PlayStation Portable homebrew

HelloWorld Homebrew

PlayStation Portable homebrew refers to the process of using exploits and hacks to execute unsigned code on the PlayStation Portable (PSP).

History of homebrew

Soon after the PSP was released, hackers began to discover exploits in the PSP that could be used to run unsigned code on the device. Sony released version 1.51 of the PSP firmware in May 2005 to plug the holes that hackers were using to gain access to the device.^[1] On 15 June 2005 the hackers distributed the cracked code of the PSP on the internet. Hackers refused to apply updates which would render their hacks unusable so Sony attempted to convince users that there was a benefit to upgrading by including new features in the firmware updates, such as a web browser, and not just security patches to plug the vulnerabilities^{[citation needed]}. BusinessWeek dubbed this the "carrot-and-stick" approach.^[2]

In August 2005 Sony released version 2.0 of the firmware which included the web browser, file compatibility updates and other features.^[3] Hackers and other homebrew enthusiasts then encountered the first trojan for the PSP. Symantec called this trojan "Trojan.PSPBrick". Users attempting to downgrade their PSP using this software instead found that it was rendered inoperable as this software deleted important system files.^[4] Over the course of 2005 Sony released six different versions of the firmware and hackers typically responded to it by downgrading to avoid the new security updates.^[2]

In Mid-2006, after several months of problems in defeating the PSP's firmware a file was posted online which allowed new PSPs running firmware version 2.6 to downgrade to 1.5 so they could then be hacked using older methods. This reportedly caused more buzz in the community than any recent official offerings for the device.^[5]

Downgrading

Downgrading is the process in which a PSP's system firmware is downgraded to a lower firmware version, in most cases to use homebrew or to install Custom Firmware. Sony Computer Entertainment states on official firmware updates that you can NOT downgrade to a previous firmware version, and using anything other than a official update will result in a void of any PSP warranty, this goes as far as having the ability to be able to send your PSP to Sony if it 'bricks' If you use a unofficial downgrader or unofficial sony update file you will also lose this oppurtunity.

Various downgraders have been released over the years to downgrade firmware versions these include:

• 2.71 and Below - Hen D Exploit (No UMD Game required)
• 2.80 - Hen D Exploit (Similar to Dark_Alex's Exploit for 2.71)
• 2.81 - 3.03 - Using Exploit found within GTA Liberity City Stories Game (Unpatched)
• 3.11 - This was created for people that were stuck on the 3.11 Firmware due to their PSPs using the TA-082/TA-086 motherboard. Running a downgrader on this motherboard version required a certain patch before you ran the downgrader. But when Sony released Firmware version 3.30 this firmware detected this patch and stopped any form of upgrade. The 3.11 downgrader was simply for this problem.
• 3.50 - Using (Illuminati) Exploit found within Lumines (Unpatched)
• Pandora's Battery - This was (officially) released on 22 August 2007. Pandora's Battery is known as a universal downgrader and unbricker as it has the ability to downgrade or unbrick any PSP 1000, PSP 2000 but at this time Pandora's Battery does not work on the PSP 3000, and may not work for some time due to the motherboard that the PSP 3000's have.
• 5.03 - Using the ChickHen TIFF Exploit to get Homebrew Enabled PSP's. Works with PSP 1000, 2000, and 3000. Later patched in 5.50.

Downgraders that use a UMD game to run the exploit require a user to put certain files on their memory stick in the correct directories. This includes, certain programs, flashers and modified save data for the UMD game for that exploit. The exploit itself accesses a restricted part of the PSP known as the kernel, the exploit opens up the kernel allowing non sony programs to be run. In exploits that require a UMD game, the exploit is usually run when the UMD game reaches the start menu, after the start button is pressed on the PSP the exploit begins. This is signified by a flashing of the screen usually in a red or blue color, the exploit uses the modified savedata on the memory stick to run parts of the exploit and if succesful the PSP will be returned to its XMB interface. From here a user can go check to see if the PSP system firmware has changed to x.xx HEN (Homebrew ENabler Mode). Hen mode allows the PSP to run the files to downgrade. If HEN mode is enabled then the PSP can be downgraded by running the flasher program.

Pandora's Battery is a downgrader that can downgrade any firmware version and works on the PSP 1000 and PSP 2000. This was released on 22nd August 2007 and changed the way PSP users can downgrade their PSPs. Not only is Pandora's Battery a downgrader but it can also unbrick a PSP that has been 'bricked' (When the flash content becomes corrupt, missing or damaged) this was made possible by a project known as the Prometheus project who after years of work reverse engineered a special part of the PSP known as service mode. This special mode is how official sony workers would unbrick your PSP if you were to send it to them to reflash the firmware. Now anyone using a special 'jigkick' battery and 'magic' memory stick can access their PSP service mode to unbrick or downgrade their PSP.

The ChickHEN exploit sports a similar execution to previous HEN operations but works uniquely as it doesn't not require dangerous flashing to the PSP on-board memory. This HEN also supplied custom firmware patches commonly found in M33 firmwares such as "nid-resolver", emulation of M33 sdk functions and various specific patches not found in previous HEN. The ChickHEN exploit allows downgrading utilities to execute but many applications do not check for non flash-able 2000 and 3000 PSP types which permanently ceases system operation.

The actual exploit for ChickHen uses an exploit in the PSP to flash the firmware to HEN mode enabled firmware. HEN mode allows execution of some forms of homeberew (Though HEN can not run all homebrew) It is very similar to the 2.71/2.80 HEN D Expliot, the exploit is done by using a few pictures and the special picture with the "exploit" on it. The exploit is run within the PSP's photo directory you flick through the exploited image files and then you run the TIFF exploit image which will then flash some modules to the PSP Flash0. It can take a few goes before the program will successfully flash the modules. You will know if the modules have been flashed because certain colours will appear on the screen breifly and then the PSP unit will reset. You can then check if your in HEN mode by checking your System Information within the PSP XMB.

The problem with downgraders that require a UMD game is that they now have been patched, because once Sony saw downgraders that used a UMD Game hit the internet, they quickly approached RockStar (GTA: LBS) and Ubisoft (Lumines) to fix the exploit that was present in the UMD game. So now if you tried to buy a copy of either GTA Liberty City Stories or Lumines you may end up with a patched version, which would mean the exploit will not work and you will not be able to downgrade because your PSP will not be able to get into HEN Mode. It has been reported that newer versions of the Lumines game require a 3.51 Firmware to run which essentially patches the exploit.^[6]

Dark Alex

One of the drawbacks of downgrading the PSP is that new legitimate media may require the presence of a new firmware edition. Dark Alex, a Spanish programmer, had released a custom firmware called "Dark Alex's Open Edition firmware" or "Custom Firmware (CFW)" which opens the firmware but allows users to use the existing feature set of the current edition. Sony quickly patched the firmware again, continuing the cat-and-mouse game with the hackers and users.^[7] In 2006 Sony released six updates to the system firmware and in 2007 they released another six updates. ^[3] In July 2007 Dark Alex officially stopped his work on the PSP, citing perceived problems with Sony as one of the reasons for his departure.^[8] Some people even suggested that Dark Alex was paid by Sony not to release any more custom firmware, but Sony denied this.^[9]

Other works by Dark Alex include a custom firmware known as "M33 custom firmware" (currently version 5.00 m33-6) for a while a Russian hacking team was said to be creating this firmware because they appeared after Dark_Alex ceased developing his OE custom firmware but it was revealed when they released custom firmware version 3.71 M33 they we're Dark_Alex and friends, this sent shockwaves through the PSP Scene. Custom Firmware allows the running of unsigned code such as homebrew applications and UMD backups, as well as specially converted PlayStation games.^[10]

Motivation for homebrew

Hackers have stated that the motivation for unlocking the PSP has nothing to do with piracy, but allowing individuals full access to the products they've purchased and the freedom to do what they want with the item as well as the interest in exploring something unknown.^[2][11] Fanjita, a member of the hacker group "N00bz!", stated,

"Everyone has the right to do what they want with their own hardware. Piracy does upset me, and because what we are doing opens the way to piracy it's harder to justify it morally. But our stance on piracy is clear, and we hope to be role models. Sony have never been in touch with me, so I am confident that what we are doing is legal."^[7]

Additional features added including the ability to share music, print photos, watch videos from streaming sites such as YouTube, and run additional video formats originally unsupported by the device^[2]

Sony's position

Sony has told the media that any issues resulting from running modified code on the device would void the warranty.^[1][2] They have also stated that the problem is not with homebrew but piracy.^[7] However their constant firmware updates are seen as attempts to hamper homebrew development.^[12] According to Phillip Torrone from Make Magazine, this hampering could be due to the attempts to curb piracy and may cause more harm than good.^[11]

"I think the really smart companies should release their products to the alpha geeks for six months and let the alpha geeks play around with them. It seems to me they'd save a lot of money on R&D, and they'd come out with much more solid products."

However, Sony has also said that, when questioned about homebrew game support, Jack Tretton replied with,

"I think that is something that is in the works. We certainly see some of the stuff that has been done via homebrew, and it's incredibly creative. And I think we'd like to try and tap into that a little bit more."^[13]

References