PATCHED IPLS for 1.00/1.50 By Mathieulh

M

Mathieulh

Problem Solver
Registered
Joined
May 31, 2019
Messages
77
PATCHED IPLS By Mathieulh

Those are 1.00 and 1.50 patched IPLs, they will load plain (decrypted) modules and config.txt
the ones in the "Dumps 0xbfc00000 to 0x883f0000 and supports plain modules" folder will also copy 0xbfc00000 to 0x883f0000
whereas the ones in "Plain Support with 0xbfc00000 dump and TA082 clockgen fix" add the TA-082 clockgen fix (though this is only relevant for
retail systems, as I only own development units, I tested this patch on a DTP-T1000 system)

The 0x883f0000 address is overwritten on development units and cannot be used to retrieve relevant data (so is 0xBFC00000),
you may however modify the addresses and rebuild the sources and IPL to your liking.

The plain text patch uses the patched payload from https://github.com/mathieulh/150IPL_PLAINMODULES

"Lib-PSP iplloader" contains Special kbooti that only run on development kits, which allow to run/bootstrap decrypted Lib-PSP iplloader code

This follows the project here: https://github.com/mathieulh/Lib-PSP-iplloader-Bootstraper-for-DTP-T1000

Lib-PSP iplloader0.9.0_bfe03000.bin : patched iplloader0.9.0 (used in 0.9.0 to 2.5.0 SDKs to run IPL from 0xBFE03000 (0x3000 in the file)

Tachyon0x00140000i.bin: Tachyon 0x00140000 (TA-079 to TA-081 pre-ipl) patched to run on Development kit.
Tachyon0x00140000i_CS_Mode.bin: Tachyon 0x00140000 (TA-079 to TA-081 pre-ipl) patched to run on Development kit with forced service mode
Tachyon0x00400000i.bin: Tachyon 0x00400000 (TA-082 to TA-088 pre-ipl) patched to run on Development kit with forced service mode
Tachyon0x00400000i_CS_Mode.bin: Tachyon 0x00400000 (TA-082 to TA-088 pre-ipl) patched to run on Development kit with forced service mode

DOWNLOAD LINK:

mega.nz

5.08 MB file on MEGA

mega.nz mega.nz

UPDATE: Added patched loadcore for 1.0.2 and 1.0.3 firmware.

UPDATE2: I updated the 1.00 IPLs to use a patched 1.00 payload instead of the a mix between 1.00 main.bin and 1.50 payload as this seems to may have caused incompatibilities on retail systems (it worked on devkit though), this is cleaner either way,(albeit more work for me) since those are full 1.00 IPLs now

UPDATE3: Added IPLs that dump to 0x883e0000 for testing purposes

UPDATE4: Added patched test (DTP-H1500) 1.50 modules.

UPDATE5: Added 1.0.3 patched modules in encrypted form as well as the 1.0.3 patched vsh
 
Last edited:
On a sidenote, in the patched 1.50 modules, loadcore is patched to allow further plain text modules along the boot to be loaded, modulemgr patches kxploit so you don't need to use 2 separate folders for homebrew and you can just use the 1.00 format (assuming you run code from ms0:/PSP/GAME/$HOMEBREW/EBOOT.PBP, if you are on a development unit and use the T1000/H1500/L1500 vsh (which hide the memory stick in game menu) and run apps from disc0:/PSP_GAME/SYSDIR/BOOT.BIN or mstart (from host0:/ or app_home) the modulemgr patch would be quite useless to you.

This still lacks a proper loadexec patch to load a fully decrypted boot chain (for example vshmain cannot currently run decrypted), feel free to contribute though!
 
Mathieulh said:
Tachyon0x00400000i.bin: Tachyon 0x00400000 (TA-082 to TA-088 pre-ipl) patched to run on Development kit with forced service mode
Tachyon0x00400000i_CS_Mode.bin: Tachyon 0x00400000 (TA-082 to TA-088 pre-ipl) patched to run on Development kit with forced service mode
Click to expand...
TA-086?
 
Yoti said:
I think Slims can't run pre-3.xx kernel.
Click to expand...

I believe it had something to do with the display drivers, 1.50 Pandora does work but it was just a dark screen :p

There was a 1.50+3.40 mix out there, where it was a 1.50 FW but had some modules of 3.40 (or was it 3.52?). It was only runnable via Pandora I think. :O

EDIT: Oh it was Time Machine that did it XD

EDIT2: So just tried flashing the "Plain modules and TXT support" retail IPL for 1.50 and 1.00 :P

It works perfect in 1.5.0 release, but not so much for 1.0.3 or 1.0.0 , it bricks on that :O I also did the loadcore patch as well from there.
 
Last edited:
WorldGenesis said:
I believe it had something to do with the display drivers, 1.50 Pandora does work but it was just a dark screen :p

There was a 1.50+3.40 mix out there, where it was a 1.50 FW but had some modules of 3.40 (or was it 3.52?). It was only runnable via Pandora I think. :O

EDIT: Oh it was Time Machine that did it XD

EDIT2: So just tried flashing the "Plain modules and TXT support" retail IPL for 1.50 and 1.00 :p

It works perfect in 1.5.0 release, but not so much for 1.0.3 or 1.0.0 , it bricks on that :O I also did the loadcore patch as well from there.
Click to expand...


Odd, are you sure you tried the 1.00 kbooti? I use that to load even 1.0.2.

Also you need to use the 1.0.3 loadcore on 1.0.3, I updated the patched modules to include it though I did not test anything but the 1.5.0 modules, I plan on testing the 1.0.2 and 1.0.3 loadcore tonight, in the meantime try without the loadcore patch on 1.0.3 I guess?

I tested all the kbooti and they do work though

P.S. What do you use to write the custom modules?

UPDATE: I may have had the 1.0.2 and 1.0.3 loadcore patches wrong, (I can't tell for sure because I can't test).

UPDATE2: woops I did do a loadcore patch wrong, so 1.0.2 loadcore was bricking (not 1.0.3 though, even though the patch was wrong there as well)

I just updated the original posts's link
 
Last edited:
Mathieulh said:
Odd, are you sure you tried the 1.00 kbooti? I use that to load even 1.0.2.

Also you need to use the 1.0.3 loadcore on 1.0.3, I updated the patched modules to include it though I did not test anything but the 1.5.0 modules, I plan on testing the 1.0.2 and 1.0.3 loadcore tonight, in the meantime try without the loadcore patch on 1.0.3 I guess?

I tested all the kbooti and they do work though

P.S. What do you use to write the custom modules?

UPDATE: I may have had the 1.0.2 and 1.0.3 loadcore patches wrong, (I can't tell for sure because I can't test).

If you can ascertain that's the case (if it bricks with the modules from my original post), try the ones here:

I'll test tonight otherwise.
Click to expand...


>Odd, are you sure you tried the 1.00 kbooti? I use that to load even 1.0.2.
Yeah, I tried the Retail ipl100_plain and ipl150_plain on 1.50, and both booted just fine :P

Yeah, I used a combination of the 1.0.3 loadcore on 1.0.3 with the ipl100_plain and without the loadcore patch.

I used jas0nuk's Elf Menu v0.4, its the only Flash -> USB tool I have available, so I just copy the modules directly to it. I'll give those a try tonight and will report back the results :P
 
WorldGenesis said:
>Odd, are you sure you tried the 1.00 kbooti? I use that to load even 1.0.2.
Yeah, I tried the Retail ipl100_plain and ipl150_plain on 1.50, and both booted just fine :p

Yeah, I used a combination of the 1.0.3 loadcore on 1.0.3 with the ipl100_plain and without the loadcore patch.

I used jas0nuk's Elf Menu v0.4, its the only Flash -> USB tool I have available, so I just copy the modules directly to it. I'll give those a try tonight and will report back the results :p
Click to expand...
Elf Menu v0.4, actually works from 1.50? Do you have a link to that? I can't find it anywhere.
 
Mathieulh said:
Elf Menu v0.4, actually works from 1.50? Do you have a link to that? I can't find it anywhere.
Click to expand...

Not from 1.50, I'm using the classic Pandora with the Elf Menu v0.4 as the 'extprxs.elf' replacement.

( I mean, technically it IS running in 1.50...the Pandora subset at least :P )
 
WorldGenesis said:
Not from 1.50, I'm using the classic Pandora with the Elf Menu v0.4 as the 'extprxs.elf' replacement.

( I mean, technically it IS running in 1.50...the Pandora subset at least :P )
Click to expand...
I would be interested in trying that if you have a link to it anywhere.

You are running from an actual devkit, right?
 
WorldGenesis said:
I'm doing the retail IPLs on the retail unit :P
Click to expand...
That may explain it, I did not actually try this on retail as I don't own any.

Also the 1.0.3 loadcore patch is for tool, I did not do a retail version. I assume you are using the 1.00 firmware untouched with the patched 1.00 IPL? I'll try the retail firmware tonight, I will also attempt to patch the 1.00 payload directly (I am currently using a patched 1.50 payload on top of 1.00 main.bin) this might be too much work though.

By the way, as you are on a retail, can you try the bfc dump 1.50 IPL and dump 0x883f0000 with kdumper (I have a version in the plain IPL github) to see if that works and dumps the pre-ipl properly? (0x883f0000 is overwritten on devkit).
 
@WorldGenesis can you try with this IPL, this uses the patched 1.00 payload ?

you may also try any of the _test versions in this archive:



If it works, I will update the orginal post.

The patched 1.50 payload with 1.00 main.bin does work on devkit though but IPL execution path may be different on those.

UPDATE: I tested the IPLs it works on devkit, please get the new ipl100 files from the archive on the OG post.
 
Last edited:
Mathieulh said:
@WorldGenesis can you try with this IPL, this uses the patched 1.00 payload ?

you may also try any of the _test versions in this archive:



If it works, I will update the orginal post.

The patched 1.50 payload with 1.00 main.bin does work on devkit though but IPL execution path may be different on those.

UPDATE: I tested the IPLs it works on devkit, please get the new ipl100 files from the archive on the OG post.
Click to expand...

I'll give it a try tonight and report back the results :D
 
So, it looks like the ipl100_plain.bin won't work on 1.0.3 release still, although 1.50 works flawlessly :P

Here's a dump of 0x883f0000 from 1.50 with the BFC IPL:

150fw_kdump
 
WorldGenesis said:
So, it looks like the ipl100_plain.bin won't work on 1.0.3 release still, although 1.50 works flawlessly :P

Here's a dump of 0x883f0000 from 1.50 with the BFC IPL:

150fw_kdump
Click to expand...
That's odd, does it work with 1.50 fw? On devkit it boots everything from 1.0.2 to 1.5.0 without any problems
 
WorldGenesis said:
Yeah, 1.50FW works with both the ipl150_plain and the ipl100_plain IPL without any issues
Click to expand...

Does it boot 1.50 plain too?

It seems the IPL is not the issue but rather your 1.00 flash0 files are. Can you try the untouched flash0 with the patched IPL as well if you haven't already?
 
Mathieulh said:
Does it boot 1.50 plain too?

It seems the IPL is not the issue but rather your 1.00 flash0 files are. Can you try the untouched flash0 with the patched IPL as well if you haven't already?
Click to expand...

Yeah :P I ran it with a vanilla installed 1.03 (Release) FW, no modifications or anything.
 
You must log in or register to reply here.
Back
Top Bottom