Editing Loaders

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
[[Category:Software]]
= Explaination =
= Explaination =
Loaders are used for loading other modules.
Loaders are used for loading other modules.
Line 8: Line 9:
{| class="wikitable"
{| class="wikitable"
|-
|-
! Loader !! Location !! Type !! Zlib support !! Fself support !! Remarks
! Loader !! Location !! Remarks
|-
|-
| bootldr || [[Flash]] || Boot Loader || NO || NO || primary loader from chain of trust, loads lv0
| bootldr || Flash || primairy loader from chain of trust
|-
|-
| metldr || [[Flash]] || Meta Loader || NO || NO || aka asecure_loader. Loads other loaders
| metldr || Flash || metaloader, aka asecure_loader. Loads other loaders
|-
|-
| appldr || [[Boot_Order#CoreOS_PKG_Filelisting|CoreOS]] || Application Loader || YES || YES || loads userspace [f]selfs e.g. [[VSH|vsh.self]], videoplayer_plugin.sprx, disc/NPDRM EBOOT.BINs and [[EDAT_files|EDAT files]]
| appldr || CoreOS ||  
|-
|-
| isoldr || [[Boot_Order#CoreOS_PKG_Filelisting|CoreOS]] || Isolation Loader || NO ||  NO || loading [[Iso module|isolated SPU modules]]
| isoldr || CoreOS ||  
|-
|-
| lv1ldr || [[Boot_Order#CoreOS_PKG_Filelisting|CoreOS]] || Hypervisor Loader || YES ||  NO || loads [[lv1.self]] ([[Hypervisor_Reverse_Engineering|Hypervisor]])
| lv1ldr || CoreOS ||  
|-
| lv2ldr || [[Boot_Order#CoreOS_PKG_Filelisting|CoreOS]] || Supervisor Loader || YES ||  NO || loads lv2_kernel.self (Supervisor kernel)
|-
|-
|}
| lv2ldr || CoreOS ||  
 
=== Loader encapsulation in lv0 ===
{| class="wikitable"
|-
! [http://www.mirrorcreator.com/files/1MLGFUHN/lv0-360-426.rar_links version] !! decrypted SHA1 hash !! isoldr !! appldr !! lv1ldr !! lv2ldr !! Remarks
|-
| [http://www.mirrorcreator.com/files/0YTEHDT5/lv0-360.elf_links 3.60] || 7A051A4A228C5C7256B9DD3ECC0CFABB605490E3 || || || || || [http://www.mirrorcreator.com/files/IJZ2LZ6I/3.60_loaders.7z_links D/L] ; contains weird 2nd loaders that could not be decrypted (named [loader name]_2)
|-
| [http://www.mirrorcreator.com/files/1XLVGOHY/lv0-361.elf_links 3.61] || 832CE19B420895B7C89D0DD3D346B9B4254F0902 ||  ||  ||  ||  ||
|-
| [http://www.mirrorcreator.com/files/SEZJC9MY/lv0-365.elf_links 3.65] || C9F7F42BFB30A9FB9FF1394D18F8C490FA20E51D ||  ||  ||  ||  ||
|-
| [http://www.mirrorcreator.com/files/KCT9T16O/lv0-366.elf_links 3.66] || 110CEA044B059AC8E89C52121DD94EB062605180 ||  ||  ||  ||  ||
|-
| [http://www.mirrorcreator.com/files/0R5PB6HD/lv0-370.elf_links 3.70] || B0CE989CEA9994A7424BC64C49B477ACB9759C45 ||  ||  ||  ||  ||
|-
| [http://www.mirrorcreator.com/files/3T5G4HTU/lv0-372.elf_links 3.72] || E6ABA3DBBAB9CCCFA8B9D4C75AF9BC2CD2A470CC ||  ||  ||  ||  ||
|-
| [http://www.mirrorcreator.com/files/UFNLTHF4/lv0-373.elf_links 3.73] || 17E363EC32AE2C35410250FD147500EAB27C7229 ||  ||  ||  ||  ||
|-
| [http://www.mirrorcreator.com/files/0PPREFR4/lv0-374.elf_links 3.74] || 048C7F30C6FEC76029DE7107C6EA825D778464D3 ||  ||  ||  ||  ||
|-
| [http://www.mirrorcreator.com/files/0DMBS9UJ/lv0-400.elf_links 4.00] || B1BD5C738EA8B4C5882DF3816802042015E57765 ||  ||  ||  ||  ||
|-
| [http://www.mirrorcreator.com/files/BYC8OJTA/lv0-401.elf_links 4.01] || DB42B9FC98E927536F9BDE68517DC7EF6A3E7630 ||  ||  ||  ||  ||
|-
| [http://www.mirrorcreator.com/files/10ZSJ0EV/lv0-410.elf_links 4.10] || ED6B89DE996DA92B670A515342E5BA44C506CCB8 ||  ||  ||  ||  ||
|-
| [http://www.mirrorcreator.com/files/YAVOOWHN/lv0-411.elf_links 4.11] || 5A80C633C7679FB24FEC9E603058A65010F1CC59 ||  ||  ||  ||  ||
|-
| [http://www.mirrorcreator.com/files/ZASV4VRP/lv0-420.elf_links 4.20] || 69F14D7512177EAE3DB6A00764CB242D1683511C ||  ||  ||  ||  ||
|-
| [http://www.mirrorcreator.com/files/6YUOJVTH/lv0-421.elf_links 4.21] || DB4E4CF6A795D8AB93200B4ACDA7978028601EDC ||  ||  ||  ||  ||
|-
| [http://www.mirrorcreator.com/files/NOYHSIPY/lv0-423.elf_links 4.23] || AC7BDA2E7E093D4FDDE801FAFAB42F55B92506C4 ||  ||  ||  ||  ||
|-
| [http://www.mirrorcreator.com/files/1BJIVAWD/lv0-425.elf_links 4.25] || A6DE36E9178C75B3C557E3056C8BAE5A13C83038 ||  ||  ||  ||  ||
|-
| [http://www.mirrorcreator.com/files/0GJNGKIH/lv0-426.elf_links 4.26] || 042ACDE3A986B50F8C58450798DD866130EB85EA ||  ||  ||  ||  ||
|-
| [http://www.mirrorcreator.com/files/M85N5C74/lv0-430.elf_links 4.30] || 44A048CC7F990A9EE5400695BC0D9EE283BAB02F ||  ||  ||  || ||  
|-
|-
|}
|}
Line 70: Line 28:
{| class="wikitable"
{| class="wikitable"
|-
|-
! Stop Code !! Module !! Remark  
! Stop Code !! Module !! Remark
|-
| 0x30 || isoldr/appldr || Version mismatch (isoldr version differs from version returned by SPU channel 73).
|-
| 0x16 || isoldr || Revoke List Error
|-
| 0x17 || isoldr || Adresses needs to be aligned
|-
| 0x21 || lv1ldr || ???
|-
| 0x27 || appldr || SPU arg at 0x3E840
|-
| 0x20 || metldr || header error
|-
| 0x23 || metldr || ECDSA signature failure
|-
|}
 
0x27
 
When booting, lv1ldr store its version in this region writing to ch_72.<br />
isoldr asks for the version in two chuncks, if you want to pass version 3.41 (0x0003004100000000)
 
Note: this version check was recently added, maybe in fw 3.41
 
<pre>
//for ch_73_round_0
data0 = 0x00030041;
//for ch_73_round_1
data1 = 0x00000000;
</pre>
 
=== lv1ldr ===
Used for loading the hypervisor (lv1.self). It also handles some initialization of the ATA and ENCDEC subsystems.
 
==== LS Parameters Layout ====
{| class="wikitable"
|-
! Address !! Usage !! Comments
|-
| 0x34CB0 || Unknown || DMA read from ch74 20 times.
|-
| 0x3E000 || Wait flag || If (flag==0){wait;} // use 0xFF00000000ULL
|-
| 0x3E800 || Arguments ||
|}
 
=== lv2ldr ===
Used to verify and decrypt lv2 selfs (lv2_kernel.self, ps2_emu.self, ps2_gxemu.self, ps2_softemu.self, ps2_netemu.self)
 
And to install RVK-list.
 
==== LS Parameters layout ====
{| class="wikitable"
|-
! Address !! Usage !! Comments
|-
| 0x3E000 || Wait flag || If (flag==0){wait;} // use 0xFF00000000ULL
|-
| 0x3E800 || Arguments ||
|-
| 0x3F000 || Program revoke list ||
|}
 
==== Arguments ====
 
{| class="wikitable"
|-
! Size !! Name !! Value
|-
|u64 || lpar_auth_id || 0x1070000002000001
|-
|u8 || *lv2_in || lv2 self - address in ram
|-
|u8 || *lv2_out || where to decrypt lv2 - address in ram
|-
|u64 || field18 || -1
|-
|u8[40] || res1 || Unknown / Not used
|-
|u64 || field48 || 1
|-
|u8[16] || res2 || Unknown / Not used
|}
 
=== appldr ===
Used to verify and decrypt usermode program/data segments (system libraries, vsh and its modules, games, edat and sdat files)<BR>
Allows to authenticate fselfs by following Target_ids from EID0: 0x81, 0x82, 0xA0.
 
==== LS Parameters layout ====
{| class="wikitable"
|-
! Address !! Usage !! Comments
|-
| 0x3E000 || Wait flag || If (flag==0){wait;} // use 0xFF00000000ULL
|-
| 0x3E400 || EID0 || first 0x400 bytes of EID0
|-
| 0x3E800 || Arguments || u64 buffer_args_effective_addr
|-
| 0x3EC00 || QA-Flag Info|| u64 qaflag_exist_flag //If existed, set to 0, otherwise -1<BR>u64 unk0 //always 0<BR>u8[0x50] qa_token<BR>u8[0x2A] qa_token_signature<BR>u8[0x6] padding
|-
| 0x3EE00 || LV2 Protection Info || u64 hashed memory effective addr<BR>u64 hashed memory size<BR>u8[0x14] expected_hmac_hash<BR>u8[0xC] padding
|-
| 0x3F000 || Program revoke list ||
|}
 
==== Arguments ====
 
For authenticate_program_segment, firmware 0.8x
{| class="wikitable"
|-
! Size !! Name !! Value
|-
|u64 || program_auth_id || subject program authority id
|-
|u64 || lpar_auth_id || subject logical partition authority id
|-
|u64 || self_header_addr ||
|-
|u64 || program_segment_addr ||
|-
|u64 || program_segment_index ||
|-
|u64 || destination_addr || where to decrypt
|-
|u64 || capability_addr || capability flags will be placed to this addr
|-
|u64 || flag ||
|-
|u64 || field40 || unknown/pad
|-
|u64 || field48 || 2 (on modern fws it could be 2 or 3 or 5)
|}
 
For authenticate_program_segment, firmware 4.7x
{| class="wikitable"
|-
! Size !! Name !! Value
|-
|u64 || subarguments_addr || subarguments effective address
|-
|u64 || lpar_auth_id || subject logical partition authority id
|-
| || ||
|-
|u64 || field48 || 5 (checked by appldr, if doesnot match -> appldr will be stoped with err code 0x27)
|-
| || ||
|}
 
subarguments
 
{| class="wikitable"
|-
! Size !! Name !! Value
|-
| u64 || program_auth_id ||
|-
| u64 || self_header_addr ||
|-
| u64 || program_segment_addr? ||
|-
|-
| u32 || segment_type || 0 for phdrs, 1 for shdrs
| 0x30 || isoldr || Version mismatch (isoldr version differs from version returned by SPU channel 73).
|-
|-
| u32 || program_segment_index || segment number
|-
| u64 || destination_addr ||
|-
| u64 || capability_addr || capability flags (0x20 bytes) will be copyed at this effective addr
|-
| u64 || flag || some flags // flag & 0xFFFF must be <=2 for APP, 3 for UNK7/seven, 4 for NPDRM_APP, 5 for EDAT
|-
| u64 || ||
|-
| u64 || ||
|-
| u64 || ||
|-
| u64 || ||
|-
| u64 || ||
|-
| u8[0x10] || sceNpDrmKey ||
|-
| u64 || header_key_check_result_addr || ppu addr to send the result.
|-
| u64 || ||
|}
|}


Line 266: Line 40:
{| class="wikitable"
{| class="wikitable"
|-
|-
! Address !! Usage !! Comments
! Address !! Usage
|-
|-
| 0x3E000 || Wait flag || If (flag==0){wait;} // use 0xFF00000000ULL
| 0x3E000 || Wait flag
|-
|-
| 0x3E400 || EID0 ||
| 0x3E400 || EID0
|-
|-
| 0x3E800 || Arguments ||
| 0x3E800 || Arguments
|-
|-
| 0x3EC00 || QA-Token || If not used set to -1
| 0x3EC00 || QA-Token
|-
|-
| 0x3F000 || Program revoke list ||
| 0x3F000 || Program revoke list
|}
|}
==== Stop Codes ====
{| class="wikitable"
|-
! Stop Code !! Remark
|-
| 0x0D || Revocation check failed.
|-
| 0x0E || Signature check failed.
|-
| 0x0F || Revoke list verification failed.
|-
| 0x11 || Revoke list verification failed (header).
|-
| 0x12 || SELF segment verification internal error.
|-
| 0x13 || SELF verification failed.
|-
| 0x16 || Revoke list verification failed.
|-
| 0x17 || Isolated module EA is not aligned.
|-
| 0x1D || SELF segment verification internal error (ELF32 header).
|-
| 0x25 || Auth-ID error?
|-
|}
==== Arguments ====
Depending which isolated module you want to load, you would need to pass it different arguments.
{| class="wikitable"
|-
! Size !! Name !! spp_verifier
|-
|u64 || prog_auth_id || 0x1050000003000001
|-
|u64 || lpar_auth_id || 0x1070000002000001
|-
|u64 || *spu_module || SPU - address in ram
|-
|u64 || *spu_module_arg1 || Profile - address in ram
|-
|u64 || spu_module_arg1_size || sizeof(profile)
|-
|u64 || *spu_module_arg2 || Not used
|-
|u64 || spu_module_arg2_size || Not used
|-
|u8 || res1[16] || Unknown
|-
|u64 || field48 || 3
|-
|u8 res2[16] || Unknown
|}
{| class="wikitable"
|-
! Size !! Name !! aim_spu_module
|-
|u64 || prog_auth_id || 0x1050000003000001
|-
|u64 || lpar_auth_id || 0x1070000002000001
|-
|u64 || *spu_module || SPU - address in ram
|-
|u64 || *spu_module_arg1 || aim_spu_args - address in ram
|-
|u64 || spu_module_arg1_size || 0x80
|-
|u64 || *spu_module_arg2 || eid0 - address in ram
|-
|u64 || spu_module_arg2_size || sizeof(eid0)
|-
|u64 || field48 || 3
|}
<pre>
union aim_spu_args {
struct {
void *buf;          // debug_info buffer address
u64 buf_size;        // debug_info buffer size
u32 param;          // 0x01 device type, 0x02 device id, 0x03 pscode, 0x04 psid
} in;
struct {
u8 result[0x10];    // no need to explain...
} out;
};
</pre>
{{Development}}<noinclude>[[Category:Main]]</noinclude>
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps3/Loaders"