Editing PS3Cobra Payload Reverse Engineering

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
In case you wanted a simple guide howto run Cobra without a dongle, look here: http://www.ps3hax.net/showthread.php?t=67286
[[Category:Software]][[Category:Hardware]]
 
{{Wikify}}
 
=Description=
=Description=
Dongle is DRM to make sure you have the dongle, the firmware 'special' functionality will not work without it. <br />
Dongle is DRM to make sure you have the dongle, the firmware 'special' functionality will not work without it. <br />
Hardwarewise, there are many simularities with [[ReDRM / Piracy dongles]] like PSJB2/TrueBlue
Hardwarewise, there are many simularities with [[PS3JB2_Reverse_Engineering#Hardware_Dongle|PSJB2/TrueBlue]]




Line 58: Line 55:
| 25EC18 || bl      sub_12934        || bl      sub_500960 ||                    ||
| 25EC18 || bl      sub_12934        || bl      sub_500960 ||                    ||
|-
|-
| 271AF0 || stdu    %sp, var_B0(%sp) || b      loc_500808 || b      loc_500818 || (syscall864 / sys storage manager) <s>Again, wrong here, loc_500808 is a bad jump.</s><br>this is 1.2!
| 271AF0 || stdu    %sp, var_B0(%sp) || b      loc_500808 || b      loc_500818 || (syscall864) <s>Again, wrong here, loc_500808 is a bad jump.</s><br>this is 1.2!
|-
|-
| 273F80 || stdu    %sp, var_B0(%sp) || b      sub_500878 || b      sub_500990 || (syscall867 / aim manager )<s>you have a critical mistake, sub_500878 IS WRONG, :), if you jump here you crash your lv2</s><br> YOUR CRITICAL MISTAKE WAS ONLY PUT 1.2, NOW YOU FIX IT, THANKS<br>didn't meant to be rude, sry :)
| 273F80 || stdu    %sp, var_B0(%sp) || b      sub_500878 || b      sub_500990 || (syscall867)<s>you have a critical mistake, sub_500878 IS WRONG, :), if you jump here you crash your lv2</s><br> YOUR CRITICAL MISTAKE WAS ONLY PUT 1.2, NOW YOU FIX IT, THANKS<br>didn't meant to be rude, sry :)
|-
|-
| 29245C || stdu    %sp, var_100(%sp)|| b      sub_5005A8 ||                  ||
| 29245C || stdu    %sp, var_100(%sp)|| b      sub_5005A8 ||                  ||
Line 68: Line 65:
| 293A18 || ld      %r9, stru_3403A0 || b      sub_500540 ||                  ||
| 293A18 || ld      %r9, stru_3403A0 || b      sub_500540 ||                  ||
|-
|-
| 296550 || stdu    %sp, var_D0(%sp) || b      sub_500640 ||                  ||(syscall606 sys_storage_async_read)
| 296550 || stdu    %sp, var_D0(%sp) || b      sub_500640 ||                  ||(syscall606)
|-
|-
| 296928 || stdu    %sp, var_D0(%sp) || b      sub_500770 ||                  ||(syscall619 sys_storage_async_send_device_command)
| 296928 || stdu    %sp, var_D0(%sp) || b      sub_500770 ||                  ||(syscall619)
|-
|-
| 29BD48 || b      sub_11850 || b      sub_500358 ||                        ||
| 29BD48 || b      sub_11850 || b      sub_500358 ||                        ||
Line 208: Line 205:
* lv1_storage_check_async_status
* lv1_storage_check_async_status


==Preliminary Examination of Cobra USB Manager v1.0==
==Preliminary Examination of Cobra USB Manager v1.0


The following was acquired from a Debug/DEX unit on 3.55forDEX using the *Check debug option:
The following was acquired from a Debug/DEX unit on 3.55forDEX using the *Check debug option:
<div style="height:250px; overflow:auto"><pre>
 
System Version : 03.0000
System Version : 03.0000


Line 264: Line 261:
[Debug] EBOOT.BIN: 300.001 (PPU) : libc
[Debug] EBOOT.BIN: 300.001 (PPU) : libc
[Debug] EBOOT.BIN: 300.001 (PPU) : liblv2_stub
[Debug] EBOOT.BIN: 300.001 (PPU) : liblv2_stub
</pre></div><br /><br />


= Mountpoints =
 
<table width="100%"><tr>
<td with="50%">
Intern (PS3):
* ''/dev_hdd0/GAMES''
* /dev_hdd0/BDRIPS
* /dev_hdd0/GAMEZ
* ''/dev_hdd0/PS3ISO'' <- Only for Backups in ISO Format.
</td><td with="50%">
Extern (PS3):
* ''/dev_usb/GAMES''
* /dev_usb/GAMEZ
* ''/dev_usb/PS3ISO'' <-  <- Only for Backups in ISO Format.
</td></tr>
<tr><td with="50%">
Intern (PS2):
* ''/dev_hdd0/PS2ISO''
</td><td with="50%">
Extern (PS2):
* ''/dev_usb/PS2ISO'' <-  <- Only for Backups, not for loading.
</td></tr>
<tr><td with="50%">
Intern (PS1):
* ''/dev_hdd0/PSXISO''
</td><td with="50%">
Extern (PS1):
* ''/dev_usb/PSXISO''
</td></tr>
<tr><td with="50%">
Intern (PSP):
* ''/dev_hdd0/PSPISO''
</td><td with="50%">
Extern (PSP):
* ''/dev_usb/PSPISO''
</td></tr>
<tr><td with="50%">
Intern (BluRay):
* ''/dev_hdd0/BDISO''
</td><td with="50%">
Extern (BluRay):
* ''/dev_usb/BDISO''
</td></tr>
<tr><td with="50%">
Intern (DVD):
* ''/dev_hdd0/DVDISO''
</td><td with="50%">
Extern (DVD):
* ''/dev_usb/DVDISO''
</td></tr></table>


= Hardware Dongle =
= Hardware Dongle =


== Dongle 1.0 ==
== Dongle 1.0 ==
<table width="100%" align="left"><tr><td align="left">
<table width="100%" align="left"><tr><td align="left">[[File:CobraPCB - TOP.jpg|200px|thumb|left|PS3Cobra - TOP]]</td></tr></table>
[[File:CobraPCB - TOP.jpg|200px|thumb|left|PS3Cobra - TOP]]</td><td align="left">[[File:CobraPCB - BACK.jpg|200px|thumb|left|PS3Cobra - BACK]]</td></tr></table>
 
<Gallery>
File:Cobra USB SWITCH.jpg|Cobra USB - SWITCH
File:Cobra USB OPEN1.jpg|Cobra USB - OPEN 1
File:Cobra USB OPEN2.jpg|Cobra USB - OPEN 2
File:Cobra USB TOP1.jpg|Cobra USB - TOP 1
File:Cobra USB TOP2.jpg|Cobra USB - TOP 2
File:Cobra USB BACK.jpg|Cobra USB - BACK
</Gallery>


=== Components ===
=== Components ===
Line 346: Line 284:
Datasheets and usermanuals: http://www.actel.com/products/pa3/docs.aspx#ds <br />
Datasheets and usermanuals: http://www.actel.com/products/pa3/docs.aspx#ds <br />
Familyroot: http://www.actel.com/products/pa3/ <br />
Familyroot: http://www.actel.com/products/pa3/ <br />
Usage Guide: http://www.embedtools.com/pro_kaifa/SOPC_%20EDA/ProASIC3/PA3_E_IO_AN.pdf


===== Pinout A3P060 VQ100 =====
===== Pinout A3P060 VQ100 =====
Line 563: Line 500:


==== 12.000 MHz Crystal ====
==== 12.000 MHz Crystal ====
Y2 <br />
Y2? <br />
SCK/CLK for Atmel/Winbond <br />
CLK for Atmel <br />


==== AMS1117 3.3 1032 - Low Dropout Linear Regulator ====
==== AMS1117 3.3 1032 - Low Dropout Linear Regulator ====
U3 <br />
U3 <br />
Datasheet:  
Datasheet: http://www.sltdigital.com/product/product_pdf/AMS1117.pdf / http://home1.cyber-labo.co.jp/board/goods/pdf/AMS1117.pdf <br />
* https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Datasheets/AMS1117-.pdf
[[:File:AMS1117 - SOT-223.png]]<br />
* https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Datasheets/AMS1117.pdf<!--// http://www.sltdigital.com/product/product_pdf/AMS1117.pdf / http://home1.cyber-labo.co.jp/board/goods/pdf/AMS1117.pdf //--> <br />
<gallery>File:AMS1117 - SOT-223.png</gallery>


====  A 47 (F51C 5pin Multilayer Ceramic Capacitor : U4) ====
====  A 47 (unreferenced 5pin IC : U4) ====
<div style="float:right">[[File:SOT5.PNG|200px|Thumb|Left|F51C 5pin Multilayer Ceramic Capacitor]]<br /></div>
U4 <br />
<div style="height:300px; overflow:auto">
A 47 <!--// 51c or s1c ? - hard to see without magnifier //--> <br />
Capacitance value untested, likely one of these ([http://www.mouser.com/Passive-Components/Capacitors/_/N-5g7r?P=1z0z7ym&Keyword=f51C&Ns=Pricing|0&FS=True from Mouser]) <!--// F51C -- verified with magnifier //-->  
[[:File:SOT5.PNG]]<br />
</div>
<br />


==== Atmel ATmega 16A (16MHz AVR - 16KB flash - USB stack + DFU) ====
==== Atmel ATmega 16A (16MHz AVR - 16KB flash - USB stack + DFU) ====
Line 590: Line 525:
! Pin !! Function !! Notes
! Pin !! Function !! Notes
|-
|-
| 1 || (MOSI) PB5 || Tied to DI (Pin 5) on the Winbond Flash
| 1 || (MOSI) PB5 ||
|-
|-
| 2 || (MISO) PB6 || Tied to DO (Pin 2) on the Winbond Flash
| 2 || (MISO) PB6 ||  
|-
|-
| 3 || (SCK) PB7 || Provides CLK to The Winbond Flash
| 3 || (SCK) PB7 ||  
|-
|-
| 4 || RESET ||  
| 4 || RESET ||  
Line 602: Line 537:
| 6 || GND ||  
| 6 || GND ||  
|-
|-
| 7 || XTAL2 || Y2
| 7 || XTAL2 ||  
|-
|-
| 8 || XTAL1 || Y2
| 8 || XTAL1 ||  
|-
|-
| 9 || (RXD) PD0 || Actel IO92RSB2 (pin 30)
| 9 || (RXD) PD0 ||  
|-
|-
| 10 || (TXD) PD1 || Actel IO92RSB2 (pin 29)
| 10 || (TXD) PD1 ||  
|-
|-
| 11 || (INT0) PD2 ||  
| 11 || (INT0) PD2 ||  
Line 636: Line 571:
| 23 || (TDO) PC4 ||  
| 23 || (TDO) PC4 ||  
|-
|-
| 24 || (TDI) PC5 || Tied to 3v3 Voltage regulator VCC
| 24 || (TDI) PC5 ||  
|-
|-
| 25 || (TOSC1) PC6 ||  
| 25 || (TOSC1) PC6 ||  
Line 642: Line 577:
| 26 || (TOSC2) PC7 ||  
| 26 || (TOSC2) PC7 ||  
|-
|-
| 27 || AVCC || Tied to 3v3 Voltage regulator VCC
| 27 || AVCC ||  
|-
|-
| 28 || GND ||  
| 28 || GND ||  
Line 664: Line 599:
| 37 || (ADC0) PA0 ||  
| 37 || (ADC0) PA0 ||  
|-
|-
| 38 || VCC || Tied to 3v3 Voltage regulator VCC
| 38 || VCC ||  
|-
|-
| 39 || GND ||  
| 39 || GND ||  
Line 680: Line 615:
|}
|}
</div>
</div>


==== Winbond 25X16AVSIG (SPI Flash 16Mbit) ====
==== Winbond 25X16AVSIG (SPI Flash 16Mbit) ====
The IC designation on the board of the cobra dongle is U1.
<div style="float:right">[[File:W25X16A - SOIC-8.png|200px|thumb|left|8-pin TSSOP<br />Winbond 25X16A<br />SOIC-8 pinout]]</div>
{{Template:Winbond 25X16AVSIG}}
U1 <br />
 
<pre>W - Winbond
On the Cobra Dongle, pin 3 of the EEPROM is tied to VCC. Lifting this Pin from the board and tieing it to ground '''should''' prevent the flash from being erased.
25X - SPI Flash with 4KB sectors/64Kbyte blocks, dual output
 
16A - 16Mbit / 2M-byte
=====Roles=====
V - Supply Voltage 2.7 to 3.6V
Drives data to and from the Winbond flash chip.
S - Package Type : 8pin SOIC 150-mil
 
I - Temperature Range: Industrial (-40'C ~ 85'C)
====Cobra Test Points====
G - Environment: Green Package (Lead-free, RoHS Compliant, Halogen-free (TBBA), Antimony-Oxie-free)</pre>
<div style="float:right">[[File:Cobra-TESTPOINTS.jpg|200px|thumb|left|Cobra - Testpoints to Winbond SPI flash]]</div><BR/>
datasheet: [http://www.multiupload.com/P2833U5SOW W25X16A.pdf (1.3 MB)] <br />
 
Note: can use [http://blog.hodgepig.org/busninja/ Bus Ninja] or [http://flashrom.org/Bus_Pirate Bus Pirate] and [http://flashrom.org/Flashrom FlashROM] - <abbr title="In-System Programming (ISP)">ISP</abbr> is possible, so long as no other devices on the SPI bus are trying to access the device (in that case, you might want to cut Vcc to the FPGA or the regulator for it).
There are test points that map out the Winbond flash shown in the diagram to the right.
 
==== DG/PS3/PC Selection switch ====
 
There is a switch that switched between Downgrade, PC and PS3 modes of the dongle.
 
When facing the switch, with the USB Plug to the left the pins are labeled 1 to 4 in the table below:


{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"  
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"  
|- bgcolor="#cccccc"
|- bgcolor="#cccccc"
! Pin !! Usage !! Connects to !! Remarks
! Pin !! Usage !! I/O !! Remarks
|-
| 1 || /CS || I || Chip Select (high=deselect, low=select)
|-
|-
| 1 || PC Position || GND || A resistor is placed, by hand, between this pin and GND after the board is manufactured.
| 2 || DO || O || Data output
|-
|-
| 2 || PC/PS3 Position|| AVCC (atmega 27) + Winbond /WP (PIN 3) || Ties to Pin 27 of atmega16 (AVCC) and /WP of Winbond Flash
| 3 || /WP || I || Write Protect (active low)
|-
|-
| 3 || PS3/DG Position|| TOSC2 of the Atmega (Pin 26)|| ???
| 4 || GND || || Ground
|-
|-
| 4 || DG Position|| GND || A resistor is placed, by hand, between this pin and GND after the board is manufactured.
| 5 || DIO || I/O || Serial data input/output
|-
|-
 
| 6 || CLK || I || Serial Clock
When in PC Mode, Pins 1 and 2 are shorted. When in PS3 Mode, Pins 2 and 3 are shorted. When in DG Mode 3 and 4 are shorted.
|-
 
| 7 || /HOLD || I || Hold (high=normal/resume, low=hold/pause)
 
|-
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
| 8 || VCC ||  || Vcc (min 2.7-max 3.6V @ Fr0 75MHz / min 3.0-max 3.6V @ Fastread Fr1 100MHz)
|-
|}
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps3/PS3Cobra_Payload_Reverse_Engineering"