Download Firmware 2.0 Eboot Loader v0.8.5

EBOOT loader v0.8.5  by Fanjita
  ===============================

Official Homepage: http://www.fanjita.org/psp.html
Official Forum:    http://forums.qj.net/forumdisplay.php?f=187

(based on excellent groundwork by Saotome)

NOTE : THIS PROGRAM ALLOWS YOU TO RUN HOMEBREW EBOOTs ON YOUR v2.0 PSP.
  IT CANNOT LOAD EBOOT.PBPs THAT CONTAIN FIRMWARE UPDATES.

This program builds on the work done by Saotome to load homebrew EBOOT.PBPs
into PSPs with v2.0 firmware, using the TIFF exploit.  It will not work
on any other firmware version - including v2.01.

It currently cannot run all known homebrew, but it uses a number of tricks
to get substantially further than ever before.  Known limitations are:

- Can't run kernel-mode applications.
  - That means anything that uses wi-fi or USB access, or emulates ISOs/UMDs.
- Some minor system calls are still unsupported.

It's also still very much in development, so you should expect a few bugs,
and for not every EBOOT to run perfectly.  A common problem is a load buzzing
noise when starting up some emulators, so you may want to play with your PSP
volume turned down.


To use:
-------

- Extract all the files into the root folder (e.g. "F:\") of your memory
  stick.  You need these files to be in the right place:
  \PSP\PHOTO\EBOOT Loader 085\RUN_L081.TIF
  \PSP\PHOTO\EBOOT Loader 085\AAA.GIF
  \UTILS\EBOOT_SIGNATURE.EXE
  \PSP\GAME\LOADER085.CFG
  \PSP\GAME\LOADMENU085.PBP
  \PSP\GAME\LOADMENU.TGA
  \L_085.BIN

- Copy the homebrew you want to run to your memory stick.  Usually, this
  means unzipping a directory that contains an EBOOT.PBP file to somewhere
  under \PSP\GAME\.  The exact location and folder name usually doesn't matter,
  but for best compatibility you should try to use the same names as
  originally shown in the homebrew ZIP file.

  If the instructions with the homebrew contain separate steps for v1.0 and
  v1.5 firmwares, then usually you'll get best results by following the
  v1.0 instructions.

  NOTE: If the homebrew is written in LUA, you need to copy it to a subdirectory
  under the \PSP\GAME\USER_LUA\APPLICATIONS folder.

- Make sure you have a custom wallpaper set.  Any image will do.

- Use the PSP's built-in photo viewer to open the "EBOOT loader 085" folder,
  this will cause the loader to start.  If your PSP hangs at this point,
  then try the following:
  - check your firmware version.  This loader is for v2.0 ONLY.
  - check that you have the loader files in the correct place (see above)
  - turn your PSP completely off, then back on again.  The loader works
  best on a freshly-rebooted PSP.
  - try setting a custom background - some people have reported that it
  works better if you use a custom wallpaper (any image).
  - try 'touching' the TIF image file : see 'fixing up the file times'
  below.

- The loader displays a list of files in \PSP\GAME.  Use the up and down
  buttons to change the current selection (highlighted in red), and X to
  open an EBOOT.PBP file or browse into a folder.

  NOTE: To load LUA applications, you need to run the EBOOT.PBP that is in
  the \PSP\GAME\USER_LUA folder, which will launch Lowser and let you
  browse to open the application.

- Once you select an EBOOT.PBP to load, after a few moments, the loader
  will either display an error message, or give you the option to run
  the application.

- To exit the application, you need to reboot your PSP.  
  The loader contains in-built support for rebooting, by holding the
  Left Trigger, Right Trigger and START buttons together for 1 second.
  If this doesn't work, then you can also reboot by removing the battery,
  or holding the power switch for at least 10 seconds.
  Note that sometimes after a software reboot, the loader will hang if you
  try to run it again.  This seems to be much rarer if you enter USB mode
  briefly, before running the loader again.


Using multiple versions of EBOOT loader
---------------------------------------

Occasionally, some EBOOTs work better with older versions of the loader.
In v0.8.5, it looks like TerraIncognita is broken, but this works fine on 0.7.
Also, LUA can be very unpredictable, working in some loader versions for some
people, and other versions for others.

From 0.8 onwards, the loader uses version numbers in the filenames, so that
you can run multiple versions side-by-side.

After installing v0.8.5, you can continue to use any previously-installed
versions of the loader, if you have problems with your favourite EBOOTs.


Troubleshooting
---------------

If you have problems with an individual EBOOT getting to the "Press X to
launch the program" screen, but crashing immediately after, here are a
few things to try:

- Check whether it is already on the list of non-working EBOOTs below.
- Make sure you are trying to run it as the first thing you do after a
  clean reboot of your PSP
- Use v1.0 EBOOTs in preference to v1.5.
- Make sure that you read any README supplied with the homebrew, and followed
  the installation instructions (for v1.0, preferably) carefully.
- Make sure that any support files (e.g. WAV files, graphics files)
  contained in the ZIP file are copied into the same place on the memory stick,
  relative to the EBOOT file.
- Experiment with the launcher options in the configuration file. (see below)
- Check the forums at pspupdates.com - someone might already have found a
  way to make this EBOOT work.
- When starting the EBOOT loader, try pressing the "down" button very quickly
  immediately after pressing "X" to open the 'EBOOT loader' photo folder.
  This can help the stability of some apps.
- If you see a message during the loading process, saying
  "Found suspicious hard path", then this means the loader detected that
  the application depends upon being in a specific location on the
  memory stick.  Usually the path will mention a specific file - try moving the
  application folder so that the file is in the place shown.

If you find that one of these steps helps, then please send me details
on what you did to make the EBOOT work - I can build the workarounds
automatically into the next version of the loader.

NOTE: If the EBOOT loader aborted the process before reaching the "press X"
screen, then don't bother trying these steps - there's no way that EBOOT
will currently work, but please remember to send the details of the error
message to me, so that I can attempt to change the code to make it work.


Fixing up the file times:
-------------------------

If you have problems with the PSP freezing as soon as you open the PHOTO
folder, or even if it just starts the EBOOT loader as soon as you open the
PHOTO folder, and you want to be able to view photos normally, then you can
use the enclosed TOUCH.EXE file to help out:

- Copy touch.exe to the \psp\photo\ folder on your memory stick.

- Open a windows command prompt (click "Start", "Run...", and enter "cmd"
in the box that comes up).

- In the command prompt, enter these commands:
  >   F:                   (replace 'F' with the drive letter of your memory stick)
  >   cd "\psp\photo\eboot loader"
  >   ..\touch run_l.tif
  >   cd "\psp\photo\eboot loader 03"
  >   ..\touch run_lalt.tif


Configuration File:
-------------------
v0.8.5 and beyond of the loader support configuration via a file, LOADER.CFG.
See inside the file for basic details on what the various options do.  For most
purposes, the defaults should be sufficient.

If you want to try to tweak the options for a specific EBOOT, here are some
pointers:

- Each EBOOT has a special signature that identifies it to the EBOOT loader.
  To find out the signature, use the bundled Windows program
  "EBOOT_SIGNATURE.EXE". This will tell you the name you need to use for the
  config file section header for the EBOOT.

- The following options are the most common ones to change to make a specific
  EBOOT work.  Often, changing one of these (more-or-less at random) will fix
  the more sensitive EBOOTs such as USER_LUA.  Try changing these one at a time,
  in this order, for best results.

  - passparameters    : this is the same as the old 'press Square for
  alternate parameters' option.
  - confirm        
  - callinit          : this is the same as the old 'press L-Trigger' option
  - clearscreen
  - initbssfull
  - initbsspartial

- If you want to suppress screen-spam during loading of a known-good EBOOT,
  you can try changing these options.  You may find that the EBOOT stops
  working after changing an option - if so, just change it back.

  - confirm            : displays the 'press X to start' menu
  - unknownNIDwarning  : warns you if some system calls requested by the
  EBOOT couldn't be identified.
  - patchkernelwarning : warns you if the EBOOT is kernel-mode. For some
  EBOOTs, this doesn't matter.
  - ignorefixedpath    : warns you if the EBOOT contains a suspicious-
  looking filename, that implies it might need to be
  run from a fixed location on the memory stick.

If you find some new configuration parameters that work well for a specific
EBOOT, please email me at fanjita@fanjita.org, or make a post on the EBOOT
loader forums at pspupdates.com.


Future plans:
-------------

- Improve compatibility
- Add wi-fi support - this seems to be possible without kernel-mode.
- Allow loading of EBOOTs from ZIPs


Compatibility Status:
---------------------

The list of known working applications is now kept up-to-date online, at
http://www.fanjita.o...p_working.html.

New Working applications in this release:
  - SNES9xTYL 0.2c
  - TCGS Car
  - ASTC (Another Silly Tetris Clone)
  - Moppi's Flower Demo
  - Tail Tale
  - Scrabble Assistant - loads but hangs?
  - PSP Revolution
  - Heretic PSP
  - SMS plus 1.2
  - Crystallise 1.0
  - Binary Clock
  - A-Blit demo

EBOOTs known to have gone from working to broken with this release, compared
  to v0.7:
  - Terra Incognita (might occasionally work)
  - User_Lua can be inconsistent - I suggest experimenting to find a
  combination of loader version that works for you - 0.7 seems best.
  - CNReader 2.0 may be broken

EBOOTs with partial progress made in this release:
  - Various kernel mode apps

Please let me know if you test and can confirm compatibility of other EBOOTs.

If you find an EBOOT that doesn't work, then please email me at

  fanjita@fanjita.org
  
  with details of:
  - the name of the EBOOT that failed, and where to get it from
  - the last message that was displayed on the PSP screen
  - your firmware version, and PSP region (US, EU, JP).

NOTE: Kernel-mode support is currently not possible on v2.0 firmware, until
someone finds a way to access the kernel memory space.


Acknowledgements:
-----------------
  
  This app wouldn't have been possible without the toc2rta TIFF exploit code,
or Saotome's hard work on the first beta EBOOT loader, or the support of
the fantastic folks at the ps2dev.org forums (especially Groepaz's list
of NID -> syscall mappings, and Vampyre's continuing efforts to expand that
list).

  Thanks to Calum for his customised front-end menu.  If you want to know
how to produce a customised menu, email me at fanjita@fanjita.org.  Note that
you can change the artwork by replacing /psp/game/loadmenu.tga with another
24-bit uncompressed TGA file, resolution 480x272 pixels.

  Thanks also to the many beta testers for their hard work beta testing, as
well as many other individual email contributions with information on which
EBOOTs are working.

  If you have found this program useful and want to encourage further
development, please consider donating a small amount via paypal to
fanjita@fanjita.org.  To be able to work effectively on it, I need to
buy a second PSP (to understand the v1.5 environment more fully) and more
memory stick storage for testing.  As little as a $1 donation would be
enormously helpful.  Thanks.

Change history:
---------------
  v0.8.5 : Flexibility, compatibility
  - Introduce configuration file, to allow tweaking of EBOOTs by end-users.
  See loadmenu.cfg for details.
  - Improved kernel-mode override patching logic.
  - Attempt to kill surplus system threads, for stability.
  - Run loader from reserved memory for increased stability.
  - Tidied up some memory reuse in ELF section header handling
  - Bundled graphical menu now filters to only display the names of
  EBOOTs for selection - all the surplus fluff is hidden.  Also now
  handles v1.5 homebrew directory structure.
  - Added option to allow L+R+START reset to go back to loader menu,
  rather than main menu

  v0.8 : Usability, compatibility
  - Added capability to reboot the PSP without holding the power button.
  During any EBOOT, just hold Left Trigger, Right Trigger and START
  buttons for 1 second to exit the loader and reboot back to the PSP
  menu.
  - Separated menu binary from loader binary, to allow custom menu creation.
  Included custom menu by Calum.
  - Added kernel-mode override facility - allows the loader to attempt
  to load apps marked as kernel-mode, that don't really require
  kernel access.  This doesn't enable a huge number of apps, but it
  does enable a few - e.g. ScummVM 0.5, PSPChess, Nethack.  Expect more
  progress in the future.
  - Relax requirement to resolve all NIDs.  Now you can choose to ignore
  failed NIDs in the hope that they aren't required.
  - Improved USER_LUA stability (by incorporating the 0.7 USER_LUA patch)
  - Added PowerTick() call to prevent display dimming during play
  - Skip calling .init code by default
  - Allow easier co-existence of multiple loader versions.
  - Improve memory and thread manager semaphoring.
  - Added all remaining VSH-mode NIDs, thanks to Vampyre's work.
  - Moved working EBOOT list to new web-page.
  - Filled in some missing opcodes from the disassembler
  - Added syscall dereferencing to disassembler
  - Added hook to sceKernelCreateThread, to improve thread monitoring
  - Reduced screen spam during loading, by moving it to debug-only build
  - Attempt to load more of the ELF sections into RAM if appropriate
  - Retired hokey malloc implementation during file load, use proper
  memory blocks now.

  v0.7 : Compatibility, usability
  - Implement simple internal memory manager, hooked onto firmware memory
  management, to boost memory pool available to applications.
  - Hook thread allocation and exit, to allow for clean return to the
  loader from applications that support an Exit option.
  - Improve code signature algorithm to distinguish between similar EBOOTs
  (fixes mis-identification of Casino Addict as SMS emulator).
  - Added overclocking option : use left and right trigger buttons when
  choosing file to change CPU speed.
  - Add NID resolution for Sircs function : enables PSP IR Remote function.
  - Add USB stubs to user-mode LUA, and better debug info in case of script
  errors.
  - Added left and right DPAD support in file-chooser, to go to the start
  and end of the list
  - Now supports more than 20 files in a directory
  - Found pathname hack to run PSP Rhythm Composer.
  - Improved cache flushing, should improve reliability
  - Added safeguard to prevent PSPSet from being run and bricking 2.0.

  v0.6 : Compatibility and stability
  - bundle user-mode LUA player.
  - only process stringtable section header and .reginfo, all others are unused.
  - setup $gp register from .reginfo
  - change folder thumbnail to smaller image, improves launch stability.
  - added scan for EBOOTs with hard-coded paths.
  - clear display RAM before starting some EBOOTs, to clear up some
  graphical anomalies.
  - added direct seek to ELF header - much much faster file loading.

  v0.5 : More compatibility enhancements, bug fixes
  - Better argc/argv handling, prevents a common cause of startup
  crashes (e.g. PSP Schedule).
  - Made the 'return to chooser' function more stable.  It now shouldn't
  affect how well the next EBOOT loads.
  - Improved file scanning speed - large EBOOTs should load much faster.
  - Added 'alternate startup parameters', use this to run Sega Master System
  emulator which was broken in v0.4.
  - Introduced 'EBOOT signatures' : known workarounds for specific
  EBOOTs should now be turned on automatically, and install
  location can be automatically checked if a specific path is
  required.
  - Added support for .init sections, should help avoid a few more
  startup crashes.
  - Added option to return to EBOOT chooser on final confirmation menu.
  - Version number shown on screen fixed.
  - Lots more info in readme file.
  - Various minor bugfixes.

  v0.4 : Usability & reliability enhancements
  - Return to menu if possible after failed load.  NOTE : this is
  a bit flaky, and mainly designed for quick checks for kernel-mode
  apps, etc.  If something crashes after you ran through a few EBOOTs
  that wouldn't load, it's worth retrying it immediately after a
  reboot.
  - Experimented with exception handlers for extra diagnostics, but this
  is not possible in user-mode (and anyway the appropriate syscall code is
  unknown for v2.0).
  - Fixed overflow with more than 19 directory entries - now apps that
  failed just after EBOOT selection will get further.
  - Added set up of argv, argc to supply path arguments - helps for
  Ghost In The Matrix, possibly others.
  - Changed load address to 0x0860000, to allow more headroom for increased
  loader complexity.  Also begun integrating Abu's loader code with the
  TIF file.

  v0.3 : Compatibility enhancements
  - Allow browsing of multiple EBOOTs
  - Change directory to selected EBOOT location
  (adds sounds to Attack of the Mutants)
  - Restore screen mode before running EBOOT
  (improves reliability)
  - Allow multiple text segments in ELF

  v0.2 : Original version, ported to C from original v0.1 EBOOT loader by
  Saotome.