Editing Syscon Firmware
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
Syscon Firmware is the firmware stored on the System Controller EEPROM (see [[Syscon Hardware]]). Updates are stored in update packages within the Update_files.tar of a [[Playstation Update Package (PUP)]]. Syscon Packages appear to always be 5KB (5376 bytes) in size. | |||
= Syscon | = Syscon update packages = | ||
d/l: [http://www.multiupload.com/JHBCOCGNUR syscon_fw1.00-4.00.rar (51.74 KB)] | |||
== Package structure == | |||
Sys_con_firmware Packages can be unpacked with unpkg | |||
=== Overview === | |||
{|class="wikitable" | |||
|- | |- | ||
! Address !! Length !! Value !! Description | |||
|- | |- | ||
| | | 0x00 || 0x4 || ASCI:"SCE" || SCE magic header | ||
|- | |- | ||
| | | 0x04 || 0x4 || 0x2 || Flags | ||
|- | |- | ||
| | | 0x08 || 0x4 || 0x3 || Type (0x3 = PKG) | ||
|- | |- | ||
| | | 0x0C || 0x4 || 0x0 || Blank/Unknown | ||
|- | |- | ||
| | | 0x10 || 0x4 || 0x0 || Blank/Unknown | ||
|- | |- | ||
| | | 0x10 || 0x8 || 0x280 || Start Data Offset ('hdr_len') | ||
|- | |- | ||
| | | 0x18 || 0x8 || 0x1080 || Data Size ('dec_size') | ||
|- | |- | ||
| | | 0x20 || 0x260 || - || Header | ||
|- | |- | ||
| | | 0x280 || 0x40 || - || 'info0' section (see below) | ||
|- | |- | ||
| | | 0x2C0 || 0x40 || - || 'info1' section (see below) | ||
|- | |- | ||
| | | 0x300 || 0x1000 || - || 'content' | ||
|- | |- | ||
| | |} | ||
==='info0'=== | |||
{|class="wikitable" | |||
|- | |- | ||
! Address !! Length !! Value !! Description | |||
|- | |- | ||
| | | 0x00 || 0x4 || 0x3 || | ||
|- | |- | ||
| | | 0x04 || 0x4 || 0x8 || | ||
|- | |- | ||
| | | 0x08 || 0x8 || - || SC firmware revision (the high word of it is the SC type) | ||
|- | |- | ||
| | | 0x0C || 0x4 || 0x0B8E(1.30-4.84)<br />0x0C16(1.81-4.84)<br />0x0D52(3.40-4.84)<br />0x0DBF(3.40-4.84)<br />0x0E69(3.40-4.84)<br />0x0F29(3.40-4.84)<br />0x0F38(3.41-4.84)<br />0x065D<br />0x0832(3.00-4.84)<br />0x08A0<br />0x08C2<br />0x0918 || 'SoftID' | ||
|- | |- | ||
| 0x10 || 0x8 || 0x0001000000000004<br />0x0001000000000005<br />0x0001000000000006<br />0x0001000100030002<br />0x0001000100030003<br />0x0001000200030002<br />0x0001000300030002<br />0x0001000400040002<br />0x0001000500000002<br />0x0001000500010001<br />0x00010002083E0832<br /> || 'PatchID' | |||
| | |||
|- | |- | ||
| 0x18 || 0x8 || 0x1000 || 'Content' Data Size | |||
| | |||
|- | |- | ||
| 0x20 || 0x8 || 0x1000 || 'Content' Compressed Data Size | |||
| | |||
|- | |- | ||
| 0x28 || 0x8 || 0x0 || | |||
| | |||
|- | |- | ||
| 0x30 || 0x10 || 0x0 || | |||
| | |||
|- | |- | ||
|} | |} | ||
Note: PS3 firmwares cannot deal with compressed syscon firmwares, so they will abort the update process in that case. | |||
Note2: The PatchID is also present in the first 8 bytes of decrypted content but 16bit swapped for ARM BGAs | |||
==='info1'=== | |||
{|class="wikitable" | {|class="wikitable" | ||
|- | |- | ||
! Address !! Length !! Value !! Description | ! Address !! Length !! Value !! Description | ||
|- | |- | ||
| 0x00 || 0x4 || | | 0x00 || 0x4 || 0x0 || | ||
|- | |- | ||
| 0x04 || 0x4 || | | 0x04 || 0x4 || 0x3 || | ||
|- | |- | ||
| 0x08 || | | 0x08 || 0x8 || 0x40 || Offset/size? | ||
|- | |- | ||
| | | 0x10 || 0x4 || 0x0 || | ||
|- | |- | ||
| | | 0x14 || 0x4 || 0x0 || | ||
|- | |- | ||
| | | 0x18 || 0x8 || 0x1000 || 'Content' Data Size? | ||
|- | |- | ||
| | | 0x20 || 0x8 || 0x1 || | ||
|- | |- | ||
| | | 0x28 || 0x8 || 0x1 || | ||
|- | |- | ||
| | | 0x30 || 0x10 || 0x0 || | ||
|- | |- | ||
| | |} | ||
==='content' overview=== | |||
{|class="wikitable" | |||
|- | |- | ||
| | ! Address !! Length !! Value !! Description | ||
|- | |||
|- | |||
| 0x0 || 0x1000 || - || 'content' | |||
|- | |- | ||
|} | |} | ||
== | == Known Retail syscon update packages == | ||
{|class="wikitable" | These are in full Retail/CEX and Debug/DEX firmwares: | ||
{| class="wikitable" | |||
|- | |||
! [[Motherboard Revisions|Board]] !! [[Syscon Hardware]] !! sys_con_firmware package !! 1.00-1.30 !! 1.30-1.80 !! 1.81-2.80 !! 3.00-3.30 !! 3.40 !! 3.41-4.75 !! SoftID or Syscon Revision !! Notes | |||
|-{{cellcolors|lightgrey}} | |||
! rowspan=3 | [[COK-00x#COK-001|COK-001]] !! rowspan=3 | [[CXR713120-201GB]] | |||
| SYS_CON_FIRMWARE_01000004.pkg || {{No}} || {{Yes}} || {{No}} || {{No}} || {{No}} || {{No}} || 0B8E || Superseded by SYS_CON_FIRMWARE_01000005.pkg | |||
|-{{cellcolors|lightgrey}} | |||
| SYS_CON_FIRMWARE_01000005.pkg || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{No}} || {{No}} || 0B8E || Superseded by SYS_CON_FIRMWARE_01000006.pkg | |||
|- | |- | ||
! | | SYS_CON_FIRMWARE_01000006.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0B8E || | ||
|-{{cellcolors|lightgrey}} | |||
! rowspan=2 | [[COK-00x#COK-002|COK-002]] || rowspan=2 | [[CXR713120-201GB]]<br />[[CXR713120-202GB]] | |||
| SYS_CON_FIRMWARE_01010302.pkg || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{No}} || {{No}} || 0C16 || Superseded by SYS_CON_FIRMWARE_01010303.pkg | |||
|- | |- | ||
| | | SYS_CON_FIRMWARE_01010303.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0C16 || | ||
|- | |- | ||
| | ! [[SEM-00x|SEM-001]] || [[CXR713120-201GB]]<br />[[CXR713120-202GB]]<br />[[CXR713120-203GB]] | ||
| SYS_CON_FIRMWARE_01020302.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0D52 || | |||
|- | |- | ||
| | ! [[DIA-00x#DIA-001|DIA-001]] || [[CXR714120-301GB]] | ||
| SYS_CON_FIRMWARE_01030302.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0DBF || | |||
|- | |- | ||
! [[DIA-00x#DIA-002|DIA-002]] / [[DEB-00x#DEB-001|DEB-001]] || [[CXR714120-301GB]]<br />[[CXR714120-302GB]] | |||
| SYS_CON_FIRMWARE_01040402.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0E69 || | |||
|- | |- | ||
| | ! [[COK-00x|COK-002]] with 65nm [[RSX]] || [[CXR714120-303GB]] | ||
| SYS_CON_FIRMWARE_01050002.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0F29 || Refurbished, RSX replaced, syscon rewritten/replaced | |||
|- | |- | ||
| | ! [[COK-00x|COK-001]] with 40nm [[RSX]] || [[CXR713120-201GB]] ? | ||
| SYS_CON_FIRMWARE_01050101.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || 0F38 || Refurbished, RSX replaced, syscon rewritten/replaced | |||
|- | |- | ||
| | ! [[VER-00x|VER-001]] || [[SW-30x]] | ||
| || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 065D || | |||
|- | |- | ||
| | ! [[DYN-00x|DYN-001]] || rowspan=4 | [[SW2-30x]] | ||
| SYS_CON_FIRMWARE_S1_00010002083E0832.pkg || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{Yes}} || 0832 || rowspan=2 | ps3 2k series | |||
|- | |- | ||
| | ! [[SUR-00x|SUR-001]] | ||
| || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 08A0 | |||
|- | |- | ||
| | ! [[JTP-00x|JTP-001]]<br />[[JSD-00x|JSD-001]] | ||
| || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 08C2 || ps3 2k5 series | |||
|- | |- | ||
| | ! [[KTE-00x|KTE-001]] | ||
| || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 0918 || ps3 3k series | |||
|- | |- | ||
! [[MSX-00x|MSX-001]]<br />[[MPX-00x|MPX-001]] || [[SW3-30x]] | |||
| || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 098F || ps3 4k series | |||
|} | |} | ||
This means from syscon perspective notible firmware changes where made at 1.30, 1.81, 3.00, 3.40 and 3.41 that affected retail and debug PS3 models | |||
*Firmware 1.30 (December 6, 2006) added Backup/Restore | |||
*Firmware 1.81 (June 15, 2007) ? | |||
*Firmware 3.00 (September 1, 2009) resulted in Class action suit for BluRay reading problems | |||
*Firmware 3.40 (June 29, 2010) ? | |||
*Firmware 3.41 (July 26, 2010) ? | |||
== NonRetail syscon == | |||
Remember, Debug/DEX consoles are normal retail consoles with different TargetID, so only those that have a nonretail board have deviating patches (like the CXR713F120A found on the [[DECR-1000A]] TOOL/DECR). | |||
Tool/DECR don't have patches, they flash entire firmwares.<br /> | |||
Factory cp comes with 0.8.8 (corresponds to syscon fw size 0x60000)<br> | |||
it is VERY likely that it is not possible to go below this point, so any smaller size would likely cause a brick (see [[Talk:Communication_Processor]] for more info on how to downgrade)<br> | |||
DECR samples: [https://mega.co.nz/#!g50S1LRD!g8n1C191ax61YibnLEHJCQ63fT_ye1hA4Dhhrfulfs0] [https://mega.co.nz/#!jgVVCYZC!HaUXkeKFJNbzxAVkbO-Aj5LC2-yriY7rmUWKljlEQ40 mirror]: | |||
v0.6.1c8_TMU510_u.bin | CRC16:FAE0 | CRC32:590D9A21 | SHA1:DC8AEA0DDC6C5B813FE9861C972AAE111DA6FCAB | MD5:50794942BD9FAB7CC04A81BD8D220BA1 | 7379733103B15C07EC051E9B44D90BDF 07AD575D86B3937CFA8B3D331BE958DDB40EDFBE | |||
v0.6.10c4_TMU510_u.bin | CRC16:B58A | CRC32:DB8A00BF | SHA1:5D52289960151E2543EBEAA805963B7B88C35DD8 | MD5:14C288A576690C587E95C8542EDC2A70 | 7379733160AF70F9CF5DF54F30D5C77C 5F360CD146EEC3A7B5026151C396C4A5F7F1EC91 | |||
v0.6.11c4_TMU510_u.bin | CRC16:8A51 | CRC32:289B15F3 | SHA1:D45214E907A104BCC6BC91D78B7B471263AB0699 | MD5:B7CFA6536329F0DFF1AAD7905627F15F | 73797331F283602B666562012850612E 3FABA6E4FE1D70724164A23886199F36A02EDB0D | |||
v0.6.12c5_TMU510_u.bin | CRC16:31B2 | CRC32:1A1F141B | SHA1:403BF55314C4E785ED90D03A8F2E90B67CC235EA | MD5:1B19B55924445E4BBB2D970410AD6366 | 737973316E5C037615E4727464B2D929 2D2EB7DADEF6B24C4E959235E5B11917D352F9D5 | |||
v0.6.14c4_TMU510_u.bin | CRC16:FB1B | CRC32:079EF389 | SHA1:6EF7067FAD939D0B0DFC0B9418A6F4C7509104E5 | MD5:11E9F6270A5D79D0B76614B1C6FE622B | 73797331DCEAC9FA0F1B2449F332C4A9 1CBFF6FE43BDCA3B0A5AAFCE9A98D7176D951A49 | |||
v0.8.4c8_TMU510_u.bin | CRC16:2949 | CRC32:81EFA508 | SHA1:5963B333361123782848E3639D9FA585A728691A | MD5:564D5479F5B98E244C1EA7B56BACC873 | 73797331E8A9ADD15036B33AB8E8AB17 FDCC981DA58B9F44E9331C9708C01D924D78DB3E | |||
v0.9.9c1_TMU510_u.bin | CRC16:172A | CRC32:EBB2D78A | SHA1:D5E693D2E22FD99CF3E330AC442CD9B07D01DB66 | MD5:216B258115F25B13C9969AF35BFCAC20 | 7379733116E6DD5F054442FACFA15A5C 5E62E8FC8059F864A91CAD142BC30BDAE77D9464 | |||
v0.9.14c1_TMU510_u.bin | CRC16:2A2C | CRC32:330CB685 | SHA1:30B19BB8B78E60D81848E8FDF6C4A79537CFBE66 | MD5:7AA5BFE64D15F8BD61EB80B999FE4343 | 73797331807BAF3D6E1B6A3CA5FDF30D 7CCE3B0E739A19C9C431D4D8C59CF1513DAF25E9 | |||
v1.0.1c1_TMU510_u.bin | CRC16:3FD1 | CRC32:A7C7E313 | SHA1:F0DCA7130074E023FFAF58EBD06A61EE73C94907 | MD5:C95C57DC20D9AC5473C1EC914744352F | 73797331F362AE579EA3D864E27334CC 3EAB05DEC5328E885EED3295954999BD518ABFDF | |||
v1.0.3c1_TMU510_u.bin | CRC16:636E | CRC32:32942DFD | SHA1:83BE56F92A93B911D2BBE12DD1F6AF9CCD1EC11B | MD5:642C0E6615AACBF180C367F7927D1E30 | 737973312D08051E9F5AA1AAF2647EC0 44EE5DF74D92DDB81B1099430B0B5A243FFDA44E | |||
v1.0.4c1_TMU510_u.bin | CRC16:528F | CRC32:A0FBA694 | SHA1:1A5E5F97D66A754C2C7436618DC911C1C57B9FEA | MD5:6641B03FC6193E35380D681152226275 | 73797331E40325B060CDE461D250058D 8AF478F0A1C1B4B9DECA01C8770F8A9010F0A513 | |||
v1.0.5c1_TMU510_u.bin | CRC16:59F8 | CRC32:87316EBF | SHA1:8ED74829973F740C1B825FD976F7926A95ACBE8B | MD5:717DC4187A6E446C30DACAC129090656 | 737973316856FC96CA6FA4D4652D4985 F9E998439D4C23DA9C1BA8F5C44611D826DA1CFE | |||
=== dev/hda === | |||
dev_hda.image from [[DECR-1000A]] CP: [http://mega/content/secure.html#!shd2VBwI!aElpZXIMqxdAP0hw775sNhmkwJewVXafQvdFUGQ5Lgo dev_hda.image] [https://mega.co.nz/#!y8kWmSqR!4PPNen3bukLWt-EZm_zENT9G8Ey-Fi0YcaLHNey41m0 dev_hda.image.7z] | |||
== | ==== Partitions ==== | ||
{|class="wikitable" | {| class="wikitable sortable" | ||
|- | |- | ||
! | ! device file !! size !! type | ||
|- | |- | ||
| | | /dev/loop0p1 || 51 MB (50577408 bytes) || 0x89 | ||
|- | |- | ||
| | | /dev/loop0p2 || 8,7 MB (8650752 bytes) || Linux | ||
|- | |- | ||
| | | /dev/loop0p3 || 32 MB (31981568 bytes) || Linux | ||
|- | |- | ||
| | | /dev/loop0p4 || 35 MB (35127296 bytes) || Extended | ||
|- | |- | ||
| | | /dev/loop0 || 4,9 MB (4883968 bytes) || Unassigned | ||
|- | |- | ||
|} | |} | ||
== | === Deviating from Retail === | ||
{|class="wikitable" | Please note that without info about the SKU the listing of ID's is pretty useless | ||
{| class="wikitable sortable" | |||
|- | |- | ||
! sys_con_firmware package !! 1.00-1.30 !! 1.30-1.80 !! 1.81-2.80 !! 3.00-3.30 !! 3.40 !! 3.41-4.11 !! SoftID !! Notes | |||
|- | |- | ||
| | | ? || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || 0B67 || Debug/DEX | ||
|- | |- | ||
|} | |} | ||
=== | == Usage == | ||
The firmware PUP's contains a collection of patches for all the different hardware revisions of syscon's chips used in different motherboard models. | |||
The ps3swu.self (system updater) decides which applicable [[Syscon Hardware]] is present and installs the needed package update(s) accordingly (via updater manager ss service). | |||
Which syscon version and which patches are installed can be seen in [[More_System_Information]] | |||
== Decryption == | |||
Packages can be decrypted with the unpkg tool. Decrypted content of the updates appears to always be 0x1000 bytes (4KB). | |||
=== Patch/Firmware Body Decryption/Hashing === | |||
The following is all theoretical and is intended to discard possibilities about modes of operation used by aes when decrypting body of firmware/patch | |||
We know that: | |||
* Two key expansions are used before applying crypto on body (one probably for hashing. the other for decrypting with cbc) | |||
* Encrypt is used when applying crypto on body TopHalf (forward ttables) and Decrypt is used when applying on body Bottomhalf (inverse ttables) | |||
* Authenticated regions uses a form of what seems to be some ECB with tweak xoring (as graf once said about XTS) | |||
* XTS was introduced in 2007 and SysCon from ps3 exists for far more time than that (2003) | |||
* XEX is a close relative of XTS that was introduced in 1984 | |||
* PS4 uses XTS for Authenticated Regions or SNVS (with sector size of 0x20 being used. is this even considered safe?) | |||
* 4 regions can be controlled for DPA and they are: 0x2790 (size 0x20) (FFs), patch header (most notably at offset 0x4 of header size 0x10 and 0x30 size 0x10), patch body tophalf(+0x40) and patch body bottomhalf(+0x50) | |||
* here are the DPA bytes for each of the controlable sections: | |||
* 21 06 23 DC A2 98 99 4D XX 87 F8 40 FC 48 1C BF (section 2/FF's from 0x2790 on DIA-001) -> 210623DCA298994DFE87F840FC481CBF | |||
* 21 06 23 DC A2 98 99 4D XX 87 F8 40 FC 48 1C BF (section 2/FF's from 0x2790 on DEB-001) -> 210623DCA298994DFE87F840FC481CBF | |||
* 16 32 47 79 C3 2C 47 D3 2B 39 CA B5 83 41 0E D5 (section 3/header from DIA-001 patch content) | |||
* XX XX XX XX 7B FC 27 CD D5 9A 05 09 3A DF E4 75 (section 3/header AA from DEB-001 patch content) -> 6E9CE7C57BFC27CDD59A05093ADFE475 | |||
* 92 4A 87 88 20 59 6C 49 9F 0E 7D 77 2F 38 4C FC (section 3/header DD from DEB-001 patch content) | |||
* 7D C6 3B 3B 69 DF 67 4C 94 D7 D4 A8 E0 F8 5B B2 (section 4/body from DIA-001 patch content/tophalf/forward) | |||
* 73 XX F0 3D XX 9A F0 92 4D XX 62 DA XX 48 3C DB (section 4/body from DIA-001 patch content/bottomhalf/inverse) | |||
* 49 1F 7B 0A 48 BD 79 33 4E 16 89 F6 B0 25 86 48 (section 4/body from DEB-001 patch content/tophalf/forward) | |||
* 14 4D F1 D3 21 B6 17 46 60 81 42 E5 02 C9 07 66 (section 4/body from DEB-001 patch content/bottomhalf/inverse/PROPER) -> 6B3583DA1AA6B49106E1641178EE68C8 (inverse ttables) | |||
* some bytes are considered "weak" bytes and should be bruteforced in the eventuality these keys fail | |||
* another possibility is that both the header and the body are hashed and then decrypted, using for example, cmac and cbc | |||
* since key expansions take 10 "hills" in the analysis, it should be safe to assume that AES-128 is used(because it uses 10 rounds). | |||
* 6554cff202c3bfdd9740901070b705bf : correct md5 for patch content we are trying keys on (DIA-001) | |||
* 4875ad06a1499cc516a0d4d92e595794 : correct md5 for patch content we are trying keys on (DEB-001/DIA-002) | |||
* trying a different header/body patch content from another similar board will result into failure of decrypting body, which means that the header is checked for authenticity and that the header hash is NOT in the header | |||
* altering the patch header doesn't cause the patch header dpa bytes to change (a test was done with 4 bytes and the result was 16 32 47 79, which matches the other patch dpa recovered bytes) | |||
* there are in fact not 4 but 5 aes sections. the last one seems to be body related, as changing the body even one bit makes the last aes section disappear. | |||
* section 2 is divided into two sections, corresponding to TopHalf and BottomHalf of patch area. | |||
* TopHalf uses forward ttables/sbox. BottomHalf uses inverse ttables/sbox | |||
* TopHalf is ONLY the very first 0x10 bytes AFTER the header and into the body (corresponding to 0x40 in header size 0x10) | |||
* BottomHalf is the rest of the body itself. | |||
* DYN-001 processes one entire chunk of 0x1000 bytes, 0x40 for header and 0xFC0 for body, and not two of 0x400 and 0xC00 like the Sony models | |||
* 504 aes operations are done for the body (252/0xFC for cmac and 252/0xFC for cbc). it is unknown if cmac comes first or it is cbc. | |||
* All attacks show weak bytes in comparisson with CXR(F), likely due to CXR being optimized for the attack (removed resistors/capacitors, etc) | |||
== Header == | |||
The header format is partially unknown at this stage. | The header format is partially unknown at this stage. | ||
All the Firmwares patches are written in little endian. | All the Firmwares patches are written in little endian. | ||
Line 312: | Line 268: | ||
! Offset !! Length !! Notes !! Related DECR Error !! Notes | ! Offset !! Length !! Notes !! Related DECR Error !! Notes | ||
|- | |- | ||
| 0x0 || 0x4 || Magic || FFFFFED2 (Magic Error) || | | 0x0 || 0x4 || Magic || FFFFFED2 (Magic Error) || | ||
|- | |- | ||
| 0x4 || 0x10 || Header CMAC1 | | | 0x4 || 0x10 || Header CMAC1 || FFFFFED1 (Header Check Error) || CMAC of Partial Header (0x10,0x30 size) with header first 4 bytes instead of random 4 bytes and where Header CMAC2 is zeroed Concatenated with Encrypted Body | ||
|- | |- | ||
| 0x14 || 0x10 || Header CMAC2 || CMAC of Header (where this cmac has been zeroed) | | 0x14 || 0x10 || Header CMAC2 || FFFFFED1 (Header Check Error) || CMAC of Header (where this cmac has been zeroed) | ||
|- | |- | ||
| 0x24 || 0x4 || Padding || | | 0x24 || 0x4 || Padding || FFFFFED1 (Header Check Error) || | ||
|- | |- | ||
| 0x28 || 0x4 || Total size || | | 0x28 || 0x4 || Total size || FFFFFED1 (Header Check Error) || | ||
|- | |- | ||
| | | 0x2c || 0x4 || Size of binary || FFFFFED1 (Header Check Error) || | ||
|- | |- | ||
| 0x30 || 0x10 || IV for AES-128 CBC || | | 0x30 || 0x10 || IV for AES-128 CBC || FFFFFED1 (Header Check Error) || | ||
|- | |- | ||
| 0x40 || | | 0x40 || 0xfc0 || Encrypted binary || FFFFFED0 (Data Check Error) / FFFFFECF (Data Size Check Error) || | ||
|- | |- | ||
|} | |} | ||
Line 334: | Line 290: | ||
* Note3: setting data between 0x40 to 0x4C to zero in bogus update yields error FFFFFED0 | * Note3: setting data between 0x40 to 0x4C to zero in bogus update yields error FFFFFED0 | ||
=== Samples === | |||
<pre> | <pre> | ||
00000000 1B 2D 70 0F AB 5E B3 99 68 20 FE 3D E1 80 6A 1D .-p.«^³™h þ=á€j. | 00000000 1B 2D 70 0F AB 5E B3 99 68 20 FE 3D E1 80 6A 1D .-p.«^³™h þ=á€j. | ||
Line 352: | Line 308: | ||
00000020 FF 83 0B E0 00 00 00 00 40 00 06 00 00 00 06 00 ÿƒ à @ | 00000020 FF 83 0B E0 00 00 00 00 40 00 06 00 00 00 06 00 ÿƒ à @ | ||
00000030 69 B6 02 69 3A 97 8B 1C 4E 18 D4 E0 63 7D CA 94 i¶ i:—‹ N Ôàc}Ê” | 00000030 69 B6 02 69 3A 97 8B 1C 4E 18 D4 E0 63 7D CA 94 i¶ i:—‹ N Ôàc}Ê” | ||
00000040 4B A0 79 34 79 41 BD 09 BB 68 D4 0A A0 B7 05 78 | 00000040 4B A0 79 34 79 41 BD 09 BB 68 D4 0A A0 B7 05 78 K y4yA½ »hÔ · x | ||
00000050 D9 8F 8F 28 6C 9A 1B 61 CF A1 E7 49 7D CA C4 A3 Ù (lš aÏ¡çI}ÊÄ£ | 00000050 D9 8F 8F 28 6C 9A 1B 61 CF A1 E7 49 7D CA C4 A3 Ù (lš aÏ¡çI}ÊÄ£ | ||
00000060 A4 4D 4B E0 AE 48 86 03 B1 43 F2 47 C0 C4 1D 4F ¤MKà®H† ±CòGÀÄ O | 00000060 A4 4D 4B E0 AE 48 86 03 B1 43 F2 47 C0 C4 1D 4F ¤MKà®H† ±CòGÀÄ O | ||
Line 358: | Line 314: | ||
</pre> | </pre> | ||
=== | === Observations === | ||
* The first 4 bytes (0x1B2D700F) appear static in each package. | |||
* The next 0x20 bytes appear to change with each package | |||
* The following 12 bytes (0x0000000000100000C00F0000) also appear static, but it's the firmware size and fw size - header size; infact if correctly converted to little endian 00000000 00001000 00000fc0, where 00000000 is Unknown, 00001000 is 4096 in dec (file size) and 00000fc0 is 4032 in dec (update size). | |||
* On the DECH fw, the update works in the same way: 000000004000060000000600 converted will be: 00000000 00060040 00060000, where, 00000000 is probably padding, file size 00060040, 00060000 update size | |||
* the first 0x40 bytes probably are IV + HASH + update infos. probably the algorithm used is AES. | |||
* algorithm used is aes 128 cbc on the body (iv is at + 0x30) | |||
== Access to Syscon from Linux == | |||
Access SysCon ROM without needing ps3dm-utils: http://wiki.gitbrew.org/wikibrew/PS3:HvReverseEngineering#SYSCON | |||
== List of Soft IDs in Decimal Form == | |||
<pre> | |||
2958 | |||
3094 | |||
3410 | |||
3519 | |||
3689 | |||
3881 | |||
3896 | |||
</pre> | |||
== Placeholder for bga patch key generation == | |||
<pre> | |||
34 3A 00 00 00 00 5F 5F 53 43 45 49 53 59 53 31 | |||
</pre> | |||
<pre> | |||
4:....__SCEISYS1 | |||
</pre> | |||
OR (slim DYN-001) | |||
<pre> | |||
00 00 00 00 5F 5F 5F 5F 53 43 45 49 53 59 53 31 | |||
</pre> | |||
<pre> | |||
....____SCEISYS1 | |||
</pre> | |||
* replace 4 dots with soft id in decimal form, xor with 0x140 key and with cipher patcher key and encrypt with master patcher key to obtain cipher master key for that soft id | |||
* | |||
* replace 4 dots with soft id in decimal form, xor with 0x140 key and with hasher patcher key and encrypt with master patcher key to obtain hasher master key for that soft id | |||
= Mullion Patch Content = | |||
{| class="wikitable" | {| class="wikitable" | ||
|- | |- | ||
! Offset !! Size !! | !Offset!!Size!!Notes!!Number | ||
|- | |- | ||
| 0x00 || 0x2 || Major Version || 1 | | 0x00 || 0x2 || Major Version || 1 | ||
|- | |- | ||
| 0x02 || 0x2 || Minor Version || 1 | | 0x02 || 0x2 || Minor Version || 1 | ||
|- | |- | ||
| 0x04 || 0x2 || Major Revision || 1 | | 0x04 || 0x2 || Major Revision || 1 | ||
|- | |- | ||
| 0x06 || 0x2 || Minor Revision || 1 | | 0x06 || 0x2 || Minor Revision || 1 | ||
|- | |- | ||
| 0x08 || 0x10 || Patch Addresses || 4*4 | | 0x08 || 0x10 || Patch Addresses || 4*4 | ||
|- | |- | ||
| 0x18 || 0x10 || Patch Instruction / Data || 4*4 | | 0x18 || 0x10 || Patch Instruction / Data || 4*4 | ||
|- | |- | ||
| 0x28 || 0x10 || Patch Jump Instruction Addresses || 4*4 | | 0x28 || 0x10 || Patch Jump Instruction Addresses || 4*4 | ||
|- | |- | ||
| 0x38 || 0x388 || Additional Patch Instructions || 1 | | 0x38 || 0x388 || Additional Patch Instructions || 1 | ||
|- | |- | ||
| 0x3C0 || 0xC00 || HDMI Patch || 1 | | 0x3C0 || 0xC00 || HDMI Patch || 1 | ||
|- | |- | ||
|} | |} | ||
= Sherwood Patch Content = | |||
{| class="wikitable" | {| class="wikitable" | ||
|- | |- | ||
! Offset !! Size !! | !Offset!!Size!!Notes!!Number | ||
|- | |- | ||
| 0x00 || 0x4 || Magic || 1 | | 0x00 || 0x4 || Magic || 1 | ||
|- | |- | ||
| 0x04 || 0x2 || Major Version || 1 | | 0x04 || 0x2 || Major Version || 1 | ||
|- | |- | ||
| 0x06 || 0x2 || Minor Version || 1 | | 0x06 || 0x2 || Minor Version || 1 | ||
|- | |- | ||
| 0x08 || 0x2 || Major Revision || 1 | | 0x08 || 0x2 || Major Revision || 1 | ||
|- | |- | ||
| 0x0A || 0x2 || Minor Revision || 1 | | 0x0A || 0x2 || Minor Revision || 1 | ||
|- | |- | ||
| 0x0C || 0x4 || Absolute Table Address || 1 | | 0x0C || 0x4 || Absolute Table Address || 1 | ||
|- | |- | ||
| 0x10 || 0x2 || Data Size || 1 | | 0x10 || 0x2 || Data Size || 1 | ||
|- | |- | ||
| 0x12 || 0x2 || Data Checksum || 1 | | 0x12 || 0x2 || Data Checksum || 1 | ||
|- | |- | ||
| 0x14 || 0x2 || Patch Checksum || 1 | | 0x14 || 0x2 || Patch Checksum || 1 | ||
|- | |- | ||
| 0x16 || 0x2 || Relative Data Address || 1 | | 0x16 || 0x2 || Relative (0x2000) Data Address || 1 | ||
|- | |- | ||
| 0x18 || 0x2 || Relative Table Address || 1 | | 0x18 || 0x2 || Relative (0x2000) Table Address || 1 | ||
|- | |- | ||
| | | ------ || 0x80 || Table with Addresses || 32*4 | ||
|- | |- | ||
| | | ------ || ------ || Data (not parsed on SW) || - | ||
|- | |- | ||
|} | |} | ||
= | = External commands (COK-001) = | ||
{| class="wikitable" | |||
{| class="wikitable | |||
! Address !! Command !! Subcommand !! Permission | ! Address !! Command !! Subcommand !! Permission | ||
|- | |- | ||
Line 569: | Line 514: | ||
|} | |} | ||
= Internal commands = | |||
{| class="wikitable sortable" | {| class="wikitable sortable" | ||
|- | |- | ||
Line 614: | Line 559: | ||
|disp_err ||0x25911 || 0xDD0C0000|| - || Displays errors | |disp_err ||0x25911 || 0xDD0C0000|| - || Displays errors | ||
|- | |- | ||
|duty || 0x9B23 || 0xDD0C0000 || get/getmin/getmax/ | |duty || 0x9B23 || 0xDD0C0000 || get/set/getmin/setmin/getmax/setmax/getinmin/setinmin/getinmax/setinmax || Fan policy | ||
|- | |- | ||
|dve || 0x2995D || 0xDC0C0000 || help/set/save/show || DVE chip parameters | |dve || 0x2995D || 0xDC0C0000 || help/set/save/show || DVE chip parameters | ||
|- | |- | ||
|eepcsum || 0xAA65 || 0xDD0C0000|| - || | |eepcsum || 0xAA65 || 0xDD0C0000|| - || Does nothing | ||
|- | |- | ||
|eepromcheck || 0x9A1D || 0x000C0000 || [id] || Check eeprom | |eepromcheck || 0x9A1D || 0x000C0000 || [id] || Check eeprom | ||
Line 636: | Line 577: | ||
|fanconautotype || 0xC075 || 0xDD0C0000|| - || Does nothing | |fanconautotype || 0xC075 || 0xDD0C0000|| - || Does nothing | ||
|- | |- | ||
|fanconmode || 0xBF35 || 0xDD0C0000 || get || Fan control mode | |fanconmode || 0xBF35 || 0xDD0C0000 || get || Fan control mode | ||
|- | |- | ||
|fanconpolicy || 0xBBC9 || 0xDD0C0000 || get/set/getini/setini || Fan control policy | |fanconpolicy || 0xBBC9 || 0xDD0C0000 || get/set/getini/setini || Fan control policy | ||
|- | |- | ||
|fandiag || 0x1E91B || 0xF0000000|| - || Fan | |fandiag || 0x1E91B || 0xF0000000|| - || Fan test | ||
|- | |- | ||
|faninictrl || 0xD3D9 || 0x0D000000|| - || Does nothing | |faninictrl || 0xD3D9 || 0x0D000000|| - || Does nothing | ||
Line 656: | Line 589: | ||
|fanservo || 0xBF29 || 0xDD0C0000|| - || Does nothing | |fanservo || 0xBF29 || 0xDD0C0000|| - || Does nothing | ||
|- | |- | ||
|fantbl || 0xC087 || 0xDD0C0000 || get/set/getini/setini/gettable/settable | |fantbl || 0xC087 || 0xDD0C0000 || get/set/getini/setini/gettable/settable || Fan table: get/set - currently in RAM/in use ; getini/setini - stored in EEPROM (!! in COK the chksum does not updated automatically !!) | ||
<pre> | <pre> | ||
fantbl - Fan Table set/get command | |||
Usage: fantbl set fanconNo pNo tempD tempU duty | Usage: fantbl set fanconNo pNo tempD tempU duty | ||
ex. fantbl set 0 p1 0x1400 0x1E40 0xC0 | ex. fantbl set 0 p1 0x1400 0x1E40 0xC0 | ||
Line 703: | Line 637: | ||
|hdmiid2 || 0x29D81 || 0xDC0F0000|| - || Get HDMI id's | |hdmiid2 || 0x29D81 || 0xDC0F0000|| - || Get HDMI id's | ||
|- | |- | ||
|hversion || 0x2422F || 0xDD0C0000|| - || | |hversion || 0x2422F || 0xDD0C0000|| - || Platform ID | ||
|- | |- | ||
|hyst || 0xAEF5 || 0xDD0C0000 || get/set/getini/setini || | |hyst || 0xAEF5 || 0xDD0C0000 || get/set/getini/setini || Temperature zones | ||
|- | |- | ||
|lasterrlog || 0xB7FF || 0xDD0C0000|| - || Last error from log | |lasterrlog || 0xB7FF || 0xDD0C0000|| - || Last error from log | ||
Line 764: | Line 691: | ||
|restartlogerrtoeep || 0xB903 || 0xDD0C0000|| - || Reenable error logging to eeprom | |restartlogerrtoeep || 0xB903 || 0xDD0C0000|| - || Reenable error logging to eeprom | ||
|- | |- | ||
|revision || 0xD7E1 || 0xFFFF0000|| - || Get | |revision || 0xD7E1 || 0xFFFF0000|| - || Get softid | ||
|- | |- | ||
|rrsxc || 0xD313 || 0xDD0C0000 || [offset] [length] || Read from RSX | |rrsxc || 0xD313 || 0xDD0C0000 || [offset] [length] || Read from RSX | ||
Line 792: | Line 719: | ||
|task || 0x15005 || 0xDD0C0000|| - || Print tasks | |task || 0x15005 || 0xDD0C0000|| - || Print tasks | ||
|- | |- | ||
|thalttest || 0xD813 || 0x000F0000|| - || | |thalttest || 0xD813 || 0x000F0000|| - || Does nothing | ||
|- | |- | ||
|thermfatalmode || 0xCA3B || 0xDD0C0000 || canboot/cannotboot || Set boot mode | |thermfatalmode || 0xCA3B || 0xDD0C0000 || canboot/cannotboot || Set thermal boot mode | ||
|- | |- | ||
|therrclr || 0xD3E5 || 0xDD0C0000|| - || | |therrclr || 0xD3E5 || 0xDD0C0000|| - || Thermal register clear | ||
|- | |- | ||
|thrm || 0xBF1D || 0xDD0C0000|| - || Does nothing | |thrm || 0xBF1D || 0xDD0C0000|| - || Does nothing | ||
|- | |- | ||
|tmp ||0xAA69 || 0xDD0C0000 || [ | |tmp ||0xAA69 || 0xDD0C0000 || [zone] || Get temperature | ||
|- | |- | ||
|trace || 0xB951 || 0xDD0C0000 || ... || Trace tasks (use help) | |trace || 0xB951 || 0xDD0C0000 || ... || Trace tasks (use help) | ||
Line 816: | Line 739: | ||
</pre> | </pre> | ||
|- | |- | ||
|trp ||0xAB2F || 0xDD0C0000 || get/set/getini/setini || | |trp ||0xAB2F || 0xDD0C0000 || get/set/getini/setini || Temperature zones | ||
|- | |- | ||
|tsensor || 0xA279 || 0xDD0C0000 || [ | |tsensor || 0xA279 || 0xDD0C0000 || [sensor] || Get raw temperature | ||
|- | |- | ||
|tshutdown || 0xB2A1 || 0xDD0C0000 || get/set/getini/setini || Thermal shutdown | |tshutdown || 0xB2A1 || 0xDD0C0000 || get/set/getini/setini || Thermal shutdown | ||
|- | |- | ||
|tshutdowntime || 0xC95D || 0xDD0C0000 || | |tshutdowntime || 0xC95D || 0xDD0C0000 || [time] || Thermal shutdown time | ||
|- | |- | ||
|tzone || 0xB5E1 || 0xDD0C0000|| - || | |tzone || 0xB5E1 || 0xDD0C0000|| - || Show thermal zones | ||
|- | |- | ||
|version || 0xD65F || 0xFFFF0000|| - || | |version || 0xD65F || 0xFFFF0000|| - || SC firmware version | ||
|- | |- | ||
|w ||0x8BF9 || 0xDD0C0000 || [offset] [value] || Write byte to SC | |w ||0x8BF9 || 0xDD0C0000 || [offset] [value] || Write byte to SC | ||
Line 890: | Line 765: | ||
|wrsxc || 0xD279 || 0xDD0C0000 || [offset] [value] || Write to RSX | |wrsxc || 0xD279 || 0xDD0C0000 || [offset] [value] || Write to RSX | ||
|- | |- | ||
|xdrdiag || 0x1E711 || 0xF0000000 || start/info/result || XDR | |xdrdiag || 0x1E711 || 0xF0000000 || start/info/result || XDR diag | ||
|- | |- | ||
|xiodiag || 0x1E875 || 0xF0000000|| - || XIO | |xiodiag || 0x1E875 || 0xF0000000|| - || XIO diag | ||
|- | |- | ||
|xrcv || 0x25313 || 0xDC0C0000|| - || Xmodem receive | |xrcv || 0x25313 || 0xDC0C0000|| - || Xmodem receive | ||
Line 898: | Line 773: | ||
|} | |} | ||
= | = SW-301 Command List = | ||
* A_AUTH = 0x0700 | |||
* B_AUTH = 0x0B00 | |||
* INT = 0x0300 | |||
* ANY = 0x0F00 | |||
{| class="wikitable sortable" | |||
|- | |- | ||
! | !Address!! Command!! Permission | ||
|- | |||
|0x32030|| hdmi ||A_AUTH | |||
|- | |||
|0x2FB30|| tsensor ||A_AUTH | |||
|- | |||
|0x2FE7F|| tmp ||A_AUTH | |||
|- | |||
|0x2FFA6|| trp ||A_AUTH | |||
|- | |||
|0x301D8|| tshutdown ||A_AUTH | |||
|- | |||
|0x3041B|| tzone ||A_AUTH | |||
|- | |||
|0x30482|| thrm ||A_AUTH | |||
|- | |||
|0x307EF|| duty ||A_AUTH | |||
|- | |||
|0x30C0D|| fanconpolicy ||A_AUTH | |||
|- | |||
|0x30DF9|| fanconmode ||A_AUTH | |||
|- | |||
|0x30F3B|| fantbl ||A_AUTH | |||
|- | |||
|0x305F2|| hyst ||A_AUTH | |||
|- | |||
|0x313EB|| powupcause ||A_AUTH | |||
|- | |||
|0x31460|| syspowdown ||A_AUTH | |||
|- | |||
|0x316C6|| devpm ||A_AUTH | |||
|- | |||
|0x318CF|| powerstate ||A_AUTH | |||
|- | |||
|0x31AC2|| nonfatalerror ||A_AUTH | |||
|- | |||
|0x2F82A|| getrtc ||INT | |||
|- | |||
|0x2ED2B|| help ||A_AUTH | |||
|- | |||
|0x2EED7|| meminfo ||INT | |||
|- | |||
|0x2EF63|| rbe ||INT | |||
|- | |||
|0x2F1FC|| DISABLEALLERASE ||A_AUTH | |||
|- | |||
|0x2F281|| task ||INT | |||
|- | |||
|0x2F460|| cleareep ||INT | |||
|- | |||
|0x2F499|| commt ||INT | |||
|- | |||
|0x2F79B|| bestat ||A_AUTH | |||
|- | |||
|0x2DAC3|| bringup ||A_AUTH | |||
|- | |||
|0x2DC1C|| shutdown ||A_AUTH | |||
|- | |||
|0x2DC9B|| r ||A_AUTH | |||
|- | |||
|0x2DC9B|| r16 ||A_AUTH | |||
|- | |||
|0x2DC9B|| r32 ||A_AUTH | |||
|- | |||
|0x2E7BC|| r64 ||A_AUTH | |||
|- | |||
|0x2E7BC|| r64d ||A_AUTH | |||
|- | |||
|0x2E03B|| w ||A_AUTH | |||
|- | |||
|0x2E03B|| w16 ||A_AUTH | |||
|- | |||
|0x2E03B|| w32 ||A_AUTH | |||
|- | |||
|0x2E6C1|| w64 ||A_AUTH | |||
|- | |||
|0x2E6C1|| wbe ||A_AUTH | |||
|- | |||
|0x2DAC3|| BOOT ||A_AUTH | |||
|- | |||
|0x2DC1C|| HALT ||A_AUTH | |||
|- | |||
|0x2DC7B|| BOOTENABLE ||A_AUTH | |||
|- | |||
|0x2DC9B|| R8 ||A_AUTH | |||
|- | |||
|0x2DC9B|| R16 ||A_AUTH | |||
|- | |||
|0x2DC9B|| R32 ||A_AUTH | |||
|- | |||
|0x2E03B|| W8 ||A_AUTH | |||
|- | |||
|0x2E03B|| W16 ||A_AUTH | |||
|- | |||
|0x2E03B|| W32 ||A_AUTH | |||
|- | |||
|0x2E8C2|| EEP ||A_AUTH | |||
|- | |||
|0x2E9B8|| PDAREA ||A_AUTH | |||
|- | |||
|0x2E9B8|| CSAREA ||A_AUTH | |||
|- | |||
|0x2EC36|| portset ||INT | |||
|- | |||
|0x2ECF9|| extend ||A_AUTH | |||
|- | |||
|0x80D0 || version ||ANY | |||
|- | |||
|0x812B || revision ||ANY | |||
|- | |||
|0x8251 || setcmdlong ||ANY | |||
|- | |||
|0x81C3 || VER ||ANY | |||
|- | |||
|0x8251 || SETCMDLONG ||ANY | |||
|- | |||
|0x8356 || csum ||A_AUTH | |||
|- | |||
|0x8555 || AUTH1 ||B_AUTH | |||
|- | |||
|0x8555 || AUTH2 ||B_AUTH | |||
|- | |||
|0x86FB || AUTHVER ||ANY | |||
|- | |||
|0x311DA|| ERRLOG ||ANY | |||
|- | |||
|0x311DA|| errlog ||ANY | |||
|- | |||
|0x31C87|| powersw ||A_AUTH | |||
|- | |||
|0x31CA5|| ejectsw ||A_AUTH | |||
|- | |||
|0x31CC5|| buzzduty ||INT | |||
|- | |||
|0x31D24|| buzz ||INT | |||
|- | |||
|0x33F98|| VID ||A_AUTH | |||
|- | |||
|0x340BF|| CID ||A_AUTH | |||
|- | |||
|0x340BF|| ECID ||A_AUTH | |||
|- | |||
|0x34211|| SPU ||A_AUTH | |||
|- | |||
|0x342BC|| REV ||A_AUTH | |||
|- | |||
|0x34363|| KSV ||A_AUTH | |||
|- | |||
|0x3441B|| portscan ||A_AUTH | |||
|- | |||
|0x33F46|| eepcsum ||A_AUTH | |||
|- | |||
|0x346DD|| patchinfo ||A_AUTH | |||
|- | |||
|0x346F3|| poll ||INT | |||
|- | |||
|0x3470F|| recv ||INT | |||
|- | |||
|0x3472B|| send ||INT | |||
|- | |||
|0x34747|| LS ||INT | |||
|- | |||
|0x34763|| hversion ||INT | |||
|- | |- | ||
|} | |} | ||
= | = SW2-301 Command List = | ||
= | * A_AUTH = 0x0700 | ||
* B_AUTH = 0x0B00 | |||
* INT = 0x0300 | |||
* ANY = 0x0F00 | |||
{| class="wikitable sortable" | |||
|- | |||
!Address!! Command !!Permission | |||
|- | |||
|0x3D989|| hdmi ||A_AUTH | |||
|- | |||
|0x3B1CF|| tsensor ||A_AUTH | |||
|- | |||
|0x3B3D5|| tmp ||A_AUTH | |||
|- | |||
|0x3B627|| trp ||A_AUTH | |||
|- | |||
|0x3B645|| tshutdown ||A_AUTH | |||
|- | |||
|0x3B663|| tzone ||A_AUTH | |||
|- | |||
|0x3B6C9|| thrm ||A_AUTH | |||
|- | |||
|0x3B95D|| duty ||A_AUTH | |||
|- | |||
|0x3BBB9|| fanconpolicy ||A_AUTH | |||
|- | |||
|0x3BD48|| fanconmode ||A_AUTH | |||
|- | |||
|0x3BE58|| fantbl ||A_AUTH | |||
|- | |||
|0x3C07D|| fanservo ||A_AUTH | |||
|- | |||
|0x3C2E2|| fanservostat ||A_AUTH | |||
|- | |||
|0x3B7F0|| hyst ||A_AUTH | |||
|- | |||
|0x3C695|| powupcause ||A_AUTH | |||
|- | |||
|0x3C70A|| syspowdown ||A_AUTH | |||
|- | |||
|0x3C98A|| devpm ||A_AUTH | |||
|- | |||
|0x3CB93|| powerstate ||A_AUTH | |||
|- | |||
|0x3CDF0|| nonfatalerror ||A_AUTH | |||
|- | |||
|0x3AD68|| getrtc ||INT | |||
|- | |||
|0x3A280|| help ||A_AUTH | |||
|- | |||
|0x3A42C|| meminfo ||INT | |||
|- | |||
|0x3A4B8|| rbe ||INT | |||
|- | |||
|0x3A751|| DISABLEALLERASE ||A_AUTH | |||
|- | |||
|0x3A7D6|| task ||INT | |||
|- | |||
|0x3A99E|| cleareep ||INT | |||
|- | |||
|0x3A9D7|| commt ||INT | |||
|- | |||
|0x3ACD9|| bestat ||A_AUTH | |||
|- | |||
|0x39018|| bringup ||A_AUTH | |||
|- | |||
|0x39171|| shutdown ||A_AUTH | |||
|- | |||
|0x391F0|| r ||A_AUTH | |||
|- | |||
|0x391F0|| r16 ||A_AUTH | |||
|- | |||
|0x391F0|| r32 ||A_AUTH | |||
|- | |||
|0x39D11|| r64 ||A_AUTH | |||
|- | |||
|0x39D11|| r64d ||A_AUTH | |||
|- | |||
|0x39590|| w ||A_AUTH | |||
|- | |||
|0x39590|| w16 ||A_AUTH | |||
|- | |||
|0x39590|| w32 ||A_AUTH | |||
|- | |||
|0x39C16|| w64 ||A_AUTH | |||
|- | |||
|0x39C16|| wbe ||A_AUTH | |||
|- | |||
|0x39018|| BOOT ||A_AUTH | |||
|- | |||
|0x39171|| HALT ||A_AUTH | |||
|- | |||
|0x391D0|| BOOTENABLE ||A_AUTH | |||
|- | |||
|0x391F0|| R8 ||A_AUTH | |||
|- | |||
|0x391F0|| R16 ||A_AUTH | |||
|- | |||
|0x391F0|| R32 ||A_AUTH | |||
|- | |||
|0x39590|| W8 ||A_AUTH | |||
|- | |||
|0x39590|| W16 ||A_AUTH | |||
|- | |||
|0x39590|| W32 ||A_AUTH | |||
|- | |||
|0x39E17|| EEP ||A_AUTH | |||
|- | |||
|0x39F0D|| PDAREA ||A_AUTH | |||
|- | |||
|0x39F0D|| CSAREA ||A_AUTH | |||
|- | |||
|0x3A18B|| portset ||INT | |||
|- | |||
|0x3A24E|| extend ||A_AUTH | |||
|- | |||
|0xA0F1 || version ||ANY | |||
|- | |||
|0xA14C || revision ||ANY | |||
|- | |||
|0xA272 || setcmdlong ||ANY | |||
|- | |||
|0xA1E4 || VER ||ANY | |||
|- | |||
|0xA272 || SETCMDLONG ||ANY | |||
|- | |||
|0xA37B || csum ||A_AUTH | |||
|- | |||
|0xA5AF || AUTH1 ||B_AUTH | |||
|- | |||
|0xA5AF || AUTH2 ||B_AUTH | |||
|- | |||
|0xA755 || AUTHVER ||ANY | |||
|- | |||
|0x3C484|| ERRLOG ||ANY | |||
|- | |||
|0x3C484|| errlog ||ANY | |||
|- | |||
|0x3D005|| powersw ||A_AUTH | |||
|- | |||
|0x3D023|| ejectsw ||A_AUTH | |||
|- | |||
|0x3D043|| buzzduty ||INT | |||
|- | |||
|0x3D0A2|| buzz ||INT | |||
|- | |||
|0x3FC43|| VID ||A_AUTH | |||
|- | |||
|0x3FD6A|| CID ||A_AUTH | |||
|- | |||
|0x3FD6A|| ECID ||A_AUTH | |||
|- | |||
|0x3FEBC|| SPU ||A_AUTH | |||
|- | |||
|0x3FF67|| REV ||A_AUTH | |||
|- | |||
|0x4000E|| KSV ||A_AUTH | |||
|- | |||
|0x400C6|| portscan ||A_AUTH | |||
|- | |||
|0x3FBF1|| eepcsum ||A_AUTH | |||
|- | |||
|0x40388|| patchinfo ||A_AUTH | |||
|- | |||
|0x4039E|| poll ||INT | |||
|- | |||
|0x403BA|| recv ||INT | |||
|- | |||
|0x403D6|| send ||INT | |||
|- | |||
|0x403F2|| LS ||INT | |||
|- | |||
|0x4040E|| hversion ||INT | |||
|- | |||
|} | |||
* Note: Very similar to ps4 southbridge firmware. Only difference here is the string is Playstation 3 | |||
= SW3-304 Commandlist = | |||
{| class="wikitable sortable" | |||
|- | |||
! Address!! Command!! Permission | |||
|- | |||
|0x3E21D|| hdmi ||A_AUTH | |||
|- | |||
|0x3B8F0|| tsensor ||A_AUTH | |||
|- | |||
|0x3BAF6|| tmp ||A_AUTH | |||
|- | |||
|0x3BD48|| trp ||A_AUTH | |||
|- | |||
|0x3BD66|| tshutdown ||A_AUTH | |||
|- | |||
|0x3BD84|| tzone ||A_AUTH | |||
|- | |||
|0x3BDEA|| thrm ||A_AUTH | |||
|- | |||
|0x3C07E|| duty ||A_AUTH | |||
|- | |||
|0x3C2DA|| fanconpolicy ||A_AUTH | |||
|- | |||
|0x3C469|| fanconmode ||A_AUTH | |||
|- | |||
|0x3C579|| fantbl ||A_AUTH | |||
|- | |||
|0x3C79E|| fanservo ||A_AUTH | |||
|- | |||
|0x3CA03|| fanservostat ||A_AUTH | |||
|- | |||
|0x3CB6B|| fanservosetval ||A_AUTH | |||
|- | |||
|0x3BF11|| hyst ||A_AUTH | |||
|- | |||
|0x3CE8E|| powupcause ||A_AUTH | |||
|- | |||
|0x3CF03|| syspowdown ||A_AUTH | |||
|- | |||
|0x3D183|| devpm ||A_AUTH | |||
|- | |||
|0x3D38C|| powerstate ||A_AUTH | |||
|- | |||
|0x3D5E9|| nonfatalerror ||A_AUTH | |||
|- | |||
|0x3B489|| getrtc ||INT | |||
|- | |||
|0x3A9A1|| help ||A_AUTH | |||
|- | |||
|0x3AB4D|| meminfo ||INT | |||
|- | |||
|0x3ABD9|| rbe ||INT | |||
|- | |||
|0x3AE72|| DISABLEALLERASE ||A_AUTH | |||
|- | |||
|0x3AEF7|| task ||INT | |||
|- | |||
|0x3B0BF|| cleareep ||INT | |||
|- | |||
|0x3B0F8|| commt ||INT | |||
|- | |||
|0x3B3FA|| bestat ||A_AUTH | |||
|- | |||
|0x39739|| bringup ||A_AUTH | |||
|- | |||
|0x39892|| shutdown ||A_AUTH | |||
|- | |||
|0x39911|| r ||A_AUTH | |||
|- | |||
|0x39911|| r16 ||A_AUTH | |||
|- | |||
|0x39911|| r32 ||A_AUTH | |||
|- | |||
|0x3A432|| r64 ||A_AUTH | |||
|- | |||
|0x3A432|| r64d ||A_AUTH | |||
|- | |||
|0x39CB1|| w ||A_AUTH | |||
|- | |||
|0x39CB1|| w16 ||A_AUTH | |||
|- | |||
|0x39CB1|| w32 ||A_AUTH | |||
|- | |||
|0x3A337|| w64 ||A_AUTH | |||
|- | |||
|0x3A337|| wbe ||A_AUTH | |||
|- | |||
|0x39739|| BOOT ||A_AUTH | |||
|- | |||
|0x39892|| HALT ||A_AUTH | |||
|- | |||
|0x398F1|| BOOTENABLE ||A_AUTH | |||
|- | |||
|0x39911|| R8 ||A_AUTH | |||
|- | |||
|0x39911|| R16 ||A_AUTH | |||
|- | |||
|0x39911|| R32 ||A_AUTH | |||
|- | |||
|0x39CB1|| W8 ||A_AUTH | |||
|- | |||
|0x39CB1|| W16 ||A_AUTH | |||
|- | |||
|0x39CB1|| W32 ||A_AUTH | |||
|- | |||
|0x3A538|| EEP ||A_AUTH | |||
|- | |||
|0x3A62E|| PDAREA ||A_AUTH | |||
|- | |||
|0x3A62E|| CSAREA ||A_AUTH | |||
|- | |||
|0x3A8AC|| portset ||INT | |||
|- | |||
|0x3A96F|| extend ||A_AUTH | |||
|- | |||
|0xA0FF || version ||ANY | |||
|- | |||
|0xA15A || revision ||ANY | |||
|- | |||
|0xA280 || setcmdlong ||ANY | |||
|- | |||
|0xA1F2 || VER ||ANY | |||
|- | |||
|0xA280 || SETCMDLONG ||ANY | |||
|- | |||
|0xA389 || csum ||A_AUTH | |||
|- | |||
|0xA5BD || AUTH1 ||B_AUTH | |||
|- | |||
|0xA5BD || AUTH2 ||B_AUTH | |||
|- | |||
|0xA763 || AUTHVER ||ANY | |||
|- | |||
|0x3CC7D|| ERRLOG ||ANY | |||
|- | |||
|0x3CC7D|| errlog ||ANY | |||
|- | |||
|0x3D7FE|| powersw ||A_AUTH | |||
|- | |||
|0x3D81C|| ejectsw ||A_AUTH | |||
|- | |||
|0x3D83C|| doorsw ||A_AUTH | |||
|- | |||
|0x3D8D7|| buzzduty ||INT | |||
|- | |||
|0x3D936|| buzz ||INT | |||
|- | |||
|0x404D8|| VID ||A_AUTH | |||
|- | |||
|0x405FF|| CID ||A_AUTH | |||
|- | |||
|0x405FF|| ECID ||A_AUTH | |||
|- | |||
|0x40751|| SPU ||A_AUTH | |||
|- | |||
|0x407FC|| REV ||A_AUTH | |||
|- | |||
|0x408A3|| KSV ||A_AUTH | |||
|- | |||
|0x4095B|| MOUNTINFO ||A_AUTH | |||
|- | |||
|0x40A2A|| portscan ||A_AUTH | |||
|- | |||
|0x40486|| eepcsum ||A_AUTH | |||
|- | |||
|0x40CF2|| patchinfo ||A_AUTH | |||
|- | |||
|0x40D08|| poll ||INT | |||
|- | |||
|0x40D24|| recv ||INT | |||
|- | |||
|0x40D40|| send ||INT | |||
|- | |||
|0x40D5C|| LS ||INT | |||
|- | |||
|0x40D78|| hversion ||INT | |||
|} | |||
{{Custom Firmware}}<noinclude>[[Category:Main]]</noinclude> | {{Custom Firmware}}<noinclude>[[Category:Main]]</noinclude> |