Talk:SC EEPROM: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
m (→‎Experimental table: Easyer to mantain)
Line 77: Line 77:
The goal is to join together all the "memory map" info in a single table
The goal is to join together all the "memory map" info in a single table


{| class="wikitable sortable" style="line-height:110%; font-size:85%"
{| class="wikitable sortable" style="line-height:100%; font-size:85%"
|+ Round 2
|+ Round 2
! colspan="3" | Area !! colspan="4" | [[Syscon_Hardware|<abbr title="Only Mullion syscons have a direct SPI access to the EEPROM>SPI</abbr> / <abbr title="All syscons have a UART access>UART</abbr>]] !! colspan="6" | [[LV2_Functions_and_Syscalls#process_socket_service_syscalls|Syscall 863]] !! class="unsortable" rowspan="3" | Data Name !! class="unsortable" rowspan="3" | Notes
! colspan="3" | Area !! colspan="4" | [[Syscon_Hardware|<abbr title="Only Mullion syscons have a direct SPI access to the EEPROM>SPI</abbr> / <abbr title="All syscons have a UART access>UART</abbr>]] !! colspan="6" | [[LV2_Functions_and_Syscalls#process_socket_service_syscalls|Syscall 863]] !! class="unsortable" rowspan="3" | Data Name !! class="unsortable" rowspan="3" | Notes
Line 87: Line 87:
| colspan="15" style="padding:0px" |
| colspan="15" style="padding:0px" |
|-
|-
! System Info !! 0x200
! System Info !! 0x200 !! {{no}}
| {{no}} || 0x2600 || 0x2600 || ? || ? || ? || ? || ? || ? || ? || 0x200 ||  || Encrypted data at relative offset 0xB0
| 0x2600 || 0x2600 || ? || ? || ? || ? || ? || ? || ? || 0x200 ||  || Encrypted data at relative offset 0xB0
|- {{cellcolors|#ffffcc}}
|- {{cellcolors|#ffffcc}}
| style="text-align:center; font-weight:bold;" | Patch 1 || style="text-align:center; font-weight:bold;" |  0x400 || {{No}} || 0x2800 || 0x2800 || <abbr title="On Sherwood the patch isn't even stored in the emulated eeprom, it's stored inside the firmware (0x2000-0x2FFF)>0x2000 ?</abbr> || {{exploitable}} || {{cellcolors|lightgrey}} N/A || {{no}} || {{no}} || {{no}} || 0x02800 || 0x400 || [[Syscon_Firmware#Syscon_patches|Syscon Firmware Patch]] (top half) || Encrypted
! Patch 1 !! 0x400 !! {{No}}
| 0x2800 || 0x2800 || <abbr title="On Sherwood the patch isn't even stored in the emulated eeprom, it's stored inside the firmware (0x2000-0x2FFF)>0x2000 ?</abbr> || {{exploitable}} || {{cellcolors|lightgrey}} N/A || {{no}} || {{no}} || {{no}} || 0x02800 || 0x400 || [[Syscon_Firmware#Syscon_patches|Syscon Firmware Patch]] (top half) || Encrypted
|- {{cellcolors|lightgrey}}
|- {{cellcolors|lightgrey}}
| style="text-align:center; font-weight:bold;" | - || style="text-align:center; font-weight:bold;" | 0x300 || {{No}} || 0x2C00 || 0x2C00 || N/A ? || {{yes}} ? || N/A || {{no}} || {{no}} || {{no}} || 0x02C00 || 0x300 || style="text-align:center" | ''not used'' || Filled with FF's
! - !! 0x300 !! {{No}}
| 0x2C00 || 0x2C00 || N/A ? || {{yes}} ? || N/A || {{no}} || {{no}} || {{no}} || 0x02C00 || 0x300 || style="text-align:center" | ''not used'' || Filled with FF's
|-
|-
! Industry Area !! 0x100
! Industry Area !! 0x100 !! {{no}}
| {{no}} || 0x2F00 || 0x2F00 || 0xE00 || {{yes}} || 0x10 || {{patchable}} || {{yes}} || {{yes}} || 0x02F00 ||  ||  
| 0x2F00 || 0x2F00 || 0xE00 || {{yes}} || 0x10 || {{patchable}} || {{yes}} || {{yes}} || 0x02F00 ||  ||  
|-
|-
! Customer Service Area !! 0x100
! Customer Service Area !! 0x100 !! {{no}}
| {{no}} || 0x3000 || 0x3000 || 0xF00 || {{yes}} || 0x20 || ? || ? || ? || ? || 0x100 ||  ||  
| 0x3000 || 0x3000 || 0xF00 || {{yes}} || 0x20 || ? || ? || ? || ? || 0x100 ||  ||  
|-
|-
! Platform Config !! 0x100
! Platform Config !! 0x100 !! {{yes}}
| {{yes}} || 0x3100 || 0x3100 || ? || {{yes}} || ? || ? || ? || ? || ? || 0x100 ||  ||  
| 0x3100 || 0x3100 || ? || {{yes}} || ? || ? || ? || ? || ? || 0x100 ||  ||  
|-
|-
! Hardware Config !! 0x100
! Hardware Config !! 0x100 !! {{yes}}
| {{yes}} || 0x3200 || 0x3200 || ? || {{yes}} || ? || ? || ? || ? || ? || 0x100 ||  ||  
| 0x3200 || 0x3200 || ? || {{yes}} || ? || ? || ? || ? || ? || 0x100 ||  ||  
|-
|-
! Thermal Config !! 0x200
! Thermal Config !! 0x200 !! {{yes}}
| {{yes}} || 0x3300 || 0x3300 || 0x250 || {{yes}} || ? || ? || ? || ? || ? || 0x200 || Data table using [[Syscon_Thermal_Config/structs|this C structure]] || See: [[Syscon Thermal Config]]
| 0x3300 || 0x3300 || 0x250 || {{yes}} || ? || ? || ? || ? || ? || 0x200 || Data table using [[Syscon_Thermal_Config/structs|this C structure]] || See: [[Syscon Thermal Config]]
|-
|-
! On/Off Count/Time !! 0x200
! On/Off Count/Time !! 0x200 !! {{no}}
| {{no}} || 0x3500 || 0x3500 || ? || {{yes}} || ? || ? || ? || ? || ? || 0x200 || Data table ||  
| 0x3500 || 0x3500 || ? || {{yes}} || ? || ? || ? || ? || ? || 0x200 || Data table ||  
|-
|-
! Error Log !! 0x100
! Error Log !! 0x100 !! {{no}}
| {{no}} || 0x3700 || 0x3700 || 0x900 || {{yes}} || ? || ? || ? || ? || ? || 0x100 || Data table || See: [[Syscon Error Codes]]
| 0x3700 || 0x3700 || 0x900 || {{yes}} || ? || ? || ? || ? || ? || 0x100 || Data table || See: [[Syscon Error Codes]]
|- {{cellcolors|lightgrey}}
|- {{cellcolors|lightgrey}}
| style="text-align:center; font-weight:bold;" | - || style="text-align:center; font-weight:bold;" | 0x100 || {{No}} || 0x3800 || 0x3800 || N/A ? || {{yes}} ? || N/A || {{no}} || {{no}} || {{no}} || ? || 0x100 || style="text-align:center" | ''not used'' || Filled with FF's
! - !! 0x100 !! {{No}}
| 0x3800 || 0x3800 || N/A ? || {{yes}} ? || N/A || {{no}} || {{no}} || {{no}} || ? || 0x100 || style="text-align:center" | ''not used'' || Filled with FF's
|-
|-
! Board Config !! 0x100
! Board Config !! 0x100 !! {{yes}}
| {{yes}} || 0x3900 || 0x3900 || ? || {{yes}} || ? || ? || ? || ? || ? || 0x100 ||  ||  
| 0x3900 || 0x3900 || ? || {{yes}} || ? || ? || ? || ? || ? || 0x100 ||  ||  
|-
|-
! HDMI/DVE Config !! 0x100
! HDMI/DVE Config !! 0x100 !! {{no}}
| {{no}} || 0x3A00 || 0x3A00 || ? || {{yes}} || ? || ? || ? || ? || ? || 0x100 ||  ||  
| 0x3A00 || 0x3A00 || ? || {{yes}} || ? || ? || ? || ? || ? || 0x100 ||  ||  
|- {{cellcolors|lightgrey}}
|- {{cellcolors|lightgrey}}
| style="text-align:center; font-weight:bold;" | - || style="text-align:center; font-weight:bold;" | 0x100 || {{No}} || 0x3B00 || 0x3B00 || N/A ? || {{yes}} ? || N/A || {{no}} || {{no}} || {{no}} || ? || 0x100 || style="text-align:center" | ''not used'' || Filled with FF's
! - !! 0x100 !! {{No}}
| 0x3B00 || 0x3B00 || N/A ? || {{yes}} ? || N/A || {{no}} || {{no}} || {{no}} || ? || 0x100 || style="text-align:center" | ''not used'' || Filled with FF's
|- {{cellcolors|lightgrey}}
|- {{cellcolors|lightgrey}}
| style="text-align:center; font-weight:bold;" | - || style="text-align:center; font-weight:bold;" | 0x200 || {{yes}} || 0x3C00 || 0x3C00 || N/A ? || {{yes}} ? || N/A || {{no}} || {{no}} || {{no}} || ? || 0x200 || style="text-align:center" | ''not used'' || Filled with FF's
! - !! 0x200 !! {{yes}}
| 0x3C00 || 0x3C00 || N/A ? || {{yes}} ? || N/A || {{no}} || {{no}} || {{no}} || ? || 0x200 || style="text-align:center" | ''not used'' || Filled with FF's
|- {{cellcolors|lightgrey}}
|- {{cellcolors|lightgrey}}
| style="text-align:center; font-weight:bold;" | - || style="text-align:center; font-weight:bold;" | 0x200 || {{yes}} || 0x3E00 || 0x3E00 || N/A ? || {{yes}} ? || N/A || {{no}} || {{no}} || {{no}} || ? || 0x200 || style="text-align:center" | ''not used'' || Filled with FF's
! - !! 0x200 !! {{yes}}
| 0x3E00 || 0x3E00 || N/A ? || {{yes}} ? || N/A || {{no}} || {{no}} || {{no}} || ? || 0x200 || style="text-align:center" | ''not used'' || Filled with FF's
|- {{cellcolors|lightgrey}}
|- {{cellcolors|lightgrey}}
| style="text-align:center; font-weight:bold;" | - || style="text-align:center; font-weight:bold;" | 0x400 || {{No}} || 0x4000 || 0x7000 || N/A ? || {{yes}} ? || N/A || {{no}} || {{no}} || {{no}} || ? || 0x400 || style="text-align:center" | ''not used'' || Filled with FF's
! - !! 0x400 !! {{No}}
| 0x4000 || 0x7000 || N/A ? || {{yes}} ? || N/A || {{no}} || {{no}} || {{no}} || ? || 0x400 || style="text-align:center" | ''not used'' || Filled with FF's
|- {{cellcolors|lightgrey}}
|- {{cellcolors|lightgrey}}
| style="text-align:center; font-weight:bold;" | - || style="text-align:center; font-weight:bold;" | 0xB00 || {{No}} || 0x4400 || 0x7400 || N/A ? || {{yes}} ? || N/A || {{no}} || {{no}} || {{no}} || ? || 0xB00 || style="text-align:center" | ''not used'' || Filled with FF's
! - !! 0xB00 !! {{No}}
| 0x4400 || 0x7400 || N/A ? || {{yes}} ? || N/A || {{no}} || {{no}} || {{no}} || ? || 0xB00 || style="text-align:center" | ''not used'' || Filled with FF's
|- {{cellcolors|lightgrey}}
|- {{cellcolors|lightgrey}}
| style="text-align:center; font-weight:bold;" | - || style="text-align:center; font-weight:bold;" | 0x2000 || {{No}} || 0x5000 || 0x5000 || N/A ? || {{yes}} ? || N/A || {{no}} || {{no}} || {{no}} || ? || 0x2000 || style="text-align:center" | ''not used'' || Filled with FF's
! - !! 0x2000 !! {{No}}
| 0x5000 || 0x5000 || N/A ? || {{yes}} ? || N/A || {{no}} || {{no}} || {{no}} || ? || 0x2000 || style="text-align:center" | ''not used'' || Filled with FF's
|-
|-
! System Software Config !! 0x100
! System Software Config !! 0x100 !! {{no}}
| {{no}} || 0x7000 || 0x4000 || 0x1000 || {{yes}} || 0x0 || ? || ? || ? || ? || 0x100 ||  ||  
| 0x7000 || 0x4000 || 0x1000 || {{yes}} || 0x0 || ? || ? || ? || ? || 0x100 ||  ||  
|-
|-
! System Software Config !! 0x100
! System Software Config !! 0x100 !! {{no}}
| {{no}} || 0x7100 || 0x4100 || 0x1100 || {{yes}} || 0x1 || ? || ? || ? || ? || 0x100 ||  ||  
| 0x7100 || 0x4100 || 0x1100 || {{yes}} || 0x1 || ? || ? || ? || ? || 0x100 ||  ||  
|-
|-
! System Software Config<br>a.k.a.<br><strike>Flags and Tokens</strike> !! 0x100
! System Software Config<br>a.k.a.<br><strike>Flags and Tokens</strike> !! 0x100 !! {{no}}
| {{no}} || 0x7200 || 0x4200 || 0x1200 || {{yes}} || 0x2 || {{patchable}} || {{yes}} || {{yes}} || 0x48C00 ||  ||  
| 0x7200 || 0x4200 || 0x1200 || {{yes}} || 0x2 || {{patchable}} || {{yes}} || {{yes}} || 0x48C00 ||  ||  
|-
|-
! System Software Config !! 0x100
! System Software Config !! 0x100 !! {{no}}
| {{no}} || 0x7300 || 0x4300 || 0x1300 || {{yes}} || 0x3 || ? || ? || ? || ? || 0x100 ||  ||  
| 0x7300 || 0x4300 || 0x1300 || {{yes}} || 0x3 || ? || ? || ? || ? || 0x100 ||  ||  
|- {{cellcolors|#ffffcc}}
|- {{cellcolors|#ffffcc}}
| style="text-align:center; font-weight:bold;" | Patch 2 || style="text-align:center; font-weight:bold;" | 0xC00 || {{No}} || 0x7400 || 0x4400 || <abbr title="On Sherwood the patch isn't even stored in the emulated eeprom, it's stored inside the firmware (0x2000-0x2FFF)>0x2400 ?</abbr> || {{exploitable}} || {{cellcolors|lightgrey}} N/A || {{no}} || {{no}} || {{no}} || ? || ? || [[Syscon_Firmware#Syscon_patches|Syscon Firmware Patch]] (bottom half) || Encrypted
! Patch 2 !! 0xC00 !! {{No}}
| 0x7400 || 0x4400 || <abbr title="On Sherwood the patch isn't even stored in the emulated eeprom, it's stored inside the firmware (0x2000-0x2FFF)>0x2400 ?</abbr> || {{exploitable}} || {{cellcolors|lightgrey}} N/A || {{no}} || {{no}} || {{no}} || ? || ? || [[Syscon_Firmware#Syscon_patches|Syscon Firmware Patch]] (bottom half) || Encrypted
|}
|}

Revision as of 19:12, 1 December 2021

Memory test diagnosis NVS flag

There is a NVS flag which enables a special diagnostic mode at startup. This flag is enabled on Proto/DECR. It allows memtest diagnose.

Pseudo-code: 

def check_bootrom_diag_mode(mode, param)
        diag_mode = get_eeprom_bootrom_diag()
        if diag_mode & 0x1:
                if diag_mode & 0x100:
                        return 0
                mode = (diag_mode >> 3) & 0x1
                param = (diag_mode >> 3) & 0x1
        else:
                mode = (diag_mode >> 1) & 0x1
                param = -1
        return 1

EEPROM Dumps

EEPROM Strings (CP memory dump, DECR)

http://pastie.org/private/usd2zi8mw3igycsh1a395q -> DEAD LINK

Bus Pirate stuff

http://i.imgur.com/48rbR51.png

(needs more wikifying)

On standby

  • Note: during this time the plaintext EEPROM is never read even once!
  • Additionally, the areas 0x26B0, 0x26D0 are not read
  • Checks status
  • Unlocks Write Command
  • Reads PATCH top half region
  • Reads PATCH bottom half region
  • Reads 0x2790?(0x20)
  • Reads 0x27B0?(0x10)
  • Reads 0x26D0 (0x10)
  • Reads some configs? (around >0x31XX area)
  • Reads 0x0 (0x10)
  • Reads some configs?
  • Reads 0x10(0x280) (EID1)?
  • Reads 0x3A00 (0x1)
  • Reads 0x290 (0x10) (EID1 CMAC?)
  • Reads 0x2A0 (0x20)
  • Reads 0x2C0 (0x20)
  • Reads 0x2E0 (0x20)
  • Writes some stuff to 0x2C0/0x2E0/0x2A0 (mostly ff's)
  • ReReads EID1 and CMAC
  • Reads 0x360
  • Reads 0x370
  • Writes (again) mostly ff's to 0x360 and 0x370
  • ReReads EID1 and CMAC
  • Does same process with 0x460 and 0x470
  • Reads 0x2710 and 0x2730 (0x20,0x10) ???
  • Reads 0x2700 (0x10)
  • fini!

MemoryMap Syscon BB Chip

0x1000-0x1FFF:PTCH Region (patch written here)

Nice read about Syscon EEPROM

http://rmscrypt.wordpress.com/2011/02/01/lets-look-at-syscon/

Experimental table

The goal is to join together all the "memory map" info in a single table

Round 2
Area SPI / UART Syscall 863 Data Name Notes
Name Size csum Mullion Sherwood whitelist Block ID
NVS Region		 whitelist Offset Size
CXR713 CXR714 SW/2/3(emu) EEP DM UM SCM
System Info 0x200 No 0x2600 0x2600 ? ? ? ? ? ? ? 0x200 Encrypted data at relative offset 0xB0
Patch 1 0x400 No 0x2800 0x2800 0x2000 ?  Exploit  N/A No No No 0x02800 0x400 Syscon Firmware Patch (top half) Encrypted
- 0x300 No 0x2C00 0x2C00 N/A ? Yes ? N/A No No No 0x02C00 0x300 not used Filled with FF's
Industry Area 0x100 No 0x2F00 0x2F00 0xE00 Yes 0x10  Patch  Yes Yes 0x02F00
Customer Service Area 0x100 No 0x3000 0x3000 0xF00 Yes 0x20 ? ? ? ? 0x100
Platform Config 0x100 Yes 0x3100 0x3100 ? Yes ? ? ? ? ? 0x100
Hardware Config 0x100 Yes 0x3200 0x3200 ? Yes ? ? ? ? ? 0x100
Thermal Config 0x200 Yes 0x3300 0x3300 0x250 Yes ? ? ? ? ? 0x200 Data table using this C structure See: Syscon Thermal Config
On/Off Count/Time 0x200 No 0x3500 0x3500 ? Yes ? ? ? ? ? 0x200 Data table
Error Log 0x100 No 0x3700 0x3700 0x900 Yes ? ? ? ? ? 0x100 Data table See: Syscon Error Codes
- 0x100 No 0x3800 0x3800 N/A ? Yes ? N/A No No No ? 0x100 not used Filled with FF's
Board Config 0x100 Yes 0x3900 0x3900 ? Yes ? ? ? ? ? 0x100
HDMI/DVE Config 0x100 No 0x3A00 0x3A00 ? Yes ? ? ? ? ? 0x100
- 0x100 No 0x3B00 0x3B00 N/A ? Yes ? N/A No No No ? 0x100 not used Filled with FF's
- 0x200 Yes 0x3C00 0x3C00 N/A ? Yes ? N/A No No No ? 0x200 not used Filled with FF's
- 0x200 Yes 0x3E00 0x3E00 N/A ? Yes ? N/A No No No ? 0x200 not used Filled with FF's
- 0x400 No 0x4000 0x7000 N/A ? Yes ? N/A No No No ? 0x400 not used Filled with FF's
- 0xB00 No 0x4400 0x7400 N/A ? Yes ? N/A No No No ? 0xB00 not used Filled with FF's
- 0x2000 No 0x5000 0x5000 N/A ? Yes ? N/A No No No ? 0x2000 not used Filled with FF's
System Software Config 0x100 No 0x7000 0x4000 0x1000 Yes 0x0 ? ? ? ? 0x100
System Software Config 0x100 No 0x7100 0x4100 0x1100 Yes 0x1 ? ? ? ? 0x100
System Software Config
a.k.a.
Flags and Tokens		 0x100 No 0x7200 0x4200 0x1200 Yes 0x2  Patch  Yes Yes 0x48C00
System Software Config 0x100 No 0x7300 0x4300 0x1300 Yes 0x3 ? ? ? ? 0x100
Patch 2 0xC00 No 0x7400 0x4400 0x2400 ?  Exploit  N/A No No No ? ? Syscon Firmware Patch (bottom half) Encrypted
Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=Talk:SC_EEPROM&oldid=63548"