Editing PS3Cobra Payload Reverse Engineering

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
In case you wanted a simple guide howto run Cobra without a dongle, look here: http://www.ps3hax.net/showthread.php?t=67286
{{Wikify}}
=Description=
Dongle is DRM to make sure you have the dongle, the firmware 'special' functionality will not work without it. <br />
Hardwarewise, there are many simularities with [[ReDRM / Piracy dongles]] like PSJB2/TrueBlue
The Ps3Cobra implements syscall 8 and moves syscall 0 into the payload.
The Ps3Cobra implements syscall 8 and moves syscall 0 into the payload.
It does some heavy patching on Lv2 code
It does some heavy patching on Lv2 code
Line 14: Line 5:
{| class="wikitable"
{| class="wikitable"
|-
|-
!offset !! psgroove !! cobra 1.2 !! cobra 2.0 !! comment
!offset !! psgroove !! cobra !! comment
|-
| 9134 || 7d 80 00 26 mfcr r12      || N/A                        || 48 4f 77 ec  b 0x8000000000500920 ||
|-
| 17cbc|| e8 63 00 00 ld  r3,0(r3)  || 3c 60 80 01  lis r3,-32767  || 3c 60 80 01  lis r3,-32767        || remove syscall 6 (peek)
|-
| 17cc0|| 60 00 00 00 nop          || 60 63 00 03  ori r3,r3,3    || 60 63 00 03  ori r3,r3,3          || remove syscall 6 (peek)
|-
| 17cc8|| f8 83 00 00 std r4,0(r3)  || 3c 60 80 01  lis r3,-32767  || 3c 60 80 01  lis r3,-32767        || remove syscall 7 (poke)
|-
| 17ccc|| 60 00 00 00 nop          || 60 63 00 03  ori r3,r3,3    || 60 63 00 03  ori r3,r3,3          || remove syscall 8 (poke)
|-
| 490e0|| 2f 83 00 00 cmpwi cr7,r3,0|| e8 82 0f 08  ld  r4,3848(r2)|| e8 82 0f 08  ld  r4,3848(r2)      ||
|-
| 490e4|| 7c 64 1b 78 mr  r4,r3    || e8 7c 00 20  ld  r3,32(r28) || e8 7c 00 20  ld  r3,32(r28)      ||
|-
| 490e8|| 40 de 00 20 bne- cr7,0x8000000000049108 || f8 64 00 00  std r3,0(r4)  || f8 64 00 00  std r3,0(r4)        ||
|-
| 4ed18|| 38 84 ff fa addi r4,r4,-6 || 38 80 00 00  li  r4,0      || 38 80 00 00  li  r4,0            ||
|-
| 4ed1c|| 7c 08 02 a6 mflr r0      || 90 83 00 00  stw r4,0(r3)  || 90 83 00 00  stw r4,0(r3)        ||
|-
| 4ed20|| f8 21 ff 91 stdu r1,-112(r1) || 4e 80 00 20  blr        || 4e 80 00 20  blr                  ||
|-
| 4f0a8|| bl      sub_50B44        || 48 4b 11 a9  bl 0x8000000000500250 || 48 4b 11 a9  bl 0x8000000000500250 ||
|-
| 4fc2c  || beq cr7, loc_4FC4C      || 60 00 00 00  nop  || 60 00 00 00 nop    ||
|-
| 505D0  || li      %r3, 1          || b      sub_5008E0 || 48 4b 04 28  b 0x80000000005009f8 ||
|-
| 50B48  || patched                  || unpatched ?        ||                    ||
|-
| 572B8  || extsw  %r3, %r31        || li      %r3, 0    ||                    ||
|-
| 5741C  || bl      sub_288568      || nop                ||                    ||
|-
| 1C00EC || stdu    %sp, var_150(%sp)|| b      sub_5003A8 ||                    ||
|-
| 1C26EC || stdu    %sp, var_D0(%sp) || b      sub_500448 ||                    ||
|-
| 1CF8A8 || stdu    %sp, var_B0(%sp) || b      sub_5004C8 ||                    ||
|-
| 25EC18 || bl      sub_12934        || bl      sub_500960 ||                    ||
|-
| 271AF0 || stdu    %sp, var_B0(%sp) || b      loc_500808 || b      loc_500818 || (syscall864 / sys storage manager) <s>Again, wrong here, loc_500808 is a bad jump.</s><br>this is 1.2!
|-
| 273F80 || stdu    %sp, var_B0(%sp) || b      sub_500878 || b      sub_500990 || (syscall867 / aim manager )<s>you have a critical mistake, sub_500878 IS WRONG, :), if you jump here you crash your lv2</s><br> YOUR CRITICAL MISTAKE WAS ONLY PUT 1.2, NOW YOU FIX IT, THANKS<br>didn't meant to be rude, sry :)
|-
| 29245C || stdu    %sp, var_100(%sp)|| b      sub_5005A8 ||                  ||
|-
| 292598 || ld      %r11, stru_3403A0|| b      sub_5006D8 ||                  ||
|-
| 293A18 || ld      %r9, stru_3403A0 || b      sub_500540 ||                  ||
|-
| 296550 || stdu    %sp, var_D0(%sp) || b      sub_500640 ||                  ||(syscall606 sys_storage_async_read)
|-
| 296928 || stdu    %sp, var_D0(%sp) || b      sub_500770 ||                  ||(syscall619 sys_storage_async_send_device_command)
|-
| 29BD48 || b      sub_11850 || b      sub_500358 ||                        ||
|-
| 2AAFC8 || b      sub_50B48 || b      sub_5002F0 ||                        ||
|-
| 2AB3FC || unpatched        || b      sub_5002A0 ||                        || (PS2 EMU?)
|-
| 3ba890 ||                  ||                    || 0x01000000              || patch table entry 1
|-
|}
 
{| class="wikitable"
|-
!offset !! cobra 1.2 !! cobra 2.0 !! comment
|-
| 3ba890 || 0x10000000        || 0x10000000              || patch table entry 1
|-
| 490e0  ||                    || ld      r4, stru_33F628 || patch table entry 2
|-
| 490e4  ||                    || ld      r3, 0x20(r28)  || patch table entry 3
|-
| 490e8  ||                    || std    r3, 0(r4)      || patch table entry 4
|-
| 4ed18  ||                    || li      r4, 0          || patch table entry 5
|-
| 4ed1c  ||                    || stw    r4, 0(r3)      || patch table entry 6
|-
| 4ed20  ||                    || blr                    || patch table entry 7
|-
| 572b8  ||                    || li      r3, 0          || patch table entry 8
|-
| 5741c  ||                    || nop                    || patch table entry 9
|-
| 4fc2c  ||                    || nop                    || patch table entry a
|-
| 50b3c  ||                    || li      r3, 1          || patch table entry b
|-
| 50b40  ||                    || blr                    || patch table entry c
|-
|}
 
==Cobra 1.2==
 
  8000000000017cbc:    3c 60 80 01    lis    r3,-32767
  8000000000017cc0:    60 63 00 03    ori    r3,r3,3
 
  8000000000017cc8:    3c 60 80 01    lis    r3,-32767
  8000000000017ccc:    60 63 00 03    ori    r3,r3,3
 
  80000000000490e0:    e8 82 0f 08    ld      r4,3848(r2)
  80000000000490e4:    e8 7c 00 20    ld      r3,32(r28)
  80000000000490e8:    f8 64 00 00    std    r3,0(r4)
 
  800000000004ed18:    38 80 00 00    li      r4,0
  800000000004ed1c:    90 83 00 00    stw    r4,0(r3)
  800000000004ed20:    4e 80 00 20    blr
 
  800000000004f0a8:    48 4b 11 a9    bl      0x8000000000500250
  800000000004fc2c:    60 00 00 00    nop
 
  80000000000505d0:    48 4b 03 10    b      0x80000000005008e0
  8000000000050b3c:    38 60 00 01    li      r3,1
  8000000000050b40:    4e 80 00 20    blr
 
  80000000000572b8:    38 60 00 00    li      r3,0
 
  800000000005741c:    60 00 00 00    nop
 
  80000000001c00ec:    48 34 02 bc    b      0x80000000005003a8
  80000000001c26ec:    48 33 dd 5c    b      0x8000000000500448
  80000000001cf8a8:    48 33 0c 20    b      0x80000000005004c8
  800000000025ec18:    48 2a 1d 49    bl      0x8000000000500960
  8000000000271af0:    48 28 ed 18    b      0x8000000000500808
  8000000000273f80:    48 28 c8 f8    b      0x8000000000500878
  800000000029245c:    48 26 e1 4c    b      0x80000000005005a8
  8000000000292598:    48 26 e1 40    b      0x80000000005006d8
  8000000000293a18:    48 26 cb 28    b      0x8000000000500540
  8000000000296550:    48 26 a0 f0    b      0x8000000000500640
  8000000000296928:    48 26 9e 48    b      0x8000000000500770
  800000000029bd48:    48 26 46 10    b      0x8000000000500358
  80000000002aafc8:    48 25 53 28    b      0x80000000005002f0
 
==Cobra 2.0==
  8000000000009134:    48 4f 77 ec    b      0x8000000000500920
 
  8000000000017cbc:    3c 60 80 01    lis    r3,-32767
  8000000000017cc0:    60 63 00 03    ori    r3,r3,3
 
  8000000000017cc8:    3c 60 80 01    lis    r3,-32767
  8000000000017ccc:    60 63 00 03    ori    r3,r3,3
 
  80000000000490e0:    e8 82 0f 08    ld      r4,3848(r2)
  80000000000490e4:    e8 7c 00 20    ld      r3,32(r28)
  80000000000490e8:    f8 64 00 00    std    r3,0(r4)
 
  800000000004ed18:    38 80 00 00    li      r4,0
  800000000004ed1c:    90 83 00 00    stw    r4,0(r3)
  800000000004ed20:    4e 80 00 20    blr
 
  800000000004f0a8:    48 4b 11 a9    bl      0x8000000000500250
 
  800000000004fc2c:    60 00 00 00    nop
 
  80000000000505d0:    48 4b 04 28    b      0x80000000005009f8
 
  8000000000050b3c:    38 60 00 01    li      r3,1
 
  8000000000050b40:    4e 80 00 20    blr
 
  80000000000572b8:    38 60 00 00    li      r3,0
 
  800000000005741c:    60 00 00 00    nop
 
  80000000001c00ec:    48 34 02 cc    b      0x80000000005003b8
  80000000001c26ec:    48 33 dd 6c    b      0x8000000000500458
  80000000001cf8a8:    48 33 0c 30    b      0x80000000005004d8
  800000000025ec18:    48 2a 1e 61    bl      0x8000000000500a78
  8000000000271af0:    48 28 ed 28    b      0x8000000000500818
  8000000000273f80:    48 28 ca 10    b      0x8000000000500990
  800000000029245c:    48 26 e1 5c    b      0x80000000005005b8
  8000000000292598:    48 26 e1 50    b      0x80000000005006e8
  8000000000293a18:    48 26 cb 38    b      0x8000000000500550
  8000000000296550:    48 26 a1 00    b      0x8000000000500650
  8000000000296928:    48 26 9e 58    b      0x8000000000500780
  800000000029bd48:    48 26 46 20    b      0x8000000000500368
  80000000002aafc8:    48 25 53 38    b      0x8000000000500300
 
==lv1 hvcalls==
 
* lv1_get_repository_node_value
* lv1_allocate_device_dma_region
* lv1_free_device_dma_region
* lv1_map_device_dma_region
* lv1_unmap_device_dma_region
* lv1_storage_read
* lv1_storage_check_async_status
 
==Preliminary Examination of Cobra USB Manager v1.0==
 
The following was acquired from a Debug/DEX unit on 3.55forDEX using the *Check debug option:
<div style="height:250px; overflow:auto"><pre>
System Version : 03.0000
 
---
Log
---
[Info] Checking HDD Game.(HG,"/dev_hdd0/game/CBUM01234")
[Debug] Checking System File /dev_hdd0/game/CBUM01234/PARAM.SFO.
[Info] TITLE_ID = CBUM01234.
[Info] PARENTAL_LEVEL = 0/--/--/--/--/--/--.
[Info] ATTRIBUTE = 0x0.
[Info] RESOLUTION = 0x3F, 1080/720/576/576(16:9)/480/480(16:9).
[Info] SOUND_FORMAT = 0x117, 7.1LPCM/5.1LPCM/2LPCM/5.1Dolby.
[Info] VERSION = 01.00.
[Info] PS3_SYSTEM_VER = 03.0000.
[Info] APP_VER = 01.00.
[Debug] TITLE_ID = CBUM01234.
[Warn] PARAM.SFO: Param PARENTAL_LEVEL: Currently being rated.
[Debug] PARENTAL_LEVEL = 0/--/--/--/--/--/--.
[Debug] ATTRIBUTE = 0x0.
[Error] PARAM.SFO: Param LICENSE: Unexpected val_size.
[Error] PARAM.SFO: Param LICENSE: Unexpected value.
[Debug] RESOLUTION = 0x3F, 1080/720/576/576(16:9)/480/480(16:9).
[Debug] SOUND_FORMAT = 0x117, 7.1LPCM/5.1LPCM/2LPCM/5.1Dolby.
[Debug] VERSION = 01.00.
[Debug] PS3_SYSTEM_VER = 03.0000.
[Debug] APP_VER = 01.00.
[Debug] PS3LOGO.DAT: Logo.
[Debug] ICON0.PNG: 320x176/24bit.
[Info] EBOOT.BIN: PPU SELF file, SDK version = 03.0000.
[Debug] EBOOT.BIN: 300.001 (PPU) : crt0
[Debug] EBOOT.BIN: 300.001 (PPU) : crt1
[Debug] EBOOT.BIN: 192.001 (PPU) : libftp
[Error] EBOOT.BIN: Debug library linked (libftp).
[Error] EBOOT.BIN: Version conflict error (libftp, 192.001).
[Debug] EBOOT.BIN: 300.001 (PPU) : libnet_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libnetctl_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libpngdec_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libdbgfont_gcm
[Error] EBOOT.BIN: Debug library linked (libdbgfont_gcm).
[Debug] EBOOT.BIN: 300.001 (PPU) : libgcm_cmd
[Debug] EBOOT.BIN: 300.001 (PPU) : libgcm_sys_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libio_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libsysmodule_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libsysutil_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libfs_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libl10n_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libfontGcm
[Debug] EBOOT.BIN: 300.001 (PPU) : libfontFT_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libfont_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libstdc++
[Debug] EBOOT.BIN: 300.001 (PPU) : libc
[Debug] EBOOT.BIN: 300.001 (PPU) : liblv2_stub
</pre></div><br /><br />
 
= Mountpoints =
<table width="100%"><tr>
<td with="50%">
Intern (PS3):
* ''/dev_hdd0/GAMES''
* /dev_hdd0/BDRIPS
* /dev_hdd0/GAMEZ
* ''/dev_hdd0/PS3ISO'' <- Only for Backups in ISO Format.
</td><td with="50%">
Extern (PS3):
* ''/dev_usb/GAMES''
* /dev_usb/GAMEZ
* ''/dev_usb/PS3ISO'' <-  <- Only for Backups in ISO Format.
</td></tr>
<tr><td with="50%">
Intern (PS2):
* ''/dev_hdd0/PS2ISO''
</td><td with="50%">
Extern (PS2):
* ''/dev_usb/PS2ISO'' <-  <- Only for Backups, not for loading.
</td></tr>
<tr><td with="50%">
Intern (PS1):
* ''/dev_hdd0/PSXISO''
</td><td with="50%">
Extern (PS1):
* ''/dev_usb/PSXISO''
</td></tr>
<tr><td with="50%">
Intern (PSP):
* ''/dev_hdd0/PSPISO''
</td><td with="50%">
Extern (PSP):
* ''/dev_usb/PSPISO''
</td></tr>
<tr><td with="50%">
Intern (BluRay):
* ''/dev_hdd0/BDISO''
</td><td with="50%">
Extern (BluRay):
* ''/dev_usb/BDISO''
</td></tr>
<tr><td with="50%">
Intern (DVD):
* ''/dev_hdd0/DVDISO''
</td><td with="50%">
Extern (DVD):
* ''/dev_usb/DVDISO''
</td></tr></table>
 
= Hardware Dongle =
 
== Dongle 1.0 ==
<table width="100%" align="left"><tr><td align="left">
[[File:CobraPCB - TOP.jpg|200px|thumb|left|PS3Cobra - TOP]]</td><td align="left">[[File:CobraPCB - BACK.jpg|200px|thumb|left|PS3Cobra - BACK]]</td></tr></table>
 
<Gallery>
File:Cobra USB SWITCH.jpg|Cobra USB - SWITCH
File:Cobra USB OPEN1.jpg|Cobra USB - OPEN 1
File:Cobra USB OPEN2.jpg|Cobra USB - OPEN 2
File:Cobra USB TOP1.jpg|Cobra USB - TOP 1
File:Cobra USB TOP2.jpg|Cobra USB - TOP 2
File:Cobra USB BACK.jpg|Cobra USB - BACK
</Gallery>
 
=== Components ===
 
==== Actel ProASIC3 A3P060 - FPGA ====
U2 <br />
  A3P060 = 60,000 System Gates
  blank = Speed Grade: Standard
  VQ = Package Type: Very Thin Quad Flat Pack (0.5mm pitch)
  G = Lead-Free Packaging: RoHS-Compliant (Green)
  100 = Package Lead Count : 100 pins
  blank = Security Feature : no IP license
  blank = Temperature Range: Commercial (0°C to +70°C Ambient Temperature)
128-bit AES <br />
1,024 bits of user flash memory <br />
Datasheets and usermanuals: http://www.actel.com/products/pa3/docs.aspx#ds <br />
Familyroot: http://www.actel.com/products/pa3/ <br />
Usage Guide: http://www.embedtools.com/pro_kaifa/SOPC_%20EDA/ProASIC3/PA3_E_IO_AN.pdf
 
===== Pinout A3P060 VQ100 =====
<div style="float:right">[[File:VQ100.png|200px|thumb|left|Actel ProASIC3 A3P060 - FPGA (Cobra) VQ100 package]]</div>
<div style="height:300px; overflow:auto">
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"
|- bgcolor="#cccccc"
! Pin !! Function !! Notes
|-
| 1 || GND || Ground
|-
| 2 || GAA2/IO118UDB3 ||
|-
| 3 || IO118VDB3 ||
|-
| 4 || GAB2/IO117UDB3 ||
|-
| 5 || IO117VDB3 ||
|-
| 6 || GAC2/IO116UDB3 ||
|-
| 7 || IO116VDB3 ||
|-
| 8 || IO112PSB3 ||
|-
| 9 || GND || Ground
|-
| 10 || GFB1/IO109PDB3 ||
|-
| 11 || GFB0/IO109NDB3 ||
|-
| 12 || VCOMPLF ||
|-
| 13 || GFA0/IO108NPB3 ||
|-
| 14 || VCCPLF ||
|-
| 15 || GFA1/IO108PPB3 ||
|-
| 16 || GFA2/IO107PSB3 ||
|-
| 17 || VCC ||
|-
| 18 || VCCIB3 ||
|-
| 19 || GFC2/IO105PSB3 ||
|-
| 20 || GEC1/IO100PDB3 ||
|-
| 21 || GEC0/IO100NDB3 ||
|-
| 22 || GEA1/IO98PDB3 ||
|-
| 23 || GEA0/IO98NDB3 ||
|-
| 24 || VMV3 ||
|-
| 25 || GNDQ || Ground
|-
| 26 || GEA2/IO97RSB2 ||
|-
| 27 || GEB2/IO96RSB2 ||
|-
| 28 || GEC2/IO95RSB2 ||
|-
| 29 || IO93RSB2 ||
|-
| 30 || IO92RSB2 ||
|-
| 31 || IO91RSB2 ||
|-
| 32 || IO90RSB2 ||
|-
| 33 || IO88RSB2 ||
|-
| 34 || IO86RSB2 ||
|-
| 35 || IO85RSB2 ||
|-
| 36 || IO84RSB2 ||
|-
| 37 || VCC ||
|-
| 38 || GND || Ground
|-
| 39 || VCCIB2 ||
|-
| 40 || IO77RSB2 ||
|-
| 41 || IO74RSB2 ||
|-
| 42 || IO71RSB2 ||
|-
| 43 || GDC2/IO63RSB2 ||
|-
| 44 || GDB2/IO62RSB2 ||
|-
| 45 || GDA2/IO61RSB2 ||
|-
| 46 || GNDQ || Ground
|-
| 47 || TCK ||
|-
| 48 || TDI ||
|-
| 49 || TMS ||
|-
| 50 || VMV2 ||
|-
| 51 || GND || Ground
|-
| 52 || VPUMP ||
|-
| 53 || NC ||
|-
| 54 || TDO ||
|-
| 55 || TRST ||
|-
| 56 || VJTAG ||
|-
| 57 || GDA1/IO60USB1 ||
|-
| 58 || GDC0/IO58VDB1 ||
|-
| 59 || GDC1/IO58UDB1 ||
|-
| 60 || IO52NDB1 ||
|-
| 61 || GCB2/IO52PDB1 ||
|-
| 62 || GCA1/IO50PDB1 ||
|-
| 63 || GCA0/IO50NDB1 ||
|-
| 64 || GCC0/IO48NDB1 ||
|-
| 65 || GCC1/IO48PDB1 ||
|-
| 66 || VCCIB1 ||
|-
| 67 || GND || Ground
|-
| 68 || VCC ||
|-
| 69 || IO43NDB1 ||
|-
| 70 || GBC2/IO43PDB1 ||
|-
| 71 || GBB2/IO42PSB1 ||
|-
| 72 || IO41NDB1 ||
|-
| 73 || GBA2/IO41PDB1 ||
|-
| 74 || VMV1 ||
|-
| 75 || GNDQ || Ground
|-
| 76 || GBA1/IO40RSB0 ||
|-
| 77 || GBA0/IO39RSB0 ||
|-
| 78 || GBB1/IO38RSB0 ||
|-
| 79 || GBB0/IO37RSB0 ||
|-
| 80 || GBC1/IO36RSB0 ||
|-
| 81 || GBC0/IO35RSB0 ||
|-
|-
| 82 || IO29RSB0 ||  
| 4F0A8 || bl      sub_50B44 || bl      sub_500250 ||
|-
|-
| 83 || IO27RSB0 ||  
| 4FC2C || beq    cr7, loc_4FC4C || nop ||
|-
|-
| 84 || IO25RSB0 ||  
| 505D0 || li      %r3, 1 || b      sub_5008E0 ||
|-
|-
| 85 || IO23RSB0 ||  
| 50B48 || patched || unpatched ? ||
|-
|-
| 86 || IO21RSB0 ||  
| 572B8 || extsw  %r3, %r31 || li      %r3, 0 ||
|-
|-
| 87 || VCCIB0 ||  
| 5741C || bl      sub_288568 || nop ||
|-
|-
| 88 || GND || Ground
| 1C00EC || stdu    %sp, var_150(%sp) || b      sub_5003A8 ||
|-
|-
| 89 || VCC ||  
| 1C26EC || stdu    %sp, var_D0(%sp) || b      sub_500448 ||
|-
|-
| 90 || IO15RSB0 ||  
| 1CF8A8 || stdu    %sp, var_B0(%sp) || b      sub_5004C8 ||
|-
|-
| 91 || IO13RSB0 ||  
| 25EC18 || bl      sub_12934 || bl      sub_500960 ||
|-
|-
| 92 || IO11RSB0 ||  
| 271AF0 || stdu    %sp, var_B0(%sp) || b      loc_500808 || (syscall864)
|-
|-
| 93 || GAC1/IO05RSB0 ||  
| 273F80 || stdu    %sp, var_B0(%sp) || b      sub_500878 || (syscall867)
|-
|-
| 94 || GAC0/IO04RSB0 ||  
| 29245C || stdu    %sp, var_100(%sp) || b      sub_5005A8 ||
|-
|-
| 95 || GAB1/IO03RSB0 ||  
| 292598 || ld      %r11, stru_3403A0.base_addr_toc+8 || b      sub_5006D8 ||
|-
|-
| 96 || GAB0/IO02RSB0 ||  
| 293A18 || ld      %r9, stru_3403A0.base_addr_toc+8 || b      sub_500540 ||
|-
|-
| 97 || GAA1/IO01RSB0 ||  
| 296550 || stdu    %sp, var_D0(%sp) || b      sub_500640 || (syscall606)
|-
|-
| 98 || GAA0/IO00RSB0 ||  
| 296928 || stdu    %sp, var_D0(%sp) || b      sub_500770 || (syscall619)
|-
|-
| 99 || GNDQ || Ground
| 29BD48 || b      sub_11850 || b      sub_500358 ||
|-
|-
| 100 || VMV0 ||  
| 2AAFC8 || b      sub_50B48 || b      sub_5002F0 ||
|-
|-
|}
|}
</div>
==== 24.000 MHz Crystal ====
Y1 <br />
CLK for Actel <br />
==== 12.000 MHz Crystal ====
Y2 <br />
SCK/CLK for Atmel/Winbond <br />
==== AMS1117 3.3 1032 - Low Dropout Linear Regulator ====
U3 <br />
Datasheet:
* https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Datasheets/AMS1117-.pdf
* https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Datasheets/AMS1117.pdf<!--// http://www.sltdigital.com/product/product_pdf/AMS1117.pdf / http://home1.cyber-labo.co.jp/board/goods/pdf/AMS1117.pdf //--> <br />
<gallery>File:AMS1117 - SOT-223.png</gallery>
====  A 47 (F51C 5pin Multilayer Ceramic Capacitor : U4) ====
<div style="float:right">[[File:SOT5.PNG|200px|Thumb|Left|F51C 5pin Multilayer Ceramic Capacitor]]<br /></div>
<div style="height:300px; overflow:auto">
Capacitance value untested, likely one of these ([http://www.mouser.com/Passive-Components/Capacitors/_/N-5g7r?P=1z0z7ym&Keyword=f51C&Ns=Pricing|0&FS=True from Mouser]) <!--// F51C -- verified with magnifier //-->
</div>
==== Atmel ATmega 16A (16MHz AVR - 16KB flash - USB stack + DFU) ====
U5 <br />
ISP via pin 1 (MOSI), 2 (MISO), 3 (SCK), 4 (Reset) <br />
datasheet: [http://www.multiupload.com/U5BGWX9489 Atmel-ATMega16A.pdf (6.93 MB)]
<div style="float:right">[[File:Atmel-ATMega16A - QFN.png|200px|thumb|left|Atmel ATMega16A<br />QFN44 pinout]]</div>
<div style="height:275px; overflow:auto">
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"
|- bgcolor="#cccccc"
! Pin !! Function !! Notes
|-
| 1 || (MOSI) PB5 || Tied to DI (Pin 5) on the Winbond Flash
|-
| 2 || (MISO) PB6 || Tied to DO (Pin 2) on the Winbond Flash
|-
| 3 || (SCK) PB7 || Provides CLK to The Winbond Flash
|-
| 4 || RESET ||
|-
| 5 || VCC ||
|-
| 6 || GND ||
|-
| 7 || XTAL2 || Y2
|-
| 8 || XTAL1 || Y2
|-
| 9 || (RXD) PD0 || Actel IO92RSB2 (pin 30)
|-
| 10 || (TXD) PD1 || Actel IO92RSB2 (pin 29)
|-
| 11 || (INT0) PD2 ||
|-
| 12 || (INT1) PD3 ||
|-
| 13 || (OC1B) PD4 ||
|-
| 14 || (OC1A) PD5 ||
|-
| 15 || (ICP1) PD6 ||
|-
| 16 || (OC2) PD7 ||
|-
| 17 || VCC ||
|-
| 18 || GND ||
|-
| 19 || (SCL) PC0 ||
|-
| 20 || (SDA) PC1 ||
|-
| 21 || (TCK) PC2 ||
|-
| 22 || (TMS) PC3 ||
|-
| 23 || (TDO) PC4 ||
|-
| 24 || (TDI) PC5 || Tied to 3v3 Voltage regulator VCC
|-
| 25 || (TOSC1) PC6 ||
|-
| 26 || (TOSC2) PC7 ||
|-
| 27 || AVCC || Tied to 3v3 Voltage regulator VCC
|-
| 28 || GND ||
|-
| 29 || AREF ||
|-
| 30 || (ADC7) PA7 ||
|-
| 31 || (ADC6) PA6 ||
|-
| 32 || (ADC5) PA5 ||
|-
| 33 || (ADC4) PA4 ||
|-
| 34 || (ADC3) PA3 ||
|-
| 35 || (ADC2) PA2 ||
|-
| 36 || (ADC1) PA1 ||
|-
| 37 || (ADC0) PA0 ||
|-
| 38 || VCC || Tied to 3v3 Voltage regulator VCC
|-
| 39 || GND ||
|-
| 40 || (XCK/T0) PB0 ||
|-
| 41 || (T1) PB1 ||
|-
| 42 || (AIN0/INT2) PB2 ||
|-
| 43 || (AIN1/OC0) PB3 ||
|-
| 44 || (SS) PB4 ||
|-
|}
</div>
==== Winbond 25X16AVSIG (SPI Flash 16Mbit) ====
The IC designation on the board of the cobra dongle is U1.
{{Template:Winbond 25X16AVSIG}}
On the Cobra Dongle, pin 3 of the EEPROM is tied to VCC. Lifting this Pin from the board and tieing it to ground '''should''' prevent the flash from being erased.
=====Roles=====
Drives data to and from the Winbond flash chip.
====Cobra Test Points====
<div style="float:right">[[File:Cobra-TESTPOINTS.jpg|200px|thumb|left|Cobra - Testpoints to Winbond SPI flash]]</div><BR/>
There are test points that map out the Winbond flash shown in the diagram to the right.
==== DG/PS3/PC Selection switch ====
There is a switch that switched between Downgrade, PC and PS3 modes of the dongle.
When facing the switch, with the USB Plug to the left the pins are labeled 1 to 4 in the table below:
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"
|- bgcolor="#cccccc"
! Pin !! Usage !! Connects to !! Remarks
|-
| 1 || PC Position || GND || A resistor is placed, by hand, between this pin and GND after the board is manufactured.
|-
| 2 || PC/PS3 Position|| AVCC (atmega 27) + Winbond /WP (PIN 3) || Ties to Pin 27 of atmega16 (AVCC) and /WP of Winbond Flash
|-
| 3 || PS3/DG Position|| TOSC2 of the Atmega (Pin 26)|| ???
|-
| 4 || DG Position|| GND || A resistor is placed, by hand, between this pin and GND after the board is manufactured.
|-
When in PC Mode, Pins 1 and 2 are shorted. When in PS3 Mode, Pins 2 and 3 are shorted. When in DG Mode 3 and 4 are shorted.




{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
feel free to append and/or revise :)
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps3/PS3Cobra_Payload_Reverse_Engineering"