Gaming Why PSP3000 is only "software" hackable

[Rambytes]

Hi everyone,

I have a PSP3000 with 5.03 firmware. First I install the Chicken R2 firmware and after the 5.03GEN-C(Full) firmware. If I put the PSP in sleep there is no problem when i turn on again, the PSP still in the GEN-C firmware.

But this method drain a little bit of power...

But if I turn off (slide the power and hold for about 3-5 sec) or I remove the battery, I need again to re-install the ChickenR2 and the Gen-C firmware.

My question is if there is a way to permanently have the Gen-C firmware?

Thanks alot (and sorry for my english)

 

[Law]

No.

 

[Rambytes]

Can I know why (and a little bit of information about this)

 

[Law]

The firmware just can't be flashed permanently due to the motherboard.

 

[xist]

When the PSP boots, the boot code (aka pre-ipl or ipl loader) loads the ipl from either the nand or memory stick. The IPL is splitted into pieces of 0×1000 bytes.

First 0xA0 bytes of each block is a header for the kirk hardware command 1. It contains keys, the size of the cipher data, and two hashes, one for part the header itself, and another one for the body. The 0xF60 remaining bytes are the ciphered body, which will decrypt to 0xF60 plain bytes… if the hashes, which are checked by kirk hardware itself, are OK. (Note: ciphered body can actually be less than 0xF60, in this case, remaining bytes are ignored… before TA88v3)

The security of kirk hashes was destroyed by a timing attack, and the IPL became unprotected. What has Sony added to fix this?

The answer can be found in 4.00+ slim ipl’s. They decreased the size of the ciphered body to 0xF40 to leave 0×20 bytes at the end of each block (at offset 0xFE0).
As stated before, these remaining bytes are ignored… in pre-ipl’s of psp’s prior to TA88v3, and in fact, they can be randomized and ipl will still boot in those psp’s. In newest pre-ipl’s, these 0×20 bytes have a meaning.

The first 0×10 bytes is an unknown hash calculated from the decrypted block. It is deduced that is calculated from the decrypted block and not the ciphered one due to the fact that 4.01 and 4.05 have a lot of ipl blocks in common, which, when decrypted, are similar, but they are totally different in its encrypted form. In these two ipl’s, this hash is same, as seen in the picture:

The second 0×10 bytes seem also to be dependent of the decrypted body (maybe dependent of the previous 0×10 bytes too?). In the picture it can be seen that they are different in 4.01 and 4.05, but they can actually be interchanged, you can move those 0×10 bytes from the same block in 4.05 ipl to the 4.01 ipl and it will still boot; however it cannot be randomized.

This protection also destroys any possibility of downgrading below 4.00, as these new cpu’s won’t be able to boot previous firmwares ipl’s.

Summary: basically, all security of newest psp cpu’s rely on the secrecy of the calculation of those 0×20 bytes. If pre-ipl were dumped somehow, the security would go down TOTALLY.

Endless loop pic goes here....

 

[ProtoKun7]

No.

This.

Simple enough. Motherboard won't allow it.

 

[jalaneme]

why do you think CFW M33 is the best? you can turn your psp off at any time and when you turn it back on it will always be there.

 

[lolzed]

why do you think CFW M33 is the best? you can turn your psp off at any time and when you turn it back on it will always be there.

GEN does so too,except v3 motherboards have specially made CFW that will make the CFW(a.k.a 5.03 GEN-"X")turn off every time,5.00 M33 and 5.50 GEN-"X"will install and let you turn off as long as you install it on non-v3 boards(resulting to brick if otherwise).Personally M33 is the best,i want to see the WIP M33-8 though,if it's worth it

 

[Rambytes]

What the main difference between Gen-C and M33 ?

And does the m33 firmware can be installed to my Psp3000?

 

[Fluto]

ive been thinking the same thing since i got my psp

 

[lolzed]

What the main difference between Gen-C and M33 ?

And does the m33 firmware can be installed to my Psp3000?

5.03 GEN-c are the only firmwares that can be "installed" to v3 motherboards(also PSP3000's) all the rest install either 5.00 M33 or 5.50 GEN-D

 

[zuron7]

Because it's too easy to hack the soft of the PSP.