Editing PS3Cobra Payload Reverse Engineering

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
In case you wanted a simple guide howto run Cobra without a dongle, look here: http://www.ps3hax.net/showthread.php?t=67286
[[Category:Software]][[Category:Hardware]]
 
{{Wikify}}
 
=Description=
=Description=
Dongle is DRM to make sure you have the dongle, the firmware 'special' functionality will not work without it. <br />
Dongle is DRM to make sure you have the dongle, the firmware 'special' functionality will not work without it. <br />
Hardwarewise, there are many simularities with [[ReDRM / Piracy dongles]] like PSJB2/TrueBlue
Hardwarewise, there are many simularities with [[PS3JB2_Reverse_Engineering#Hardware_Dongle|PSJB2/TrueBlue]]




Line 58: Line 55:
| 25EC18 || bl      sub_12934        || bl      sub_500960 ||                    ||
| 25EC18 || bl      sub_12934        || bl      sub_500960 ||                    ||
|-
|-
| 271AF0 || stdu    %sp, var_B0(%sp) || b      loc_500808 || b      loc_500818 || (syscall864 / sys storage manager) <s>Again, wrong here, loc_500808 is a bad jump.</s><br>this is 1.2!
| 271AF0 || stdu    %sp, var_B0(%sp) || b      loc_500808 || b      loc_500818 || (syscall864) <s>Again, wrong here, loc_500808 is a bad jump.</s><br>this is 1.2!
|-
|-
| 273F80 || stdu    %sp, var_B0(%sp) || b      sub_500878 || b      sub_500990 || (syscall867 / aim manager )<s>you have a critical mistake, sub_500878 IS WRONG, :), if you jump here you crash your lv2</s><br> YOUR CRITICAL MISTAKE WAS ONLY PUT 1.2, NOW YOU FIX IT, THANKS<br>didn't meant to be rude, sry :)
| 273F80 || stdu    %sp, var_B0(%sp) || b      sub_500878 || b      sub_500990 || (syscall867)<s>you have a critical mistake, sub_500878 IS WRONG, :), if you jump here you crash your lv2</s><br> YOUR CRITICAL MISTAKE WAS ONLY PUT 1.2, NOW YOU FIX IT, THANKS<br>didn't meant to be rude, sry :)
|-
|-
| 29245C || stdu    %sp, var_100(%sp)|| b      sub_5005A8 ||                  ||
| 29245C || stdu    %sp, var_100(%sp)|| b      sub_5005A8 ||                  ||
Line 68: Line 65:
| 293A18 || ld      %r9, stru_3403A0 || b      sub_500540 ||                  ||
| 293A18 || ld      %r9, stru_3403A0 || b      sub_500540 ||                  ||
|-
|-
| 296550 || stdu    %sp, var_D0(%sp) || b      sub_500640 ||                  ||(syscall606 sys_storage_async_read)
| 296550 || stdu    %sp, var_D0(%sp) || b      sub_500640 ||                  ||(syscall606)
|-
|-
| 296928 || stdu    %sp, var_D0(%sp) || b      sub_500770 ||                  ||(syscall619 sys_storage_async_send_device_command)
| 296928 || stdu    %sp, var_D0(%sp) || b      sub_500770 ||                  ||(syscall619)
|-
|-
| 29BD48 || b      sub_11850 || b      sub_500358 ||                        ||
| 29BD48 || b      sub_11850 || b      sub_500358 ||                        ||
Line 293: Line 290:
Extern (PS1):
Extern (PS1):
* ''/dev_usb/PSXISO''
* ''/dev_usb/PSXISO''
</td></tr>
<tr><td with="50%">
Intern (PSP):
* ''/dev_hdd0/PSPISO''
</td><td with="50%">
Extern (PSP):
* ''/dev_usb/PSPISO''
</td></tr>
</td></tr>
<tr><td with="50%">
<tr><td with="50%">
Line 346: Line 336:
Datasheets and usermanuals: http://www.actel.com/products/pa3/docs.aspx#ds <br />
Datasheets and usermanuals: http://www.actel.com/products/pa3/docs.aspx#ds <br />
Familyroot: http://www.actel.com/products/pa3/ <br />
Familyroot: http://www.actel.com/products/pa3/ <br />
Usage Guide: http://www.embedtools.com/pro_kaifa/SOPC_%20EDA/ProASIC3/PA3_E_IO_AN.pdf


===== Pinout A3P060 VQ100 =====
===== Pinout A3P060 VQ100 =====
Line 563: Line 552:


==== 12.000 MHz Crystal ====
==== 12.000 MHz Crystal ====
Y2 <br />
Y2? <br />
SCK/CLK for Atmel/Winbond <br />
CLK for Atmel <br />


==== AMS1117 3.3 1032 - Low Dropout Linear Regulator ====
==== AMS1117 3.3 1032 - Low Dropout Linear Regulator ====
U3 <br />
U3 <br />
Datasheet:  
Datasheet: http://www.sltdigital.com/product/product_pdf/AMS1117.pdf / http://home1.cyber-labo.co.jp/board/goods/pdf/AMS1117.pdf <br />
* https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Datasheets/AMS1117-.pdf
[[:File:AMS1117 - SOT-223.png]]<br />
* https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Datasheets/AMS1117.pdf<!--// http://www.sltdigital.com/product/product_pdf/AMS1117.pdf / http://home1.cyber-labo.co.jp/board/goods/pdf/AMS1117.pdf //--> <br />
<gallery>File:AMS1117 - SOT-223.png</gallery>


====  A 47 (F51C 5pin Multilayer Ceramic Capacitor : U4) ====
====  A 47 (unreferenced 5pin IC : U4) ====
<div style="float:right">[[File:SOT5.PNG|200px|Thumb|Left|F51C 5pin Multilayer Ceramic Capacitor]]<br /></div>
U4 <br />
<div style="height:300px; overflow:auto">
A 47 <!--// 51c or s1c ? - hard to see without magnifier //--> <br />
Capacitance value untested, likely one of these ([http://www.mouser.com/Passive-Components/Capacitors/_/N-5g7r?P=1z0z7ym&Keyword=f51C&Ns=Pricing|0&FS=True from Mouser]) <!--// F51C -- verified with magnifier //-->  
[[:File:SOT5.PNG]]<br />
</div>
<br />


==== Atmel ATmega 16A (16MHz AVR - 16KB flash - USB stack + DFU) ====
==== Atmel ATmega 16A (16MHz AVR - 16KB flash - USB stack + DFU) ====
Line 590: Line 577:
! Pin !! Function !! Notes
! Pin !! Function !! Notes
|-
|-
| 1 || (MOSI) PB5 || Tied to DI (Pin 5) on the Winbond Flash
| 1 || (MOSI) PB5 ||
|-
|-
| 2 || (MISO) PB6 || Tied to DO (Pin 2) on the Winbond Flash
| 2 || (MISO) PB6 ||  
|-
|-
| 3 || (SCK) PB7 || Provides CLK to The Winbond Flash
| 3 || (SCK) PB7 ||  
|-
|-
| 4 || RESET ||  
| 4 || RESET ||  
Line 602: Line 589:
| 6 || GND ||  
| 6 || GND ||  
|-
|-
| 7 || XTAL2 || Y2
| 7 || XTAL2 ||  
|-
|-
| 8 || XTAL1 || Y2
| 8 || XTAL1 ||  
|-
|-
| 9 || (RXD) PD0 || Actel IO92RSB2 (pin 30)
| 9 || (RXD) PD0 ||  
|-
|-
| 10 || (TXD) PD1 || Actel IO92RSB2 (pin 29)
| 10 || (TXD) PD1 ||  
|-
|-
| 11 || (INT0) PD2 ||  
| 11 || (INT0) PD2 ||  
Line 636: Line 623:
| 23 || (TDO) PC4 ||  
| 23 || (TDO) PC4 ||  
|-
|-
| 24 || (TDI) PC5 || Tied to 3v3 Voltage regulator VCC
| 24 || (TDI) PC5 ||  
|-
|-
| 25 || (TOSC1) PC6 ||  
| 25 || (TOSC1) PC6 ||  
Line 642: Line 629:
| 26 || (TOSC2) PC7 ||  
| 26 || (TOSC2) PC7 ||  
|-
|-
| 27 || AVCC || Tied to 3v3 Voltage regulator VCC
| 27 || AVCC ||  
|-
|-
| 28 || GND ||  
| 28 || GND ||  
Line 664: Line 651:
| 37 || (ADC0) PA0 ||  
| 37 || (ADC0) PA0 ||  
|-
|-
| 38 || VCC || Tied to 3v3 Voltage regulator VCC
| 38 || VCC ||  
|-
|-
| 39 || GND ||  
| 39 || GND ||  
Line 680: Line 667:
|}
|}
</div>
</div>


==== Winbond 25X16AVSIG (SPI Flash 16Mbit) ====
==== Winbond 25X16AVSIG (SPI Flash 16Mbit) ====
The IC designation on the board of the cobra dongle is U1.
<div style="float:right">[[File:W25X16A - SOIC-8.png|200px|thumb|left|8-pin TSSOP<br />Winbond 25X16A<br />SOIC-8 pinout]]</div>
{{Template:Winbond 25X16AVSIG}}
U1 <br />
 
<pre>W - Winbond
On the Cobra Dongle, pin 3 of the EEPROM is tied to VCC. Lifting this Pin from the board and tieing it to ground '''should''' prevent the flash from being erased.
25X - SPI Flash with 4KB sectors/64Kbyte blocks, dual output
 
16A - 16Mbit / 2M-byte
=====Roles=====
V - Supply Voltage 2.7 to 3.6V
Drives data to and from the Winbond flash chip.
S - Package Type : 8pin SOIC 150-mil
 
I - Temperature Range: Industrial (-40'C ~ 85'C)
====Cobra Test Points====
G - Environment: Green Package (Lead-free, RoHS Compliant, Halogen-free (TBBA), Antimony-Oxie-free)</pre>
<div style="float:right">[[File:Cobra-TESTPOINTS.jpg|200px|thumb|left|Cobra - Testpoints to Winbond SPI flash]]</div><BR/>
datasheet: [http://www.multiupload.com/P2833U5SOW W25X16A.pdf (1.3 MB)] <br />
 
Note: can use [http://blog.hodgepig.org/busninja/ Bus Ninja] or [http://flashrom.org/Bus_Pirate Bus Pirate] and [http://flashrom.org/Flashrom FlashROM] - <abbr title="In-System Programming (ISP)">ISP</abbr> is possible, so long as no other devices on the SPI bus are trying to access the device (in that case, you might want to cut Vcc to the FPGA or the regulator for it).
There are test points that map out the Winbond flash shown in the diagram to the right.
 
==== DG/PS3/PC Selection switch ====
 
There is a switch that switched between Downgrade, PC and PS3 modes of the dongle.
 
When facing the switch, with the USB Plug to the left the pins are labeled 1 to 4 in the table below:


{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"  
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"  
|- bgcolor="#cccccc"
|- bgcolor="#cccccc"
! Pin !! Usage !! Connects to !! Remarks
! Pin !! Usage !! I/O !! Remarks
|-
|-
| 1 || PC Position || GND || A resistor is placed, by hand, between this pin and GND after the board is manufactured.
| 1 || /CS || I || Chip Select (high=deselect, low=select)
|-
|-
| 2 || PC/PS3 Position|| AVCC (atmega 27) + Winbond /WP (PIN 3) || Ties to Pin 27 of atmega16 (AVCC) and /WP of Winbond Flash
| 2 || DO || O || Data output
|-
|-
| 3 || PS3/DG Position|| TOSC2 of the Atmega (Pin 26)|| ???
| 3 || /WP || I || Write Protect (active low)
|-
|-
| 4 || DG Position|| GND || A resistor is placed, by hand, between this pin and GND after the board is manufactured.
| 4 || GND || || Ground
|-
|-
| 5 || DIO || I/O || Serial data input/output
|-
| 6 || CLK || I || Serial Clock
|-
| 7 || /HOLD || I || Hold (high=normal/resume, low=hold/pause)
|-
| 8 || VCC ||  || Vcc (min 2.7-max 3.6V @ Fr0 75MHz / min 3.0-max 3.6V @ Fastread Fr1 100MHz)
|-
|}


When in PC Mode, Pins 1 and 2 are shorted. When in PS3 Mode, Pins 2 and 3 are shorted. When in DG Mode 3 and 4 are shorted.
==== DG/PS3/PC Selection switch ====
 


{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
This switch is tied to pin 4 of the [http://www.ps3devwiki.com/index.php?title=PS3JB2_Reverse_Engineering#Winbond_25X16AVSIG_.28SPI_Flash_16Mbit.29 Winbond 25X16AVSIG Flash chip] and the Ground of the dongle. When in DG and PS3 mode the ground is connected, however when in PC mode the ground is disconnected (assumingly) to disable the flash chip.
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps3/PS3Cobra_Payload_Reverse_Engineering"