Devlog #1: PROGRESS!

To sum it up: the firmware mod is almost done, and I am going to start on the homebrew menu!
since the last devlog, I went through 4 iterations on the homebrew loader design:

• It. 1: The OG design, a patched update loop that runs my homebrew before the update loop begins, with a file open func to read payloads
• It. 2: same design, but using lower-level uC-fs file IO funcs since the regular ones didnt seem to work when elevated
• It. 3: New design, this time I patched the LoadPDX() function that loads games/apps to elevate permissions if a system app was being ran (there is an unpatched exploit to install any app as a system app so this route made sense)
• It. 4: New design a function is placed at the end of the firmware that just contains a single svc #2, which is the assembly instruction that elevates your permissions and then returns, so that the caller gets elevated (this works because the CPU only will run elevation/permission change functions from firmware code, not loaded code like a game)

Iteration #4 is the current iteration and I am actively working to get it… well… working. The current issue right now is for some reason it seems to crash when I run the homebrew app, but the firmware itself is fine so I am going to try a couple of things.

Devlog #0 - A quick Recap

This is my first devlog for PlayBrew, my Playdate Homebrew, and it is mostly focused on explaining what I have thus far.

What is PlayBrew?

Playbrew is a homebrew for the playdate game console that enables the user of the device (YOU!) to unlock your console’s true potential! You can code payloads, which are C scripts compiled into binary files, and then run them on-device with full low level firmware access (no sandboxing!!!). Possible payloads could be one that enables the bluetooth functionality, one that allows you to set a custom lock screen, and even one for game modding! (I have a whole list of cool ideas that I may share later)

The state of things

Sooo sadly right now PlayBrew is unfunctional 😭…
So far I have been able to modify the firmware to allow for ACE (arbitrary code execution (also don’t worry the games can’t access it so no worry of malware :D)) of some C code that gets compiled and appended to the firmware, but I am having issues with the filesystem and am unable to read the actual payloads. The way the arbitrary code runs is by modifying a function pointer to the main FW update loop to run my code, and then at the end of PlayBrew’s code it just returns into the FW update loop and the firmware runs as normal.

sooo now what’s next?

There’s a couple things I have planned, kinda ranked in order of importance:

• Getting the FS to work (I am making progress on that rn)
• Making the payload build system (gonna need help with that lol… I hate the C compiler)
• expanding the API before the full v1 release (I have to manually expose all of the functions from the FW since their addresses can change…)
• Get sleep (so basically I havzzzzzzzzzzzzzzzzzzzz)
• make a way to dump the unlock code (it’s your FW decryption key)
• make an installer
• don’t get DMCA takedown’ed

Sign me up!

hold up there… even If you own a playdate, there are a few different things you need to know ahead of time, and in short, you can’t install it.
this is because:

• firmware for the device (specifically the pdfw file in a PlaydateOS.pdos (which is just a zip) file) is encrypted, so you gotta get your device specific key and write or find a tool to decrypt it, and I can’t legally share one because of the really dumb law called the DMCA :(
• PlayBrew is ONLY compatable with rev. B devices (the newer ones) at this time. I don’t have a rev. A to test it on but it is possible to port it, I just can’t rn
• You need your unlock code, as required in the first point. The unlock code is a special decryption key used for decrypting FW, and it is not accessable AT ALL unless you are on a FW version below 2.5.0 (maybe 2.6.0???), in which case you can use Crank2Unlock to read your code. Otherwise you gotta wait for the exploit I be cooking (or write your own lol).

Finally, If you ever wanna install this on your device, either stay on 3.0.2 which is the latest fully-stable version, or jump to 3.1.0 when It comes out since I’m not releasing my exploit till after that so It won’t be patched :)

also here’s a pic of the current header file, its super broken (Ill star one of your repo’s if you can spot the issues!) but it used to work and it will, and really that’s all that matters.