• Good day, Guest!
    Flowers in Chania

    OG is raising money to form a non profit community interest company enabling us to preserve more history than ever before!

    Unfortunately, like most things in life this is going to cost money and we're asking for some help from the community. All users will be given donator status, along with early updates and depending on how much you help us with we'll try to chuck in some free merch!

    This will cost us roughly $850 for two years including business address/phone number etc which is needed to register a business bank account within the UK.

    You can help us by making a custom pledge, or by making a general pledge as it all helps us greatly. We're happy for a one time donators via Ko-Fi, Patreon asks monthly so please be aware. To prevent charge backs we're unable to accept Paypal at this time. Although once live this will be sorted too!

    One time donations can be sent via our Ko-Fi,



    Or for monthly please visit our Patreon, Ko-Fi is preferred as they charge us less fee's. Become a Patron of Obscure Gamers!
  • The Obscure Gamers 2020 Light and Dark themes are now live! Please report any bugs and make any suggestions you may have to a member of staff.

PSP PATCHED IPLS for 1.00/1.50 By Mathieulh

Mathieulh

Problem Solver
Refugee
Joined
May 31, 2019
Messages
51
Reaction score
59
AG User Name
Mathieulh
AG Join Date
01/01/2006
PATCHED IPLS By Mathieulh

Those are 1.00 and 1.50 patched IPLs, they will load plain (decrypted) modules and config.txt
the ones in the "Dumps 0xbfc00000 to 0x883f0000 and supports plain modules" folder will also copy 0xbfc00000 to 0x883f0000
whereas the ones in "Plain Support with 0xbfc00000 dump and TA082 clockgen fix" add the TA-082 clockgen fix (though this is only relevant for
retail systems, as I only own development units, I tested this patch on a DTP-T1000 system)

The 0x883f0000 address is overwritten on development units and cannot be used to retrieve relevant data (so is 0xBFC00000),
you may however modify the addresses and rebuild the sources and IPL to your liking.

The plain text patch uses the patched payload from https://github.com/mathieulh/150IPL_PLAINMODULES

"Lib-PSP iplloader" contains Special kbooti that only run on development kits, which allow to run/bootstrap decrypted Lib-PSP iplloader code

This follows the project here: https://github.com/mathieulh/Lib-PSP-iplloader-Bootstraper-for-DTP-T1000

Lib-PSP iplloader0.9.0_bfe03000.bin : patched iplloader0.9.0 (used in 0.9.0 to 2.5.0 SDKs to run IPL from 0xBFE03000 (0x3000 in the file)

Tachyon0x00140000i.bin: Tachyon 0x00140000 (TA-079 to TA-081 pre-ipl) patched to run on Development kit.
Tachyon0x00140000i_CS_Mode.bin: Tachyon 0x00140000 (TA-079 to TA-081 pre-ipl) patched to run on Development kit with forced service mode
Tachyon0x00400000i.bin: Tachyon 0x00400000 (TA-082 to TA-088 pre-ipl) patched to run on Development kit with forced service mode
Tachyon0x00400000i_CS_Mode.bin: Tachyon 0x00400000 (TA-082 to TA-088 pre-ipl) patched to run on Development kit with forced service mode

DOWNLOAD LINK:


UPDATE: Added patched loadcore for 1.0.2 and 1.0.3 firmware.

UPDATE2: I updated the 1.00 IPLs to use a patched 1.00 payload instead of the a mix between 1.00 main.bin and 1.50 payload as this seems to may have caused incompatibilities on retail systems (it worked on devkit though), this is cleaner either way,(albeit more work for me) since those are full 1.00 IPLs now

UPDATE3: Added IPLs that dump to 0x883e0000 for testing purposes
 
Last edited:

Mathieulh

Problem Solver
Refugee
Joined
May 31, 2019
Messages
51
Reaction score
59
AG User Name
Mathieulh
AG Join Date
01/01/2006
On a sidenote, in the patched 1.50 modules, loadcore is patched to allow further plain text modules along the boot to be loaded, modulemgr patches kxploit so you don't need to use 2 separate folders for homebrew and you can just use the 1.00 format (assuming you run code from ms0:/PSP/GAME/$HOMEBREW/EBOOT.PBP, if you are on a development unit and use the T1000/H1500/L1500 vsh (which hide the memory stick in game menu) and run apps from disc0:/PSP_GAME/SYSDIR/BOOT.BIN or mstart (from host0:/ or app_home) the modulemgr patch would be quite useless to you.

This still lacks a proper loadexec patch to load a fully decrypted boot chain (for example vshmain cannot currently run decrypted), feel free to contribute though!
 

Yoti

Registered
Registered
Joined
Jul 7, 2019
Messages
3
Reaction score
0
AG User Name
Yoti
AG Join Date
Nov 24, 2011
Tachyon0x00400000i.bin: Tachyon 0x00400000 (TA-082 to TA-088 pre-ipl) patched to run on Development kit with forced service mode
Tachyon0x00400000i_CS_Mode.bin: Tachyon 0x00400000 (TA-082 to TA-088 pre-ipl) patched to run on Development kit with forced service mode
TA-086?
 

Yoti

Registered
Registered
Joined
Jul 7, 2019
Messages
3
Reaction score
0
AG User Name
Yoti
AG Join Date
Nov 24, 2011
I think Slims can't run pre-3.xx kernel.
 

WorldGenesis

:D
2019 Donator
Joined
May 31, 2019
Messages
31
Reaction score
9
AG User Name
WorldGenesis
AG Join Date
May 12, 2007
I think Slims can't run pre-3.xx kernel.
I believe it had something to do with the display drivers, 1.50 Pandora does work but it was just a dark screen :p

There was a 1.50+3.40 mix out there, where it was a 1.50 FW but had some modules of 3.40 (or was it 3.52?). It was only runnable via Pandora I think. :O

EDIT: Oh it was Time Machine that did it XD

EDIT2: So just tried flashing the "Plain modules and TXT support" retail IPL for 1.50 and 1.00 :p

It works perfect in 1.5.0 release, but not so much for 1.0.3 or 1.0.0 , it bricks on that :O I also did the loadcore patch as well from there.
 
Last edited:

Mathieulh

Problem Solver
Refugee
Joined
May 31, 2019
Messages
51
Reaction score
59
AG User Name
Mathieulh
AG Join Date
01/01/2006
I believe it had something to do with the display drivers, 1.50 Pandora does work but it was just a dark screen :p

There was a 1.50+3.40 mix out there, where it was a 1.50 FW but had some modules of 3.40 (or was it 3.52?). It was only runnable via Pandora I think. :O

EDIT: Oh it was Time Machine that did it XD

EDIT2: So just tried flashing the "Plain modules and TXT support" retail IPL for 1.50 and 1.00 :p

It works perfect in 1.5.0 release, but not so much for 1.0.3 or 1.0.0 , it bricks on that :O I also did the loadcore patch as well from there.

Odd, are you sure you tried the 1.00 kbooti? I use that to load even 1.0.2.

Also you need to use the 1.0.3 loadcore on 1.0.3, I updated the patched modules to include it though I did not test anything but the 1.5.0 modules, I plan on testing the 1.0.2 and 1.0.3 loadcore tonight, in the meantime try without the loadcore patch on 1.0.3 I guess?

I tested all the kbooti and they do work though

P.S. What do you use to write the custom modules?

UPDATE: I may have had the 1.0.2 and 1.0.3 loadcore patches wrong, (I can't tell for sure because I can't test).

UPDATE2: woops I did do a loadcore patch wrong, so 1.0.2 loadcore was bricking (not 1.0.3 though, even though the patch was wrong there as well)

I just updated the original posts's link
 
Last edited:

WorldGenesis

:D
2019 Donator
Joined
May 31, 2019
Messages
31
Reaction score
9
AG User Name
WorldGenesis
AG Join Date
May 12, 2007
Odd, are you sure you tried the 1.00 kbooti? I use that to load even 1.0.2.

Also you need to use the 1.0.3 loadcore on 1.0.3, I updated the patched modules to include it though I did not test anything but the 1.5.0 modules, I plan on testing the 1.0.2 and 1.0.3 loadcore tonight, in the meantime try without the loadcore patch on 1.0.3 I guess?

I tested all the kbooti and they do work though

P.S. What do you use to write the custom modules?

UPDATE: I may have had the 1.0.2 and 1.0.3 loadcore patches wrong, (I can't tell for sure because I can't test).

If you can ascertain that's the case (if it bricks with the modules from my original post), try the ones here:
I'll test tonight otherwise.
>Odd, are you sure you tried the 1.00 kbooti? I use that to load even 1.0.2.
Yeah, I tried the Retail ipl100_plain and ipl150_plain on 1.50, and both booted just fine :p

Yeah, I used a combination of the 1.0.3 loadcore on 1.0.3 with the ipl100_plain and without the loadcore patch.

I used jas0nuk's Elf Menu v0.4, its the only Flash -> USB tool I have available, so I just copy the modules directly to it. I'll give those a try tonight and will report back the results :p
 

Mathieulh

Problem Solver
Refugee
Joined
May 31, 2019
Messages
51
Reaction score
59
AG User Name
Mathieulh
AG Join Date
01/01/2006
>Odd, are you sure you tried the 1.00 kbooti? I use that to load even 1.0.2.
Yeah, I tried the Retail ipl100_plain and ipl150_plain on 1.50, and both booted just fine :p

Yeah, I used a combination of the 1.0.3 loadcore on 1.0.3 with the ipl100_plain and without the loadcore patch.

I used jas0nuk's Elf Menu v0.4, its the only Flash -> USB tool I have available, so I just copy the modules directly to it. I'll give those a try tonight and will report back the results :p
Elf Menu v0.4, actually works from 1.50? Do you have a link to that? I can't find it anywhere.
 

WorldGenesis

:D
2019 Donator
Joined
May 31, 2019
Messages
31
Reaction score
9
AG User Name
WorldGenesis
AG Join Date
May 12, 2007
Elf Menu v0.4, actually works from 1.50? Do you have a link to that? I can't find it anywhere.
Not from 1.50, I'm using the classic Pandora with the Elf Menu v0.4 as the 'extprxs.elf' replacement.

( I mean, technically it IS running in 1.50...the Pandora subset at least :p )
 

Mathieulh

Problem Solver
Refugee
Joined
May 31, 2019
Messages
51
Reaction score
59
AG User Name
Mathieulh
AG Join Date
01/01/2006
Not from 1.50, I'm using the classic Pandora with the Elf Menu v0.4 as the 'extprxs.elf' replacement.

( I mean, technically it IS running in 1.50...the Pandora subset at least :p )
I would be interested in trying that if you have a link to it anywhere.

You are running from an actual devkit, right?
 

WorldGenesis

:D
2019 Donator
Joined
May 31, 2019
Messages
31
Reaction score
9
AG User Name
WorldGenesis
AG Join Date
May 12, 2007
I would be interested in trying that if you have a link to it anywhere.

You are running from an actual devkit, right?
I'm doing the retail IPLs on the retail unit :p
 

Mathieulh

Problem Solver
Refugee
Joined
May 31, 2019
Messages
51
Reaction score
59
AG User Name
Mathieulh
AG Join Date
01/01/2006
I'm doing the retail IPLs on the retail unit :p
That may explain it, I did not actually try this on retail as I don't own any.

Also the 1.0.3 loadcore patch is for tool, I did not do a retail version. I assume you are using the 1.00 firmware untouched with the patched 1.00 IPL? I'll try the retail firmware tonight, I will also attempt to patch the 1.00 payload directly (I am currently using a patched 1.50 payload on top of 1.00 main.bin) this might be too much work though.

By the way, as you are on a retail, can you try the bfc dump 1.50 IPL and dump 0x883f0000 with kdumper (I have a version in the plain IPL github) to see if that works and dumps the pre-ipl properly? (0x883f0000 is overwritten on devkit).
 

Mathieulh

Problem Solver
Refugee
Joined
May 31, 2019
Messages
51
Reaction score
59
AG User Name
Mathieulh
AG Join Date
01/01/2006
@WorldGenesis can you try with this IPL, this uses the patched 1.00 payload ?

you may also try any of the _test versions in this archive:



If it works, I will update the orginal post.

The patched 1.50 payload with 1.00 main.bin does work on devkit though but IPL execution path may be different on those.

UPDATE: I tested the IPLs it works on devkit, please get the new ipl100 files from the archive on the OG post.
 
Last edited:

WorldGenesis

:D
2019 Donator
Joined
May 31, 2019
Messages
31
Reaction score
9
AG User Name
WorldGenesis
AG Join Date
May 12, 2007
@WorldGenesis can you try with this IPL, this uses the patched 1.00 payload ?

you may also try any of the _test versions in this archive:



If it works, I will update the orginal post.

The patched 1.50 payload with 1.00 main.bin does work on devkit though but IPL execution path may be different on those.

UPDATE: I tested the IPLs it works on devkit, please get the new ipl100 files from the archive on the OG post.
I'll give it a try tonight and report back the results :D
 

WorldGenesis

:D
2019 Donator
Joined
May 31, 2019
Messages
31
Reaction score
9
AG User Name
WorldGenesis
AG Join Date
May 12, 2007
So, it looks like the ipl100_plain.bin won't work on 1.0.3 release still, although 1.50 works flawlessly :p

Here's a dump of 0x883f0000 from 1.50 with the BFC IPL:

150fw_kdump
 

Mathieulh

Problem Solver
Refugee
Joined
May 31, 2019
Messages
51
Reaction score
59
AG User Name
Mathieulh
AG Join Date
01/01/2006
So, it looks like the ipl100_plain.bin won't work on 1.0.3 release still, although 1.50 works flawlessly :p

Here's a dump of 0x883f0000 from 1.50 with the BFC IPL:

150fw_kdump
That's odd, does it work with 1.50 fw? On devkit it boots everything from 1.0.2 to 1.5.0 without any problems
 

WorldGenesis

:D
2019 Donator
Joined
May 31, 2019
Messages
31
Reaction score
9
AG User Name
WorldGenesis
AG Join Date
May 12, 2007
That's odd, does it work with 1.50 fw? On devkit it boots everything from 1.0.2 to 1.5.0 without any problems
Yeah, 1.50FW works with both the ipl150_plain and the ipl100_plain IPL without any issues
 

Mathieulh

Problem Solver
Refugee
Joined
May 31, 2019
Messages
51
Reaction score
59
AG User Name
Mathieulh
AG Join Date
01/01/2006
Yeah, 1.50FW works with both the ipl150_plain and the ipl100_plain IPL without any issues
Does it boot 1.50 plain too?

It seems the IPL is not the issue but rather your 1.00 flash0 files are. Can you try the untouched flash0 with the patched IPL as well if you haven't already?
 

WorldGenesis

:D
2019 Donator
Joined
May 31, 2019
Messages
31
Reaction score
9
AG User Name
WorldGenesis
AG Join Date
May 12, 2007
Does it boot 1.50 plain too?

It seems the IPL is not the issue but rather your 1.00 flash0 files are. Can you try the untouched flash0 with the patched IPL as well if you haven't already?
Yeah :p I ran it with a vanilla installed 1.03 (Release) FW, no modifications or anything.
 
Top