Editing PS3Cobra Payload Reverse Engineering

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
In case you wanted a simple guide howto run Cobra without a dongle, look here: http://www.ps3hax.net/showthread.php?t=67286
[[Category:Software]][[Category:Hardware]]
 
{{Wikify}}
 
=Description=
=Description=
Dongle is DRM to make sure you have the dongle, the firmware 'special' functionality will not work without it. <br />
Dongle is DRM to make sure you have the dongle, the firmware 'special' functionality will not work without it. <br />
Hardwarewise, there are many simularities with [[ReDRM / Piracy dongles]] like PSJB2/TrueBlue
Hardwarewise, there are many simularities with [[PS3JB2_Reverse_Engineering#Hardware_Dongle|PSJB2/TrueBlue]]




Line 40: Line 37:
| 4f0a8|| bl      sub_50B44        || 48 4b 11 a9  bl 0x8000000000500250 || 48 4b 11 a9  bl 0x8000000000500250 ||
| 4f0a8|| bl      sub_50B44        || 48 4b 11 a9  bl 0x8000000000500250 || 48 4b 11 a9  bl 0x8000000000500250 ||
|-
|-
| 4fc2c || beq cr7, loc_4FC4C       || 60 00 00 00  nop   || 60 00 00 00 nop   ||
| 4fc2c|| beq cr7, loc_4FC4C       || 60 00 00 00  nop           || 60 00 00 00 nop                   ||
|-
| 505D0  || li      %r3, 1          || b      sub_5008E0 || 48 4b 04 28  b 0x80000000005009f8 ||
|-
|-
| 50B48  || patched                  || unpatched ?        ||                   ||
| 505D0 || li      %r3, 1 || b      sub_5008E0 || 48 4b 04 28  b 0x80000000005009f8 ||
|-
|-
| 572B8  || extsw  %r3, %r31        || li      %r3, 0    ||                   ||
| 50B48 || patched || unpatched ? || ||
|-
|-
| 5741C  || bl      sub_288568      || nop                ||                   ||
| 572B8 || extsw  %r3, %r31 || li      %r3, 0 || ||
|-
|-
| 1C00EC || stdu    %sp, var_150(%sp)|| b      sub_5003A8 ||                   ||
| 5741C || bl      sub_288568 || nop || ||
|-
|-
| 1C26EC || stdu    %sp, var_D0(%sp) || b      sub_500448 ||                   ||
| 1C00EC || stdu    %sp, var_150(%sp) || b      sub_5003A8 || ||
|-
|-
| 1CF8A8 || stdu    %sp, var_B0(%sp) || b      sub_5004C8 ||                   ||
| 1C26EC || stdu    %sp, var_D0(%sp) || b      sub_500448 || ||
|-
|-
| 25EC18 || bl      sub_12934        || bl      sub_500960 ||                   ||
| 1CF8A8 || stdu    %sp, var_B0(%sp) || b      sub_5004C8 || ||
|-
|-
| 271AF0 || stdu    %sp, var_B0(%sp) || b      loc_500808 || b      loc_500818 || (syscall864 / sys storage manager) <s>Again, wrong here, loc_500808 is a bad jump.</s><br>this is 1.2!
| 25EC18 || bl      sub_12934 || bl      sub_500960 ||
|-
|-
| 273F80 || stdu    %sp, var_B0(%sp) || b      sub_500878 || b      sub_500990 || (syscall867 / aim manager )<s>you have a critical mistake, sub_500878 IS WRONG, :), if you jump here you crash your lv2</s><br> YOUR CRITICAL MISTAKE WAS ONLY PUT 1.2, NOW YOU FIX IT, THANKS<br>didn't meant to be rude, sry :)
| 271AF0 || stdu    %sp, var_B0(%sp) || b      loc_500808 || b      loc_500818 || (syscall864) <s>Again, wrong here, loc_500808 is a bad jump.</s><br>this is 1.2!
|-
|-
| 29245C || stdu    %sp, var_100(%sp)|| b      sub_5005A8 ||                 ||
| 273F80 || stdu    %sp, var_B0(%sp) || b      sub_500878 || b      sub_500990 || (syscall867)<s>you have a critical mistake, sub_500878 IS WRONG, :), if you jump here you crash your lv2</s><br> YOUR CRITICAL MISTAKE WAS ONLY PUT 1.2, NOW YOU FIX IT, THANKS<br>didn't meant to be rude, sry :)
|-
|-
| 292598 || ld      %r11, stru_3403A0|| b      sub_5006D8 ||                  ||
| 29245C || stdu    %sp, var_100(%sp) || b      sub_5005A8 ||
|-
|-
| 293A18 || ld      %r9, stru_3403A0 || b      sub_500540 ||                 ||
| 292598 || ld      %r11, stru_3403A0.base_addr_toc+8 || b      sub_5006D8 || ||
|-
|-
| 296550 || stdu    %sp, var_D0(%sp) || b      sub_500640 ||                 ||(syscall606 sys_storage_async_read)
| 293A18 || ld      %r9, stru_3403A0.base_addr_toc+8 || b      sub_500540 || ||
|-
|-
| 296928 || stdu    %sp, var_D0(%sp) || b      sub_500770 ||                 ||(syscall619 sys_storage_async_send_device_command)
| 296550 || stdu    %sp, var_D0(%sp) || b      sub_500640 || ||(syscall606)
|-
|-
| 29BD48 || b      sub_11850 || b      sub_500358 ||                         ||
| 296928 || stdu    %sp, var_D0(%sp) || b      sub_500770 || ||(syscall619)
|-
|-
| 2AAFC8 || b      sub_50B48 || b      sub_5002F0 ||                         ||
| 29BD48 || b      sub_11850 || b      sub_500358 || ||
|-
|-
| 2AB3FC || unpatched        || b      sub_5002A0 ||                         || (PS2 EMU?)
| 2AAFC8 || b      sub_50B48 || b      sub_5002F0 || ||
|-
|-
| 3ba890 ||                   ||                   || 0x01000000              || patch table entry 1
| 2AB3FC || unpatched        || b      sub_5002A0 || || (PS2 EMU?)
|-
|-
|}
|}


{| class="wikitable"
Cobra 1.2
|-
!offset !! cobra 1.2 !! cobra 2.0 !! comment
|-
| 3ba890 || 0x10000000        || 0x10000000              || patch table entry 1
|-
| 490e0  ||                    || ld      r4, stru_33F628 || patch table entry 2
|-
| 490e4  ||                    || ld      r3, 0x20(r28)  || patch table entry 3
|-
| 490e8  ||                    || std    r3, 0(r4)      || patch table entry 4
|-
| 4ed18  ||                    || li      r4, 0          || patch table entry 5
|-
| 4ed1c  ||                    || stw    r4, 0(r3)      || patch table entry 6
|-
| 4ed20  ||                    || blr                    || patch table entry 7
|-
| 572b8  ||                    || li      r3, 0          || patch table entry 8
|-
| 5741c  ||                    || nop                    || patch table entry 9
|-
| 4fc2c  ||                    || nop                    || patch table entry a
|-
| 50b3c  ||                    || li      r3, 1          || patch table entry b
|-
| 50b40  ||                    || blr                    || patch table entry c
|-
|}
 
==Cobra 1.2==


   8000000000017cbc:    3c 60 80 01    lis    r3,-32767
   8000000000017cbc:    3c 60 80 01    lis    r3,-32767
Line 153: Line 118:
   80000000002aafc8:    48 25 53 28    b      0x80000000005002f0
   80000000002aafc8:    48 25 53 28    b      0x80000000005002f0


==Cobra 2.0==
Cobra 2.0
   8000000000009134:    48 4f 77 ec    b      0x8000000000500920
   8000000000009134:    48 4f 77 ec    b      0x8000000000500920


Line 197: Line 162:
   800000000029bd48:    48 26 46 20    b      0x8000000000500368
   800000000029bd48:    48 26 46 20    b      0x8000000000500368
   80000000002aafc8:    48 25 53 38    b      0x8000000000500300
   80000000002aafc8:    48 25 53 38    b      0x8000000000500300
==lv1 hvcalls==
* lv1_get_repository_node_value
* lv1_allocate_device_dma_region
* lv1_free_device_dma_region
* lv1_map_device_dma_region
* lv1_unmap_device_dma_region
* lv1_storage_read
* lv1_storage_check_async_status
==Preliminary Examination of Cobra USB Manager v1.0==
The following was acquired from a Debug/DEX unit on 3.55forDEX using the *Check debug option:
<div style="height:250px; overflow:auto"><pre>
System Version : 03.0000
---
Log
---
[Info] Checking HDD Game.(HG,"/dev_hdd0/game/CBUM01234")
[Debug] Checking System File /dev_hdd0/game/CBUM01234/PARAM.SFO.
[Info] TITLE_ID = CBUM01234.
[Info] PARENTAL_LEVEL = 0/--/--/--/--/--/--.
[Info] ATTRIBUTE = 0x0.
[Info] RESOLUTION = 0x3F, 1080/720/576/576(16:9)/480/480(16:9).
[Info] SOUND_FORMAT = 0x117, 7.1LPCM/5.1LPCM/2LPCM/5.1Dolby.
[Info] VERSION = 01.00.
[Info] PS3_SYSTEM_VER = 03.0000.
[Info] APP_VER = 01.00.
[Debug] TITLE_ID = CBUM01234.
[Warn] PARAM.SFO: Param PARENTAL_LEVEL: Currently being rated.
[Debug] PARENTAL_LEVEL = 0/--/--/--/--/--/--.
[Debug] ATTRIBUTE = 0x0.
[Error] PARAM.SFO: Param LICENSE: Unexpected val_size.
[Error] PARAM.SFO: Param LICENSE: Unexpected value.
[Debug] RESOLUTION = 0x3F, 1080/720/576/576(16:9)/480/480(16:9).
[Debug] SOUND_FORMAT = 0x117, 7.1LPCM/5.1LPCM/2LPCM/5.1Dolby.
[Debug] VERSION = 01.00.
[Debug] PS3_SYSTEM_VER = 03.0000.
[Debug] APP_VER = 01.00.
[Debug] PS3LOGO.DAT: Logo.
[Debug] ICON0.PNG: 320x176/24bit.
[Info] EBOOT.BIN: PPU SELF file, SDK version = 03.0000.
[Debug] EBOOT.BIN: 300.001 (PPU) : crt0
[Debug] EBOOT.BIN: 300.001 (PPU) : crt1
[Debug] EBOOT.BIN: 192.001 (PPU) : libftp
[Error] EBOOT.BIN: Debug library linked (libftp).
[Error] EBOOT.BIN: Version conflict error (libftp, 192.001).
[Debug] EBOOT.BIN: 300.001 (PPU) : libnet_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libnetctl_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libpngdec_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libdbgfont_gcm
[Error] EBOOT.BIN: Debug library linked (libdbgfont_gcm).
[Debug] EBOOT.BIN: 300.001 (PPU) : libgcm_cmd
[Debug] EBOOT.BIN: 300.001 (PPU) : libgcm_sys_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libio_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libsysmodule_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libsysutil_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libfs_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libl10n_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libfontGcm
[Debug] EBOOT.BIN: 300.001 (PPU) : libfontFT_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libfont_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : libstdc++
[Debug] EBOOT.BIN: 300.001 (PPU) : libc
[Debug] EBOOT.BIN: 300.001 (PPU) : liblv2_stub
</pre></div><br /><br />
= Mountpoints =
<table width="100%"><tr>
<td with="50%">
Intern (PS3):
* ''/dev_hdd0/GAMES''
* /dev_hdd0/BDRIPS
* /dev_hdd0/GAMEZ
* ''/dev_hdd0/PS3ISO'' <- Only for Backups in ISO Format.
</td><td with="50%">
Extern (PS3):
* ''/dev_usb/GAMES''
* /dev_usb/GAMEZ
* ''/dev_usb/PS3ISO'' <-  <- Only for Backups in ISO Format.
</td></tr>
<tr><td with="50%">
Intern (PS2):
* ''/dev_hdd0/PS2ISO''
</td><td with="50%">
Extern (PS2):
* ''/dev_usb/PS2ISO'' <-  <- Only for Backups, not for loading.
</td></tr>
<tr><td with="50%">
Intern (PS1):
* ''/dev_hdd0/PSXISO''
</td><td with="50%">
Extern (PS1):
* ''/dev_usb/PSXISO''
</td></tr>
<tr><td with="50%">
Intern (PSP):
* ''/dev_hdd0/PSPISO''
</td><td with="50%">
Extern (PSP):
* ''/dev_usb/PSPISO''
</td></tr>
<tr><td with="50%">
Intern (BluRay):
* ''/dev_hdd0/BDISO''
</td><td with="50%">
Extern (BluRay):
* ''/dev_usb/BDISO''
</td></tr>
<tr><td with="50%">
Intern (DVD):
* ''/dev_hdd0/DVDISO''
</td><td with="50%">
Extern (DVD):
* ''/dev_usb/DVDISO''
</td></tr></table>


= Hardware Dongle =
= Hardware Dongle =


== Dongle 1.0 ==
== Dongle 1.0 ==
<table width="100%" align="left"><tr><td align="left">
<table width="100%" align="left"><tr><td align="left">[[File:CobraPCB - TOP.jpg|200px|thumb|left|PS3Cobra - TOP]]</td></tr></table>
[[File:CobraPCB - TOP.jpg|200px|thumb|left|PS3Cobra - TOP]]</td><td align="left">[[File:CobraPCB - BACK.jpg|200px|thumb|left|PS3Cobra - BACK]]</td></tr></table>
 
<Gallery>
File:Cobra USB SWITCH.jpg|Cobra USB - SWITCH
File:Cobra USB OPEN1.jpg|Cobra USB - OPEN 1
File:Cobra USB OPEN2.jpg|Cobra USB - OPEN 2
File:Cobra USB TOP1.jpg|Cobra USB - TOP 1
File:Cobra USB TOP2.jpg|Cobra USB - TOP 2
File:Cobra USB BACK.jpg|Cobra USB - BACK
</Gallery>


=== Components ===
=== Components ===
Line 346: Line 183:
Datasheets and usermanuals: http://www.actel.com/products/pa3/docs.aspx#ds <br />
Datasheets and usermanuals: http://www.actel.com/products/pa3/docs.aspx#ds <br />
Familyroot: http://www.actel.com/products/pa3/ <br />
Familyroot: http://www.actel.com/products/pa3/ <br />
Usage Guide: http://www.embedtools.com/pro_kaifa/SOPC_%20EDA/ProASIC3/PA3_E_IO_AN.pdf


===== Pinout A3P060 VQ100 =====
===== Pinout A3P060 VQ100 =====
Line 563: Line 399:


==== 12.000 MHz Crystal ====
==== 12.000 MHz Crystal ====
Y2 <br />
Y2? <br />
SCK/CLK for Atmel/Winbond <br />
CLK for Atmel <br />


==== AMS1117 3.3 1032 - Low Dropout Linear Regulator ====
==== AMS1117 3.3 1032 - Low Dropout Linear Regulator ====
U3 <br />
U3 <br />
Datasheet:  
Datasheet: http://www.sltdigital.com/product/product_pdf/AMS1117.pdf / http://home1.cyber-labo.co.jp/board/goods/pdf/AMS1117.pdf <br />
* https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Datasheets/AMS1117-.pdf
[[:File:AMS1117 - SOT-223.png]]<br />
* https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Datasheets/AMS1117.pdf<!--// http://www.sltdigital.com/product/product_pdf/AMS1117.pdf / http://home1.cyber-labo.co.jp/board/goods/pdf/AMS1117.pdf //--> <br />
<gallery>File:AMS1117 - SOT-223.png</gallery>


====  A 47 (F51C 5pin Multilayer Ceramic Capacitor : U4) ====
====  A 47 (unreferenced 5pin IC : U4) ====
<div style="float:right">[[File:SOT5.PNG|200px|Thumb|Left|F51C 5pin Multilayer Ceramic Capacitor]]<br /></div>
U4 <br />
<div style="height:300px; overflow:auto">
A 47 <!--// 51c or s1c ? - hard to see without magnifier //--> <br />
Capacitance value untested, likely one of these ([http://www.mouser.com/Passive-Components/Capacitors/_/N-5g7r?P=1z0z7ym&Keyword=f51C&Ns=Pricing|0&FS=True from Mouser]) <!--// F51C -- verified with magnifier //-->  
[[:File:SOT5.PNG]]<br />
</div>
<br />


==== Atmel ATmega 16A (16MHz AVR - 16KB flash - USB stack + DFU) ====
==== Atmel ATmega 16A (16MHz AVR - 16KB flash - USB stack + DFU) ====
Line 590: Line 424:
! Pin !! Function !! Notes
! Pin !! Function !! Notes
|-
|-
| 1 || (MOSI) PB5 || Tied to DI (Pin 5) on the Winbond Flash
| 1 || (MOSI) PB5 ||
|-
|-
| 2 || (MISO) PB6 || Tied to DO (Pin 2) on the Winbond Flash
| 2 || (MISO) PB6 ||  
|-
|-
| 3 || (SCK) PB7 || Provides CLK to The Winbond Flash
| 3 || (SCK) PB7 ||  
|-
|-
| 4 || RESET ||  
| 4 || RESET ||  
Line 602: Line 436:
| 6 || GND ||  
| 6 || GND ||  
|-
|-
| 7 || XTAL2 || Y2
| 7 || XTAL2 ||  
|-
|-
| 8 || XTAL1 || Y2
| 8 || XTAL1 ||  
|-
|-
| 9 || (RXD) PD0 || Actel IO92RSB2 (pin 30)
| 9 || (RXD) PD0 ||  
|-
|-
| 10 || (TXD) PD1 || Actel IO92RSB2 (pin 29)
| 10 || (TXD) PD1 ||  
|-
|-
| 11 || (INT0) PD2 ||  
| 11 || (INT0) PD2 ||  
Line 636: Line 470:
| 23 || (TDO) PC4 ||  
| 23 || (TDO) PC4 ||  
|-
|-
| 24 || (TDI) PC5 || Tied to 3v3 Voltage regulator VCC
| 24 || (TDI) PC5 ||  
|-
|-
| 25 || (TOSC1) PC6 ||  
| 25 || (TOSC1) PC6 ||  
Line 642: Line 476:
| 26 || (TOSC2) PC7 ||  
| 26 || (TOSC2) PC7 ||  
|-
|-
| 27 || AVCC || Tied to 3v3 Voltage regulator VCC
| 27 || AVCC ||  
|-
|-
| 28 || GND ||  
| 28 || GND ||  
Line 664: Line 498:
| 37 || (ADC0) PA0 ||  
| 37 || (ADC0) PA0 ||  
|-
|-
| 38 || VCC || Tied to 3v3 Voltage regulator VCC
| 38 || VCC ||  
|-
|-
| 39 || GND ||  
| 39 || GND ||  
Line 680: Line 514:
|}
|}
</div>
</div>


==== Winbond 25X16AVSIG (SPI Flash 16Mbit) ====
==== Winbond 25X16AVSIG (SPI Flash 16Mbit) ====
The IC designation on the board of the cobra dongle is U1.
<div style="float:right">[[File:W25X16A - SOIC-8.png|200px|thumb|left|8-pin TSSOP<br />Winbond 25X16A<br />SOIC-8 pinout]]</div>
{{Template:Winbond 25X16AVSIG}}
U1 <br />
 
<pre>W - Winbond
On the Cobra Dongle, pin 3 of the EEPROM is tied to VCC. Lifting this Pin from the board and tieing it to ground '''should''' prevent the flash from being erased.
25X - SPI Flash with 4KB sectors/64Kbyte blocks, dual output
 
16A - 16Mbit / 2M-byte
=====Roles=====
V - Supply Voltage 2.7 to 3.6V
Drives data to and from the Winbond flash chip.
S - Package Type : 8pin SOIC 150-mil
 
I - Temperature Range: Industrial (-40'C ~ 85'C)
====Cobra Test Points====
G - Environment: Green Package (Lead-free, RoHS Compliant, Halogen-free (TBBA), Antimony-Oxie-free)</pre>
<div style="float:right">[[File:Cobra-TESTPOINTS.jpg|200px|thumb|left|Cobra - Testpoints to Winbond SPI flash]]</div><BR/>
datasheet: [http://www.multiupload.com/P2833U5SOW W25X16A.pdf (1.3 MB)] <br />
 
Note: can use [http://blog.hodgepig.org/busninja/ Bus Ninja] or [http://flashrom.org/Bus_Pirate Bus Pirate] and [http://flashrom.org/Flashrom FlashROM] - <abbr title="In-System Programming (ISP)">ISP</abbr> is possible, so long as no other devices on the SPI bus are trying to access the device (in that case, you might want to cut Vcc to the FPGA or the regulator for it).
There are test points that map out the Winbond flash shown in the diagram to the right.
 
==== DG/PS3/PC Selection switch ====
 
There is a switch that switched between Downgrade, PC and PS3 modes of the dongle.
 
When facing the switch, with the USB Plug to the left the pins are labeled 1 to 4 in the table below:


{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"  
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"  
|- bgcolor="#cccccc"
|- bgcolor="#cccccc"
! Pin !! Usage !! Connects to !! Remarks
! Pin !! Usage !! I/O !! Remarks
|-
| 1 || /CS || I || Chip Select (high=deselect, low=select)
|-
|-
| 1 || PC Position || GND || A resistor is placed, by hand, between this pin and GND after the board is manufactured.
| 2 || DO || O || Data output
|-
|-
| 2 || PC/PS3 Position|| AVCC (atmega 27) + Winbond /WP (PIN 3) || Ties to Pin 27 of atmega16 (AVCC) and /WP of Winbond Flash
| 3 || /WP || I || Write Protect (active low)
|-
|-
| 3 || PS3/DG Position|| TOSC2 of the Atmega (Pin 26)|| ???
| 4 || GND || || Ground
|-
|-
| 4 || DG Position|| GND || A resistor is placed, by hand, between this pin and GND after the board is manufactured.
| 5 || DIO || I/O || Serial data input/output
|-
|-
 
| 6 || CLK || I || Serial Clock
When in PC Mode, Pins 1 and 2 are shorted. When in PS3 Mode, Pins 2 and 3 are shorted. When in DG Mode 3 and 4 are shorted.
|-
 
| 7 || /HOLD || I || Hold (high=normal/resume, low=hold/pause)
 
|-
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
| 8 || VCC ||  || Vcc (min 2.7-max 3.6V @ Fr0 75MHz / min 3.0-max 3.6V @ Fastread Fr1 100MHz)
|-
|}
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps3/PS3Cobra_Payload_Reverse_Engineering"