Editing PS3Cobra Payload Reverse Engineering

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
In case you wanted a simple guide howto run Cobra without a dongle, look here: http://www.ps3hax.net/showthread.php?t=67286
[[Category:Software]]
 
{{Wikify}}
 
=Description=
Dongle is DRM to make sure you have the dongle, the firmware 'special' functionality will not work without it. <br />
Hardwarewise, there are many simularities with [[ReDRM / Piracy dongles]] like PSJB2/TrueBlue
 
 
The Ps3Cobra implements syscall 8 and moves syscall 0 into the payload.
The Ps3Cobra implements syscall 8 and moves syscall 0 into the payload.
It does some heavy patching on Lv2 code
It does some heavy patching on Lv2 code
Line 16: Line 8:
!offset !! psgroove !! cobra 1.2 !! cobra 2.0 !! comment
!offset !! psgroove !! cobra 1.2 !! cobra 2.0 !! comment
|-
|-
| 9134 || 7d 80 00 26 mfcr r12      || N/A                        || 48 4f 77 ec  b 0x8000000000500920 ||
| 9134 || || || patched ||
|-
| 17cbc|| e8 63 00 00 ld  r3,0(r3)  || 3c 60 80 01  lis r3,-32767  || 3c 60 80 01  lis r3,-32767        || remove syscall 6 (peek)
|-
| 17cc0|| 60 00 00 00 nop          || 60 63 00 03  ori r3,r3,3    || 60 63 00 03  ori r3,r3,3          || remove syscall 6 (peek)
|-
| 17cc8|| f8 83 00 00 std r4,0(r3)  || 3c 60 80 01  lis r3,-32767  || 3c 60 80 01  lis r3,-32767        || remove syscall 7 (poke)
|-
| 17ccc|| 60 00 00 00 nop          || 60 63 00 03  ori r3,r3,3    || 60 63 00 03  ori r3,r3,3          || remove syscall 8 (poke)
|-
| 490e0|| 2f 83 00 00 cmpwi cr7,r3,0|| e8 82 0f 08  ld  r4,3848(r2)|| e8 82 0f 08  ld  r4,3848(r2)      ||
|-
| 490e4|| 7c 64 1b 78 mr  r4,r3    || e8 7c 00 20  ld  r3,32(r28) || e8 7c 00 20  ld  r3,32(r28)      ||
|-
| 490e8|| 40 de 00 20 bne- cr7,0x8000000000049108 || f8 64 00 00  std r3,0(r4)  || f8 64 00 00  std r3,0(r4)        ||
|-
| 4ed18|| 38 84 ff fa addi r4,r4,-6 || 38 80 00 00  li  r4,0      || 38 80 00 00  li  r4,0            ||
|-
| 4ed1c|| 7c 08 02 a6 mflr r0      || 90 83 00 00  stw r4,0(r3)  || 90 83 00 00  stw r4,0(r3)        ||
|-
| 4ed20|| f8 21 ff 91 stdu r1,-112(r1) || 4e 80 00 20  blr        || 4e 80 00 20  blr                  ||
|-
| 4f0a8|| bl      sub_50B44        || 48 4b 11 a9  bl 0x8000000000500250 || 48 4b 11 a9  bl 0x8000000000500250 ||
|-
|-
| 4fc2c  || beq cr7, loc_4FC4C      || 60 00 00 00  nop  || 60 00 00 00 nop    ||
| 4F0A8 || bl      sub_50B44 || bl      sub_500250 || ||
|-
|-
| 505D0  || li      %r3, 1          || b      sub_5008E0 || 48 4b 04 28  b 0x80000000005009f8 ||
| 4FC2C || beq    cr7, loc_4FC4C || nop || ||
|-
|-
| 50B48  || patched                  || unpatched ?        ||                   ||
| 505D0 || li      %r3, 1 || b      sub_5008E0 || ||
|-
|-
| 572B8  || extsw  %r3, %r31        || li      %r3, 0    ||                   ||
| 50B48 || patched || unpatched ? || ||
|-
|-
| 5741C  || bl      sub_288568      || nop                ||                   ||
| 572B8 || extsw  %r3, %r31 || li      %r3, 0 || ||
|-
|-
| 1C00EC || stdu    %sp, var_150(%sp)|| b      sub_5003A8 ||                   ||
| 5741C || bl      sub_288568 || nop || ||
|-
|-
| 1C26EC || stdu    %sp, var_D0(%sp) || b      sub_500448 ||                   ||
| 1C00EC || stdu    %sp, var_150(%sp) || b      sub_5003A8 || ||
|-
|-
| 1CF8A8 || stdu    %sp, var_B0(%sp) || b      sub_5004C8 ||                   ||
| 1C26EC || stdu    %sp, var_D0(%sp) || b      sub_500448 || ||
|-
|-
| 25EC18 || bl      sub_12934        || bl      sub_500960 ||                   ||
| 1CF8A8 || stdu    %sp, var_B0(%sp) || b      sub_5004C8 || ||
|-
|-
| 271AF0 || stdu    %sp, var_B0(%sp) || b      loc_500808 || b      loc_500818 || (syscall864 / sys storage manager) <s>Again, wrong here, loc_500808 is a bad jump.</s><br>this is 1.2!
| 25EC18 || bl      sub_12934 || bl      sub_500960 ||
|-
|-
| 273F80 || stdu    %sp, var_B0(%sp) || b      sub_500878 || b      sub_500990 || (syscall867 / aim manager )<s>you have a critical mistake, sub_500878 IS WRONG, :), if you jump here you crash your lv2</s><br> YOUR CRITICAL MISTAKE WAS ONLY PUT 1.2, NOW YOU FIX IT, THANKS<br>didn't meant to be rude, sry :)
| 271AF0 || stdu    %sp, var_B0(%sp) || b      loc_500808 || b      loc_500818 || (syscall864) <s>Again, wrong here, loc_500808 is a bad jump.</s><br>this is 1.2!
|-
|-
| 29245C || stdu    %sp, var_100(%sp)|| b      sub_5005A8 ||                 ||
| 273F80 || stdu    %sp, var_B0(%sp) || b      sub_500878 || b      sub_500990 || (syscall867)<s>you have a critical mistake, sub_500878 IS WRONG, :), if you jump here you crash your lv2</s><br> YOUR CRITICAL MISTAKE WAS ONLY PUT 1.2, NOW YOU FIX IT, THANKS<br>didn't meant to be rude, sry :)
|-
|-
| 292598 || ld      %r11, stru_3403A0|| b      sub_5006D8 ||                  ||
| 29245C || stdu    %sp, var_100(%sp) || b      sub_5005A8 ||
|-
|-
| 293A18 || ld      %r9, stru_3403A0 || b      sub_500540 ||                 ||
| 292598 || ld      %r11, stru_3403A0.base_addr_toc+8 || b      sub_5006D8 || ||
|-
|-
| 296550 || stdu    %sp, var_D0(%sp) || b      sub_500640 ||                 ||(syscall606 sys_storage_async_read)
| 293A18 || ld      %r9, stru_3403A0.base_addr_toc+8 || b      sub_500540 || ||
|-
|-
| 296928 || stdu    %sp, var_D0(%sp) || b      sub_500770 ||                 ||(syscall619 sys_storage_async_send_device_command)
| 296550 || stdu    %sp, var_D0(%sp) || b      sub_500640 || ||(syscall606)
|-
|-
| 29BD48 || b      sub_11850 || b      sub_500358 ||                         ||
| 296928 || stdu    %sp, var_D0(%sp) || b      sub_500770 || ||(syscall619)
|-
|-
| 2AAFC8 || b      sub_50B48 || b      sub_5002F0 ||                         ||
| 29BD48 || b      sub_11850 || b      sub_500358 || ||
|-
|-
| 2AB3FC || unpatched        || b      sub_5002A0 ||                         || (PS2 EMU?)
| 2AAFC8 || b      sub_50B48 || b      sub_5002F0 || ||
|-
|-
| 3ba890 ||                   ||                   || 0x01000000              || patch table entry 1
| 2AB3FC || unpatched        || b      sub_5002A0 || || (PS2 EMU?)
|-
|-
|}
|}


{| class="wikitable"
|-
!offset !! cobra 1.2 !! cobra 2.0 !! comment
|-
| 3ba890 || 0x10000000        || 0x10000000              || patch table entry 1
|-
| 490e0  ||                    || ld      r4, stru_33F628 || patch table entry 2
|-
| 490e4  ||                    || ld      r3, 0x20(r28)  || patch table entry 3
|-
| 490e8  ||                    || std    r3, 0(r4)      || patch table entry 4
|-
| 4ed18  ||                    || li      r4, 0          || patch table entry 5
|-
| 4ed1c  ||                    || stw    r4, 0(r3)      || patch table entry 6
|-
| 4ed20  ||                    || blr                    || patch table entry 7
|-
| 572b8  ||                    || li      r3, 0          || patch table entry 8
|-
| 5741c  ||                    || nop                    || patch table entry 9
|-
| 4fc2c  ||                    || nop                    || patch table entry a
|-
| 50b3c  ||                    || li      r3, 1          || patch table entry b
|-
| 50b40  ||                    || blr                    || patch table entry c
|-
|}
==Cobra 1.2==
  8000000000017cbc:    3c 60 80 01    lis    r3,-32767
  8000000000017cc0:    60 63 00 03    ori    r3,r3,3
  8000000000017cc8:    3c 60 80 01    lis    r3,-32767
  8000000000017ccc:    60 63 00 03    ori    r3,r3,3
  80000000000490e0:    e8 82 0f 08    ld      r4,3848(r2)
  80000000000490e4:    e8 7c 00 20    ld      r3,32(r28)
  80000000000490e8:    f8 64 00 00    std    r3,0(r4)
  800000000004ed18:    38 80 00 00    li      r4,0
  800000000004ed1c:    90 83 00 00    stw    r4,0(r3)
  800000000004ed20:    4e 80 00 20    blr
  800000000004f0a8:    48 4b 11 a9    bl      0x8000000000500250
  800000000004fc2c:    60 00 00 00    nop
  80000000000505d0:    48 4b 03 10    b      0x80000000005008e0
  8000000000050b3c:    38 60 00 01    li      r3,1
  8000000000050b40:    4e 80 00 20    blr
  80000000000572b8:    38 60 00 00    li      r3,0
  800000000005741c:    60 00 00 00    nop
  80000000001c00ec:    48 34 02 bc    b      0x80000000005003a8
  80000000001c26ec:    48 33 dd 5c    b      0x8000000000500448
  80000000001cf8a8:    48 33 0c 20    b      0x80000000005004c8
  800000000025ec18:    48 2a 1d 49    bl      0x8000000000500960
  8000000000271af0:    48 28 ed 18    b      0x8000000000500808
  8000000000273f80:    48 28 c8 f8    b      0x8000000000500878
  800000000029245c:    48 26 e1 4c    b      0x80000000005005a8
  8000000000292598:    48 26 e1 40    b      0x80000000005006d8
  8000000000293a18:    48 26 cb 28    b      0x8000000000500540
  8000000000296550:    48 26 a0 f0    b      0x8000000000500640
  8000000000296928:    48 26 9e 48    b      0x8000000000500770
  800000000029bd48:    48 26 46 10    b      0x8000000000500358
  80000000002aafc8:    48 25 53 28    b      0x80000000005002f0
==Cobra 2.0==
  8000000000009134:    48 4f 77 ec    b      0x8000000000500920
  8000000000017cbc:    3c 60 80 01    lis    r3,-32767
  8000000000017cc0:    60 63 00 03    ori    r3,r3,3
  8000000000017cc8:    3c 60 80 01    lis    r3,-32767
  8000000000017ccc:    60 63 00 03    ori    r3,r3,3
  80000000000490e0:    e8 82 0f 08    ld      r4,3848(r2)
  80000000000490e4:    e8 7c 00 20    ld      r3,32(r28)
  80000000000490e8:    f8 64 00 00    std    r3,0(r4)
  800000000004ed18:    38 80 00 00    li      r4,0
  800000000004ed1c:    90 83 00 00    stw    r4,0(r3)
  800000000004ed20:    4e 80 00 20    blr
  800000000004f0a8:    48 4b 11 a9    bl      0x8000000000500250
  800000000004fc2c:    60 00 00 00    nop
  80000000000505d0:    48 4b 04 28    b      0x80000000005009f8
  8000000000050b3c:    38 60 00 01    li      r3,1
  8000000000050b40:    4e 80 00 20    blr
  80000000000572b8:    38 60 00 00    li      r3,0
  800000000005741c:    60 00 00 00    nop
  80000000001c00ec:    48 34 02 cc    b      0x80000000005003b8
  80000000001c26ec:    48 33 dd 6c    b      0x8000000000500458
  80000000001cf8a8:    48 33 0c 30    b      0x80000000005004d8
  800000000025ec18:    48 2a 1e 61    bl      0x8000000000500a78
  8000000000271af0:    48 28 ed 28    b      0x8000000000500818
  8000000000273f80:    48 28 ca 10    b      0x8000000000500990
  800000000029245c:    48 26 e1 5c    b      0x80000000005005b8
  8000000000292598:    48 26 e1 50    b      0x80000000005006e8
  8000000000293a18:    48 26 cb 38    b      0x8000000000500550
  8000000000296550:    48 26 a1 00    b      0x8000000000500650
  8000000000296928:    48 26 9e 58    b      0x8000000000500780
  800000000029bd48:    48 26 46 20    b      0x8000000000500368
  80000000002aafc8:    48 25 53 38    b      0x8000000000500300
==lv1 hvcalls==
* lv1_get_repository_node_value
* lv1_allocate_device_dma_region
* lv1_free_device_dma_region
* lv1_map_device_dma_region
* lv1_unmap_device_dma_region
* lv1_storage_read
* lv1_storage_check_async_status
==Preliminary Examination of Cobra USB Manager v1.0==
The following was acquired from a Debug/DEX unit on 3.55forDEX using the *Check debug option:
<div style="height:250px; overflow:auto"><pre>
System Version : 03.0000
---
Log
---
[Info] Checking HDD Game.(HG,"/dev_hdd0/game/CBUM01234")
[Debug] Checking System File /dev_hdd0/game/CBUM01234/PARAM.SFO.
[Info] TITLE_ID = CBUM01234.
[Info] PARENTAL_LEVEL = 0/--/--/--/--/--/--.
[Info] ATTRIBUTE = 0x0.
[Info] RESOLUTION = 0x3F, 1080/720/576/576(16:9)/480/480(16:9).
[Info] SOUND_FORMAT = 0x117, 7.1LPCM/5.1LPCM/2LPCM/5.1Dolby.
[Info] VERSION = 01.00.
[Info] PS3_SYSTEM_VER = 03.0000.
[Info] APP_VER = 01.00.
[Debug] TITLE_ID = CBUM01234.
[Warn] PARAM.SFO: Param PARENTAL_LEVEL: Currently being rated.
[Debug] PARENTAL_LEVEL = 0/--/--/--/--/--/--.
[Debug] ATTRIBUTE = 0x0.
[Error] PARAM.SFO: Param LICENSE: Unexpected val_size.
[Error] PARAM.SFO: Param LICENSE: Unexpected value.
[Debug] RESOLUTION = 0x3F, 1080/720/576/576(16:9)/480/480(16:9).
[Debug] SOUND_FORMAT = 0x117, 7.1LPCM/5.1LPCM/2LPCM/5.1Dolby.
[Debug] VERSION = 01.00.
[Debug] PS3_SYSTEM_VER = 03.0000.
[Debug] APP_VER = 01.00.
[Debug] PS3LOGO.DAT: Logo.
[Debug] ICON0.PNG: 320x176/24bit.
[Info] EBOOT.BIN: PPU SELF file, SDK version = 03.0000.
[Debug] EBOOT.BIN: 300.001 (PPU) : crt0
[Debug] EBOOT.BIN: 300.001 (PPU) : crt1
[Debug] EBOOT.BIN: 192.001 (PPU) : libftp
[Error] EBOOT.BIN: Debug library linked (libftp).
[Error] EBOOT.BIN: Version conflict error (libftp, 192.001).
[Debug] EBOOT.BIN: 300.001 (PPU) : libnet_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libnetctl_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libpngdec_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libdbgfont_gcm
[Error] EBOOT.BIN: Debug library linked (libdbgfont_gcm).
[Debug] EBOOT.BIN: 300.001 (PPU) : libgcm_cmd
[Debug] EBOOT.BIN: 300.001 (PPU) : libgcm_sys_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libio_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libsysmodule_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libsysutil_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libfs_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libl10n_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libfontGcm
[Debug] EBOOT.BIN: 300.001 (PPU) : libfontFT_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libfont_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libstdc++
[Debug] EBOOT.BIN: 300.001 (PPU) : libc
[Debug] EBOOT.BIN: 300.001 (PPU) : liblv2_stub
</pre></div><br /><br />
= Mountpoints =
<table width="100%"><tr>
<td with="50%">
Intern (PS3):
* ''/dev_hdd0/GAMES''
* /dev_hdd0/BDRIPS
* /dev_hdd0/GAMEZ
* ''/dev_hdd0/PS3ISO'' <- Only for Backups in ISO Format.
</td><td with="50%">
Extern (PS3):
* ''/dev_usb/GAMES''
* /dev_usb/GAMEZ
* ''/dev_usb/PS3ISO'' <-  <- Only for Backups in ISO Format.
</td></tr>
<tr><td with="50%">
Intern (PS2):
* ''/dev_hdd0/PS2ISO''
</td><td with="50%">
Extern (PS2):
* ''/dev_usb/PS2ISO'' <-  <- Only for Backups, not for loading.
</td></tr>
<tr><td with="50%">
Intern (PS1):
* ''/dev_hdd0/PSXISO''
</td><td with="50%">
Extern (PS1):
* ''/dev_usb/PSXISO''
</td></tr>
<tr><td with="50%">
Intern (PSP):
* ''/dev_hdd0/PSPISO''
</td><td with="50%">
Extern (PSP):
* ''/dev_usb/PSPISO''
</td></tr>
<tr><td with="50%">
Intern (BluRay):
* ''/dev_hdd0/BDISO''
</td><td with="50%">
Extern (BluRay):
* ''/dev_usb/BDISO''
</td></tr>
<tr><td with="50%">
Intern (DVD):
* ''/dev_hdd0/DVDISO''
</td><td with="50%">
Extern (DVD):
* ''/dev_usb/DVDISO''
</td></tr></table>


= Hardware Dongle =
= Hardware Dongle =


== Dongle 1.0 ==
== Dongle 1.0 ==
<table width="100%" align="left"><tr><td align="left">
<table width="100%" align="left"><tr><td align="left">[[File:CobraPCB - TOP.jpg|200px|thumb|left|Psjb2 Trueblue - OVERVIEW]]</td></tr></table>
[[File:CobraPCB - TOP.jpg|200px|thumb|left|PS3Cobra - TOP]]</td><td align="left">[[File:CobraPCB - BACK.jpg|200px|thumb|left|PS3Cobra - BACK]]</td></tr></table>
 
<Gallery>
File:Cobra USB SWITCH.jpg|Cobra USB - SWITCH
File:Cobra USB OPEN1.jpg|Cobra USB - OPEN 1
File:Cobra USB OPEN2.jpg|Cobra USB - OPEN 2
File:Cobra USB TOP1.jpg|Cobra USB - TOP 1
File:Cobra USB TOP2.jpg|Cobra USB - TOP 2
File:Cobra USB BACK.jpg|Cobra USB - BACK
</Gallery>


=== Components ===
=== Components ===
Line 346: Line 73:
Datasheets and usermanuals: http://www.actel.com/products/pa3/docs.aspx#ds <br />
Datasheets and usermanuals: http://www.actel.com/products/pa3/docs.aspx#ds <br />
Familyroot: http://www.actel.com/products/pa3/ <br />
Familyroot: http://www.actel.com/products/pa3/ <br />
Usage Guide: http://www.embedtools.com/pro_kaifa/SOPC_%20EDA/ProASIC3/PA3_E_IO_AN.pdf


===== Pinout A3P060 VQ100 =====
===== Pinout A3P060 VQ100 =====
Line 563: Line 289:


==== 12.000 MHz Crystal ====
==== 12.000 MHz Crystal ====
Y2 <br />
Y2? <br />
SCK/CLK for Atmel/Winbond <br />
CLK for Atmel <br />


==== AMS1117 3.3 1032 - Low Dropout Linear Regulator ====
==== AMS1117 3.3 1032 - Low Dropout Linear Regulator ====
U3 <br />
U3 <br />
Datasheet:  
Datasheet: http://www.sltdigital.com/product/product_pdf/AMS1117.pdf / http://home1.cyber-labo.co.jp/board/goods/pdf/AMS1117.pdf <br />
* https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Datasheets/AMS1117-.pdf
[[:File:AMS1117 - SOT-223.png]]<br />
* https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Datasheets/AMS1117.pdf<!--// http://www.sltdigital.com/product/product_pdf/AMS1117.pdf / http://home1.cyber-labo.co.jp/board/goods/pdf/AMS1117.pdf //--> <br />
<gallery>File:AMS1117 - SOT-223.png</gallery>


====  A 47 (F51C 5pin Multilayer Ceramic Capacitor : U4) ====
====  A 47 (unreferenced 5pin IC : U4) ====
<div style="float:right">[[File:SOT5.PNG|200px|Thumb|Left|F51C 5pin Multilayer Ceramic Capacitor]]<br /></div>
U4 <br />
<div style="height:300px; overflow:auto">
A 47 <!--// 51c or s1c ? - hard to see without magnifier //--> <br />
Capacitance value untested, likely one of these ([http://www.mouser.com/Passive-Components/Capacitors/_/N-5g7r?P=1z0z7ym&Keyword=f51C&Ns=Pricing|0&FS=True from Mouser]) <!--// F51C -- verified with magnifier //-->  
[[:File:SOT5.PNG]]<br />
</div>
<br />


==== Atmel ATmega 16A (16MHz AVR - 16KB flash - USB stack + DFU) ====
==== Atmel ATmega 16A (16MHz AVR - 16KB flash - USB stack + DFU) ====
Line 590: Line 314:
! Pin !! Function !! Notes
! Pin !! Function !! Notes
|-
|-
| 1 || (MOSI) PB5 || Tied to DI (Pin 5) on the Winbond Flash
| 1 || (MOSI) PB5 ||
|-
|-
| 2 || (MISO) PB6 || Tied to DO (Pin 2) on the Winbond Flash
| 2 || (MISO) PB6 ||  
|-
|-
| 3 || (SCK) PB7 || Provides CLK to The Winbond Flash
| 3 || (SCK) PB7 ||  
|-
|-
| 4 || RESET ||  
| 4 || RESET ||  
Line 602: Line 326:
| 6 || GND ||  
| 6 || GND ||  
|-
|-
| 7 || XTAL2 || Y2
| 7 || XTAL2 ||  
|-
|-
| 8 || XTAL1 || Y2
| 8 || XTAL1 ||  
|-
|-
| 9 || (RXD) PD0 || Actel IO92RSB2 (pin 30)
| 9 || (RXD) PD0 ||  
|-
|-
| 10 || (TXD) PD1 || Actel IO92RSB2 (pin 29)
| 10 || (TXD) PD1 ||  
|-
|-
| 11 || (INT0) PD2 ||  
| 11 || (INT0) PD2 ||  
Line 636: Line 360:
| 23 || (TDO) PC4 ||  
| 23 || (TDO) PC4 ||  
|-
|-
| 24 || (TDI) PC5 || Tied to 3v3 Voltage regulator VCC
| 24 || (TDI) PC5 ||  
|-
|-
| 25 || (TOSC1) PC6 ||  
| 25 || (TOSC1) PC6 ||  
Line 642: Line 366:
| 26 || (TOSC2) PC7 ||  
| 26 || (TOSC2) PC7 ||  
|-
|-
| 27 || AVCC || Tied to 3v3 Voltage regulator VCC
| 27 || AVCC ||  
|-
|-
| 28 || GND ||  
| 28 || GND ||  
Line 664: Line 388:
| 37 || (ADC0) PA0 ||  
| 37 || (ADC0) PA0 ||  
|-
|-
| 38 || VCC || Tied to 3v3 Voltage regulator VCC
| 38 || VCC ||  
|-
|-
| 39 || GND ||  
| 39 || GND ||  
Line 681: Line 405:
</div>
</div>


==== Winbond 25X16AVSIG (SPI Flash 16Mbit) ====
The IC designation on the board of the cobra dongle is U1.
{{Template:Winbond 25X16AVSIG}}
On the Cobra Dongle, pin 3 of the EEPROM is tied to VCC. Lifting this Pin from the board and tieing it to ground '''should''' prevent the flash from being erased.


=====Roles=====
==== Winbond 25X16AVS1G (SPI Flash 16Mbit) ====
Drives data to and from the Winbond flash chip.
<div style="float:right">[[File:W25X16A - SOIC-8.png|200px|thumb|left|8-pin TSSOP<br />Winbond 25X16A<br />SOIC-8 pinout]]</div>
 
U1 <br />
====Cobra Test Points====
<pre>W - Winbond
<div style="float:right">[[File:Cobra-TESTPOINTS.jpg|200px|thumb|left|Cobra - Testpoints to Winbond SPI flash]]</div><BR/>
25X - SPI Flash
 
16 - 16Mbit / 2M-byte (Uniform 4Kbyte sectors/64Kbyte blocks)
There are test points that map out the Winbond flash shown in the diagram to the right.
AVS1G - 100MHz (200Mbits/sec)</pre>
 
datasheet: [http://www.multiupload.com/P2833U5SOW W25X16A.pdf (1.3 MB)] <br />
==== DG/PS3/PC Selection switch ====
Note: can use [http://blog.hodgepig.org/busninja/ Bus Ninja] or [http://flashrom.org/Bus_Pirate Bus Pirate] and [http://flashrom.org/Flashrom FlashROM] - <abbr title="In-System Programming (ISP)">ISP</abbr> is possible, so long as no other devices on the SPI bus are trying to access the device (in that case, you might want to cut Vcc to the FPGA or the regulator for it).
 
There is a switch that switched between Downgrade, PC and PS3 modes of the dongle.
 
When facing the switch, with the USB Plug to the left the pins are labeled 1 to 4 in the table below:


{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"  
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"  
|- bgcolor="#cccccc"
|- bgcolor="#cccccc"
! Pin !! Usage !! Connects to !! Remarks
! Pin !! Usage !! Remarks
|-
|-
| 1 || PC Position || GND || A resistor is placed, by hand, between this pin and GND after the board is manufactured.
| 1 || /CS || Chip Select
|-
|-
| 2 || PC/PS3 Position|| AVCC (atmega 27) + Winbond /WP (PIN 3) || Ties to Pin 27 of atmega16 (AVCC) and /WP of Winbond Flash
| 2 || DO || Data output
|-
|-
| 3 || PS3/DG Position|| TOSC2 of the Atmega (Pin 26)|| ???
| 3 || /WP || Write Protect
|-
|-
| 4 || DG Position|| GND || A resistor is placed, by hand, between this pin and GND after the board is manufactured.
| 4 || GND || Ground
|-
|-
 
| 5 || DIO || Serial data input/output
When in PC Mode, Pins 1 and 2 are shorted. When in PS3 Mode, Pins 2 and 3 are shorted. When in DG Mode 3 and 4 are shorted.
|-
 
| 6 || CLK || Serial Clock
 
|-
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
| 7 || /HOLD || Hold
|-
| 8 || VCC || Vcc (min 2.7-max 3.6V)
|-
|}
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps3/PS3Cobra_Payload_Reverse_Engineering"