Iso module

Explanation

Isolated modules are used for de-/encryption, rehashing etc.

Commonly found in CoreOS, dev_flash, embedded sony selfs and service packages like Remarry Bluray Drive.

They are SPU .self binaries which can be called whenever needed: e.g. decrypting and hashcheck EID0 for Target ID inside IDPS when called upon by lv1 (HyperVisor) to set up restrictions for Retail/CEX or Debug/DEX etc.

Note: This page lists all isolated modules, except bootldr, metldr and other loaders from CoreOS, see also Boot Order

Known isolated modules

Module	Usage	Location	Remarks
AacsModule.spu.isoself	EID3 and theoretically OCRL	/dev_flash/bdplayer
aim_spu_module.self	EID0 (section 0x00 and 0x0A)	CoreOS
CprmModule.spu.isoself	EID3	/dev_flash/bdplayer
CssModule.spu.isoself		/dev_flash/bdplayer
fdm_spu_module	EID2, Remarry Bluray Drive	2.43 JIG PUP
manu_info_spu_module.self		CoreOS (since FW 3.50)
mc_iso_spu_module.self	PS2	CoreOS
me_iso_for_ps2emu.self	PS2	CoreOS (since FW 3.70)
me_iso_spu_module.self	PS2	CoreOS
SacModule.spu.isoself	EID3, SuperAudioCD	/dev_flash/vsh/module
sb_iso_spu_module.self	South Bridge	CoreOS
sc_iso.self	syscon	CoreOS
sc_iso_factory.self	syscon	2.43 JIG PUP
spu_handler.isoself	PSP Savegames	self inside /dev_flash/sys/internal/libchnnlsv.sprx
spu_handler.isoself	PSP	self inside /dev_flash/pspemu/release/emulator_drm.sprx mself (since FW 3.15)
spu_mode_auth.self		2.43 JIG PUP
spu_pkg_rvk_verifier.self		CoreOS
spu_token_processor.self	systemtokens, QA Flagging	CoreOS
spu_utoken_processor.self	usertokens	CoreOS (since FW 2.40)
ss_sc_init.self	syscon	2.43 JIG PUP
sv_iso_for_ps2emu.self	EID4, PS2	CoreOS (since FW 3.70)
sv_iso_spu_module.self	EID0, EID4, PS2, bluray	CoreOS

sc_iso.self

sc_iso.self is used by the system to handle communications to/from syscon. Once debug printing is enabled after you load it, you can see some of the internal workings including error codes for when you are trying to use the module on your own.

Communicating w/ sc_iso.self

Look in the hv bible for more detailed info, but the gist is this:

1) Send the mbmsg start packet {1, 1, [sc_iso_cmd], [sc_iso_cmd_size]}. This is in response to the 0x80 mbox int.
2) On 0x81 mbox int, receive the packet (same location you sent it from), do stuff, then write back new packets and then spu_in_mbox_write(problem, seqno++)

Error Value	Meaning
0x80010283	Bad hdr->seqno (in dma_get)
0x80010284	Bad hdr->mbmsg (in dma_get)
0x80010285	is_align_ok fail (in dma_get)
0x81010101	sc_iso command failed
0x81010106	Bad input command value
0x81010607	Bad parameter for Get SRH (0x4)
0x81010801	Init for VTRM (0x6) write mngblk failed
0x81010807	Bad parameters for Init for VTRM (0x6)
0x81010907	Bad parameters for get_region_data (0x7)
0x81010A07	Bad parameters for set_region_data (0x8)
0x81010B01	Read mngblk failed for Init For Updater (0xE)
0x81010B07	Bad parameter for Init For Updater (0xE)
0x81011E07	Bad parameter for encrypt (0x1) / decrypt (0x2)

Iso module main arguments

Register	Value
r3	uint64_t iso_module_arg0
r4	uint64_t iso_module_arg1
r5	uint64_t iso_module_arg2
r6	uint64_t iso_module_arg3
r7	uint128_t indiv_data0_part0
r8	uint128_t indiv_data0_part1
r9	uint128_t indiv_data0_part2
r10	uint128_t indiv_data0_part3
r11	uint128_t indiv_data1_part0
r12	uint128_t indiv_data1_part1
r13	uint128_t indiv_data1_part2
r14	uint128_t indiv_data1_part3
r15	uint128_t indiv_data2_part0
r16	uint128_t indiv_data2_part1
r17	uint128_t indiv_data2_part2
r18	uint128_t indiv_data2_part3
r19	uint128_t indiv_data3_part0
r20	uint128_t indiv_data3_part1 (EID0_KEY_first_part for sv_iso_module only)
r21	uint128_t indiv_data3_part2 (EID0_KEY_second_part for sv_iso_module only)
r22	uint128_t indiv_data3_part3 (EID0_IV for sv_iso_module only)
r23	uint32_t entry_point
r24	uint64_t forced_sdk_minver (passed from metldr)