

//swap the stick
If(real pbp) then
check security();
else
execute(); ???
end if

wooo... is it right ?

MindWall · Post by **MindWall** » Wed Jun 15, 2005 10:48 pm

I guess in 1.5x there's a better check of validity of the eboot.pbp and simply missing data.psp does not cut it.

how about using a proper data.psar or even the whole eboot.pbp (from the firm-update) and use the swap idea.

the check of the eboot should "pass" and then the "swapped" file with the same name will be executed?

gosh i feel smart today =/

Shazz · Post by **Shazz** » Wed Jun 15, 2005 11:01 pm

MindWall wrote: [....] how about using a proper data.psar or even the whole eboot.pbp (from the firm-update) and use the swap idea [....]

Makes sense but where do you find a proper DATA.PSAR for firmware 1.0 (if this is your idea to downgrade...) and firmware upgrade checks should occur after...

But for the moment I'm just wondering if the swapping thing works, a poll ?? :D

MindWall · Post by **MindWall** » Wed Jun 15, 2005 11:16 pm

no.... no.. the idea was related to the fact that the "exploit"-swap does not work on 1.51 nor 1.52

so.. get the data.psar for ver-up 1.5 stick it in the pbp perform the swap trick and run a homebrew...

and clean update of firmware will be very limiting if you want to use games and whatnot that will require 1.5+
so probably only a partial update of only some modules will be best.

Chrighton · Post by **Chrighton** » Wed Jun 15, 2005 11:16 pm

It seems the 1st method using the tool is corrupting the end of the file, this is likely the culprit of the problems people are having. Method B works fine, another confirmation :)

radui2 · Post by **radui2** » Wed Jun 15, 2005 11:17 pm

Shazz wrote:
MindWall wrote: [....] how about using a proper data.psar or even the whole eboot.pbp (from the firm-update) and use the swap idea [....]
Makes sense but where do you find a proper DATA.PSAR for firmware 1.0 (if this is your idea to downgrade...) and firmware upgrade checks should occur after...

But for the moment I'm just wondering if the swapping thing works, a poll ?? :D

It works, but could only get NestrJ to work through the provided MSwap.exe
If I tried SNES9X or Generator, it just froze and then turned off. (This may also be because I didn't have any roms in their folders, but then again NesterJ ran with no roms also)

Shazz · Post by **Shazz** » Wed Jun 15, 2005 11:20 pm

Chrighton wrote:It seems the 1st method using the tool is corrupting the end of the file...)

Thanks Chrighton, it should validate my little scenario :D
So now, time to dump the 1.5 firmware using Drakonite's tool ! :D

TRF-Yu-Ki · Post by **TRF-Yu-Ki** » Wed Jun 15, 2005 11:36 pm

Method B is the way to go..... Method A with that executable thing of theirs is gonna confuse people for the next couple of weeks. =^)

wulf · Post by **wulf** » Wed Jun 15, 2005 11:54 pm

confirmed again..

and I was one of the absolute naysayers.. I used the tool they provided on linux (using wine)
I used chess.. cool port, btw.

You just have to be fast like a jackrabbit.. don't wait for the psp logo to stop chiming.

ckinni · Post by **ckinni** » Thu Jun 16, 2005 12:17 am

so an admin should rename the sticky to 1.51 and take off 1.5 because now we have one! but DAMN, why did i update??? :(

cwbowron · Post by **cwbowron** » Thu Jun 16, 2005 12:26 am

I just played my pspChess program for the first time on a real psp. It felt good. Unfortunately I was in the middle of a debug build when I did it and the cursor control was backwards.

It would be nice to see a command line tool that creates the two EBOOT.bin files necessary for getting this exploit to work. That would make it easier for developers to create them in their compile scripts and release them which would make it easier for the end users as well.

Vampire · Post by **Vampire** » Thu Jun 16, 2005 12:32 am

cwbowron wrote:It would be nice to see a command line tool that creates the two EBOOT.bin files necessary for getting this exploit to work. That would make it easier for developers to create them in their compile scripts and release them which would make it easier for the end users as well.

it is a command line tool

cwbowron · Post by **cwbowron** » Thu Jun 16, 2005 12:44 am

Vampire wrote: it is a command line tool

Ahhh, Yes... I am an idiot...

I didnt investigate it very far... I just used the GUI and didnt bother to look in the program directory...

Thanks for pointing it out...

thedyingmatt · Post by **thedyingmatt** » Thu Jun 16, 2005 1:41 am

Hi I'm an Uber noob, seeing as this is my first post and all, but I had a few simple questions,

I read on another website, one that I question the validity of, that this could possibly damage your memory stick, or your psp.

I'm just wondering what the chances of this happening are? Is it a slim to none chance?? Or should I just wait until they refine this exploit, if at all possible?? Thanks for any replies in advance.

Matt

th0mas · Post by **th0mas** » Thu Jun 16, 2005 2:01 am

personally I would not use this as an everyday method of running code. Wait until someone comes out with something akin to reflashing your 1.5 psp to a 1.0, I guess.

StriderA · Post by **StriderA** » Thu Jun 16, 2005 2:55 am

I finally have a real reason to buy that memory card I've been wanting. So now that we have a way to run code, who's going to be the first one to try and kill their psp by flashing down to 1.0?