First, the address of all the sce(Sony Computer Entertainment) functions. I don't know what's going on today, but back in the day hackers had to dump kernel and/or memory to find all those values and they went into an assembly language file. I was on the forums back when people were arguing about the "sce" prefix. I'm very happy to see Davee stuck with that standard with the src code on the Davee-Bubbletune site. It's illogical not to do it that way. My file was really long with all kinds of address.. but it looked like this:
Code:
STUB_START "ModuleMgrForKernel",0x40010000,0x00130005
STUB_FUNC 0xabe84f8a,sceKernelLoadModuleBufferWithApitype
STUB_FUNC 0xba889c07,sceKernelLoadModuleBuffer
STUB_FUNC 0xb7f46618,sceKernelLoadModuleByID
STUB_FUNC 0x437214ae,sceKernelLoadModuleWithApitype
STUB_FUNC 0x977de386,sceKernelLoadModule
STUB_FUNC 0x710f61b5,sceKernelLoadModuleMS
STUB_FUNC 0x91b87fae,sceKernelLoadModuleVSHByID
STUB_FUNC 0xa4370e7c,sceKernelLoadModuleVSH
STUB_FUNC 0x23425e93,sceKernelLoadModuleVSHPlain
STUB_FUNC 0xf9275d98,sceKernelLoadModuleBufferUsbWlan
STUB_FUNC 0xf0cac59e,sceKernelLoadModuleBufferVSH
STUB_FUNC 0x50f0c1ec,sceKernelStartModule
STUB_FUNC 0xd1ff982a,sceKernelStopModule
STUB_FUNC 0x2e0911aa,sceKernelUnloadModule
STUB_FUNC 0xd675ebb8,sceKernelSelfStopUnloadModule
.......blah blah...
Those hex numbers were obtained by dumping memory. Different embedded systems support different types of compiled C. I believe hackers had to take a PSP physically apart and identify the chipset on them; then lookup their specs on line. In the end.. the compile-line looked like this(for cygwin)
Code:
C:\PSPCYGWIN\ee\bin\ee-gcc.exe -march=r4000 -g -mgp32 -c -xassembler -O -o startup_ex.o startup_ex.s
C:\PSPCYGWIN\ee\bin\ee-gcc.exe -march=r4000 -g -mgp32 -mlong32 -c ExitCallback.c
C:\PSPCYGWIN\ee\bin\ee-gcc.exe -march=r4000 -g -mgp32 -mlong32 -c WorldGroove
C:\PSPCYGWIN\ee\bin\ee-ld.exe -O0 -G0 -lc startup_ex.o WorldGroove.o ExitCallback.o -M -Ttext 8900000 -q -o out
And then there was an ELF patching to the "out" binary. Google ELF Object file format for that. I have no idea what that patching was about, but I assume the "out" binary created by all those compile commands above produces something close, but not exact, to what the PSP 1.50 would run.
You'd have to wrap up that out inside of an EBOOT.PBP, which contained the icon displayed "ICON0.PNG". The parameters of the code to boot; like size 'n stuff "PARAM.SFO" and finally the "out" bin file that was compiled previously. It'd be renamed to "DATA.PSP", if I remember correctly.
There was a tool for all that "PBP Unpacker"(which also can pack).
Inside the WorldGroove.c file, it would import constants that hackers would figure out. Back then, it looked something like:
Code:
#define SCREEN_WIDTH 480
#define SCREEN_HEIGHT 272
#define PIXELSIZE 1
#define LINESIZE 512
#define FRAMESIZE 0x44000
#define CTRL_SQUARE 0x8000
#define CTRL_TRIANGLE 0x1000
#define CTRL_CIRCLE 0x2000
#define CTRL_CROSS 0x4000
#define CTRL_UP 0x0010
#define CTRL_DOWN 0x0040
#define CTRL_LEFT 0x0080
#define CTRL_RIGHT 0x0020
#define CTRL_START 0x0008
#define CTRL_SELECT 0x0001
#define CTRL_LTRIGGER 0x0100
#define CTRL_RTRIGGER 0x0200
blah blah...
And finally... the WorldGroove.c file itself was
Code:
int xmain()
{
int retc;
char* buf;
int hFile;
//Enable HOME Button
SetupCallbacks();
retc = 7;
buf = "Here we go!";
hFile = sceIoOpen("ms0:/PSP/INIT.txt", O_CREAT|O_WRONLY|O_TRUNC, 0777);
sceIoWrite(hFile, buf, sizeof(11));
sceIoClose(hFile);
retc = sceKernelLoadModuleMS("ms0:/PSP/PRX/pspnet.prx", 0, 0);
sceKernelStartModule(retc);
hFile = sceIoOpen("ms0:/PSP/sceLoadModule.txt", O_CREAT|O_WRONLY|O_TRUNC, 0777);
sceIoWrite(hFile, "Still going!", 5);
sceIoClose(hFile);
return 0;
}
The reason it's "xmain", is because the assembly code that runs before it was called main and it figured out where xmain was...
Code:
_start:
addiu $sp, 0x10
sw $ra, 0($sp)
sw $s0, 4($sp)
sw $s1, 8($sp)
move $s0, $a0 # Save args
move $s1, $a1
la $a0, _main_thread_name # Main thread setup
la $a1, xmain
li $a2, 0x20 # Priority
li $a3, 0x40000 # Stack size
lui $t0, 0x8000 # Attributes
jal sceKernelCreateThread
move $t1, $0
move $a0, $v0 # Start thread
move $a1, $s0
jal sceKernelStartThread
move $a2, $s1
lw $ra, 0($sp)
lw $s0, 4($sp)
lw $s1, 8($sp)
move $v0, $0
jr $ra
addiu $sp, 0x10
.
this just means were 1 step closer to the HEN.