NO-KXploit Patcher for 1.50

moonlight · Post by **moonlight** » Mon Apr 10, 2006 9:35 pm

This program will patch the firmware 1.50 (in RAM) to allow it to run normal pbp's.

The patch will remain resident in the firmware until one of these conditions happen:
1) A program crashes the psp, forcing you to do 2.
2) You restart your psp holding the power button or remove the battery.

You can run/exit games/homebrews, put the psp in sleep mode... none of those things will delete the patch from RAM.

I don't know if someone will find this useful since most current homebrews are kxploited, but it's a solution to having 2 folders, hiding icons... and all those annoying things.

It's also an example of a program that remains resident surviving sceKernelLoadExec, sceKernelExitGame, maybe someone finds that useful (there is a part of the code that it's executed with no firmware in RAM :), some cool things could be done with that)

http://rapidshare.de/files/17641675/NOKXPLOIT.zip.html

Mathieulh · Post by **Mathieulh** » Mon Apr 10, 2006 9:57 pm

This is what I call a great job ;)

lopoz · Post by **lopoz** » Mon Apr 10, 2006 11:11 pm

Wow! Did anyone try this already?

danzel · Post by **danzel** » Mon Apr 10, 2006 11:41 pm

This is without a doubt the coolest thing I have seen all day.
Awesome work moonlight :D

Mathieulh · Post by **Mathieulh** » Mon Apr 10, 2006 11:54 pm

lopoz wrote:Wow! Did anyone try this already?

I did, it works like a charm :) It even let you run kxploit eboots allong with the unpatched ones :)

The sources are also pretty interesting :)

It's really a good job ;)

Too bad it only patches the ram tough :/

Wraggster · Post by **Wraggster** » Tue Apr 11, 2006 12:54 am

Excellent release for the scene

Alcahest · Post by **Alcahest** » Tue Apr 11, 2006 3:35 am

Moonlight, i've got a question regarding your hack.

I have a PSP fw 1.0 and for now am very happy with it because it launches homebrews very fast (fw 1.0 in 3,5 seconds, fw 1.50 in almost 9 seconds!).
Also I like using 1.0 PBPs (easier to manage) and no corrupted icon (i know these can be hidden on 1.50 so that' a rather moot argument ^^)

But I am tempted to upgrade to 1.50 because I would like to try the Firwmare Emulator from MPH..

Do you notice if with your hack the 1.50 launches homebrew faster than without it?
Can you stopwatch if it's not a problem?
(from pressing the "execute" (circle or square if jap or us) button on the PBP list to the first screen of the homebrew).
It would help me decide i think ;)
Thanks,

Alcahest

Mathieulh · Post by **Mathieulh** » Tue Apr 11, 2006 4:09 am

Alcahest wrote:Moonlight, i've got a question regarding your hack.

I have a PSP fw 1.0 and for now am very happy with it because it launches homebrews very fast (fw 1.0 in 3,5 seconds, fw 1.50 in almost 9 seconds!).
Also I like using 1.0 PBPs (easier to manage) and no corrupted icon (i know these can be hidden on 1.50 so that' a rather moot argument ^^)

But I am tempted to upgrade to 1.50 because I would like to try the Firwmare Emulator from MPH..

Do you notice if with your hack the 1.50 launches homebrew faster than without it?
Can you stopwatch if it's not a problem?
(from pressing the "execute" (circle or square if jap or us) button on the PBP list to the first screen of the homebrew).
It would help me decide i think ;)
Thanks,

Alcahest

The loading of unpatched eboots on 1.50 using moonlight patch is slower than the kxploit patched eboots, and way slower than 1.00, beside 1.00 is so rare that I would never advise to update it

moonlight · Post by **moonlight** » Tue Apr 11, 2006 4:35 am

Mathieulh is right. Right now it's more slow, because it extracts the elf from the pbp to another file.
I'll take a look at the (undocumented) functions sceKernelLoadExecBufferPlain, sceKernelLoadExecBufferPlain0 and sceKernelLoadExecBufferVSHPlain to document them and avoid having to extract the file to another one.

Alcahest · Post by **Alcahest** » Tue Apr 11, 2006 5:00 am

Thanks for the info guys.
Guess i'll hold onto the 1.0 for a bit longer ;)
Let's hope someone can find why homebrew apps that work on 1.50 don't work on 1.0 so far.. :/ (MPH Firmware Launcher, Game Loader, RunUMD, etc..)
See you,

Alcahest

Shazz · Post by **Shazz** » Tue Apr 11, 2006 7:14 pm

Hum, yep extracting the ELF from the archive may be slow...
Why not writing our own process ? The PBP archive can contains only a tiny loader which loadExec something called EBOOT.ELF or whatever located in the same directory ?
EBOOT.ELF should be, obviously, the homebrew stuff to run.

Those EBOOT.PBP are so usless :D viva PSPLink :D

as simple as that...

tiny loader

Code: Select all

#include <pspkernel.h>
#include <pspdebug.h>
#include <pspdisplay.h>
#include <pspsdk.h>
#include <psploadexec.h>
#include <psptypes.h>

#include <stdio.h>
#include <string.h>
#include <sys/unistd.h>

#define ELF_FILENAME "EBOOT.ELF"

PSP_MODULE_INFO&#40;"TINY_LOADER", 0x1000, 1, 1&#41;;
PSP_MAIN_THREAD_ATTR&#40;0&#41;;

int main&#40;void&#41;
&#123;
	char initialPath&#91;MAXPATHLEN&#93;;

	struct SceKernelLoadExecParam execParam;

	if&#40;getcwd&#40;initialPath, MAXPATHLEN&#41;&#41;
	&#123;
		char pathFA&#91;MAXPATHLEN&#93;;
		sprintf&#40;pathFA, "%s/%s", initialPath, ELF_FILENAME &#41;;

		execParam.size = sizeof&#40;execParam&#41;;
		execParam.argp = path;
		execParam.args = strlen&#40;path&#41;;
		execParam.key = NULL;
		
		int res;
		res = sceKernelLoadExec&#40;path, &execParam&#41;;
	&#125;
	
	
	//never goes here...
	sceKernelExitGame&#40;&#41;;
	return 0;
&#125;

Art · Post by **Art** » Tue Apr 11, 2006 8:09 pm

But I am tempted to upgrade to 1.50 because I would like to try the Firwmare Emulator from MPH..

They are not replaceable. You might try selling it on eBay,
and might find you end up with enough cash for a new unit.
At least over here, there are good firmware units still available.

Sorry for the off topic... but here we are trying to make 1.5's behave like 1.0s!

Alcahest · Post by **Alcahest** » Tue Apr 11, 2006 10:05 pm

Art wrote:
But I am tempted to upgrade to 1.50 because I would like to try the Firwmare Emulator from MPH..
They are not replaceable. You might try selling it on eBay,
and might find you end up with enough cash for a new unit.
At least over here, there are good firmware units still available.

Sorry for the off topic... but here we are trying to make 1.5's behave like 1.0s!

Oh mind you, I worship my 1.0 and would never sell it. It's just sad that most homebrews released nowadays do not work on it.
Later,

Alcahest

Duo · Post by **Duo** » Wed Apr 12, 2006 1:33 am

Are there plans for releasing a version that patches the firmware so this doesn't have to be loaded every time? Great job though. This is a great idea. Saves some memory stick memory too.

Mathieulh · Post by **Mathieulh** » Wed Apr 12, 2006 9:22 am

Duo wrote:Are there plans for releasing a version that patches the firmware so this doesn't have to be loaded every time? Great job though. This is a great idea. Saves some memory stick memory too.

You can't do this unless you manage to bypass the IPL prx checksum (as unfortunately, loadexec.prx is one of the few modules checked by the IPL at startup (as most of the modules in the flash0:/kd/ folder are)), and this can't be done without overwriting the IPL in the first place.