Announcement

**LosT** · March 30, 2005, 22:32

Same avatar as ndex....how confusing ;)

**TheCotMan** · March 30, 2005, 23:03

Originally posted by Vyrus

well as most of you at this point are not aware of, me and my offiliats at DC949 have started a small (hack the psp) project (yes i know there is plenty of compitition and in the hacking of consoles we are all essentialy n00bs. ) that been said i figured that you would all like to see some of the packet dumps of the psp runing in "host" mode when playing the "dark stalkers" title.

I've some limited work at reverse engineering several network protocols, and it can be a lot of work, and often needs a little luck, but is very rewarding. :-D

1) Do the most simple networking between PSP and capture-- use this as a baseline. Document hypothesis for what fields might be used for. Look for IFS by character. NULL? CR? CR/LF? Tab? Look for sections and estimate purposes like checksum fields and Length as well as "Player ID" and "Unit ID." If TCP/IP is used, only look at the payload of the TCP to begin with, then revisit.
2) Once you have some good guesses for what fields may be used for, play very short network games start to finish. Compare the packets relayed to your initial model. (even if you must "die" really quickly-- minimize your data.)
Repeat this process, and if you have others working on this, share the things you are nearly certain about, but keep your theories to yourself unless you get stuck. (Suggesting a bad path to others leads to many working on the same potential dead end.)
3) repeat for new games. revise your hypothesis

When you have an idea how it works, try to build a fake unit in software and have it send the same responses as what was captured to see if playback is effective. If so, verify your model by changing what works to see if the outcome is the same.

This kind of work is fastest when you have a unit and sniffing/analysis software. If I had one of these and lots of free time, this would be great fun. :-)

Good luck!

**Vyrus** · March 31, 2005, 09:10

Originally posted by TheCotMan

I've some limited work at reverse engineering several network protocols, and it can be a lot of work, and often needs a little luck, but is very rewarding. :-D

1) Do the most simple networking between PSP and capture-- use this as a baseline. Document hypothesis for what fields might be used for. Look for IFS by character. NULL? CR? CR/LF? Tab? Look for sections and estimate purposes like checksum fields and Length as well as "Player ID" and "Unit ID." If TCP/IP is used, only look at the payload of the TCP to begin with, then revisit.
2) Once you have some good guesses for what fields may be used for, play very short network games start to finish. Compare the packets relayed to your initial model. (even if you must "die" really quickly-- minimize your data.)
Repeat this process, and if you have others working on this, share the things you are nearly certain about, but keep your theories to yourself unless you get stuck. (Suggesting a bad path to others leads to many working on the same potential dead end.)
3) repeat for new games. revise your hypothesis

When you have an idea how it works, try to build a fake unit in software and have it send the same responses as what was captured to see if playback is effective. If so, verify your model by changing what works to see if the outcome is the same.

This kind of work is fastest when you have a unit and sniffing/analysis software. If I had one of these and lots of free time, this would be great fun. :-)

Good luck!

thanx for the info man (/me shows his n00bness)

**Vyrus** · March 31, 2005, 09:19

btw...

another little titbit i gatherd this morning, aperently there are sevral ways to upgrade the firmware, one of wich is through the memory stick, another is through the network. while i plan to log a packet capture of a network session and post it, i figured i would try my hand at "updateing" the psp firmware to a "linux moble" distro :P. in short, so far no luck but i have diserned that the update works by being stored in the PSP/GAMES/UPDATE folder and is called EBOOT.PBP. i tried renameing the file and it didnt work, as well as copying a distro boot file and nameing it that, that didnt work eather. i did however figure out that by makeing folders with wich ever name i wish and putting the update in there, the psp trys to run the image as a game, where as when in the update folder, the psp assumes that the image is indeed firmware. now acording to the documentation (offical), in the prosses of updateing the psp you make the UPDATE folder in the games dir, then place the update in the folder then run, and it will ask you if you want to run "now" or "later". suposidly if you say later then you can turn your psp off and reboot off the memory card (HINT HINT WINK WINK). I however could not test this because my firmwere is alredy the latest, so when i tried the update i got an error that said "your firmware needs no update". Just some food for thought, pm me of you got ideas :P...

ps... when i tried to run the update in a folder i made (game folder) and tried to run it as a game and not an update i got the err...

8002014 "Game could not be started"

**TheCotMan** · March 31, 2005, 09:51

Originally posted by Vyrus

another little titbit i gatherd this morning, aperently there are sevral ways to upgrade the firmware, one of wich is through the memory stick, another is through the network.

Many network devices have historically used TFTP to download firmware updates. I was surprised to find this is still used today in some wireless access points. The PSP may use http or another method, but I include refrence to tftp in case you sniff it, so it won't be unexpected.

Be careful with firmware updates-- in many devices, loading a bad firmware means, an unbootable device while in others, they offer a chance to reset to factory settings or require you test a new firmware before purging the old.

I however could not test this because my firmwere is alredy the latest, so when i tried the update i got an error that said "your firmware needs no update".

See if you have a way to reset your system to an older revision of firmware. Sometimes this is accomplished by holding down a rest button for a longer period than normal, or holding down other buttons during startup.

I would expect this procedure to be documented. If not, try calling their tech support and claim that the latest firmware update seems to be causing problems, and ask how you can go back to an earlier release (Assuming there is one.)

**Vyrus** · April 1, 2005, 00:59

made some progress and closeing in on the compile the linux kernel stage, see the info at the new base for the project...

http://dc949.diseasedmind.com/forum/viewtopic.php?t=37

**Vyrus** · April 1, 2005, 01:20

now HERE is some new data that will get your fingers itching :P

so i told the psp to try and update itself over the internet useing my wifi network on dhcp... well it didnt update because my firmware is alredy current, but i did packet - sniff the session and i came up with the ip that it was talking to... so i port scann the ip (from an anonymous location :P "/me loves airsnarf") and get this... :P

Starting nmap 3.75 ( http://www.insecure.org/nmap/ ) at 2005-03-31 17:21 PST
Interesting ports on 69.50.184.85:
(The 1647 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
22/tcp open ssh
25/tcp filtered smtp
53/tcp open domain
57/tcp filtered priv-term
80/tcp open http
111/tcp filtered rpcbind
139/tcp filtered netbios-ssn
199/tcp open smux
445/tcp filtered microsoft-ds
515/tcp filtered printer
587/tcp open submission
1433/tcp filtered ms-sql-s
1720/tcp filtered H.323/Q.931
3306/tcp open mysql
17300/tcp filtered kuang2
27374/tcp filtered subseven

btw.. if you visit port 80 over a web client it still has the apache test screen on it :P

**alklloyd** · April 5, 2005, 21:43

Originally posted by Vyrus

now HERE is some new data that will get your fingers itching :P

This isn't much help...but
http://www.engadget.com/entry/1234000613038689/
Got IRC going..

Al

**Beginner** · April 15, 2005, 10:08

I would be helpful if someone made a UMD reader for the computer so you could see the updates that are on the disk.

**alklloyd** · April 15, 2005, 22:01

The PSP was made by God...
Sorry, had to say it.

Al K. Lloyd

**ndex** · April 20, 2005, 19:25

Looks like I need a new avatar.

See what happens when you ignore the forums for a while?

There is some really good info about reverse engineering on DT's site... actually.

**Beginner** · April 25, 2005, 17:13

Here is an interesting article on how to disassemble the PSP. and suggestions on how to modify it. http://www.informit.com/articles/article.asp?p=380915
Note: this voids your warranty in a BIG way, forget replacing the unit if you screw it up after this! Also note this means you can probably make backups of your umd disks to computer with some modification. And if this is possible you can most likely find a way to read and write programs, updates, and other things for it too.
Good luck and happy hacking!

**bascule** · April 27, 2005, 11:24

If you really want to hack the PSP the best bet is getting the media player running in SoftICE and looking for bad buffer checking on the media code, which is very likely littered with security vulnerabilities. Once you have found a buffer overflow you should be able to construct a media file that will boot whatever program you want.

**Beginner** · April 30, 2005, 19:00

Originally posted by bascule

If you really want to hack the PSP the best bet is getting the media player running in SoftICE and looking for bad buffer checking on the media code, which is very likely littered with security vulnerabilities. Once you have found a buffer overflow you should be able to construct a media file that will boot whatever program you want.

Wow, I never really thought of that, someone let me know if they can get it to work, my friend won't let me try it on his. He was more willing to let me take it apart! I don't have enough $$$ to buy one after getting a jeep.

Announcement

Hacking the psp...

Hacking the psp...

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment