EBOOT loader v0.9 by Fanjita
=============================

Official Homepage: http://www.fanjita.org/psp.html
Official Forum: http://forums.qj.net/forumdisplay.php?f=187

(based on excellent groundwork by Saotome)

NOTE : THIS PROGRAM ALLOWS YOU TO RUN HOMEBREW EBOOTs ON YOUR v2.0 PSP.
IT CANNOT LOAD EBOOT.PBPs THAT CONTAIN FIRMWARE UPDATES.

This program builds on the work done by Saotome to load homebrew EBOOT.PBPs
into PSPs with v2.0 firmware, using the TIFF exploit. It will not work
on any other firmware version - including v2.01.

It currently cannot run all known homebrew, but it uses a number of tricks
to get substantially further than ever before. Known limitations are:

- Can't run kernel-mode applications.
- That means anything that uses wi-fi or USB access, or emulates ISOs/UMDs.
- Some minor system calls are still unsupported.

It's also still very much in development, so you should expect a few bugs,
and for not every EBOOT to run perfectly. A common problem is a load buzzing
noise when starting up some emulators, so you may want to play with your PSP
volume turned down.


To use:
-------

- Extract all the files into the root folder (e.g. "F:") of your memory
stick. You need these files to be in the right place:
PSPPHOTOEBOOT Loader 09RUN_L09.TIF
PSPPHOTOEBOOT Loader 09AAA.GIF
PSPPHOTOWIFIBACKGROUND.PNG
PSPPHOTOWIFI LoaderREADY.PNG
PSPPHOTOWIFI LoaderLOADER2.TIFF
UTILSEBOOT_SIGNATURE.EXE
PSPGAMELOADER09.CFG
PSPGAMELOADMENU09.PBP
PSPGAMELOADMENU.TGA
L_09.BIN
A.BIN
TSR.BIN

- Copy the homebrew you want to run to your memory stick. Usually, this
means unzipping a directory that contains an EBOOT.PBP file to somewhere
under PSPGAME. The exact location and folder name usually doesn't matter,
but for best compatibility you should try to use the same names as
originally shown in the homebrew ZIP file.

If the instructions with the homebrew contain separate steps for v1.0 and
v1.5 firmwares, then usually you'll get best results by following the
v1.0 instructions.

NOTE: If the homebrew is written in LUA, you need to copy it to a subdirectory
under the PSPGAMEUSER_LUAAPPLICATIONS folder.

- Make sure you have a custom wallpaper set. Any image will do.

- Use the PSP's built-in photo viewer to open the "EBOOT loader 09" folder,
this will cause the loader to start. If your PSP hangs at this point,
then try the following:
- check your firmware version. This loader is for v2.0 ONLY.
- check that you have the loader files in the correct place (see above)
- turn your PSP completely off, then back on again. The loader works
best on a freshly-rebooted PSP.
- try setting a custom background - some people have reported that it
works better if you use a custom wallpaper (any image).
- try 'touching' the TIF image file : see 'fixing up the file times'
below.

- The loader displays a list of files in PSPGAME. Use the up and down
buttons to change the current selection (highlighted in red), and X to
open an EBOOT.PBP file or browse into a folder.

NOTE: To load LUA applications, you need to run the EBOOT.PBP that is in
the PSPGAMEUSER_LUA folder, which will launch Lowser and let you
browse to open the application.

- Once you select an EBOOT.PBP to load, after a few moments, the loader
will either display an error message, or give you the option to run
the application.

- To exit the application, you need to reboot your PSP.
The loader contains in-built support for rebooting, by holding the
Left Trigger, Right Trigger and START buttons together for 1 second.
If this doesn't work, then you can also reboot by removing the battery,
or holding the power switch for at least 10 seconds.
Note that sometimes after a software reboot, the loader will hang if you
try to run it again. This seems to be much rarer if you enter USB mode
briefly, before running the loader again.


Using multiple versions of EBOOT loader
---------------------------------------

Occasionally, some EBOOTs work better with older versions of the loader.
In v0.8.5, it looks like TerraIncognita is broken, but this works fine on 0.7.
Also, LUA can be very unpredictable, working in some loader versions for some
people, and other versions for others.

From 0.8 onwards, the loader uses version numbers in the filenames, so that
you can run multiple versions side-by-side.

After installing v0.9, you can continue to use any previously-installed
versions of the loader, if you have problems with your favourite EBOOTs.


Using the EBOOT loader to run wifi applications
-----------------------------------------------

Because Wifi applications normally need kernel-mode to operate, you need to use
a special workaround to load them with the EBOOT loader. You need to have
set up a working wifi connection in the usual way before you can use wifi
homebrew - if you can use the v2.0 web browser, then you're set.

- Go to the PHOTO menu on your PSP, open the 'wifibackground.png' file, and
set it as your PSP's wallpaper.

- Completely reboot your PSP, by holding the power button for 10 seconds
until it powers off. Then switch it back on again.

- Go straight to the PHOTO menu, and open the 'Wifi Loader' folder.

- You'll see an image that says 'wifi loader ready', plus another that says
'Corrupted Data'. If your PSP hasn't frozen at this point, then the
wifi loader has been successfully started, as a background process.

- Now exit the PHOTO menu, and go all the way to the left, and then the
bottom, to the 'Network Settings' menu.

- Select this menu to get a choice of 'Ad Hoc' or 'Infrastructure'. Choose
'Infrastructure'.

- Select the connection to use. Note that you won't be able to select a
different connection within the homebrew (any change of connection is
ignored by the EBOOT loader), so highlight the appropriate one now.

- Press Triangle for connection options, and select 'Test Connection'

- The wifi light should come on, and your PSP connects to the network.

- Once the statistics for the connection are shown, the connection is
stable and ready to use. Now press and hold LTrigger+RTrigger+SELECT
for a few seconds. The screen will flicker for a moment, and then the
EBOOT loader menu will start.

- Now the EBOOT loader is ready to use, with full wi-fi support.


Using a different menu
----------------------

v0.9 of the loader ships with 2 alternative menus:

- loadmenu09.pbp is like the menu in previous versions, but with the
addition of support for program icons.

- loadmenu09sort.pbp is similar, but displays the list of programs in an
alphabetically-sorted, single list.

You can also download a third optional menu, called 'Choice', from this location:

http://www.xart.co.uk/downloads/choice.php

The loader will use the loadmenu09.pbp menu by default. If you want to use
one of the alternatives, then edit the loadmenu09.cfg file (with Notepad, or
any other text editor), and change the following line:

menu=ms0:/psp/game/loadmenu09.pbp

to

menu=ms0:/psp/game/loadmenu09sort.pbp

or

menu=ms0:/psp/photo/choice/choice.pbp (or wherever you placed Choice, if
it is in a different location).


Troubleshooting
---------------

If you have problems with an individual EBOOT getting to the "Press X to
launch the program" screen, but crashing immediately after, here are a
few things to try:

- Check whether it is already on the list of non-working EBOOTs below.
- Make sure you are trying to run it as the first thing you do after a
clean reboot of your PSP
- Use v1.0 EBOOTs in preference to v1.5.
- Make sure that you read any README supplied with the homebrew, and followed
the installation instructions (for v1.0, preferably) carefully.
- Make sure that any support files (e.g. WAV files, graphics files)
contained in the ZIP file are copied into the same place on the memory stick,
relative to the EBOOT file.
- Experiment with the launcher options in the configuration file. (see below)
- Check the forums at pspupdates.com - someone might already have found a
way to make this EBOOT work.
- When starting the EBOOT loader, try pressing the "down" button very quickly
immediately after pressing "X" to open the 'EBOOT loader' photo folder.
This can help the stability of some apps.
- If you see a message during the loading process, saying
"Found suspicious hard path", then this means the loader detected that
the application depends upon being in a specific location on the
memory stick. Usually the path will mention a specific file - try moving the
application folder so that the file is in the place shown.

If you find that one of these steps helps, then please send me details
on what you did to make the EBOOT work - I can build the workarounds
automatically into the next version of the loader.

NOTE: If the EBOOT loader aborted the process before reaching the "press X"
screen, then don't bother trying these steps - there's no way that EBOOT
will currently work, but please remember to send the details of the error
message to me, so that I can attempt to change the code to make it work.


Fixing up the file times:
-------------------------

If you have problems with the PSP freezing as soon as you open the PHOTO
folder, or even if it just starts the EBOOT loader as soon as you open the
PHOTO folder, and you want to be able to view photos normally, then you can
use the enclosed TOUCH.EXE file to help out:

- Copy touch.exe to the pspphoto folder on your memory stick.

- Open a windows command prompt (click "Start", "Run...", and enter "cmd"
in the box that comes up).

- In the command prompt, enter these commands:
> F: (replace 'F' with the drive letter of your memory stick)
> cd "pspphotoeboot loader"
> ..touch run_l.tif
> cd "pspphotoeboot loader 03"
> ..touch run_lalt.tif


Configuration File:
-------------------
v0.8.5 and beyond of the loader support configuration via a file, LOADER09.CFG.
See inside the file for basic details on what the various options do. For most
purposes, the defaults should be sufficient.

If you want to try to tweak the options for a specific EBOOT, here are some
pointers:

- Each EBOOT has a special signature that identifies it to the EBOOT loader.
To find out the signature, use the bundled Windows program
"EBOOT_SIGNATURE.EXE". This will tell you the name you need to use for the
config file section header for the EBOOT.

- The following options are the most common ones to change to make a specific
EBOOT work. Often, changing one of these (more-or-less at random) will fix
the more sensitive EBOOTs such as USER_LUA. Try changing these one at a time,
in this order, for best results.

- passparameters : this is the same as the old 'press Square for
alternate parameters' option.
- confirm
- callinit : this is the same as the old 'press L-Trigger' option
- clearscreen
- initbssfull
- initbsspartial

- If you want to suppress screen-spam during loading of a known-good EBOOT,
you can try changing these options. You may find that the EBOOT stops
working after changing an option - if so, just change it back.

- confirm : displays the 'press X to start' menu
- unknownNIDwarning : warns you if some system calls requested by the
EBOOT couldn't be identified.
- patchkernelwarning : warns you if the EBOOT is kernel-mode. For some
EBOOTs, this doesn't matter.
- ignorefixedpath : warns you if the EBOOT contains a suspicious-
looking filename, that implies it might need to be
run from a fixed location on the memory stick.

If you find some new configuration parameters that work well for a specific
EBOOT, please email me at fanjita@fanjita.org, or make a post on the EBOOT
loader forums at pspupdates.com.


Future plans:
-------------

- Improve compatibility
- Add wi-fi support - this seems to be possible without kernel-mode.
- Allow loading of EBOOTs from ZIPs


Compatibility Status:
---------------------

The list of known working applications is now kept up-to-date online, at
http://www.fanjita.org/psp_working.html.

New Working applications in this release:
- File Assistant v0.4 (was broken in releases 0.8 - 0.8.5)
- Terra Incognita (working again, was broken from 0.8 - 0.8.5)
- PSPPet's Wifi Sample .03
- Peldet 0.7
- LUA Player 0.14
- 2ch Browser Test 0.13
- PSPPOP v0.6
- Future wifi apps using the new PSPSDK wifi support should work fine

EBOOTs known to have gone from working to broken with this release, compared
to v0.7:
- CNReader 2.0 may be broken

EBOOTs with partial progress made in this release:
- Various kernel mode apps
- Various wifi apps:
PVNC
PSPRadio
Wifi Jukebox
PSP Weather


Please let me know if you test and can confirm compatibility of other EBOOTs.

If you find an EBOOT that doesn't work, then please email me at

fanjita@fanjita.org

with details of:
- the name of the EBOOT that failed, and where to get it from
- the last message that was displayed on the PSP screen
- your firmware version, and PSP region (US, EU, JP).

NOTE: Kernel-mode support is currently not possible on v2.0 firmware, until
someone finds a way to access the kernel memory space.


Acknowledgements:
-----------------

This app wouldn't have been possible without the toc2rta TIFF exploit code,
or Saotome's hard work on the first beta EBOOT loader, or the support of
the fantastic folks at the ps2dev.org forums (especially Groepaz's list
of NID -> syscall mappings, and Vampyre's continuing efforts to expand that
list).

Thanks to Calum for his customised front-end menu. If you want to know
how to produce a customised menu, email me at fanjita@fanjita.org. Note that
you can change the artwork by replacing /psp/game/loadmenu.tga with another
24-bit uncompressed TGA file, resolution 480x272 pixels.

Thanks also to the many beta testers for their hard work beta testing, as
well as many other individual email contributions with information on which
EBOOTs are working.

If you have found this program useful and want to encourage further
development, please consider donating a small amount via paypal to
fanjita@fanjita.org. To be able to work effectively on it, I need to
buy a second PSP (to understand the v1.5 environment more fully) and more
memory stick storage for testing. As little as a donation would be
enormously helpful. Thanks.

Change history:
---------------
v0.9 : Wifi support, stability
- Added wifi support! Now the loader auto-detects if the wifi libraries
are loaded (via the wifi load method above) and offers them to homebrew
for use.
- Added call to application exit callback, to allow RIN etc. to save state
when L+R+START reset is used.
- Added memory reset after running the menu. This should make things
much less sensitive to whatever has been run before them. Can be
turned off in config.
- Added memory reset on exit - this might make it easier to restart the
loader.
- Added config option to fake success code from unknown functions
- Added clock-speed option to the config file, to allow automatic
overclocking / underclocking of applications.

v0.8.5 : Flexibility, compatibility
- Introduce configuration file, to allow tweaking of EBOOTs by end-users.
See loader085.cfg for details.
- Improved kernel-mode override patching logic.
- Attempt to kill surplus system threads, for stability.
- Run loader from reserved memory for increased stability.
- Tidied up some memory reuse in ELF section header handling
- Bundled graphical menu now filters to only display the names of
EBOOTs for selection - all the surplus fluff is hidden. Also now
handles v1.5 homebrew directory structure.
- Added option to allow L+R+START reset to go back to loader menu,
rather than main menu

v0.8 : Usability, compatibility
- Added capability to reboot the PSP without holding the power button.
During any EBOOT, just hold Left Trigger, Right Trigger and START
buttons for 1 second to exit the loader and reboot back to the PSP
menu.
- Separated menu binary from loader binary, to allow custom menu creation.
Included custom menu by Calum.
- Added kernel-mode override facility - allows the loader to attempt
to load apps marked as kernel-mode, that don't really require
kernel access. This doesn't enable a huge number of apps, but it
does enable a few - e.g. ScummVM 0.5, PSPChess, Nethack. Expect more
progress in the future.
- Relax requirement to resolve all NIDs. Now you can choose to ignore
failed NIDs in the hope that they aren't required.
- Improved USER_LUA stability (by incorporating the 0.7 USER_LUA patch)
- Added PowerTick() call to prevent display dimming during play
- Skip calling .init code by default
- Allow easier co-existence of multiple loader versions.
- Improve memory and thread manager semaphoring.
- Added all remaining VSH-mode NIDs, thanks to Vampyre's work.
- Moved working EBOOT list to new web-page.
- Filled in some missing opcodes from the disassembler
- Added syscall dereferencing to disassembler
- Added hook to sceKernelCreateThread, to improve thread monitoring
- Reduced screen spam during loading, by moving it to debug-only build
- Attempt to load more of the ELF sections into RAM if appropriate
- Retired hokey malloc implementation during file load, use proper
memory blocks now.

v0.7 : Compatibility, usability
- Implement simple internal memory manager, hooked onto firmware memory
management, to boost memory pool available to applications.
- Hook thread allocation and exit, to allow for clean return to the
loader from applications that support an Exit option.
- Improve code signature algorithm to distinguish between similar EBOOTs
(fixes mis-identification of Casino Addict as SMS emulator).
- Added overclocking option : use left and right trigger buttons when
choosing file to change CPU speed.
- Add NID resolution for Sircs function : enables PSP IR Remote function.
- Add USB stubs to user-mode LUA, and better debug info in case of script
errors.
- Added left and right DPAD support in file-chooser, to go to the start
and end of the list
- Now supports more than 20 files in a directory
- Found pathname hack to run PSP Rhythm Composer.
- Improved cache flushing, should improve reliability
- Added safeguard to prevent PSPSet from being run and bricking 2.0.

v0.6 : Compatibility and stability
- bundle user-mode LUA player.
- only process stringtable section header and .reginfo, all others are unused.
- setup $gp register from .reginfo
- change folder thumbnail to smaller image, improves launch stability.
- added scan for EBOOTs with hard-coded paths.
- clear display RAM before starting some EBOOTs, to clear up some
graphical anomalies.
- added direct seek to ELF header - much much faster file loading.

v0.5 : More compatibility enhancements, bug fixes
- Better argc/argv handling, prevents a common cause of startup
crashes (e.g. PSP Schedule).
- Made the 'return to chooser' function more stable. It now shouldn't
affect how well the next EBOOT loads.
- Improved file scanning speed - large EBOOTs should load much faster.
- Added 'alternate startup parameters', use this to run Sega Master System
emulator which was broken in v0.4.
- Introduced 'EBOOT signatures' : known workarounds for specific
EBOOTs should now be turned on automatically, and install
location can be automatically checked if a specific path is
required.
- Added support for .init sections, should help avoid a few more
startup crashes.
- Added option to return to EBOOT chooser on final confirmation menu.
- Version number shown on screen fixed.
- Lots more info in readme file.
- Various minor bugfixes.

v0.4 : Usability & reliability enhancements
- Return to menu if possible after failed load. NOTE : this is
a bit flaky, and mainly designed for quick checks for kernel-mode
apps, etc. If something crashes after you ran through a few EBOOTs
that wouldn't load, it's worth retrying it immediately after a
reboot.
- Experimented with exception handlers for extra diagnostics, but this
is not possible in user-mode (and anyway the appropriate syscall code is
unknown for v2.0).
- Fixed overflow with more than 19 directory entries - now apps that
failed just after EBOOT selection will get further.
- Added set up of argv, argc to supply path arguments - helps for
Ghost In The Matrix, possibly others.
- Changed load address to 0x0860000, to allow more headroom for increased
loader complexity. Also begun integrating Abu's loader code with the
TIF file.

v0.3 : Compatibility enhancements
- Allow browsing of multiple EBOOTs
- Change directory to selected EBOOT location
(adds sounds to Attack of the Mutants)
- Restore screen mode before running EBOOT
(improves reliability)
- Allow multiple text segments in ELF

v0.2 : Original version, ported to C from original v0.1 EBOOT loader by
Saotome.