Ipl Game For Psp

• Game For Psp Free
• Game For Psp Download Free
• Ipl Game For Psp Pc

Download Ipl Game For Psp Posted on 6/17/2018 by admin Pepsi IPL 6 Game – Overview – Free Download – Compressed – Screenshots – PC – RIP – Specs – Torrent/uTorrent Type of game: Sports, Cricket PC Release Date: unknown Developer: unknown Pepsi IPL 6 (Size: 643 MB) is a Sports video game. Apr 8, 2014 - DLF or Pepsi IPL T20 Cricket game is available for download at PC, Android, and iOS. Free IPL cricket Game has twenty overs format with many best features.

The PRE-IPL, called 'Lib-PSP iplloader' internally by sony, is the first code to run in PSP MIPS32 main CPU. Its role is to load the Initial Program Loader. PRE-IPL is where the routines to boot into service mode are and loads & decrypts the encrypted IPL from the nand/MS).

On retail PSP units PRE-IPL is read from the Tachyon (Allegrex MIPS R4000 based SOC) boot rom. On DTP-T1000 it is loaded externally.

The PSP main CPU is a custom-made Sony CPU with a MIPS32 core and has an embedded mask rom device (like most embedded systems do) which is exactly 4KB in size. This device holds the PRE-IPL. This PRE-IPL mask rom device is mapped to physical address 0x1FC00000 (this is the address of reset exception vector on MIPS CPUs), and this is where the CPU starts executing from coldboot.

The PRE-IPL is made up of 2 parts, the 'loader', and the 'payload'.

TODO

A few example of PRE-IPL payload sizes and hashes are:

PRE-IPL Boot Sequence[edit]

Part1 PRE-IPL (the loader)[edit]

Because the PRE-IPL is stored in non-volatile read-only memory it cannot use variables, so the Part1 PRE-IPL code (the loader) copies the Part2 PRE-IPL (the payload) to the CPU's scratchpad RAM (the only RAM available at this time, along with another 4KB block of RAM and the 2MB EDRAM - normal DDR SDRAM hasnt been initialised yet). The scratchpad RAM is mapped to physical address 0x00010000, and after Part1 has finished copying Part2 to it, it jumps to this new address.

Part2 PRE-IPL (the payload)[edit]

Now the CPU is executing from the scratchpad RAM (the PRE-IPL payload). The PRE-IPL payload inits the nand hardware and reads the IPL nand-block-table (a table with the physical block numbers of the encrypted IPL's location on the nand). The table is located at the 4th physical block of the nand (offset 0x10000), and is repeated for the next 7 blocks. This is so that if a bad block occurs in any of these blocks, the table can still be read. Though if all 8 blocks become bad blocks, its a non-recoverable brick as the PRE-IPL can no longer locate the IPL's location (the only solution to this problem is to either boot from MS instead, or use a custom IPL to patch the PRE-IPL to remap the table - both of which would still require Pandora).

The entire raw IPL is stored on the nand encrypted. The PRE-IPL payload uses a 4KB RAM (this RAM is mapped to physical address 0x1FD00000, but will later be remapped to 0x1FC00000 to be used for the ME CPU reset exception vector) as a temporary location to load & decrypt each encrypted IPL block. Because this RAM is only 4KB in size, the encrypted IPL is organised as 4KB blocks on the nand. As the PRE-IPL decrypts each of the 4KB IPL blocks, it loads the decrypted blocks to the IPL entry address 0x040F0000 (this address is located in the 2MB EDRAM which is normally used as VRAM, normal DDR RAM still has not been initialised yet). When the PRE-IPL has finished decrypting and loading all the encrypted IPL blocks, it jumps to the IPL entry address.

Memory mapping[edit]

The PRE-IPL is mapped to 0xBFC00000 which is the reset vector of PSP's MIPS R4000 CPU.

0.7.0 PRE-IPL and onward are composed of two parts: a loader from 0xBFC00000 to 0xBFC0027F and a payload from 0xBFC00280 and ending at the size specified at 0xBFC000034 (little endian 0x2 bytes).

PSVita's PRE-IPL from version 0.996 and onward's payload starts at 0xbfc00180, rather than 0xbfc00280 on previous and PSP hardware versions.

Devkit behaviour[edit]

bloadp[edit]

bloadp is used to send kbooti binaries (encrypted PRE-IPL data from 0x0 to 0x1000 and IPL blocks at 0x1000) to the DTP-T1000.

bloadp will (through tachsm) initialize the 0x1D600000 memory (from /dev/mem or 0x00000000 from /dev/tachsm0 ; /dev/tachsm1 is mapped from 0x1D400000 to 0x1D5FFFFF) on the Communication Processor side (0x200000 in size, 0x100000 on the tachsm0 device) which is the DTP-T1000 PSP Shared memory, on the psp/tachyon side it is mapped to 0xBFE00000, it will then write the kbooti binary at 0x1D600000, however on SDK 0.5.0 and below dstdb (which bloadp was originally a part of), it was possible to specify the address to which kbooti would be loaded (default address to be specified was 0xbfc00000, the allowed range was 0xbfc00000-0xbfc10000), this in effect would write kbooti to 0x1D600000/0xBFE00000 + the address specific in the range -0xbfc00000, so for instance if 0xbfc02000 was specified, this would write kbooti to 0xBFE02000, keep in mind that the actual 0xBFC00000 memory mirrors itself every 0x1000 segments.

If bloadp is never invoked, 0x1D700000 to 0x1D7FFFFF is uninitialized memory. It is cleared out as soon as bloadp is invoked.

Prototype 0.4.0-0.6.0 (23-07-2004 or older)[edit]

Prototype PRE-IPL will read the IPL blocks in place from 0xBFE01000 and decrypts them to 0x88400000 before jumping there. IPL blocks have no metadata in prototype IPLs. Instead PRE-IPL uses 0x88400000 as a hardcoded entry point (see code samples below). In fact the IPL payload/part3, nested inside current IPL revisions and loaded by main.bin are using the prototype format, so the prototype PRE-IPL loads the IPL part 3/payload directly.

It is also worthy of note that prototype PRE-IPL for DEM-1000 (for 0.4.0 and 0.6.0 firmwares) does not make use of paddr 0xa0010000 as their payload location. The PRE-IPL payload is instead executed in place at 0xBFC00000. As such the PRE-IPL data is not wiped and can be dumped in its entirety using a custom IPL (please note that the IPL format is different than later revision IPLs: prototype IPLs are loaded in a single raw KIRK commmand 1 block).

0.7.0-2.50 (18-09-2004)[edit]

The 0.7.0+ PRE-IPL will copy its PRE-IPL payload (stored at 0xBFC000280) to 0x80010000 (physical address 0xa0010000) and jump there. Because on DTP-T1000 0xBFC00000 is writable during PRE-IPL execution and because 0xBFD00000 is an invalid range on DTP-T1000, the payload will use the 0xBFC00000 memory (which originally contains the whole PRE-IPL loader+payload) as work ram. It will however not wipe itself so you can dump the important part (the payload) from 0xa0010000 (assuming you gain execution at IPL time).

IPL blocks are then loaded from 0xBFE01000 by PRE-IPL and copied to 0xBFC00000 where they are decrypted in place and copied to the location of load address specified in the metadata.

2.60+ (22-10-2005)[edit]

Because a hash of the data stored between 0xbfc00040 and 0xbfc002c0 is used in an additional step by 2.60+ IPLs to decrypt main.bin, from 2.60 and onward the payload will overwrite 0xbfc00000 with an identical copy of first 0x2C0 bytes of the original psp-1000(01g) PRE-IPL rom data (stored at 0xBFC00BB0 in the 2.60 and 2.71 kbooti, 0x80010930 in the payload) and wipe everything after 0xbfc002C0 with 00 before jumping to the IPL entrypoint, if bootstrapping the 1.50 firmware using the 2.60/2.71 PRE-IPL part, data from the retail rom addresses 0xBFC00200 to 0xBFC002C0 is retrievable, please note that this would not have been enough to generate the hash required to decrypt 2.60+ main.bin in any case and dumping using a custom IPL would be required to retrieve enough of the data even on a DTP-T1000.

If bloadp is never invoked, 0x1D700000 to 0x1D7FFFFF is uninitialized memory. It is cleared out as soon as bloadp is invoked.

Prototype 0.4.0-0.6.0 (23-07-2004 or older)[edit]

Prototype PRE-IPL will read the IPL blocks in place from 0xBFE01000 and decrypts them to 0x88400000 before jumping there. IPL blocks have no metadata in prototype IPLs. Instead PRE-IPL uses 0x88400000 as a hardcoded entry point (see code samples below). In fact the IPL payload/part3, nested inside current IPL revisions and loaded by main.bin are using the prototype format, so the prototype PRE-IPL loads the IPL part 3/payload directly.

It is also worthy of note that prototype PRE-IPL for DEM-1000 (for 0.4.0 and 0.6.0 firmwares) does not make use of paddr 0xa0010000 as their payload location. The PRE-IPL payload is instead executed in place at 0xBFC00000. As such the PRE-IPL data is not wiped and can be dumped in its entirety using a custom IPL (please note that the IPL format is different than later revision IPLs: prototype IPLs are loaded in a single raw KIRK commmand 1 block).

0.7.0-2.50 (18-09-2004)[edit]

The 0.7.0+ PRE-IPL will copy its PRE-IPL payload (stored at 0xBFC000280) to 0x80010000 (physical address 0xa0010000) and jump there. Because on DTP-T1000 0xBFC00000 is writable during PRE-IPL execution and because 0xBFD00000 is an invalid range on DTP-T1000, the payload will use the 0xBFC00000 memory (which originally contains the whole PRE-IPL loader+payload) as work ram. It will however not wipe itself so you can dump the important part (the payload) from 0xa0010000 (assuming you gain execution at IPL time).

IPL blocks are then loaded from 0xBFE01000 by PRE-IPL and copied to 0xBFC00000 where they are decrypted in place and copied to the location of load address specified in the metadata.

2.60+ (22-10-2005)[edit]

Because a hash of the data stored between 0xbfc00040 and 0xbfc002c0 is used in an additional step by 2.60+ IPLs to decrypt main.bin, from 2.60 and onward the payload will overwrite 0xbfc00000 with an identical copy of first 0x2C0 bytes of the original psp-1000(01g) PRE-IPL rom data (stored at 0xBFC00BB0 in the 2.60 and 2.71 kbooti, 0x80010930 in the payload) and wipe everything after 0xbfc002C0 with 00 before jumping to the IPL entrypoint, if bootstrapping the 1.50 firmware using the 2.60/2.71 PRE-IPL part, data from the retail rom addresses 0xBFC00200 to 0xBFC002C0 is retrievable, please note that this would not have been enough to generate the hash required to decrypt 2.60+ main.bin in any case and dumping using a custom IPL would be required to retrieve enough of the data even on a DTP-T1000.

2.6.0 kbooti also appears to fix one of the PRE-IPL flaws that allowed to load the Pandora time attacked block. It likely either checks for the entrypoint not to be in the 0xb* range or prevents the use of IPL blocks with 0x0 set as a load address (or both), it does not however check for the data size of the block.

The code that copies 0x2C0 bytes from 0x80010930 to 0xbfc0 verbatim from the 2.6.0 PRE-IPL payload.

Please note that neither the 0xbfc00000 (on DTP-T1000) nor 0xa0010000 memory locations survive reboots.

Game For Psp Free

3.50+ (01-06-2007 or older)[edit]

Game For Psp Download Free

PRE-IPL adds a step using a 0x40 bytes xor key to decrypt the CMAC hash and data keys from the IPL block headers. As a result you cannot decrypt using KIRK command 1 the IPL blocks meant for the new PRE-IPL.

Retail behaviour[edit]

pseucode from Tachyon 0x00140000-0x00300000 PRE-IPL payload:

Tachyon revisions 0x00140000 to 0x00300000 PRE-IPL pseudo code:

PSVita Compatibility mode behavior[edit]

PRE-IPL is sent by the compatibility secure module (os0:sm/compat_sm.self) to the non-secure kernel which writes it to 0xE8100000 (named CompatSharedSram and mapped to the 0xBFC00000 reset vector on the emulated PSP/Tachyon side).

compat_sm will then send a specific 0x40 bytes key to be used for by the PSVita's PRE-IPL as a 0x40 bytes XOR mask against the IPL header (the IPL is stored in the pcbc.skprx kernel module).

KIRK command 1 will then be used on the result. Unlike on actual PSP units, the IPL is decrypted in a single large block rather than in multiple blocks.

The 0x40 bytes key gets updated depending on the firmware version in use.

A 0x40 bytes XOR mask is also presumably how the PSP-3000 (and newer), as well as the 3.50+ DTP-T1000 security, is most likely handled (see PSP PRE-IPL section).

As of March 21st 2018, a dumper for DTP-T1000 PRE-IPL has been made available on github by mathieulh:

Ipl Game For Psp Pc