PS3Cobra Payload Reverse Engineering: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
m (Text replacement - "http://web.archive.org/web→‎/http://ps3devwiki.com/files" to "https://web.archive.org/web/: http://ps3devwiki.com/files")
 
(42 intermediate revisions by 7 users not shown)
Line 1: Line 1:
[[Category:Software]][[Category:Hardware]]
In case you wanted a simple guide howto run Cobra without a dongle, look here: http://www.ps3hax.net/showthread.php?t=67286
 
{{Wikify}}
 
=Description=
=Description=
Dongle is DRM to make sure you have the dongle, the firmware 'special' functionality will not work without it. <br />
Dongle is DRM to make sure you have the dongle, the firmware 'special' functionality will not work without it. <br />
Hardwarewise, there are many simularities with [[PS3JB2_Reverse_Engineering#Hardware_Dongle|PSJB2/TrueBlue]]
Hardwarewise, there are many simularities with [[ReDRM / Piracy dongles]] like PSJB2/TrueBlue




Line 55: Line 58:
| 25EC18 || bl      sub_12934        || bl      sub_500960 ||                    ||
| 25EC18 || bl      sub_12934        || bl      sub_500960 ||                    ||
|-
|-
| 271AF0 || stdu    %sp, var_B0(%sp) || b      loc_500808 || b      loc_500818 || (syscall864) <s>Again, wrong here, loc_500808 is a bad jump.</s><br>this is 1.2!
| 271AF0 || stdu    %sp, var_B0(%sp) || b      loc_500808 || b      loc_500818 || (syscall864 / sys storage manager) <s>Again, wrong here, loc_500808 is a bad jump.</s><br>this is 1.2!
|-
|-
| 273F80 || stdu    %sp, var_B0(%sp) || b      sub_500878 || b      sub_500990 || (syscall867)<s>you have a critical mistake, sub_500878 IS WRONG, :), if you jump here you crash your lv2</s><br> YOUR CRITICAL MISTAKE WAS ONLY PUT 1.2, NOW YOU FIX IT, THANKS<br>didn't meant to be rude, sry :)
| 273F80 || stdu    %sp, var_B0(%sp) || b      sub_500878 || b      sub_500990 || (syscall867 / aim manager )<s>you have a critical mistake, sub_500878 IS WRONG, :), if you jump here you crash your lv2</s><br> YOUR CRITICAL MISTAKE WAS ONLY PUT 1.2, NOW YOU FIX IT, THANKS<br>didn't meant to be rude, sry :)
|-
|-
| 29245C || stdu    %sp, var_100(%sp)|| b      sub_5005A8 ||                  ||
| 29245C || stdu    %sp, var_100(%sp)|| b      sub_5005A8 ||                  ||
Line 65: Line 68:
| 293A18 || ld      %r9, stru_3403A0 || b      sub_500540 ||                  ||
| 293A18 || ld      %r9, stru_3403A0 || b      sub_500540 ||                  ||
|-
|-
| 296550 || stdu    %sp, var_D0(%sp) || b      sub_500640 ||                  ||(syscall606)
| 296550 || stdu    %sp, var_D0(%sp) || b      sub_500640 ||                  ||(syscall606 sys_storage_async_read)
|-
|-
| 296928 || stdu    %sp, var_D0(%sp) || b      sub_500770 ||                  ||(syscall619)
| 296928 || stdu    %sp, var_D0(%sp) || b      sub_500770 ||                  ||(syscall619 sys_storage_async_send_device_command)
|-
|-
| 29BD48 || b      sub_11850 || b      sub_500358 ||                        ||
| 29BD48 || b      sub_11850 || b      sub_500358 ||                        ||
Line 290: Line 293:
Extern (PS1):
Extern (PS1):
* ''/dev_usb/PSXISO''
* ''/dev_usb/PSXISO''
</td></tr>
<tr><td with="50%">
Intern (PSP):
* ''/dev_hdd0/PSPISO''
</td><td with="50%">
Extern (PSP):
* ''/dev_usb/PSPISO''
</td></tr>
</td></tr>
<tr><td with="50%">
<tr><td with="50%">
Line 336: Line 346:
Datasheets and usermanuals: http://www.actel.com/products/pa3/docs.aspx#ds <br />
Datasheets and usermanuals: http://www.actel.com/products/pa3/docs.aspx#ds <br />
Familyroot: http://www.actel.com/products/pa3/ <br />
Familyroot: http://www.actel.com/products/pa3/ <br />
Usage Guide: http://www.embedtools.com/pro_kaifa/SOPC_%20EDA/ProASIC3/PA3_E_IO_AN.pdf


===== Pinout A3P060 VQ100 =====
===== Pinout A3P060 VQ100 =====
Line 552: Line 563:


==== 12.000 MHz Crystal ====
==== 12.000 MHz Crystal ====
Y2? <br />
Y2 <br />
CLK for Atmel <br />
SCK/CLK for Atmel/Winbond <br />


==== AMS1117 3.3 1032 - Low Dropout Linear Regulator ====
==== AMS1117 3.3 1032 - Low Dropout Linear Regulator ====
U3 <br />
U3 <br />
Datasheet: http://www.sltdigital.com/product/product_pdf/AMS1117.pdf / http://home1.cyber-labo.co.jp/board/goods/pdf/AMS1117.pdf <br />
Datasheet:  
[[:File:AMS1117 - SOT-223.png]]<br />
* https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Datasheets/AMS1117-.pdf
* https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Datasheets/AMS1117.pdf<!--// http://www.sltdigital.com/product/product_pdf/AMS1117.pdf / http://home1.cyber-labo.co.jp/board/goods/pdf/AMS1117.pdf //--> <br />
<gallery>File:AMS1117 - SOT-223.png</gallery>


====  A 47 (unreferenced 5pin IC : U4) ====
====  A 47 (F51C 5pin Multilayer Ceramic Capacitor : U4) ====
U4 <br />
<div style="float:right">[[File:SOT5.PNG|200px|Thumb|Left|F51C 5pin Multilayer Ceramic Capacitor]]<br /></div>
A 47 <!--// 51c or s1c ? - hard to see without magnifier //--> <br />
<div style="height:300px; overflow:auto">
[[:File:SOT5.PNG]]<br />
Capacitance value untested, likely one of these ([http://www.mouser.com/Passive-Components/Capacitors/_/N-5g7r?P=1z0z7ym&Keyword=f51C&Ns=Pricing|0&FS=True from Mouser]) <!--// F51C -- verified with magnifier //-->  
<br />
</div>


==== Atmel ATmega 16A (16MHz AVR - 16KB flash - USB stack + DFU) ====
==== Atmel ATmega 16A (16MHz AVR - 16KB flash - USB stack + DFU) ====
Line 577: Line 590:
! Pin !! Function !! Notes
! Pin !! Function !! Notes
|-
|-
| 1 || (MOSI) PB5 ||
| 1 || (MOSI) PB5 || Tied to DI (Pin 5) on the Winbond Flash
|-
|-
| 2 || (MISO) PB6 ||  
| 2 || (MISO) PB6 || Tied to DO (Pin 2) on the Winbond Flash
|-
|-
| 3 || (SCK) PB7 ||  
| 3 || (SCK) PB7 || Provides CLK to The Winbond Flash
|-
|-
| 4 || RESET ||  
| 4 || RESET ||  
Line 589: Line 602:
| 6 || GND ||  
| 6 || GND ||  
|-
|-
| 7 || XTAL2 ||  
| 7 || XTAL2 || Y2
|-
|-
| 8 || XTAL1 ||  
| 8 || XTAL1 || Y2
|-
|-
| 9 || (RXD) PD0 ||  
| 9 || (RXD) PD0 || Actel IO92RSB2 (pin 30)
|-
|-
| 10 || (TXD) PD1 ||  
| 10 || (TXD) PD1 || Actel IO92RSB2 (pin 29)
|-
|-
| 11 || (INT0) PD2 ||  
| 11 || (INT0) PD2 ||  
Line 623: Line 636:
| 23 || (TDO) PC4 ||  
| 23 || (TDO) PC4 ||  
|-
|-
| 24 || (TDI) PC5 ||  
| 24 || (TDI) PC5 || Tied to 3v3 Voltage regulator VCC
|-
|-
| 25 || (TOSC1) PC6 ||  
| 25 || (TOSC1) PC6 ||  
Line 629: Line 642:
| 26 || (TOSC2) PC7 ||  
| 26 || (TOSC2) PC7 ||  
|-
|-
| 27 || AVCC ||  
| 27 || AVCC || Tied to 3v3 Voltage regulator VCC
|-
|-
| 28 || GND ||  
| 28 || GND ||  
Line 651: Line 664:
| 37 || (ADC0) PA0 ||  
| 37 || (ADC0) PA0 ||  
|-
|-
| 38 || VCC ||  
| 38 || VCC || Tied to 3v3 Voltage regulator VCC
|-
|-
| 39 || GND ||  
| 39 || GND ||  
Line 667: Line 680:
|}
|}
</div>
</div>


==== Winbond 25X16AVSIG (SPI Flash 16Mbit) ====
==== Winbond 25X16AVSIG (SPI Flash 16Mbit) ====
Line 673: Line 685:
{{Template:Winbond 25X16AVSIG}}
{{Template:Winbond 25X16AVSIG}}


On the Cobra Dongle, pin 3 of the EEPROM is tied to VCC. Lifting this Pin from the board '''should''' prevent the eeprom from being erased.
On the Cobra Dongle, pin 3 of the EEPROM is tied to VCC. Lifting this Pin from the board and tieing it to ground '''should''' prevent the flash from being erased.
 
=====Roles=====
Drives data to and from the Winbond flash chip.


====Cobra Test Points====
====Cobra Test Points====
Line 683: Line 698:


There is a switch that switched between Downgrade, PC and PS3 modes of the dongle.
There is a switch that switched between Downgrade, PC and PS3 modes of the dongle.
When facing the switch, with the USB Plug to the left the pins are labeled 1 to 4 in the table below:
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"
|- bgcolor="#cccccc"
! Pin !! Usage !! Connects to !! Remarks
|-
| 1 || PC Position || GND || A resistor is placed, by hand, between this pin and GND after the board is manufactured.
|-
| 2 || PC/PS3 Position|| AVCC (atmega 27) + Winbond /WP (PIN 3) || Ties to Pin 27 of atmega16 (AVCC) and /WP of Winbond Flash
|-
| 3 || PS3/DG Position|| TOSC2 of the Atmega (Pin 26)|| ???
|-
| 4 || DG Position|| GND || A resistor is placed, by hand, between this pin and GND after the board is manufactured.
|-
When in PC Mode, Pins 1 and 2 are shorted. When in PS3 Mode, Pins 2 and 3 are shorted. When in DG Mode 3 and 4 are shorted.
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>

Latest revision as of 06:00, 17 April 2023

In case you wanted a simple guide howto run Cobra without a dongle, look here: http://www.ps3hax.net/showthread.php?t=67286

This article is marked for rewrite/restructuring in proper wiki format.
You can help PS3 Developer wiki by editing it.

Description[edit | edit source]

Dongle is DRM to make sure you have the dongle, the firmware 'special' functionality will not work without it.
Hardwarewise, there are many simularities with ReDRM / Piracy dongles like PSJB2/TrueBlue


The Ps3Cobra implements syscall 8 and moves syscall 0 into the payload. It does some heavy patching on Lv2 code

Lv2 Patches of Cobra Payload 1.2[edit | edit source]

offset psgroove cobra 1.2 cobra 2.0 comment
9134 7d 80 00 26 mfcr r12 N/A 48 4f 77 ec b 0x8000000000500920
17cbc e8 63 00 00 ld r3,0(r3) 3c 60 80 01 lis r3,-32767 3c 60 80 01 lis r3,-32767 remove syscall 6 (peek)
17cc0 60 00 00 00 nop 60 63 00 03 ori r3,r3,3 60 63 00 03 ori r3,r3,3 remove syscall 6 (peek)
17cc8 f8 83 00 00 std r4,0(r3) 3c 60 80 01 lis r3,-32767 3c 60 80 01 lis r3,-32767 remove syscall 7 (poke)
17ccc 60 00 00 00 nop 60 63 00 03 ori r3,r3,3 60 63 00 03 ori r3,r3,3 remove syscall 8 (poke)
490e0 2f 83 00 00 cmpwi cr7,r3,0 e8 82 0f 08 ld r4,3848(r2) e8 82 0f 08 ld r4,3848(r2)
490e4 7c 64 1b 78 mr r4,r3 e8 7c 00 20 ld r3,32(r28) e8 7c 00 20 ld r3,32(r28)
490e8 40 de 00 20 bne- cr7,0x8000000000049108 f8 64 00 00 std r3,0(r4) f8 64 00 00 std r3,0(r4)
4ed18 38 84 ff fa addi r4,r4,-6 38 80 00 00 li r4,0 38 80 00 00 li r4,0
4ed1c 7c 08 02 a6 mflr r0 90 83 00 00 stw r4,0(r3) 90 83 00 00 stw r4,0(r3)
4ed20 f8 21 ff 91 stdu r1,-112(r1) 4e 80 00 20 blr 4e 80 00 20 blr
4f0a8 bl sub_50B44 48 4b 11 a9 bl 0x8000000000500250 48 4b 11 a9 bl 0x8000000000500250
4fc2c beq cr7, loc_4FC4C 60 00 00 00 nop 60 00 00 00 nop
505D0 li %r3, 1 b sub_5008E0 48 4b 04 28 b 0x80000000005009f8
50B48 patched unpatched ?
572B8 extsw %r3, %r31 li %r3, 0
5741C bl sub_288568 nop
1C00EC stdu %sp, var_150(%sp) b sub_5003A8
1C26EC stdu %sp, var_D0(%sp) b sub_500448
1CF8A8 stdu %sp, var_B0(%sp) b sub_5004C8
25EC18 bl sub_12934 bl sub_500960
271AF0 stdu %sp, var_B0(%sp) b loc_500808 b loc_500818 (syscall864 / sys storage manager) Again, wrong here, loc_500808 is a bad jump.
this is 1.2!
273F80 stdu %sp, var_B0(%sp) b sub_500878 b sub_500990 (syscall867 / aim manager )you have a critical mistake, sub_500878 IS WRONG, :), if you jump here you crash your lv2
YOUR CRITICAL MISTAKE WAS ONLY PUT 1.2, NOW YOU FIX IT, THANKS
didn't meant to be rude, sry :)
29245C stdu %sp, var_100(%sp) b sub_5005A8
292598 ld %r11, stru_3403A0 b sub_5006D8
293A18 ld %r9, stru_3403A0 b sub_500540
296550 stdu %sp, var_D0(%sp) b sub_500640 (syscall606 sys_storage_async_read)
296928 stdu %sp, var_D0(%sp) b sub_500770 (syscall619 sys_storage_async_send_device_command)
29BD48 b sub_11850 b sub_500358
2AAFC8 b sub_50B48 b sub_5002F0
2AB3FC unpatched b sub_5002A0 (PS2 EMU?)
3ba890 0x01000000 patch table entry 1
offset cobra 1.2 cobra 2.0 comment
3ba890 0x10000000 0x10000000 patch table entry 1
490e0 ld r4, stru_33F628 patch table entry 2
490e4 ld r3, 0x20(r28) patch table entry 3
490e8 std r3, 0(r4) patch table entry 4
4ed18 li r4, 0 patch table entry 5
4ed1c stw r4, 0(r3) patch table entry 6
4ed20 blr patch table entry 7
572b8 li r3, 0 patch table entry 8
5741c nop patch table entry 9
4fc2c nop patch table entry a
50b3c li r3, 1 patch table entry b
50b40 blr patch table entry c

Cobra 1.2[edit | edit source]

 8000000000017cbc:     3c 60 80 01     lis     r3,-32767
 8000000000017cc0:     60 63 00 03     ori     r3,r3,3

 8000000000017cc8:     3c 60 80 01     lis     r3,-32767
 8000000000017ccc:     60 63 00 03     ori     r3,r3,3

 80000000000490e0:     e8 82 0f 08     ld      r4,3848(r2)
 80000000000490e4:     e8 7c 00 20     ld      r3,32(r28)
 80000000000490e8:     f8 64 00 00     std     r3,0(r4)

 800000000004ed18:     38 80 00 00     li      r4,0
 800000000004ed1c:     90 83 00 00     stw     r4,0(r3)
 800000000004ed20:     4e 80 00 20     blr

 800000000004f0a8:     48 4b 11 a9     bl      0x8000000000500250
 800000000004fc2c:     60 00 00 00     nop

 80000000000505d0:     48 4b 03 10     b       0x80000000005008e0
 8000000000050b3c:     38 60 00 01     li      r3,1
 8000000000050b40:     4e 80 00 20     blr

 80000000000572b8:     38 60 00 00     li      r3,0

 800000000005741c:     60 00 00 00     nop

 80000000001c00ec:     48 34 02 bc     b       0x80000000005003a8
 80000000001c26ec:     48 33 dd 5c     b       0x8000000000500448
 80000000001cf8a8:     48 33 0c 20     b       0x80000000005004c8
 800000000025ec18:     48 2a 1d 49     bl      0x8000000000500960
 8000000000271af0:     48 28 ed 18     b       0x8000000000500808
 8000000000273f80:     48 28 c8 f8     b       0x8000000000500878
 800000000029245c:     48 26 e1 4c     b       0x80000000005005a8
 8000000000292598:     48 26 e1 40     b       0x80000000005006d8
 8000000000293a18:     48 26 cb 28     b       0x8000000000500540
 8000000000296550:     48 26 a0 f0     b       0x8000000000500640
 8000000000296928:     48 26 9e 48     b       0x8000000000500770
 800000000029bd48:     48 26 46 10     b       0x8000000000500358
 80000000002aafc8:     48 25 53 28     b       0x80000000005002f0

Cobra 2.0[edit | edit source]

 8000000000009134:     48 4f 77 ec     b       0x8000000000500920

 8000000000017cbc:     3c 60 80 01     lis     r3,-32767
 8000000000017cc0:     60 63 00 03     ori     r3,r3,3

 8000000000017cc8:     3c 60 80 01     lis     r3,-32767
 8000000000017ccc:     60 63 00 03     ori     r3,r3,3

 80000000000490e0:     e8 82 0f 08     ld      r4,3848(r2)
 80000000000490e4:     e8 7c 00 20     ld      r3,32(r28)
 80000000000490e8:     f8 64 00 00     std     r3,0(r4)

 800000000004ed18:     38 80 00 00     li      r4,0
 800000000004ed1c:     90 83 00 00     stw     r4,0(r3)
 800000000004ed20:     4e 80 00 20     blr

 800000000004f0a8:     48 4b 11 a9     bl      0x8000000000500250

 800000000004fc2c:     60 00 00 00     nop

 80000000000505d0:     48 4b 04 28     b       0x80000000005009f8

 8000000000050b3c:     38 60 00 01     li      r3,1

 8000000000050b40:     4e 80 00 20     blr

 80000000000572b8:     38 60 00 00     li      r3,0

 800000000005741c:     60 00 00 00     nop

 80000000001c00ec:     48 34 02 cc     b       0x80000000005003b8
 80000000001c26ec:     48 33 dd 6c     b       0x8000000000500458
 80000000001cf8a8:     48 33 0c 30     b       0x80000000005004d8
 800000000025ec18:     48 2a 1e 61     bl      0x8000000000500a78
 8000000000271af0:     48 28 ed 28     b       0x8000000000500818
 8000000000273f80:     48 28 ca 10     b       0x8000000000500990
 800000000029245c:     48 26 e1 5c     b       0x80000000005005b8
 8000000000292598:     48 26 e1 50     b       0x80000000005006e8
 8000000000293a18:     48 26 cb 38     b       0x8000000000500550
 8000000000296550:     48 26 a1 00     b       0x8000000000500650
 8000000000296928:     48 26 9e 58     b       0x8000000000500780
 800000000029bd48:     48 26 46 20     b       0x8000000000500368
 80000000002aafc8:     48 25 53 38     b       0x8000000000500300

lv1 hvcalls[edit | edit source]

  • lv1_get_repository_node_value
  • lv1_allocate_device_dma_region
  • lv1_free_device_dma_region
  • lv1_map_device_dma_region
  • lv1_unmap_device_dma_region
  • lv1_storage_read
  • lv1_storage_check_async_status

Preliminary Examination of Cobra USB Manager v1.0[edit | edit source]

The following was acquired from a Debug/DEX unit on 3.55forDEX using the *Check debug option: 

System Version : 03.0000

---
Log
---
[Info]	Checking HDD Game.(HG,"/dev_hdd0/game/CBUM01234")
[Debug]	Checking System File /dev_hdd0/game/CBUM01234/PARAM.SFO.
[Info]	TITLE_ID = CBUM01234.
[Info]	PARENTAL_LEVEL = 0/--/--/--/--/--/--.
[Info]	ATTRIBUTE = 0x0.
[Info]	RESOLUTION = 0x3F, 1080/720/576/576(16:9)/480/480(16:9).
[Info]	SOUND_FORMAT = 0x117, 7.1LPCM/5.1LPCM/2LPCM/5.1Dolby.
[Info]	VERSION = 01.00.
[Info]	PS3_SYSTEM_VER = 03.0000.
[Info]	APP_VER = 01.00.
[Debug]	TITLE_ID = CBUM01234.
[Warn]	PARAM.SFO: Param PARENTAL_LEVEL: Currently being rated.
[Debug]	PARENTAL_LEVEL = 0/--/--/--/--/--/--.
[Debug]	ATTRIBUTE = 0x0.
[Error]	PARAM.SFO: Param LICENSE: Unexpected val_size.
[Error]	PARAM.SFO: Param LICENSE: Unexpected value.
[Debug]	RESOLUTION = 0x3F, 1080/720/576/576(16:9)/480/480(16:9).
[Debug]	SOUND_FORMAT = 0x117, 7.1LPCM/5.1LPCM/2LPCM/5.1Dolby.
[Debug]	VERSION = 01.00.
[Debug]	PS3_SYSTEM_VER = 03.0000.
[Debug]	APP_VER = 01.00.
[Debug]	PS3LOGO.DAT: Logo.
[Debug]	ICON0.PNG: 320x176/24bit.
[Info]	EBOOT.BIN: PPU SELF file, SDK version = 03.0000.
[Debug]	EBOOT.BIN: 300.001 (PPU) : crt0
[Debug]	EBOOT.BIN: 300.001 (PPU) : crt1
[Debug]	EBOOT.BIN: 192.001 (PPU) : libftp
[Error]	EBOOT.BIN: Debug library linked (libftp).
[Error]	EBOOT.BIN: Version conflict error (libftp, 192.001).
[Debug]	EBOOT.BIN: 300.001 (PPU) : libnet_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libnetctl_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libpngdec_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libdbgfont_gcm
[Error]	EBOOT.BIN: Debug library linked (libdbgfont_gcm).
[Debug]	EBOOT.BIN: 300.001 (PPU) : libgcm_cmd
[Debug]	EBOOT.BIN: 300.001 (PPU) : libgcm_sys_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libio_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libsysmodule_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libsysutil_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libfs_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libl10n_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libfontGcm
[Debug]	EBOOT.BIN: 300.001 (PPU) : libfontFT_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libfont_stub
[Debug]	EBOOT.BIN: 300.001 (PPU) : libstdc++
[Debug]	EBOOT.BIN: 300.001 (PPU) : libc
[Debug]	EBOOT.BIN: 300.001 (PPU) : liblv2_stub



Mountpoints[edit | edit source]

Intern (PS3):

  • /dev_hdd0/GAMES
  • /dev_hdd0/BDRIPS
  • /dev_hdd0/GAMEZ
  • /dev_hdd0/PS3ISO <- Only for Backups in ISO Format.

Extern (PS3):

  • /dev_usb/GAMES
  • /dev_usb/GAMEZ
  • /dev_usb/PS3ISO <- <- Only for Backups in ISO Format.

Intern (PS2):

  • /dev_hdd0/PS2ISO

Extern (PS2):

  • /dev_usb/PS2ISO <- <- Only for Backups, not for loading.

Intern (PS1):

  • /dev_hdd0/PSXISO

Extern (PS1):

  • /dev_usb/PSXISO

Intern (PSP):

  • /dev_hdd0/PSPISO

Extern (PSP):

  • /dev_usb/PSPISO

Intern (BluRay):

  • /dev_hdd0/BDISO

Extern (BluRay):

  • /dev_usb/BDISO

Intern (DVD):

  • /dev_hdd0/DVDISO

Extern (DVD):

  • /dev_usb/DVDISO

Hardware Dongle[edit | edit source]

Dongle 1.0[edit | edit source]

PS3Cobra - TOP
PS3Cobra - BACK
  • Cobra USB - SWITCH

    Cobra USB - SWITCH

  • Cobra USB - OPEN 1

    Cobra USB - OPEN 1

  • Cobra USB - OPEN 2

    Cobra USB - OPEN 2

  • Cobra USB - TOP 1

    Cobra USB - TOP 1

  • Cobra USB - TOP 2

    Cobra USB - TOP 2

  • Cobra USB - BACK

    Cobra USB - BACK

Components[edit | edit source]

Actel ProASIC3 A3P060 - FPGA[edit | edit source]

U2 

  A3P060 = 60,000 System Gates
  blank = Speed Grade: Standard
  VQ = Package Type: Very Thin Quad Flat Pack (0.5mm pitch)
  G = Lead-Free Packaging: RoHS-Compliant (Green)
  100 = Package Lead Count : 100 pins
  blank = Security Feature : no IP license
  blank = Temperature Range: Commercial (0°C to +70°C Ambient Temperature)

128-bit AES
1,024 bits of user flash memory
Datasheets and usermanuals: http://www.actel.com/products/pa3/docs.aspx#ds
Familyroot: http://www.actel.com/products/pa3/
Usage Guide: http://www.embedtools.com/pro_kaifa/SOPC_%20EDA/ProASIC3/PA3_E_IO_AN.pdf

Pinout A3P060 VQ100[edit | edit source]
Actel ProASIC3 A3P060 - FPGA (Cobra) VQ100 package
Pin Function Notes
1 GND Ground
2 GAA2/IO118UDB3
3 IO118VDB3
4 GAB2/IO117UDB3
5 IO117VDB3
6 GAC2/IO116UDB3
7 IO116VDB3
8 IO112PSB3
9 GND Ground
10 GFB1/IO109PDB3
11 GFB0/IO109NDB3
12 VCOMPLF
13 GFA0/IO108NPB3
14 VCCPLF
15 GFA1/IO108PPB3
16 GFA2/IO107PSB3
17 VCC
18 VCCIB3
19 GFC2/IO105PSB3
20 GEC1/IO100PDB3
21 GEC0/IO100NDB3
22 GEA1/IO98PDB3
23 GEA0/IO98NDB3
24 VMV3
25 GNDQ Ground
26 GEA2/IO97RSB2
27 GEB2/IO96RSB2
28 GEC2/IO95RSB2
29 IO93RSB2
30 IO92RSB2
31 IO91RSB2
32 IO90RSB2
33 IO88RSB2
34 IO86RSB2
35 IO85RSB2
36 IO84RSB2
37 VCC
38 GND Ground
39 VCCIB2
40 IO77RSB2
41 IO74RSB2
42 IO71RSB2
43 GDC2/IO63RSB2
44 GDB2/IO62RSB2
45 GDA2/IO61RSB2
46 GNDQ Ground
47 TCK
48 TDI
49 TMS
50 VMV2
51 GND Ground
52 VPUMP
53 NC
54 TDO
55 TRST
56 VJTAG
57 GDA1/IO60USB1
58 GDC0/IO58VDB1
59 GDC1/IO58UDB1
60 IO52NDB1
61 GCB2/IO52PDB1
62 GCA1/IO50PDB1
63 GCA0/IO50NDB1
64 GCC0/IO48NDB1
65 GCC1/IO48PDB1
66 VCCIB1
67 GND Ground
68 VCC
69 IO43NDB1
70 GBC2/IO43PDB1
71 GBB2/IO42PSB1
72 IO41NDB1
73 GBA2/IO41PDB1
74 VMV1
75 GNDQ Ground
76 GBA1/IO40RSB0
77 GBA0/IO39RSB0
78 GBB1/IO38RSB0
79 GBB0/IO37RSB0
80 GBC1/IO36RSB0
81 GBC0/IO35RSB0
82 IO29RSB0
83 IO27RSB0
84 IO25RSB0
85 IO23RSB0
86 IO21RSB0
87 VCCIB0
88 GND Ground
89 VCC
90 IO15RSB0
91 IO13RSB0
92 IO11RSB0
93 GAC1/IO05RSB0
94 GAC0/IO04RSB0
95 GAB1/IO03RSB0
96 GAB0/IO02RSB0
97 GAA1/IO01RSB0
98 GAA0/IO00RSB0
99 GNDQ Ground
100 VMV0

24.000 MHz Crystal[edit | edit source]

Y1
CLK for Actel

12.000 MHz Crystal[edit | edit source]

Y2
SCK/CLK for Atmel/Winbond

AMS1117 3.3 1032 - Low Dropout Linear Regulator[edit | edit source]

U3
Datasheet:

  • AMS1117 - SOT-223.png

A 47 (F51C 5pin Multilayer Ceramic Capacitor : U4)[edit | edit source]

F51C 5pin Multilayer Ceramic Capacitor

Capacitance value untested, likely one of these (from Mouser)

Atmel ATmega 16A (16MHz AVR - 16KB flash - USB stack + DFU)[edit | edit source]

U5
ISP via pin 1 (MOSI), 2 (MISO), 3 (SCK), 4 (Reset)
datasheet: Atmel-ATMega16A.pdf (6.93 MB)

Atmel ATMega16A
QFN44 pinout
Pin Function Notes
1 (MOSI) PB5 Tied to DI (Pin 5) on the Winbond Flash
2 (MISO) PB6 Tied to DO (Pin 2) on the Winbond Flash
3 (SCK) PB7 Provides CLK to The Winbond Flash
4 RESET
5 VCC
6 GND
7 XTAL2 Y2
8 XTAL1 Y2
9 (RXD) PD0 Actel IO92RSB2 (pin 30)
10 (TXD) PD1 Actel IO92RSB2 (pin 29)
11 (INT0) PD2
12 (INT1) PD3
13 (OC1B) PD4
14 (OC1A) PD5
15 (ICP1) PD6
16 (OC2) PD7
17 VCC
18 GND
19 (SCL) PC0
20 (SDA) PC1
21 (TCK) PC2
22 (TMS) PC3
23 (TDO) PC4
24 (TDI) PC5 Tied to 3v3 Voltage regulator VCC
25 (TOSC1) PC6
26 (TOSC2) PC7
27 AVCC Tied to 3v3 Voltage regulator VCC
28 GND
29 AREF
30 (ADC7) PA7
31 (ADC6) PA6
32 (ADC5) PA5
33 (ADC4) PA4
34 (ADC3) PA3
35 (ADC2) PA2
36 (ADC1) PA1
37 (ADC0) PA0
38 VCC Tied to 3v3 Voltage regulator VCC
39 GND
40 (XCK/T0) PB0
41 (T1) PB1
42 (AIN0/INT2) PB2
43 (AIN1/OC0) PB3
44 (SS) PB4

Winbond 25X16AVSIG (SPI Flash 16Mbit)[edit | edit source]

The IC designation on the board of the cobra dongle is U1.

8-pin TSSOP
Winbond 25X16A
SOIC-8 pinout

W - Winbond
25X - SPI Flash with 4KB sectors/64Kbyte blocks, dual output
16A - 16Mbit / 2M-byte
V - Supply Voltage 2.7 to 3.6V
S - Package Type : 8pin SOIC 150-mil
I - Temperature Range: Industrial (-40'C ~ 85'C)
G - Environment: Green Package (Lead-free, RoHS Compliant, Halogen-free (TBBA), Antimony-Oxie-free)

datasheet: W25X16A.pdf (1.3 MB) / https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Datasheets/W25X16A.pdf
Note: can use Bus Ninja or Bus Pirate and FlashROM - ISP is possible, so long as no other devices on the SPI bus are trying to access the device (in that case, you might want to cut Vcc to the FPGA or the regulator for it).

Pin Usage I/O Remarks
1 /CS I Chip Select (high=deselect, low=select)
2 DO O Data output
3 /WP I Write Protect (active low)
4 GND Ground
5 DIO I/O Serial data input/output
6 CLK I Serial Clock
7 /HOLD I Hold (high=normal/resume, low=hold/pause)
8 VCC Vcc (min 2.7-max 3.6V @ Fr0 75MHz / min 3.0-max 3.6V @ Fastread Fr1 100MHz)

On the Cobra Dongle, pin 3 of the EEPROM is tied to VCC. Lifting this Pin from the board and tieing it to ground should prevent the flash from being erased.

Roles[edit | edit source]

Drives data to and from the Winbond flash chip.

Cobra Test Points[edit | edit source]

Cobra - Testpoints to Winbond SPI flash


There are test points that map out the Winbond flash shown in the diagram to the right.

DG/PS3/PC Selection switch[edit | edit source]

There is a switch that switched between Downgrade, PC and PS3 modes of the dongle.

When facing the switch, with the USB Plug to the left the pins are labeled 1 to 4 in the table below:

When in PC Mode, Pins 1 and 2 are shorted. When in PS3 Mode, Pins 2 and 3 are shorted. When in DG Mode 3 and 4 are shorted.
Pin Usage Connects to Remarks
1 PC Position GND A resistor is placed, by hand, between this pin and GND after the board is manufactured.
2 PC/PS3 Position AVCC (atmega 27) + Winbond /WP (PIN 3) Ties to Pin 27 of atmega16 (AVCC) and /WP of Winbond Flash
3 PS3/DG Position TOSC2 of the Atmega (Pin 26) ???
4 DG Position GND A resistor is placed, by hand, between this pin and GND after the board is manufactured.
General
Hypervisor
Services
Plugin
Interfaces
ap_plugin · audioplayer_plugin · audiop_plugin_dummy · audiop_plugin_mini · auth_plugin · autodownload_plugin · autoupdateconf_plugin · avc_plugin · avc_util · avc2_game_plugin · avc2_game_video_plugin · avc2_text_plugin · bdp_disccheck_plugin · bdp_plugin · bdp_storage_plugin · campaign_plugin · category_setting_plugin · comboplay_plugin · custom_render_plugin · data_copy_plugin · deviceconf_plugin · dlna_plugin · download_plugin · dtcpip_util · edy_plugin · esehttp · eseibrd · eseidle · eselock · eula_cddb_plugin · eula_hcopy_plugin · eula_net_plugin · explore_plugin · explore_plugin_ft · explore_plugin_game · explore_plugin_np · filecopy_plugin · friendim_plugin · friendml_plugin · friendtrophy_plugin · game_ext_plugin · game_indicator_plugin · game_plugin · gamedata_plugin · gamelib_plugin · gameupdate_plugin · hknw_plugin · idle_plugin · impose_plugin · kensaku_plugin · msgdialog_plugin · mtpinitiator_plugin · musicbrowser_plugin · nas_plugin · netconf_plugin · newstore_plugin · np_eula_plugin · np_matching_plugin · np_multisignin_plugin · np_sns_plugin · npsignin_plugin · np_trophy_ingame · np_trophy_plugin · osk · oskfullkeypanel · oskpanel · pesm_plugin · photo_network_sharing_plugin · photolist_plugin · photoviewer_plugin · playlist_plugin · poweroff_plugin · premo_plugin · premo_game_plugin · print_plugin · profile_plugin · ps3_savedata_plugin · ps3_savedata_plugin_game · ps3_savedata_plugin_psp · rec_plugin · regcam_plugin · remotedownload_plugin · sacd_plugin · scenefolder_plugin · screenshot_plugin · software_update_plugin · soundvisualizer_plugin · strviewer_plugin · sysconf_plugin · system_plugin · thumthum_plugin · upload_util · user_info_plugin · user_plugin · videodownloader_plugin · videoeditor_plugin · videoplayer_util · videoplayer_plugin · vmc_savedata_plugin · wboard_plugin · webbrowser_plugin · webbrowser_service · webrender_plugin · xai_plugin · xmb_ingame · xmb_plugin
Emulation
Extended
features
Online
Hardware
SC
CELL
RAM
SB
HDD
BD
Tools
Strings
files
dumps
Reference
Keys & Seeds
Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=PS3Cobra_Payload_Reverse_Engineering&oldid=70797"