Editing Syscon Firmware

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
= Description =
Syscon Firmware is the firmware stored on the System Controller EEPROM (see [[Syscon Hardware]]). Updates are stored in update packages within the Update_files.tar of a [[Playstation Update Package (PUP)]]. Syscon Packages appear to always be 5KB (5376 bytes) in size.
The '''Syscon firmware''' (also known as '''sys'''tem '''con'''troller '''firmware''') is the software stored inside [[Syscon Hardware|syscon]]. Composed by the base firmware (not updateable in retail syscon models) and a optional patch that is applyed virtually on runtime on top of the base firmware<br>
The syscon patches (also known as system controller update packages) for retail PS3 models are distributed in [[PKG_files|PKG]] format inside the [[Update_files.tar]] of the [[Playstation Update Package (PUP)|PS3UPDAT.PUP]]s. Syscon patches appear to always be 5KB (5376 bytes) in size.


= Update procedure =
The PS3 firmware installer PUP's contains a collection of syscon patches for all the different syscon's chips used in the different motherboard models. The ps3swu.self (system updater) checks the syscon [[More_System_Information|SoftID]] and installs the compatible patch accordingly (via updater manager ss service).<br>
The non-retail PS3 models with syscon [[CXR713F120A]] don't have patches, this special syscon model with the "F" product code (that seems to indicate that is fully flasheable) allows to overwrite the base syscon firmware through the [[Communication Processor]]


= Syscon firmwares =
= Syscon update packages =
{| class="wikitable"
d/l: [http://www.multiupload.com/JHBCOCGNUR syscon_fw1.00-4.00.rar (51.74 KB)]
|+Mullion
 
! <abbr title="Syscon firmware build id">SoftID</abbr> !! Firmware version !! Build target !! Build date !! Adds support for [[Platform ID]]s !! Corresponding [[SCEI PS3 SDK|SDK]] / [[Communication_Processor|CP]] versions !! Notes
== Package structure ==
|-{{cellcolors|lightgrey}}
Sys_con_firmware Packages can be unpacked with unpkg
| -    || v0.4.5_b4  || BACKUP      || 2005      || (Cyt1.0), (Cyt1.1), (Cyt2.1), (Cok01)    || 0.40 || Only used on the backup bank of flash models
 
|-{{cellcolors|lightgrey}}
=== Overview ===
| 06DA || v0.6.1_c8  || CYTOLOGY    || 2006/01/31 || Cyt1.2, Cyt2.0, Cyt2.2, (Cok02), (Cok03)  || 0.80 / 0.3.2 ||
{|class="wikitable"
|-{{cellcolors|lightgrey}}
| 073E || v0.6.10_c4 || CYTOLOGY    || 2006/03/01 || (Cok05)                                  || 0.81 / 0.4.3/0.4.7 ||
|-{{cellcolors|lightgrey}}
| 07FF || v0.6.11_c4 || CYTOLOGY    || 2006/03/27 || Cyt3.0, Cyt3.1, Cyt3.2, (Cok08)           || 0.82 / 0.5.3 ||
|-{{cellcolors|lightgrey}}
| 086C || v0.6.12_c5 || CYTOLOGY    || 2006/04/11 || -                                        || 0.83 / 0.6.4/0.6.5/0.6.7 ||
|-{{cellcolors|lightgrey}}
| 08F1 || v0.6.12_c7 || CYTOLOGY    || 2006/04/22 || -                                        || 0.83 ||
|-{{cellcolors|lightgrey}}
| 0955 || v0.6.14_c4 || CYTOLOGY    || 2006/05/01 || -                                        || 0.84 / 0.7.1 ||
|-{{cellcolors|lightgrey}}
| 0AF4 || v0.8.4_c8  || CYTOLOGY    || 2006/06/23 || (Cok11)                                  || 0.85 / 0.8.4/0.8.8 ||
|-{{cellcolors|lightgrey}}
| 0B48 || v0.9.9_c1  || CYTOLOGY    || 2006/07/07 || Cyt3.3, Cyt3.4, (Cok12), (Cok13), (Cok14) || 0.90 / 0.9.1 ||
|-{{cellcolors|lightgrey}}
| 0B67 || v0.9.13_k1 || COOKIE      || 2006      || -                                        || -  || [[COOKIE-13]], [[COK-001_(Prototype)|COK-001(Proto)]], etc... with a [[CXR713F120A]]
|-{{cellcolors|lightgrey}}
| 0B74 || v0.9.14_c1 || CYTOLOGY    || 2006/08/03 || -                                        || 0.91 / 0.9.2 ||
|-
|-
| 0B8E || v1.0.0_k1  || COOKIE (201) || 2006      || -                                        || -    ||
! Address !! Length !! Value !! Description
|-{{cellcolors|lightgrey}}
| 0B9D || v1.0.1_c1  || CYTOLOGY    || 2006/08/31 || -                                        || 0.93 / 0.9.4 ||
|-
|-
| 0C16 || v1.1.3_k1  || COOKIE (202) || 2006      || CokB10                                    || -    ||
| 0x00 || 0x4 || ASCI:"SCE" || SCE magic header
|-{{cellcolors|lightgrey}}
| 0C23 || v1.0.3_c1  || CYTOLOGY    || 2006/12/04 || -                                        || 1.50 / 1.1.1 ||
|-
| 0D52 || v1.2.3_k1  || COOKIE (203) || 2007      || CokC10, CokC11, CokC12, CokD10            || -    ||
|-{{cellcolors|lightgrey}}
| 0D79 || v1.0.4_c1  || CYTOLOGY    || 2007/06/21 || -                                        || 1.90 / 1.2.0 ||
|-
|-
| 0DBF || v1.3.3_k1  || COOKIE (301) || 2007      || -                                        || -    ||
| 0x04 || 0x4 || 0x2 || Flags
|-{{cellcolors|lightgrey}}
| 0E4E || v1.0.4_c2  || CYTOLOGY    || 2007/11/08 || -                                        || 2.40 / 1.3.1 ||
|-
|-
| 0E69 || v1.4.4_k2  || COOKIE (302) || 2007      || CokE10, Deb01                            || -    ||
| 0x08 || 0x4 || 0x3 || Type (0x3 = PKG)
|-
|-
| 0F29 || v1.5.0_k2  || COOKIE (303) || 2009      || -                                        || -    || Removes hardcoding from previous firmware, adds support for 65nm RSX - <span style="background:#ff4444; cursor:wait;">not dumped yet</span>
| 0x0C || 0x4 || 0x0 || Blank/Unknown
|-
|-
| 0F38 || v1.5.1_k2  || COOKIE (304) || 2010      || -                                        || -    || Adds support for 40nm RSX
| 0x10 || 0x4 || 0x0 || Blank/Unknown
|-{{cellcolors|lightgrey}}
| 0F3B || v1.0.5_c1  || CYTOLOGY    || 2010/05/12 || -                                        || 3.60 / 1.3.3 ||
|}
 
{| class="wikitable"
|+Sherwood
! <abbr title="Syscon firmware build id">SoftID</abbr> !! Firmware version !! Build target !! Build date !! <abbr title="Not final">Adds support for [[Platform ID]]s</abbr> !! Notes
|-{{cellcolors|lightgrey}}
| 0658 || ?.??.? || -      || 2008 || CokF10                        || <span style="background:#ff4444; cursor:wait;">not dumped yet</span> [[VERTIGO-02]]
|-
|-
| 065D || 0.17.0 || SW-301  || 2008 || -                              ||  
| 0x10 || 0x8 || 0x280 || Start Data Offset ('hdr_len')
|-
|-
| ???? || ?.??.? || SW-302  || 2008 || -                              || <span style="background:#ff4444; cursor:wait;">not dumped yet</span> [[VER-001]]
| 0x18 || 0x8 || 0x1080 || Data Size ('dec_size')
|-
|-
| 0832 || 1.11.0 || SW2-301 || 2009 || CokG10, CokG11                ||  
| 0x20 || 0x260 || - || Header
|-
|-
| 0898 || 1.15.0 || -       || 2009 || CokH10, CokH11, CokJ12        ||
| 0x280 || 0x40 || - || 'info0' section (see below)
|-
|-
| 08A0 || 1.16.0 || SW2-302 || 2009 ||                                ||
| 0x2C0 || 0x40 || - || 'info1' section (see below)
|-
|-
| 08C2 || 1.21.0 || SW2-303 || 2010 || CokJ13, CokJ20                ||
| 0x300 || 0x1000 || - || 'content'
|-
|-
| 0918 || 2.3.0  || SW3-301 || 2011 || CokK10                        ||  
|}
==='info0'===
{|class="wikitable"
|-
|-
| 098F || 2.12.0 || SW3-302 || 2012 || CokM20, CokM40, CokN10, CokN30 ||
! Address !! Length !! Value !! Description
|-
|-
| ???? || ?.??.? || SW3-303 || 2013 || -                              || <span style="background:#ff4444; cursor:wait;">not dumped yet</span> (unknown PS3 model/motherboard)
| 0x00 || 0x4 || 0x3 ||  
|-
|-
| 09A4 || 2.21.0 || SW3-304 || 2013 || -                              ||
| 0x04 || 0x4 || 0x8 ||  
|}
 
= Syscon patches =
<div style="float:right">[[File:MoreSystemInformation_CECHA_with_40nm_RSX.jpg|400px|thumb|left|[[CECHAxx]] Refurbished 40nm RSX / [[COK-001]] / [[CXR714120-304GB]]<br>Syscon firmware '''v1.5.1_k2''' patch '''1''']]<br>[[File:MoreSystemInformation-CECH2004B-270.JPG|400px|thumb|left|[[CECH-20xx]] / [[DYN-001]] / [[SW2-301]]<br>Syscon firmware '''1.11.0''' patch '''1.2.83E.832''']]</div>
 
These patches are in full Retail/CEX and Debug/DEX firmwares. Are intended to fix some problem in the syscon firmware
*Fix 1) System firmware 1.30 (December 6, 2006). Disables UART access to the Syscon EEPROM patch region (not for 0832)
*Fix 2) System firmware 1.81 (June 15, 2007). Patch for the HDMI display data channel read<!-- ''hdmi chstat'' ? --> function (only for 0B8E and 0C16)
*Fix 3) System firmware 3.00 (September 1, 2009). Unknown patch (only for 0832)
*Fix 4) System firmware 3.40 (June 29, 2010) and  3.41 (July 26, 2010). Patch for the rtc read<!-- ''getrtc'' ? --> function (not for 0832)
 
{| class="wikitable"
|-
|-
! <abbr title="Syscon ROM Revision">SoftID</abbr> !! sys_con_firmware package !! [[1.00_CEX|1.00]]~[[1.11_CEX|1.11]] !! [[1.30_CEX|1.30]]~[[1.80_CEX|1.80]] !! [[1.81_CEX|1.81]]~[[2.80_CEX|2.80]] !! [[3.00_CEX|3.00]]~[[3.30_CEX|3.30]] !! [[3.40_CEX|3.40]] !! [[3.41-1_CEX|3.41]]~[[4.88_CEX|4.88]] !! Notes
| 0x08 || 0x8 || - || SC firmware revision (the high word of it is the SC type)
|-{{cellcolors|lightgrey}}
! rowspan=3 | 0B8E
| SYS_CON_FIRMWARE_01000004.pkg || {{No}} || {{Yes}} (fix 1) || {{No}} || {{No}} || {{No}} || {{No}} || Superseded by SYS_CON_FIRMWARE_01000005.pkg
|-{{cellcolors|lightgrey}}
| SYS_CON_FIRMWARE_01000005.pkg || {{No}} || {{No}} || colspan="2" {{Yes}} (fix 1+2) || {{No}} || {{No}} || Superseded by SYS_CON_FIRMWARE_01000006.pkg
|-
|-
| SYS_CON_FIRMWARE_01000006.pkg || {{No}} || {{No}} || {{No}} || {{No}} || colspan="2" {{Yes}} (fix 1+2+4) || [[CXR713120-201GB]] <abbr title="Last 2 bytes of the patch 2 region, at the end of the EEPROM dumps>...4706</abbr>
| 0x0C || 0x4 || 0x0B8E(1.30-4.84)<br />0x0C16(1.81-4.84)<br />0x0D52(3.40-4.84)<br />0x0DBF(3.40-4.84)<br />0x0E69(3.40-4.84)<br />0x0F29(3.40-4.84)<br />0x0F38(3.41-4.84)<br />0x065D<br />0x0832(3.00-4.84)<br />0x08A0<br />0x08C2<br />0x0918 || 'SoftID'
|-{{cellcolors|lightgrey}}
! rowspan=2 | 0C16
| SYS_CON_FIRMWARE_01010302.pkg || {{No}} || {{No}} || colspan="2" {{Yes}} (fix 1+2) || {{No}} || {{No}} || Superseded by SYS_CON_FIRMWARE_01010303.pkg
|-
|-
| SYS_CON_FIRMWARE_01010303.pkg || {{No}} || {{No}} || {{No}} || {{No}} || colspan="2" {{Yes}} (fix 1+2+4) || [[CXR713120-202GB]] <abbr title="Last 2 bytes of the patch 2 region, at the end of the EEPROM dumps>...7214</abbr>
| 0x10 || 0x8 || 0x0001000000000004<br />0x0001000000000005<br />0x0001000000000006<br />0x0001000100030002<br />0x0001000100030003<br />0x0001000200030002<br />0x0001000300030002<br />0x0001000400040002<br />0x0001000500000002<br />0x0001000500010001<br />0x00010002083E0832<br /> || 'PatchID'
|-
|-
! 0D52
| 0x18 || 0x8 || 0x1000 || 'Content' Data Size
| SYS_CON_FIRMWARE_01020302.pkg || {{No}} || {{No}} || {{No}} || {{No}} || colspan="2" style="background:#55CC55; color:#FFFFFF; text-align:right;" | Yes (fix 1+4) || [[CXR713120-203GB]] <abbr title="Last 2 bytes of the patch 2 region, at the end of the EEPROM dumps>...F427</abbr>
|-
|-
! 0DBF
| 0x20 || 0x8 || 0x1000 || 'Content' Compressed Data Size
| SYS_CON_FIRMWARE_01030302.pkg || {{No}} || {{No}} || {{No}} || {{No}} || colspan="2" style="background:#55CC55; color:#FFFFFF; text-align:right;" | Yes (fix 1+4) || [[CXR714120-301GB]] <abbr title="Last 2 bytes of the patch 2 region, at the end of the EEPROM dumps>...F321</abbr>
|-
|-
! 0E69
| 0x28 || 0x8 || 0x0 ||  
| SYS_CON_FIRMWARE_01040402.pkg || {{No}} || {{No}} || {{No}} || {{No}} || colspan="2" style="background:#55CC55; color:#FFFFFF; text-align:right;" | Yes (fix 1+4) || [[CXR714120-302GB]] <abbr title="Last 2 bytes of the patch 2 region, at the end of the EEPROM dumps>...5096</abbr>
|-
|-
! 0F29
| 0x30 || 0x10 || 0x0 ||  
| SYS_CON_FIRMWARE_01050002.pkg || {{No}} || {{No}} || {{No}} || {{No}} || colspan="2" style="background:#55CC55; color:#FFFFFF; text-align:right;" | Yes (fix 1+4) || [[CXR714120-303GB]]
|-
|-
! 0F38
| SYS_CON_FIRMWARE_01050101.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || style="background:#55CC55; color:#FFFFFF; text-align:right;" | Yes (fix 1+4) || [[CXR714120-304GB]] <abbr title="Last 2 bytes of the patch 2 region, at the end of the EEPROM dumps>...16FA</abbr>
|-
! 0832
| SYS_CON_FIRMWARE_S1_00010002083E0832.pkg || {{No}} || {{No}} || {{No}} || colspan="3" {{Yes}} (fix 3) || [[SW2-301]]
|}
|}


The screen [[More System Information]] allows to see some details related with syscon. The syscon firmware version can be derived from the SoftID, and additionally if there is a patch installed the PatchID displayed in the screen contains both, the syscon firmware version and the patch version. Note also that there is a direct relationship in between the PatchID displayed in the screen and the patch filename. The syscon UART commands also displays some info related with the base syscon firmware and the patch
Note: PS3 firmwares cannot deal with compressed syscon firmwares, so they will abort the update process in that case.


Some examples from syscon UART:
Note2: The PatchID is also present in the first 8 bytes of decrypted content but 16bit swapped for ARM BGAs
<div style="float:left; font-size:small;">
<div style="float:top; text-align:center;">'''CECHC, CECHE / COK-002 / CXR713120-202GB'''</div><pre>
>$ revision
0C16


>$ version
==='info1'===
v1.1.3_k1
 
>$ patchvereep
major:0x0001
minor:0x0001
patch:0x0003
revision:0x0003
 
>$ patchcsum
r1 csum: [00030266] [018DB626] [90662679]
r2 csum: [000069C5] [0046B830] [5E535A06]
</pre></div>
 
<div style="float:left; font-size:small;">
<div style="float:top; text-align:center;">'''CECH-20xx / DYN-001 / SW2-301'''</div><pre>
>$ revision
# Revision = 2098(0832)
 
>$ version
# Sherwood Version = 1.11.0
 
>$ patchinfo
#
# MAJOR  :0000
# MINOR  :0000
# REV    :0000
# SYS_REV :0000
# TABLE  :00FFFFFF
# DATSIZ  :FFFF
# DATSUM  :FFFF
# SUM    :FFFF
# not applyed
</pre></div>
 
<div style="float:left; font-size:small;">
<div style="float:top; text-align:center;">'''CECH-20xx / DYN-001 / SW2-301'''</div><pre>
>$ revision
# Revision = 2098(0832)
 
>$ version
# Sherwood Version = 1.11.0
 
>$ patchinfo
#
# MAJOR  :0001
# MINOR  :0002
# REV    :083E
# SYS_REV :0832
# TABLE  :0000201A
# DATSIZ  :0FAA
# DATSUM  :02AB
# SUM    :035D
# applyed
</pre></div>
<br style="clear: left;" />
 
*Mullion PatchID names format ('''major, minor, patch, revision''')
**0B8E.0000000000000000@SC = syscon firmware '''v1.0.0_k1''', not patched
**[[Media:MoreSystemInformation-CECHA01-102.JPG|0B8E.000'''1'''000'''0'''000'''0'''000'''5'''@SC]] = syscon firmware '''v1.0.0_k1''', patch '''5''' (filename SYS_CON_FIRMWARE_0'''1'''0'''0'''0'''0'''0'''5'''.pkg)
**0F38.0000000000000000@SC = syscon firmware '''v1.5.1_k2''', not patched
**[[Media:MoreSystemInformation CECHA with 40nm RSX.jpg|0F38.000'''1'''000'''5'''000'''1'''000'''1'''@SC]] = syscon firmware '''v1.5.1_k2''', patch '''1''' (filename SYS_CON_FIRMWARE_0'''1'''0'''5'''0'''1'''0'''1'''.pkg)
*Sherwood PatchID names format ('''major, minor, rev, sys_rev''')
**0832.0000000000000000@SC = syscon firmware '''1.11.0''', not patched
**[[Media:MoreSystemInformation-CECH2004B-270.JPG|0832.000'''1'''000'''2'''0'''83E'''0'''832'''@SC]] = syscon firmware '''1.11.0''', patch '''1.2.83E.832''' (filename SYS_CON_FIRMWARE_S1_000'''1'''000'''2'''0'''83E'''0'''832'''.pkg)
 
<br style="clear: both;" />
 
= Package structure =
Sys_con_firmware Packages can be unpacked with unpkg. See [[PKG files]] and [[Certified File]]
 
== Header ==
{|class="wikitable"
{|class="wikitable"
|-
|-
! Address !! Length !! Value !! Description
! Address !! Length !! Value !! Description
|-
|-
| 0x00 || 0x4 || ASCI:"SCE" || SCE magic header
| 0x00 || 0x4 || 0x0 ||  
|-
| 0x04 || 0x4 || 0x2 || Version
|-
| 0x08 || 0x2 || 0x0 || Attribute
|-
|-
| 0x0A || 0x2 || 0x3 || Category (0x3 = Update Package)
| 0x04 || 0x4 || 0x3 ||  
|-
|-
| 0x0C || 0x4 || 0x0 || Extended Header Size (no ext header)
| 0x08 || 0x8 || 0x40 || Offset/size?
|-
|-
| 0x10 || 0x8 || 0x280 || File Offset (hdr_len)
| 0x10 || 0x4 || 0x0 ||  
|-
|-
| 0x18 || 0x8 || 0x1080 || File Size (dec_size)
| 0x14 || 0x4 || 0x0 ||  
|-
|-
| 0x20 || 0x260 || - || Encrypted part of header
| 0x18 || 0x8 || 0x1000 || 'Content' Data Size?
|-
|-
| 0x280 || 0x40 || - || '''update_package_header''' section (see below)
| 0x20 || 0x8 || 0x1 ||  
|-
|-
| 0x2C0 || 0x40 || - || '''update_package_contents_header''' section (see below)
| 0x28 || 0x8 || 0x1 ||  
|-
|-
| 0x300 || 0x1000 || - || '''content''' section
| 0x30 || 0x10 || 0x0 ||  
|-
|-
|}
|}
 
==='content' overview===
== Update Package Header ==
{|class="wikitable"
{|class="wikitable"
|-
|-
! Address !! Length !! Value !! Description
! Address !! Length !! Value !! Description
|-
|-
| 0x00 || 0x4 || 0x3 || Header Version? 3 (fixed value for all PS3 update packages)
|-
|-
| 0x04 || 0x4 || 0x8 || SoftType? 8 = SC firmware
| 0x0 || 0x1000 || - || 'content'
|-
| 0x08 || 0x8 || - || SC firmware revision (the high word of it is the SC type)
|-
| 0x0C || 0x4 || 0x0B8E(1.30-4.84)<br />0x0C16(1.81-4.84)<br />0x0D52(3.40-4.84)<br />0x0DBF(3.40-4.84)<br />0x0E69(3.40-4.84)<br />0x0F29(3.40-4.84)<br />0x0F38(3.41-4.84)<br />0x0832(3.00-4.84) || 'SoftID'
|-
| 0x10 || 0x8 || 0x0001000000000004<br />0x0001000000000005<br />0x0001000000000006<br />0x0001000100030002<br />0x0001000100030003<br />0x0001000200030002<br />0x0001000300030002<br />0x0001000400040002<br />0x0001000500000002<br />0x0001000500010001<br />0x00010002083E0832<br /> || 'PatchID' (official name is "version")
|-
| 0x18 || 0x8 || 0x1000 || '''Content''' Data Size
|-
| 0x20 || 0x8 || 0x1000 || '''Content''' Compressed Data Size
|-
| 0x28 || 0x4 || 0x0 || Attribute
|-
| 0x2C || 0x4 || 0x0 || Region
|-
| 0x30 || 0x8 || 0x0 || Image Offset
|-
| 0x38 || 0x8 || 0x0 || Reserved_0
|-
|-
|}
|}


Note: PS3 firmwares cannot deal with compressed syscon firmwares, so they will abort the update process in that case.
== Known Retail syscon update packages ==
 
These are in full Retail/CEX and Debug/DEX firmwares:
Note2: The PatchID is also present in the first 8 bytes of decrypted content but 16bit swapped for ARM BGAs
{| class="wikitable"
 
== Update Package Contents Header ==
{|class="wikitable"
|-
|-
! Address !! Length !! Value !! Description
! [[Motherboard Revisions|Board]] !! [[Syscon Hardware]] !! sys_con_firmware package !! 1.00-1.30 !! 1.30-1.80 !! 1.81-2.80 !! 3.00-3.30 !! 3.40 !! 3.41-4.75 !! SoftID or Syscon Revision !! Notes
|-{{cellcolors|lightgrey}}
! rowspan=3 | [[COK-00x#COK-001|COK-001]] !! rowspan=3 | [[CXR713120-201GB]]
| SYS_CON_FIRMWARE_01000004.pkg || {{No}} || {{Yes}} || {{No}} || {{No}} || {{No}} || {{No}} || 0B8E || Superseded by SYS_CON_FIRMWARE_01000005.pkg
|-{{cellcolors|lightgrey}}
| SYS_CON_FIRMWARE_01000005.pkg || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{No}} || {{No}} || 0B8E || Superseded by SYS_CON_FIRMWARE_01000006.pkg
|-
|-
| 0x00 || 0x8 || 0x3 || Header Version?
| SYS_CON_FIRMWARE_01000006.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0B8E ||
|-{{cellcolors|lightgrey}}
! rowspan=2 | [[COK-00x#COK-002|COK-002]] || rowspan=2 | [[CXR713120-201GB]]<br />[[CXR713120-202GB]]
| SYS_CON_FIRMWARE_01010302.pkg || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{No}} || {{No}} || 0C16 || Superseded by SYS_CON_FIRMWARE_01010303.pkg
|-
|-
| 0x08 || 0x8 || 0x40 || Header Size?
| SYS_CON_FIRMWARE_01010303.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0C16 ||  
|-
|-
| 0x10 || 0x8 || 0x0 || Chunk Offset
! [[SEM-00x|SEM-001]] || [[CXR713120-201GB]]<br />[[CXR713120-202GB]]<br />[[CXR713120-203GB]]
| SYS_CON_FIRMWARE_01020302.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0D52 ||  
|-
|-
| 0x18 || 0x8 || 0x1000 || Chunk Size
! [[DIA-00x#DIA-001|DIA-001]] || [[CXR714120-301GB]]
| SYS_CON_FIRMWARE_01030302.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0DBF ||  
|-
|-
| 0x20 || 0x8 || 0x1 || Current Chunk
! [[DIA-00x#DIA-002|DIA-002]] / [[DEB-00x#DEB-001|DEB-001]] || [[CXR714120-301GB]]<br />[[CXR714120-302GB]]
| SYS_CON_FIRMWARE_01040402.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0E69 ||  
|-
|-
| 0x28 || 0x8 || 0x1 || Chunks Total
! ??? || ???
| SYS_CON_FIRMWARE_01050002.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0F29 || rowspan=2 | CXR714120-X0XGB / SW-30x Prototype
|-
|-
| 0x30 || 0x8 || 0x0 || Reserved_0?
! ??? || ???
| SYS_CON_FIRMWARE_01050101.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || 0F38
|-
|-
| 0x38 || 0x8 || 0x0 || Reserved_1?
! [[VER-00x|VER-001]] || [[SW-30x]]
| || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 065D ||  
|-
|-
|}
! [[DYN-00x|DYN-001]] || rowspan=4 | [[SW2-30x]]
 
| SYS_CON_FIRMWARE_S1_00010002083E0832.pkg || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{Yes}} || 0832 || rowspan=2 | ps3 2k series
== Content ==
{|class="wikitable"
|-
|-
! Address !! Length !! Value !! Description
! [[SUR-00x|SUR-001]]
| || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 08A0
|-
|-
! [[JTP-00x|JTP-001]]<br />[[JSD-00x|JSD-001]]
| || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 08C2 || ps3 2k5 series
|-
|-
| 0x0 || 0x1000 || - || '''Content''' Data
! [[KTE-00x|KTE-001]]
| || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 0918 || ps3 3k series
|-
|-
! [[MSX-00x|MSX-001]]<br />[[MPX-00x|MPX-001]] || [[SW3-30x]]
| || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 098F || ps3 4k series
|}
|}


=== Content Data Header ===
This means from syscon perspective notible firmware changes where made at 1.30, 1.81, 3.00, 3.40 and 3.41 that affected retail and debug PS3 models
The header format is partially unknown at this stage.
*Firmware 1.30 (December 6, 2006) added Backup/Restore
All the Firmwares patches are written in little endian.
*Firmware 1.81 (June 15, 2007) ?
*Firmware 3.00 (September 1, 2009) resulted in Class action suit for BluRay reading problems
*Firmware 3.40 (June 29, 2010) ?
*Firmware 3.41 (July 26, 2010) ?
 
== NonRetail syscon ==
Remember, Debug/DEX consoles are normal retail consoles with different TargetID, so only those that have a nonretail board have deviating patches (like the CXR713F120A found on the [[DECR-1000A]] TOOL/DECR).
 
Tool/DECR don't have patches, they flash entire firmwares.<br />
 
Factory cp comes with 0.8.8 (corresponds to syscon fw size 0x60000)<br>
it is VERY likely that it is not possible to go below this point, so any smaller size would likely cause a brick (see [[Talk:Communication_Processor]] for more info on how to downgrade)<br>
 
DECR samples: [https://mega.co.nz/#!g50S1LRD!g8n1C191ax61YibnLEHJCQ63fT_ye1hA4Dhhrfulfs0] [https://mega.co.nz/#!jgVVCYZC!HaUXkeKFJNbzxAVkbO-Aj5LC2-yriY7rmUWKljlEQ40 mirror]:
v0.6.1c8_TMU510_u.bin  | CRC16:FAE0 | CRC32:590D9A21 | SHA1:DC8AEA0DDC6C5B813FE9861C972AAE111DA6FCAB | MD5:50794942BD9FAB7CC04A81BD8D220BA1 | 7379733103B15C07EC051E9B44D90BDF 07AD575D86B3937CFA8B3D331BE958DDB40EDFBE
v0.6.10c4_TMU510_u.bin | CRC16:B58A | CRC32:DB8A00BF | SHA1:5D52289960151E2543EBEAA805963B7B88C35DD8 | MD5:14C288A576690C587E95C8542EDC2A70 | 7379733160AF70F9CF5DF54F30D5C77C 5F360CD146EEC3A7B5026151C396C4A5F7F1EC91
v0.6.11c4_TMU510_u.bin | CRC16:8A51 | CRC32:289B15F3 | SHA1:D45214E907A104BCC6BC91D78B7B471263AB0699 | MD5:B7CFA6536329F0DFF1AAD7905627F15F | 73797331F283602B666562012850612E 3FABA6E4FE1D70724164A23886199F36A02EDB0D
v0.6.12c5_TMU510_u.bin | CRC16:31B2 | CRC32:1A1F141B | SHA1:403BF55314C4E785ED90D03A8F2E90B67CC235EA | MD5:1B19B55924445E4BBB2D970410AD6366 | 737973316E5C037615E4727464B2D929 2D2EB7DADEF6B24C4E959235E5B11917D352F9D5
v0.6.14c4_TMU510_u.bin | CRC16:FB1B | CRC32:079EF389 | SHA1:6EF7067FAD939D0B0DFC0B9418A6F4C7509104E5 | MD5:11E9F6270A5D79D0B76614B1C6FE622B | 73797331DCEAC9FA0F1B2449F332C4A9 1CBFF6FE43BDCA3B0A5AAFCE9A98D7176D951A49
v0.8.4c8_TMU510_u.bin  | CRC16:2949 | CRC32:81EFA508 | SHA1:5963B333361123782848E3639D9FA585A728691A | MD5:564D5479F5B98E244C1EA7B56BACC873 | 73797331E8A9ADD15036B33AB8E8AB17 FDCC981DA58B9F44E9331C9708C01D924D78DB3E
v0.9.9c1_TMU510_u.bin  | CRC16:172A | CRC32:EBB2D78A | SHA1:D5E693D2E22FD99CF3E330AC442CD9B07D01DB66 | MD5:216B258115F25B13C9969AF35BFCAC20 | 7379733116E6DD5F054442FACFA15A5C 5E62E8FC8059F864A91CAD142BC30BDAE77D9464
v0.9.14c1_TMU510_u.bin | CRC16:2A2C | CRC32:330CB685 | SHA1:30B19BB8B78E60D81848E8FDF6C4A79537CFBE66 | MD5:7AA5BFE64D15F8BD61EB80B999FE4343 | 73797331807BAF3D6E1B6A3CA5FDF30D 7CCE3B0E739A19C9C431D4D8C59CF1513DAF25E9
v1.0.1c1_TMU510_u.bin  | CRC16:3FD1 | CRC32:A7C7E313 | SHA1:F0DCA7130074E023FFAF58EBD06A61EE73C94907 | MD5:C95C57DC20D9AC5473C1EC914744352F | 73797331F362AE579EA3D864E27334CC 3EAB05DEC5328E885EED3295954999BD518ABFDF
v1.0.3c1_TMU510_u.bin  | CRC16:636E | CRC32:32942DFD | SHA1:83BE56F92A93B911D2BBE12DD1F6AF9CCD1EC11B | MD5:642C0E6615AACBF180C367F7927D1E30 | 737973312D08051E9F5AA1AAF2647EC0 44EE5DF74D92DDB81B1099430B0B5A243FFDA44E
v1.0.4c1_TMU510_u.bin  | CRC16:528F | CRC32:A0FBA694 | SHA1:1A5E5F97D66A754C2C7436618DC911C1C57B9FEA | MD5:6641B03FC6193E35380D681152226275 | 73797331E40325B060CDE461D250058D 8AF478F0A1C1B4B9DECA01C8770F8A9010F0A513
v1.0.5c1_TMU510_u.bin  | CRC16:59F8 | CRC32:87316EBF | SHA1:8ED74829973F740C1B825FD976F7926A95ACBE8B | MD5:717DC4187A6E446C30DACAC129090656 | 737973316856FC96CA6FA4D4652D4985 F9E998439D4C23DA9C1BA8F5C44611D826DA1CFE
 
=== dev/hda ===
dev_hda.image from [[DECR-1000A]] CP: [http://mega/content/secure.html#!shd2VBwI!aElpZXIMqxdAP0hw775sNhmkwJewVXafQvdFUGQ5Lgo dev_hda.image] [https://mega.co.nz/#!y8kWmSqR!4PPNen3bukLWt-EZm_zENT9G8Ey-Fi0YcaLHNey41m0 dev_hda.image.7z]


==== Partitions ====
{| class="wikitable sortable"
{| class="wikitable sortable"
|-
|-
! Offset !! Length !! Notes !! Related DECR Error !! Notes
! device file !! size !! type
|-
|-
| 0x0 || 0x4 || Magic || FFFFFED2 (Magic Error) || 0x1B2D700F in mullions, '''sys1''' in cytology ?
| /dev/loop0p1 || 51 MB (50577408 bytes) || 0x89
|-
|-
| 0x4 || 0x10 || Header CMAC1 || rowspan="6" | FFFFFED1 (Header Check Error) || CMAC of Partial Header (0x10,0x30 size) with header first 4 bytes instead of random 4 bytes<br>and where Header CMAC2 is zeroed Concatenated with Encrypted Body
| /dev/loop0p2 || 8,7 MB (8650752 bytes) || Linux
|-
|-
| 0x14 || 0x10 || Header CMAC2 || CMAC of Header (where this cmac has been zeroed)
| /dev/loop0p3 || 32 MB (31981568 bytes) || Linux
|-
|-
| 0x24 || 0x4 || Padding ||  
| /dev/loop0p4 || 35 MB (35127296 bytes) || Extended
|-
|-
| 0x28 || 0x4 || Total size || Always 0x1000 in mullions, 0x60040 in cytology ?
| /dev/loop0 || 4,9 MB (4883968 bytes) || Unassigned
|-
|-
| 0x2C || 0x4 || Size of binary || Always 0xFC0 in mullions, 0x60000 in cytology ?
|}
 
=== Deviating from Retail ===
Please note that without info about the SKU the listing of ID's is pretty useless
{| class="wikitable sortable"
|-
|-
| 0x30 || 0x10 || IV for AES-128 CBC ||
! sys_con_firmware package !! 1.00-1.30 !! 1.30-1.80 !! 1.81-2.80 !! 3.00-3.30 !! 3.40 !! 3.41-4.11 !! SoftID !! Notes
|-
|-
| 0x40 || 0xFC0 || Encrypted binary || FFFFFED0 (Data Check Error)<br>FFFFFECF (Data Size Check Error) ||
| ? || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 0B67 || Debug/DEX
|-
|-
|}
|}


* Note: For the weird bogus update ONLY: FFFFFF37 (Alignment Error?) (Trying any data size between 0x41 and 0x4C bytes)
== Usage ==
* Note2: v0.6.14c4 is the bogus update (only update with a weird header)
 
* Note3: setting data between 0x40 to 0x4C to zero in bogus update yields error FFFFFED0
The firmware PUP's contains a collection of patches for all the different hardware revisions of syscon's chips used in different motherboard models.
 
The ps3swu.self (system updater) decides which applicable [[Syscon Hardware]] is present and installs the needed package update(s) accordingly (via updater manager ss service).
 
Which syscon version and which patches are installed can be seen in [[More_System_Information]]


'''Samples'''
== Decryption ==
<pre>
Packages can be decrypted with the unpkg tool. Decrypted content of the updates appears to always be 0x1000 bytes (4KB).
00000000  1B 2D 70 0F AB 5E B3 99 68 20 FE 3D E1 80 6A 1D  .-p.«^³™h þ=á€j.
00000010  B8 FD 37 CF CD 45 85 AB 51 F7 05 E3 EA 32 A5 EA  ¸ý7ÏÍE…«Q÷.ãê2¥ê
00000020  67 45 F9 48 00 00 00 00 00 10 00 00 C0 0F 00 00  gEùH........À...
00000030  8B 04 07 F9 9B A2 90 3A 75 89 F1 42 12 59 DA 0D  ‹..ù›¢.:u‰ñB.YÚ.
00000040  21 7C A2 C3 5A E4 78 00 10 8D 4B F7 A2 73 9C 63  !|¢ÃZäx...K÷¢sœc
00000050  5D 8D 5D 49 16 C7 6F 2C AD 33 FE 1F D3 6C A1 CA  ].]I.Ço,.3þ.Ól¡Ê
00000060  BA AD 2B FE 8F 33 71 D7 C5 E6 5C FF BF 77 6C 80  º.+þ.3q×Åæ\ÿ¿wl€
00000070  F2 BE 11 BB 3C 52 52 DC A9 68 E5 24 AD 4F F3 48  ò¾.»<RRÜ©hå$.OóH
</pre>


-From v1.0.4c2_TMU510_u-
=== Patch/Firmware Body Decryption/Hashing ===
<pre>
00000000  73 79 73 31 73 47 59 5D  FB 85 3B 7B 4A 28 10 5D  sys1sGY]û…;{J( ]
00000010  46 EE 8C 01 3C B4 F1 82  1E 18 4F B7 4A 56 FC C7  FîŒ <´ñ‚  O·JVüÇ
00000020  FF 83 0B E0 00 00 00 00  40 00 06 00 00 00 06 00  ÿƒ à    @     
00000030  69 B6 02 69 3A 97 8B 1C  4E 18 D4 E0 63 7D CA 94  i¶ i:—‹ N Ôàc}Ê”
00000040  4B A0 79 34 79 41 BD 09  BB 68 D4 0A A0 B7 05 78  K y4yA½ »hÔ  · x
00000050  D9 8F 8F 28 6C 9A 1B 61  CF A1 E7 49 7D CA C4 A3  Ù  (lš aÏ¡çI}ÊÄ£
00000060  A4 4D 4B E0 AE 48 86 03  B1 43 F2 47 C0 C4 1D 4F  ¤MKà®H† ±CòGÀÄ O
00000070  FA E8 43 A7 1E 6E 79 8C  E5 FF 04 20 E9 44 09 B5  úèC§ nyŒåÿ  éD µ
</pre>


=== Content Data Patch (encrypted) ===
The following is all theoretical and is intended to discard possibilities about modes of operation used by aes when decrypting body of firmware/patch
Packages can be extracted with the unpkg tool. Extracted content of the updates appears to always be 0x1000 bytes (4KB).


The following is all theoretical and is intended to discard possibilities about modes of operation used by aes when decrypting body of firmware/patch<br>
We know that:
We know that:
* Two key expansions are used before applying crypto on body (one probably for hashing. the other for decrypting with cbc)
* Two key expansions are used before applying crypto on body (one probably for hashing. the other for decrypting with cbc)
* Encrypt is used when applying crypto on body TopHalf (forward ttables) and Decrypt is used when applying on body Bottomhalf (inverse ttables)
* Encrypt is used when applying crypto on body TopHalf (forward ttables) and Decrypt is used when applying on body Bottomhalf (inverse ttables)
Line 371: Line 235:
* 4 regions can be controlled for DPA and they are: 0x2790 (size 0x20) (FFs), patch header (most notably at offset 0x4 of header size 0x10 and 0x30 size 0x10), patch body tophalf(+0x40) and patch body bottomhalf(+0x50)
* 4 regions can be controlled for DPA and they are: 0x2790 (size 0x20) (FFs), patch header (most notably at offset 0x4 of header size 0x10 and 0x30 size 0x10), patch body tophalf(+0x40) and patch body bottomhalf(+0x50)
* here are the DPA bytes for each of the controlable sections:
* here are the DPA bytes for each of the controlable sections:
* 21 06 23 DC A2 98 99 4D XX 87 F8 40 FC 48 1C BF (section 2/FF's from 0x2790 on DIA-001) -> 210623DCA298994DFE87F840FC481CBF 
* 21 06 23 DC A2 98 99 4D XX 87 F8 40 FC 48 1C BF (section 2/FF's from 0x2790 on DIA-001)
* 21 06 23 DC A2 98 99 4D XX 87 F8 40 FC 48 1C BF (section 2/FF's from 0x2790 on DEB-001) -> 210623DCA298994DFE87F840FC481CBF 
* 21 06 23 DC A2 98 99 4D XX 87 F8 40 FC 48 1C BF (section 2/FF's from 0x2790 on DEB-001)
* 16 32 47 79 C3 2C 47 D3 2B 39 CA B5 83 41 0E D5 (section 3/header from DIA-001 patch content)
* 16 32 47 79 C3 2C 47 D3 2B 39 CA B5 83 41 0E D5 (section 3/header from DIA-001 patch content)
* XX XX XX XX 7B FC 27 CD D5 9A 05 09 3A DF E4 75 (section 3/header AA from DEB-001 patch content) -> 6E9CE7C57BFC27CDD59A05093ADFE475
* 7B FC 27 CD D5 9A 05 09 3A DF E4 75 BF FD 03 1A (section 3/header AA from DEB-001 patch content)
* 92 4A 87 88 20 59 6C 49 9F 0E 7D 77 2F 38 4C FC (section 3/header DD from DEB-001 patch content)
* 92 4A 87 88 20 59 6C 49 9F 0E 7D 77 2F 38 4C FC (section 3/header DD from DEB-001 patch content)
* 7D C6 3B 3B 69 DF 67 4C 94 D7 D4 A8 E0 F8 5B B2 (section 4/body from DIA-001 patch content/tophalf/forward)
* 7D C6 3B 3B 69 DF 67 4C 94 D7 D4 A8 E0 F8 5B B2 (section 4/body from DIA-001 patch content/tophalf/forward)
* 73 XX F0 3D XX 9A F0 92 4D XX 62 DA XX 48 3C DB (section 4/body from DIA-001 patch content/bottomhalf/inverse)
* 73 XX F0 3D XX 9A F0 92 4D XX 62 DA XX 48 3C DB (section 4/body from DIA-001 patch content/bottomhalf/inverse)
* 49 1F 7B 0A 48 BD 79 33 4E 16 89 F6 B0 25 86 48 (section 4/body from DEB-001 patch content/tophalf/forward)
* 49 1F 7B 0A 48 BD 79 33 4E 16 89 F6 B0 25 86 48 (section 4/body from DEB-001 patch content/tophalf/forward)
* 14 4D F1 D3 21 B6 17 46 60 81 42 E5 02 C9 07 66 (section 4/body from DEB-001 patch content/bottomhalf/inverse/PROPER) -> 6B3583DA1AA6B49106E1641178EE68C8 (inverse ttables)
* 14 4D F1 D3 21 B6 17 46 60 81 42 E5 02 C9 07 66 (section 4/body from DEB-001 patch content/bottomhalf/inverse/PROPER)
* some bytes are considered "weak" bytes and should be bruteforced in the eventuality these keys fail
* some bytes are considered "weak" bytes and should be bruteforced in the eventuality these keys fail
* another possibility is that both the header and the body are hashed and then decrypted, using for example, cmac and cbc
* another possibility is that both the header and the body are hashed and then decrypted, using for example, cmac and cbc
Line 392: Line 256:
* TopHalf is ONLY the very first 0x10 bytes AFTER the header and into the body (corresponding to 0x40 in header size 0x10)
* TopHalf is ONLY the very first 0x10 bytes AFTER the header and into the body (corresponding to 0x40 in header size 0x10)
* BottomHalf is the rest of the body itself.
* BottomHalf is the rest of the body itself.
* DYN-001 processes one entire chunk of 0x1000 bytes, 0x40 for header and 0xFC0 for body, and not two of 0x400 and 0xC00 like the Sony models
* 504 aes operations are done for the body (252/0xFC for cmac and 252/0xFC for cbc). it is unknown if cmac comes first or it is cbc.
* All attacks show weak bytes in comparisson with CXR(F), likely due to CXR being optimized for the attack (removed resistors/capacitors, etc)


= Patch structure (decrypted) =
== Header ==
The header format is partially unknown at this stage.
All the Firmwares patches are written in little endian.


== Mullion Patch structure ==
{| class="wikitable sortable"
 
{| class="wikitable"
|-
|-
! Offset !! Size !! Name !! Number !! Example !! Notes
! Offset !! Length !! Notes !! Related DECR Error !! Notes
|-
|-
| 0x00 || 0x2 || Major Version || 1 ||  ||  
| 0x0 || 0x4 || Magic || FFFFFED2 (Magic Error) ||
|-
|-
| 0x02 || 0x2 || Minor Version || 1 ||  ||
| 0x4 || 0x10 || Header CMAC1 || FFFFFED1 (Header Check Error) || CMAC of Partial Header (0x10,0x30 size) with header first 4 bytes instead of random 4 bytes and where Header CMAC2 is zeroed Concatenated with Encrypted Body
|-
| 0x04 || 0x2 || Major Revision || 1 ||  ||  
|-
|-
| 0x06 || 0x2 || Minor Revision || 1 ||  ||  
| 0x14 || 0x10 || Header CMAC2 || FFFFFED1 (Header Check Error) || CMAC of Header (where this cmac has been zeroed)
|-
|-
| 0x08 || 0x10 || Patch Addresses || 4*4 ||  ||  
| 0x24 || 0x4 || Padding || FFFFFED1 (Header Check Error) ||
|-
|-
| 0x18 || 0x10 || Patch Instruction / Data || 4*4 ||  ||  
| 0x28 || 0x4 || Total size || FFFFFED1 (Header Check Error) ||
|-
|-
| 0x28 || 0x10 || Patch Jump Instruction Addresses || 4*4 ||  ||  
| 0x2c || 0x4 || Size of binary || FFFFFED1 (Header Check Error) ||
|-
|-
| 0x38 || 0x388 || Additional Patch Instructions || 1 ||  ||  
| 0x30 || 0x10 || IV for AES-128 CBC || FFFFFED1 (Header Check Error) ||  
|-
|-
| 0x3C0 || 0xC00 || HDMI Patch || 1 ||  ||  
| 0x40 || 0xfc0 || Encrypted binary || FFFFFED0 (Data Check Error) / FFFFFECF (Data Size Check Error) ||
|-
|-
|}
|}


== Sherwood Patch structure ==
* Note: For the weird bogus update ONLY: FFFFFF37 (Alignment Error?) (Trying any data size between 0x41 and 0x4C bytes)
{| class="wikitable"
* Note2: v0.6.14c4 is the bogus update (only update with a weird header)
|-
* Note3: setting data between 0x40 to 0x4C to zero in bogus update yields error FFFFFED0
! Offset !! Size !! Name !! Number !! Example !! Notes
|-
| 0x00 || 0x4 || Magic || 1 || 0x5D4E246B ||
|-
| 0x04 || 0x2 || Major Version || 1 || 0x0001 || In the output of the UART command ''patchinfo'' is named ''MAJOR''
|-
| 0x06 || 0x2 || Minor Version || 1 || 0x0002 || In the output of the UART command ''patchinfo'' is named ''MINOR''
|-
| 0x08 || 0x2 || Major Revision || 1 || 0x083E || In the output of the UART command ''patchinfo'' is named ''REV'' (patch revision)
|-
| 0x0A || 0x2 || Minor Revision || 1 || 0x0832 || In the output of the UART command ''patchinfo'' is named ''SYS_REV'' (syscon revision)
|-
| 0x0C || 0x4 || Absolute Table Address || 1 || 0x0000201A || In the output of the UART command ''patchinfo'' is named ''TABLE''
|-
| 0x10 || 0x2 || Data Size || 1 || 0x0FAA || In the output of the UART command ''patchinfo'' is named ''DATSIZE''
|-
| 0x12 || 0x2 || Data Checksum || 1 || 0x02AB || In the output of the UART command ''patchinfo'' is named ''DATSUM''
|-
| 0x14 || 0x2 || Patch Checksum || 1 || 0x035D || In the output of the UART command ''patchinfo'' is named ''SUM'' (patch checksum)
|-
| 0x16 || 0x2 || Relative Data Address || 1 || 0x0000 || Not parsed/ignored on SW (only used on SW2/SW3). Relative to the patch start address (0x2000)
|-
| 0x18 || 0x2 || Relative Table Address || 1 || 0x0000 || Not parsed/ignored on SW (only used on SW2/SW3). Relative to the patch start address (0x2000)
|-
| 0x1A || 0x80 || Table || 4*0x20 ||  ||
|-
| 0x9A || 0x6 || Padding || - ||  || Not parsed/ignored on SW (only used on SW2/SW3)
|-
|}


= Command list =
=== Samples ===
<pre>
00000000  1B 2D 70 0F AB 5E B3 99 68 20 FE 3D E1 80 6A 1D  .-p.«^³™h þ=á€j.
00000010  B8 FD 37 CF CD 45 85 AB 51 F7 05 E3 EA 32 A5 EA  ¸ý7ÏÍE…«Q÷.ãê2¥ê
00000020  67 45 F9 48 00 00 00 00 00 10 00 00 C0 0F 00 00  gEùH........À...
00000030  8B 04 07 F9 9B A2 90 3A 75 89 F1 42 12 59 DA 0D  ‹..ù›¢.:u‰ñB.YÚ.
00000040  21 7C A2 C3 5A E4 78 00 10 8D 4B F7 A2 73 9C 63  !|¢ÃZäx...K÷¢sœc
00000050  5D 8D 5D 49 16 C7 6F 2C AD 33 FE 1F D3 6C A1 CA  ].]I.Ço,.3þ.Ól¡Ê
00000060  BA AD 2B FE 8F 33 71 D7 C5 E6 5C FF BF 77 6C 80  º.+þ.3q×Åæ\ÿ¿wl€
00000070  F2 BE 11 BB 3C 52 52 DC A9 68 E5 24 AD 4F F3 48  ò¾.»<RRÜ©hå$.OóH
</pre>


== Mullion ==
-From v1.0.4c2_TMU510_u-
<pre>
00000000  73 79 73 31 73 47 59 5D  FB 85 3B 7B 4A 28 10 5D  sys1sGY]û…;{J( ]
00000010  46 EE 8C 01 3C B4 F1 82  1E 18 4F B7 4A 56 FC C7  FîŒ <´ñ‚  O·JVüÇ
00000020  FF 83 0B E0 00 00 00 00  40 00 06 00 00 00 06 00  ÿƒ à    @     
00000030  69 B6 02 69 3A 97 8B 1C  4E 18 D4 E0 63 7D CA 94  i¶ i:—‹ N Ôàc}Ê”
00000040  4B A0 79 34 79 41 BD 09  BB 68 D4 0A A0 B7 05 78  K y4yA½ »hÔ  · x
00000050  D9 8F 8F 28 6C 9A 1B 61  CF A1 E7 49 7D CA C4 A3  Ù  (lš aÏ¡çI}ÊÄ£
00000060  A4 4D 4B E0 AE 48 86 03  B1 43 F2 47 C0 C4 1D 4F  ¤MKà®H† ±CòGÀÄ O
00000070  FA E8 43 A7 1E 6E 79 8C  E5 FF 04 20 E9 44 09 B5  úèC§ nyŒåÿ  éD µ
</pre>


=== External commands ===
=== Observations ===
<!-- Im wondering if there is some easy way to indicate in wiki what means each byte
* The first 4 bytes (0x1B2D700F) appear static in each package.
*Permission
* The next 0x20 bytes appear to change with each package
** 0x00008096 = ?
* The following 12 bytes (0x0000000000100000C00F0000) also appear static, but it's the firmware size and fw size - header size; infact if correctly converted to little endian 00000000 00001000 00000fc0, where 00000000 is Unknown, 00001000 is 4096 in dec (file size) and 00000fc0 is 4032 in dec (update size).
** 0x000080D5 = ?
* On the DECH fw, the update works in the same way: 000000004000060000000600 converted will be: 00000000 00060040 00060000, where, 00000000 is probably padding, file size 00060040, 00060000 update size
** 0x000080D6 = ?
* the first 0x40 bytes probably are IV + HASH + update infos. probably the algorithm used is AES.
** 0x0000809A = ?
* algorithm used is aes 128 cbc on the body (iv is at + 0x30)
** 0x000080DA = ?
** 0x0000C0D5 = ?
** 0x0000C0D7 = ?
** 0x0000C0DF = ?
** 0x0000C0EF = ?
** 0x0000C0FF = ?
-->


{| class="wikitable sortable"
== Access to Syscon from Linux ==
! Address              !! Command      !! Subcommand  !! Permission 
Access SysCon ROM without needing ps3dm-utils: http://wiki.gitbrew.org/wikibrew/PS3:HvReverseEngineering#SYSCON
|-
| 0x32959              || BOOT        || MODE        || 0x000080D6 
|-
| 0x329D5              || BOOT        || CONT        || 0x000080D5 
|-
| 0x342D7              || SHUTDOWN    || -            || 0x0000C0D5 
|-
| 0x32A51              || HALT        || -            || 0x0000C0D5 
|-
| 0x32A85              || BOOTENABLE  || -            || 0x0000809A 
|-
| 0x33491              || AUTH1        || -            || 0x0000C0EF 
|-
| 0x33525              || AUTH2        || -            || 0x0000C0EF 
|-
| 0x33619              || AUTHVER      || SET          || 0x0000C0DF 
|-
| 0x335BF              || AUTHVER      || GET          || 0x0000C0FF 
|-
| 0x32AC3              || EEP          || INIT        || 0x000080DA 
|-
| 0x32C51              || EEP          || SET          || 0x0000C0DF 
|-
| 0x32D3D              || EEP          || GET          || 0x0000C0DF 
|-
| 0x32EA7              || PDAREA      || SET          || 0x0000C0DF 
|-
| 0x32E3B              || PDAREA      || GET          || 0x0000C0DF 
|-
| 0x330C5              || CSAREA      || SET          || 0x0000C0DF 
|-
| 0x33057              || CSAREA      || GET          || 0x0000C0DF 
|-
| 0x33169              || VID          || GET          || 0x0000C0D5 
|-
| 0x331D7              || CID          || GET          || 0x0000C0D5 
|-
| 0x3321D              || ECID        || GET          || 0x0000C0D5 
|-
| 0x3325D              || REV          || SB          || 0x0000C0D5 
|-
| 0x3328D              || SPU          || INFO        || 0x0000C0D5 
|-
| 0x332E1              || KSV          || -            || 0x0000C0D5 
|-
| 0x33685              || FAN          || SETPOLICY    || 0x0000C0D7 
|-
| 0x33717              || FAN          || GETPOLICY    || 0x0000C0D7 
|-
| 0x33781              || FAN          || START        || 0x0000C0D7 
|-
| 0x33781              || FAN          || STOP        || 0x0000C0D7 
|-
| 0x33951              || FAN          || SETDUTY      || 0x0000C0D7 
|-
| 0x339C3              || FAN          || GETDUTY      || 0x0000C0D7 
|-
| 0x33A27              || R8          || -            || 0x0000C0DF 
|-
| 0x33AD1              || W8          || -            || 0x0000C0DF 
|-
| 0x33B71              || R16          || -            || 0x0000C0DF 
|-
| 0x33C19              || W16          || -            || 0x0000C0DF 
|-
| 0x33CBB              || R32          || -            || 0x0000C0DF 
|-
| 0x33E49              || W32          || -            || 0x0000C0DF 
|-
| 0x33EE9              || RBE          || -            || 0x0000C0D5 
|-
| 0x33F91              || WBE          || -            || 0x0000C0D5 
|-
| 0x34049              || PORTSTAT    || -            || 0x0000C0DF 
|-
| 0x332BF              || VER          || -            || 0x0000C0FF 
|-
| 0x341C5              || BUZ          || -            || 0x00008096 
|-
| 0x342D7              || SERVFAN      || -            || 0x0000C0D7 
|-
| 0x341F9              || ERRLOG      || START        || 0x0000C0DF 
|-
| 0x34221              || ERRLOG      || STOP        || 0x0000C0DF 
|-
| 0x34249              || ERRLOG      || GET          || 0x0000C0FF 
|-
| 0x342B3              || ERRLOG      || CLEAR        || 0x0000C0DF 
|-
|}


=== Internal commands ===
== List of Soft IDs in Decimal Form ==
{| class="wikitable sortable"
|-
! Command !! Address !! Perms !! SubCommands !! Description
|-
|becount || 0xCA7D || 0xDD0C0000|| - || Display bringup/shutdown count + Power-on time
|-
|bepgoff || 0xA4E7 || 0xD00C0000|| - || BE power grid off
|-
|bepkt ||  0x2435D ||  0xDC0C0000 || show/set/unset/mode/debug/help || Packet permissions
|-
|bestat ||  0xD413 || 0xFD0F0000|| - || Get status of BE
|-
|boardconfig ||    0x99C7 || 0xDC0C0000|| - || Displays board configuration (NOT WORKING?)
|-
|bootbeep || 0x1EA67 ||  0xF0000000 || stat/on/off ||  Boot beep
|-
|bringup || 0xD597 || 0xFD0F0000|| - || Turn PS3 on
|-
|bsn || 0xD805 || 0xF00F0000|| - || Get board serial number
|-
|bstatus || 0x24269 ||  0xDD0C0000|| - || HDMI related status
|-
|buzz ||    0xA4FF || 0xDC0C0000 || [freq] || Activate buzzer
|-
|buzzpattern ||    0xA8B7 || 0xDC0C0000 || [freq] [pattern] [count] || Buzzer pattern
|-
|clear_err || 0x2595B ||  0xDD0C0000 || last/eeprom/all ||  Clear errors
|-
|clearerrlog ||    0xB8CB || 0xDD0C0000|| - || Clears error log
|-
|comm ||    0x9919 || 0xDC0C0000|| - || Communication mode
|-
|commt ||  0x24907 ||  0xDC0C0000 || help/start/stop/send ||  Manual BE communication
|-
|cp || 0x1E077 ||  0xF0000000 || ready/busy/reset/beepremote/beep2kn1n3/beep2kn2n3 || CP control commands
|-
|csum ||    0xD687 || 0xFF0F0000|| - || Firmware checksum
|-
|devpm ||  0xD053 || 0xDD0C0000 || ata/pci/pciex/rsx || Device power management
|-
|diag ||    0x9AAD || 0xD00C0000 || ... || Diag (execute without param to show help) (NOT WORKING?)
|-
|disp_err ||0x25911 ||  0xDD0C0000|| - || Displays errors
|-
|duty ||    0x9B23 || 0xDD0C0000 || get/getmin/getmax/getinimin/getinimax<br>set/setmin/setmax/setinimin/setinimax ||  Fan speed
<pre>
<pre>
Usage: duty get fanconNo
2958
    ex. duty get 1
3094
3410
3519
3689
3881
3896
</pre>
</pre>
|-
 
|dve || 0x2995D ||  0xDC0C0000 || help/set/save/show || DVE chip parameters
== Placeholder for bga patch key generation ==
|-
 
|eepcsum || 0xAA65 || 0xDD0C0000|| - || Displays checksums of some eeprom areas
|-
|eepromcheck ||    0x9A1D || 0x000C0000 || [id] || Check eeprom
|-
|eeprominit || 0x9A65 || 0x000C0000 || [id] || Init eeprom
|-
|ejectsw || 0xD611 || 0xFD0F0000|| - || Eject switch
|-
|errlog ||  0xB7ED || 0xFF0C0000|| - || Gets the error log
|-
|fancon ||  0xD26D || 0x0D000000|| - || Does nothing
|-
|fanconautotype || 0xC075 || 0xDD0C0000|| - || Does nothing
|-
|fanconmode || 0xBF35 || 0xDD0C0000 || get || Fan control mode (0=Full, 1=VaryTable & VaryServo, 2=Manual, 3=Minimun)
<pre>
<pre>
Usage: fanconmode get fanconNo
34 3A 00 00 00 00 5F 5F 53 43 45 49 53 59 53 31
    ex. fanconmode get 1
</pre>
</pre>
|-
 
|fanconpolicy ||  0xBBC9 || 0xDD0C0000 || get/set/getini/setini || Fan control policy (0=Full, 1=Auto, 2=Manual)
<pre>
<pre>
Usage: fanconpolicy get fanconNo
4:....__SCEISYS1
    ex. fanconpolicy get 1
</pre>
</pre>
* replace 4 dots with soft id in decimal form, xor with 0x140 key and with cipher patcher key and encrypt with master patcher key to obtain cipher master key for that soft id
* replace 4 dots with soft id in decimal form, xor with 0x140 key and with hasher patcher key and encrypt with master patcher key to obtain hasher master key for that soft id
= PTCH Firmware TOC =
{| class="wikitable"
|-
|-
|fandiag || 0x1E91B ||  0xF0000000|| - || Fan Diagnostic (test)
!Offset!!Size!!Notes!!Number
|-
|-
|faninictrl || 0xD3D9 || 0x0D000000|| - || Does nothing
| 0x00 || 0x2 || Major Version || 1
|-
|-
|fanpol || 0xCA31 || 0xDD0C0000|| - || Does nothing
| 0x02 || 0x2 || Minor Version || 1
|-  
| 0x04 || 0x2 || Major Revision || 1
|-
|-
|fanservo || 0xBF29 || 0xDD0C0000|| - || Does nothing
| 0x06 || 0x2 || Minor Revision || 1
|-
|-
|fantbl || 0xC087 || 0xDD0C0000 || get/set/getini/setini/gettable/settable/getselect/setselect ||  Fan table: get/set - currently in RAM/in use ; getini/setini - stored in EEPROM (!! in COK the chksum does not updated automatically !!)
| 0x08 || 0x10 || PTCH Addresses || 4*4
<pre>
Usage: fantbl set fanconNo pNo tempD tempU duty
    ex. fantbl set 0 p1 0x1400 0x1E40 0xC0
    ex. fantbl set 0 p1 20.0 30.25 75
Usage: fantbl get fanconNo
    ex. fantbl get 1
</pre>
|-
|-
|firmud || 0xD61D || 0xFDFF0000|| - || Firmware update
| 0x18 || 0x4 || PTCH #1 Instruction / Data || 1
|-
|-
|geterrlog || 0xB84F || 0xDD0C0000 || [id] || Gets error log
| 0x1C || 0x4 || PTCH #2 Instruction / Data || 1
|-
|-
|getrtc || 0xA6F3 || 0xDD0C0000|| - || Gets rtc
| 0x20 || 0x4 || PTCH #3 Instruction / Data || 1
|-
|-
|halt ||   0x1E107 || 0xF0000000|| - || Halts syscon
| 0x24 || 0x4 || PTCH #4 Instruction / Data || 1
|-
|-
|hdmi ||   0x29F39 || 0xDD0C0000 || ... ||  HDMI (various commands, use help)
| 0x28 || 0x10 || Additional PTCH Instruction Addresses || 4*4
<pre>
[HDMI Help] HDMI System Start        :$ hdmi setup ([ChannelNo])
[HDMI Help] Show IC Type              :$ hdmi ictype [ChannelNo]
[HDMI Help] Display EDID              :$ hdmi redid  [ChannelNo] (p)
[HDMI Help] Display KSV              :$ hdmi rksv  [ChannelNo]
[HDMI Help] SiI Register Read        :$ hdmi r  [ChannelNo] [TargetDevID(0/1)] [OffsetAddr(hex)] [ReadSize(hex)]
[HDMI Help] SiI Register Write        :$ hdmi w  [ChannelNo] [TargetDevID(0/1)] [OffsetAddr(hex)] [WriteData(hex)]
[HDMI Help] Set 12bit Param          :$ hdmi 12bit  [ChannelNo] (d1:0 - d5:4)
[HDMI Help] Set 10bit Param          :$ hdmi 10bit  [ChannelNo] (d1:0 - d5:4)
[HDMI Help] DDC Bus Read              :$ hdmi dr [ChannelNo] [TargetDevID(0/1)] [OffsetAddr(hex)] [ReadSize(hex)]
[HDMI Help] DDC Bus Write            :$ hdmi dw [OffsetAddr(hex)] [WriteData(hex)]
[HDMI Help] Show Channel Status      :$ hdmi chstat  [ChannelNo]
[HDMI Help] Debug Log Verbose        :$ hdmi vbs ([Verbose Setting(hex)])
[HDMI Help] HDMI System Shutdown      :$ hdmi letup ([ChannelNo])
[HDMI Help] HDMI Eleguler Test        :$ hdmi hwreset ([ChannelNo])
[HDMI Help] HDMI Eleguler Test KPL    :$ hdmi hwreset2 ([ChannelNo])
[HDMI Help] HDMI Manage Struct Dump  :$ hdmi dumpst ([ChannelNo])
[HDMI Help] Show HDMI and DVE Port Num:$ hdmi ports
[HDMI Help] Show Timer Value          :$ hdmi timer
[HDMI Help] Show I2C Resource        :$ hdmi i2c
[HDMI Help] Show Patch Information    :$ hdmi patch
[HDMI Help] Resolution Reset          :$ hdmi resrst [ChannelNo]
[HDMI Help] Show this Message        :$ hdmi help
</pre>
|-
|-
|hdmiid || 0x29D1D || 0xDC0F0000|| - || Get HDMI id's
| 0x38 || 0x388 || Additional PTCH Instructions || 1
|-
|-
|hdmiid2 || 0x29D81 || 0xDC0F0000|| - || Get HDMI id's
| 0x3C0 || 0xC00 || HDMI Related PTCH Instructions || 1
|-
|-
|hversion || 0x2422F ||  0xDD0C0000|| - || Displays [[Platform ID]]
|}
|-
 
|hyst ||    0xAEF5 || 0xDD0C0000 || get/set/getini/setini || This value is stored inside the Thermal Config area, every thermal sensor has their own. See: [https://en.wikipedia.org/wiki/Hysteresis#Control_systems Hysteresis]
= External commands =
<pre>
 
Usage: hyst set TZoneNo temp
{| class="wikitable"
    ex. hyst set 1 0x0200
    ex. hyst set 1 2.0
Usage: hyst get TZoneNo
    ex. hyst get 14
</pre>
|-
|lasterrlog || 0xB7FF || 0xDD0C0000|| - || Last error from log
|-
|ledmode || 0xA80B || 0xDC0C0000 || [id] [id] ||  Get led mode
|-
|LS || 0x2421B ||  0xDD0C0000|| - || LabStation Mode
|-
|ltstest || 0xCB97 || 0xDD0C0000 || get/set be/rsx ||  ?Temp related? values
|-
|osbo ||    0x1EA3F ||  0xF0000000|| - || Sets 0x2000F60
|-
|patchcsum ||  0xD9F7 || 0xDD0C0000|| - || Patch checksum
|-
|patchvereep ||    0xD9B1 || 0xDD0C0000|| - || Patch version eeprom
|-
|patchverram ||    0xD965 || 0xDD0C0000|| - || Patch version ram
|-
|poll ||    0x240E3 ||  0xDD0C0000|| - || Poll log
|-
|portscan || 0xDA0D || 0xDD0C0000 || [port] || Scan port (NOT WORKING?)
|-
|powbtnmode || 0xB911 || 0xDC0C0000 || [mode (0/1)] || Power button mode
|-
|powerstate || 0xCE6F || 0xDD0C0000|| - || Get power state
|-
|powersw || 0xD5F9 || 0xFD0F0000|| - || Power switch
|-
|powupcause || 0xB621 || 0xDD0C0000|| - || Power up cause
|-
|printmode || 0x99D9 || 0xDC0C0000 || [mode (0/1/2/3)] || Set printmode
|-
|-
|printpatch || 0xD94F || 0xDD0C0000|| - || Prints patch
!Offset!!Command!!Subcommand!!Permissions
|-             
| 0x333C5 ||             BOOT ||         MODE        0x000080D6
|-
|-
|r || 0x8CA5 || 0xDD0C0000 || [offset] [length] ||  Read byte from SC
| 0x33441 ||             BOOT ||       CONT        0x000080D5
|-
|-
|r16 || 0x8ED5 || 0xDD0C0000 || [offset] [length] ||  Read word from SC
| 0x34EA9 ||             SHUTDOWN || ||                 0x0000C0D5
|-
|-
|r32 || 0x9191 || 0xDD0C0000 || [offset] [length] ||  Read dword from SC
| 0x334BD ||             HALT || ||                   0x0000C0D5
|-
|-
|r64 || 0x935D || 0xDD0C0000 || [offset] [length] || Read qword from SC
| 0x334F1 ||             BOOTENABLE || ||               0x0000809A
|-
|-
|r64d ||   0x948F || 0xDD0C0000 || [offset] [length] ||  Read ?qword data? from SC
| 0x33F5F ||             AUTH1          || ||         0x0000C0EF
|-
|-
|rbe || 0x96F9 || 0xDD0C0000 || [offset] ||  Read from BE
| 0x33FF5 ||             AUTH2          || ||         0x0000C0EF
|-
|-
|recv ||    0x24135 ||  0xDD0C0000|| - || Receive something
| 0x340EB ||             AUTHVER ||   SET          0x0000C0DF
|-
|-
|resetsw || 0xD605 || 0xFC0F0000|| - || Reset switch
| 0x34091 ||             AUTHVER  ||   GET          0x0000C0FF
|-
|-
|restartlogerrtoeep || 0xB903 || 0xDD0C0000|| - || Reenable error logging to eeprom
| 0x3352F ||             EEP      ||   INIT        0x000080DA
|-
|-
|revision || 0xD7E1 || 0xFFFF0000|| - || Get [[More_System_Information|SoftID]]
| 0x336BD ||             EEP      ||   SET          0x0000C0DF
|-
|-
|rrsxc ||   0xD313 || 0xDD0C0000 || [offset] [length] || Read from RSX
| 0x337DF ||             EEP      ||   GET          0x0000C0DF
|-
|-
|rtcreset || 0xA7BB || 0x000C0000|| - || Reset RTC
| 0x33A71 ||             PDAREA  ||   SET          0x0000C0DF
|-
|-
|scagv2 || 0xE24F || 0xFF000000|| - || Auth related?
| 0x338F7 ||             PDAREA  ||   GET          0x0000C0DF
|-
|-
|scasv2 || 0xE207 || 0xDD000000|| - || Auth related?
| 0x33B85 ||             CSAREA  ||   SET          0x0000C0DF
|-
|-
|scclose || 0xE1EF || 0xFF000000|| - || Auth related?
| 0x33B19 ||             CSAREA  ||   GET          0x0000C0DF
|-
|-
|scopen || 0xE121 || 0xFF000000|| - || Auth related?
| 0x33C29 ||             VID      ||   GET          0x0000C0D5
|-
|-
|send ||   0x2416F || 0xDD0C0000 || [variable] || Send something
| 0x33C97 ||             CID      ||   GET          0x0000C0D5
|-
|-
|shutdown ||0xD5C5 || 0xFD0F0000|| - || PS3 shutdown
| 0x33CDD ||             ECID    ||   GET          0x0000C0D5
|-
|-
|startlogerrtsk || 0xB8E7 || 0xDD0C0000|| - || Start error log task
| 0x33D1D ||             REV      ||   SB          0x0000C0D5
|-
|-
|stoplogerrtoeep || 0xB8F5 || 0xDD0C0000|| - || Stop error logging to eeprom
| 0x33D4D ||             SPU      ||   INFO        0x0000C0D5
|-
|-
|stoplogerrtsk || 0xB8D9 || 0xDD0C0000|| - || Stop error log task
| 0x33DA1 ||             KSV      || ||             0x0000C0D5
|-
|-
|syspowdown ||0xB6E9 || 0xDD0C0000 || 3 params || System power down
| 0x34157 ||             FAN      ||   SETPOLICY    0x0000C0D7
|-
|-
|task ||   0x15005 || 0xDD0C0000|| - || Print tasks
| 0x341E5 ||             FAN      ||   GETPOLICY    0x0000C0D7
|-
|-
|thalttest || 0xD813 || 0x000F0000|| - || Thermal Alert Test ? (boes nothing), maybe is needed to do it while GameOS is working to trigger the XMB overheat warning message and the power off sequence
| 0x3424F ||             FAN      ||   START        0x0000C0D7
|-
|-
|thermfatalmode || 0xCA3B || 0xDD0C0000 || canboot/cannotboot || Set boot mode after a thermal alert ?
| 0x3424F ||             FAN      ||   STOP        0x0000C0D7
|-
|-
|therrclr || 0xD3E5 || 0xDD0C0000|| - || Clears the thermal alert register ?
| 0x34425 ||             FAN      ||   SETDUTY      0x0000C0D7
|-
|-
|thrm ||   0xBF1D || 0xDD0C0000|| - || Does nothing
| 0x34493 ||             FAN      ||   GETDUTY      0x0000C0D7
|-
|-
|tmp ||0xAA69 || 0xDD0C0000 || [tzone] ||  Get temperature
| 0x344F5 ||             R8      || ||               0x0000C0DF
<pre>
Usage: tmp TZoneNo
    ex. tmp 1
</pre>
|-
|-
|trace ||   0xB951 || 0xDD0C0000 || ... ||   Trace tasks (use help)
| 0x3459F ||             W8      || ||               0x0000C0DF
<pre>
Usage: trace command param
    command:
      [status/start/stop/dump/print/id]
    param (with `id' command):
      available characters: [0-9][,][-]
      ex. trace id 1-12,16
</pre>
|-
|-
|trp ||0xAB2F || 0xDD0C0000 || get/set/getini/setini || This value is stored inside the Thermal Config area, every thermal sensor has their own<!-- Transient Receptor Potential ? https://en.wikipedia.org/wiki/Thermosensation -->
| 0x3463F ||             R16      || ||               0x0000C0DF
<pre>
Usage: trp set TZoneNo temp
    ex. trp set 2 0x5980
    ex. trp set 2 89.5
Usage: trp get TZoneNo
    ex. trp get 14
</pre>
|-
|-
|tsensor || 0xA279 || 0xDD0C0000 || [tzone] ||  Get raw temperature
| 0x346E7 ||             W16      || ||                 0x0000C0DF
<pre>
Usage: tsensor TZoneNo
    ex. tsensor 2
</pre>
|-
|-
|tshutdown || 0xB2A1 || 0xDD0C0000 || get/set/getini/setini || Thermal shutdown. This value is stored inside the Thermal Config area, every thermal sensor has their own
| 0x34789 ||             R32      || ||             0x0000C0DF
<pre>
Usage: tshutdown set TZoneNo temp
    ex. tshutdown set 2 0x5A80
    ex. tshutdown set 2 90.5
Usage: tshutdown get TZoneNo
    ex. tshutdown get 14
</pre>
|-
|-
|tshutdowntime || 0xC95D || 0xDD0C0000 || get ||  Thermal shutdown time. This value is stored inside the Thermal Config area, is a single value shared by all thermal sensors
| 0x3492F ||             W32      || ||                 0x0000C0DF
|-
|-
|tzone ||   0xB5E1 || 0xDD0C0000|| - || Shows a list of the "TZone" identifyers associated with every thermal sensor, and a short text description of them
| 0x349CF ||             RBE      || ||               0x0000C0D5
<pre>
Example, on cytology PS3 models
> tzone
00: 1st BE Primary
01: RSX Primary
02: XDR Primary
0A: Air Intake
0F: GbE
14: SB
 
Example, on cookie old
> tzone
00: 1st BE Primary
01: RSX Primary
03: BE VR
14: SB
15: EE+GS
 
Example, on cookie new
> tzone
00: 1st BE Primary
01: RSX Primary
14: SB
 
Example, on sherwood
> tzone
# 00:1st BE Primary
# 01:RSX Primary
 
</pre>
|-
|-
|version || 0xD65F || 0xFFFF0000|| - || Syscon firmware version
| 0x34A77 ||             WBE      || ||                 0x0000C0D5
|-
|-
|w ||0x8BF9 || 0xDD0C0000 || [offset] [value] ||  Write byte to SC
| 0x34B2F ||             PORTSTAT || ||                 0x0000C0DF
|-
|-
|w16 ||0x8E2D || 0xDD0C0000 || [offset] [value] ||  Write word to SC
| 0x33D7F ||             VER      || ||                 0x0000C0FF
|-
|-
|w32 ||0x8FED || 0xDD0C0000 || [offset] [value] ||  Write dword to SC
| 0x34CAD ||             BUZ      || ||               0x00008096
|-
|-
|w64 ||0x92A9 || 0xDD0C0000 || [offset] [value] ||   Write qword to SC
| 0x34CE1 ||             BTNEMU  ||   SYNC  ||       0x0000C0D7
|-
|-
|wbe ||0x9665 || 0xDD0C0000 || [offset] [value] ||  Write to BE
| 0x34CE1 ||             BTNEMU  ||   ASYNC  ||     0x0000C0D7
|-
|-
|wmmto ||   0xCB3B || 0xDC0C0000 || get ||  Get watch dog timeout
| 0x34EA9 ||             SERVFAN  ||     ||             0x0000C0D7
|-
|-
|wrsxc ||  0xD279 || 0xDD0C0000 || [offset] [value] ||  Write to RSX
| 0x34D6F ||             ERRLOG   ||   START  ||       0x0000C0DF
|-
|-
|xdrdiag || 0x1E711 || 0xF0000000 || start/info/result || XDR diagnostics
| 0x34D93 ||             ERRLOG  ||   STOP  ||       0x0000C0DF
|-
|-
|xiodiag || 0x1E875 || 0xF0000000|| - || XIO diagnostic
| 0x34DB7 ||             ERRLOG  ||   GET    ||       0x0000C0FF
|-
|-
|xrcv ||   0x25313 || 0xDC0C0000|| - || Xmodem receive
| 0x34E1D ||             ERRLOG  ||   CLEAR  ||     0x0000C0DF
|-
|-
|}
| 0x34E41 ||             NONFATALERR || ||               0x0000C0DF
 
== Sherwood ==
*Permission
** 0x0700 = A_AUTH
** 0x0B00 = B_AUTH
** 0x0300 = INT (Command not available from UART interface. Can be unlocked by patching syscon firmware)
** 0x0F00 = ANY
 
{| class="wikitable sortable" style="line-height:110%"
|+Sherwood Commands
! rowspan="2" | Command<br>lowercase/UPPERCASE !! rowspan="2" | <abbr title="Permission">Perms</abbr> !! colspan="3" | Address !! rowspan="2" | Notes
|-
|-
! SW-301 !! SW2-301 !! SW3-304
|-
| hdmi            || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x32030 || 0x3D989 || 0x3E21D ||
|-                                               
| tsensor        || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x2FB30 || 0x3B1CF || 0x3B8F0 ||
|-                                               
| tmp            || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x2FE7F || 0x3B3D5 || 0x3BAF6 ||
|-                                               
| trp            || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x2FFA6 || 0x3B627 || 0x3BD48 ||
|-                                               
| tshutdown      || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x301D8 || 0x3B645 || 0x3BD66 ||
|-                                               
| tzone          || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x3041B || 0x3B663 || 0x3BD84 ||
|-                                               
| thrm            || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x30482 || 0x3B6C9 || 0x3BDEA ||
|-                                               
| duty            || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x307EF || 0x3B95D || 0x3C07E ||
|-                                               
| fanconpolicy    || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x30C0D || 0x3BBB9 || 0x3C2DA ||
|-                                               
| fanconmode      || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x30DF9 || 0x3BD48 || 0x3C469 ||
|-                                               
| fantbl          || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x30F3B || 0x3BE58 || 0x3C579 ||
|-                                               
| fanservo        || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || {{cellcolors|lightgrey}} N/A ? || 0x3C07D || 0x3C79E ||
|-                                               
| fanservostat    || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || {{cellcolors|lightgrey}} N/A ? || 0x3C2E2 || 0x3CA03 ||
|-                                               
| fanservosetval  || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || {{cellcolors|lightgrey}} N/A ? || {{cellcolors|lightgrey}} N/A ? || 0x3CB6B ||
|-                                               
| hyst            || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x305F2 || 0x3B7F0 || 0x3BF11 ||
|-                                               
| powupcause      || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x313EB || 0x3C695 || 0x3CE8E ||
|-                                               
| syspowdown      || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x31460 || 0x3C70A || 0x3CF03 ||
|-                                               
| devpm          || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x316C6 || 0x3C98A || 0x3D183 ||
|-                                               
| powerstate      || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x318CF || 0x3CB93 || 0x3D38C ||
|-                                               
| nonfatalerror  || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x31AC2 || 0x3CDF0 || 0x3D5E9 ||
|-                                               
| getrtc          || {{cellcolors|#ffaaaa}} <abbr title="0x0300">INT</abbr> || 0x2F82A || 0x3AD68 || 0x3B489 ||
|-                                               
| help            || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x2ED2B || 0x3A280 || 0x3A9A1 ||
|-                                               
| meminfo        || {{cellcolors|#ffaaaa}} <abbr title="0x0300">INT</abbr> || 0x2EED7 || 0x3A42C || 0x3AB4D ||
|-                                               
| rbe            || {{cellcolors|#ffaaaa}} <abbr title="0x0300">INT</abbr> || 0x2EF63 || 0x3A4B8 || 0x3ABD9 ||
|-                                               
| DISABLEALLERASE || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x2F1FC || 0x3A751 || 0x3AE72 ||
|-                                               
| task            || {{cellcolors|#ffaaaa}} <abbr title="0x0300">INT</abbr> || 0x2F281 || 0x3A7D6 || 0x3AEF7 ||
|-                                               
| cleareep        || {{cellcolors|#ffaaaa}} <abbr title="0x0300">INT</abbr> || 0x2F460 || 0x3A99E || 0x3B0BF ||
|-                                               
| commt          || {{cellcolors|#ffaaaa}} <abbr title="0x0300">INT</abbr> || 0x2F499 || 0x3A9D7 || 0x3B0F8 ||
|-                                               
| bestat          || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x2F79B || 0x3ACD9 || 0x3B3FA ||
|-                                               
| bringup / BOOT  || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x2DAC3 || 0x39018 || 0x39739 ||
|-                                               
| shutdown / HALT || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x2DC1C || 0x39171 || 0x39892 ||
|-                                               
| r / R8<br>r16 / R16<br>r32 / R32          || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x2DC9B || 0x391F0 || 0x39911 ||
|-                                               
| r64<br>r64d    || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x2E7BC || 0x39D11 || 0x3A432 ||
|-                                               
| w / W8<br>w16 / W16<br>w32 / W32          || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x2E03B || 0x39590 || 0x39CB1 ||
|-                                               
| w64<br>wbe      || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x2E6C1 || 0x39C16 || 0x3A337 ||
|-                                               
| BOOTENABLE      || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x2DC7B || 0x391D0 || 0x398F1 ||
|-                                               
| EEP            || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x2E8C2 || 0x39E17 || 0x3A538 ||
|-                                               
| PDAREA<br>CSAREA          || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x2E9B8 || 0x39F0D || 0x3A62E ||
|-                                               
| portset        || {{cellcolors|#ffaaaa}} <abbr title="0x0300">INT</abbr> || 0x2EC36 || 0x3A18B || 0x3A8AC ||
|-                                               
| extend          || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x2ECF9 || 0x3A24E || 0x3A96F ||
|-                                               
| version        || {{cellcolors|#ddddff}} <abbr title="0x0F00">ANY</abbr> || 0x080D0  || 0x0A0F1  || 0x0A0FF  ||
|-                                               
| revision        || {{cellcolors|#ddddff}} <abbr title="0x0F00">ANY</abbr> || 0x0812B  || 0x0A14C  || 0x0A15A  ||
|-                                               
| setcmdlong / SETCMDLONG || {{cellcolors|#ddddff}} <abbr title="0x0F00">ANY</abbr> || 0x08251  || 0x0A272  || 0x0A280  ||
|-                                               
| VER            || {{cellcolors|#ddddff}} <abbr title="0x0F00">ANY</abbr> || 0x081C3  || 0x0A1E4  || 0x0A1F2  ||
|-                                               
| csum            || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x08356  || 0x0A37B  || 0x0A389  ||
|-                                               
| AUTH1<br>AUTH2  || {{cellcolors|#ffffcc}} <abbr title="0x0B00">B_AUTH</abbr> || 0x08555  || 0x0A5AF  || 0x0A5BD  ||
|-                                               
| AUTHVER        || {{cellcolors|#ddddff}} <abbr title="0x0F00">ANY</abbr> || 0x086FB  || 0x0A755  || 0x0A763  ||
|-                                               
| errlog / ERRLOG || {{cellcolors|#ddddff}} <abbr title="0x0F00">ANY</abbr> || 0x311DA || 0x3C484 || 0x3CC7D ||
|-                                               
| powersw        || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x31C87 || 0x3D005 || 0x3D7FE ||
|-                                               
| ejectsw        || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x31CA5 || 0x3D023 || 0x3D81C ||
|-                                               
| doorsw          || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || {{cellcolors|lightgrey}} N/A ? || {{cellcolors|lightgrey}} N/A ? || 0x3D83C ||
|-                                               
| buzzduty        || {{cellcolors|#ffaaaa}} <abbr title="0x0300">INT</abbr> || 0x31CC5 || 0x3D043 || 0x3D8D7 ||
|-                                               
| buzz            || {{cellcolors|#ffaaaa}} <abbr title="0x0300">INT</abbr> || 0x31D24 || 0x3D0A2 || 0x3D936 ||
|-                                               
| VID            || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x33F98 || 0x3FC43 || 0x404D8 ||
|-                                               
| CID<br>ECID            || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x340BF || 0x3FD6A || 0x405FF ||
|-                                               
| SPU            || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x34211 || 0x3FEBC || 0x40751 ||
|-                                               
| REV            || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x342BC || 0x3FF67 || 0x407FC ||
|-                                               
| KSV            || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x34363 || 0x4000E || 0x408A3 ||
|-                                               
| MOUNTINFO      || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || {{cellcolors|lightgrey}} N/A ? || {{cellcolors|lightgrey}} N/A ? || 0x4095B ||
|-                                               
| portscan        || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x3441B || 0x400C6 || 0x40A2A ||
|-                                               
| eepcsum        || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x33F46 || 0x3FBF1 || 0x40486 ||
|-                                               
| patchinfo      || {{cellcolors|#ccffcc}} <abbr title="0x0700">A_AUTH</abbr> || 0x346DD || 0x40388 || 0x40CF2 ||
|-                                               
| poll            || {{cellcolors|#ffaaaa}} <abbr title="0x0300">INT</abbr> || 0x346F3 || 0x4039E || 0x40D08 ||
|-                                               
| recv            || {{cellcolors|#ffaaaa}} <abbr title="0x0300">INT</abbr> || 0x3470F || 0x403BA || 0x40D24 ||
|-                                               
| send            || {{cellcolors|#ffaaaa}} <abbr title="0x0300">INT</abbr> || 0x3472B || 0x403D6 || 0x40D40 ||
|-                                               
| LS              || {{cellcolors|#ffaaaa}} <abbr title="0x0300">INT</abbr> || 0x34747 || 0x403F2 || 0x40D5C ||
|-                                               
| hversion        || {{cellcolors|#ffaaaa}} <abbr title="0x0300">INT</abbr> || 0x34763 || 0x4040E || 0x40D78 ||
|}
= Access to Syscon from Linux =
Access SysCon ROM without needing ps3dm-utils: http://wiki.gitbrew.org/wikibrew/PS3:HvReverseEngineering#SYSCON
= Placeholder for bga patch key generation =
<pre>
34 3A 00 00 00 00 5F 5F 53 43 45 49 53 59 53 31
</pre>
<pre>
4:....__SCEISYS1
</pre>
OR (slim DYN-001)
<pre>
00 00 00 00 5F 5F 5F 5F 53 43 45 49 53 59 53 31
</pre>


= Internal commands =
<pre>
<pre>
....____SCEISYS1
Command              Address      Permission 
becount              0xC0E7      0xDD0C0000 
bestat              0xCDB7      0xFD0F0000 
bringup              0xCF3B      0xFD0F0000 
bsn                  0xD231      0xF00F0000 
bstatus              0x20DC5      0xDD0C0000 
btnemua              0xCFD1      0xDD0F0000 
btnemus              0xCFD1      0xDD0F0000 
clear_err            0x21227      0xDD0C0000 
clearerrlog          0xB0D9      0xDD0C0000 
csum                0xD0B5      0xFF0F0000 
devpm                0xC637      0xDD0C0000 
disp_err            0x211DD      0xDD0C0000 
duty                0x99E5      0xDD0C0000 
eepcsum              0xA2B1      0xDD0C0000 
ejectsw              0xCFC1      0xFD0F0000 
errlog              0xAFF9      0xFF0C0000 
fancon              0xC865      0x0D000000 
fanconautotype      0xB839      0xDD0C0000 
fanconmode          0xB7A5      0xDD0C0000 
fanconpolicy        0xB361      0xDD0C0000 
faninictrl          0xCB27      0x0D000000 
fanpol              0xC09B      0xDD0C0000 
fanservo            0xB693      0xDD0C0000 
fantbl              0xB84B      0xDD0C0000 
firmud              0xD04F      0xFDFF0000 
geterrlog            0xB05D      0xDD0C0000 
getrtc              0xA071      0xDD0C0000 
hdmi                0x25241      0xDD0C0000 
hdmiid              0x25025      0xDC0F0000 
hdmiid2              0x25089      0xDC0F0000 
hversion            0x20D8B      0xDD0C0000 
hyst                0xA751      0xDD0C0000 
lasterrlog          0xB00B      0xDD0C0000 
ltstest              0xC1A5      0xDD0C0000
LS                  0x20D77      0xDD0C0000 
nonfatalerror        0xDCAD      0xDD0C0000
patchcsum            0xD423      0xDD0C0000 
patchvereep          0xD3DD      0xDD0C0000 
patchverram          0xD391      0xDD0C0000 
poll                0x20C3F      0xDD0C0000 
portscan            0xD439      0xDD0C0000 
powerstate          0xC45B      0xDD0C0000 
powersw              0xCFA1      0xFD0F0000 
powupcause          0xAE31      0xDD0C0000 
printpatch          0xD37B      0xDC0C0000 
r                    0x8D59      0xDD0C0000 
r16                  0x8F97      0xDD0C0000 
r32                  0x9255      0xDD0C0000 
r64                  0x9427      0xDD0C0000 
r64d                0x9559      0xDD0C0000 
rbe                  0x97C5      0xDD0C0000 
recv                0x20C91      0xDD0C0000 
resetsw              0xCFB1      0xFC0F0000 
restartlogerrtoeep  0xB111      0xDD0C0000 
revision            0xD20D      0xFFFF0000 
rrsxc                0xCA65      0xDD0C0000 
scagv2              0xDC7B      0xFF000000 
scasv2              0xDC33      0xDD000000 
scclose              0xDC1B      0xFF000000 
scopen              0xDB4D      0xFF000000 
send                0x20CCB      0xDD0C0000 
shutdown            0xCF6D      0xFD0F0000 
startlogerrtsk      0xB0F5      0xDD0C0000 
stoplogerrtoeep      0xB103      0xDD0C0000 
stoplogerrtsk        0xB0E7      0xDD0C0000 
syspowdown          0xAE79      0xDD0C0000 
task                0x14919      0xDD0C0000 
thalttest            0xD23F      0x000F0000 
thermfatalmode      0xC0A5      0xDD0C0000 
therrclr            0xCD85      0xDD0C0000 
thrm                0xB5C7      0xDD0C0000 
tmp                  0xA2C7      0xDD0C0000 
trace                0xB11F      0xDD0C0000 
trp                  0xA38D      0xDD0C0000 
tsensor              0x9EB9      0xDD0C0000 
tshutdown            0xAA97      0xDD0C0000 
tshutdowntime        0xBFC1      0xDD0C0000 
tzone                0xADF1      0xDD0C0000 
version              0xD091      0xFFFF0000 
w                    0x8CAD      0xDD0C0000 
w16                  0x8EED      0xDD0C0000 
w32                  0x90AF      0xDD0C0000 
w64                  0x936D      0xDD0C0000 
wbe                  0x9731      0xDD0C0000 
wrsxc                0xC9CB      0xDD0C0000
</pre>
</pre>
* replace 4 dots with soft id in decimal form, xor with 0x140 key and with cipher patcher key and encrypt with master patcher key to obtain cipher master key for that soft id
* replace 4 dots with soft id in decimal form, xor with 0x140 key and with hasher patcher key and encrypt with master patcher key to obtain hasher master key for that soft id
{{Custom Firmware}}<noinclude>[[Category:Main]]</noinclude>
{{Custom Firmware}}<noinclude>[[Category:Main]]</noinclude>
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)