Editing Talk:Syscon Firmware
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
LV1 - System Controller (SC) manager | |||
*sc_mgr_get_srh (0x9001) | *sc_mgr_get_srh (0x9001) | ||
*sc_mgr_set_srh (0x9002) | *sc_mgr_set_srh (0x9002) | ||
Line 22: | Line 22: | ||
*Read System Data From SC EEPROM - Indi Info Manager 0x17007) | *Read System Data From SC EEPROM - Indi Info Manager 0x17007) | ||
SC - sc_iso.self | |||
*sc_iso_sc_binary_patch | *sc_iso_sc_binary_patch | ||
*sc_iso_get_sc_status | *sc_iso_get_sc_status | ||
Line 72: | Line 72: | ||
This should be a good starting point but leaves enough to explore yourself though: http://pastebin.com/NxVkGCdp (for version 1.02) | This should be a good starting point but leaves enough to explore yourself though: http://pastebin.com/NxVkGCdp (for version 1.02) | ||
See [[Graf's PSGroove Payload]] and [[Hypervisor_Reverse_Engineering | See [[Graf's PSGroove Payload]] and [http://www.ps3devwiki.com/index.php?title=Hypervisor_Reverse_Engineering#0x9000_-_SC_Manager HV page #0x9000 - SC_Manager] / [http://www.ps3devwiki.com/index.php?title=Hypervisor_Reverse_Engineering#System_Controller_.28SC_or_SYSCON.29 HVpage #System Controller] | ||
---- | ---- | ||
[http://www.multiupload.com/F388R44T3X SYS_CON_FIRMWARE-PKGs.rar (51.92 KB)] | |||
SYS_CON_FIRMWARE_01000004.pkg (5376 bytes) Firmware 1.30 up to 1.80 (not 1.81 and higher) | |||
SYS_CON_FIRMWARE_01000005.pkg (5376 bytes) Firmware 1.81 up to 3.30 (not 3.40 and higher) | |||
SYS_CON_FIRMWARE_01000006.pkg (5376 bytes) Firmware 3.40/3.41/3.42/3.50/3.55/3.56/3.60/3.61/3.65 | |||
SYS_CON_FIRMWARE_01010302.pkg (5376 bytes) Firmware 1.81 up to 3.30 (not 3.40 and higher) | |||
SYS_CON_FIRMWARE_01010303.pkg (5376 bytes) Firmware 3.40/3.41/3.42/3.50/3.55/3.56/3.60/3.61/3.65 | |||
SYS_CON_FIRMWARE_01020302.pkg (5376 bytes) Firmware 3.40/3.41/3.42/3.50/3.55/3.56/3.60/3.61/3.65 | |||
SYS_CON_FIRMWARE_01030302.pkg (5376 bytes) Firmware 3.40/3.41/3.42/3.50/3.55/3.56/3.60/3.61/3.65 | |||
SYS_CON_FIRMWARE_01040402.pkg (5376 bytes) Firmware 3.40/3.41/3.42/3.50/3.55/3.56/3.60/3.61/3.65 | |||
SYS_CON_FIRMWARE_01050002.pkg (5376 bytes) Firmware 3.40/3.41/3.42/3.50/3.55/3.56/3.60/3.61/3.65 | |||
SYS_CON_FIRMWARE_S1_00010002083E0832.pkg (5376 bytes) Firmware 3.00/3.01/3.10/3.15/3.20/3.21/3.30/3.40/3.41/3.42/3.50/3.55/3.56/3.60/3.61/3.65 | |||
SYS_CON_FIRMWARE_01050101.pkg (5376 bytes) Firmware 3.41/3.42/3.50/3.55/3.56/3.60/3.61/3.65 | |||
Updater log lines related to Syscon just after BD firmware, Multi-Card controller, BlueTooth firmware (in this case CEX 3.55) just before post processing and cleanup update status : | Updater log lines related to Syscon just after BD firmware, Multi-Card controller, BlueTooth firmware (in this case CEX 3.55) just before post processing and cleanup update status : | ||
Line 94: | Line 108: | ||
It is suggested that the Syscon EEPROM is 512KB and the full (encrypted) firmware is <400KB (on Ref.Tool the Syscon is updated by overwiting the whole Syscon firmware : e.g. v1.0.5c1_TMU510_u.bin 384KB) | It is suggested that the Syscon EEPROM is 512KB and the full (encrypted) firmware is <400KB (on Ref.Tool the Syscon is updated by overwiting the whole Syscon firmware : e.g. v1.0.5c1_TMU510_u.bin 384KB) | ||
Syscon commands: | Syscon commands: | ||
ver | ver | ||
Line 136: | Line 149: | ||
The diag commands are usually for the backup bank, the main only supports firmud | The diag commands are usually for the backup bank, the main only supports firmud | ||
CP root pass on Ref.Tool: | CP root pass on Ref.Tool: Cytology | ||
---- | ---- | ||
http://www.pastie.org/2146658 : | |||
'''sc auth keys old:''' | '''sc auth keys old:''' | ||
auth_1_0x00: 13163A92B50513542C18ABAD31B85FB7 | |||
auth_2_0x00: 2BC8BB73F4B59AC658A737A5DD535DFE | |||
auth_1_0x01: D6C374FCDFF8C3CF44018C78733BF5B2 | |||
auth_2_0x01: 648B9FF94EF321C69A4AE596F2F08D22 | |||
auth_1_0x06: 626C7124FC5BA1AF7436389BA37C6654 | |||
auth_2_0x06: 9D94BE461CAF083C9D9FA185C93AEE7B | |||
'''sc auth key seeds:''' | '''sc auth key seeds:''' | ||
auth_1_0x00: 63DCA7D3FEE47F749A408363F1104E8F | auth_1_0x00: 63DCA7D3FEE47F749A408363F1104E8F | ||
Line 153: | Line 169: | ||
''the new auth keys are generated involving 256bit aes encryption (iv is all zeroes)'' | ''the new auth keys are generated involving 256bit aes encryption (iv is all zeroes)'' | ||
---- | |||
[http://www.multiupload.com/545HXQ4FCD dump_sysrom.pkg of dump-flash+syscon.rar (280.51 KB)] (http://git.gitbrew.org/ps3/?p=otheros-utils/dump_sysrom.git) seems to output wrong on MFW315: | [http://www.multiupload.com/545HXQ4FCD dump_sysrom.pkg of dump-flash+syscon.rar (280.51 KB)] (http://git.gitbrew.org/ps3/?p=otheros-utils/dump_sysrom.git) seems to output wrong on MFW315: | ||
Line 165: | Line 180: | ||
== Updating Syscon on Tool/DECR == | == Updating Syscon on Tool/DECR == | ||
[https://cdn.anonfiles.com/1355932907234.rar v1.0.4c2_TMU510_u.bin] | |||
'''Q: How is syscon updated on Reference Tool / DECR models?''' <br /> | '''Q: How is syscon updated on Reference Tool / DECR models?''' <br /> | ||
Line 170: | Line 187: | ||
it is suggested it uses full syscon updates, but how are files like "v1.0.5c1_TMU510_u.bin" send to syscon for updating? With/via Communication Processor? | it is suggested it uses full syscon updates, but how are files like "v1.0.5c1_TMU510_u.bin" send to syscon for updating? With/via Communication Processor? | ||
'''A: In DECR-1000A Syscon is located on the motherboard. The Communication Processor talks to it through UART and updates it with the firmud command.''' | '''A: In DECR-1000A Syscon is located on the motherboard. The Communication Processor talks to it through UART and updates it with the firmud command.''' <br /> | ||
List of main IC's on the board: | |||
* SCEI CXR713F120A ([[Syscon Hardware]]) | |||
* 1x Samsung K9F2G08U0M ([http://www.ps3devwiki.com/index.php?title=Flash_(Hardware) Flash] 2Gbit) | |||
* SCEI CXD4302GB ([[Starship2]]) | |||
* SCEI CXD9790GG (?) "helps handle communication between the Communication Processor, and the system controller, and southbridge. Using this path, the CP can talk to the System Controller, and bring the system up, down, and change its boot settings." | |||
[http://www.ps3news.com/ps3-hacks-jailbreak/ps3-tool-decr-1000a-system-controller-flash-chips-detailed/ archaic source1] [http://www.ps3news.com/ps3-hacks-jailbreak/ps3-tool-decr-1000a-internals-the-communication-processor/ archaic source2] | [http://www.ps3news.com/ps3-hacks-jailbreak/ps3-tool-decr-1000a-system-controller-flash-chips-detailed/ archaic source1] [http://www.ps3news.com/ps3-hacks-jailbreak/ps3-tool-decr-1000a-internals-the-communication-processor/ archaic source2] | ||