Editing Talk:Syscon Firmware

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 72: Line 72:
This should be a good starting point but leaves enough to explore yourself though: http://pastebin.com/NxVkGCdp (for version 1.02)
This should be a good starting point but leaves enough to explore yourself though: http://pastebin.com/NxVkGCdp (for version 1.02)


See [[Graf's PSGroove Payload]] and [[Hypervisor_Reverse_Engineering]] #SC_Manager, #System_Controller
See [[Graf's PSGroove Payload]] and [http://www.ps3devwiki.com/index.php?title=Hypervisor_Reverse_Engineering#0x9000_-_SC_Manager HV page #0x9000 - SC_Manager] / [http://www.ps3devwiki.com/index.php?title=Hypervisor_Reverse_Engineering#System_Controller_.28SC_or_SYSCON.29 HVpage #System Controller]
----
----
== Updater log lines related to syscon ==
== Updater log lines related to syscon ==
Line 496: Line 496:
For a backtrack of this talk see the section named "sherwood names format" at the end of [https://www.psdevwiki.com/ps3/index.php?title=System_Controller_Firmware&diff=58966&oldid=58927 this edit], the request for a confirmation [https://www.psdevwiki.com/ps3/index.php?title=System_Controller_Firmware&diff=58971&oldid=58968 here], and the answer [https://www.psdevwiki.com/ps3/index.php?title=System_Controller_Firmware&diff=58973&oldid=58971 here]
For a backtrack of this talk see the section named "sherwood names format" at the end of [https://www.psdevwiki.com/ps3/index.php?title=System_Controller_Firmware&diff=58966&oldid=58927 this edit], the request for a confirmation [https://www.psdevwiki.com/ps3/index.php?title=System_Controller_Firmware&diff=58971&oldid=58968 here], and the answer [https://www.psdevwiki.com/ps3/index.php?title=System_Controller_Firmware&diff=58973&oldid=58971 here]


The patch naming and versioning for mullion is straightforward, both the value displayed in the [[More System Information]] screen and the PKG filename itself contains the 4 integer values of the: "major version", "minor version", "major revision", and "minor revision" that appears in the header of the decrypted patch structure [[Syscon Firmware#Mullion Patch Content]]. Filename SYS_CON_FIRMWARE_0'''1'''0'''1'''0'''3'''0'''3'''.pkg is patch v1.1.3.3. But we cant apply the same rules for sherwood<br>
The patch naming and versioning for mullion is straightforward, both the value displayed in the [[More System Information]] screen and the PKG filename itself contains the 4 integer values of the: "major version", "minor version", "major revision", and "minor revision" that appears in the header of the decrypted patch structure [[System Controller Firmware#Mullion Patch Content]]. Filename SYS_CON_FIRMWARE_0'''1'''0'''1'''0'''3'''0'''3'''.pkg is patch v1.1.3.3. But we cant apply the same rules for sherwood<br>
The only official patch filename sample we have for sherwood is ''SYS_CON_FIRMWARE_S1_000'''1'''000'''2'''0'''83E'''0'''832'''.pkg''. There are many photos in the [[Talk:More System Information]] where can be seen that is displayed as ''0832.000'''1'''000'''2'''0'''83E'''0'''832'''@SC''<br>
The only official patch filename sample we have for sherwood is ''SYS_CON_FIRMWARE_S1_000'''1'''000'''2'''0'''83E'''0'''832'''.pkg''. There are many photos in the [[Talk:More System Information]] where can be seen that is displayed as ''0832.000'''1'''000'''2'''0'''83E'''0'''832'''@SC''<br>
The first 2 integers seems to follow the rules for mullion ("major version" and "minor version") and indicates v1.2... but it seems the base firmware is 1.11... so im wondering if the patch "updates" the firmware to 1.2 (base firmware v1.11 overlayed with the patch becomes v1.2)<br>
The first 2 integers seems to follow the rules for mullion ("major version" and "minor version") and indicates v1.2... but it seems the base firmware is 1.11... so im wondering if the patch "updates" the firmware to 1.2 (base firmware v1.11 overlayed with the patch becomes v1.2)<br>
The last 2 values are the most weird, but also the most interesing, the '''0832''' is the SoftID of the real '''base''' firmware... and im wondering if after applying the patch it becomes '''083E'''. Note both values are very close to each other, the algorythm used by syscon to calculate checksums makes them similar if we change only a few bytes as can be seen when playing around with the "eepcsum" command<br>
The last 2 values are the most weird, but also the most interesing, the '''0832''' is the SoftID of the real '''base''' firmware... and im wondering if after applying the patch it becomes '''083E'''. Note both values are very close to each other, the algorythm used by syscon to calculate checksums makes them similar if we change only a few bytes as can be seen when playing around with the "eepcsum" command<br>
Long story short... im wondering if all the SoftID's are checksums of the base syscon firmware build (not counting the EEPROM areas used for per-console configurations as the "platform config" area or others). And for sherwoods is also a checksum of the resulting data after applying the patch (so in this case is a checksum based in the data in syscon RAM), the header of the decrypted patch structure for sherwoods changed [[Syscon Firmware#Sherwood Patch Content]] and includes 2 new values "data checksum" (the checksum of the syscon base firmware = SoftID '''before''' aplying the patch ?), and "patch checksum" (the checksum of the syscon base firmware overlayed with the patch data = SoftID '''after''' aplying the patch ?)<br>
Long story short... im wondering if all the SoftID's are checksums of the base syscon firmware build. And for sherwoods also a checksum of the resulting data after applying the patch (so in this case is a checksum based in the data in syscon RAM), the header of the decrypted patch structure for sherwoods changed [[System Controller Firmware#Sherwood Patch Content]] and includes 2 new values "data checksum" (the checksum of the syscon base firmware = SoftID '''before''' aplying the patch ?), and "patch checksum" (the checksum of the syscon base firmware overlayed with the patch data = SoftID '''after''' aplying the patch ?)<br>
So the filename for sherwoods is "major version" (of the patched data), "minor version" (of the patched data), "patch checksum" (of base firmware + patch), "data checksum" (of base firmware)
So the filename for sherwoods is "major version" (of the patched data), "minor version" (of the patched data), "patch checksum" (of base firmware + patch), "data checksum" (of base firmware)
--[[User:Sandungas|Sandungas]] ([[User talk:Sandungas|talk]]) 19:32, 1 May 2021 (UTC)
--[[User:Sandungas|Sandungas]] ([[User talk:Sandungas|talk]]) 19:32, 1 May 2021 (UTC)
----
----
Syscon doesn't use the PatchID internally - I guess it's just saved in the patch header for identification purposes. The only thing it's checking is the SoftID.<br>
The SoftID (I call it BuildID) is incremental ([[Syscon_Firmware#Syscon_firmwares|see here]]), like for example the [[Index.dat#build|build id]].<br>
The checksums in the Sherwood patch are just for the data saved in the patch (for "integrity" = bad crypto reasons), the HDMI patch on the Mullion syscon does also have a checksum.<br>[[User:M4j0r|M4j0r]] ([[User talk:M4j0r|talk]]) 19:46, 1 May 2021 (UTC)
----
= Device list =
Mullion firmware versions: v1.0.0_k1, v1.1.3_k1, v1.2.3_k1, v1.3.3_k1 (the list is identical in all this syscon firmware versions)
<pre>
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000  55 53 42 20 00 41 43 2F 44 43 20 00 32 6E 64 20  USB .AC/DC .2nd
00000010  48 44 44 20 00 31 73 74 20 48 44 44 20 00 47 62  HDD .1st HDD .Gb
00000020  45 20 00 47 44 44 52 33 20 56 52 20 00 42 45 20  E .GDDR3 VR .BE
00000030  56 52 20 00 58 44 52 20 56 52 20 00 52 53 58 20  VR .XDR VR .RSX
00000040  56 52 20 00 45 45 2B 47 53 20 00 6D 69 73 63 20  VR .EE+GS .misc
00000050  00 49 4F 49 46 30 20 74 72 61 63 65 20 00 49 4F  .IOIF0 trace .IO
00000060  49 46 31 20 74 72 61 63 65 20 00 58 49 4F 20 74  IF1 trace .XIO t
00000070  72 61 63 65 20 00 41 69 72 20 49 6E 74 61 6B 65  race .Air Intake
00000080  20 00 69 6E 73 69 64 65 20 63 68 61 73 69 73 20  .inside chasis
00000090  00 42 44 20 53 65 63 6F 6E 64 61 72 79 20 00 42  .BD Secondary .B
000000A0  44 20 50 72 69 6D 61 72 79 20 00 31 73 74 20 42  D Primary .1st B
000000B0  45 20 50 72 69 6D 61 72 79 20 00 58 44 52 20 50  E Primary .XDR P
000000C0  72 69 6D 61 72 79 20 00 52 53 58 20 50 72 69 6D  rimary .RSX Prim
000000D0  61 72 79 20 00                                  ary .
</pre>
Sherwood firmware version: v0.17.0 (only)<br>
The strings was reorganized, and was added "SB"
<pre>
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000  31 73 74 20 42 45 20 50 72 69 6D 61 72 79 20 00  1st BE Primary .
00000010  52 53 58 20 50 72 69 6D 61 72 79 20 00 58 44 52  RSX Primary .XDR
00000020  20 50 72 69 6D 61 72 79 20 00 42 45 20 56 52 20  Primary .BE VR
00000030  00 52 53 58 20 56 52 20 00 47 44 44 52 33 20 56  .RSX VR .GDDR3 V
00000040  52 20 00 58 44 52 20 56 52 20 00 41 43 2F 44 43  R .XDR VR .AC/DC
00000050  20 00 42 44 20 50 72 69 6D 61 72 79 20 00 42 44  .BD Primary .BD
00000060  20 53 65 63 6F 6E 64 61 72 79 20 00 41 69 72 20  Secondary .Air
00000070  49 6E 74 61 6B 65 20 00 69 6E 73 69 64 65 20 63  Intake .inside c
00000080  68 61 73 69 73 20 00 58 49 4F 20 74 72 61 63 65  hasis .XIO trace
00000090  20 00 49 4F 49 46 30 20 74 72 61 63 65 20 00 49  .IOIF0 trace .I
000000A0  4F 49 46 31 20 74 72 61 63 65 20 00 47 62 45 20  OIF1 trace .GbE
000000B0  00 55 53 42 20 00 6D 69 73 63 20 00 31 73 74 20  .USB .misc .1st
000000C0  48 44 44 20 00 32 6E 64 20 48 44 44 20 00 53 42  HDD .2nd HDD .SB
000000D0  20 00 45 45 2B 47 53 20 00                        .EE+GS .
</pre>
Sherwood firmware version: v1.11.0 (or newer)<br>
All the strings was removed, except 2 of them
<pre>
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000  31 73 74 20 42 45 20 50 72 69 6D 61 72 79 00 52  1st BE Primary.R
00000010  53 58 20 50 72 69 6D 61 72 79 00                SX Primary.
</pre>
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)