GitHub - pcm720/dvrpwned: The first ever working custom firmware for the PSX DESR DVRP · GitHub
/" data-turbo-transient="true" />
Skip to content
Search/
Sign in<br>Sign upAppearance settings
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
pcm720
dvrpwned
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star<br>56
main
BranchesTags
Go to file
CodeOpen more actions menu
Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit
History<br>1 Commit<br>1 Commit
docs
docs
include
include
linker
linker
manifests
manifests
src
src
tools
tools
.gitignore
.gitignore
LICENSE
LICENSE
README.md
README.md
build.py
build.py
View all files
Repository files navigation
DVRPwned
The first ever working custom firmware for the PSX DESR DVRP.
This custom firmware bypasses the HDD ID security check that previously restricted PSX to only original Sony HDDs supporting proprietary commands or adapters that support the proprietary IDENTIFY command.
With the custom firmware, almost any HDD can be used with:
PSX1 (DESR-5000/5100/7000/7100) - firmware version 1.31
PSX2 (DESR-5500/5700/7500/7700) - firmware version 2.11
Credits
Brought to you by:
uyjulian - concept and bypass idea
Tunertom - DVRP checksum fixer script, exploit development and RE support
pcm720 - patching ideas, exploit development, patching toolkit and final implementation
DiscoStarslayer - FR60 Ghidra plugin and documentation
MonkeyBoyJoey - extensive testing, validation and risking his PSX1 and PSX2 units
GhostTownUS- - testing and moral support
PS2SDK developers - ps2atad implementation and SPEED register documentation, DESR reverse engineering
In Memoriam
One brave soul was lost in the fight for custom firmware.
While in the trenches, MonkeyBoyJoey's DESR-5000 lost its life.
Bricked to death. May it rest in pieces as a glorified PS2 Slim.
Nevermind, we fixed it two hours later.
How it works
The bypass concept was originally described by @uyjulian in his research gist
This implementation uses a GCC cross-compiler to compile C code into FR30 assembly, compatible with the FR60 architecture that the MB91302A is based on, and patches the DVRP firmware update file (.udm).
The patch:
Injects a custom HDD ID file to provide a valid HDD ID response in case the drive does not support it
Intercepts the sceAtaGetSceId function to ensure it always succeeds
Provides custom implementations of sceAtaExecCmd and sceAtaWaitResult for the DVRP ATA emulation task to always return a valid HDD ID to the PS2 side
Usage
Get the original DVRP_FIRMWARE.udm file for your PSX model and place it in the root of this repository as:
DVRP_FIRMWARE_131.udm — PSX1
DVRP_FIRMWARE_211.udm — PSX2
Build the fr30-elf toolchain in tools/gcc-fr30-elf/ by running:
./tools/build/build-toolchain.sh
Patch the firmware from a manifest:
python3 build.py manifests/sce_security_patch_131.json
The output is written to build/sce_security_patch_131.udm with correct checksums.
Use the DVRP flasher to flash the firmware
Available manifests
manifests/sce_security_patch_131.json - security check bypass for DVRP firmware version 1.31 (DESR-5000/5100/7000/7100)
manifests/sce_security_patch_211.json - security check bypass for DVRP firmware version 2.11 (DESR-5500/5700/7500/7700)
Project Structure
├── src/ # Payload sources (.c/.S)<br>├── include/ # C headers with firmware function references<br>├── manifests/ # JSON patch manifests for different firmware versions<br>├── linker/ # Linker scripts for different firmware versions<br>├── tools/<br>│ ├── scripts/ # Patching toolkit internals<br>│ │ ├── build-toolchain.sh<br>│ │ ├── build_payload.py<br>│ │ ├── patcher.py<br>│ │ └── fix_checksum.py<br>│ └── gcc-fr30-elf/ # Cross toolchain (built via the build-toolchain.sh script)<br>├── build/ # Build artifacts and output .udm files<br>├── docs/ # Technical documentation<br>│ ├── dvrp_dvr_speed_workaround.md # HDD authentication workaround details<br>│ └── hm91301CM71-10114-3E.pdf # MB91302A hardware manual<br>└── build.py # Main build script
Disclaimer
This is an experimental firmware modification. Use at your own risk.
About<br>The first ever working custom firmware for the PSX DESR DVRP<br>Resources<br>Readme<br>AFL-3.0 license<br>Activity<br>Stars<br>56 stars<br>Watchers<br>2 watching<br>Forks<br>4 forks<br>Report repository
Releases
Packages
Contributors
Languages
You can’t perform that action at this time.