Editing Syscon Firmware

[[Category:Software]]
Syscon Firmware is the firmware stored on the System Controller EEPROM (see [[Syscon Hardware]]). Updates are stored in update packages within the Update_files.tar of a [[Playstation Update Package (PUP)]].  Syscon Packages appear to always be 5KB (5376 bytes) in size.


= Updates =

== General Speculation ==
It is rumored that the firmware are not complete updates, but only patches and are also further encrypted. It is further believed that these patches are decrypted and patch memory at runtime by the original syscon firmware.

== Syscon update packages ==
d/l: [http://www.multiupload.com/JHBCOCGNUR syscon_fw1.00-4.00.rar (51.74 KB)]

=== Package structure ===
Sys_con_firmware Packages can be unpacked with unpkg

==== Overview ====
{|class="wikitable"
|-
! Address !! Length !! Value !! Description
|-
| 0x00 || 0x4 || ASCI:"SCE" || SCE magic header
|-
| 0x04 || 0x4 || 0x2 || Flags
|-
| 0x08 || 0x4 || 0x3 || Type (0x3 = PKG)
|-
| 0x0C || 0x4 || 0x0 || Blank/Unknown
|-
| 0x10 || 0x4 || 0x0 || Blank/Unknown
|-
| 0x10 || 0x8 || 0x280 || Start Data Offset ('hdr_len')
|-
| 0x18 || 0x8 || 0x1080 || Data Size ('dec_size')
|-
| 0x20 || 0x260 || - || Header
|-
| 0x280 || 0x40 || - || 'info0' section (see below)
|-
| 0x2C0 || 0x40 || - || 'info1' section (see below)
|-
| 0x300 || 0x1000 || - || 'content'
|-
|}
===='info0'====
{|class="wikitable"
|-
! Address !! Length !! Value !! Description
|-
| 0x00 || 0x4 || 0x3 || 
|-
| 0x04 || 0x4 || 0x8 || 
|-
| 0x08 || 0x4 || 0x0 or 0x1 || 
|-
| 0x0C || 0x4 || 0x0B8E<br />0x0C16<br />0x0D52<br />0x0DBF<br />0x0E69<br />0x0F29<br />0x0F38<br />0x0832<br /> || 'SoftID'
|-
| 0x10 || 0x8 || 0x0001000000000004<br />0x0001000000000005<br />0x0001000000000006<br />0x0001000100030002<br />0x0001000100030003<br />0x0001000200030002<br />0x0001000300030002<br />0x0001000400040002<br />0x0001000500000002<br />0x0001000500010001<br />0x00010002083E0832<br /> || 'PatchID'
|-
| 0x18 || 0x8 || 0x1000 || 'Content' Data Size?
|-
| 0x20 || 0x8 || 0x1000 || 'Content' Data Size?
|-
| 0x28 || 0x8 || 0x0 || 
|-
| 0x30 || 0x10 || 0x0 || 
|-
|}
===='info1'====
{|class="wikitable"
|-
! Address !! Length !! Value !! Description
|-
| 0x00 || 0x4 || 0x0 || 
|-
| 0x04 || 0x4 || 0x3 || 
|-
| 0x08 || 0x8 || 0x40 || Offset/size?
|-
| 0x10 || 0x4 || 0x0 || 
|-
| 0x14 || 0x4 || 0x0 || 
|-
| 0x18 || 0x8 || 0x1000 || 'Content' Data Size?
|-
| 0x20 || 0x8 || 0x1 || 
|-
| 0x28 || 0x8 || 0x1 || 
|-
| 0x30 || 0x10 || 0x0 || 
|-
|}
'content' overview:
{|class="wikitable"
|-
! Address !! Length !! Value !! Description
|-
|-
| 0x0 || 0x1000 || - || 'content'
|-
|}


=== Known Retail syscon update packages ===
These are in in full Retail/CEX and Debug/DEX firmwares:
{| class="wikitable sortable"
|-
! sys_con_firmware package !! 1.00-1.30 !! 1.30-1.80 !! 1.81-2.80 !! 3.00-3.30 !! 3.40 !! 3.41-4.00 !! SoftID !! Notes
|-
| SYS_CON_FIRMWARE_01000004.pkg || {{No}} || {{Yes}} || {{No}} || {{No}} || {{No}} || {{No}} || 0B8E || 
|-
| SYS_CON_FIRMWARE_01000005.pkg || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{No}} || {{No}} || 0B8E || 
|-
| SYS_CON_FIRMWARE_01000006.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0B8E || 
|-
| SYS_CON_FIRMWARE_01010302.pkg || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{No}} || {{No}} || 0C16 || 
|-
| SYS_CON_FIRMWARE_01010303.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0C16 ||
|-
| SYS_CON_FIRMWARE_01020302.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0D52 || 
|-
| SYS_CON_FIRMWARE_01030302.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0DBF || 
|-
| SYS_CON_FIRMWARE_01040402.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0E69 || 
|-
| SYS_CON_FIRMWARE_01050002.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || 0F29 || 
|-
| SYS_CON_FIRMWARE_01050101.pkg || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || 0F38 || 
|-
| SYS_CON_FIRMWARE_S1_00010002083E0832.pkg || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{Yes}} || 0832 || 
|-
|}
SoftID is located at offset 0x28E in the .pkg file

This means from syscon perspective notible firmware changes where made at 1.30, 1.81, 3.00, 3.40 and 3.41 (FW 1.30 added Backup/Restore, FW 3.00 resulted in Class action suit for BluRay reading problems).

=== NonRetail syscon ===
Remember, Debug/DEX consoles are normal retail consoles with different TargetID, so only those that have a nonretail board have deviating patches.

Tool/DECR don't have patches, they flash entire firmwares.

==== Deviating from Retail ====
Please note that without info about the SKU the listing of ID's is pretty useless
{| class="wikitable sortable"
|-
! sys_con_firmware package !! 1.00-1.30 !! 1.30-1.80 !! 1.81-2.80 !! 3.00-3.30 !! 3.40 !! 3.41-4.00 !! SoftID !! Notes
|-
| ? || ? || ? || ? || ? || ? || {{Yes}} || 08A0 || Debug/DEX
|-
|}

=== Speculation of their usage ===
The firmware PUP's contains a collection of patches for all the different hardware revisions of syscon's chips used in different motherboard models, each of this different syscons has his specific "syscon update package"

The ps3swu.self (system updater) decides wich applicable [[Syscon Hardware]] is present and installs the needed package update accordingly.

Package numbers used in the names (marked as asterisks in this example) "SYS_CON_FIRMWARE_********.pkg" identifyes the "syscon hardware revision" "patch version" etc.. (not documented further)

This numeric string in the format wwxxyyzz can be "translated" to wwwwxxxxyyyyzzzz by adding 2 zeroes to each value, and is the syscon patches shown in the "secret" info screen [[More_System_Information]]

Note To end the speculation dispute:
# reversing of ps3swu.self proves indisputable how exactly the packages are applied
# more reported info is needed on the reported SC values in [[More_System_Information]] from the various [[SKU Models]] for their respective [[Syscon Hardware]] - especially when the values are non zero. Also the 00010002083E0832 seems to be an odd one, as it is rare to see this one reported.

== Decryption ==
Packages can be decrypted with the unpkg tool. Decrypted content of the updates appears to always be 0x1000 bytes (4KB).

== Header ==
The header format is completely unknown at this stage.

=== Sample ===
<pre>
00000000  1B 2D 70 0F AB 5E B3 99 68 20 FE 3D E1 80 6A 1D  .-p.«^³™h þ=á€j.
00000010  B8 FD 37 CF CD 45 85 AB 51 F7 05 E3 EA 32 A5 EA  ¸ý7ÏÍE…«Q÷.ãê2¥ê
00000020  67 45 F9 48 00 00 00 00 00 10 00 00 C0 0F 00 00  gEùH........À...
00000030  8B 04 07 F9 9B A2 90 3A 75 89 F1 42 12 59 DA 0D  ‹..ù›¢.:u‰ñB.YÚ.
00000040  21 7C A2 C3 5A E4 78 00 10 8D 4B F7 A2 73 9C 63  !|¢ÃZäx...K÷¢sœc
00000050  5D 8D 5D 49 16 C7 6F 2C AD 33 FE 1F D3 6C A1 CA  ].]I.Ço,.3þ.Ól¡Ê
00000060  BA AD 2B FE 8F 33 71 D7 C5 E6 5C FF BF 77 6C 80  º.+þ.3q×Åæ\ÿ¿wl€
00000070  F2 BE 11 BB 3C 52 52 DC A9 68 E5 24 AD 4F F3 48  ò¾.»<RRÜ©hå$.OóH
</pre>

=== Observations ===
* The first 4 bytes (0x1B2D700F) appear static in each package.
* The next 20 bytes appear to change with each package
* The following 12 bytes (0x0000000000100000C00F0000) also appear static

== Access to Syscon from Linux ==
Access SysCon ROM without needing ps3dm-utils: http://wiki.gitbrew.org/index.php/PS3:HvReverseEngineering#SYSCON