How was PSP hacked? On first hand, how do people rip the binary out of PSP? I am just curious how all those hardware reverse engineering works.

P.S. Is there a PSP Custom firmware developer community around?

  • This blog seems to be by a group that hacked at least some consoles. Obviously, you need a lot of time, skill and resources to do this. Feb 12, 2015 at 16:15

2 Answers 2


I don't know the whole story but AFAIK the initial release of PSP did not use encryption or code signing, so a skilled person was able to make custom code run based off a game. This was used to explore and document the system and develop a customSDK. later firmware updates did implement encryption, but by this time hackers were able to debug code, so they could analyse the firmware update and extract the keys from it.


To answer the question, how did reverse engineers hack the psp?

Like this:

http://hackaday.com/2011/03/13/reverse-engineering-the-psp/ http://sec.pn.to/pw/?plugin=attach&pcmd=open&file=tapping.jpg&refer=Bases

First the reverse engineer rips the machine apart, and checks all of its components. Then he finds points of interaction. Perhaps the machine has a debugger port, like a JTAG. From there, the engineer attempts to circumvent any security which prevents him from dumping the firmware image. For this stage, researching the exact functionality of each hardware component is critical.

In the link I gave above, the engineer figures out how the NAND chips communicate by guessing various pin configurations. He then uses that knowledge to overwrite parts of memory, and observe the boot up process. Once you understand how the device's operating system boots, it is often possible to overwrite security protections which are selected during boot. Essentially force the device to boot into developer mode, where it may allow you to view sensitive information.

Usually the firmware image wont have source files. It will be a binary dump, which the reverse engineer may disassemble for further analysis. If you are lucky you will be able to dump a the entire file system, or the kernal the device is running.

Once the reverse engineer is possession of the firmware image, if it is the goal to recreate their own firmware, they may begin writing it based on the firmware image:

like this:


If you are interested in reverse engineering sony products:

Sony's game consoles are kind of unique in terms of computers. They are usually not set up like a typical x86 computer.

  • Cell was PS3; ps4 is practically off- the -shelf amd64 system with FreeBSD kernel. And even Cell was using PowerPC-based instruction set, which is not exactly obscure
    – Igor Skochinsky
    Feb 12, 2015 at 21:44
  • Fixed. Off by one error ;) Feb 12, 2015 at 23:08
  • Also, while the instruction set is not obscure, programmers have complained quite a bit about cell architecture being hard to use. It does introduce complexities that you have to understand. Feb 13, 2015 at 15:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.