View source for SC EEPROM

== SC EEPROM Offset Table - Flags and Tokens ==

Here is the table of SC EEPROM offsets that can be accessed through Update Manager (3.15): 

{| class="wikitable FCK__ShowTableBorders"
|-
! Offset !! Size !! Description
|-
| 0x02F00 || 8 || Manufacturing Update Release Version String
|-
| 0x02F08 || 0x18 || Manufacturing Update Build Version + Build Date String
|-
| 0x02F20 || 8 || Manufacturing Update Build Target ID (Can be 0x83(CEX-ww), 0x82(DEX-ww), 0x81(DevelopmentTool) or 0xDEAD. Written during the <br>manufacturing fw update process according to target string inside /dev_flash/vsh/etc/version.txt)
|-
| 0x02F28 || 0xD0 || Padding/undocumented (the sample below is from motherboard REX-001(eMMC), syscon SW3-304)
<pre>
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF D4 63
4F 4C 95 5E 01 31 04 BA 7C 93 41 23 52 48 B0 E0
3E 02 10 00 00 00 FF 04 00 01 02 FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF 32 49 31 34 00
32 32 1D 26 26 FF FF FF 1D 26 26 FF FF FF 80 00
</pre>
|-
| 0x02FF8 || 1 || Factory Bit (0 = ?, 1 = reset, 2 = ?, 3 = (on retails))
|-
| 0x02FF9 || 0x7 || Padding/undocumented
<pre>00 00 00 01 01 01 00 </pre>
|-
|}



{| class="wikitable FCK__ShowTableBorders"
|-
! colspan="2" | Offset !! Size !! Description
|-{{cellcolors|lightgrey}}
| colspan="2" | 0x48000 || 0x13 || (lv0 NVS region 0 start) 
|-
| <abbr title="lv0 NVS region 0: 0x48000-0x48012"><small>0</small></abbr> || 0x48000 || 0x13 || (lv0 NVS region 0)
|-{{cellcolors|lightgrey}}
| colspan="2" | 0x48012 || - || (lv0 NVS region 0 end)
|-


| colspan="2" | 0x48013 || 0x2A || QA Token ECDSA Signature (=&gt; 3.60 firmwares)
|-{{cellcolors|lightgrey}}


| colspan="2" | 0x48800 || 0x0F || (lv0 NVS region 1 start) 
|-
| rowspan="6" | <abbr title="lv0 NVS region 1: 0x48800-0x4880F"><small>1</small></abbr> || 0x48800 || 1 || ?
|-
| 0x48801 || 1 || - hv log settings/infos? -
|-
| 0x48802 || 2 || ? (lv0/lv1 CodeVerifier::spu_interrupt_handler_class2 related)
|-
| 0x48804 || 4 || bootrom failure code 
|-
| 0x48808 || 4 || bootrom failure timestamp 
|-
| 0x4880C || 4 || ?
|-{{cellcolors|lightgrey}}
| colspan="2" | 0x4880B || - || (lv0 NVS region 1 end)
|-{{cellcolors|lightgrey}}


| colspan="2" | 0x48C00 || 0x20 || (lv0 NVS region 2 start) 
|-
| rowspan="22" | <abbr title="lv0 NVS region 2: 0x48C00-0x48C1F"><small>2</small></abbr> || 0x48C00 || 1 || boot flag (load_image_in_rom flag (os_boot_order_flag)
 0 = network 1st
 1 = flash 1st
|-
| 0x48C01 || 1 || sys.dbgcard.hostpc (force standalone mode related) 
|-
| 0x48C02 || 1 || Network Device Mode (sys.dbgcard.dgbe / debug interface (select_net_device)
 -1: Ethernet 2
  0: IFB
  1: CP
  2: SB UART
  3: CP ch4
  5: Disabled (default)
|-
| 0x48C03 || 1 || sys.dbgcard.dgbe.index (select_dgbe_device) 
|-
| 0x48C04 || 1 || used to reset dgbe_config (only <= 0.85)
|-
| 0x48C05 || 1 || force update flag (update_flag for consoles with flash_format  0)
|-
| 0x48C06 || 1 || FSELF Control Flag / toggles release mode (fself_ctrl used by lv0 for failsafe mode and by lv2 to bypass protection checks)
|-
| 0x48C07 || 1 || Non-secure Product Mode (only <= 0.85) / force Syscon remarry (only JIG firmwares)
|-
| 0x48C08 || 1 || lv0 passes this to lv1ldr (not used on >= 0.82, maybe only CEB) 
|-
| 0x48C09 || 1 || boot_fir_config (lv0ldr, bit 1/2, delays setting of BE fault-iso-regs/SB params to lv0)
|-
| 0x48C0A || 1 || QA Flag exist flag
|-
| 0x48C0B || 1 || mode_auth_flag / gx enable
|-
| 0x48C0C || 1 || Memory Diag Flag (bootrom diagnostic mode and parameter (bootrom_diag))
|-
| 0x48C0D || 1 || Memory Diag Status (lv0ldr related)
|-
| 0x48C0E || 1 || XDR_Link_Init failure flag
|-
| 0x48C0F || 2 || cell os flags (loader parameter)
|-
| 0x48C11 || 1 || bootrom trace level
 0x00: fatal errors
 0x01: errors
 0x02: information messages
 0x03: debug messages
 0xFF: ? (default)
|-
| 0x48C12 || 1 || ?
|-
| 0x48C13 || 1 || flash ext flag (Device Type (flash_ext_format))
|-
| 0x48C14 || 4 || cellos_spu_configure
|-
| 0x48C18 || 4 || Safe Mode System Language. Using the [[Languages|language codes]]. See also [[XRegistry.sys#Settings|XRegistry.sys/setting/system/language]]
|-
| 0x48C1C || 4 || Safe Mode VSH Target (maybe QA,Debug,Retail,Kiosk?). See [[Promo_flags.txt]] and [[VSH_Exports#vshmain|GetReleaseTarget]] vsh export
 0x00000000 = ? (default)
 0x00000001 = ?
 0x00000005 = dtcpipdevdex (can't update to any firmware, except dtcpipdevdex firmware)
 0xFFFFFFFF = ?
 0xFFFFFFFE = ?
|-{{cellcolors|lightgrey}}
| colspan="2" | 0x48C1F || - || (lv0 NVS region 2 end)
|-{{cellcolors|lightgrey}}


| colspan="2" | 0x48C22 || 0x03 || (lv0 NVS region 3 start)
|-
| rowspan="3" | <abbr title="lv0 NVS region 3: 0x48C22-0x48C24"><small>3</small></abbr> || 0x48C22 || 1 || be nclk (be_nclck_flag1)
|-
| 0x48C23 || 1 || be ref clk (be_nclck_flag2)
|-
| 0x48C24 || 1 || Bank #0 OS-Flag (ros0 if 0xFF else ros1, for NOR consoles only) (os_bank_indicator)
|-{{cellcolors|lightgrey}}
| colspan="2" | 0x48C24 || - || (lv0 NVS region 3 end)
|-


| colspan="2" | 0x48C25 || 1 || Bank #0 rvkprg-Flag
|-
| colspan="2" | 0x48C26 || 1 || Bank #0 rvkpkg-Flag
|-
| colspan="2" | 0x48C27 || 1 || Bank #1 OS-Flag
|-
| colspan="2" | 0x48C28 || 1 || Bank #1 rvkprg-Flag
|-
| colspan="2" | 0x48C29 || 1 || Bank #1 rvkpkg-Flag
|-{{cellcolors|lightgrey}}


| colspan="2" | 0x48C30 || 0x0D || (lv0 NVS region 4 start)
|-
| rowspan="3" | <abbr title="lv0 NVS region 4: 0x48C30-0x48C3C"><small>4</small></abbr> || 0x48C30 || 1 || SPU num - Usally 0x06(default), can be set to 0x07 to enable the 8 SPE (restrict_spu) or can be set to 0xFF(unlimit)
|-
| 0x48C31 || 4 || sata param
|-
| 0x48C35 || 8 || initial TB value (spr_tbuw_value (cellos_spu_configure))
|-{{cellcolors|lightgrey}}
| colspan="2" | 0x48C3C || - || (lv0 NVS region 4 end)
|-{{cellcolors|lightgrey}}


| colspan="2" | 0x48C40 || 0x10 || (lv0 NVS region 5 start)
|-
| rowspan="8" | <abbr title="lv0 NVS region 5: 0x48C40-0x48C4F"><small>5</small></abbr> || 0x48C42 || 1 || HDD Copy Mode
|-
| 0x48C43 || 4 || Hdd Ident Information
|-
| 0x48C47 || 1 || Analog Sunset Flag, will disable AACS video output without [[HDMI]] cable soon
|-
| 0x48C50 || 0x10 || Debug Support Flag
|-
| 0x48C60 || 1 || Update Status
|-
| 0x48C61 || 1 || Recover Mode Flag
|-
| 0x48C62 || 8 || boot param. Accessed by [[LV2_Functions_and_Syscalls|syscalls 404]] ?. See also [[Factory_Service_Mode#Game_OS|this]]
|-
| 0x48C6A || 2 || factory process completion (bitflags ?). Accessed by [[LV2_Functions_and_Syscalls|syscalls 405, 406, 407]] ?. See also [[Factory_Service_Mode#Game_OS|this]]
 Usually FFFF, but also:
 00E2 - CokC12, SEM-001, CXR713120-203GB
 00EA - CokD10, DIA-001, CXR714120-301GB
 00E6 - CokE10, DIA-002, CXR714120-302GB
 00EA - CokF10, VER-001, SW-301
 00AA - CokG11, DYN-001, SW2-301
 00BE - CokH11, SUR-001, SW2-302
 00B2 - CokJ13, JTP-001, SW2-303 & CokK10, KTE-001, SW3-301
 00B0 - CokM20, MSX-001, SW3-302 & CokM30, MPX-001, SW3-302 & CokN10, NPX-001, SW3-302 & CokP10, PQX-001, SW3-304 & CokR40, REX-001, SW3-304
 
 00F0 - CokD10, DIA-001, CXR714120-304GB Refurb 40nm RSX
 01FE - Cok14, COK-001, CXR714120-304GB Refurb 40nm RSX
|-{{cellcolors|lightgrey}}
| colspan="2" | 0x48C4F || - || (lv0 NVS region 5 end)
|-{{cellcolors|lightgrey}}


| colspan="2" | 0x48C80 || 0x10 || (lv0 NVS region 6 start)
|-
| rowspan="2" | <abbr title="lv0 NVS region 6: 0x48C80-0x48C8F"><small>6</small></abbr> || 0x48C80 || 8 || (rsx.rdcy.0)
|-
| 0x48C88 || 8 || (rsx.rdcy.1)
|-{{cellcolors|lightgrey}}
| colspan="2" | 0x48C8F || - || (lv0 NVS region 6 end)
|-{{cellcolors|lightgrey}}


| colspan="2" | 0x48C90 || 0x30 || (lv0 NVS region 7 start)
|-
| rowspan="6" | <abbr title="lv0 NVS region 7: 0x48C90-0x48CBF"><small>7</small></abbr> || 0x48C90 || 8 || (rsx.rdcy.2)
|-
| 0x48C98 || 8 || (rsx.rdcy.3)
|-
| 0x48CA0 || 8 || (rsx.rdcy.4)
|-
| 0x48CA8 || 8 || (rsx.rdcy.5)
|-
| 0x48CB0 || 8 || (rsx.rdcy.6) / game_board_storage_read
|-
| 0x48CB8 || 8 || (rsx.rdcy.7) / game_board_storage_read
|-{{cellcolors|lightgrey}}
| colspan="2" | 0x48CBF || - || (lv0 NVS region 7 end)
|-

| colspan="2" | 0x48CCE || 1 || 0xFF / 0xFE / 0x00 (?)
|-
| colspan="2" | 0x48CCF || 1 || pme_user debug printf flag ( & 0x03 verbose level )
|-{{cellcolors|lightgrey}}

| colspan="2" | 0x48CF0 || 0x10 || (NVS region start)
|-
| rowspan="16" | <abbr title="NVS region: 0x48CF0-0x48CFF"><small></small></abbr> || 0x48CF0 || 1 || ss.common.printf.enabled
|-
| 0x48CF1 || 1 || ss.common.debug.level+ss.update.debug.level
|-
| 0x48CF2 || 1 || ss.updatefe.debug.level+ss.ss_init.debug.level
|-
| 0x48CF3 || 1 || ss.ss_proxy.debug.level+ss.spm.debug.level
|-
| 0x48CF4 || 1 || ss.spm.debug.policy+ss.ac_cntl.debug.level
|-
| 0x48CF5 || 1 || ss.ploader.debug.level+ss.gloader.debug.level
|-
| 0x48CF6 || 1 || ss.commlib.debug.level+ss.sc_mngr.debug.level
|-
| 0x48CF7 || 1 || ss.sc_iso.debug.level+ss.ii_mngr.debug.level
|-
| 0x48CF8 || 1 || ss.vtrm.debug.level+ss.sec_rtc.debug.level
|-
| 0x48CF9 || 1 || ss.sb_mngr.debug.level+ss.sb_iso.debug.level
|-
| 0x48CFA || 1 || ss.app_info.debug.level+ss.aim_iso.debug.level
|-
| 0x48CFB || 1 || ss.fdm.debug.level+ss.fdm_iso.debug.level
|-
| 0x48CFC || 1 || ss.fw.debug.level+ss.stricv.debug.level
|-
| 0x48CFD || 1 || ss.usbauth.debug.level+ss.dispatch.debug.level
|-
| 0x48CFE || 1 || ss.sc_test.debug.level+ss.sc_test.debug.spu
|-
| 0x48CFF || 1 || ss.token.debug.level
|-{{cellcolors|lightgrey}}
| colspan="2" | 0x48CFF || - || (NVS region end)
|-{{cellcolors|lightgrey}}


| colspan="2" | 0x48D00 || 0x0C || (lv0 NVS region 8 start)
|-
| rowspan="3" | <abbr title="lv0 NVS region 8: 0x48D00-0x48D0B"><small>8</small></abbr> || 0x48D00 || 4 || ip_addr (dgbe_config)
|-
| 0x48D04 || 4 || ip_netmask
|-
| 0x48D08 || 4 || ip_gateway
|-{{cellcolors|lightgrey}}
| colspan="2" | 0x48D0B || - || (lv0 NVS region 8 end)
|-{{cellcolors|lightgrey}}



| colspan="2" | 0x48D20 || 0x08|| (lv0 NVS region 9 start)
|-
| <abbr title="lv0 NVS region 9: 0x48D20-0x48D27"><small>9</small></abbr> || 0x48D20 || 8 || spider.gbe0.macaddr.0  (<code>0xFFFFFFFFFFFFFFFF</code> if unused/nonpresent)
|-{{cellcolors|lightgrey}}
| colspan="2" | 0x48D27 || - || (lv0 NVS region 9 end)
|-{{cellcolors|lightgrey}}


| colspan="2" | 0x48D28 || 0x18 || (lv0 NVS region B start)
|-
| rowspan="3" | <abbr title="lv0 NVS region B: 0x48D28-0x48D3F"><small>B</small></abbr> || 0x48D28 || 8 || spider.gbe0.macaddr.1  (<code>FFFFFFFFFFFFFFFF</code> if unused/nonpresent)
|-
| 0x48D30 || 8 || spider.gbe0.macaddr.2  (<code>FFFFFFFFFFFFFFFF</code> if unused/nonpresent)
|-
| 0x48D38 || 8 || spider.gbe0.macaddr.3  (<code>FFFFFFFFFFFFFFFF</code> if unused/nonpresent)
|-{{cellcolors|lightgrey}}
| colspan="2" | 0x48D3F || - || (lv0 NVS region B end)
|-{{cellcolors|lightgrey}}



| colspan="2" | 0x48D3E || 0x50 || (lv0 NVS region A start)
|-
| <abbr title="lv0 NVS region A: 0x48D3E-0x48D8D"><small>A</small></abbr> || 0x48D3E || 0x50 || QA Token - UM doesn't allow access to this offset but SC Manager can read/write it (qa_token)
|-{{cellcolors|lightgrey}}
| colspan="2" | 0x48D8D || - || (lv0 NVS region A end)
|-


| colspan="2" | 0x48D8E || 0x50 || mode_auth_data (read/cleared by ss_sc_init_pu, checked by spu_mode_auth, used to enter product mode on jig firmwares without a dongle)
|-
|}

In a standard mostly untouched ps3 the common value for this flags is 0xFF wich means not active, anything else means active (e.g. 0xFE)

To change this to an active status you have to write 0x00 to turn on the flag

Debug support flag is tied to EID which is supposed to be hashed and saves in SC EEPROM

QA flag is tied to QA token that is also saved in this part of the SC EEPROM

QA Token ECDSA Signature is stored in 0x48013 offset (starting from 3.60 firmwares)