Welcome to our page dedicated to PSP reverse engineering! The PlayStation Portable, or PSP, was a popular handheld gaming console released by Sony in 2004. If you’re interested in learning more about the technical aspects of this console and how it works, you’ve come to the right place.
On this page, we’ve compiled a list of links to other pages that cover various topics related to PSP reverse engineering. Whether you’re interested in understanding the hardware architecture of the console, analyzing game code, or exploring the many mods and hacks that have been created by enthusiasts over the years, you’ll find a wealth of resources and information on the pages we’ve linked to.
So grab your PSP, and get ready to dive into the exciting world of PSP reverse engineering!
When announced the PSP was claimed to be as powerful as the PS2 and while it was certainly a very powerful system and the most impressive portable console on the market, it didn’t quite reach the performance of it’s home console sibling.
The PSP was made up of:
For an in-depth look at the Playstation Portable’s Retail hardware architecture check out the excellent post by Copetti.org:
The main CPU in the PSP was the ALLEGREX.
The VFPU operates as a coprocessor for ALLEGREX it is a 128-bit vector floating-point processor.
Operates synchronously with ALLEGREX’s clock (However, the write buffer operates at the bus clock speed.)
Equipped with 32 128-bit matrix registers Designed for vector and matrix calculations (The minimum access unit is 32 bits.)
Capable of high-speed processing for geometry calculations, audio processing, and more.
We have a seperate post all about the development hardware used to make PSP games:
There was a custom Software Development kit that was created by SN Systems before they got bought by Sony in 2005. It was later included in the official SDK when Sony bought the company.
This section lists all the file formats that are useful to know about for reverse engineering or developing PSP games.
On official PSP discs, there are actually two executables included in the SYSDIR folder: BOOT.BIN and EBOOT.BIN the former is uncompressed/unencrypted and suitable for reverse engineering and the latter is the encrypted version that is loaded by the PSP retail firmware.
Sometimes the BOOT.BIN file is filled with zero bytes, this was more common with later PSP games, in which case you will need to decrypt EBOOT.BIN manually instead.
If you only have an EBOOT.BIN don’t worry there are tools that can decrypt it back into a BOOT.BIN such as PRXDecrypter.
On retail discs, games almost always ship with both executables, even though only EBOOT.BIN is guaranteed to be used by official firmware.
Homebrew/custom firmware can be configured to load either, which is why BOOT.BIN remains useful for modders.
Officially the PSP either used physical Universal Media Discs (UMD) or PBP files to distrubte games, but there are a variety of formats available for storing PSP games:
Additionally, compressed zip and rar archives can sometimes be used by PSP emulators like PPSSPP run games without extracting.
The DAX file format is named after Dark_AleX, the pseudonym of a famous Spanish programmer who was a key figure in the PSP hacking and homebrew community.
Dark_AleX developed custom firmware and various tools that enabled compressed PSP game images, including the DAX format, to overcome storage limitations of early PSP memory sticks.
Specifically, the DAX ISO compressor was created by Dark_AleX as a solution to the small storage sizes of Memory Stick PRO Duo cards available at the time. His work allowed users to compress PSP game images into smaller files (DAX files) for easier storage and use on PSP devices with limited storage capacity.
However more recently users found it more convenient to convert DAX files to the more popular compressed CSO format, which offers better compression and compatibility with almost all emulators unlike DAX.
There are some files that are common to almost all PSP games, they are often found in an extracted PSP game, this section will describe the purpose of each of them.
UMD_DATA.BIN is a small binary file found inside PSP game disc images (UMD ISOs). It essentially contains header data about the UMD disc, mainly including the disc ID and partition information. This file helps the PSP or emulators identify and manage the game data on the UMD image correctly.
In the structure of a dumped PSP game ISO, UMD_DATA.BIN serves as metadata that references the partitions (numbered typically 0001 and 0002) and the disc identity. It is crucial for proper loading and launching of the game when the ISO is used on the PSP system or emulators.
It usually contains the following metadata seperated by the pipe “|” (0x7C) character:
Tools like UMDGen, commonly used for creating and editing PSP UMD ISO files, can generate or edit UMD_DATA.BIN as part of managing the overall disc image
PARAM.SFO is a small but critical metadata file used by the PSP (and also PS3/PS4/PS5 with different schema). It’s stored in the root of the PSP_GAME folder and sometimes inside the SYSDIR/UPDATE folders too.
The purpose of the file is to describes the game (or update package) to the PSP system, so that the XMB had the data for displaying the game icon, title, version, and other details. It also tells the firmware what minimum system software version is required to run.
Typical Fields (for a PSP game):
The PSP will refuse to boot the game if PARAM.SFO is missing or corrupted, so make sure that when modding or trimming ISOs, PARAM.SFO must stay intact in the root! The update folder’s PARAM.SFO is only used if you try to run the included firmware updater.
It can be edited (with tools like PSP SFO Editor) to spoof firmware requirements, useful for running older ISOs on newer/different firmware.
Some file formats used in the creation of PSP games:
On the PSP, .pmf files are PlayStation Media Format containers. They are a proprietary Sony format used mainly for full-motion video (FMV) in games e.g for logos, intro movies, attract/demo sequences, cutscenes and credits.
Internally, PMF files are very similar to MPEG-4 video with H.264-like video and ATRAC3+ audio.
They are typically played with the psmf.prx and libpsmfplayer.prx modules.
They are not essential to gameplay itself so they can be removed and the game usually still runs, but it may crash when trying to load the missing FMV unless the executable is patched. So its best to replace them with 0 byte files if you want to save space or skip cutscenes.
First step is to find your BOOT.BIN file, normally in the PSP_GAME/SYSDIR folder of the extracted game ISO. If you only have an EBOOT.BIN file you will need to convert it to a BOOT.BIN with a tool such as PRXDecrypter.
Since BOOT.BIN files are standard ELF executables compiled for the MIPS R4000 (little-endian) instruction set you can import directly into Ghidra without any plugins!
Now double click on BOOT.BIN in the Ghidra tree view and Ghidra will then ask you if you want to analyze the imported binary, say yes and keep the default settings for now.
Give it some time to analyze, depending on the size of the executable it could take up to 10 or 20 minutes.
Official PSP Development Kit hardware The hardware supports booting games from both the UMD and DVD drive, the DVD drive can even boot games from standard DVD-R/RW and so many... ...
Introduction What versions of the SDK have been leaked? Version 1.5.0 (psp_full_sdk_JSR) from 2005 Version 6.6.0 (psp_sdk_660) from 2011 This page will document the latest release version 6.6.0 as it... ...
Saints Row Undercover Also known as Saint Row - The Fall earlier in development, this is one of the rare few prototype games released by the developers themselves, in this... ...
The Sony Playstation portable used encrypted executables known as EBOOT.BIN, these are basically just an encrypted ELF file and it is possible to decrypt them with the correct tools. Some... ...
Introduction What is the SN Systems ProDG PSP SDK? SN Systems were in the business of creating excellent 3rd party development tools and many game development studios relied on them... ...
