PlayStation Portable homebrew

The PlayStation Portable homebrew scene is a community in which programmers run their own code on Sony's PlayStation Portable (PSP) handheld gaming system.

General information

In May 2005, it was found that PSPs using the 1.00 version of the firmware (meaning Japanese PSPs that were not updated to the latest firmware) could execute unsigned code. What this meant in practice was that these PSPs could run homebrew software, as the mechanism for checking to make sure that software has been approved by Sony hadn't yet been activated. A proof-of-concept "Hello World" program was released to demonstrate this. This resulted in a number of pieces of homebrew software such as emulators; various small games; plus a number of simple applications such as a calendar and a calculator. All of these were built with the GNU GCC and GNU Binutils, modified to produce code for the PS2 and PSP (MIPS processor devices).

In addition, the Universal Media Discs (UMDs) that games and movies are pressed on were recently dumped using a homebrew technique that allowed the discs to be read to files over USB. These dumped UMD images can be written to a Memory Stick and executed, performing in exactly the same way as if they were being read from a UMD. Execution of such images still requires a firmware of 1.5 or 1.0. UMD images of PSP games are as widely available on the internet as any other. The image of Burnout Legends was leaked before its sell date, allowing people to play it (illegally) over a week before release.

While the version 1.00 firmware has been dumped from the Japanese PSPs (by desoldering the firmware flash chip and reading it), there is currently no way to revert to previous firmware versions after updating, save for desoldering the equivalent flash chip, reprogramming it, and resoldering it. Thus, PSP owners who updated their firmware, or purchased their device in the US were temporarily unable to use homebrew software.

Homebrew software cannot be run on versions 1.51, or 1.52 of the PSP firmware. Users wishing to run such software can choose not to upgrade, but future game titles for the PSP will require version 2.00 (though much homebrew can now be made to work on firmware version 2.00 with Fanjita's EBOOT Loader) and possibly above, and the upgrade will be included with the games themselves. This has been partially circumvented by an application that can trick the PSP into showing a desired version but acting as a 1.5 machine. However, such a hack is unsuccessful in games which require certain files that are only available on later versions of the PSP firmware.

It has been found that 1.5X-2.00 firmware versions can execute unsigned code. If the PSP version is 1.51 or 1.52, the EBOOT.PBP can have a DATA.PSAR file added onto the PBP file to tell the PSP it is an update and to edit the PARAM.SFO to add a key stating that the firmware update is version 3.00. On 2.00 however, because of the security barrier that only applications on the UPDATE folder can go through, and several other combinations, it is nearly impossible to run homebrew on 1.5X and 2.01 versions.

Two famous European hacking groups, PSP-DEV and WAB, best known for the 1.5 Xploit hack and the Universal Loader, were rumoured to be making a downgrader that would reflash the firmware to version 1.50 from versions 1.51,1.52, and 2.00. Both websites, psp-dev.1emulation.com for PSP-DEV and wab.com for WAB claimed that they were indeed creating the downgrade. A few videos were released showing footage of claimed progress; it is now known for a fact that the videos were faking any apparent progress the groups had claimed, as evidenced by the 2.00 to 1.50 downgrader which eventually surfaced (which relied on a buffer overflow whose utility was unknown to the groups at the time).

On 16 September, 2005, the groups announced that the development of the downgrader was stopped. Many believe though that the development never started. The groups made the following statement:

The Homebrew Groups announced in September 2005 that due to apparent legal threats and disruption to their activities from Sony:

We want to announce that the collaboration between the two groups has been completely finished without success. We also want to announce that WAB has been dissolved. The relationship between the two groups were vanishing days ago (some of our members were banned from their server) and there is no progress with the collaboration. In addition, the downgrader project (never finished) is immediately cancelled (it is not an excuse, we can’t explain our reasons, but are enough to do this).

On 18 September, 2005, PSPCrazy.com posted an article with a link to download a beta downgrader. Since Yoshihiro, the co-leader of WAB cancelled the project, they decided to give it out to other people so they can continue working on it. The Beta Downgrader does not work in any of the 2 methods he states, so it really isn't anything to download, unless a PSP hacking group wishes to take over and become famous for succeeding software reflashing. Several groups are already tinkering with many combinations with the EBOOT.PBP files encoded to run the downgrader.

A user named CBMaster has stated in PSP hacking forums:

In versions 1.5X-2.00, Sony has not added a security barrier that tells to double-check the UPDATER_VER in PARAM.SFO to see if they are both correct. When WAB released the beta, the 1.50 firmware does launch successfully when swapping memory sticks because of the fact that the latest PSP firmware still does not cover the security. Future updates may enable Sony to add a type of security layer like that. The only reason why 1.50 launched successfully, but still cannot Start, is because the MEM STICK 1 HAS A UPGRADE_VER NUMBER OF 3.00, WHILE THE MEM STICK 2 HAS A UPGRADER_VER NUMBER OF 1.50.

In the 2.0 version of the firmware, an exploit was found in the PSP's image viewing software that could use a buffer overflow to run small pieces of code, including PONG. This exploit was used to create a downgrader, so that version 2.0 PSPs could return to 1.50 state and run homebrew software.

Later, an exploit was found in Grand Theft Auto: Liberty City Stories that allows unsigned code to be run through a savegame on versions 2.00-2.60. The author has made a CheatDevice which executes when users load the game, and then they can load another game after and use the CheatDevice with their own savegame. Also, Fanjita has released a Tetris game and a homebrew development kit through the GTA: Liberty City Stories savegame exploit. After about a week, Fanjita released eLoader, a modded savegame that will allow users to run homebrew games/apps.

The leaked firmware

In January 2005, a firmware update was leaked from Sony. However, this update is a "dummy" file, and will "brick" a user's PSP if they use it. How it renders PSP useless is unknown, as with a homebrew tool called "MPH Firmware Launcher" which launches other firmware from the memory stick, the firmware runs fine, but none of the updates it said it would add are there. In firmware 1.5 and up the "update" registers as corrupt data, and cannot be started. This "update" when run on a 1.0 PSP would say before the update, that it would add:

RSS Feed Reader
Portable Calculator
Email software
Spreadsheet software
Small word processor
Web Browser
Scheduler
Bug Fixes

Currently, the RSS Feed feature has been added, but only to play sound, not read RSS news or view videos. Also, the web browser has been added, and lastly, bug fixes have been added.

Firmware/homebrew compatibility

The PSP homebrew capability currently relies on firmware version 1.00, 1.50, or 2.00 through exploits such as Fanjita's EBOOT Loader. There is also an exploit in GTA: Liberty City Stories save data that allows unsigned code be run on firmwares 2.xx, though the support for 2.60 is more limited, due to increased security measures.

In order to force users to update to their latest firmware, Sony has increasingly made games firmware specific GTA: Liberty City Stories which only ran on versions 2.xx. No known way of bypassing this requirement was known up until the 22nd of February 2006 when MPH released the first game specific loader for GTA:LCS which then created some controversy within the homebrew community due to its legal implications. Other games may request a higher firmware as well, but because they do not actually contain elements within them that require the said firmware they, with help from simpler exploits, can be played on any system.

ISO image loader

By utilizing the ISO image dumped from UMDs, some homebrew application called fastloader can be used as the boot loader for the ISO image, it almost makes the PSP execute any dumped UMD games or Video.

Another ISO Image Loader was made by the makers of Fastloader, called UMD Emulator. This loader, instead of running the ISO, Emulates the ISO as a UMD in the drive, so then users can run the game via the XMB.

There are many other ISO Loaders, such as Devhook. The loaders are mainly concerned with piracy, and thus mentioning them in some forums is not tolerated. Speculations were made that after the MPH Downgrader was released, more and more PSP Owners were gaining access to ISO Loaders, that in the near future, UMD Game sales will go down and larger sized Memory Stick Duo/PRO Duos will increase.

There are also Booters/Loaders which only run one certain game. Some run an ISO, whereas some others run the psp_game directory (found in the UMD) from the boot of the Memory Stick. Most Loaders require a disc to be put in the drive. Any disc would do, including the Sample Disc. Most of the psp_game runners require the folder to be renamed (in the case of Coded Arms, coa_game).

Many PSP games can be found on BitTorrent servers, and torrents can be found off sites such as torrentreactor.net. When the torrents are downloaded, they can be run with torrent programs such as BitComet, and the file would be downloaded. Most torrents download a RAR Archive, similar to ZIP, ACE and 7z files, and require WinRAR or WinAce to extract. The ISO or the psp_game would then be found in the archive.

ISO Image Loaders did not work with the newer games such as GTA: Liberty City Stories and Me and My Katamari, as these games only were coded to run only on Firmware version 2.XX and force users to upgrade. As of 22nd February 2006 another exploit has been located by the PSP hacking group MPH which allows 1.5 firmware users to run GTA: Liberty City Stories.

Emulation

Emulators for the PSP include:

Version changer

As some newly released PSP games required an updated PSP firmware version, there is a need to upgrade the firmware in order to play new games. Usually, the firmware is included inside the UMD disc. To tackle this issue, homebrew team SonyXTeam's Yoshihiro (former W.A.B member) released the utility called "SXT Version Changer" to change the version number (Physically, not actually changing the revision) for the PSP to read.

The Version Changer 2.0 for 2.0 PSP's is used to launch the MPH Downgrader, since it changes the version to 1.00, therefore launching the 1.50 firmware update.

There is a program called "No Update UMD Starter" which is considered by some to be better than a version changer that actually looks for the UMD0:/PSP_GAME/SYSDIR/BOOT.BIN and skips the update which is in UMD0:/PSP_GAME/SYSDIR/UPDATE/BOOT.BIN to allow the game to load.

The 2.0 update

Sony, seeing that not many people were updating their PSPs to 1.51 or 1.52, had to release an update with something that would give people an incentive to update. This feature was an official web browser, revealed at the 2005 PlayStation Meeting on June 20. The Japanese version of the update was released a week later, on June 27. In addition to a web browser, it also has support for higher-quality MPEG-4 AVC video, the ability to change the wallpaper for the system, and many other features. When the update arrived, many people, not wanting to wait for an official US release, updated their US PSPs with the Japanese upgrade, despite Sony’s warning about upgrading a non-Japanese PSP with the Japanese version. A few days later, Sony announced that 2.0 would be released in the US on August 12, at which point Sony announced the upgrade would be delayed to August 15. In fact, it wasn’t until August 24 that the US 2.0 was released, almost two weeks after it was due. However, users who updated to the Japanese update could not overwrite it with the US version. The US 2.0 was delayed because Sony found more security holes in the Japanese version of 2.0 and had to delay the US version to patch the holes. The Japanese version was also re-released.

2.0 homebrew

Normally, on a 2.0 PSP, unsigned code will appear as corrupted data, thus shutting the door for standard homebrew. But, since 2.0 has a web browser, it can view HTML files. Thus, right after 2.0 was initially released, people immediately started work on games and applications that run through 2.0's browser. Some examples include: WinPSPortal (A collection of many games, links, and apps), IE2PSP, which converts Internet Explorer bookmarks to PSP bookmarks, and an E-Book reader "hack", that allows users to view text files through the browser. On August 5, a user named realritzcracker, found a way to get past the corrupt data icon and get a program to boot, but it would crash. He did it by changing the game so that it looks like a 2.10 update. There have been many other advances, but none of them have been successful.

On September 23 2005, a buffer overun in the image rendering was discovered, allowing an unsigned binary file to be executed. The method involves the user setting a PNG image as their background, and then placing a special TIFF file in their Photo directory. When the Photo menu is accessed, the binary file (h.bin) is loaded.

On September 25 2005, the first "Hello World" program was released. The size of the binary is limited to 64kb, and the PSP cannot yet read unencrypted ELF (a PSP homebrew program) files, so further experimentation is required before any kind of homebrew software can be run.

On September 26 2005, the first playable game using the toc2rta TIFF exploit was released, called "TIFF Pong 2.00." It was the first actual playable 2.00 homebrew game, where the left paddle was controlled by the Up and Down buttons and the right paddle with the Triangle and X buttons.

On September 28 2005, a successful downgrade method for 2.0 PSP users was released by a modding group known as MPH. Using the buffer overflow exploit discovered earlier, it's now possible to install 1.50 firmware onto a 2.0 firmware PSP, thus downgrading it and allowing for execution of unsigned code.

Moving quickly to fix the buffer overflow exploit found in version 2.0 firmware, on October 3rd 2005 Sony released the firmware version 2.01. It should be noted that firmware version 2.01 offers nothing new in the way of features and only closes the hole in 2.0 that allows users to downgrade. PSP users are warned not to update their firmware to 2.01 if they wish to continue running most homebrew applications on their PSP. With a copy of Grand Theft Auto: Liberty City Stories, some homebrew applications and games are still usable using Fanjita's eLoader 2.60 BETA.

2.01+ Homebrew

You must add a |reason= parameter to this Cleanup template – replace it with {{Cleanup|January 2006|reason=<Fill reason here>}}, or remove the Cleanup template.

Grand Theft Auto: Liberty City Stories Exploit Progress:

Using an exploit from GTA: Liberty City Stories, several homebrew programs can now be run on 2.01/2.50/2.60. The exploit started in the form of a cheat device and it's newest version (0.9), can be run on all current 2.xx firmwares. Homebrew custom made for 2.xx cannot be played on previous firmwares. However, the eboot loader for 2.xx relies on eboots which are in the same format to those used for the 1.50 exploit.

On 28 November 2005, EdisonCarter, the same person who searched (by brute force) and released the list of cheat codes for Liberty City Stories, released a homebrew application that was executed by loading a saved game file, and ran behind Liberty City Stories allowing for various modifications to the game, such as infinite health, wanted level/weather/time editing, and the ability to "spawn" any of the vehicles in the game. He would later release an update that included more cheats.

On 13 December 2005, a PSP coder known as Fanjita (who was also responsible for the 2.00 EBOOT Loader) managed to create a "Hello World" for the Liberty City Stories exploit, to prove that it would work.

On 14 December 2005, PSP3D created the first playable Homebrew for Firmware 2.01, "Tetris for Firmware 2.01". It was based on the Liberty City Stories exploit HelloWorld script by Fanjita and EdisonCarter.

On 16 December 2005, Edison Carter had found support for his Liberty City Stories exploit for the 2.60 firmware, meaning it may soon be possible to run arbitrary unsigned code even on PSPs with the 2.60 firmware.

On 6 January 2006, Fanjita created tetris for 2.50 using the Liberty City Stories savegame expoit. He released the game on 10 January. Support for 2.60 was added on 11 January.

On 14 January 2006, Fanjita created a developers kit for the Liberty City Stories exploit.

On 15 January 2006, Percival (a member of PSP3D) created the second playable homebrew game for 2.01, 2.50 and 2.60, GTA PONG, using the developers kit for the Liberty City Stories exploit made by Fanjita. Brad Dwyer (Yeldarb) also released "Snakman", a hybrid of Pac-Man ,for firmware 2.0 & above.

On 22 January 2006, Fanjita came to a major breakthrough in creating an EBOOT Loader for 2.01+, in which he succeeded in removing all traces of Liberty City Stories from the ram, and Fanjita ran the first homebrew on the new EBOOT Loader. This Loader has not been released to the public as of this date.

On 24 January 2006, Fanjita succeeded running a SNES emulator on his GTA EBOOT Loader. This Loader has not been released to the public as of this date and wont be till the code is cleaned up.

On 25 January 2006, arguru (a member of PSP3D) released Mario Brothers for 2.01 and up.

On 26 January 2006, Fanjita succeed in making an eboot loader for PSP Firware versions 2.01 - 2.50

On 28 January 2006, Fanjita and Ditlew launched a new version of his EBOOT loader, now known as eLoader, to the public for 2.00-2.50 PSP's.

On 29 January 2006, a day later, Fanjita along with Ditlew have found 90% of all 2.60 syscalls, and on the same day at 7:00 PM CST, PSPUpdates.QJ.net posted a new version of eLoader, now with the capability of running certain homebrew on 2.60.

On 20 February 2006, Fanjita released to the public the latest installment of his eloader known as brown ale, also this eloader included and upgrade for the TIFF eboot loader

On 22 February 2006, Fanjita and his team released a patched version of the brown ale eloader do to the fact that it contained glitches which are all fixed now

Firmware loaders

It would be possible to be able to run 2.00+ specific games such as GTA: Liberty City Stories and be able to run Homebrew using a Firmware Loader, such as the ones made by MPH and SonyXTeam. The PSP has four drives: ms0:\ (the Memory Stick), flash0:\ and flash1:\ (The BIOS and the flash memory) and disc0:\ (the UMD Drive). The Firmware is located on flash0:\ and flash1:\. All the files from flash0:\ would be copied to ms0:\FA and the files from flash1:\ would be copied to ms0:\FB and then the Firmware Loader would load the Firmware from the Memory Stick instead of the flash memory and BIOS. On 1.50, homebrew can be run and to play games such as Liberty City Stories, 2.00 would need to actually be installed. At this time there is no way to play Grand Theft Auto:LCS on any firmware lower than 2.0. If a Firmware Loader is developed for Firmware 2.00's TIFF Exploit, then 1.50 would be loaded and homebrew would be able to run. Currently the Firmware Launchers aren't stable enough to give a 100% exact load.

Dead ends

A claimed "overflow" by PSP3D is just a crash. It is not an exploit as claimed, and cannot be further exploited. Several crashes have been created by various people, and none of them lead to an exploit. A similar "overflow" made by viewing savegames (the PSP3D "exploit" had the crash caused by viewing an "update" in the GAMES section).

A vulnerability was found from libungif at version below 4.1.4 and it was fixed at (2005-10-19 08:54), which was after the time when the 2.01 Firmware update was released. It has been tested on some PSPs to cause crashes. Currently there is no idea if this can be turned into an exploit that can load unsigned code.

Notable homebrew programs

The following programs are the Jewels of Homebrew and will work with firmware version 1.5 and under. With Fanjita's EBOOT Loader, many of the programs listed also work on firmware 2.0. To get an updated list of the working programs on firmware 2.0 please see Fanjita's working 2.0 homebrew list.

File:Millionaire shot 1107.jpg

PSP Millionaire Game

Attack of the Mutants - a (modifiable) space shooter game
Callisto - a side scrolling space shooter game.
Flashmod - A Flash Modification Program which edits different aspects of your PSP.
File Assistant - a file management program in which users can transfer files to and from the assistant, run, play files and other related tasks.
Peldet - a TELNET and IRC client
Portable VNC - a VNC client for the PSP
pspChess - chess for the PSP
PSP-httpd - a simple implementation of a web server on the PSP. Users can browse through stored files using any computer on the network, as if they are surfing a website.
PSP Millionaire - the Who Wants to Be a Millionaire? game on the PSP
PSP-OSS - an Open-Source Operating System/Shell/GUI.
PSPacman - Pac-Man game
PSPRadio - a client for streaming (Shoutcast) Internet radio
Quake PSP - Quake port for the PSP.
Sudoku - A Sudoku game for the PSP.
PSIX - Created by NaoNeo, this PSP shell program is available in both Lite (Free) and Pro versions at www.psixonline.com.

All of these above programs can be downloaded from PSPUpdates, users may find tutorials for the above programs at PSPUpdate Forums

PSP hacking/homebrew teams

DST - Team DST claimed to have created a PSP modchip that allows Homebrew on all Firmwares. They stated that they would release and sell the first batch in November 2005 on eBay. So far there is no sign of this so-called modchip.
ESPAL-PSP - creators of Fastloader, UMD Emulator and various standalone loaders. Consists of (fmr.) Humma Kavula.
Fanjita - Developer of the eLoader for v2.01, 2.50 and 2.60. Also the developer of EBOOT Loader for v2.0 homebrew. He is claimed to be the most active supporter in PSP homebrew history.
MPH - active creators of the MPH Downgrader and MPH Firmware Loader, and are currently working on Quake 2 for the PSP. Consists of McZonk and Placa.
Orbis PSP Development - A single person team which has released Flashmod, J-Mania, Deflect and many other PSP applications/games.
PSP3D - After several failures in the homebrew scene, they started to bring out some quality hacking achievements, and also ported the first game to 2.01 firmware PSPs, and work closely with Fanjita to bring out many nice releases.
PSP-DEV - attempted the downgrader along with WAB. Created the Lumines Launcher.
PSP Team - creators of the so-called PSP Team Downgrader, which is really Trojan. PSPBrick.
Team Emergency Exit - Created PSPSet, and the Quake 2 port, they are currently attempting a Dual-BIOS Dual-Load PSP Motherboard.
TeamXHack - an up and coming team, with rumors of a WIP Downgrader using javascript surfacing. This project has been cancelled and the project disbanded due to a failure in the advanced file write system.
toc2rta - creators of the toc2rta TIFF Exploit. Main site is a Wiki.
WAB - creators of the WAB Launcher and WAB Version Changer. Attempted (unsuccessfully) a downgrader. Consists of Alonetrio and (fmr.) Yoshihiro. Currently the WAB website is being sold, meaning WAB is no longer active.

Trojan.PSPBrick

On October 2, 2005, an individual under the name "PSP Team" released a homebrew program that was believed to be another version of the downgrader. As it turns out, the program was actually a trojan written for the PSP that, if run, would destroy the firmware and BIOS. In turn, the PSP would be un-bootable and turn into a "Brick". After the release of this program, many PSP homebrew sites were brought to a standstill making sure that every program was safe to use. This was officially reported by Symantec as Trojan.PSPBrick.

Any files that were based on the toc2rta TIFF exploit, such as the true Downgraders (MPH and all forms and modifications, such as SonyXTeam's) and the EBOOT Loader would be seen as Trojan. PSPBrick, even if they are perfectly safe.

One possible way to fix this is to download PSP AntiTroj v0.90.0.0. It is software which detects trojan-horses on users' PSPs. Users can run it straight off their computer.

External links

Utilities

PSPBrew.com – Everything Homebrew. Has a Custom Brew Pack Generator which creates a custom pack with the homebrew the user wants ready for their PSP. A simple processing of file extraction is only required
iPSP – Converts and installs movies, music, and images onto a Memory Stick for use in a PSP; includes backup and restore for Game Saves.
PSPware – Converts and installs movies, music, and images for use on a PSP; includes synchronization functionality (currently has Mac and Windows versions)
PSP Video 9 – Free video conversion and management (Windows)
PSP Media Studio - Fast DVD-to-PSP conversion software. Also supports AVI, MPEG and Quicktime source movies.
PocketMac – Sync Entourage or Address Book contacts, music & photos from users' Macs to their PSP using iSync
PSP Multimedia Extender – Convert video files (avi, mpeg, divx, etc.) into MPEG4, images (bmp, png, gif) and txt/HTML files to JPEG, and CD Audio to MP3 to be viewed on PSP. And mass file copying to the PSP while maintaining the directory and naming structures (Windows)
XBConnect – provides free online multiplayer for the PSP in addition to the Xbox.
XLink Kai – also provides free online multiplayer for PSP and other systems.

Homebrew news

PSP3D– Great Forum which offers help and SuperMiniMario downlads.
PSP3D– Awesome PSP Website and forums. Great forum support, and as well as up to date news and exploits.
PSP Updates – Awesome PSP Website. Great forum support, and homebrew downloads.
PSPCrazy – Great PSP Website. Has many downloads and a great community.
PSP-Hacks – Best site for PSP hacking programs/Emulators and such. Also the latest hacking reports on the PSP.
PSP Files – News about PSP hacks and exploits.
PSP Wire – Information about games and homebrew. Accompanied by a growing archive of homebrew software and applications.
PSP-Spot – An up-and-coming PSP scene website that has information and news about the latest games, homebrew and news related to the PSP. Rewarded number one website by PSP E-Mag's third issue PSP E Mag
PD Roms – Covers homebrew news for many systems, also PSP. Updated daily and frequently.
PSP News – Reports on homebrew news and commercial releases, such as games and accessories. Also has a database of nearly every PSP application ever released.
Team X Hack Various information
PSPLUA PSP Lua is run by a dedicated group of PSPLUA Developers.
PSPNEWS PSPNEWS Sony Psp homebrew News Downloads and alot more.
PSPSQUAD Information on new PSP games
PSPHacks – The first of the PSP community websites. Information on hacks back to 1.0
Psp-Updates Very frequently updated PSP news site

Homebrew resources

PSP Programming Tutorials – Homebrew development tutorials that walk a novice all the way through creating his or her own apps in C or Lua
PS2Dev – Developer resource site, creators of the PSP Toolchain and PSP Devkit; their forums are widely regarded as the center of PSP Homebrew Development