Editing SC EEPROM

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
Most of the information we have about the Syscon EEPROM comes from graf_chokolo reverse engineering of the HV. See [[Hypervisor Reverse Engineering]]  
Most of the information we have about the sc eeprom comes from graf_chokolo reverse engineering of the HV see [[Hypervisor Reverse Engineering]]  


Syscon EEPROM is where system flags, tokens and hashes are stored.
Here is where system flags, tokens and hashes are stored.


Right now, most of the communication we have with the Syscon EEPROM is through Linux using graf_chokolo ps3dm-utils and/or using his payloads.
Right now most of the communication we have with the sc eeprom is through Linux using graf_chokolo ps3dm-utils and/or using his payloads.


See also {{talk}} page and [[User_talk:Zer0Tolerance|Zer0Tolerance]]
See also {{talk}} page and [[User_talk:Zer0Tolerance|Zer0Tolerance]]


= Information =
= SC EEPROM Info =
*On [[Mullion]] syscons '''the EEPROM "pins" are exposed externally''' so we can capture the EEPROM traffic by attaching devices like Logic Analyzers, Protocol Analyzers, etc...
SC EEPROM from fat consoles is a custom/proprietary EEPROM chip that uses a special non standard commands to read/write from EEPROM.
**On [[Syscon CXR713 Series]] the EEPROM consists of '''0x4000''' blocks, every block contains 2 bytes of data, so the total EEPROM size is '''0x8000''' bytes ('''32KB''').
We are so lucky that Sony had exposed EEROM chip legs out of Syscon, so we have a physical access to it and we could attach devices like "'''Logic Analyzer'''", "'''Protocol Analyzer'''", "'''Custom made MCU boards'''" to capture traffic between console and Syscon EEPROM.
**On [[Syscon CXR714 Series]] the EEPROM consists of '''0x2800''' blocks, every block contains 2 bytes of data, so the total EEPROM size is '''0x5000''' bytes ('''20KB''').
*On [[Sherwood]] syscons '''the EEPROM is virtualized inside FLASH menory''', so there is not physical access to the EEPROM.
**On [[Syscon SW Series]], [[Syscon SW2 Series]] and [[Syscon SW3 Series]] the virtual EEPROM consists of '''0x4000''' blocks, every block contains 2 bytes of data, so the total EEPROM size is '''0x8000''' bytes ('''32KB''').


For FAT console Syscon EEPROM consists of: 0x4000 blocks, and every block is consists of 2 bytes of data.
So the total EEPROM size is: 0x8000 byte length.


Dont confuse the SPI block access (using blocks of 2 bytes leght) with the '''"Block ID"''' used by the '''SERV_NVS''' [[SC_Communication#Syscon_Services|Syscon Service]]
And since the pin-out of Syscon chip for Slim & Super Slim consoles is not known till now, we can not be sure if the Syscon EEPROM pins are exposed outside or not so we can access it like in FAT console without handling Syscon it self.


== SPI Commands ==
== SC EEPROM Commands ==
Syscon EEPROM uses a standard SPI protocol with proprietary commands as following:
 
FAT console's SC EEPROM used a standard SPI protocol with a proprietary commands as flow:


{| class="wikitable"
{| class="wikitable"
Line 26: Line 26:
| Unlock Command || 0xA3 0x00 0x00 || This command must be send first before write command.
| Unlock Command || 0xA3 0x00 0x00 || This command must be send first before write command.
|-
|-
| Write Command || 0xA4 0xXX 0xXX || XX XX is a block to be written (in the range 0x0000 up to 0x3FFF for [[Syscon CXR713 Series]], or 0x0000 up to 0x27FF for [[Syscon CXR714 Series]])<br>The maximum data to be written in one command cycle is 32 byte length (16 blocks).
| Write Command || 0xA4 0xXX 0xXX || XX XX is a block id to be written (value 0x0000 to 0x3FFF), the maximum data to be written in one command cycle is 32 byte length (16 blocks).
|-
|-
| Read Command || 0xA8 0xXX 0xXX || XX XX is a block to be read (in the range 0x0000 up to 0x3FFF for [[Syscon CXR713 Series]], or range 0x0000 up to 0x27FF for [[Syscon CXR714 Series]])<br>There is no maximum limit for read command so we can send it once with block 0x00 0x00 then read the full SC EEPROM at once without sending read command again.
| Read Command || 0xA8 0xXX 0xXX || XX XX is a block id to be read (value 0x0000 to 0x3FFF), there is no maximum limit for read command so we can send it once with block id 0x00 0x00 then read the full EEPROM at once without sending read command again.
|-
|-
| Check Status Command || 0xA9 0x00 0x00 0x00 || The response of this command is 0xFFFFFFFF if there is no error, or any other value if there is error happened or SC EEPROM still busy doing something.
| Check Status Command || 0xA9 0x00 0x00 0x00 || The response of this command is 0xFFFFFFFF if there is no error, or any other value if there is error happened or EEPROM still busy doing something.
|}
|}


= Dumps =
= SC EEPROM dumps =
 
* https://mega.co.nz/#!Bt8klAhQ!-t5YVetoL9gz6iZucpqQB9Vl9chCkbhFiMfqjbmotoc {{MD5|B0E0551116B718A4921757B2B074693F}}
* https://mega.co.nz/#!Bt8klAhQ!-t5YVetoL9gz6iZucpqQB9Vl9chCkbhFiMfqjbmotoc {{MD5|B0E0551116B718A4921757B2B074693F}}
* https://mega.co.nz/#!B51wWJYA!zg8O-vCvRBOgK5mpzTQ1H2hgBZmykglmbksB5w1Mlfg {{MD5|3E0E73DACF7E10F2369624EA439C661B}} (partial: {{MD5|7E2BAD4DFDEE485494C8749B1C3E5676}} / {{MD5|05D9ED4B545C709C9C4564F047028DE8}})
* https://mega.co.nz/#!B51wWJYA!zg8O-vCvRBOgK5mpzTQ1H2hgBZmykglmbksB5w1Mlfg {{MD5|3E0E73DACF7E10F2369624EA439C661B}} (partial: {{MD5|7E2BAD4DFDEE485494C8749B1C3E5676}} / {{MD5|05D9ED4B545C709C9C4564F047028DE8}})
Line 42: Line 41:
* https://mega.nz/#!iV0nGY4I!94ByAd-sourgK8_l_4s-6BX_V7iVOrysQd55bI0N6ws {{MD5|1DB1CAA8E3D54256A59D08B6AF2B9BC5}} (Dumped by Syscon EEPROM Flasher done by me "'''Abkarino'''" using Arduino Mega).
* https://mega.nz/#!iV0nGY4I!94ByAd-sourgK8_l_4s-6BX_V7iVOrysQd55bI0N6ws {{MD5|1DB1CAA8E3D54256A59D08B6AF2B9BC5}} (Dumped by Syscon EEPROM Flasher done by me "'''Abkarino'''" using Arduino Mega).


* https://mega.nz/#!AwF1jIaB!5qei9JOCzisgUHARcjARCw0zvQENkkvtAdd_O0dRUfI DECR Syscon EEPROM dump from lv2 um_manager, needs documentation.
* https://mega.nz/#!AwF1jIaB!5qei9JOCzisgUHARcjARCw0zvQENkkvtAdd_O0dRUfI DECR eeprom dump from lv2 um_manager, needs documentation.


Note: different consoles have same initial 16 bytes -> maybe key/iv?
different consoles, same initial 16 bytes. maybe key/iv?


= Important offsets =
=Important Offsets=


== SC EEPROM Offset Table - Flags and Tokens ==
== EEPROM Offset Table - Flags and Tokens ==


Here is the table of SC EEPROM offsets that can be accessed through Update Manager (3.15):  
Here is the table of EEPROM offsets that can be accessed through Update Manager (3.15):  


{| class="wikitable FCK__ShowTableBorders"
{| class="wikitable FCK__ShowTableBorders"
Line 58: Line 57:
| 0x02F00 || 8 || Manufacturing Update Release Version String
| 0x02F00 || 8 || Manufacturing Update Release Version String
|-
|-
| 0x02F08 || 0x18 || Manufacturing Update Build Version + Build Date String
| 0x02F08 || 0x10 || Manufacturing Update Build Version + Build Date String
|-
|-
| 0x02F20 || 8 || Manufacturing Update Build Target ID (Can be 0x83(CEX-ww), 0x82(DEX-ww), 0x81(DevelopmentTool) or 0xDEAD. Written during the <br>manufacturing fw update process according to target string inside /dev_flash/vsh/etc/version.txt)
| 0x02F20 || 8 || Manufacturing Update Build Target ID (Can be 0x83(CEX-ww), 0x82(DEX-ww), 0x81(DevelopmentTool) or 0xDEAD. Written during the <br>manufacturing fw update process according to target string inside /dev_flash/vsh/etc/version.txt)
|-
|-
| 0x02F28 || 0xD0 || Padding/undocumented (the sample below is from motherboard REX-001(eMMC), syscon SW3-304)
| 0x02F28 || 0xD0 || Padding/undocumented
<pre>
<pre>00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF xx xx
FF FF FF FF FF FF FF FF FF FF FF FF FF FF D4 63
xx xx xx FF FF xx xx xx xx xx xx xx xx xx xx xx
4F 4C 95 5E 01 31 04 BA 7C 93 41 23 52 48 B0 E0
xx xx 00 00 00 00 FF xx 00 xx xx FF FF FF FF FF  
3E 02 10 00 00 00 FF 04 00 01 02 FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF xx xx xx 00 00  
FF FF FF FF FF FF FF FF FF FF FF 32 49 31 34 00
xx xx xx xx xx FF FF FF xx xx xx FF FF FF xx 00 </pre>
32 32 1D 26 26 FF FF FF 1D 26 26 FF FF FF 80 00
</pre>
|-
|-
| 0x02FF8 || 1 || Factory Bit (0 = ?, 1 = reset, 2 = ?, 3 = (on retails))
| 0x02FF8 || 1 || Factory Bit (0 = ?, 1 = reset, 2 = ?, 3 = (on retails))
|-
|-
| 0x02FF9 || 0x7 || Padding/undocumented
| 0x02FF9 || 0x7 || Padding/undocumented
<pre>00 00 00 01 01 01 00 </pre>
<pre>00 00 00 00 xx xx xx </pre>
|-
|-
|}
|}
Line 124: Line 121:
| colspan="2" | 0x48C00 || 0x20 || (lv0 NVS region 2 start)  
| colspan="2" | 0x48C00 || 0x20 || (lv0 NVS region 2 start)  
|-
|-
| rowspan="22" | <abbr title="lv0 NVS region 2: 0x48C00-0x48C1F"><small>2</small></abbr> || 0x48C00 || 1 || boot flag (load_image_in_rom flag (os_boot_order_flag)
| rowspan="22" | <abbr title="lv0 NVS region 2: 0x48C00-0x48C1F"><small>2</small></abbr> || 0x48C00 || 1 || boot flag (load_image_in_rom flag (os_boot_order_flag), 0 = network 1st, 1 = flash 1st)
0 = network 1st
1 = flash 1st
|-
|-
| 0x48C01 || 1 || sys.dbgcard.hostpc (force standalone mode related)  
| 0x48C01 || 1 || sys.dbgcard.hostpc (force standalone mode related)  
|-
|-
| 0x48C02 || 1 || Network Device Mode (sys.dbgcard.dgbe / debug interface (select_net_device)
| 0x48C02 || 1 || Network Device Mode (sys.dbgcard.dgbe / debug interface (select_net_device) (-1: Ethernet 2, 0: IFB, 1: CP, 2: SB UART, 3: CP ch4, 5: invalid <!-- used on retail consoles -->))
-1: Ethernet 2
  0: IFB
  1: CP
  2: SB UART
  3: CP ch4
  5: Disabled (default)
|-
|-
| 0x48C03 || 1 || sys.dbgcard.dgbe.index (select_dgbe_device)  
| 0x48C03 || 1 || sys.dbgcard.dgbe.index (select_dgbe_device)  
Line 146: Line 135:
| 0x48C06 || 1 || FSELF Control Flag / toggles release mode (fself_ctrl used by lv0 for failsafe mode and by lv2 to bypass protection checks)
| 0x48C06 || 1 || FSELF Control Flag / toggles release mode (fself_ctrl used by lv0 for failsafe mode and by lv2 to bypass protection checks)
|-
|-
| 0x48C07 || 1 || Non-secure Product Mode (only <= 0.85) / force Syscon remarry (only JIG firmwares)
| 0x48C07 || 1 || Product Mode (UM allows to read this offset, it can be also written but only when already in product mode)
|-
|-
| 0x48C08 || 1 || lv0 passes this to lv1ldr (not used on >= 0.82, maybe only CEB)  
| 0x48C08 || 1 || lv0 passes this to lv1ldr (not used on >= 0.82, maybe only CEB)  
Line 164: Line 153:
| 0x48C0F || 2 || cell os flags (loader parameter)
| 0x48C0F || 2 || cell os flags (loader parameter)
|-
|-
| 0x48C11 || 1 || bootrom trace level
| 0x48C11 || 1 || bootrom trace level (0x00: fatal errors, 0x01: errors, 0x02: information messages, 0x03: debug messages)
0x00: fatal errors
0x01: errors
0x02: information messages
0x03: debug messages
0xFF: ? (default)
|-
|-
| 0x48C12 || 1 || ?
| 0x48C12 || 1 || ?
Line 177: Line 161:
| 0x48C14 || 4 || cellos_spu_configure
| 0x48C14 || 4 || cellos_spu_configure
|-
|-
| 0x48C18 || 4 || Safe Mode System Language. Using the [[Languages|language codes]]. See also [[XRegistry.sys#Settings|XRegistry.sys/setting/system/language]]
| 0x48C18 || 4 || Safe Mode System Language [[XRegistry.sys#Settings]] ( /setting/system/language )
|-
|-
| 0x48C1C || 4 || Safe Mode VSH Target (maybe QA,Debug,Retail,Kiosk?). See [[Promo_flags.txt]] and [[VSH_Exports#vshmain|GetReleaseTarget]] vsh export
| 0x48C1C || 4 || Safe Mode VSH Target (seems it can be 0xFFFFFFFE, 0xFFFFFFFF, 0x00000001 default: 0x00000000 /maybe QA,Debug,Retail,Kiosk?)
0x00000000 = ? (default)
0x00000001 = ?
0x00000005 = dtcpipdevdex (can't update to any firmware, except dtcpipdevdex firmware)
0xFFFFFFFF = ?
0xFFFFFFFE = ?
|-{{cellcolors|lightgrey}}
|-{{cellcolors|lightgrey}}
| colspan="2" | 0x48C1F || - || (lv0 NVS region 2 end)
| colspan="2" | 0x48C1F || - || (lv0 NVS region 2 end)
Line 240: Line 219:
| 0x48C61 || 1 || Recover Mode Flag
| 0x48C61 || 1 || Recover Mode Flag
|-
|-
| 0x48C62 || 8 || boot param. Accessed by [[LV2_Functions_and_Syscalls|syscalls 404]] ?. See also [[Factory_Service_Mode#Game_OS|this]]
| 0x48C62 || 8 || boot param
|-
|-
| 0x48C6A || 2 || factory process completion (bitflags ?). Accessed by [[LV2_Functions_and_Syscalls|syscalls 405, 406, 407]] ?. See also [[Factory_Service_Mode#Game_OS|this]]
| 0x48C6A || 2 || factory process completion %
Usually FFFF, but also:
00E2 - CokC12, SEM-001, CXR713120-203GB
00EA - CokD10, DIA-001, CXR714120-301GB
00E6 - CokE10, DIA-002, CXR714120-302GB
00EA - CokF10, VER-001, SW-301
00AA - CokG11, DYN-001, SW2-301
00BE - CokH11, SUR-001, SW2-302
00B2 - CokJ13, JTP-001, SW2-303 & CokK10, KTE-001, SW3-301
00B0 - CokM20, MSX-001, SW3-302 & CokM30, MPX-001, SW3-302 & CokN10, NPX-001, SW3-302 & CokP10, PQX-001, SW3-304 & CokR40, REX-001, SW3-304
00F0 - CokD10, DIA-001, CXR714120-304GB Refurb 40nm RSX
01FE - Cok14, COK-001, CXR714120-304GB Refurb 40nm RSX
|-{{cellcolors|lightgrey}}
|-{{cellcolors|lightgrey}}
| colspan="2" | 0x48C4F || - || (lv0 NVS region 5 end)
| colspan="2" | 0x48C4F || - || (lv0 NVS region 5 end)
Line 372: Line 339:




| colspan="2" | 0x48D8E || 0x50 || mode_auth_data (read/cleared by ss_sc_init_pu, checked by spu_mode_auth, used to enter product mode on jig firmwares without a dongle)
| colspan="2" | 0x48D8E || 0x50 || mode_auth_data (read/cleared by ss_sc_init_pu, checked by spu_mode_auth)
|-
|-
|}
|}
Line 386: Line 353:
QA Token ECDSA Signature is stored in 0x48013 offset (starting from 3.60 firmwares)
QA Token ECDSA Signature is stored in 0x48013 offset (starting from 3.60 firmwares)


== Undocumented region ==
== Undocumented config ==
This is 0x48800 on SC EEPROM, or at 0x7100 (mullions with 32KB EEPROM used), or at 0x4100 (mullions with 20KB EEPROM used), or at 0x1100 (sherwoods)
 
Accessed by [[Hypervisor_Reverse_Engineering | Hypervisor Service ID 32]] '''REQUEST_SYSTEM_EVENT_LOG''' ?, and [[LV2_Functions_and_Syscalls| syscall 395]] '''sys_sm_request_system_event_log''' ?


There is an unknown syscon response of 0x100 bytes when using NVS service with such params: BlockID=1, Offset=0, Size=0.
There is an unknown syscon response of 0x100 bytes when using NVS service with such params: BlockID=1, Offset=0, Size=0.
Sometimes the whole region is filled with FF's (empty, never used, or erased), it seems this procedure can be used to reset it
It can be considered an structure composed by a 0x10 header, and six available "slots" of 0x28 each, the second byte of the header seems to be some kind of counter related with the slots where the only values posibles are 0-5. The presence of data in the slots could vary usually all them are filled with data but in some rare cases the slots are empty (filled with FF's)
Sample (CokH11, SUR-001, SW2-302)
<pre>
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00001100  FF 05 FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿ.ÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00001110  16 0E F0 35 00 00 E1 18 00 04 53 00 0C 00 00 00  ..ð5..á...S.....
00001120  00 00 00 00 00 00 00 00 00 00 00 00 55 55 55 55  ............UUUU
00001130  00 00 00 00 00 00 00 00 18 F1 6F 68 00 00 E1 18  .........ñoh..á.
00001140  00 04 53 00 0C 00 00 00 00 00 00 00 00 00 00 00  ..S.............
00001150  00 00 00 00 55 55 55 55 00 00 00 00 00 00 00 00  ....UUUU........
00001160  18 F1 6F C7 00 00 E1 18 00 04 53 00 0C 00 00 00  .ñoÇ..á...S.....
00001170  00 00 00 00 00 00 00 00 00 00 00 00 55 55 55 55  ............UUUU
00001180  00 00 00 00 00 00 00 00 18 FF EE 91 00 00 E1 18  .........ÿî‘..á.
00001190  00 04 53 00 0C 00 00 00 00 00 00 00 00 00 00 00  ..S.............
000011A0  00 00 00 00 71 75 F4 75 00 00 00 00 00 00 00 00  ....quôu........
000011B0  1A 21 73 52 00 00 E1 18 00 04 53 00 0C 00 00 00  .!sR..á...S.....
000011C0  00 00 00 00 00 00 00 00 00 00 00 00 50 75 55 51  ............PuUQ
000011D0  00 00 00 00 00 00 00 00 16 0E EF D5 00 00 E1 18  ..........ïÕ..á.
000011E0  00 04 53 00 0C 00 00 00 00 00 00 00 00 00 00 00  ..S.............
000011F0  00 00 00 00 55 55 55 55 00 00 00 00 00 00 00 00  ....UUUU........
</pre>
Sample with 2 slots used
<pre>
<pre>
0000h: FF 02 FF FE FF 02 FF FF 19 FB E1 16 00 00 00 00  ÿ.ÿþÿ.ÿÿ.ûá.....  
0000h: FF 02 FF FE FF 02 FF FF 19 FB E1 16 00 00 00 00  ÿ.ÿþÿ.ÿÿ.ûá.....  
Line 439: Line 375:
</pre>
</pre>


Sample with only 1 slot used (CokP10, PQX-001nor, SW3-304)
This is 0x48800 on EEPROM
<pre>
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
00001100  FF 01 FF FF 0D FF FF FF 27 B5 4D 75 FF FF FF FF  ÿ.ÿÿ.ÿÿÿ'µMuÿÿÿÿ
00001110  1E 61 CF 07 00 00 E1 18 00 03 02 00 0C 03 00 00  .aÏ...á.........
00001120  A8 00 00 2D DC 40 00 00 00 20 00 00 3E AA A8 28  ¨..-Ü@... ..>ª¨(
00001130  00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF  ........ÿÿÿÿÿÿÿÿ
00001140  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00001150  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00001160  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00001170  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00001180  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00001190  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000011A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000011B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000011C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000011D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000011E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000011F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
 
The structure of an slot seems to be: 0x4 (timestamp) + 0x2 (unknown, always 0000) + 0x1 (unknown, always 0xE1 or 0xE2) + 0x1 (Data Size ?, usually 0x18) + 0x4 (Data Type ?) + 0x1C (data, included padding)
*The timestamp follows the same format than the timestamps of the [[Syscon_Error_Codes#Error_log_format|Syscon Error Codes]], in some syscon models the lowest value posible for this timestamps seems to be 0x0B488680 (2005/12/31 00:00:00)


<pre>
cech-c (NO BD Drive): http://pastie.org/private/grl0dc0dxajisa36chgm7w
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F


00001110  0B 74 08 2F 00 00 E1 18 00 03 15 00 0C 03 00 00  .t./..á.........
== lv0 SC EEPROM usage ==
00001120  A8 00 00 18 32 E2 00 00 00 80 00 00 FF FF FF FF  ¨...2â...€..ÿÿÿÿ
00001130  00 00 00 00 00 00 00 00                          ........
</pre>
<pre>
<pre>
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
[*] lv0 NVS regions:
 
# start_offset end_offset block  size
00001110  1F AC E5 B0 00 00 E1 18 00 03 02 00 0C 03 00 00  .¬å°..á.........
0 0x00        0x12      0x48000 0x13
00001120  A8 00 00 15 8A 20 00 00 00 40 00 00 AA AA AA AA  ¨...Š ...@..ªªªª
1 0x00        0x0B      0x48800 0x0C
00001130  00 00 00 00 00 00 00 00                          ........
2 0x00        0x1F      0x48C00 0x20
</pre>
3 0x22        0x24      0x48C00 0x03
<pre>
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
00001110  1D 59 29 DB 00 00 E2 18 01 51 40 25 40 01 03 00  .Y)Û..â..Q@%@...
00001120  00 00 00 01 08 E5 00 13 00 C7 00 00 00 00 00 00  .....å...Ç......
00001130  00 00 00 00 00 00 00 00                          ........
</pre>
<pre>
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
00001110  16 0E F0 35 00 00 E1 18 00 04 53 00 0C 00 00 00  ..ð5..á...S.....
00001120  00 00 00 00 00 00 00 00 00 00 00 00 55 55 55 55  ............UUUU
00001130  00 00 00 00 00 00 00 00                          ........
</pre>
<pre>
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
00007110  0B 48 86 7D 00 00 E1 18 53 54 52 3A 50 41 54 41  .H†}..á.STR:PATA
00007120  43 30 3A 43 61 62 6C 65 20 4E 6F 74 20 43 6F 6E  C0:Cable Not Con
00007130  6E 65 63 74 00 00 00 00                          nect....
</pre>
 
*Notes
**See the timestamp of the last sample with value 0B48867D, very close to 0B488680 (2005/12/31 00:00:00)
 
== lv0 SC EEPROM usage ==
 
<pre>
[*] lv0 NVS regions:
# start_offset end_offset block  size
0 0x00        0x12      0x48000 0x13
1 0x00        0x0B      0x48800 0x0C
2 0x00        0x1F      0x48C00 0x20
3 0x22        0x24      0x48C00 0x03
4 0x30        0x3C      0x48C00 0x0D
4 0x30        0x3C      0x48C00 0x0D
5 0x40        0x4F      0x48C00 0x10
5 0x40        0x4F      0x48C00 0x10
Line 562: Line 437:
rsx.rdcy.7          0x48CB8 0x08 [0x08 value]
rsx.rdcy.7          0x48CB8 0x08 [0x08 value]
dgbe_config          0x48D00 0x0C [0x04 ip_addr, 0x04 ip_netmask, 0x04 ip_gateway]
dgbe_config          0x48D00 0x0C [0x04 ip_addr, 0x04 ip_netmask, 0x04 ip_gateway]
qa_token            0x48D3E 0x50 [0x50 token]
UNKNOWN              0x48D20 0x08 [0x08 value]
UNKNOWN              0x48D20 0x08 [0x08 value]
qa_token            0x48D3E 0x50 [0x50 token]
</pre>
</pre>


== System Data from SC EEPROM  ==
== System Data From EEPROM  ==


Here is the list of possible SC EEPROM offsets:  
Here is the list of possible EEPROM offsets:  


{|class="wikitable"
{|class="wikitable"
|-
|-
! Index !! SC EEPROM offset !! Data size !! Description
! Index !! SC EEPROM Offset !! Size Of Data !! Description
|-
| 4 || 0x48D00 || 4 ||?
|-
| 5 || 0x48D04 || 4 ||?
|-
| 6 || 0x48D08 || 4 ||?
|-
|-
| 0 || 0x48D20 || 6 ||?
| 0 || 0x48D20 || 6 ||?
Line 587: Line 456:
|-
|-
| 3 || 0x48D38 || 6 ||?
| 3 || 0x48D38 || 6 ||?
|-
| 4 || 0x48D00 || 4 ||?
|-
| 5 || 0x48D04 || 4 ||?
|-
| 6 || 0x48D08 || 4 ||?
|}
|}


== Dumpable SC EEPROM Offset - Block ID and Block Offset Mapping Table (NVS Service) ==
== Dumpable EEPROM Offset - Block ID and Block Offset Mapping Table (NVS Service) ==


Right now we only have read access to some portions of the SC EEPROM to have access to this regions DM needs to be patched, see section dumping SC EEPROM.
Right now we only have read access to some portions of the eeprom to have access to this regions DM needs to be patched, see section dumping eeprom


{|class="wikitable"
{|class="wikitable"
|-
|-
! SC EEPROM Offset !! Block ID !! Block Offset !! Description !! Physical Offset (CXR713) !! Physical Offset (CXR714) !! Virtual Offset (SW)
! EEPROM Offset !! Block ID !! Block Offset !! Description !! Physical Offset
|-
|-
| - || - || - || ERRLOG Errors are stored here || - || - || 0x900
| 0x48000 - 0x480FF || 0x00 || 0x48000 - 0x480FF || ? || 0x7000
|-
|-
| 0x2F00 - 0x2FFF || 0x10 || 0x2F00 - 0x2FFF || "Industry Area" aka OS Version Area || 0x2F00 || 0x2F00 || 0xE00
| 0x48800 - 0x488FF || 0x01 || 0x48800 - 0x488FF || Hypervisor Area || 0x7100
|-
|-
| 0x3000 - 0x30FF || 0x20 || 0x3000 - 0x30FF || "Customer Service Area" || 0x3000 || 0x3000 || 0xF00
| 0x48C00 - 0x48CFF || 0x02 || 0x48C00 - 0x48CFF || Contains flags and tokens/ see above || 0x7200
|-
|-
| 0x48000 - 0x480FF || 0x00 || 0x48000 - 0x480FF || ? || 0x7000 || 0x4000 || 0x1000
| 0x48D00 - 0x48DFF || 0x03 || 0x48D00 - 0x48DFF || System Data Region || 0x7300
|-
|-
| 0x48800 - 0x488FF || 0x01 || 0x48800 - 0x488FF || HyperVisor Area || 0x7100 || 0x4100  || 0x1100
| 0x2F00 - 0x2FFF || 0x10 || 0x2F00 - 0x2FFF || "Industry Area" aka OS Version Area || 0x2F00
|-
|-
| 0x48C00 - 0x48CFF || 0x02 || 0x48C00 - 0x48CFF || Contains flags and tokens/ see above || 0x7200 || 0x4200 || 0x1200
| 0x3000 - 0x30FF || 0x20 || 0x3000 - 0x30FF || "Customer Service Area" || 0x3000
|-
|-
| 0x48D00 - 0x48DFF || 0x03 || 0x48D00 - 0x48DFF || System Data Region || 0x7300 || 0x4300 || 0x1300
| N/A || 0xFF || N/A || ? sys_boot_gos flag is there || No eeprom activity
|-
|-
| N/A || 0xFF || N/A || ? sys_boot_gos flag is there || No SC EEPROM activity || ? || ?
| All other offsets || Invalid || Invalid || ? ||
|-
| All other offsets || Invalid || Invalid || ? || - || - || -
|}
|}


== Dumpable only with HW flasher SC EEPROM Offsets - Full Mapping Table (NAND only) ==
== Dumpable only with HW flasher EEPROM Offsets - Full Mapping Table (NAND Only) ==
*Sample from a [[CECHGxx]] with [[SEM-001]] motherboard


{|class="wikitable"
{|class="wikitable"
Line 625: Line 497:
| 0x0-0xF || magic0 (static bytes) || <pre>99D9662BB3D761546B9C3F9ED140EDB0</pre>
| 0x0-0xF || magic0 (static bytes) || <pre>99D9662BB3D761546B9C3F9ED140EDB0</pre>
|-
|-
| 0x10-0x28F || eEID1 (probably encrypted) ||
| 0x10-0x29F(0x290) || eEID1 (probably encrypted) ||
|-
|-
| 0x290-0x4FF || Unknown ||
| 0x2A0-0x4FF(0x260) || Unknown ||
|-  
|-  
| 0x500-0x55F || magic1 (static bytes)
| 0x500-0x55F || magic1(static bytes) ||
| <pre>E01B01CF9C7FBC7D79D670086DAF497F
9BD3A5D5178DDE1D825344AE398113DD
FF525D8BF4422CC76B13AA47FA2CC369
83A720CD45D18FB3D4112888187E3040
702B91D8E6ACEEC4B801315F357E1EE3
2DA1081408D72C41AFC1B61AE7C9882D</pre>
|-
|-
| 0x560-0x95F || Authenticated Data Region 0 (snvs region 0), not used || Used on COK-001, DIA-001 / CXR714120-304GB / 40nm RSX (official refurbished)
| 0x560-0x95F || Authenticated Data Region 0 (snvs region 0), not used ||
|-
|-
| 0x960-0xD5F || Authenticated Data Region 1 (snvs region 1), contains ss-service version, secure_product_mode flag,<BR> vtrm cipher/hasher keys, versions/hashes of installed update packages, etc... || Used on COK-001, DIA-001 / CXR714120-304GB / 40nm RSX (official refurbished)
| 0x960-0xD5F || Authenticated Data Region 1 (snvs region 1), contains ss-service version, secure_product_mode flag,<BR> vtrm cipher/hasher keys, versions/hashes of installed update packages, etc... ||
|-
|-
| 0xD60-0x115F || Authenticated Data Region 2 (snvs region 2), not used || Used on COK-001, DIA-001 / CXR714120-304GB / 40nm RSX (official refurbished)
| 0xD60-0x115F || Authenticated Data Region 2 (snvs region 2), not used ||
|-
|-
| 0x1160-0x155F || Authenticated Data Region 3 (snvs region 3), not used || Used on COK-001, DIA-001 / CXR714120-304GB / 40nm RSX (official refurbished)
| 0x1160-0x155F || Authenticated Data Region 3 (snvs region 3), not used ||
|-
|-
| 0x1560-0x195F || Authenticated Data Region 4 (snvs region 4), not used || Used on COK-001, DIA-001 / CXR714120-304GB / 40nm RSX (official refurbished)
| 0x1560-0x195F || Authenticated Data Region 4 (snvs region 4), not used ||
|-
|-
| 0x1960-0x1D5F || Authenticated Data Region 5 (snvs region 5), not used || Used on COK-001, DIA-001 / CXR714120-304GB / 40nm RSX (official refurbished)
| 0x1960-0x1D5F || Authenticated Data Region 5 (snvs region 5), not used ||
|-
|-
| 0x1D60-0x215F || Authenticated Data Region 6 (snvs region 6), not used || Used on COK-001, DIA-001 / CXR714120-304GB / 40nm RSX (official refurbished)
| 0x1D60-0x215F || Authenticated Data Region 6 (snvs region 6), not used ||
|-
|-
| 0x2160-0x255F || Authenticated Data Region 7 (snvs region 7), not used || Used on COK-001, DIA-001 / CXR714120-304GB / 40nm RSX (official refurbished)
| 0x2160-0x255F || Authenticated Data Region 7 (snvs region 7), not used ||
|-
|-
| 0x2560-0x25FF || FF Region ||
| 0x2560-0x26AF || FF Region ||
|-
|-
| 0x2600-0x26AF || FF Region || rowspan="6" | System Info
| 0x26B0-(0x26CF/0x26EF) || Unknown (0x20 byte on TMU, 0x40 byte on retail boards) ||  
|-
|-
| 0x26B0-0x26CF || Unknown, encrypted ?
| 0x26F0-0x26FF || FF Region ||  
|-
|-
| 0x26D0-0x26EF || Unknown, encrypted ? (filled with FF's on TMU)
| 0x2700 - 0x270F || magic2 (static bytes) (does not exist in TMU dump) || <pre>857C4DE5BFAFD6A4A361CB5BFDD72D26</pre>
|-
|-
| 0x26F0-0x26FF || FF Region
| 0x2710-0x27FF || FF Region ||
|-
|-
| 0x2700-0x270F || magic2 (static bytes) (does not exist in TMU dump) <pre>857C4DE5BFAFD6A4A361CB5BFDD72D26</pre>
| 0x2800 - 0x2BFF || Syscon Patch Content Top-Half ||
|-
|-
| 0x2710-0x27FF || FF Region
| 0x2C00 - 0x2EFF || FF Region ||
|-
|-
| 0x2800-0x2BFF || Syscon Patch Content Top-Half ||
| 0x2F00-0x2FFF || Industry Area  (nvs region 0x20) ||
|-
| 0x2C00-0x2EFF || FF Region ||
|-
|-
| 0x2F00-0x2FFF || Industry Area (nvs region 0x20) ||
| 0x3000-0x30FF || Costumer Service Area (nvs region 0x30) ||
|-
|-
| 0x3000-0x30FF || Customer Service Area (nvs region 0x30) ||
| 0x3100-0x31FF || Special Region #0 ||
|-
|-
| 0x3100-0x31FF || Special Region #0 || Platform Config ([[Platform_ID]]<small>(hex)</small> at relative offset 0xE
| 0x3200-0x32FF || Special Region #1 ||
|-
|-
| 0x3200-0x32FF || Special Region #1 || Hardware/XDR Config
| 0x3300-0x33FF || Special Region #2 || 3JMPRW
|-
|-
| 0x3300-0x33FF || Special Region #2 || [[Syscon Thermal Configs|Thermal Config]]
| 0x3400-0x34FF || Special Region #3 || 3JMPRW
|-
|-
| 0x3400-0x34FF || Special Region #3 || [[Syscon Thermal Configs|Thermal Config]]
| 0x3500-0x35FF || Special Region #4 || .....z
|-
|-
| 0x3500-0x35FF || Special Region #4 || On/Off Count, On-time
| 0x3600-0x36FF || Special Region #5 || ...,.z
|-
|-
| 0x3600-0x36FF || Special Region #5 || On/Off Count, On-time
| 0x3700-0x370F / 0x3700-0x37FF || Serial Num (DECR only) / Special Region #6 || 2M010001207K / 2D@ 40@ 
|-
|-
| 0x3700-0x37FF || Special Region #6 [[Syscon Error Codes|Errorlog]] (retail PS3 models) ...or... Serial Num (DECR only) || 2M010001207K / 2D@ 40@ 
| 0x3710 - 0x37FF || FF Region (DECR only) ||
|-
|-
| 0x3800-0x38FF || FF Region ...or... [[Syscon Error Codes|Errorlog]] (DECR only) ||  
| 0x3800-0x38FF || FF Region ||  
|-
|-
| 0x5000-0x6FFF || FF Region ||
| 0x7000-0x70FF OR 0x4000-0x40FF || Bluray Drive Area ?? (nvs region 0) ||
|-
|-
| 0x7000-0x70FF ...or... 0x4000-0x40FF || Bluray Drive Area ?? (nvs region 0) || rowspan="4" | System Software Config
| 0x7100-0x71FF OR 0x4100-0x41FF || HyperVisor Area (nvs region 1) ||
|-
|-
| 0x7100-0x71FF ...or... 0x4100-0x41FF || HyperVisor Area (nvs region 1)
| 0x7200-0x72FF OR 0x4200-0x42FF || Token Area (nvs region 2) ||
|-
|-
| 0x7200-0x72FF ...or... 0x4200-0x42FF || Token Area (nvs region 2)
| 0x7300-0x73FF OR 0x4300-0x43FF || System Data Area (nvs region 3) ||
|-
|-
| 0x7300-0x73FF ...or... 0x4300-0x43FF || System Data Area (nvs region 3)
| 0x7400 - 0x7FFF OR 0x4400 - 0x4FFF || Syscon Patch Content Bottom-Half ||
|-
|-
| 0x7400-0x7FFF ...or... 0x4400-0x4FFF || Syscon Patch Content Bottom-Half ||  
| 0x5000-0x6FFF || FF Region ||
|-
|-
|}
|}
Line 709: Line 573:
=== Tests ===
=== Tests ===


* [https://www.psdevwiki.com/ps3/File:A8g00bD.png AES128CBC with fixed key and incremented iv (by 1 each time)]
* http://i.imgur.com/A8g00bD.png <- aes 128 cbc with fixed key and incremented iv (by 1 each time)
* [https://www.psdevwiki.com/ps3/File:HZDWGSk.png results]
* http://i.imgur.com/HZDWGSk.png <- results
* [https://www.psdevwiki.com/ps3/File:2mtrtdm.png region 0 encrypted] vs [https://www.psdevwiki.com/ps3/File:7bSdQni.png decrypted]
* http://i.imgur.com/2mtrtdm.png region 0 encrypted vs http://i.imgur.com/7bSdQni.png decrypted
* [https://www.psdevwiki.com/ps3/File:FGJKkuz.png region 7 encrypted] vs [https://www.psdevwiki.com/ps3/File:7TSeHWK.png decrypted]
* http://i.imgur.com/FGJKkuz.png region 7 encrypted vs http://i.imgur.com/7TSeHWK.png decrypted


=== Conclusion ===
=== Conclusion ===


* different key for a different authenticated region.
* different key for a different authenticated region.
* Sony uses either AES 128-cbc or AES 256-cbc (most likely 128-cbc)
* sony uses either aes 128-cbc or aes 256-cbc (most likely 128-cbc)
* Sony does this weird cbc crypto in which they only decrypt portions of 0x10 bytes of the region, then increment or decrement (most likely increment) iv, and then decrypt again. I have decided to call it ctr-cbc.
* sony does this weird cbc crypto in which they only decrypt portions of 0x10 bytes of the region, then increment or decrement (most likely increment) iv, and then decrypt again. i've decided to call it ctr-cbc
* most likely the keys used are <strike>session</strike> perconsole keys.
* most likely the keys used are <strike>session</strike> perconsole keys.
* most likely the iv used starts with 00, then gets incremented by 1 for each 0x10 bytes
* most likely the iv used starts with 00, then gets incremented by 1 for each 0x10 bytes
Line 725: Line 589:


* Zer0Tolerance for the crypto findings
* Zer0Tolerance for the crypto findings
* flatz for his awesome Syscon tool
* flatz for his awesome syscon tool


= Dumping SC EEPROM =
=Dumping your SC EEPROM=


== Linux ==
==Linux==


First you need graf_chokolo kernel ps3dm-utils and linux_hv_scripts.
First you need graf_chokolo kernel ps3dm-utils and linux_hv_scripts.


Patch DM using linux_hv_scripts:
If you are ready.
 
Patch DM using linux_hv_scripts


<pre>
<pre>
Line 739: Line 605:
</pre>
</pre>


Read the data from the region you want for example (see tables above):
Read the data from the region you want for example (see tables above)


<pre>
<pre>
Line 745: Line 611:
</pre>
</pre>


You can see some coolstuff containing dumps.
You can see some coolstuff that containing dumps


= Hashes =
=Hashes=


Where exactly the hashes are stored is still a secret. It is said that those hashes are stored in SC EEPROM.
Where exactly the hashes are stored is still a secret, it is said that those hashes are stored in SC EEPROM


To retrieve the information about the packages you have installed you can also use ps3d_utils.
To retrieve the information about the packages you have installed you can also use ps3d_utils


== Linux ==
==Linux==


=== Installed Package info ===
===Installed Package info===


<pre>
<pre>
Line 769: Line 635:
0003004100000000
0003004100000000
</pre>
</pre>
 
get_pkg_info 2 - Revoke List for program
get_pkg_info 2 - Revoke List for program


Line 775: Line 641:
0003004100000000
0003004100000000
</pre>
</pre>
 
get_pkg_info 3 - Revoke list for package
get_pkg_info 3 - Revoke list for package
 
<pre>
<pre>
0002003000000000
0002003000000000
</pre>
</pre>
 
get_pkg_info 4
get_pkg_info 4
 
<pre>
<pre>
deadbeaffacebabe
deadbeaffacebabe
</pre>
</pre>
 
get_pkg_info 5
get_pkg_info 5
 
<pre>
<pre>
deadbeaffacebabe
deadbeaffacebabe
Line 795: Line 661:


get_pkg_info 6 - Firmware Package
get_pkg_info 6 - Firmware Package
 
<pre>
<pre>
0003005000000000
0003005000000000
</pre>
</pre>


You can find more information about this in [[Hypervisor Reverse Engineering]].


=== Hashes ===
You can find more information about this in [[Hypervisor Reverse Engineering]]


What algorithm is used and what exactly is hashed is still unknown. It seems that the content of files is hashed by the SHA-1.
 
===Hashes===
 
What algorithm is used and what exactly is hashed is still unknown (seems that the content of files is hashed by the SHA-1).


<pre>
<pre>
Line 1,275: Line 1,143:
</pre>
</pre>


=== PROTO BOARD 1 ===
== Authenticated Regions ==


Here is an example of data (partition 1) from syscon which stores VTRM block key, SRK/SRH, region data, etc.
<br>
RETAIL TSOP:
<pre>
<pre>
0000000 0001 0005 0000 0002 3ec4 0003 1204 0002
0x0000: 00 00 00 03 C0 00 00 FF 00 00 00 00 00 00 00 00  ................ <- version/mode
0000010 dddd dddd cccc cccc 28ee d001 d00d dff1
0x0010: 01 A2 F6 6C 26 54 1A 54 CE A3 F9 71 50 2B A8 20  ...l&T.T...qP+.  <- vtrm block key
0000020 dddd dddd cccc cccc ffff ffff f078 0200
0x0020: 33 0E F4 5F 77 19 96 A6 7A 84 5D C9 AE B9 50 73  3.._w...z.]...Ps <- SRK
0000030 dddd dddd cccc cccc 1fff e8bd 1fbf e92d
0x0030: AE 45 5D 8E 6C BB 80 4D 7E C5 BF A4 AC 8E E1 E5  .E].l..M~....... <- SRK/SRH
0000040 0004 e28f 8002 e1a0 001e ea00 6007 e1a0
0x0040: 82 9B 0A 57 9A 40 D9 0C 00 00 00 00 00 00 00 00  ...W.@.......... <- SRH
0000050 300c e3a0 0396 e003 60ac e59f 6000 e596
0x0050: 7F 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  .....|.PQ..0MQw|
0000060 6006 e083 3004 e086 3020 e243 301f e5d3
0x0060: 7C 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  |....|.PQ..0MQw|
0000070 0005 e153 0010 ba00 5000 e3a0 5000 e581
0x0070: 7D 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  }....|.PQ..0MQw|
0000080 8000 e3a0 0002 e158 0008 0a00 0000 e28f
0x0080: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 0
0000090 000c ea00 5000 e591 50ff e285 506e e285
0x0090: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 0
00000a0 5007 e085 5000 e581 8001 e288 fff4 eaff
0x00A0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 0
00000b0 1fbf e8bd 2054 e59f f002 e1b0 1fbf e8bd
0x00B0: 00 03 00 55 00 00 00 00 50 12 F0 AD 3A 4F 9F 1B  ...U....P...:O.. <- region data 1
00000c0 004c e59f f000 e1b0 0000 e358 000a 0a00
0x00C0: F9 F1 E1 D3 64 85 D4 01 19 9D 76 9E 5C 33 8D FE  ....d.....v.\3.. <- region data 1
00000d0 3008 e1a0 000a e353 0001 ba00 300a e243
0x00D0: 39 75 10 9B 73 43 69 89 2B F6 EE 53 15 4A 3B 06  9u..sCi.+..S.J;. <- region data 1
00000e0 fffb eaff 0004 e353 0001 ba00 3004 e243
0x00E0: 00 03 00 55 00 00 00 00 7B C9 65 97 CF 0D 20 4B  ...U....{.e... K <- region data 2
00000f0 fffb eaff 0000 e353 0001 0a00 7000 e3a0
0x00F0: BB 6A B1 B9 B0 71 83 27 79 6F 16 08 FF FF FF FF  .j...q.'yo...... <- region data 2
0000100 ff10 e12f 7001 e3a0 ff10 e12f 1288 0002
0x0100: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 2
0000110 1236 0002 1222 0002 f3f4 f1f2 f3f4 f1f2
0x0110: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 3
0000120 f3f4 f1f2 f3f4 f1f2 f3f4 f1f2 f3f4 f1f2
0x0120: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 3
*
0x0130: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 3
0000fc0
0x0140: 00 01 00 00 00 00 00 00 B0 64 53 92 7F 5E 29 47  .........dS.^)G  <- region data 4
</pre>
0x0150: 9C BC 84 58 4A F2 ED 0B 50 E1 BE F3 FF FF FF FF  ...XJ...P....... <- region data 4
 
0x0160: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 4
=== PROTO BOARD 2 ===
0x0170: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 5
 
0x0180: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 5
<pre>
0x0190: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 5
0000000 0001 0005 0001 0001 4000 0003 1228 0002
0x01A0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 6
0000010 dddd dddd cccc cccc 28ee d001 d00d dff1
0x01B0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 6
0000020 dddd dddd cccc cccc ffff ffff f078 0200
0x01C0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 6
0000030 dddd dddd cccc cccc 1fff e8bd 1fbf e92d
0x01D0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 7
0000040 0004 e28f 8002 e1a0 001e ea00 6007 e1a0
0x01E0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 7
0000050 300c e3a0 0396 e003 60ac e59f 6000 e596
0x01F0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 7
0000060 6006 e083 3004 e086 3020 e243 301f e5d3
0x0200: 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00  ...P............ <- region data 8
0000070 0005 e153 0010 ba00 5000 e3a0 5000 e581
0x0210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ <- region data 8
0000080 8000 e3a0 0002 e158 0008 0a00 0000 e28f
0x0220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ <- region data 8
0000090 000c ea00 5000 e591 50ff e285 506e e285
0x0230: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 9
00000a0 5007 e085 5000 e581 8001 e288 fff4 eaff
0x0240: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 9
00000b0 1fbf e8bd 2054 e59f f002 e1b0 1fbf e8bd
0x0250: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 9
00000c0 004c e59f f000 e1b0 0000 e358 000a 0a00
0x0260: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 10
00000d0 3008 e1a0 000a e353 0001 ba00 300a e243
0x0270: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 10
00000e0 fffb eaff 0004 e353 0001 ba00 3004 e243
0x0280: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 10
00000f0 fffb eaff 0000 e353 0001 0a00 7000 e3a0
0x0290: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 11
0000100 ff10 e12f 7001 e3a0 ff10 e12f 12ac 0002
0x02A0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 11
0000110 125a 0002 1246 0002 f3f4 f1f2 f3f4 f1f2
0x02B0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 11
0000120 f3f4 f1f2 f3f4 f1f2 f3f4 f1f2 f3f4 f1f2
0x02C0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 12
*
0x02D0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 12
0000fc0
0x02E0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 12
0x02F0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 13
0x0300: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 13
0x0310: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 13
0x0320: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 14
0x0330: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 14
0x0340: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 14
0x0350: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 15
0x0360: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 15
0x0370: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 15
0x0380: 42 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  B....|.PQ..0MQw|
0x0390: 43 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  C....|.PQ..0MQw|
0x03A0: 40 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  @....|.PQ..0MQw|
0x03B0: 41 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  A....|.PQ..0MQw|
0x03C0: 46 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  F....|.PQ..0MQw|
0x03D0: 47 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  G....|.PQ..0MQw|
0x03E0: 44 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  D....|.PQ..0MQw|
0x03F0: 45 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  E....|.PQ..0MQw|
</pre>
</pre>


=== DYN-001 ===
<br> PROTO BGA(DECR):


<pre>
<pre>
0000000 4e5d 6b24 0001 0002 083e 0832 201a 0000
0000010 0faa 02ab 035d 009a 001a 0000 0000 0000
0000020 0000 0000 0000 0000 0000 0000 0000 0000
*
0000090 0000 0000 0000 0000 0000 3001 a0f8 1a14
00000a0 0000 0000 0000 0000 0000 0000 0000 0000
*
0000fc0
</pre>


*To be continued...
00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00   ........ ........
 
00000010: eb 49 35 4a c3 26 51 7a - 1e 88 c9 5d 52 03 f1 54   .I5J..Qz ....R..T
== Authenticated Regions ==
00000020: 7c d0 77 88 d1 1b 13 a2 - 43 dd c7 24 a4 79 5c d1  ..w..... C....y..
 
00000030: 3f b9 f3 c1 e9 0a 28 43 - 30 d8 e0 82 20 6e 06 29  .......C 0....n..
Here is an example of data (partition 1) from syscon EEPROM which stores VTRM block key, SRK/SRH, region data, etc.
00000040: ee aa 4c d0 ac 44 dd 7e - 00 00 00 00 00 00 00 00   ..L..D.. ........
 
00000050: 9d 57 cf 03 e0 eb 89 7a - 8f 82 3b d6 83 f5 fb 1d  .W.....z ........
RETAIL TSOP:
00000060: f5 b6 36 d3 48 d5 56 20 - 87 b9 3a fd 3b 49 ab 71  ..6.H.V. .....I.q
 
00000070: 08 40 33 b5 40 07 84 b8 - 73 3f d1 91 04 3e 1b e8  ..3..... s.......
<pre>
00000080: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27  ........ 9.V..... <- this was refurbished
0x0000: 00 00 00 03 C0 00 00 FF 00 00 00 00 00 00 00 00 ................ <- version/mode
00000090: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 0a ab d0 be  B.....1d ........ <- this was refurbished
0x0010: 01 A2 F6 6C 26 54 1A 54 CE A3 F9 71 50 2B A8 20  ...l&T.T...qP+. <- vtrm block key
000000a0: f0 d7 47 7a a7 f4 a7 5b - 2d 09 78 48 e9 46 40 62  ..Gz.... ..xH.F.b <- this was refurbished
0x0020: 33 0E F4 5F 77 19 96 A6 7A 84 5D C9 AE B9 50 73  3.._w...z.]...Ps <- SRK
000000b0: 00 04 00 78 00 00 00 00 - 9f 00 c1 b7 ba 85 9b f0  ...x.... ........
0x0030: AE 45 5D 8E 6C BB 80 4D 7E C5 BF A4 AC 8E E1 E5  .E].l..M~....... <- SRK/SRH
000000c0: 54 2f b8 07 3a 2e b7 c4 - 48 d0 4b 6d c8 10 4b 99  T....... H.Km..K.
0x0040: 82 9B 0A 57 9A 40 D9 0C 00 00 00 00 00 00 00 00 ...W.@.......... <- SRH
000000d0: ec 1e b0 9d e9 a3 b4 04 - ef 9d 7d b0 83 24 69 73   ........ ......is
0x0050: 7F 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  .....|.PQ..0MQw|
000000e0: 00 03 00 55 00 00 00 00 - e9 02 a0 49 ca 20 5d 49  ...U.... ...I...I
0x0060: 7C 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  |....|.PQ..0MQw|
000000f0: 46 65 fe 86 cf b4 3b 1e - 45 00 6e 04 ff ff ff ff  Fe...... E.n.....
0x0070: 7D 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  }....|.PQ..0MQw|
00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
0x0080: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 0
00000110: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b  ........ ...7.... <- this was refurbished
0x0090: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 0
00000120: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff  ........ yX.Q.... <- this was refurbished
0x00A0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 0
00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........ <- this was refurbished
0x00B0: 00 03 00 55 00 00 00 00 50 12 F0 AD 3A 4F 9F 1B  ...U....P...:O.. <- region data 1
00000140: 00 01 00 00 00 00 00 00 - 0f 02 32 f0 4c 09 59 bc  ........ ..2.L.Y.
0x00C0: F9 F1 E1 D3 64 85 D4 01 19 9D 76 9E 5C 33 8D FE  ....d.....v.\3.. <- region data 1
00000150: 01 c1 1c 76 77 2e e0 a4 - 80 c1 eb 2f ff ff ff ff  ...vw... ........
0x00D0: 39 75 10 9B 73 43 69 89 2B F6 EE 53 15 4A 3B 06  9u..sCi.+..S.J;. <- region data 1
00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
0x00E0: 00 03 00 55 00 00 00 00 7B C9 65 97 CF 0D 20 4B  ...U....{.e... K <- region data 2
00000170: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74  ........ 3...k.It <- this was refurbished
0x00F0: BB 6A B1 B9 B0 71 83 27 79 6F 16 08 FF FF FF FF  .j...q.'yo...... <- region data 2
00000180: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff  ...H...v ........ <- this was refurbished
0x0100: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 2
00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........ <- this was refurbished
0x0110: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 3
000001a0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
0x0120: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 3
000001b0: 1f b0 c8 f2 55 e5 1a 44 - 3a eb 77 51 15 f4 2f 25  ....U..D ..wQ....
0x0130: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 3
000001c0: 91 b0 3a 2b 43 79 c8 ca - 59 5e 3c 8c b9 f5 95 54  ....Cy.. Y......T
0x0140: 00 01 00 00 00 00 00 00 B0 64 53 92 7F 5E 29 47  .........dS.^)G  <- region data 4
000001d0: 00 01 00 00 06 01 00 00 - 00 00 00 00 00 00 00 00  ........ ........
0x0150: 9C BC 84 58 4A F2 ED 0B 50 E1 BE F3 FF FF FF FF  ...XJ...P....... <- region data 4
000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ........ ........
0x0160: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 4
000001f0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ........ ........
0x0170: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 5
00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00   ........ ........
0x0180: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 5
00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00   ........ ........
0x0190: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................ <- region data 5
00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00   ........ ........
0x01A0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 6
00000230: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
0x01B0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 6
00000240: d5 5b f0 81 49 fa 71 0b - 99 58 d3 ed d5 3e 30 96  ....I.q. .X....0.
0x01C0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 6
00000250: 59 97 b2 bf 29 62 e7 86 - de 6f 67 1c 8e 19 e1 87  Y....b.. .og.....
0x01D0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 7
00000260: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
0x01E0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 7
00000270: c7 2b 3f 31 5d 3b 60 b7 - a0 c6 f5 38 40 d7 a0 04  ...1.... ...8....
0x01F0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 7
00000280: 2c 56 df 01 6f ad 35 26 - ac 9e b1 52 97 4e 4d e8  .V..o.5. ...R.NM.
0x0200: 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 ...P............ <- region data 8
00000290: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
0x0210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ <- region data 8
000002a0: f0 84 7f e0 42 de 21 af - 58 b9 a4 11 03 d0 ff a8  ....B... X.......
0x0220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ <- region data 8
000002b0: e3 9d 54 25 28 dd 7d 46 - 20 24 43 ef 3a a3 9e aa  ..T....F ..C.....
0x0230: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 9
000002c0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
0x0240: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 9
000002d0: ff 6e f8 37 55 2f 7a e0 - 62 53 d4 be d1 d0 e1 38  .n.7U.z. bS.....8
0x0250: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 9
000002e0: 35 82 2d de a6 d7 ed d4 - a7 f6 7d 95 4f b8 41 a6  5....... ....O.A.
0x0260: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 10
000002f0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
0x0270: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 10
00000300: 7f 01 3c 78 0b 9a 98 df - 7d 13 ce ef ef c4 34 e9  ...x.... ......4.
0x0280: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 10
00000310: 7c 13 d5 e3 ff 85 0b a9 - 1d b8 b3 0e f4 63 d9 48  ........ .....c.H
0x0290: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 11
00000320: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
0x02A0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 11
00000330: 8e 4f c0 e7 c9 a9 da 14 - 2b 2d ad 2d 4e 48 f5 5b  .O...... ....NH..
0x02B0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 11
00000340: 06 ca 5a e6 7b 45 e1 45 - a5 c6 b1 a6 a5 8e d5 49  ..Z..E.E .......I
0x02C0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 12
00000350: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
0x02D0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 12
00000360: c4 e9 a3 9a ec 7c 36 97 - 25 4f e4 3d ea 73 98 63  ......6. .O...s.c
0x02E0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 12
00000370: 7c 17 0a 57 ed 44 70 08 - 6a b0 9e 3a c4 f2 cc b5  ...W.Dp. j.......
0x02F0: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 13
00000380: 49 7c 5c 74 45 75 66 c5 - 07 74 4b 66 58 84 42 d8  I..tEuf. .tKfX.B.
0x0300: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 13
00000390: cb 71 a4 a8 7e 55 e7 64 - b3 24 4f 47 aa 61 31 32  .q...U.d ..OG.a12
0x0310: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 13
000003a0: 50 f8 c1 ed 64 7a 3b 0a - 40 f6 90 a1 8e 53 65 71  P...dz.. .....Seq
0x0320: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 14
000003b0: 14 87 74 95 ef 14 48 40 - e7 28 51 74 42 d2 37 82  ..t...H. ..QtB.7.
0x0330: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 14
000003c0: 78 f2 d8 9e 06 64 71 49 - 20 65 68 f9 e0 79 f7 38  x....dqI .eh..y.8
0x0340: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 14
000003d0: 6f 1b 9e 6d bc 58 eb ae - 3f 43 83 49 b0 0b 13 f4  o..m.X.. .C.I....
0x0350: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 15
000003e0: 1d 7b 48 9a f1 a3 fb 22 - 6e 00 7a 75 d8 e3 c7 47  ..H..... n.zu...G
0x0360: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 15
000003f0: 0e 0e 8a ec 43 53 4a 65 - 19 8b 85 49 e0 9b 15 fe  ....CSJe ...I....
0x0370: DE AD BE AF FA CE BA BE DE AD BE AF FA CE BA BE  ................ <- region data 15
0x0380: 42 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  B....|.PQ..0MQw|
0x0390: 43 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  C....|.PQ..0MQw|
0x03A0: 40 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  @....|.PQ..0MQw|
0x03B0: 41 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  A....|.PQ..0MQw|
0x03C0: 46 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  F....|.PQ..0MQw|
0x03D0: 47 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  G....|.PQ..0MQw|
0x03E0: 44 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  D....|.PQ..0MQw|
0x03F0: 45 03 00 94 B4 7C B6 50 51 E5 84 30 4D 51 77 7C  E....|.PQ..0MQw|
</pre>
</pre>
PROTO BGA (DECR):


<pre>
<pre>
00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00  ........ ........
00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00  ........ ........
00000010: eb 49 35 4a c3 26 51 7a - 1e 88 c9 5d 52 03 f1 54   .I5J..Qz ....R..T
00000010: b4 68 3b 7f ad 57 3f 0f - 23 a2 a1 e8 11 49 f4 f5   .h...W.. .....I..
00000020: 7c d0 77 88 d1 1b 13 a2 - 43 dd c7 24 a4 79 5c d1   ..w..... C....y..
00000020: 28 c9 3e 9f 14 f8 2e f9 - c1 49 cd 46 6c a0 0e af   ........ .I.Fl...
00000030: 3f b9 f3 c1 e9 0a 28 43 - 30 d8 e0 82 20 6e 06 29   .......C 0....n..
00000030: 74 19 b8 b2 11 92 d0 f6 - 69 0c a6 5a e0 36 15 18   t....... i..Z.6..
00000040: ee aa 4c d0 ac 44 dd 7e - 00 00 00 00 00 00 00 00  ..L..D.. ........
00000040: 27 52 89 5f cf 59 42 28 - 00 00 00 00 00 00 00 00  .R...YB. ........
00000050: 9d 57 cf 03 e0 eb 89 7a - 8f 82 3b d6 83 f5 fb 1d   .W.....z ........
00000050: 14 9d 2f 1e c8 07 f8 77 - 92 e9 e4 ce 00 12 a0 9a   .......w ........
00000060: f5 b6 36 d3 48 d5 56 20 - 87 b9 3a fd 3b 49 ab 71   ..6.H.V. .....I.q
00000060: ad cf 41 99 f9 d3 ec 83 - 2c 8f 26 80 d4 c0 fb 0e   ..A..... ........
00000070: 08 40 33 b5 40 07 84 b8 - 73 3f d1 91 04 3e 1b e8  ..3..... s.......
00000070: b3 a3 61 ea 9a 41 17 cf - e8 50 15 d2 59 a3 51 dc   ..a..A.. .P..Y.Q.
00000080: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27  ........ 9.V..... <- this was refurbished
00000080: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27  ........ 9.V.....
00000090: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 0a ab d0 be  B.....1d ........ <- this was refurbished
00000090: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 0a ab d0 be  B.....1d ........
000000a0: f0 d7 47 7a a7 f4 a7 5b - 2d 09 78 48 e9 46 40 62  ..Gz.... ..xH.F.b <- this was refurbished
000000a0: f0 d7 47 7a a7 f4 a7 5b - 2d 09 78 48 e9 46 40 62  ..Gz.... ..xH.F.b
000000b0: 00 04 00 78 00 00 00 00 - 9f 00 c1 b7 ba 85 9b f0   ...x.... ........
000000b0: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27   ........ 9.V.....
000000c0: 54 2f b8 07 3a 2e b7 c4 - 48 d0 4b 6d c8 10 4b 99   T....... H.Km..K.
000000c0: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 05 d4 15 79   B.....1d .......y
000000d0: ec 1e b0 9d e9 a3 b4 04 - ef 9d 7d b0 83 24 69 73   ........ ......is
000000d0: f7 68 8a df ad 9e cd 34 - b4 c7 9f a8 c6 99 82 ee   .h.....4 ........
000000e0: 00 03 00 55 00 00 00 00 - e9 02 a0 49 ca 20 5d 49   ...U.... ...I...I
000000e0: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b   ........ ...7....
000000f0: 46 65 fe 86 cf b4 3b 1e - 45 00 6e 04 ff ff ff ff  Fe...... E.n.....
000000f0: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff  ........ yX.Q....
00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
00000110: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b  ........ ...7.... <- this was refurbished
00000110: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b  ........ ...7....
00000120: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff  ........ yX.Q.... <- this was refurbished
00000120: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff  ........ yX.Q....
00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........ <- this was refurbished
00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
00000140: 00 01 00 00 00 00 00 00 - 0f 02 32 f0 4c 09 59 bc   ........ ..2.L.Y.
00000140: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74   ........ 3...k.It
00000150: 01 c1 1c 76 77 2e e0 a4 - 80 c1 eb 2f ff ff ff ff  ...vw... ........
00000150: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff  ...H...v ........
00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
00000170: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74  ........ 3...k.It <- this was refurbished
00000170: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74  ........ 3...k.It
00000180: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff  ...H...v ........ <- this was refurbished
00000180: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff  ...H...v ........
00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........ <- this was refurbished
00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
000001a0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
000001a0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
000001b0: 1f b0 c8 f2 55 e5 1a 44 - 3a eb 77 51 15 f4 2f 25   ....U..D ..wQ....
000001b0: 19 38 98 8f 93 c3 2f a9 - c6 51 23 cf 12 ca 69 36   .8...... .Q....i6
000001c0: 91 b0 3a 2b 43 79 c8 ca - 59 5e 3c 8c b9 f5 95 54   ....Cy.. Y......T
000001c0: 3e 59 7e 41 1f 56 d4 03 - f4 c3 d2 6b 5d 51 e4 f4   .Y.A.V.. ...k.Q..
000001d0: 00 01 00 00 06 01 00 00 - 00 00 00 00 00 00 00 00  ........ ........
000001d0: 00 01 00 00 06 01 00 00 - 00 00 00 00 00 00 00 00  ........ ........
000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ........ ........
000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ........ ........
Line 1,454: Line 1,322:
00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ........ ........
00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ........ ........
00000230: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
00000230: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
00000240: d5 5b f0 81 49 fa 71 0b - 99 58 d3 ed d5 3e 30 96   ....I.q. .X....0.
00000240: 5f fb 4e 0b a7 ff 63 f4 - f7 0a 22 d4 1b 3d f4 7d   ..N...c. ........
00000250: 59 97 b2 bf 29 62 e7 86 - de 6f 67 1c 8e 19 e1 87   Y....b.. .og.....
00000250: 24 32 71 b1 f9 84 b0 cd - d7 42 7e ff 0c 77 c7 06   .2q..... .B...w..
00000260: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
00000260: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
00000270: c7 2b 3f 31 5d 3b 60 b7 - a0 c6 f5 38 40 d7 a0 04   ...1.... ...8....
00000270: b9 f1 da 9f 01 a0 ba a3 - 3f ce ee 46 41 f6 40 f4   ........ ...FA...
00000280: 2c 56 df 01 6f ad 35 26 - ac 9e b1 52 97 4e 4d e8   .V..o.5. ...R.NM.
00000280: 79 10 f6 1c c8 3e f3 55 - 8d 2c d0 4d 7e fa 27 81   y......U ...M....
00000290: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
00000290: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
000002a0: f0 84 7f e0 42 de 21 af - 58 b9 a4 11 03 d0 ff a8   ....B... X.......
000002a0: a9 5a 92 ea 64 a6 64 c5 - a2 06 93 38 b0 39 45 ad   .Z..d.d. ...8.9E.
000002b0: e3 9d 54 25 28 dd 7d 46 - 20 24 43 ef 3a a3 9e aa   ..T....F ..C.....
000002b0: f3 ad 9d ff 90 17 88 26 - b1 d3 6a d6 20 a5 73 2d   ........ ..j...s.
000002c0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
000002c0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
000002d0: ff 6e f8 37 55 2f 7a e0 - 62 53 d4 be d1 d0 e1 38   .n.7U.z. bS.....8
000002d0: 31 d9 71 84 3d bc 44 b0 - 2c 7a 64 f3 c6 c2 8c d1  1.q...D. .zd.....
000002e0: 35 82 2d de a6 d7 ed d4 - a7 f6 7d 95 4f b8 41 a6   5....... ....O.A.
000002e0: 4d 70 8e f0 58 8f 96 2a - 82 90 ea d2 f4 1f e6 a9   Mp..X... ........
000002f0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
000002f0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
00000300: 7f 01 3c 78 0b 9a 98 df - 7d 13 ce ef ef c4 34 e9   ...x.... ......4.
00000300: 40 0b 6d 1d fb 4f ce d2 - da 8c b2 e2 27 21 96 27   ..m..O.. ........
00000310: 7c 13 d5 e3 ff 85 0b a9 - 1d b8 b3 0e f4 63 d9 48   ........ .....c.H
00000310: 76 51 cf c8 1e a3 ad ed - 7a 8d 9e 9e a7 82 c1 b3  vQ...... z.......
00000320: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
00000320: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
00000330: 8e 4f c0 e7 c9 a9 da 14 - 2b 2d ad 2d 4e 48 f5 5b   .O...... ....NH..
00000330: d1 9b db da 69 32 00 5e - 09 2f d4 8e 22 09 97 03   ....i2.. ........
00000340: 06 ca 5a e6 7b 45 e1 45 - a5 c6 b1 a6 a5 8e d5 49   ..Z..E.E .......I
00000340: 01 ab 1b d6 0e 19 41 3c - 00 b6 2c 40 07 e4 ff 45  ......A. .......E
00000350: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
00000350: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00  ........ ........
00000360: c4 e9 a3 9a ec 7c 36 97 - 25 4f e4 3d ea 73 98 63   ......6. .O...s.c
00000360: 06 71 09 15 89 7e 7d fa - b9 38 1a e0 99 cb 02 33   .q...... .8.....3
00000370: 7c 17 0a 57 ed 44 70 08 - 6a b0 9e 3a c4 f2 cc b5   ...W.Dp. j.......
00000370: 44 9b d6 40 90 af 01 b9 - 89 b4 c0 1d 25 af 4f 84   D....... ......O.
00000380: 49 7c 5c 74 45 75 66 c5 - 07 74 4b 66 58 84 42 d8   I..tEuf. .tKfX.B.
00000380: 81 91 1f e2 fc 59 b4 fb - 43 dd 31 0f 00 96 b6 4e   .....Y.. C.1....N
00000390: cb 71 a4 a8 7e 55 e7 64 - b3 24 4f 47 aa 61 31 32   .q...U.d ..OG.a12
00000390: 41 5e 91 78 d2 4f 5c 04 - 13 71 5d 09 2f 95 4f af   A..x.O.. .q....O.
000003a0: 50 f8 c1 ed 64 7a 3b 0a - 40 f6 90 a1 8e 53 65 71   P...dz.. .....Seq
000003a0: 43 fe b6 1c 0b 6c 4d 1c - 13 0b a0 42 a9 47 2d bc   C....lM. ...B.G..
000003b0: 14 87 74 95 ef 14 48 40 - e7 28 51 74 42 d2 37 82   ..t...H. ..QtB.7.
000003b0: 54 f4 f5 80 b2 57 5b a2 - 34 3e 76 0b a0 3f a8 41   T....W.. 4.v....A
000003c0: 78 f2 d8 9e 06 64 71 49 - 20 65 68 f9 e0 79 f7 38  x....dqI .eh..y.8
000003c0: c9 9f 96 8f 9b b1 f8 bc - 3b 5d 44 a0 6a 00 38 23   ........ ..D.j.8.
000003d0: 6f 1b 9e 6d bc 58 eb ae - 3f 43 83 49 b0 0b 13 f4   o..m.X.. .C.I....
000003d0: a0 b8 53 24 f8 fd 34 5e - b9 64 f0 af 6e 28 4e 23   ..S...4. .d..n.N.
000003e0: 1d 7b 48 9a f1 a3 fb 22 - 6e 00 7a 75 d8 e3 c7 47   ..H..... n.zu...G
000003e0: 6b eb 86 db b2 72 80 ad - bc cd 9d d5 bc 42 9d d2   k....r.. .....B..
000003f0: 0e 0e 8a ec 43 53 4a 65 - 19 8b 85 49 e0 9b 15 fe   ....CSJe ...I....
000003f0: af 77 6c ab 06 08 d8 c9 - 91 2f f3 8d 45 fd df 39   .wl..... ....E..9
</pre>
</pre>
<br>
RETAIL BGA:


<pre>
<pre>
00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00  ........ ........
00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00  ........ ........
00000010: b4 68 3b 7f ad 57 3f 0f - 23 a2 a1 e8 11 49 f4 f5   .h...W.. .....I..
00000010: 37 24 90 70 31 f5 64 48 - 12 7c a5 bc 37 6f 26 8d   7..p1.dH ....7o..
00000020: 28 c9 3e 9f 14 f8 2e f9 - c1 49 cd 46 6c a0 0e af   ........ .I.Fl...
00000020: 31 80 62 8d 16 56 ba 7c - b0 6a c8 65 ad 36 c1 e1   1.b..V.. .j.e.6..
00000030: 74 19 b8 b2 11 92 d0 f6 - 69 0c a6 5a e0 36 15 18   t....... i..Z.6..
00000030: 54 61 e2 08 cd 58 a7 d9 - 3d 22 bd 1b d7 c8 f6 97   Ta...X.. ........
00000040: 27 52 89 5f cf 59 42 28 - 00 00 00 00 00 00 00 00  .R...YB. ........
00000040: 5d be bc 55 4e ae 0c dc - 00 00 00 00 00 00 00 00  ...UN... ........
00000050: 14 9d 2f 1e c8 07 f8 77 - 92 e9 e4 ce 00 12 a0 9a   .......w ........
00000050: f3 1f f5 81 d2 58 e6 b4 - ac f0 7a b4 e7 be 75 61   .....X.. ..z...ua
00000060: ad cf 41 99 f9 d3 ec 83 - 2c 8f 26 80 d4 c0 fb 0e   ..A..... ........
00000060: de 13 f1 17 35 29 5a 09 - 11 a8 ae 25 c3 f4 2f 6a   ....5.Z. .......j
00000070: b3 a3 61 ea 9a 41 17 cf - e8 50 15 d2 59 a3 51 dc   ..a..A.. .P..Y.Q.
00000070: 74 1d ed 93 a0 17 06 63 - 61 ef dd fb 98 9e 07 3e   t......c a.......
00000080: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27   ........ 9.V.....
00000080: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff   ........ ........
00000090: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 0a ab d0 be   B.....1d ........
00000090: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff   ........ ........
000000a0: f0 d7 47 7a a7 f4 a7 5b - 2d 09 78 48 e9 46 40 62   ..Gz.... ..xH.F.b
000000a0: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff   ........ ........
000000b0: 00 03 00 15 00 00 00 00 - 39 8f 56 3b d3 c3 19 27   ........ 9.V.....
000000b0: 00 03 00 55 00 00 00 00 - 66 1c 5d 52 ad 85 c0 22   ...U.... f..R....
000000c0: 42 f5 0b 2a 06 0d 31 64 - 18 f3 e3 8a 05 d4 15 79   B.....1d .......y
000000c0: 12 3f 8c 38 1f f8 e0 34 - c8 76 f0 42 dd d9 ca 89   ...8...4 .v.B....
000000d0: f7 68 8a df ad 9e cd 34 - b4 c7 9f a8 c6 99 82 ee   .h.....4 ........
000000d0: 88 c9 db 93 8c 1a 4d 77 - 1f 98 23 a1 1e f7 d0 bd   ......Mw ........
000000e0: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b   ........ ...7....
000000e0: 00 03 00 55 00 00 00 00 - 7b c9 65 97 cf 0d 20 4b   ...U.... ..e....K
000000f0: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff  ........ yX.Q....
000000f0: bb 6a b1 b9 b0 71 83 27 - 79 6f 16 08 ff ff ff ff  .j...q.. yo......
00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
00000110: 00 03 00 15 00 00 00 00 - 04 c2 14 37 09 90 c3 3b   ........ ...7....
00000110: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff   ........ ........
00000120: 24 e0 8c 2c d8 93 14 a5 - 79 58 90 51 ff ff ff ff  ........ yX.Q....
00000120: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
00000140: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74   ........ 3...k.It
00000140: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff   ........ ........
00000150: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff  ...H...v ........
00000150: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
00000170: 00 01 00 00 00 00 00 00 - 33 b2 94 a4 6b e1 49 74   ........ 3...k.It
00000170: 00 01 00 00 00 00 00 00 - b0 64 53 92 7f 5e 29 47   ........ .dS....G
00000180: cc 5f ee 48 19 ae 3c 76 - cd d2 7d db ff ff ff ff  ...H...v ........
00000180: 9c bc 84 58 4a f2 ed 0b - 50 e1 be f3 ff ff ff ff  ...XJ... P.......
00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
000001a0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00   ........ ........
000001a0: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
000001b0: 19 38 98 8f 93 c3 2f a9 - c6 51 23 cf 12 ca 69 36   .8...... .Q....i6
000001b0: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
000001c0: 3e 59 7e 41 1f 56 d4 03 - f4 c3 d2 6b 5d 51 e4 f4   .Y.A.V.. ...k.Q..
000001c0: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
000001d0: 00 01 00 00 06 01 00 00 - 00 00 00 00 00 00 00 00   ........ ........
000001d0: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00   ........ ........
000001e0: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
000001f0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00   ........ ........
000001f0: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00  ........ ........
00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00  ........ ........
00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ........ ........
00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ........ ........
00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ........ ........
00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ........ ........
00000230: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00   ........ ........
00000230: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
00000240: 5f fb 4e 0b a7 ff 63 f4 - f7 0a 22 d4 1b 3d f4 7d   ..N...c. ........
00000240: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
00000250: 24 32 71 b1 f9 84 b0 cd - d7 42 7e ff 0c 77 c7 06   .2q..... .B...w..
00000250: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
00000260: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00   ........ ........
00000260: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
00000270: b9 f1 da 9f 01 a0 ba a3 - 3f ce ee 46 41 f6 40 f4   ........ ...FA...
00000270: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
00000280: 79 10 f6 1c c8 3e f3 55 - 8d 2c d0 4d 7e fa 27 81   y......U ...M....
00000280: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
00000290: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00   ........ ........
00000290: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
000002a0: a9 5a 92 ea 64 a6 64 c5 - a2 06 93 38 b0 39 45 ad  .Z..d.d. ...8.9E.
000002a0: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
000002b0: f3 ad 9d ff 90 17 88 26 - b1 d3 6a d6 20 a5 73 2d   ........ ..j...s.
000002b0: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
000002c0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00   ........ ........
000002c0: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
000002d0: 31 d9 71 84 3d bc 44 b0 - 2c 7a 64 f3 c6 c2 8c d1   1.q...D. .zd.....
000002d0: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
000002e0: 4d 70 8e f0 58 8f 96 2a - 82 90 ea d2 f4 1f e6 a9   Mp..X... ........
000002e0: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
000002f0: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00   ........ ........
000002f0: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
00000300: 40 0b 6d 1d fb 4f ce d2 - da 8c b2 e2 27 21 96 27   ..m..O.. ........
00000300: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
00000310: 76 51 cf c8 1e a3 ad ed - 7a 8d 9e 9e a7 82 c1 b3   vQ...... z.......
00000310: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
00000320: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00   ........ ........
00000320: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
00000330: d1 9b db da 69 32 00 5e - 09 2f d4 8e 22 09 97 03   ....i2.. ........
00000330: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
00000340: 01 ab 1b d6 0e 19 41 3c - 00 b6 2c 40 07 e4 ff 45   ......A. .......E
00000340: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
00000350: de ad be af fa ce ba be - 00 00 00 00 00 00 00 00   ........ ........
00000350: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
00000360: 06 71 09 15 89 7e 7d fa - b9 38 1a e0 99 cb 02 33   .q...... .8.....3
00000360: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
00000370: 44 9b d6 40 90 af 01 b9 - 89 b4 c0 1d 25 af 4f 84   D....... ......O.
00000370: de ad be af fa ce ba be - de ad be af fa ce ba be   ........ ........
00000380: 81 91 1f e2 fc 59 b4 fb - 43 dd 31 0f 00 96 b6 4e   .....Y.. C.1....N
00000380: 23 78 00 8b 80 be 94 c3 - aa 63 7e 87 c8 dc 32 5b   .x...... .c....2.
00000390: 41 5e 91 78 d2 4f 5c 04 - 13 71 5d 09 2f 95 4f af   A..x.O.. .q....O.
00000390: 65 30 16 c7 31 b5 54 d7 - 8c 42 88 08 1c 52 6a 90   e0..1.T. .B...Rj.
000003a0: 43 fe b6 1c 0b 6c 4d 1c - 13 0b a0 42 a9 47 2d bc   C....lM. ...B.G..
000003a0: f1 f3 41 44 66 11 4f 8a - 7f 63 81 16 e0 f6 fa 94   ..ADf.O. .c......
000003b0: 54 f4 f5 80 b2 57 5b a2 - 34 3e 76 0b a0 3f a8 41   T....W.. 4.v....A
000003b0: 0a 2f 92 e5 c3 43 49 90 - 90 4d b8 c1 81 e4 dc 31   .....CI. .M.....1
000003c0: c9 9f 96 8f 9b b1 f8 bc - 3b 5d 44 a0 6a 00 38 23   ........ ..D.j.8.
000003c0: 1a 37 3a c8 a0 f8 7f 5d - 90 f1 74 6f 3d f9 c5 e4   .7...... ..to....
000003d0: a0 b8 53 24 f8 fd 34 5e - b9 64 f0 af 6e 28 4e 23   ..S...4. .d..n.N.
000003d0: 5f 44 e7 67 81 22 2a 7d - 72 97 c5 ed 99 76 92 ee   .D.g.... r....v..
000003e0: 6b eb 86 db b2 72 80 ad - bc cd 9d d5 bc 42 9d d2   k....r.. .....B..
000003e0: 52 24 8e 52 05 cb 4c 72 - 8c 5d 3d 4c f0 a2 38 00   R..R..Lr ...L..8.
000003f0: af 77 6c ab 06 08 d8 c9 - 91 2f f3 8d 45 fd df 39   .wl..... ....E..9
000003f0: 17 40 27 9f 99 f0 3c ea - 26 7c f0 df d0 da 72 23   ........ ......r.
</pre>
</pre>


RETAIL BGA:
== More samples ==
 
* https://dl.dropboxusercontent.com/u/35197530/bin/eeprom.bin
 
=Tokens=
 
Here we will document the different types off tokens known in the PS3
All tokens are tied? encrypted? using EID0.
They enable additional repository nodes.


<pre>
==List==
00000000: 00 00 00 02 c0 00 00 ff - 00 00 00 00 00 00 00 00  ........ ........
{| class="wikitable FCK__ShowTableBorders"
00000010: 37 24 90 70 31 f5 64 48 - 12 7c a5 bc 37 6f 26 8d  7..p1.dH ....7o..
|-
00000020: 31 80 62 8d 16 56 ba 7c - b0 6a c8 65 ad 36 c1 e1  1.b..V.. .j.e.6..
! Token !! Location !! Size !! SPU module !!Description
00000030: 54 61 e2 08 cd 58 a7 d9 - 3d 22 bd 1b d7 c8 f6 97  Ta...X.. ........
|-
00000040: 5d be bc 55 4e ae 0c dc - 00 00 00 00 00 00 00 00  ...UN... ........
| qa_token || sc_eeprom - 0x48D3E || 0x50 || spu_token_processor.self ||
00000050: f3 1f f5 81 d2 58 e6 b4 - ac f0 7a b4 e7 be 75 61  .....X.. ..z...ua
|-
00000060: de 13 f1 17 35 29 5a 09 - 11 a8 ae 25 c3 f4 2f 6a  ....5.Z. .......j
| user_token || ? || ? || spu_utoken_processor.self  || Encrypted/Signed
00000070: 74 1d ed 93 a0 17 06 63 - 61 ef dd fb 98 9e 07 3e  t......c a.......
|-
00000080: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
| token_seed || ? || ? || ?  || This is used to create the token with EID0
00000090: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
|}
000000a0: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
 
000000b0: 00 03 00 55 00 00 00 00 - 66 1c 5d 52 ad 85 c0 22  ...U.... f..R....
==Token Seed==
000000c0: 12 3f 8c 38 1f f8 e0 34 - c8 76 f0 42 dd d9 ca 89  ...8...4 .v.B....
 
000000d0: 88 c9 db 93 8c 1a 4d 77 - 1f 98 23 a1 1e f7 d0 bd  ......Mw ........
Unencrypted form of QA-token
000000e0: 00 03 00 55 00 00 00 00 - 7b c9 65 97 cf 0d 20 4b  ...U.... ..e....K
 
000000f0: bb 6a b1 b9 b0 71 83 27 - 79 6f 16 08 ff ff ff ff  .j...q.. yo......
==Structure==
00000100: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
 
00000110: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
This section has to be corrected, is only based on debug strings, we need to decrypt the tokens
00000120: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
 
00000130: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
===Token Seed===
00000140: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
 
00000150: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
?
00000160: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
 
00000170: 00 01 00 00 00 00 00 00 - b0 64 53 92 7f 5e 29 47  ........ .dS....G
===QA Token===
00000180: 9c bc 84 58 4a f2 ed 0b - 50 e1 be f3 ff ff ff ff  ...XJ... P.......
 
00000190: ff ff ff ff ff ff ff ff - ff ff ff ff ff ff ff ff  ........ ........
 
000001a0: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
 
000001b0: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
===User Token===
000001c0: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
 
000001d0: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
{| class="wikitable FCK__ShowTableBorders"
000001e0: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
|-
000001f0: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
! Address !! Size !! Description
00000200: 00 03 00 10 00 00 00 00 - 00 00 00 00 00 00 00 00  ........ ........
|-
00000210: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ........ ........
| ? || ? || m_magic
00000220: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ........ ........
|-
00000230: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
| ? || ? || m_format_version
00000240: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
|-
00000250: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
| ? || ? || m_size
00000260: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
|-
00000270: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
| ? || ? || m_capability
00000280: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
|-
00000290: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
| ? || ? || m_expire_date
000002a0: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
|-
000002b0: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
| ? || ? || m_idps?
000002c0: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
|-
000002d0: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
| ? || ? || m_attribute
000002e0: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
|-
000002f0: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
| ? || ? || m_digest
00000300: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
|}
00000310: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
 
00000320: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
For every atribute in the token
00000330: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
 
00000340: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
{| class="wikitable FCK__ShowTableBorders"
00000350: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
|-
00000360: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
! Address !! Size !! Description
00000370: de ad be af fa ce ba be - de ad be af fa ce ba be  ........ ........
|-
00000380: 23 78 00 8b 80 be 94 c3 - aa 63 7e 87 c8 dc 32 5b  .x...... .c....2.
| ? || ? || attr:m_type
00000390: 65 30 16 c7 31 b5 54 d7 - 8c 42 88 08 1c 52 6a 90  e0..1.T. .B...Rj.
|-
000003a0: f1 f3 41 44 66 11 4f 8a - 7f 63 81 16 e0 f6 fa 94  ..ADf.O. .c......
| ? || ? || attr:m_size
000003b0: 0a 2f 92 e5 c3 43 49 90 - 90 4d b8 c1 81 e4 dc 31  .....CI. .M.....1
|-
000003c0: 1a 37 3a c8 a0 f8 7f 5d - 90 f1 74 6f 3d f9 c5 e4  .7...... ..to....
| ? || ? || attr:m_data
000003d0: 5f 44 e7 67 81 22 2a 7d - 72 97 c5 ed 99 76 92 ee  .D.g.... r....v..
|}
000003e0: 52 24 8e 52 05 cb 4c 72 - 8c 5d 3d 4c f0 a2 38 00  R..R..Lr ...L..8.
000003f0: 17 40 27 9f 99 f0 3c ea - 26 7c f0 df d0 da 72 23  ........ ......r.
</pre>


== More samples ==
= Dumping SC EEPROM - hardware way =


* [https://dl.dropboxusercontent.com/u/35197530/bin/eeprom.bin dead link]
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"
|-
! style="background-color:red;" | <span style="background-color:lightred; color:white; font-size:200%; ">Warning</span>
|-
| style="background-color:white;" | <span style="white; color:red; font-size:150%; text-align:center; ">You can use this method at your own risk. Author is not responsible for any hardware damages and failures.  
|}
== Bus Pirate 3 Solderless method ==


= Tokens =
=== You need ===
1) PS3 motherboard with BGA syscon chip (COK001, COK002, SEM001, DIA001, etc)


Here are documented the different types of tokens used in PS3.
2) Bus Pirate v3.6 with connectors.


All tokens are tied to EID0, more specifically to [[IDPS]].
3) Wires (I used AWG32 150mm with tinned ends, see below)


Tokens enable additional repository nodes.
4) PC with OS Windows7 (Should work on other windows systems, but not tested).


== List ==
5) A sharp pencil.


{| class="wikitable FCK__ShowTableBorders"
6) Fingers ;)
|-
! Token !! Location !! Size !! SPU module !!Description
|-
| qa_token || sc_eeprom - 0x48D3E || 0x50 || spu_token_processor.self ||
|-
| user_token || ?copied from HDD or USB storage to VTRM? || ?variable? || spu_utoken_processor.self  || Encrypted/Signed
|-
| token_seed || memory (temporary data) || ? || ? || Used to create a QA Token with EID0.
|}


=== QA Token ===
=== Hardware Part ===


Used internally by Sony developpers to test the console and OS.
Find the syscon on your PS3 motherboard.
[[File:CXR713120 on SEM-001.JPG|thumbnail|none]]


=== User Token ===
Look at the EEPROM Pins location and Draw serifs on the upper surface of the chip, strictly on these pins using pencil.
[[File:CXR713120_EEPROM_PINS.JPG||thumbnail|none]]


Used to test a usermode application.
Draw the Pinout for convenience.
[[File:CXR713120 EEPROM PINOUT.JPG|thumbnail|none]]


=== Token Seed ===
Connect Bus-Pirate and AWG32 wires using probe Kit
[[File:Bus-Pirate-3 with Wires.jpg|thumbnail|none]]


Unencrypted form of QA Token.
Connect Bus-Pirate to the EEPROM Pins using the folowing table:
 
{| class="wikitable"
== Structure ==
|-
 
! Bus Pirate pin !! EEPROM pin
This section has to be corrected because it is almost only based on debug strings. We need to decrypt the tokens.
|-
 
| CLK || SKB
=== Token Seed ===
|-
 
| CS || CSB
?
 
=== QA Token ===
 
Size is about 0x50 bytes.
 
=== User Token ===
 
<syntaxhighlight lang="C">
struct user_token_attr {
    uint32_t type; // usually 1, 0 for last attribute
    uint32_t size;    // Size of this structure
    uint8_t data[0]; // size of data can be 0 */
}
 
struct user_token {
    uint32_t magic; // 0x73757400 = "sut\0"
    uint32_t format_version; // usually 1
    uint64_t size;
    uint8_t idps[16];
    uint64_t expire_date;
    uint64_t capability;
    union {
        struct user_token_attr attribute[0];
        uint8_t dummy[0xC00];
    } attributes;
    /* 0xC30 */
    uint8_t digest[0x14]; // certainly SHA-1
}
</syntaxhighlight>
 
{| class="wikitable FCK__ShowTableBorders"
|-
|-
! Offset !! Size !! Description
| MOSI || DI
|-
|-
| ? || ? || m_magic
| MISO || DO
|-
|-
| ? || ? || m_format_version
| 3V3 || RBB
|-
|-
| ? || ? || m_size
| GND || Any Ground Point
|-
| ? || ? || m_idps
|-
| ? || ? || m_expire_date
|-
| ? || ? || m_capability
|-
| ? || ? || m_attribute
|-
| ? || ? || m_digest
|}
|}
Use 1 finger to hold the wires. The wires should be well connected with the eeprom pins.
[[File:CXR713120 EEPROM FingerTrick.JPG|thumbnail|none]]
Connect Bus-Pirate to you PC with Windows7 by USB.


For every attribute in the token:
=== Software Part ===


{| class="wikitable FCK__ShowTableBorders"
Big thanks to '''Dasanko''' for the hard work and for the Syscon Flasher GUI Tool!!!
|-
! Offset !! Size !! Description
|-
| ? || ? || attr:m_type
|-
| ? || ? || attr:m_size
|-
| ? || ? || attr:m_data
|}


= Dumping SC EEPROM - hardware way =
Download and Install the driver for Bus-Pirate.


{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"
Download link: http://www.ftdichip.com/Drivers/CDM/CDM%20v2.12.00%20WHQL%20Certified.exe
|-
! style="background-color:red!important;" | <span style="background-color:lightred; color:white; font-size:200%; ">Warning</span>
|-
| <span style="white; color:red!important; font-size:150%; text-align:center; ">You can use this method at your own risk. Author is not responsible for any hardware damages and failures.  
|}


== Bus Pirate 3 Solderless method ==
Open the Device Manager and find the port number of your USB Serial Port.
[[File:USB Serial Port.jpg|thumbnail|none]]


=== Requirements ===
Download and Run Syscon Flasher.exe


1) PS3 motherboard with BGA syscon chip (COK001, COK002, SEM001, DIA001, etc)
Download link: https://www.sendspace.com/file/7jq6ka


2) Bus Pirate v3.6 with connectors.
MD5=D59A8AA9E7BB1AEB753D7C6391CE17B1


3) Wires (I used AWG32 150mm with tinned ends, see below)
[[File:Syscon Flasher GUI.jpg|thumbnail|none]]


4) PC with OS Windows7 (Should work on other windows systems, but not tested).
There are 6 simple steps to obtain the dump.


5) A sharp pencil.
1) Select the correct USB Serial Port for Bus-Pirate.


6) Fingers ;)
2) Press "Send settings to device" button. If done correctly, then "Mode" Led on the Bus Pirate will be Green.


=== Hardware Part ===
3) Press "Power on" button. If done correctly, then "VREG" Led on the Bus Pirate will be Red.


Find the Syscon on your PS3 motherboard.
4) Press "Browse" button and specify location and file name for your syscon eeprom dump.
[[File:CXR713120 on SEM-001.JPG|thumbnail|none]]


Look at the SC EEPROM Pins location and Draw serifs on the upper surface of the chip, strictly on these pins using pencil.
5) Specify Offset and Length. Offset=0 Length=0x8000 for full dump the eeprom.
[[File:CXR713120_EEPROM_PINS.JPG||thumbnail|none]]


Draw the Pinout for convenience.
6) Press "Fast Read" button and wait about 15sec.
[[File:CXR713120 EEPROM PINOUT.JPG|thumbnail|none]]


Connect Bus-Pirate and AWG32 wires using probe Kit
Enjoy:
[[File:Bus-Pirate-3 with Wires.jpg|thumbnail|none]]


Connect Bus-Pirate to the SC EEPROM pins using the folowing table:
My dump, for example:
{| class="wikitable"
|-
! Bus Pirate pin !! SC EEPROM pin
|-
| CLK || SKB
|-
| CS || CSB
|-
| MOSI || DI
|-
| MISO || DO
|-
| 3V3 ||  RBB
|-
| GND || Any Ground Point
|}


Use one finger to hold the wires. The wires should be well connected with the SC EEPROM pins.
https://mega.co.nz/#!E1kHgSZJ!4e7TdNLdkQQzinwlnRO2KmaBd0GeBliHuHFe2tkmBgQ
[[File:CXR713120 EEPROM FingerTrick.JPG|thumbnail|none]]


Connect Bus-Pirate to your PC with Windows 7 by USB.
== Bus Pirate 3 method by: ([[User_talk:Zer0Tolerance|Zer0Tolerance]]) ==


=== Software Part ===
=== You need ===
1) PS3 motherboard. I am using '''DIA-001'''. may be we can dump it from another boards, but it is unknown yet.


Big thanks to '''Dasanko''' for the hard work and for the Syscon Flasher GUI Tool!!!
2) Device that can work with SPI interface and send any commands. I am using a Bus Pirate v3.6 with connectors.


Download and Install the driver for Bus-Pirate.
3) Soldering station.


Download link: http://www.ftdichip.com/Drivers/CDM/CDM%20v2.12.00%20WHQL%20Certified.exe
4) Wires (see below).


Open the Device Manager and find the port number of your USB Serial Port.
5) Personal conputer with installed HxD, Putty (or other terminal supporting serial port connections, e.g.:Tera Term) , Notepad++
[[File:USB Serial Port.jpg|thumbnail|none]]


Download and Run Syscon Flasher.exe
6) /dev/Hands ;)


Download link: https://www.sendspace.com/file/es86dh
=== Preparation ===


MD5=D59A8AA9E7BB1AEB753D7C6391CE17B1
Find the test points on the motherboard using this picture. (for DIA-001 Users)
[[File:DIA-001 SysCon EPROM Interface.png|thumbnail|none]]


[[File:Syscon Flasher GUI.jpg|thumbnail|none]]
or this one, if you own a DECR-1400


There are 6 simple steps to obtain the dump.
[[File:DEB-001 SC EEPROM.png|thumbnail|none]]


1) Select the correct USB Serial Port for Bus-Pirate.
All points are covered with varnish. You need to carefully remove the varnish to the copper and solder the wires to it.


2) Press "Send settings to device" button. If done correctly, then "Mode" Led on the Bus Pirate will be Green.
Attach a Bus Pirate to the wires using the following table:
 
 
3) Press "Power on" button. If done correctly, then "VREG" Led on the Bus Pirate will be Red.
{| class="wikitable"
|-
! Bus Pirate pin !! Test Point
|-
| CLK || SKB
|-
| CS || CSB
|-
| MOSI || DI
|-
| MISO || DO
|-
| 3V3 || WCB, RBB
|-
| GND || Any Ground Point
|}


4) Press "Browse" button and specify location and file name for your SC EEPROM dump.
Make sure that the battery is attached to the motherboard.
 
5) Specify Offset and Length. Offset=0 Length=0x8000 for full dump of the SC EEPROM.
 
6) Press "Fast Read" button and wait about 15sec.
 
7) Enjoy
 
My dump, for example: [https://mega.co.nz/#!E1kHgSZJ!4e7TdNLdkQQzinwlnRO2KmaBd0GeBliHuHFe2tkmBgQ download link]
 
== Bus Pirate 3 method by: ([[User_talk:Zer0Tolerance|Zer0Tolerance]]) ==
 
=== Requirements ===
 
1) PS3 motherboard. I am using '''DIA-001'''. Maybe we can dump it from another motherboard, but it is unknown yet.
 
2) Device that can work with SPI interface and send any commands. I am using a Bus Pirate v3.6 with connectors.
 
3) Soldering station.
 
4) Wires (see below).
 
5) Personal conputer with installed HxD, Putty (or other terminal supporting serial port connections, e.g.:Tera Term) , Notepad++
 
6) /dev/Hands ;)
 
=== Preparation ===
 
Find the test points on the motherboard using the picture corresponding to your motherboard.
 
for DIA-001:
[[File:DIA-001 SysCon EPROM Interface.png|thumbnail|none]]
 
for DECR-1400:
[[File:DEB-001 SC EEPROM.png|thumbnail|none]]
 
All points are covered with varnish. You need to carefully remove the varnish to the copper and solder the wires to it.
 
Attach a Bus Pirate to the wires using the following table:
 
{| class="wikitable"
|-
! Bus Pirate pin !! Test Point
|-
| CLK || SKB
|-
| CS || CSB
|-
| MOSI || DI
|-
| MISO || DO
|-
| 3V3 || RBB
|-
| GND || WCB, Any Ground Point
|}


Make sure that the battery is attached to the motherboard.
Plug your Bus pirate to the USB port on your PC using mini_USB_to_USB cable. (I am using the cable from the ps3 gamepad)


Plug your Bus Pirate to the USB port on your PC using mini_USB_to_USB cable. (I am using the cable from the ps3 gamepad)
It should be done like this, see the following picture:


It should be done like on the following picture:
[[File:Dumping SC EEPROM using Bus Pirate v3.6.JPG|thumbnail|none]]
[[File:Dumping SC EEPROM using Bus Pirate v3.6.JPG|thumbnail|none]]


=== Setup software ===
=== Setup software ===


1) Install the driver for the Bus Pirate and setup your virtual COM port for it using the following table:
1) Install the driver for the Bus Pirate and setup your virtual COM port for it using following table:
 
{| class="wikitable"
{| class="wikitable"
|-
|-
Line 1,917: Line 1,683:


Now click Open button and setup mode for bus pirate using following commands:
Now click Open button and setup mode for bus pirate using following commands:
{| class="wikitable"
{| class="wikitable"
|-
|-
Line 1,951: Line 1,716:
You can use Notepad++ and Hex Editor like HxD to convert the dump to binary format.
You can use Notepad++ and Hex Editor like HxD to convert the dump to binary format.


<small>Read Command is 0xA8 0xXX 0xXX, XX XX is a block id to be read, the full SC EEPROM is 32768 bytes length (0x8000),  [r:] are syntax command of the Bus Pirate for start, read byte and end</small>
<small>Read Command is 0xA8 0xXX 0xXX, XX XX is a block id to be read, the full EEPROM is 32768 bytes lenght (0x8000),  [r:] are syntax command of the Bus Pirate for start, read byte and end</small>


== Arduino Mega method by: ([[User_talk:Abkarino|Abkarino]]) ==  
== Arduino Mega method by: ([[User_talk:Abkarino|Abkarino]]) ==  


   I had build my own Syscon EEPROM flasher based on open source hardware "'''Arduino Mega'''" and some resistors.
   I had build my own Syscon EEPROM flasher based on open source hardware "'''Arduino Mega'''" and some resistors.
This flasher will allow you fully read/write to your Syscon EEPROM (FAT consoles only till now).


This flasher will allow you to fully read/write to your Syscon EEPROM (FAT consoles only till now).
=== You need ===
 
1) PS3 motherboard. I had used '''SEM-0001''' board by desoldering Syscon chip form it but you can use, '''DIA-001''' for example without desoldering Syscon chip since all eeprom pins had a test points in the board it self.
=== Requirements ===
 
1) PS3 motherboard. I had used '''SEM-0001''' board by desoldering Syscon chip form it but you can use, '''DIA-001''' for example without desoldering Syscon chip since all SC EEPROM pins had a test points in the board it self.


2) Arduino Mega or any Arduino board.
2) Arduino Mega or any Arduino board.
Line 1,969: Line 1,732:
4) Soldering station.
4) Soldering station.


5) Wires & Bread board  (optional).
5) Wires & Bread board  (Optional).


6) Any PC that have terminal software like Putty, RealTerm and so on to access serial port, and any Hex Editor like HxD.
6) Any PC that have terminal software like Putty, RealTerm and so on to access serial port, and any Hex Editor like HxD.
Line 1,977: Line 1,740:
Find the test points on the motherboard using this picture.
Find the test points on the motherboard using this picture.
[[File:DIA-001 SysCon EPROM Interface.png|thumbnail|none]]
[[File:DIA-001 SysCon EPROM Interface.png|thumbnail|none]]
 
Or if you have a very good soldering skills and tools to desolder your SysCon then you can desolder your SysCon and solder your wires to it directly.  
Or if you have very good soldering skills and tools to desolder your SysCon then you can desolder your SysCon and solder your wires to it directly.  


All points are covered with varnish. You need to carefully remove the varnish to the copper and solder the wires to it.
All points are covered with varnish. You need to carefully remove the varnish to the copper and solder the wires to it.
Line 2,020: Line 1,782:


=== Arduino Sketch Source Code ===
=== Arduino Sketch Source Code ===
Here is my Arduino Mega sketch source code to allow you to read/write/erase PS3 Syscon EEPROM.
http://pastie.org/10004682#8,19


Here is my Arduino Mega sketch source code to allow you to read/write/erase PS3 Syscon EEPROM. [http://pastie.org/10004682#8,19 dead link]




{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)