Homebrew Enabler RevC
For PSP 2.71 Firmware
Homebrew Enabler RevC For PSP 2.71 Firmware (Revision C)
– Revision C (29 september):
* User mode static ELF’s are now starting to work.
Tested with SNES TYL 0.3 (user mode version), PSPMaster and CPS2PSP 1.0 (user mode version).
Kernel mode static elf’s are still not supported, they are a very odd case in 1.XX of kernel
code loaded to user memory.
Kernel Homebrew for 2.71 has to be written with a user main elf/prx that load kernel prx’s.
Note that the homebrew must be in a true pbp, not kxploited!.
* User mode prx’s could load other user mode prx’s, but kernel mode prx’s couldn’t load user mode
This is fixed.
* Patched the firmware to allow it to understand the old SFO format.
(avoiding the error of data is corrupted)
* Added a small win32 binary that will give you a hint about if a homebrew can work or not in
the current release. Note that this is only a hint.
UPDATE: Improved the binary loader (now it uses the one from TIFF SDK 1.1). Improved the binary loader of HEN revision B.. Now there should be less restarts .
– Revision B with better binary loader in the tiff (25 september)
* Changed the binary loader to use the one from tiffsdk 1.1 that has better stability.
No changes on the core.
This program enables homebrew to be run in 2.71 through the XMB. It makes a patch that remains permanent until hardware reset. Sleep mode won’t remove the patch.
Note: this program writes some small files in the flash, ONLY the first time is executed. IT does NOY rewrite any existing file in the system, it writes new files, so the probabilities of breaking are practically null.
It doesn’t work on DevHook, because the patch methods that it does interphere with DevHook. I may release in the future a special version for 2.71 DevHook that only does the extended patches for the kernel PRX loading. It would be added to the pspbtcnf* files, so no need for the TIFF when I port it to DevHook.
Update Instruction for people with revision A installed
To update from HEN revision A to B, hard reset your psp (to make sure that hen is not running).
Then copy the new files to the memory stick and run the tif. The new files will be automatically
People without any version of hen installed, just follow the instructions below.
– Copy all contents inside MS_ROOT to the root of your memory stick.
– Go to the PHOTO viewer of the XMB and enter in the folder “HEN”.
– If the PSP just freeze, reboot your psp and try again. Currently the TIFF is very unstable and it
is only executed sometimes. I’ll try to improve that in the future.
– The first time you run the program, you will see quickly a blue screen, and after that a screen
that can be of two colors:
* Red: the files couldn’t be written to the flash (it hapens a few times). Just keep trying.
* Green: The files were written succesfully. After that, the xmb will be rebooted. Now you can run
the homebrew in format prepared for 2.71. (see details below).
– As mentioned before, the patch will remain resident in memory, and even entering sleep mode
won’t delete it. Only a hardware reset will remove the program from memory.
– When you do a hardware reset, you’ll have to run the TIFF again.
This time there won’t be green or red screen, just a blue screen and xmb reboot, since
this time there is no need to write to the flash.
Note: the files pspbtknf.txt, pspbtknf_game.txt, pspbtknf_updater, and systemctrl.prx in the root
of the memory stick are only needed the first time the program is executed. After that you
can delete those. However, don’t delete patch.bin, h.bin and the folder with the TIFF, since
you will need those the next time you do a hard reset and want to run the program again.
Note2: Once the program is loaded, it is independant of the memory stick contents. So you can
freely swap memory sticks.
Notes about homebrew running
– Current homebrews are not supported. Since current homebrews are in static ELF format, they
won’t run (they are rejected by the 2.71 kernel). Homebrews for 2.71 have to be in PRX format.
Programmers see the programming notes.
In future versions i may patch the kernel to allow it to accept static ELF’s.
– There are some samples in the “GAME” directory, all of them ported from the psp sdk samples,
except the nanddumper written by me.
* polyphonic, psp sdk sample (user mode).
* cube, psp sdk sample (user mode). It shows a cube rotating.
* kdumper, psp sdk sample (kernel mode). It dumps kernel memory to the memory stick.
* ipldumper, psp sdk sample (kernel mode). It dumps the ipl to the memory stick.
* systemparam, psp sdk sample (user mode). It displays info about the system
* nanddumper, by me. (kernel mode). It dumps the full nand content to the file
“nandimage.flash” in the memory stick. The format of the dump is compliant with U.P. chip.
(It requires 33 MB of free space in the memory stick).
Programming notes for developers
– As mentioned before, homebrew has to be in PRX format, at least atm. Furthermore, the main PRX, the one in
the PBP, has to be an user PRX. However this user PRX can load unsigned kernel modules from
the memory stick, allowing kernel mode apps.
– There is no need for noplainmodule check patch or nodevicecheck patch, since those are done
by the homebrew enabler.
– Try to use USE_KERNEL_LIBS = 1 in your kernel PRX’s. In 2.XX, the separation between user
and kernel mode is higher than in 1.XX.
Some functions in “*ForUser” are now totally separated (different address) from their
“*ForKernel” equivalents. A good example is ModuleMgr. If you are in a kernel prx and
you call the sceKernelLoadModule of ModuleMgrForUser, you will get a “ILLEGA_PERMANENT_CALL” error.
– Currently DevHook emulated 2.71 is not supported. I’ll try to add support to DevHook, so
programs for 2.71 can be developed in a 1.50
– See the source code of the samples to have a hint on how to program for 2.71.
Credits and thanks.
– Coded by Dark_AleX
– Booster for creating devhook. HEN reboot method is based on devhook one.
– Nopx86 of the TIFF exploit.
– hitchhikr for the kernel exploit of 2.50-2.71.
ReadMe 에서는 뭔가 복잡한 이야기를 한다.
나도 잘 이해를 못하겠다.
하지만 낙서님의 포스팅 내용을 참고해서 보자.
간단하게 말해서 2.71 펌웨어를 쓰는 PSP에서 1.5 펌웨어의 Homebrew가 돌아가고
1.5에서도 2.71의 Homebrew가 동작한다는 것 같다.
앞으로 더 지켜봐야겠지만, 안정되면 2.71까진 펌업을 해도 될 듯…
하지만 난 좀더 지켜본다.