Editing PS3Cobra Payload Reverse Engineering

[[Category:Software]][[Category:Hardware]]{{Wikify}}

=Description=
Dongle is DRM to make sure you have the dongle, the firmware 'special' functionality will not work without it. <br />
Hardwarewise, there are many simularities with [[ReDRM / Piracy dongles]] like PSJB2/TrueBlue


The Ps3Cobra implements syscall 8 and moves syscall 0 into the payload.
It does some heavy patching on Lv2 code

==Lv2 Patches of Cobra Payload 1.2==
{| class="wikitable"
|-
!offset !! psgroove !! cobra 1.2 !! cobra 2.0 !! comment
|-
| 9134 || 7d 80 00 26 mfcr r12      || N/A                         || 48 4f 77 ec  b 0x8000000000500920 || 
|-
| 17cbc|| e8 63 00 00 ld  r3,0(r3)  || 3c 60 80 01  lis r3,-32767  || 3c 60 80 01  lis r3,-32767        || remove syscall 6 (peek)
|-
| 17cc0|| 60 00 00 00 nop           || 60 63 00 03  ori r3,r3,3    || 60 63 00 03  ori r3,r3,3          || remove syscall 6 (peek)
|-
| 17cc8|| f8 83 00 00 std r4,0(r3)  || 3c 60 80 01  lis r3,-32767  || 3c 60 80 01  lis r3,-32767        || remove syscall 7 (poke)
|-
| 17ccc|| 60 00 00 00 nop           || 60 63 00 03  ori r3,r3,3    || 60 63 00 03  ori r3,r3,3          || remove syscall 8 (poke)
|-
| 490e0|| 2f 83 00 00 cmpwi cr7,r3,0|| e8 82 0f 08  ld  r4,3848(r2)|| e8 82 0f 08  ld  r4,3848(r2)      ||
|-
| 490e4|| 7c 64 1b 78 mr  r4,r3     || e8 7c 00 20  ld  r3,32(r28) || e8 7c 00 20  ld  r3,32(r28)       || 
|-
| 490e8|| 40 de 00 20 bne- cr7,0x8000000000049108 || f8 64 00 00  std r3,0(r4)   || f8 64 00 00  std r3,0(r4)         ||
|-
| 4ed18|| 38 84 ff fa addi r4,r4,-6 || 38 80 00 00  li  r4,0       || 38 80 00 00  li  r4,0             ||
|-
| 4ed1c|| 7c 08 02 a6 mflr r0       || 90 83 00 00  stw r4,0(r3)   || 90 83 00 00  stw r4,0(r3)         ||
|-
| 4ed20|| f8 21 ff 91 stdu r1,-112(r1) || 4e 80 00 20  blr         || 4e 80 00 20  blr                  ||
|-
| 4f0a8|| bl      sub_50B44         || 48 4b 11 a9  bl 0x8000000000500250 || 48 4b 11 a9  bl 0x8000000000500250 ||
|-
| 4fc2c  || beq cr7, loc_4FC4C       || 60 00 00 00  nop   || 60 00 00 00 nop    ||
|-
| 505D0  || li      %r3, 1           || b       sub_5008E0 || 48 4b 04 28  b 0x80000000005009f8 ||
|-
| 50B48  || patched                  || unpatched ?        ||                    ||
|-
| 572B8  || extsw   %r3, %r31        || li      %r3, 0     ||                    ||
|-
| 5741C  || bl      sub_288568       || nop                ||                    ||
|-
| 1C00EC || stdu    %sp, var_150(%sp)|| b       sub_5003A8 ||                    ||
|-
| 1C26EC || stdu    %sp, var_D0(%sp) || b       sub_500448 ||                    ||
|-
| 1CF8A8 || stdu    %sp, var_B0(%sp) || b       sub_5004C8 ||                    ||
|-
| 25EC18 || bl      sub_12934        || bl      sub_500960 ||                    ||
|-
| 271AF0 || stdu    %sp, var_B0(%sp) || b       loc_500808 || b       loc_500818 || (syscall864 / sys storage manager) <s>Again, wrong here, loc_500808 is a bad jump.</s><br>this is 1.2!
|-
| 273F80 || stdu    %sp, var_B0(%sp) || b       sub_500878 || b       sub_500990 || (syscall867 / aim manager )<s>you have a critical mistake, sub_500878 IS WRONG, :), if you jump here you crash your lv2</s><br> YOUR CRITICAL MISTAKE WAS ONLY PUT 1.2, NOW YOU FIX IT, THANKS<br>didn't meant to be rude, sry :)
|-
| 29245C || stdu    %sp, var_100(%sp)|| b       sub_5005A8 ||                  ||
|-
| 292598 || ld      %r11, stru_3403A0|| b       sub_5006D8 ||                  ||
|-
| 293A18 || ld      %r9, stru_3403A0 || b       sub_500540 ||                  ||
|-
| 296550 || stdu    %sp, var_D0(%sp) || b       sub_500640 ||                  ||(syscall606)
|-
| 296928 || stdu    %sp, var_D0(%sp) || b       sub_500770 ||                  ||(syscall619)
|-
| 29BD48 || b       sub_11850 || b       sub_500358 ||                         ||
|-
| 2AAFC8 || b       sub_50B48 || b       sub_5002F0 ||                         ||
|-
| 2AB3FC || unpatched         || b       sub_5002A0 ||                         || (PS2 EMU?)
|-
| 3ba890 ||                   ||                    || 0x01000000              || patch table entry 1
|-
|}

{| class="wikitable"
|-
!offset !! cobra 1.2 !! cobra 2.0 !! comment
|-
| 3ba890 || 0x10000000         || 0x10000000              || patch table entry 1
|-
| 490e0  ||                    || ld      r4, stru_33F628 || patch table entry 2
|-
| 490e4  ||                    || ld      r3, 0x20(r28)   || patch table entry 3
|-
| 490e8  ||                    || std     r3, 0(r4)       || patch table entry 4
|-
| 4ed18  ||                    || li      r4, 0           || patch table entry 5
|-
| 4ed1c  ||                    || stw     r4, 0(r3)       || patch table entry 6
|-
| 4ed20  ||                    || blr                     || patch table entry 7
|-
| 572b8  ||                    || li      r3, 0           || patch table entry 8
|-
| 5741c  ||                    || nop                     || patch table entry 9
|-
| 4fc2c  ||                    || nop                     || patch table entry a
|-
| 50b3c  ||                    || li      r3, 1           || patch table entry b
|-
| 50b40  ||                    || blr                     || patch table entry c
|-
|}

==Cobra 1.2==

  8000000000017cbc:     3c 60 80 01     lis     r3,-32767
  8000000000017cc0:     60 63 00 03     ori     r3,r3,3

  8000000000017cc8:     3c 60 80 01     lis     r3,-32767
  8000000000017ccc:     60 63 00 03     ori     r3,r3,3

  80000000000490e0:     e8 82 0f 08     ld      r4,3848(r2)
  80000000000490e4:     e8 7c 00 20     ld      r3,32(r28)
  80000000000490e8:     f8 64 00 00     std     r3,0(r4)

  800000000004ed18:     38 80 00 00     li      r4,0
  800000000004ed1c:     90 83 00 00     stw     r4,0(r3)
  800000000004ed20:     4e 80 00 20     blr

  800000000004f0a8:     48 4b 11 a9     bl      0x8000000000500250
  800000000004fc2c:     60 00 00 00     nop

  80000000000505d0:     48 4b 03 10     b       0x80000000005008e0
  8000000000050b3c:     38 60 00 01     li      r3,1
  8000000000050b40:     4e 80 00 20     blr

  80000000000572b8:     38 60 00 00     li      r3,0

  800000000005741c:     60 00 00 00     nop

  80000000001c00ec:     48 34 02 bc     b       0x80000000005003a8
  80000000001c26ec:     48 33 dd 5c     b       0x8000000000500448
  80000000001cf8a8:     48 33 0c 20     b       0x80000000005004c8
  800000000025ec18:     48 2a 1d 49     bl      0x8000000000500960
  8000000000271af0:     48 28 ed 18     b       0x8000000000500808
  8000000000273f80:     48 28 c8 f8     b       0x8000000000500878
  800000000029245c:     48 26 e1 4c     b       0x80000000005005a8
  8000000000292598:     48 26 e1 40     b       0x80000000005006d8
  8000000000293a18:     48 26 cb 28     b       0x8000000000500540
  8000000000296550:     48 26 a0 f0     b       0x8000000000500640
  8000000000296928:     48 26 9e 48     b       0x8000000000500770
  800000000029bd48:     48 26 46 10     b       0x8000000000500358
  80000000002aafc8:     48 25 53 28     b       0x80000000005002f0

==Cobra 2.0==
  8000000000009134:     48 4f 77 ec     b       0x8000000000500920

  8000000000017cbc:     3c 60 80 01     lis     r3,-32767
  8000000000017cc0:     60 63 00 03     ori     r3,r3,3

  8000000000017cc8:     3c 60 80 01     lis     r3,-32767
  8000000000017ccc:     60 63 00 03     ori     r3,r3,3

  80000000000490e0:     e8 82 0f 08     ld      r4,3848(r2)
  80000000000490e4:     e8 7c 00 20     ld      r3,32(r28)
  80000000000490e8:     f8 64 00 00     std     r3,0(r4)

  800000000004ed18:     38 80 00 00     li      r4,0
  800000000004ed1c:     90 83 00 00     stw     r4,0(r3)
  800000000004ed20:     4e 80 00 20     blr

  800000000004f0a8:     48 4b 11 a9     bl      0x8000000000500250

  800000000004fc2c:     60 00 00 00     nop

  80000000000505d0:     48 4b 04 28     b       0x80000000005009f8

  8000000000050b3c:     38 60 00 01     li      r3,1

  8000000000050b40:     4e 80 00 20     blr

  80000000000572b8:     38 60 00 00     li      r3,0

  800000000005741c:     60 00 00 00     nop

  80000000001c00ec:     48 34 02 cc     b       0x80000000005003b8
  80000000001c26ec:     48 33 dd 6c     b       0x8000000000500458
  80000000001cf8a8:     48 33 0c 30     b       0x80000000005004d8
  800000000025ec18:     48 2a 1e 61     bl      0x8000000000500a78
  8000000000271af0:     48 28 ed 28     b       0x8000000000500818
  8000000000273f80:     48 28 ca 10     b       0x8000000000500990
  800000000029245c:     48 26 e1 5c     b       0x80000000005005b8
  8000000000292598:     48 26 e1 50     b       0x80000000005006e8
  8000000000293a18:     48 26 cb 38     b       0x8000000000500550
  8000000000296550:     48 26 a1 00     b       0x8000000000500650
  8000000000296928:     48 26 9e 58     b       0x8000000000500780
  800000000029bd48:     48 26 46 20     b       0x8000000000500368
  80000000002aafc8:     48 25 53 38     b       0x8000000000500300

==lv1 hvcalls==

* lv1_get_repository_node_value
* lv1_allocate_device_dma_region
* lv1_free_device_dma_region
* lv1_map_device_dma_region
* lv1_unmap_device_dma_region
* lv1_storage_read
* lv1_storage_check_async_status

==Preliminary Examination of Cobra USB Manager v1.0==

The following was acquired from a Debug/DEX unit on 3.55forDEX using the *Check debug option:
<div style="height:250px; overflow:auto"><pre>
System Version : 03.0000

---
Log
---
[Info]	Checking HDD Game.(HG,"/dev_hdd0/game/CBUM01234")
[Debug]	Checking System File /dev_hdd0/game/CBUM01234/PARAM.SFO.
[Info]	TITLE_ID = CBUM01234.
[Info]	PARENTAL_LEVEL = 0/--/--/--/--/--/--.
[Info]	ATTRIBUTE = 0x0.
[Info]	RESOLUTION = 0x3F, 1080/720/576/576(16:9)/480/480(16:9).
[Info]	SOUND_FORMAT = 0x117, 7.1LPCM/5.1LPCM/2LPCM/5.1Dolby.
[Info]	VERSION = 01.00.
[Info]	PS3_SYSTEM_VER = 03.0000.
[Info]	APP_VER = 01.00.
[Debug]	TITLE_ID = CBUM01234.
[Warn]	PARAM.SFO: Param PARENTAL_LEVEL: Currently being rated.
[Debug]	PARENTAL_LEVEL = 0/--/--/--/--/--/--.
[Debug]	ATTRIBUTE = 0x0.
[Error]	PARAM.SFO: Param LICENSE: Unexpected val_size.
[Error]	PARAM.SFO: Param LICENSE: Unexpected value.
[Debug]	RESOLUTION = 0x3F, 1080/720/576/576(16:9)/480/480(16:9).
[Debug]	SOUND_FORMAT = 0x117, 7.1LPCM/5.1LPCM/2LPCM/5.1Dolby.
[Debug]	VERSION = 01.00.
[Debug]	PS3_SYSTEM_VER = 03.0000.
[Debug]	APP_VER = 01.00.
[Debug]	PS3LOGO.DAT: Logo.
[Debug]	ICON0.PNG: 320x176/24bit.
[Info]	EBOOT.BIN: PPU SELF file, SDK version = 03.0000.
[Debug]	EBOOT.BIN: 300.001 (PPU) : crt0
[Debug]	EBOOT.BIN: 300.001 (PPU) : crt1
[Debug]	EBOOT.BIN: 192.001 (PPU) : libftp
[Error]	EBOOT.BIN: Debug library linked (libftp).
[Error]	EBOOT.BIN: Version conflict error (libftp, 192.001).
[Debug]	EBOOT.BIN: 300.001 (PPU) : libnet_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libnetctl_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libpngdec_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libdbgfont_gcm
[Error]	EBOOT.BIN: Debug library linked (libdbgfont_gcm).
[Debug]	EBOOT.BIN: 300.001 (PPU) : libgcm_cmd
[Debug]	EBOOT.BIN: 300.001 (PPU) : libgcm_sys_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libio_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libsysmodule_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libsysutil_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libfs_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libl10n_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libfontGcm
[Debug]	EBOOT.BIN: 300.001 (PPU) : libfontFT_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libfont_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libstdc++
[Debug]	EBOOT.BIN: 300.001 (PPU) : libc
[Debug]	EBOOT.BIN: 300.001 (PPU) : liblv2_stub
</pre></div><br /><br />

= Mountpoints =
<table width="100%"><tr>
<td with="50%">
Intern (PS3):
* ''/dev_hdd0/GAMES''
* /dev_hdd0/BDRIPS
* /dev_hdd0/GAMEZ
* ''/dev_hdd0/PS3ISO'' <- Only for Backups in ISO Format.
</td><td with="50%">
Extern (PS3):
* ''/dev_usb/GAMES''
* /dev_usb/GAMEZ
* ''/dev_usb/PS3ISO'' <-  <- Only for Backups in ISO Format.
</td></tr>
<tr><td with="50%">
Intern (PS2):
* ''/dev_hdd0/PS2ISO''
</td><td with="50%">
Extern (PS2):
* ''/dev_usb/PS2ISO'' <-  <- Only for Backups, not for loading.
</td></tr>
<tr><td with="50%">
Intern (PS1):
* ''/dev_hdd0/PSXISO''
</td><td with="50%">
Extern (PS1):
* ''/dev_usb/PSXISO''
</td></tr>
<tr><td with="50%">
Intern (BluRay):
* ''/dev_hdd0/BDISO''
</td><td with="50%">
Extern (BluRay):
* ''/dev_usb/BDISO''
</td></tr>
<tr><td with="50%">
Intern (DVD):
* ''/dev_hdd0/DVDISO''
</td><td with="50%">
Extern (DVD):
* ''/dev_usb/DVDISO''
</td></tr></table>

= Hardware Dongle =

== Dongle 1.0 ==
<table width="100%" align="left"><tr><td align="left">
[[File:CobraPCB - TOP.jpg|200px|thumb|left|PS3Cobra - TOP]]</td><td align="left">[[File:CobraPCB - BACK.jpg|200px|thumb|left|PS3Cobra - BACK]]</td></tr></table>

<Gallery>
File:Cobra USB SWITCH.jpg|Cobra USB - SWITCH
File:Cobra USB OPEN1.jpg|Cobra USB - OPEN 1
File:Cobra USB OPEN2.jpg|Cobra USB - OPEN 2
File:Cobra USB TOP1.jpg|Cobra USB - TOP 1
File:Cobra USB TOP2.jpg|Cobra USB - TOP 2
File:Cobra USB BACK.jpg|Cobra USB - BACK
</Gallery>

=== Components ===

==== Actel ProASIC3 A3P060 - FPGA ====
U2 <br />
   A3P060 = 60,000 System Gates
   blank = Speed Grade: Standard
   VQ = Package Type: Very Thin Quad Flat Pack (0.5mm pitch)
   G = Lead-Free Packaging: RoHS-Compliant (Green)
   100 = Package Lead Count : 100 pins
   blank = Security Feature : no IP license
   blank = Temperature Range: Commercial (0°C to +70°C Ambient Temperature)
128-bit AES <br />
1,024 bits of user flash memory <br />
Datasheets and usermanuals: http://www.actel.com/products/pa3/docs.aspx#ds <br />
Familyroot: http://www.actel.com/products/pa3/ <br />
Usage Guide: http://www.embedtools.com/pro_kaifa/SOPC_%20EDA/ProASIC3/PA3_E_IO_AN.pdf

===== Pinout A3P060 VQ100 =====
<div style="float:right">[[File:VQ100.png|200px|thumb|left|Actel ProASIC3 A3P060 - FPGA (Cobra) VQ100 package]]</div>
<div style="height:300px; overflow:auto">
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;" 
|- bgcolor="#cccccc"
! Pin !! Function !! Notes
|-
| 1 || GND || Ground
|-
| 2 || GAA2/IO118UDB3 || 
|-
| 3 || IO118VDB3 || 
|-
| 4 || GAB2/IO117UDB3 || 
|-
| 5 || IO117VDB3 || 
|-
| 6 || GAC2/IO116UDB3 || 
|-
| 7 || IO116VDB3 || 
|-
| 8 || IO112PSB3 || 
|-
| 9 || GND || Ground
|-
| 10 || GFB1/IO109PDB3 || 
|-
| 11 || GFB0/IO109NDB3 || 
|-
| 12 || VCOMPLF || 
|-
| 13 || GFA0/IO108NPB3 || 
|-
| 14 || VCCPLF || 
|-
| 15 || GFA1/IO108PPB3 || 
|-
| 16 || GFA2/IO107PSB3 || 
|-
| 17 || VCC || 
|-
| 18 || VCCIB3 || 
|-
| 19 || GFC2/IO105PSB3 || 
|-
| 20 || GEC1/IO100PDB3 || 
|-
| 21 || GEC0/IO100NDB3 || 
|-
| 22 || GEA1/IO98PDB3 || 
|-
| 23 || GEA0/IO98NDB3 || 
|-
| 24 || VMV3 || 
|-
| 25 || GNDQ || Ground
|-
| 26 || GEA2/IO97RSB2 || 
|-
| 27 || GEB2/IO96RSB2 || 
|-
| 28 || GEC2/IO95RSB2 || 
|-
| 29 || IO93RSB2 || 
|-
| 30 || IO92RSB2 || 
|-
| 31 || IO91RSB2 || 
|-
| 32 || IO90RSB2 || 
|-
| 33 || IO88RSB2 || 
|-
| 34 || IO86RSB2 || 
|-
| 35 || IO85RSB2 || 
|-
| 36 || IO84RSB2 || 
|-
| 37 || VCC || 
|-
| 38 || GND || Ground
|-
| 39 || VCCIB2 || 
|-
| 40 || IO77RSB2 || 
|-
| 41 || IO74RSB2 || 
|-
| 42 || IO71RSB2 || 
|-
| 43 || GDC2/IO63RSB2 || 
|-
| 44 || GDB2/IO62RSB2 || 
|-
| 45 || GDA2/IO61RSB2 || 
|-
| 46 || GNDQ || Ground
|-
| 47 || TCK || 
|-
| 48 || TDI || 
|-
| 49 || TMS || 
|-
| 50 || VMV2 || 
|-
| 51 || GND || Ground
|-
| 52 || VPUMP || 
|-
| 53 || NC || 
|-
| 54 || TDO || 
|-
| 55 || TRST || 
|-
| 56 || VJTAG || 
|-
| 57 || GDA1/IO60USB1 || 
|-
| 58 || GDC0/IO58VDB1 || 
|-
| 59 || GDC1/IO58UDB1 || 
|-
| 60 || IO52NDB1 || 
|-
| 61 || GCB2/IO52PDB1 || 
|-
| 62 || GCA1/IO50PDB1 || 
|-
| 63 || GCA0/IO50NDB1 || 
|-
| 64 || GCC0/IO48NDB1 || 
|-
| 65 || GCC1/IO48PDB1 || 
|-
| 66 || VCCIB1 || 
|-
| 67 || GND || Ground
|-
| 68 || VCC || 
|-
| 69 || IO43NDB1 || 
|-
| 70 || GBC2/IO43PDB1 || 
|-
| 71 || GBB2/IO42PSB1 || 
|-
| 72 || IO41NDB1 || 
|-
| 73 || GBA2/IO41PDB1 || 
|-
| 74 || VMV1 || 
|-
| 75 || GNDQ || Ground
|-
| 76 || GBA1/IO40RSB0 || 
|-
| 77 || GBA0/IO39RSB0 || 
|-
| 78 || GBB1/IO38RSB0 || 
|-
| 79 || GBB0/IO37RSB0 || 
|-
| 80 || GBC1/IO36RSB0 || 
|-
| 81 || GBC0/IO35RSB0 || 
|-
| 82 || IO29RSB0 || 
|-
| 83 || IO27RSB0 || 
|-
| 84 || IO25RSB0 || 
|-
| 85 || IO23RSB0 || 
|-
| 86 || IO21RSB0 || 
|-
| 87 || VCCIB0 || 
|-
| 88 || GND || Ground
|-
| 89 || VCC || 
|-
| 90 || IO15RSB0 || 
|-
| 91 || IO13RSB0 || 
|-
| 92 || IO11RSB0 || 
|-
| 93 || GAC1/IO05RSB0 || 
|-
| 94 || GAC0/IO04RSB0 || 
|-
| 95 || GAB1/IO03RSB0 || 
|-
| 96 || GAB0/IO02RSB0 || 
|-
| 97 || GAA1/IO01RSB0 || 
|-
| 98 || GAA0/IO00RSB0 || 
|-
| 99 || GNDQ || Ground
|-
| 100 || VMV0 || 
|-
|}
</div>

==== 24.000 MHz Crystal ====
Y1 <br />
CLK for Actel <br />

==== 12.000 MHz Crystal ====
Y2 <br />
SCK/CLK for Atmel/Winbond <br />

==== AMS1117 3.3 1032 - Low Dropout Linear Regulator ====
U3 <br />
Datasheet: 
* http://www.ps3devwiki.com/files/reDRM/TrueBlue/Datasheets/AMS1117-.pdf
* http://www.ps3devwiki.com/files/reDRM/TrueBlue/Datasheets/AMS1117.pdf<!--// http://www.sltdigital.com/product/product_pdf/AMS1117.pdf / http://home1.cyber-labo.co.jp/board/goods/pdf/AMS1117.pdf //--> <br />
[[:File:AMS1117 - SOT-223.png]]<br />

====  A 47 (F51C 5pin Multilayer Ceramic Capacitor : U4) ====
<div style="float:right">[[File:SOT5.PNG|200px|Thumb|Left|F51C 5pin Multilayer Ceramic Capacitor]]<br /></div>
<div style="height:300px; overflow:auto">
Capacitance value untested, likely one of these ([http://www.mouser.com/Passive-Components/Capacitors/_/N-5g7r?P=1z0z7ym&Keyword=f51C&Ns=Pricing|0&FS=True from Mouser]) <!--// F51C -- verified with magnifier //--> 
</div>

==== Atmel ATmega 16A (16MHz AVR - 16KB flash - USB stack + DFU) ====
U5 <br />
ISP via pin 1 (MOSI), 2 (MISO), 3 (SCK), 4 (Reset) <br />
datasheet: [http://www.multiupload.com/U5BGWX9489 Atmel-ATMega16A.pdf (6.93 MB)]

<div style="float:right">[[File:Atmel-ATMega16A - QFN.png|200px|thumb|left|Atmel ATMega16A<br />QFN44 pinout]]</div>
<div style="height:275px; overflow:auto">
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;" 
|- bgcolor="#cccccc"
! Pin !! Function !! Notes
|-
| 1 || (MOSI) PB5 || Tied to DI (Pin 5) on the Winbond Flash
|-
| 2 || (MISO) PB6 || Tied to DO (Pin 2) on the Winbond Flash
|-
| 3 || (SCK) PB7 || Provides CLK to The Winbond Flash
|-
| 4 || RESET || 
|-
| 5 || VCC || 
|-
| 6 || GND || 
|-
| 7 || XTAL2 || Y2
|-
| 8 || XTAL1 || Y2
|-
| 9 || (RXD) PD0 || Actel IO92RSB2 (pin 30)
|-
| 10 || (TXD) PD1 || Actel IO92RSB2 (pin 29)
|-
| 11 || (INT0) PD2 || 
|-
| 12 || (INT1) PD3 || 
|-
| 13 || (OC1B) PD4 || 
|-
| 14 || (OC1A) PD5 || 
|-
| 15 || (ICP1) PD6 || 
|-
| 16 || (OC2) PD7 || 
|-
| 17 || VCC || 
|-
| 18 || GND || 
|-
| 19 || (SCL) PC0 || 
|-
| 20 || (SDA) PC1 || 
|-
| 21 || (TCK) PC2 || 
|-
| 22 || (TMS) PC3 || 
|-
| 23 || (TDO) PC4 || 
|-
| 24 || (TDI) PC5 || Tied to 3v3 Voltage regulator VCC
|-
| 25 || (TOSC1) PC6 || 
|-
| 26 || (TOSC2) PC7 || 
|-
| 27 || AVCC || Tied to 3v3 Voltage regulator VCC
|-
| 28 || GND || 
|-
| 29 || AREF || 
|-
| 30 || (ADC7) PA7 || 
|-
| 31 || (ADC6) PA6 || 
|-
| 32 || (ADC5) PA5 || 
|-
| 33 || (ADC4) PA4 || 
|-
| 34 || (ADC3) PA3 || 
|-
| 35 || (ADC2) PA2 || 
|-
| 36 || (ADC1) PA1 || 
|-
| 37 || (ADC0) PA0 || 
|-
| 38 || VCC || Tied to 3v3 Voltage regulator VCC
|-
| 39 || GND || 
|-
| 40 || (XCK/T0) PB0 || 
|-
| 41 || (T1) PB1 || 
|-
| 42 || (AIN0/INT2) PB2 || 
|-
| 43 || (AIN1/OC0) PB3 || 
|-
| 44 || (SS) PB4 || 
|-
|}
</div>

==== Winbond 25X16AVSIG (SPI Flash 16Mbit) ====
The IC designation on the board of the cobra dongle is U1.
{{Template:Winbond 25X16AVSIG}}

On the Cobra Dongle, pin 3 of the EEPROM is tied to VCC. Lifting this Pin from the board and tieing it to ground '''should''' prevent the flash from being erased.

=====Roles=====
Drives data to and from the Winbond flash chip.

====Cobra Test Points====
<div style="float:right">[[File:Cobra-TESTPOINTS.jpg|200px|thumb|left|Cobra - Testpoints to Winbond SPI flash]]</div><BR/>

There are test points that map out the Winbond flash shown in the diagram to the right.

==== DG/PS3/PC Selection switch ====

There is a switch that switched between Downgrade, PC and PS3 modes of the dongle.

When facing the switch, with the USB Plug to the left the pins are labeled 1 to 4 in the table below:

{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;" 
|- bgcolor="#cccccc"
! Pin !! Usage !! Connects to !! Remarks
|-
| 1 || PC Position || GND || A resistor is placed, by hand, between this pin and GND after the board is manufactured.
|-
| 2 || PC/PS3 Position|| AVCC (atmega 27) + Winbond /WP (PIN 3) || Ties to Pin 27 of atmega16 (AVCC) and /WP of Winbond Flash
|-
| 3 || PS3/DG Position|| TOSC2 of the Atmega (Pin 26)|| ???
|-
| 4 || DG Position|| GND || A resistor is placed, by hand, between this pin and GND after the board is manufactured.
|-

When in PC Mode, Pins 1 and 2 are shorted. When in PS3 Mode, Pins 2 and 3 are shorted. When in DG Mode 3 and 4 are shorted.