PSP Homebrew and Hacking Pages

Wipeout Pure:
The Hidden Web Browser

A little precursor:
I was not the first person to successfully do this, nor do I claim to be. I am on the other hand one of the only ones willing to share everything I know. This is why this page is here. The more people we have working on things like this the quicker we can reach our goal (homebrew). Every little bit helps...right?

Summary:

As far as I can figure out, its NOT part of the firmware...But this can be made into a general purpose browser if you create a portal-like site to jumps to links. When you select "Go to home page" it returns you to the portal site (index.html). So thats an easy way out.

Yes you can use input (we googled stuff), when you enter a textbox and press X the PSP pops up the Keyboard API (remember there's alot of API to be taken advantage of with the PSP). After that its as simple as any other input on the PSP.

The way I loaded up my own "page" is by setting up my FreeBSD machine with some DNS entries that point ingame.scea.com and webcluster.scea.com and all NS's for scea.com to my internal LAN machine. So then I changed the PSP's NameServer settings to point to the server on my local LAN (FreeBSD machine). When the Wipeout client accesses http://ingame.scea.com/wipeout/index.html it gets my LOCAL file because of the DNS mapping.
It's all pretty simple after that. I made a static page with a bunch of spring-board (or portal-like I guess) links to access from the PSP.

Browsing is simple enough, up and down to move from link to link. D-Pad only though. Also there is no cursor anywhere, and no title-bars. If there is no link in the nearest vicinity, the PSP just scrolls the page (awesome). Entering links is X, refresh page is []. Again entering text into boxes pops up the API.

JavaScript works (Again API for Alert boxes, NEAT feature), Java is yet to be tested. Frames don't work. Large pictures are to be tested too. Uhm I think thats it for now. Most of HTML works (no H1's and stuff). Background colors and pics etc work fine.

Info:
Once the network connection is established and the PSP gets an IP, it sends a request (specifically a GET for US_holding_page.jpg from http://ingame.scea.com/wipeout/index.html?serviceId=wipeoutpure_ingamesupport_main&
hostId=ucus98612_wipeoutpure_psp_umd_1
&hostLanguage=en&pspId=<REMOVED>&skin=Default) to http://ingame.scea.com/wipeout/index.html using User Agent "SCEJ PSP BROWSER 0102pspNavigator", its Wipeout's webbrowser but it looks as if it's a Sony (Sony Computer Entertainment Japan) piece of code, so this might be a standard browser we'll be seeing. PHP rendering works great, I browsed phpinfo(); and there's not much in there to gush about. Since there are no links on that page, the browser lets you scroll up, down, left and right freely.

As Awhite (Ioannis KarAvas) suggested, I gave Opera and The Proxomitron a try. Set the USER AGENT and bingo,we spoof the PSP browser:

Heh...what do we have here? Nothing but Wipeout.

pdc^ thought up of an idea to use a proxy for Wipeout's web browsing. Now to set up a proxy and change it's requests...

What works and doesn't:
A nice chat session in #pspdev brought about these results:

Dialog box input works (eg google search) (fires up PSP's Keyboard API)

JavaScript works, with Alert's and \n newlines and stuff (thanks MomDad) (again, API for MSG boxes [alerts])

Frames don't work.
Tags like H1/H2 don't work.
To be tested:

Straight up Java.
Large images.
ftp:// (pdc^)
file upload website (opens up file selection dialog, thanks again pdc^)

--------------------------------------------------------------------------------

Older stuff:

Wipeout Pure's "Download" section is a full-featured WEB BROWSER! Here's proof:

Here's what you'd typically see if accessing that option from the PSP (I snarfed this image while packet sniffing):
BTW, you can't access the URL that this browser seeks directly using any kind of PC browser.

Here's me browsing my own stupid quickly created page:

Proof by roto/mozy (Again, I'm NOT the first person to do this. I am one of the first to spread the wealth though.)

Full writeup of how I did this is coming soon...lets just say it involved FreeBSD, BIND, and a LOT of packet sniffing and rebuilding...those of you that understand that already know how I did what I did. It was easy once I figured out what the Wipeout browser was seeking (/wipeout/US_holding_page.jpg). Basically I sniffed the packets that the browser was seding out and receiving. I then fired up my own DNS/HTTP servers and redirected the PSP's access to my data. I changed the PSP's default nameservers to the one on my LAN. Etc, etc.

Forgive me for the sucktacular HTML and ugly pics/etc...it's 3am and I wanted to finish this up today.

Small (10mb, 3min) video of this stuff in action: http://mozy.org/psp/psp_haxxed_by_roto-xvid.avi
Find me in #pspdev @ EFnet.

Thanks to (in NO order at all):

Awhite (Ioannis KarAvas)
pdc^
ooPo
MomDad
DarkFader
FuMan
omlette
RtiGHeR
LudaCris
TrAcER_
psdo
elz
amptor
SupAshaD
masta
warren...
And anyone else I might have forgotten (mirror people/etc, sorry! you know i'm thankful)

--------------------------------------------------------------------------------

Created by roto/mozy

03/26/05 - 2am