Requesting information about Wireless stuff. - PSP3D.com - Sony PlayStation Portable News, Homebrew, Hacks, Reviews, Videos, Mods, Forums

BloodForBlood · #1 (**permalink**) 01-19-2006, 05:35 PM

Hi there.

I've got my 2.5 PSP yesterday and was very disappointed that homebrew software doesnt work yet on it.
Well now i had some ideas what i could try with the wireless functions. Does anyone know the NDS WifiMe? Some guy wrote a driver for RALink wlan-cards which recognizes the ds. So i thought i could at least try the similar with the PSP 'send picture'-feature to provoke an overflow or something like that.
Now since im not THAT good at reverse engineering im looking for some documentation or stuff like that from others who worked on the wireless-thing.
Oh, and please dont post stuff like "OMG LOAL THAT DOESNT WORK!11", i want to figure it myself. At least fooling the PSP that my notebook is a psp should not be that hard.
Thanks in advance for any help ^^

scoder · #2 (**permalink**) 01-19-2006, 05:47 PM

good luck man, butterballer tried doing this and it didnt work well, but i hope u get something working. i recommend PMing butterballer, but be aware that he can be temperamental at times, and somewhat of an asshole also.

Kanyew · #3 (**permalink**) 01-19-2006, 05:59 PM

You should look at the location free feature. I dont think anyones ever tried anything with it because they cant afford the base station so dont know how it works.

BloodForBlood · #4 (**permalink**) 01-19-2006, 06:04 PM

I can't afford a base station too, im just a student ^^

scoder · #5 (**permalink**) 01-19-2006, 06:05 PM

kanye is right, an alleged sony employee said that there is an exploit in the locationfree player.

BloodForBlood · #6 (**permalink**) 01-21-2006, 09:40 AM

Well, i finally found some information.
http://oopo.net/consoledev/files/psp-gameshare-1.0.0.c if someone else needs it.

badg0r · #7 (**permalink**) 01-21-2006, 03:10 PM

good luck with it

BloodForBlood · #8 (**permalink**) 01-23-2006, 04:34 PM

Did some analyzing and pseudo reverse-engineering here.
Does somebody have a clue what to fill in in the colums with the question marks in it?

Code:


proto broadcast:

packet 1 (size 138 bytes)
00 01 01 02 00 80 54 6f 	92 69 00 FF FF FF FF FF
FF FF FF FF FF FF FF FF		FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF		FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF		FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF		FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF		FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF		FF FF FF FF FF FF FF FF
FF FF FF FF FF FF

split down:
00 01 		protocol.
02 00  		maybe some kind of "hi, i want a handshake"
00		end of header?
80		length of the following data (128)
54 6f 92 69 00	my psps name (tobi), null terminated
FF FF ..	filling data until 128 bytes.

packet 1 (size 82 bytes)
00 02 2e 08 00 00 00 00 	00 00 00 00 00 00 00 00
00 00 51 f5 86 9d ec 5c		5d 4b cd b0 d1 df 5e f9
[too much random stuff coming after here. im afraid of giving away a serial number or something like that]

split down:
00 02		protocol..?
2e 08		?
00		end of header..?
00 (13 bytes)	?
rest (64 bytes)	i believe some sort of encryption key..?

Well, as in the second packet is no byte for the size (40 in hex) in the header, i assume the 64 bit is the key. Should be the public key, though.
Can't to much more until i get a second psp. I'll try to borrow one from a friend.