Editing SC EEPROM
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
Most of the information we have about the | [[Category:Software]] | ||
Most of the information we have about the sc eeprom comes from graf_chokolo reverse engineering of the HV see [[Hypervisor Reverse Engineering]] | |||
Here is where system flags, tokens and hashes are stored. | |||
Right now | Right now most of the comunication we have with the sc eeprom is through linux using graf_chokolo ps3dm-utils and/or using his payloads. | ||
=Important Offsets= | |||
= | == EEPROM Offset Table - Flags and Tokens == | ||
Here is the table of EEPROM offsets that can be accessed through Update Manager (3.15): | |||
Here is the table of | |||
{| class="wikitable FCK__ShowTableBorders" | {| class="wikitable FCK__ShowTableBorders" | ||
Line 56: | Line 16: | ||
! Offset !! Size !! Description | ! Offset !! Size !! Description | ||
|- | |- | ||
| 0x02F00 || 8 || | | 0x02F00 || 8 || Downgrade Minimum Version String | ||
|- | |- | ||
| | | 0x02F08 || 0x10? || Downgrade Minimum Version Build + Date Build String | ||
|- | |- | ||
| | | 0x02F20 || 8 || Target Id? (HV bible lists the TargetID as 85 and not 83) | ||
|- | |- | ||
| | | 0x02FF8 || 1 || Factory Bit | ||
|- | |- | ||
| | | 0x48013 || 0x2A || QA Token ECDSA Signature (3.60>= firmwares) | ||
|- | |- | ||
| | | 0x48C01 || 1 || (force standalone mode related) | ||
|- | |- | ||
| | | 0x48C02 || 1 || select_net_device (debug interface) | ||
|- | |- | ||
| | | 0x48C03 || 1 || (sys.dbgcard.dgbe.index) | ||
|- | |- | ||
| | | 0x48C06 || 1 || FSELF Control Flag / toggles release mode | ||
|- | |- | ||
| | | 0x48C07 || 1 || Product Mode (UM allows to read this offset, it can be also written but only when already in product mode) | ||
|- | |- | ||
| | | 0x48C08 || 1 || | ||
|- | |- | ||
| 0x48C0A || 1 || QA Flag | |||
| 0x48C0A || 1 || QA Flag | |||
|- | |- | ||
| 0x48C0B || 1 || mode_auth_flag / gx enable | | 0x48C0B || 1 || mode_auth_flag / gx enable | ||
|- | |- | ||
| 0x48C0C || 1 || | | 0x48C0C || 1 || (unknown) | ||
|- | |- | ||
| | | 0x48C0D || 1 || (unknown) | ||
|- | |- | ||
| | | 0x48C13 || 1 || Device Type | ||
|- | |- | ||
| | | 0x48C14 || || cellos_spu_configure | ||
|- | |- | ||
| | | 0x48C18 || 0x4 || (unknown) | ||
|- | |- | ||
| | | 0x48C1C || 0x4 || (unknown) | ||
|- | |- | ||
| | | 0x48C22 || 1 || be nclk | ||
|- | |- | ||
| | | 0x48C23 || 1 || be ref clk | ||
|- | |- | ||
| | | 0x48C30 || 1 || SPE number Usally 0x06, can be set to 0x07 to enable the 8 SPE | ||
|- | |- | ||
| | | 0x48C31 || 4 || sata_param | ||
|- | |- | ||
| | | 0x48C35 || 8 || spr_tbuw_value | ||
|- | |- | ||
| | | 0x48C42 || 1 || HDD Copy Mode | ||
|- | |- | ||
| 0x48C43 || 4 || (unknown) | |||
| | |||
|- | |- | ||
| 0x48C50 || 0x10 || Debug Support Flag | | 0x48C50 || 0x10 || Debug Support Flag | ||
Line 240: | Line 74: | ||
| 0x48C61 || 1 || Recover Mode Flag | | 0x48C61 || 1 || Recover Mode Flag | ||
|- | |- | ||
| | | 0x48D20 || 8 || spider.gbe0.macaddr.0 | ||
|- | |- | ||
| 0x48D3E || 0x50 || QA Token (UM doesn't allow access to this offset but SC Manager can read/write it) | |||
|- | |- | ||
| 0x48D8E || 0x50 || mode_auth_data (read/cleared by ss_sc_init_pu, checked by spu_mode_auth) | |||
|} | |} | ||
Line 385: | Line 90: | ||
QA Token ECDSA Signature is stored in 0x48013 offset (starting from 3.60 firmwares) | QA Token ECDSA Signature is stored in 0x48013 offset (starting from 3.60 firmwares) | ||
== lv0 SC EEPROM usage == | == lv0 SC EEPROM usage == | ||
<pre> | <pre> | ||
[*] lv0 NVS regions: | [*] lv0 NVS regions: | ||
Line 536: | Line 123: | ||
[*] lv0 SC EEPROM usage: | [*] lv0 SC EEPROM usage: | ||
name addr size structure | name addr size structure | ||
dgbe_config 0x48D00 0x0C [0x04 ip_addr, 0x04 ip_netmask, 0x04 ip_gateway] | |||
restrict_spu 0x48C30 0x01 [0x01 flag] | restrict_spu 0x48C30 0x01 [0x01 flag] | ||
sata_param 0x48C31 0x04 [0x04 flag] | sata_param 0x48C31 0x04 [0x04 flag] | ||
os_bank_indicator 0x48C24 0x01 [0x01 flag] | |||
cellos_spu_configure 0x48C33 0x04 [0x04 config] | cellos_spu_configure 0x48C33 0x04 [0x04 config] | ||
flash_ext_format 0x48C13 0x01 [0x01 flag] | |||
cellos_flags 0x48C0F 0x02 [0x02 flags] | |||
qaf_enable 0x48C0A 0x01 [0x01 flag] | |||
UNKNOWN (debug?) 0x48C08 0x01 [0x01 flag] | |||
fself_ctrl 0x48C06 0x01 [0x01 flag] | |||
select_dgbe_device 0x48C03 0x01 [0x01 index] | |||
os_boot_order_flag 0x48C00 0x01 [0x01 flag] | |||
qa_token 0x48D3E 0x50 [0x50 token] | |||
UNKNOWN 0x48804 0x04 [0x04 value] | |||
UNKNOWN 0x48D20 0x08 [0x08 value] | |||
rsx.rdcy.7 0x48CB8 0x08 [0x08 value] | |||
rsx.rdcy.6 0x48CB0 0x08 [0x08 value] | |||
rsx.rdcy.5 0x48CA8 0x08 [0x08 value] | |||
rsx.rdcy.4 0x48CA0 0x08 [0x08 value] | |||
rsx.rdcy.3 0x48C98 0x08 [0x08 value] | |||
rsx.rdcy.2 0x48C90 0x08 [0x08 value] | |||
rsx.rdcy.1 0x48C88 0x08 [0x08 value] | |||
rsx.rdcy.0 0x48C80 0x08 [0x08 value] | |||
be_nclck_flag2 0x48C23 0x01 [0x01 flag] | |||
be_nclck_flag1 0x48C22 0x01 [0x01 flag] | |||
select_net_device 0x48C02 0x01 [0x01 index] | |||
spr_tbuw_value 0x48C35 0x08 [0x08 value] | spr_tbuw_value 0x48C35 0x08 [0x08 value] | ||
bootrom_trace_level 0x48C11 0x01 [0x01 level] | |||
</pre> | </pre> | ||
== System Data | == System Data From EEPROM == | ||
Here is the list of possible | Here is the list of possible EEPROM offsets: | ||
{|class="wikitable" | {|class="wikitable" | ||
|- | |- | ||
! Index !! SC EEPROM | ! Index !! SC EEPROM Offset !! Size Of Data !! Description | ||
|- | |- | ||
| 0 || 0x48D20 || 6 ||? | | 0 || 0x48D20 || 6 ||? | ||
Line 587: | Line 168: | ||
|- | |- | ||
| 3 || 0x48D38 || 6 ||? | | 3 || 0x48D38 || 6 ||? | ||
|- | |- | ||
| 4 || 0x48D00 || 4 ||? | |||
|- | |- | ||
| | | 5 || 0x48D04 || 4 ||? | ||
|- | |- | ||
| | | 6 || 0x48D08 || 4 ||? | ||
|} | |} | ||
== Dumpable | == Dumpable EEPROM Offset - Block ID and Block Offset Mapping Table (NVS Service) == | ||
Right now we only have read access to some portions of the eeprom to have access to this regions DM needs to be patched, see section dumping eeprom | |||
{|class="wikitable" | {|class="wikitable" | ||
|- | |- | ||
! | ! EEPROM Offset !! Block ID !! Block Offset !! Description | ||
|- | |- | ||
| | | 0x48000 - 0x480FF || 0x00 || 0x48000 - 0x480FF || ? | ||
|- | |- | ||
| | | 0x48800 - 0x488FF || 0x01 || 0x48800 - 0x488FF || ? | ||
|- | |- | ||
| | | 0x48C00 - 0x48CFF || 0x02 || 0x48C00 - 0x48CFF || Contains flags and tokens/ see above | ||
|- | |- | ||
| | | 0x48D00 - 0x48DFF || 0x03 || 0x48D00 - 0x48DFF || System Data Region | ||
|- | |- | ||
| | | 0x2F00 - 0x2FFF || 0x10 || 0x2F00 - 0x2FFF || "Industry Area" aka OS Version Area | ||
|- | |- | ||
| | | 0x3000 - 0x30FF || 0x20 || 0x3000 - 0x30FF || "CS Area" | ||
| 0x3000-0x30FF || | |||
|- | |- | ||
| All other offsets || Invalid || Invalid || ? | |||
|} | |} | ||
= | =Dumping your SC EEPROM= | ||
== | ==Linux== | ||
First you need graf_chokolo kernel ps3dm-utils and linux_hv_scripts. | |||
If you are ready. | |||
Patch DM using linux_hv_scripts | Patch DM using linux_hv_scripts | ||
<pre> | <pre> | ||
Line 739: | Line 213: | ||
</pre> | </pre> | ||
Read the data from the region you want for example (see tables above) | Read the data from the region you want for example (see tables above) | ||
<pre> | <pre> | ||
Line 745: | Line 219: | ||
</pre> | </pre> | ||
You can see some coolstuff containing dumps | You can see some coolstuff that containing dumps | ||
= Hashes = | =Hashes= | ||
Where exactly the hashes are stored is still a secret | Where exactly the hashes are stored is still a secret, it is said that those hashes are stored in SC EEPROM | ||
To | To retrive the information about the packages you have installed you can also use ps3d_utils | ||
== Linux == | ==Linux== | ||
=== Installed Package info === | ===Installed Package info=== | ||
<pre> | <pre> | ||
Line 769: | Line 243: | ||
0003004100000000 | 0003004100000000 | ||
</pre> | </pre> | ||
get_pkg_info 2 - Revoke List for program | get_pkg_info 2 - Revoke List for program | ||
Line 775: | Line 249: | ||
0003004100000000 | 0003004100000000 | ||
</pre> | </pre> | ||
get_pkg_info 3 - Revoke list for package | get_pkg_info 3 - Revoke list for package | ||
<pre> | <pre> | ||
0002003000000000 | 0002003000000000 | ||
</pre> | </pre> | ||
get_pkg_info 4 | get_pkg_info 4 | ||
<pre> | <pre> | ||
deadbeaffacebabe | deadbeaffacebabe | ||
</pre> | </pre> | ||
get_pkg_info 5 | get_pkg_info 5 | ||
<pre> | <pre> | ||
deadbeaffacebabe | deadbeaffacebabe | ||
Line 795: | Line 269: | ||
get_pkg_info 6 - Firmware Package | get_pkg_info 6 - Firmware Package | ||
<pre> | <pre> | ||
0003005000000000 | 0003005000000000 | ||
</pre> | </pre> | ||
=== Hashes === | You can find more information about this in [[Hypervisor Reverse Engineering]] | ||
===Hashes=== | |||
What algorithm is used and what exactly is hashed is still unknown | What algorithm is used and what exactly is hashed is still unknown (seems that the content of files is hashed by the SHA-1). | ||
<pre> | <pre> | ||
Line 810: | Line 286: | ||
</pre> | </pre> | ||
This hashes are checked by lv1 to make sure that the data has not been altered throgh '''scm_get_region_data: get_result: ret[X]: 0x%x''' | |||
Examples | Examples | ||
Line 816: | Line 292: | ||
region_data 0 - | region_data 0 - Core OS package | ||
<pre> | <pre> | ||
00 03 00 41 00 00 00 00 00 c3 eb 01 96 24 d0 1c 26 14 f3 1c a4 a2 ff ce 81 77 3a 4c f8 42 86 04 ee 34 bb db be 1c a7 51 e5 59 f1 95 61 07 a5 eb | 00 03 00 41 00 00 00 00 00 c3 eb 01 96 24 d0 1c 26 14 f3 1c a4 a2 ff ce 81 77 3a 4c f8 42 86 04 ee 34 bb db be 1c a7 51 e5 59 f1 95 61 07 a5 eb | ||
</pre> | </pre> | ||
region_data 1 | region_data 1 | ||
<pre> | <pre> | ||
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff | ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff | ||
</pre> | </pre> | ||
region_data 2 | region_data 2 | ||
<pre> | <pre> | ||
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff | ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff | ||
</pre> | </pre> | ||
region_data 3 | region_data 3 //Revoke List for program? | ||
<pre> | <pre> | ||
00 03 00 41 00 00 00 00 80 41 f6 b8 f2 d5 30 60 59 35 49 d7 f0 3d 58 57 87 00 88 11 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff | 00 03 00 41 00 00 00 00 80 41 f6 b8 f2 d5 30 60 59 35 49 d7 f0 3d 58 57 87 00 88 11 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff | ||
</pre> | </pre> | ||
region_data 4 | region_data 4 | ||
<pre> | <pre> | ||
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff | ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff | ||
</pre> | </pre> | ||
region_data 5 | region_data 5 //Revoke List for package? | ||
<pre> | <pre> | ||
00 02 00 30 00 00 00 00 ba 6e 1c d5 5f 48 5b 8b 3f cc c8 60 75 ce f6 83 b2 20 dc f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | 00 02 00 30 00 00 00 00 ba 6e 1c d5 5f 48 5b 8b 3f cc c8 60 75 ce f6 83 b2 20 dc f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ||
</pre> | </pre> | ||
Line 880: | Line 332: | ||
<pre> | <pre> | ||
de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be | de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be | ||
</pre> | </pre> | ||
Line 890: | Line 338: | ||
<pre> | <pre> | ||
de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be | de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be | ||
</pre> | </pre> | ||
Line 899: | Line 343: | ||
<pre> | <pre> | ||
00 03 00 50 | 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ||
</pre> | </pre> | ||
Line 910: | Line 350: | ||
<pre> | <pre> | ||
de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be | de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be | ||
</pre> | </pre> | ||
Line 920: | Line 356: | ||
<pre> | <pre> | ||
de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be | de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be | ||
</pre> | </pre> | ||
Line 930: | Line 362: | ||
<pre> | <pre> | ||
de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be | de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be | ||
</pre> | </pre> | ||
Line 940: | Line 368: | ||
<pre> | <pre> | ||
de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be | de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be | ||
</pre> | </pre> | ||
Line 950: | Line 374: | ||
<pre> | <pre> | ||
de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be | de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be | ||
</pre> | </pre> | ||
Line 960: | Line 380: | ||
<pre> | <pre> | ||
de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be | de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be | ||
</pre> | </pre> | ||
Line 970: | Line 386: | ||
<pre> | <pre> | ||
de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be | de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be de ad be af fa ce ba be | ||
</pre> | </pre> | ||
= | =Tokens= | ||
Here we will document the different types off tokens known in the PS3 | |||
All tokens are tied? encrypted? using EID0. | |||
They enable additional repository nodes. | |||
Here | |||
All tokens are tied | |||
==List== | |||
{| class="wikitable FCK__ShowTableBorders" | {| class="wikitable FCK__ShowTableBorders" | ||
|- | |- | ||
Line 1,640: | Line 401: | ||
| qa_token || sc_eeprom - 0x48D3E || 0x50 || spu_token_processor.self || | | qa_token || sc_eeprom - 0x48D3E || 0x50 || spu_token_processor.self || | ||
|- | |- | ||
| user_token || | | user_token || ? || ? || spu_utoken_processor.self || Encrypted/Signed | ||
|- | |- | ||
| token_seed || | | token_seed || ? || ? || ? || This is used to create the token with EID0 | ||
|} | |} | ||
== | ==Token Seed== | ||
? | |||
== Structure == | ==Structure== | ||
This section has to be corrected | This section has to be corrected, is only based on debug strings, we need to decrypt the tokens | ||
=== Token Seed === | ===Token Seed=== | ||
? | ? | ||
=== QA Token === | ===QA Token=== | ||
===User Token=== | |||
{| class="wikitable FCK__ShowTableBorders" | {| class="wikitable FCK__ShowTableBorders" | ||
|- | |- | ||
! | ! Address !! Size !! Description | ||
|- | |- | ||
| ? || ? || m_magic | | ? || ? || m_magic | ||
Line 1,704: | Line 434: | ||
| ? || ? || m_size | | ? || ? || m_size | ||
|- | |- | ||
| ? || ? || | | ? || ? || m_capability | ||
|- | |- | ||
| ? || ? || m_expire_date | | ? || ? || m_expire_date | ||
|- | |- | ||
| ? || ? || | | ? || ? || m_idps? | ||
|- | |- | ||
| ? || ? || m_attribute | | ? || ? || m_attribute | ||
Line 1,715: | Line 445: | ||
|} | |} | ||
For every | For every atribute in the token | ||
{| class="wikitable FCK__ShowTableBorders" | {| class="wikitable FCK__ShowTableBorders" | ||
|- | |- | ||
! | ! Address !! Size !! Description | ||
|- | |- | ||
| ? || ? || attr:m_type | | ? || ? || attr:m_type | ||
Line 1,727: | Line 457: | ||
| ? || ? || attr:m_data | | ? || ? || attr:m_data | ||
|} | |} | ||