SCE Target Manager Server for PSP2

binkinator

Garfield’s Fitness Coach
OP
Member
GBAtemp Patron
Joined
Mar 29, 2021
Messages
6,511
Trophies
2
XP
6,155
Country
United States
1658013506652.png


Come to Daddy...
Gonna scan it with MBytes and see if she flys...
 

godreborn

Welcome to the Machine
Member
Joined
Oct 10, 2009
Messages
38,471
Trophies
3
XP
29,138
Country
United States
most likely it's from the official sdk. unofficial sdks are usually made by debugging the official stuff once there's a leak.
 

binkinator

Garfield’s Fitness Coach
OP
Member
GBAtemp Patron
Joined
Mar 29, 2021
Messages
6,511
Trophies
2
XP
6,155
Country
United States
most likely it's from the official sdk. unofficial sdks are usually made by debugging the official stuff once there's a leak.

Yes, this one is of dubious Google origins. I tried using the unofficial SDK and of course it didn't go very far.

Virus total says it's legit so...

1658014101332.png


...going to run it and see if it will allow me to view my crash dump.

msi was signed by SN (official tools guys for SCE) so that's a good sign.

As is this...

1658014845216.png
 
Last edited by binkinator,
  • Like
Reactions: godreborn

binkinator

Garfield’s Fitness Coach
OP
Member
GBAtemp Patron
Joined
Mar 29, 2021
Messages
6,511
Trophies
2
XP
6,155
Country
United States
e: (oops...didn't mean to double post. thought I was editing. sorry.)

Well crap...

1658015042379.png


It either doesn't like the version number...

1658015114830.png


Or it doesn't like the fact that this dump came from a homebrew: PRO Camera Vita

Unfortunately, I can't find source for this app. They only published the vpk.

Figured out I can I unzip the VPK by renaming it and found the eboot.bin.

1658015508451.png


If I can convert the eboot.bin to a .elf I can probably use this guy: https://github.com/xyzz/vita-parse-core

python2 main.py core_file.psp2dmp homebrew_file.elf
 

binkinator

Garfield’s Fitness Coach
OP
Member
GBAtemp Patron
Joined
Mar 29, 2021
Messages
6,511
Trophies
2
XP
6,155
Country
United States
you can decrypt to elf with vita shell iirc.

Seems that the Open Decrypted option is greyed out for my eboot.bin:

image.jpg

Not sure why that would be. Maybe it's not encrypted at all since it's homebrew?

Looked at Properties and it showed me this:

image.jpg

So I looked at a few things that seemed related to FSELF files.

1658018235041.png

Bah!!!!!11!1 No joy.

Going to put it down for a bit and do something else…
 

godreborn

Welcome to the Machine
Member
Joined
Oct 10, 2009
Messages
38,471
Trophies
3
XP
29,138
Country
United States
Does unfself and selfutil work with the vita? I know they work for the ps4. Drop it into a hex editor. If it starts with elf, it's not encrypted.
 

binkinator

Garfield’s Fitness Coach
OP
Member
GBAtemp Patron
Joined
Mar 29, 2021
Messages
6,511
Trophies
2
XP
6,155
Country
United States
Does unfself and selfutil work with the vita? I know they work for the ps4. Drop it into a hex editor. If it starts with elf, it's not encrypted.

Apparently they don’t…at least not in my case! 🤣

Once I crack this nut I will go back and see if I can feed these tools a different vita eboot.bin and see if they recognize them but I did get them from PS4 threads so you’re probably right.

Hmmmmmm. Looks like it might be a regular elf file…

E4D36DED-4A82-4085-9827-A9EAF271C497.jpeg

Think I can just rename it and use it as my .elf input for debugging with the python script?

That would be wild…
 

godreborn

Welcome to the Machine
Member
Joined
Oct 10, 2009
Messages
38,471
Trophies
3
XP
29,138
Country
United States
Apparently they don’t…at least not in my case! 🤣

Once I crack this nut I will go back and see if I can feed these tools a different vita eboot.bin and see if they recognize them but I did get them from PS4 threads so you’re probably right.

Hmmmmmm. Looks like it might be a regular elf file…

View attachment 318261

Think I can just rename it and use it as my .elf input for debugging with the python script?

That would be wild…
Looks encrypted. Sce means that on ps3, probably stands for Sony computer entertainment.
 
  • Like
Reactions: binkinator

binkinator

Garfield’s Fitness Coach
OP
Member
GBAtemp Patron
Joined
Mar 29, 2021
Messages
6,511
Trophies
2
XP
6,155
Country
United States
Looks encrypted. Sce means that on ps3, probably stands for Sony computer entertainment.

@godreborn thanks for all the hints!

Finally cracked the nut!

First I grabbed the release of PSVita-RE-tools. Inside it is a (virus free) executable called vita-unmake-fself.exe

$ ./vita-unmake-fself.exe eboot.bin # <-- this is the eboot.bin that comes with the ProCamera Vita app (see above)
Using original elf header
2nd elf header
$ ls
eboot.bin eboot.bin.elf vita-unmake-fself.exe
$ file eboot.bin.elf # <-- could it be?
eboot.bin.elf: ELF 32-bit LSB ARM, EABI5 version 1 (SYSV) # <--- HOLY SHIT!!!!! It is!!!! It's an unencrypted .elf!!!

Moved my eboot.bin.elf to eboot.elf under the vita-parse-core directory and...

It worked! It really really worked!

My core dump is in the spoiler below! I don't know if I'm ludicrous or ecstatic!

The bottom line is that there's a conflict between Pro Camera Vita and vitacheat.

I removed the vitacheat plugin and the Pro Camera works! Woo hoo!

wwiii@wwiii-VAIO MSYS ~/projects/vita-parse-core
$ python main.py psp2core-1657817533-0x00001929e9-eboot.bin.psp2dmp eboot.elf
=== THREADS ===
PCM300001
ID: 0x40010003
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0x8122cb98 (lpp-vita.elf@1 + 0x226b98 => b'?? ??:0')
SceCommonDialogWorker
ID: 0x40010073
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)
vitacheat
ID: 0x4001008f
Stop reason: 0x30003 (Prefetch abort exception)
Status: 0x1 (Running)
PC: 0x0
LR: 0x8134839b (vitacheat@1 + 0x839b)
SceShellUtilClientThread
ID: 0x400100b1
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000ca94 (SceLibKernel@1 + 0x61c4)
SceGxmDisplayQueue
ID: 0x400100bd
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cfe4 (SceLibKernel@1 + 0x6714)
Audio Thread
ID: 0x400100ef
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)
Audio Thread
ID: 0x400100f1
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)
Audio Thread
ID: 0x400100f3
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)
Audio Thread
ID: 0x400100f5
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)
Audio Thread
ID: 0x400100f7
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)
Audio Thread
ID: 0x400100f9
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)
Audio Thread
ID: 0x400100fb
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)
Audio Thread
ID: 0x400100fd
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)
Mic Thread
ID: 0x400100ff
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)

=== THREAD "vitacheat" <0x4001008f> CRASHED (Prefetch abort exception) ===

DISASSEMBLY AROUND LR: 0x8134839a (Thumb):

REGISTERS:
R0: 0x81510f98
R1: 0x0
R2: 0x20
R3: 0x2aaaaaab
R4: 0x814a0398
R5: 0x0
R6: 0x814a0000
R7: 0x814c8610
R8: 0x814c9470
R9: 0x1
R10: 0xf4240
R11: 0xdeadbeef
R12: 0x8135bf70
SP: 0x81510f78
PC: 0x0
LR: 0x8134839b (vitacheat@1 + 0x839b)

STACK CONTENTS AROUND SP:
0x81510f38: 0x2bb37096
0x81510f3c: 0x4c656353
0x81510f40: 0x67506269
0x81510f44: 0x6c000066
0x81510f48: 0x676f00
0x81510f4c: 0x0
0x81510f50: 0x0
0x81510f54: 0x0
0x81510f58: 0x8133664c (SceLibPgf@1 + 0x586c)
0x81510f5c: 0x8133668c (SceLibPgf@1 + 0x58ac)
0x81510f60: 0x220
0x81510f64: 0xdeadbeef
0x81510f68: 0xdeadbeef
0x81510f6c: 0x814a0000
0x81510f70: 0x814c93a8 (vitacheat@2 + 0x293a8)
0x81510f74: 0x81348365 (vitacheat@1 + 0x8365)
SP => 0x81510f78: 0xffffffff
0x81510f7c: 0xffffffff
0x81510f80: 0x814c8610 (vitacheat@2 + 0x28610)
0x81510f84: 0x0
0x81510f88: 0x0
0x81510f8c: 0x2aaaaaab
0x81510f90: 0x8135c204 (vitacheat@1 + 0x1c204)
0x81510f94: 0xffffffff
0x81510f98: 0x120
0x81510f9c: 0xffffffff
0x81510fa0: 0xffffffff
0x81510fa4: 0xffffffff
0x81510fa8: 0xffffffff
0x81510fac: 0xffffffff
0x81510fb0: 0xffffffff
0x81510fb4: 0xffffffff
0x81510fb8: 0x220
0x81510fbc: 0xffffffff
0x81510fc0: 0xffffffff
0x81510fc4: 0xffffffff
0x81510fc8: 0xffffffff
0x81510fcc: 0xffffffff
0x81510fd0: 0xffffffff
0x81510fd4: 0xffffffff

What an adventure!

...now to figure out why vitacheat conflicts with ProCamera Vita. Hmmmm
 
  • Like
Reactions: godreborn

godreborn

Welcome to the Machine
Member
Joined
Oct 10, 2009
Messages
38,471
Trophies
3
XP
29,138
Country
United States
@godreborn thanks for all the hints!

Finally cracked the nut!

First I grabbed the release of PSVita-RE-tools. Inside it is a (virus free) executable called vita-unmake-fself.exe

$ ./vita-unmake-fself.exe eboot.bin # <-- this is the eboot.bin that comes with the ProCamera Vita app (see above)
Using original elf header
2nd elf header
$ ls
eboot.bin eboot.bin.elf vita-unmake-fself.exe
$ file eboot.bin.elf # <-- could it be?
eboot.bin.elf: ELF 32-bit LSB ARM, EABI5 version 1 (SYSV) # <--- HOLY SHIT!!!!! It is!!!! It's an unencrypted .elf!!!

Moved my eboot.bin.elf to eboot.elf under the vita-parse-core directory and...

It worked! It really really worked!

My core dump is in the spoiler below! I don't know if I'm ludicrous or ecstatic!

The bottom line is that there's a conflict between Pro Camera Vita and vitacheat.

I removed the vitacheat plugin and the Pro Camera works! Woo hoo!

wwiii@wwiii-VAIO MSYS ~/projects/vita-parse-core
$ python main.py psp2core-1657817533-0x00001929e9-eboot.bin.psp2dmp eboot.elf
=== THREADS ===
PCM300001
ID: 0x40010003
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0x8122cb98 (lpp-vita.elf@1 + 0x226b98 => b'?? ??:0')
SceCommonDialogWorker
ID: 0x40010073
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)
vitacheat
ID: 0x4001008f
Stop reason: 0x30003 (Prefetch abort exception)
Status: 0x1 (Running)
PC: 0x0
LR: 0x8134839b (vitacheat@1 + 0x839b)
SceShellUtilClientThread
ID: 0x400100b1
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000ca94 (SceLibKernel@1 + 0x61c4)
SceGxmDisplayQueue
ID: 0x400100bd
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cfe4 (SceLibKernel@1 + 0x6714)
Audio Thread
ID: 0x400100ef
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)
Audio Thread
ID: 0x400100f1
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)
Audio Thread
ID: 0x400100f3
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)
Audio Thread
ID: 0x400100f5
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)
Audio Thread
ID: 0x400100f7
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)
Audio Thread
ID: 0x400100f9
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)
Audio Thread
ID: 0x400100fb
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)
Audio Thread
ID: 0x400100fd
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)
Mic Thread
ID: 0x400100ff
Stop reason: 0x0 (No reason)
Status: 0x8 (Waiting)
PC: 0xe000cbd4 (SceLibKernel@1 + 0x6304)

=== THREAD "vitacheat" <0x4001008f> CRASHED (Prefetch abort exception) ===

DISASSEMBLY AROUND LR: 0x8134839a (Thumb):

REGISTERS:
R0: 0x81510f98
R1: 0x0
R2: 0x20
R3: 0x2aaaaaab
R4: 0x814a0398
R5: 0x0
R6: 0x814a0000
R7: 0x814c8610
R8: 0x814c9470
R9: 0x1
R10: 0xf4240
R11: 0xdeadbeef
R12: 0x8135bf70
SP: 0x81510f78
PC: 0x0
LR: 0x8134839b (vitacheat@1 + 0x839b)

STACK CONTENTS AROUND SP:
0x81510f38: 0x2bb37096
0x81510f3c: 0x4c656353
0x81510f40: 0x67506269
0x81510f44: 0x6c000066
0x81510f48: 0x676f00
0x81510f4c: 0x0
0x81510f50: 0x0
0x81510f54: 0x0
0x81510f58: 0x8133664c (SceLibPgf@1 + 0x586c)
0x81510f5c: 0x8133668c (SceLibPgf@1 + 0x58ac)
0x81510f60: 0x220
0x81510f64: 0xdeadbeef
0x81510f68: 0xdeadbeef
0x81510f6c: 0x814a0000
0x81510f70: 0x814c93a8 (vitacheat@2 + 0x293a8)
0x81510f74: 0x81348365 (vitacheat@1 + 0x8365)
SP => 0x81510f78: 0xffffffff
0x81510f7c: 0xffffffff
0x81510f80: 0x814c8610 (vitacheat@2 + 0x28610)
0x81510f84: 0x0
0x81510f88: 0x0
0x81510f8c: 0x2aaaaaab
0x81510f90: 0x8135c204 (vitacheat@1 + 0x1c204)
0x81510f94: 0xffffffff
0x81510f98: 0x120
0x81510f9c: 0xffffffff
0x81510fa0: 0xffffffff
0x81510fa4: 0xffffffff
0x81510fa8: 0xffffffff
0x81510fac: 0xffffffff
0x81510fb0: 0xffffffff
0x81510fb4: 0xffffffff
0x81510fb8: 0x220
0x81510fbc: 0xffffffff
0x81510fc0: 0xffffffff
0x81510fc4: 0xffffffff
0x81510fc8: 0xffffffff
0x81510fcc: 0xffffffff
0x81510fd0: 0xffffffff
0x81510fd4: 0xffffffff

What an adventure!

...now to figure out why vitacheat conflicts with ProCamera Vita. Hmmmm
thanks for that link. I know that stuff on the ps3, vita, and probably ps4 are compressed using zlib, which I think is 78 DA or something like that in hex, so you can use simply zip to decompress them. I've done this with vita shell (this will not decrypt them though).
1658112113810.png
 
  • Like
Reactions: binkinator

binkinator

Garfield’s Fitness Coach
OP
Member
GBAtemp Patron
Joined
Mar 29, 2021
Messages
6,511
Trophies
2
XP
6,155
Country
United States
thanks for that link. I know that stuff on the ps3, vita, and probably ps4 are compressed using zlib, which I think is 78 DA or something like that in hex, so you can use simply zip to decompress them. I've done this with vita shell (this will not decrypt them though).
View attachment 318428

Yeah, I saw your hoof prints everywhere I looked (once I realized your retired nick…thought the logo was just coincidence…lol)

I had to get past that SCE header first.

I left out a bunch of stuff out about .rif files in license folders and GitHub repos that have long since been deleted.

1658112645521.png
 
  • Like
Reactions: godreborn

godreborn

Welcome to the Machine
Member
Joined
Oct 10, 2009
Messages
38,471
Trophies
3
XP
29,138
Country
United States
it most likely decompresses them when decryption is done. that's what it does on the ps3 anyway. btw, love that two-panel comic thing you've got there. :D
 
  • Like
Reactions: binkinator

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    K3Nv2 @ K3Nv2: Lol rappers still promoting crypto