Editing Pandora

On August 22 2007, Team C+D released the "Pandora's Battery" which was the [[Prometheus]] Project everyone was waiting for. It converted a spare Memory Stick Pro Duo and battery into a "Magic Memory Stick" and "JigKick Battery". Some People mistake Pandora's Battery for the Jigkick Battery, but Pandora's battery is both the Magic Memory Stick and the JigKick Battery. The Memory Stick and battery can then be used to downgrade any PSP of any version or to recover from a brick. To convert the Memory Stick and battery another PSP which is able to run 1.50 homebrew is needed. The Memory Stick can also be converted without using a homebrew PSP by using a Pandora's battery program, such as Pandora Easy GUI. After the downgrade/unbrick service has been completed, the Memory Stick and battery can be restored for normal usage.

= [[JigKick Battery]] =

Hardmod is when you you make a JigKick Battery by opening it up and and removing a pin, this can be done to any battery.

Softmod is when you make a JigKick Battery by using a program. But it has to be suitable. New Batteries cannot be softmodded.

The preipl exploit works like this:

First a decrypted ipl block:

Which means load 0xF50-byte data to 0x040F1EA0. 0xB71C6EBA is the checksum of the previous block. Then entry address is 0 since it hasnt reached the end yet and there are more blocks to load. Once it has loaded all the ipl blocks the very last block will have entry address of where the whole ipl has been loaded (typically 0x040F0000). And will then jump to that address.

Preipl pseudocode for loading & decrypting the ipl:

 

 

As the preipl loads the first ipl block (the fake one), it decrypts the block in-place, ie. the decrypted block just overwrites your encrypted block. The fake block only decrypts into four bytes of all 0's so it ends up only overwriting the first four bytes of your fake block (with four 0's) after decryption.  

 

 

A slight flaw in the crypto engine allowed the bruteforce to be performed on a magnitude-times smaller scale than normally required.

It passes the checksum test (with 0x00000000), it skips the loading of any data (since the loadaddr has been faked to 0x00000000), see's the entry address of 0xBFD00100 and thinks it has reached the end of the ipl and so goes jumps to that address (which is where your unsigned code will be).

So that's essentially it in a nutshell. But dont let a quick 5 min. summary of the exploit underestimate the enormous effort involved in bringing it to fruition (as the final product known as Pandora).

= Properly encrypted Pandora compatible IPL blocks =

On March 10th 2018, Developer Mathieulh released properly encrypted Pandora hack compatible IPL blocks using kirk cmd 0x01 key.

[https://twitter.com/Mathieulh/status/972475508612050944]

[https://twitter.com/Mathieulh/status/972476883802689537]

Here are a few of those:  

 

 

 

 

 

 

 

These are available as binary format here:  

[https://mega.nz/#F!MlFi1QqZ!fGo2pkCEmjFiPynKtDC0Hg]

The 0xBFD00100 version of these blocks work as-is by replacing the time attacked forged block with the properly encrypted ones supplied. The 0xBFE01100 version (which only works on Development Tool units), requires you to rebuild/recompile your custom IPLs using 0xBFE01100 as the entrypoint, it may be wiser to rebuild it as a fully valid IPL instead using ipltool [https://github.com/zecoxao/ipltool],although using the Pandora compatible IPL block instead would allow you to port retail custom IPL projects on devkit with minimal efforts.