Talk:Harddrive: Difference between revisions
(→Experimental Tables: new table reordered by hdd model with data from datasheets/productsheets... the idea is to move the "speed tests" in front page to other table/s (PC - PS3otheros - PS3gameos)) |
No edit summary |
||
(155 intermediate revisions by 12 users not shown) | |||
Line 9: | Line 9: | ||
note: this seems untrue as there are several people posting pictures of their external to internal drive mod with a size of 2TB</pre> | note: this seems untrue as there are several people posting pictures of their external to internal drive mod with a size of 2TB</pre> | ||
===== Using Normal Mode and Recovery - when trying to install a 1.5TB 3.5" drive as internal (using an eSATA cradle) ===== | ===== Using Normal Mode and Recovery - when trying to install a 1.5TB 3.5" drive as internal (using an eSATA cradle) ===== | ||
* Using Recovery it is possible to finish the format of the harddrive until 100%. The system however fails to reboot automaticly after that and halts. When enforced to reboot, it errors out with "Wrong Harddrive". | * Using Recovery it is possible to finish the format of the harddrive until 100%. The system however fails to reboot automaticly after that and halts. When enforced to reboot, it errors out with "Wrong Harddrive". | ||
Line 15: | Line 15: | ||
* When trying to boot to XMB it also errors out with "Harddrive Error 0x8002F281". | * When trying to boot to XMB it also errors out with "Harddrive Error 0x8002F281". | ||
* When replacing the drive for the previous tested 1TB harddrive, it boots without errors to XMB and reports : 827GB free/931GB total | * When replacing the drive for the previous tested 1TB harddrive, it boots without errors to XMB and reports : 827GB free/931GB total | ||
;Conclusion: <span style="color:red | ;Conclusion: <span style="color:red!important;">>1TB didn't work.</span> | ||
===== Using Factory Service Mode - when trying to install a 1.5TB 3.5" drive as internal (using an eSATA cradle) FSM ===== | ===== Using Factory Service Mode - when trying to install a 1.5TB 3.5" drive as internal (using an eSATA cradle) FSM ===== | ||
Line 35: | Line 35: | ||
** Preparing Update counts to 100% and then halts (does not reboot), just like in first trial. | ** Preparing Update counts to 100% and then halts (does not reboot), just like in first trial. | ||
* Manual poweroff and reboot just results in blank screen with no harddrive activity | * Manual poweroff and reboot just results in blank screen with no harddrive activity | ||
;Conclusion: <span style="color:red | ;Conclusion: <span style="color:red!important;">>1TB didn't work in normal or recovery mode only with FSM enabled.</span> | ||
===== Going back to the 1TB and crosschecking ===== | ===== Going back to the 1TB and crosschecking ===== | ||
* Replacing drive back to the working 1TB (has 3.55 on it) gives prompt to reinstall 2.70, doing so errors out with "Harddrive Error 0x8002F281". | * Replacing drive back to the working 1TB (has 3.55 on it) gives prompt to reinstall 2.70, doing so errors out with "Harddrive Error 0x8002F281". | ||
Line 51: | Line 51: | ||
MAX Address xx:xx:xx:xx:xx:xx | MAX Address xx:xx:xx:xx:xx:xx | ||
Free Space 827GB / 931GB | Free Space 827GB / 931GB | ||
;Conclusion: <span style="color:green | ;Conclusion: <span style="color:green;"><=1TB works fine in all modi.</span> | ||
=== maximum size external drive === | === maximum size external drive === | ||
Maximum size is 2TB. | |||
PS3 can only read drives using MBR (Master Boot Record) partition table. | |||
MBR maximum drive size is 2TB (with up to 4 partitions). | |||
PS3 cannot read drives using GPT (GUID Partition Table). | |||
GPT has maximum drive size around 256TB, although in practice it may get tricky beyond 15 TB. | |||
<pre>External HDD : You can format it to any size up to 8TB | <pre>External HDD : You can format it to any size up to 8TB | ||
Line 61: | Line 70: | ||
* todo: flush out errors, merging in a readable format | * todo: flush out errors, merging in a readable format | ||
Footnote: maximum supported drive space correlates to support of 512sector (either native, or emulated), see: http://en.wikipedia.org/wiki/Advanced_Format | |||
---- | ---- | ||
== Tests increasing the max HDD capacity supported by the firmware == | |||
Successful 2Tb installation confirmed personally. (warning: "restore filesystem" a.k.a. "filesystem check" was not tested. Without this function the hdd will cummulate filesystem errors up to a point where the PS3 will welcome you with a warning message telling "the hdd needs to be formatted" and you will lose all the contents of it) | |||
*HDD was Toshiba MQ01ABB200 and PS3 was CECHK04 | |||
*Flashing to 4.46 OFW and reducing 2Tb hard drive to 3633537126 sectors via "hiding" rest via HPA on PC (formatted first to FAT format on MAC a whole device and GPT instead MBR) with HDAT2 so PS3 sees its as 1732.6GB Hard Drive and did succeed formatting. | |||
*After 4.46 you can upgrade to latest 4.82 Firmware back and continue using it. 4.82 firmware says after HPA sector hiding that it is "unsupported" but 4.46 doesn't and can format it. | |||
Pictures of some of this of my personal confession and proof: | |||
[https://twitter.com/XantheFIN/status/1022873742538682368] | |||
Original info i used to confirm: | |||
[http://www.psx-place.com/threads/ps3-1-75-tb-internal-hdd-upgrade-formatting-utility.11989/#post-100471] | |||
Note from another tester : | |||
While the above seems to work, using 4.46 to allow 1.75tb leads to errors after saving a few games : the console stalls, then takes forever to recover (if it recovers). I tried reducing to 1.5Tb, and none of the errors show up. | |||
What's misleading is that 1.5Tb is in fact recognized by 4.82+, even with HPA. | |||
I think the safe way to get the max capacity is to use HPA, but stick to something between 1.5Tb and 1.75Tb and make sure it's recognized by 4.82+. It means downgrading to 4.46 is not necessary (and mostly misleading). | |||
== AES-256-CBC versus AES-256-XTS == | == AES-256-CBC versus AES-256-XTS == | ||
There is conflicting mention of sources for the algo/mode used for GameOS encryption. | There is conflicting mention of sources for the algo/mode used for GameOS encryption. | ||
Line 78: | Line 103: | ||
*[http://en.wikipedia.org/wiki/Cipher-block_chaining CBC - Cipher-block_chaining mode] | *[http://en.wikipedia.org/wiki/Cipher-block_chaining CBC - Cipher-block_chaining mode] | ||
*[http://en.wikipedia.org/wiki/Disk_encryption_theory#XTS XTS - XEX-based Tweaked CodeBook mode] | *[http://en.wikipedia.org/wiki/Disk_encryption_theory#XTS XTS - XEX-based Tweaked CodeBook mode] | ||
== PS3 HDD reader for windows by 3141card == | |||
May 2018, added PS3 FAT NOR support: http://www.psx-place.com/threads/restoring-my-corrupted-hdd.17932/page-2#post-125398 | |||
Fat(NAND), 1. layer(ata) -> aes-cbc-192, ata_key1 IV = 0 | |||
2. layer(vflash) no vflash | |||
Fat(NOR), 1. layer(ata) -> aes-cbc-192, ata_key1 IV = 0 | |||
2. layer(vflash) -> aes-xts-128, encdec_key1 and encdec_key2, tweak = physical sector number on hdd | |||
Slim(NOR), 1. layer(ata) -> aes-xts-128, ata_key1 and ata_key2 | |||
2. layer(vflash) -> aes-xts-128, encdec_key1 and encdec_key2, tweak = physical sector number on hdd | |||
==Experimental Tables== | |||
===HDD partitions=== | |||
{| class="wikitable" style="font-size:xx-small;" | |||
|+PS3 Hard Disk Drive, partitions and storage regions | |||
! colspan=6 | Storage Region !! colspan=3 | Access Control List !! colspan=4 | File System !! colspan=5 | Size !! colspan=2 | Usage | |||
|- | |||
! rowspan=3 colspan=5 | OtherOS !! rowspan=3 | GameOS !! colspan=2 | [[Secure Profile Loader | Secure Profile]] !! rowspan=3 | Unk !! colspan=3 | Encryption !! rowspan=3 | Type !! colspan=4 | Official !! rowspan=3 | Unnofficial<BR /><BR /><BR /><BR /> !! rowspan=3 | Official<BR /><BR /><BR /><BR /> !! rowspan=3 | Unnofficial<BR /><BR /><BR /><BR /> | |||
|- | |||
! rowspan=2 | Name !! rowspan=2 | [[Authority ID|auth_id]] || colspan=2 | FAT !! SLIM !! colspan=2 | Decimal || colspan=2 | Hexadecimal | |||
|- | |||
! NAND !! NOR !! NOR !! Bytes !! Sectors !! Bytes !! Sectors | |||
|- | |||
! rowspan=21 | ps3d<BR />(3) | |||
|- {{cellcolors|#9999ff}} | |||
| rowspan=20 | ps3da<BR />(3.0) || colspan=4 | || colspan=3 | || colspan=4 | || style="text-align:right;" | <abbr title="4.096 bytes">4 KB</abbr> || style="text-align:right;" | 8 || style="text-align:right;" | 0x1000 || style="text-align:right;" | 0x8 || Same || colspan=2 | [[Resizing_VFLASH_Storage_Device#Example_Of_An_Unmodified_HDD_Partition_Table | HDD Partition Table]] (Physical HDD Device) | |||
|- | |||
| rowspan=12 {{cellcolors|#ddddff}} ps3vflash<BR />(3.1) || colspan=2 {{cellcolors|#ddddff}} || {{cellcolors|#ddddff}} ? || SCE_CELLOS_PME<BR />PS3_LPAR || 1070000001000001<BR />1070000002000001 || 0B<BR />03 || ↑:No<BR />↓:No || ↑:AES-CBC-192 (ata_key1, IV=0)<BR />↓:AES-XTS-128 (encdec_key1, encdec_key2) || ↑:AES-XTS-128 (ata_key1, ata_key2)<BR />↓:AES-XTS-128 (encdec_key1, encdec_key2) || Raw access || style="text-align:right;" | <abbr title="268.435.456 bytes">256 MB</abbr> || style="text-align:right;" | 524.288 || style="text-align:right;" | 0x10000000 || style="text-align:right;" | 0x80000 || Any || colspan=2 | First region of HDD, contains VFLASH. (only NOR) | |||
|- {{cellcolors|#9999ff}} | |||
| rowspan=11 | ps3vflasha<BR />(3.1(1.0)) || colspan=2 | || colspan=3 | || colspan=4 | || style="text-align:right;" | <abbr title="4.096 bytes">4 KB</abbr> || style="text-align:right;" | 8 || style="text-align:right;" | 0x1000 || style="text-align:right;" | 0x8 || Same || colspan=2 | [[Dev_Tools#flash_dumper | VFLASH Partition Table]] (Virtual FLASH Device, only NOR) | |||
|- | |||
| {{cellcolors|#ddddff}} ps3vflashb<BR />(3.1(1.1)) || {{cellcolors|#ddddff}} ? || SCE_CELLOS_PME || 1070000001000001 || 03 || ↑:No<BR />↓:No || ↑:AES-CBC-192 (ata_key1, IV=0)<BR />↓:AES-XTS-128 (encdec_key1, encdec_key2) || ↑:AES-XTS-128 (ata_key1, ata_key2)<BR />↓:AES-XTS-128 (encdec_key1, encdec_key2) || Raw access ? || style="text-align:right;" | <abbr title="15.462.400 bytes">14,75 MB</abbr> || style="text-align:right;" | 30.200 || style="text-align:right;" | 0xEBF000 || style="text-align:right;" | 0x75F8 || Same || colspan=2 | "mirror" of real NOR second region: "ps3nflashb" ? | |||
|- {{cellcolors|lightgrey}} | |||
| colspan=2 | || colspan=3 | || colspan=4 | || style="text-align:right;" | <abbr title="262.144 bytes">256 KB</abbr> || style="text-align:right;" | 512 || style="text-align:right;" | 0x40000 || style="text-align:right;" | 0x200 || Same || colspan=2 | ? | |||
|- | |||
| {{cellcolors|#ddddff}} ps3vflashc<BR />(3.1(1.2)) || {{cellcolors|#ddddff}} CELL_FS_IOS:BUILTIN_FLSH1<BR />dev_flash || PS3_LPAR<BR />SCE_CELLOS_PME<BR />PS2_*LPAR || 1070000002000001<BR />1070000001000001<BR />1020000003000001 || 03<BR />03<BR />01 || ↑:No<BR />↓:No || ↑:AES-CBC-192 (ata_key1, IV=0)<BR />↓:AES-XTS-128 (encdec_key1, encdec_key2) || ↑:AES-XTS-128 (ata_key1, ata_key2)<BR />↓:AES-XTS-128 (encdec_key1, encdec_key2) || FAT16 || style="text-align:right;" | <abbr title="209.453.056 bytes">199,75 MB</abbr> || style="text-align:right;" | 409.088 || style="text-align:right;" | 0xC7C0000 || style="text-align:right;" | 0x63E00 || Same || colspan=2 | Firmware files | |||
|- | |||
| {{cellcolors|#ddddff}} ps3vflashd<BR />(3.1(1.3)) || {{cellcolors|#ddddff}} CELL_FS_IOS:BUILTIN_FLSH2<BR />dev_flash2 || PS3_LPAR<BR />SCE_CELLOS_PME || 1070000002000001<BR />1070000001000001 || 03<BR />03 || ↑:No<BR />↓:No || ↑:AES-CBC-192 (ata_key1, IV=0)<BR />↓:AES-XTS-128 (encdec_key1, encdec_key2) || ↑:AES-XTS-128 (ata_key1, ata_key2)<BR />↓:AES-XTS-128 (encdec_key1, encdec_key2) || FAT16 || style="text-align:right;" | <abbr title="16.777.216 bytes">16 MB</abbr> || style="text-align:right;" | 32.768 || style="text-align:right;" | 0x1000000 || style="text-align:right;" | 0x8000 || Same || colspan=2 | XRegistry (Console/User settings) | |||
|- | |||
| {{cellcolors|#ddddff}} ps3vflashe<BR />(3.1(1.4)) || {{cellcolors|#ddddff}} CELL_FS_IOS:BUILTIN_FLSH3<BR />dev_flash3 || PS3_LPAR<BR />SCE_CELLOS_PME || 1070000002000001<BR />1070000001000001 || 03<BR />03 || ↑:No<BR />↓:No || ↑:AES-CBC-192 (ata_key1, IV=0)<BR />↓:AES-XTS-128 (encdec_key1, encdec_key2) || ↑:AES-XTS-128 (ata_key1, ata_key2)<BR />↓:AES-XTS-128 (encdec_key1, encdec_key2) || FAT12 || style="text-align:right;" | <abbr title="524.288 bytes">512 KB</abbr> || style="text-align:right;" | 1.024 || style="text-align:right;" | 0x80000 || style="text-align:right;" | 0x400 || Same || colspan=2 | CRL/DRL (Bluray revocation lists) | |||
|- | |||
| {{cellcolors|#ddddff}} ps3vflashf<BR />(3.1(1.5)) || {{cellcolors|#ddddff}} CELL_FS_IOS:BUILTIN_FLSH4<BR />dev_flash4 ? || PS3_LPAR<BR />SCE_CELLOS_PME<BR />LINUX_LPAR ||1070000002000001<BR />1070000001000001<BR />1080000004000001 || 03<BR />03<BR />03 || ↑:No<BR />↓:No || ↑:AES-CBC-192 (ata_key1, IV=0)<BR />↓:AES-XTS-128 (encdec_key1, encdec_key2) || ↑:AES-XTS-128 (ata_key1, ata_key2)<BR />↓:AES-XTS-128 (encdec_key1, encdec_key2) || Raw access || style="text-align:right;" | <abbr title="4.194.304 bytes">4 MB</abbr> || style="text-align:right;" | 8.192 || style="text-align:right;" | 0x400000 || style="text-align:right;" | 0x2000 || Any || cell_ext_os_area +<BR />OtherOS bootloader<BR /><small>(compressed: otheros.bld)</small> || cell_ext_os_area +<BR />OtherOS++ bootloader<BR /><small>(uncompressed: dtbImage.ps3.bin)</small> | |||
|- {{cellcolors|lightgrey}} | |||
| colspan=2 | || colspan=3 | || colspan=4 | || style="text-align:right;" | <abbr title="4.456.448 bytes">4,25 MB</abbr> || style="text-align:right;" | 8.704 || style="text-align:right;" | 0x440000 || style="text-align:right;" | 0x2200 || Same || colspan=2 | ? | |||
|- | |||
| {{cellcolors|#ddddff}} ps3vflashg<BR />(3.1(1.6)) || {{cellcolors|#ddddff}} ? || SCE_CELLOS_PME || 1070000001000001 || 03 || ↑:No<BR />↓:No || ↑:AES-CBC-192 (ata_key1, IV=0)<BR />↓:AES-XTS-128 (encdec_key1, encdec_key2) || ↑:AES-XTS-128 (ata_key1, ata_key2)<BR />↓:AES-XTS-128 (encdec_key1, encdec_key2) || Raw access ? || style="text-align:right;" | <abbr title="262.144 bytes">256 KB</abbr> || style="text-align:right;" | 512 || style="text-align:right;" | 0x40000 || style="text-align:right;" | 0x200 || Same || colspan=2 | ? | |||
|- {{cellcolors|lightgrey}} | |||
| colspan=2 | || colspan=3 | || colspan=4 | || rowspan=2 style="text-align:right;" | <abbr title="17.039.360 bytes">16,25 MB</abbr> || style="text-align:right;" rowspan=2 | 33.280 || style="text-align:right;" rowspan=2 | 0x1040000 || style="text-align:right;" rowspan=2 | 0x8200 || No ? || colspan=2 | Padding | |||
|- | |||
| {{cellcolors|#ddddff}} ps3vflashh<BR />(3.1(1.7)) || {{cellcolors|#ddddff}} ? || No || No || No || ↑:No<BR />↓:No || ↑:AES-CBC-192 (ata_key1, IV=0)<BR />↓:AES-XTS-128 (encdec_key1, encdec_key2) || ↑:AES-XTS-128 (ata_key1, ata_key2)<BR />↓:AES-XTS-128 (encdec_key1, encdec_key2) || <small>All supported<BR />by linux</small> || Any || Not used || <small>Linux/FreeBSD for NOR PS3's<BR />Based on graf drivers (deprecated)</small> | |||
|- {{cellcolors|lightgrey}} | |||
| colspan=4 | || colspan=3 | || colspan=4 | || style="text-align:right;" | <abbr title="8.192 bytes">8 KB</abbr> || style="text-align:right;" | 16 || style="text-align:right;" | 0x2000 || style="text-align:right;" | 0x10 || Same ? || colspan=2 | Padding ? | |||
|- | |||
| colspan=3 {{cellcolors|#ddddff}} ps3db<BR />(3.2) || {{cellcolors|#ddddff}} CELL_FS_UTILITY:HDD0<BR />dev_hdd0 || SCE_CELLOS_PME<BR />PS3_LPAR<BR />PS2_*LPAR || 1070000001000001<BR />1070000002000001<BR />1020000003000001 || 03<BR />03<BR />03 || colspan=2 | AES-CBC-192 (ata_key1, IV=0) || AES-XTS-128 (ata_key1, ata_key2) || UFS2 || colspan=5 style="text-align:center;" | Any || colspan=2 | GameOS | |||
|- {{cellcolors|lightgrey}} | |||
| colspan=4 | || colspan=3 | || colspan=4 | || style="text-align:right;" | <abbr title="4.096 bytes">4 KB</abbr> || style="text-align:right;" | 8 || style="text-align:right;" | 0x1000 || style="text-align:right;" | 0x8 || Same ? || colspan=2 | Padding | |||
|- | |||
| colspan=3 {{cellcolors|#ddddff}} ps3dc<BR />(3.3) || {{cellcolors|#ddddff}} CELL_FS_UTILITY:HDD1<BR />dev_hdd1 || SCE_CELLOS_PME<BR />PS3_LPAR || 1070000001000001<BR />1070000002000001 || 03<BR />03 || colspan=2 | AES-CBC-192 (ata_key1, IV=0) || AES-XTS-128 (ata_key1, ata_key2) || FAT16 || style="text-align:right;" | <abbr title="2.147.479.552 bytes">2 GB</abbr> || style="text-align:right;" | 4.194.296 || style="text-align:right;" | 0x7FFFF000 || style="text-align:right;" | 0x3FFFF8 || Same || colspan=2 | GameOS Cache | |||
|- {{cellcolors|lightgrey}} | |||
| colspan=4 | || colspan=3 | || colspan=4 | || style="text-align:right;" | <abbr title="4.096 bytes">4 KB</abbr> || style="text-align:right;" | 8 || style="text-align:right;" | 0x1000 || style="text-align:right;" | 0x8 || Same ? || colspan=2 | Padding | |||
|- | |||
| colspan=3 {{cellcolors|#ddddff}} ps3dd<BR />(3.4) || {{cellcolors|#ddddff}} CELL_FS_UTILITY:HDD2<BR />dev_hdd2 ? || PS3_LPAR<BR />SCE_CELLOS_PME<BR />LINUX_LPAR || 1070000002000001<BR />1070000001000001<BR />1080000004000001 || 03<BR />03<BR />03 || colspan=2 | AES-CBC-192 (ata_key1, IV=0) || AES-XTS-128 (ata_key1, ata_key2) || <small>All supported<BR />by linux</small> || colspan=4 style="text-align:center;" | 10GB <small>(0x13FFFF8 sectors)</small><BR />All available - 10GB <small>(All - 0x13FFFF8 sectors)</small> || Any || OtherOS<BR /><small>(disabled in firmware 3.21)</small> || <small>Linux/FreeBSD for NAND/NOR PS3's<BR />Based on glevand drivers</small> | |||
|- {{cellcolors|lightgrey}} | |||
| colspan=4 | || colspan=3 | || colspan=4 | || style="text-align:right;" | <abbr title="4.096 bytes">4 KB</abbr> || style="text-align:right;" | 8 || style="text-align:right;" | 0x1000 || style="text-align:right;" | 0x8 || Same ? || colspan=2 | Padding | |||
|- | |||
|} | |||
===HDD partitions table info === | |||
*This table (pretends to) show all the posible partition layouts in all PS3 models, even when there are 2 big differences that changes partition positions (and consequently region names in Otheros/linux) | |||
**Flash type | |||
***NAND flash 256mb - All firmware is stored in real NAND flash | |||
***NOR flash 16mb - A small part of the firmware is stored in real NOR flash, and most of the firmware is stored in the first "virtual flash" (ps3vflash) partition in HDD (his position makes the other partitions to be displaced) | |||
**OtherOS bootloader installation (usually petitboot or kboot) | |||
***OtherOS bootloader official - petitboot is installed in region (1.5), his size is smaller than the region so no need to resize | |||
***OtherOS++ bootloader unofficial - petitboot is installed in region (1.5), his size is bigger than the region so the region is resized conveniently (usually up to 8MB = 16384 sectors) | |||
**OtherOS installation | |||
***OtherOS official for NAND models - Linux/FreeBSD installed at region (3.4), last region of the HDD | |||
***OtherOS++ unofficial for NOR models - Linux/FreeBSD installed at region (1.7), last region of vflash is created and resized conveniently (firmware installers doesnt creates this region) | |||
***OtherOS/OtherOS++ unofficial for NOR/NAND models - Linux/FreeBSD installed at region (3.4), last region of the HDD | |||
*Devices contains a single physical partition | |||
*Physical partitions contains one or more logicall partitions | |||
*Padding Notes: | |||
**7th region of vflash (ps3vflashg) ends at sector 0x77E00. vflash is 0x80000 sectors size, so the "not used area" after ps3vflashg has a size of: 0x80000 - 0x77E00 = 0x8200 sectors = 17039360 bytes (16,25 MB) | |||
**The official padding between HDD regions defined in "HDD Partition Table" seems to be 0x8 sectors size (see [http://www.psdevwiki.com/ps3/Hypervisor_Reverse_Engineering#HDD_device graf notes] and the example below) but the padding can be different when using unnofficial rebuild methods ([http://gitorious.ps3dev.net/ps3otheros/scripts/blobs/master/create_hdd_region.sh create_hdd_region.sh] adds a padding of 0x8 sectors before and another 0x8 sectors after the new region, concatenating new regions with this script generates double padding). Or when modifying the "HDD Partition Table" manually is posible to remove all padding then let the system generate the new region by himself | |||
**VFLASH displacement | |||
***NAND: ps3db region starts at sector 0x18 (displaced 0x8 sectors by "HDD partition table" + 0x10 by ?) | |||
***NOR: ps3db region starts at sector 0x80018 (displaced 0x8 sectors by "HDD partition table" + 0x80000 by VFLASH + 0x10 by ?) | |||
*Sector backup/restore tips | |||
**There are some specific sectors that contains criticall data or are prone to be lost, sectors can be regenerated by having the related keys, or can be overwritted from another hdd formatted in the same PS3 (all hdds formatted by the same PS3 shares the same encryption with the same keys) | |||
**Some users lost the "HDD partition table" when connecting the HDD to a windows PC, because windows will try to "initialize" the HDD, and this initialization implyes to write an MBR of size 1 sector (so if the user accepts the initialization the first sector of the HDD will be lost). This can be solved by connecting another hdd to PS3 and allow PS3 to format it (this regenerates the HDD partition table), then is posible to connect the HDD to PC and "backup" the first sector with a hexeditor (like HxD)... this sector can be used to repair the other HDD. This process doesnt needs any key, is just a copy-paste of sectors from 2 HDD's | |||
**When the "boot otheros" flag is used under GameOS, but the petitboot partition is damaged, or petitboot is not present, corrupted, etc... (or when failing at updating petitboot) the console enters is a loop/brick where the bootchain tryes to boot from petitboot, but the system is not able to find it. To fix this problem is needed to "regenerate" the contents of the petitboot region in PC as explained here: [[Mounting_HDD_on_PC#Making_Changes_to_cell_ext_os_area_VFLASH_Region | how to fix a corrupted petitboot region in PC]]. This process needs the keys | |||
**Alternativelly, is posible to make backups of this criticall sectors in PC just in case some day are needed. Having the backuped sectors the fix consists simply in a copy-paste of them, no keys needed | |||
*Encryption Notes: ????? | |||
**Encryption is made "by sector" (data is accessed in chunks of 512 bytes and encrypted/decrypted individually), applyed "at write time" (only used sectors are encrypted), and "by device" (real and virtual devices). In the practise this means for PS3 NAND models all the HDD sectors are under 1 single encryption layer, but for PS3 NOR models (with a "virtual flash device" embedded inside "real hdd device") there is a "top" encryption layer over the whole HDD, and a "bottom" encryption layer over VFLASH (or in other words... in NOR models the sectors inside VFLASH are encrypted 2 times) | |||
**HDD encryption layer (top), based in the '''ata-data-key''': | |||
***FAT-NAND (no vflash): AES-CBC-192 (ata-data-key and zeroed IV) | |||
***FAT-NOR (with vflash): AES-CBC-192 (ata-data-key and zeroed IV) ? | |||
***SLIM-NOR (with vflash): XTS-AES-128 (ata-data-key and ata-tweak-key) | |||
**VFLASH encryption layer (bottom), based in the '''encdec-key''': | |||
***FAT-NOR (with vflash): AES-CBC-128 (encdec-key and zeroed IV) | |||
***SLIM-NOR (with vflash): XTS-AES-128 (encdec-data-key and encdec-tweak-key) | |||
---- | ---- | ||
*HDD Partition Table example from a PS3 DECHA00A (NAND flash) with official OtherOS installed under firmware 2.80 ---> http://www.mediafire.com/download/ou90bz0h0mw8tco/HDD_ptab_DECHA00A_OtherOS | |||
---- | ---- | ||
---- | Partition formatting in a service mode firmware installation for NOR flash. Google it: http://lmgtfy.com/?q=site%3Ahttp%3A%2F%2Fpastebin.com%2F+%22vflash+is+enabled...%22 | ||
== | manufacturing updating start | ||
PackageName = /dev_usb000/PS3UPDAT.PUP | |||
settle polling interval success | |||
vflash is enabled... | |||
creating system regions... | |||
create storage region: (region id = 1) | |||
create storage region: (region id = 2) | |||
format partition: (region_id = 2, CELL_FS_UTILITY:HDD0, CELL_FS_UFS) | |||
create storage region: (region id = 3) | |||
format partition: (region_id = 3, CELL_FS_UTILITY:HDD1, CELL_FS_FAT) | |||
creating system regions done. | |||
boot from nor flash... | |||
creating nor flash regions... | |||
create storage region: (region id = 2) | |||
create storage region: (region id = 3) | |||
creating flash regions... | |||
create storage region: (region id = 1) | |||
create storage region: (region id = 2) | |||
format partition: (region_id = 2, CELL_FS_IOS:BUILTIN_FLSH1, CELL_FS_FAT) | |||
create storage region: (region id = 3) | |||
format partition: (region_id = 3, CELL_FS_IOS:BUILTIN_FLSH2, CELL_FS_FAT) | |||
create storage region: (region id = 4) | |||
format partition: (region_id = 4, CELL_FS_IOS:BUILTIN_FLSH3, CELL_FS_FAT) | |||
create storage region: (region id = 5) | |||
create storage region: (region id = 6) | |||
Partition formatting in a service mode firmware installation for NAND flash. Google it: http://lmgtfy.com/?q=site%3Ahttp%3A%2F%2Fpastebin.com%2F+%22vflash+is+disabled...%22 | |||
manufacturing updating start | |||
PackageName = /dev_usb000/PS3UPDAT.PUP | |||
settle polling interval success | |||
vflash is disabled... | |||
boot from nand flash... | |||
creating flash regions... | |||
create storage region: (region id = 2) | |||
format partition: (region_id = 2, CELL_FS_IOS:BUILTIN_FLSH1, CELL_FS_FAT) | |||
create storage region: (region id = 3) | |||
format partition: (region_id = 3, CELL_FS_IOS:BUILTIN_FLSH2, CELL_FS_FAT) | |||
create storage region: (region id = 4) | |||
format partition: (region_id = 4, CELL_FS_IOS:BUILTIN_FLSH3, CELL_FS_FAT) | |||
create storage region: (region id = 5) | |||
create storage region: (region id = 6) | |||
Other flash/hdd regions. Google it: http://lmgtfy.com/?q=site%3Ahttp%3A%2F%2Fpastebin.com%2F+%22CELL_FS_UTILITY%3AHDD2%22 and [[Files_on_the_PS3#Mountpoints|Mountpoints]] | |||
Experimental attempt to recover deleted files from gameos partition: http://playstationhax.it/forums/topic/826-recovering-deleted-save-games-eid-dumper-troubles-mounting-the-encrypted-ufs2-filesystem/ | |||
===Speed tests running in PS3 natively=== | |||
{| class="wikitable" | {| class="wikitable" | ||
|+ | |+Speed Tests (PS3) | ||
! rowspan= | ! rowspan=3 | Brand !! rowspan=3 | Series !! rowspan=3 | Model !! colspan=3 | Linux !! GameOs | ||
|- | |- | ||
! | ! colspan=3 | [[http://www.serverschool.com/server-configuration/hard-disk-testing-with-hdparm/ hdparm -Tt]] !! N/A | ||
|- | |- | ||
! colspan= | ! Cache read<BR /><sup>(MB/s)</sup> !! Disk read<BR /><sup>(MB/s)</sup> !! <abbr title="If there is no link available for the speed test, please include your notes in this format">Link</abbr> | ||
|- | |||
! colspan=6 | | |||
|- | |- | ||
! rowspan=3 | Fujitsu | ! rowspan=3 | Fujitsu | ||
! MHW | ! MHW | ||
| [[MHW2040BH]] || | | [[MHW2040BH]] || || | ||
! N/A | |||
|- | |- | ||
! rowspan=2 | MHZ | ! rowspan=2 | MHZ | ||
| [[MHZ2080BH]] || | | [[MHZ2080BH]] || || | ||
! N/A | |||
|- | |- | ||
| [[MHZ2160BH]] || | | [[MHZ2160BH]] || || | ||
! N/A | |||
|- | |- | ||
! colspan= | ! colspan=6 | | ||
|- | |- | ||
! rowspan=4 | Hitachi | ! rowspan=4 | Hitachi | ||
! Travelstar 5K160 | ! Travelstar 5K160 | ||
| [[HTS541640J9SA00]] || | | [[HTS541640J9SA00]] || || | ||
! N/A | |||
|- | |- | ||
! Travelstar 5K250 | ! Travelstar 5K250 | ||
| [[HTS542580K9SA00]] || | | [[HTS542580K9SA00]] || || | ||
! N/A | |||
|- | |- | ||
! Travelstar 5K500 | ! Travelstar 5K500 | ||
| [[HTS545012B9SA00]] || | | [[HTS545012B9SA00]] || || | ||
! N/A | |||
|- | |- | ||
! Travelstar Z5K500 | ! Travelstar Z5K500 | ||
| [[HTS545050A7E380]] || | | [[HTS545050A7E380]] || || | ||
! N/A | |||
|- | |- | ||
! colspan= | ! colspan=6 | | ||
|- | |- | ||
! rowspan=5 | Seagate | ! rowspan=5 | Seagate | ||
! Momentus 5400.2 | ! Momentus 5400.2 | ||
| [[ST96812AS]] || | | [[ST96812AS]] || || | ||
! N/A | |||
|- | |- | ||
! Momentus 5400.3 | ! Momentus 5400.3 | ||
| [[ST980811AS]] || | | [[ST980811AS]] || || | ||
! N/A | |||
|- | |- | ||
! rowspan=2 | LD25 SATA | ! rowspan=2 | LD25 SATA | ||
| [[ST920217AS]] || | | [[ST920217AS]] || || | ||
! N/A | |||
|- | |- | ||
| [[ST9402115AS]] || | | [[ST9402115AS]] || || | ||
! N/A | |||
|- | |- | ||
! LD25 5400.2 | ! LD25 5400.2 | ||
| [[ST940210AS]] || | | [[ST940210AS]] || || | ||
! N/A | |||
|- | |- | ||
! colspan= | ! colspan=6 | | ||
|- | |- | ||
! rowspan=8 | Toshiba | ! rowspan=8 | Toshiba | ||
! rowspan=2 | MKxx52GSX | ! rowspan=2 | MKxx52GSX | ||
| [[MK8052GSX]] || | | [[MK8052GSX]] || || | ||
! N/A | |||
|- | |- | ||
| [[MK1652GSX]] || | | [[MK1652GSX]] || || | ||
! N/A | |||
|- | |- | ||
! rowspan=2 | MKxx55GSX | ! rowspan=2 | MKxx55GSX | ||
| [[MK1255GSX]] || | | [[MK1255GSX]] || || | ||
! N/A | |||
|- | |- | ||
| [[MK2555GSX]] || | | [[MK2555GSX]] || || | ||
! N/A | |||
|- | |- | ||
! rowspan=2 | MKxx65GSX | ! rowspan=2 | MKxx65GSX | ||
| [[MK1665GSX]] || | | [[MK1665GSX]] || || | ||
! N/A | |||
|- | |- | ||
| [[MK3265GSX]] || | | [[MK3265GSX]] || || | ||
! N/A | |||
|- | |- | ||
! rowspan=2 | MKxx76GSX | ! rowspan=2 | MKxx76GSX | ||
| [[MK1676GSX]] || | | [[MK1676GSX]] || || | ||
! N/A | |||
|- | |- | ||
| [[MK3276GSX]] || | | [[MK3276GSX]] || || | ||
! N/A | |||
|- | |- | ||
! colspan= | ! colspan=6 | | ||
|- | |- | ||
|} | |} | ||
* | ==== HDD vs SSD ==== | ||
** | {{#ev:youtube|Jrcde4hyRY0}} | ||
{{#ev:youtube|RbuKRH0aHRM}} | |||
=== Phat NAND HDD Entropy Table (After zerofill,no vflash) === | |||
{| class="wikitable" | |||
! Start Offset !! End Offset !! Size !! Description | |||
|- | |||
| 0x0000 || 0x1000 || 0x1000 || Header | |||
|- | |||
| 0x4000 || 0x16000 || 0x12000 || unknown | |||
|- | |||
| 0x18000 || 0x28000 || 0x10000 || unknown | |||
|} | |||
[https://mega.co.nz/#!BoVmQCJb!LvNxSFATXcPlkDnT5HCDTyTQ7qAvnN2y_mFCFcXISfU file] | |||
=== Slim NOR HDD Data Table (After zerofill,vflash) === | |||
{| class="wikitable" | |||
! Start Offset !! End Offset !! Size !! Description | |||
|- | |||
| 0x0 || 0x2000 || 0x2000 || Header | |||
|- | |||
| 0x4400 || 0x8118240 || please fill || unk | |||
|- | |||
| 0x8119000 || 0x8149960 || please fill || unk | |||
|- | |||
| 0x814B000 || 0x8152CB0 || please fill || unk | |||
|- | |||
| 0x8153000 || 0x81530C0 || please fill || unk | |||
|- | |||
| 0x8155000 || 0x8159B10 || please fill || unk | |||
|- | |||
| 0x815B000 || 0x815E3D0 || please fill || unk | |||
|- | |||
| 0x815F000 || 0x8166190 || please fill || unk | |||
|- | |||
| 0x8167000 || 0x817B750 || please fill || unk | |||
|- | |||
| 0x817D000 || 0x817D5C0 || please fill || unk | |||
|- | |||
| 0x817F000 || 0x818A500 || please fill || unk | |||
|- | |||
| 0x818B000 || 0x818CDC0 || please fill || unk | |||
|- | |||
| 0x818D000 || 0x81C9F10 || please fill || unk | |||
|- | |||
| 0x81CB000 || 0x81D1FD0 || please fill || unk | |||
|- | |||
| 0x81D3000 || 0x81D9E20 || please fill || unk | |||
|- | |||
| 0x81DB000 || 0x81DB1B0 || please fill || unk | |||
|- | |||
| 0x81DD000 || 0x81DD0A0 || please fill || unk | |||
|- | |||
| 0x81DF000 || 0x81DF090 || please fill || unk | |||
|- | |||
| 0x81E1000 || 0x81E1080 || please fill || unk | |||
|- | |||
| 0x81E3000 || 0x81E3090 || please fill || unk | |||
|- | |||
| 0x81E5000 || 0x81E50A0 || please fill || unk | |||
|- | |||
| 0x81E7000 || 0x81E70A0 || please fill || unk | |||
|- | |||
| 0x81E9000 || 0x81E9090 || please fill || unk | |||
|- | |||
| 0x81EB000 || 0x81F4CD0 || please fill || unk | |||
|} | |||
* There is actual readable data near the end of the disk, so this has been renamed to Data Table instead of Entropy Table | |||
* The table is incomplete, please help filling it. | |||
* [https://mega.co.nz/#F!cxkVzTLb!As4f0jDCkexqdhCWcIJBLA the dump and key] | |||
= GameOS fsck = | |||
code uses memory container ( there is also fsck without ) - does fsck on hdd0: | |||
LOAD:0000000000030270 .set var_3C, -0x3C | |||
LOAD:0000000000030270 .set var_38, -0x38 | |||
LOAD:0000000000030270 .set var_34, -0x34 | |||
LOAD:0000000000030270 .set var_30, -0x30 | |||
LOAD:0000000000030270 .set var_20, -0x20 | |||
LOAD:0000000000030270 .set var_18, -0x18 | |||
LOAD:0000000000030270 .set arg_10, 0x10 | |||
LOAD:0000000000030270 | |||
LOAD:0000000000030270 lis r9, aFsck_cfs@h # "fsck_cfs" | |||
LOAD:0000000000030274 mflr r0 | |||
LOAD:0000000000030278 lis r11, aY@h # "-y" | |||
LOAD:000000000003027C lis r10, aHdd0@h # "hdd0" | |||
LOAD:0000000000030280 stdu r1, -0xB0(r1) | |||
LOAD:0000000000030284 addi r9, r9, aFsck_cfs@l # "fsck_cfs" | |||
LOAD:0000000000030288 addi r11, r11, aY@l # "-y" | |||
LOAD:000000000003028C addi r10, r10, aHdd0@l # "hdd0" | |||
LOAD:0000000000030290 std r28, 0xB0+var_20(r1) | |||
LOAD:0000000000030294 li r3, 1 = "App" | |||
LOAD:0000000000030298 li r28, 0 | |||
LOAD:000000000003029C stw r11, 0xB0+var_38(r1) | |||
LOAD:00000000000302A0 std r0, 0xB0+arg_10(r1) | |||
LOAD:00000000000302A4 stw r9, 0xB0+var_3C(r1) | |||
LOAD:00000000000302A8 stw r10, 0xB0+var_34(r1) | |||
LOAD:00000000000302AC std r29, 0xB0+var_18(r1) | |||
LOAD:00000000000302B0 stw r28, 0xB0+var_30(r1) | |||
LOAD:00000000000302B4 bl _vsh_E7C34044_getMemoryContainerId | |||
LOAD:00000000000302B8 clrldi r4, r3, 32 | |||
LOAD:00000000000302BC addi r6, r1, 0xB0+var_40 | |||
LOAD:00000000000302C0 li r5, 0x200 | |||
LOAD:00000000000302C4 lis r3, 0x200 | |||
LOAD:00000000000302C8 stw r28, 0xB0+var_40(r1) | |||
LOAD:00000000000302CC bl sys_memory_allocate_from_container | |||
LOAD:00000000000302D0 lis r7, stru_1429E8@h | |||
LOAD:00000000000302D4 lwz r5, 0xB0+var_40(r1) | |||
LOAD:00000000000302D8 addi r4, r1, 0xB0+var_3C | |||
LOAD:00000000000302DC addi r7, r7, stru_1429E8@l | |||
LOAD:00000000000302E0 lis r6, 0x200 | |||
LOAD:00000000000302E4 li r8, 0 | |||
LOAD:00000000000302E8 li r3, 3 | |||
LOAD:00000000000302EC bl _fs_utility_init_1F3CD9F1 | |||
LOAD:00000000000302F0 li r11, 0x15D # sys_memory_free | |||
LOAD:00000000000302F4 mr r29, r3 | |||
LOAD:00000000000302F8 lwz r3, 0xB0+var_40(r1) | |||
LOAD:00000000000302FC sc | |||
LOAD:0000000000030300 clrldi r3, r29, 32 | |||
LOAD:0000000000030304 bl _sysPrxForUser_sys_ppu_thread_exit | |||
LOAD:0000000000030308 lis r9, dword_146D74@h | |||
LOAD:000000000003030C ld r0, 0xB0+arg_10(r1) | |||
LOAD:0000000000030310 ld r29, 0xB0+var_18(r1) | |||
LOAD:0000000000030314 mtlr r0 | |||
LOAD:0000000000030318 stw r28, dword_146D74@l(r9) | |||
LOAD:000000000003031C ld r28, 0xB0+var_20(r1) | |||
LOAD:0000000000030320 addi r1, r1, 0xB0 | |||
LOAD:0000000000030324 blr | |||
LOAD:0000000000030324 # End of function fsck_cfs_main | |||
=DECR (reference tool) and GECR (arcade)= | |||
Uses 3.5" (size) hdd's | |||
*DECR-1000 - 2x Seagate Barracuda ST3400820A6 (7200.10 400Gbytes 5V@0.72A 12V@0.52A) | |||
=Firmware Patches= | |||
==emer_init== | |||
* | Patch to increase acceptable HDD capacity for error "''The installed hard disk is not supported. You must install a hard disk that is compatible with this system''." Without patch recovery will throw this error when hdd capacity is above 1,649,267,441,664 bytes. With patch error will be shown for hdd above 2,130,303,778,816 bytes. 1,75TB limited drives should be accepted again. Untested on real hardware, use with caution (hw flasher required)! Sorry for short hex pattern, but it should be ok for manual patch (4.75 in this case). | ||
*Search for: | |||
38 00 01 80 | |||
Replace to: | |||
38 00 01 F0 | |||
For full 2TB replace to (There are likely other factors which will fail): | |||
38 00 02 01 |
Latest revision as of 02:00, 15 April 2024
Todo[edit source]
Need help getting data for the different SKU models and the default harddrive they are equiped with.
There is still some conflicting data to be sorted out, e.g.:
maximum size internal drive[edit source]
The maximum size of the internal harddrive that the PS3 supports is 1TB (TeraBytes) note: this seems untrue as there are several people posting pictures of their external to internal drive mod with a size of 2TB
Using Normal Mode and Recovery - when trying to install a 1.5TB 3.5" drive as internal (using an eSATA cradle)[edit source]
- Using Recovery it is possible to finish the format of the harddrive until 100%. The system however fails to reboot automaticly after that and halts. When enforced to reboot, it errors out with "Wrong Harddrive".
- When trying all the other Recovery Menu options it errors out with "Harddrive Error 0x8002F281".
- When trying to boot to XMB it also errors out with "Harddrive Error 0x8002F281".
- When replacing the drive for the previous tested 1TB harddrive, it boots without errors to XMB and reports : 827GB free/931GB total
- Conclusion
- >1TB didn't work.
Using Factory Service Mode - when trying to install a 1.5TB 3.5" drive as internal (using an eSATA cradle) FSM[edit source]
- Second try, using Service Mode
- first replacing drive for original 120GB 2.5" and using Factory Service Mode to downgrade to lowest firmware the system can handle (2K slim -> FW 2.70)
- Result is fine. Log showed no errors : UPDATER_LOG.TXT
- Replaced for 1.5TB 3.5" drive and do exactly the same 2.70 again
- Result is fine. Log showed no errors : UPDATER_LOG.TXT
- Boot to XMB with Service Mode still activated
- No problems to get into XMB, but checking System Settings > System Information shows size detection issues:
System Software Version 2.70 IP Address xxx.xxx.x.xxx MAX Address xx:xx:xx:xx:xx:xx Free Space 30 G
- Exit Factory Service Mode
- Blank screen freeze when trying to boot to XMB in normal mode
- Power off and try again gives "system software was not installed correct" error
- inserted USB with 2.70 on normal location and START+SELECT button to let it reinstall
- Preparing Update counts to 100% and then halts (does not reboot), just like in first trial.
- Manual poweroff and reboot just results in blank screen with no harddrive activity
- Conclusion
- >1TB didn't work in normal or recovery mode only with FSM enabled.
Going back to the 1TB and crosschecking[edit source]
- Replacing drive back to the working 1TB (has 3.55 on it) gives prompt to reinstall 2.70, doing so errors out with "Harddrive Error 0x8002F281".
- Entering Factory Service Mode with 1TB and let it reinstall via lv2diag results fine without errors: UPDATER_LOG.TXT
- Boot to XMB with Service Mode still activated
- No problems to get into XMB, but checking System Settings > System Information shows size detection issues (the '30 G' seems to be FSM related):
System Software Version 2.70 IP Address xxx.xxx.x.xxx MAX Address xx:xx:xx:xx:xx:xx Free Space 30 G
- Exit Factory Service Mode
- No problems to get into XMB, and checking System Settings > System Information shows no size detection issues:
System Software Version 2.70 IP Address xxx.xxx.x.xxx MAX Address xx:xx:xx:xx:xx:xx Free Space 827GB / 931GB
- Conclusion
- <=1TB works fine in all modi.
maximum size external drive[edit source]
Maximum size is 2TB.
PS3 can only read drives using MBR (Master Boot Record) partition table. MBR maximum drive size is 2TB (with up to 4 partitions).
PS3 cannot read drives using GPT (GUID Partition Table). GPT has maximum drive size around 256TB, although in practice it may get tricky beyond 15 TB.
External HDD : You can format it to any size up to 8TB note: this seems untrue, because when >2TB drives have hit the market, no screenshots of >2TB external storage are known
- sources used: source: http://www.edepot.com/playstation3.html#PS3_Harddrive and euss temp blog
- todo: flush out errors, merging in a readable format
Footnote: maximum supported drive space correlates to support of 512sector (either native, or emulated), see: http://en.wikipedia.org/wiki/Advanced_Format
Tests increasing the max HDD capacity supported by the firmware[edit source]
Successful 2Tb installation confirmed personally. (warning: "restore filesystem" a.k.a. "filesystem check" was not tested. Without this function the hdd will cummulate filesystem errors up to a point where the PS3 will welcome you with a warning message telling "the hdd needs to be formatted" and you will lose all the contents of it)
- HDD was Toshiba MQ01ABB200 and PS3 was CECHK04
- Flashing to 4.46 OFW and reducing 2Tb hard drive to 3633537126 sectors via "hiding" rest via HPA on PC (formatted first to FAT format on MAC a whole device and GPT instead MBR) with HDAT2 so PS3 sees its as 1732.6GB Hard Drive and did succeed formatting.
- After 4.46 you can upgrade to latest 4.82 Firmware back and continue using it. 4.82 firmware says after HPA sector hiding that it is "unsupported" but 4.46 doesn't and can format it.
Pictures of some of this of my personal confession and proof: [1] Original info i used to confirm: [2]
Note from another tester : While the above seems to work, using 4.46 to allow 1.75tb leads to errors after saving a few games : the console stalls, then takes forever to recover (if it recovers). I tried reducing to 1.5Tb, and none of the errors show up. What's misleading is that 1.5Tb is in fact recognized by 4.82+, even with HPA. I think the safe way to get the max capacity is to use HPA, but stick to something between 1.5Tb and 1.75Tb and make sure it's recognized by 4.82+. It means downgrading to 4.46 is not necessary (and mostly misleading).
AES-256-CBC versus AES-256-XTS[edit source]
There is conflicting mention of sources for the algo/mode used for GameOS encryption.
Fact:
- Sony/IBM loves AES
- 256bit based
- sectorsize 512 bytes (4096 bits)
- blockcipher
- recurring patterns are seen
Reference:
PS3 HDD reader for windows by 3141card[edit source]
May 2018, added PS3 FAT NOR support: http://www.psx-place.com/threads/restoring-my-corrupted-hdd.17932/page-2#post-125398
Fat(NAND), 1. layer(ata) -> aes-cbc-192, ata_key1 IV = 0 2. layer(vflash) no vflash Fat(NOR), 1. layer(ata) -> aes-cbc-192, ata_key1 IV = 0 2. layer(vflash) -> aes-xts-128, encdec_key1 and encdec_key2, tweak = physical sector number on hdd Slim(NOR), 1. layer(ata) -> aes-xts-128, ata_key1 and ata_key2 2. layer(vflash) -> aes-xts-128, encdec_key1 and encdec_key2, tweak = physical sector number on hdd
Experimental Tables[edit source]
HDD partitions[edit source]
Storage Region | Access Control List | File System | Size | Usage | |||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
OtherOS | GameOS | Secure Profile | Unk | Encryption | Type | Official | Unnofficial |
Official |
Unnofficial | ||||||||||
Name | auth_id | FAT | SLIM | Decimal | Hexadecimal | ||||||||||||||
NAND | NOR | NOR | Bytes | Sectors | Bytes | Sectors | |||||||||||||
ps3d (3) | |||||||||||||||||||
ps3da (3.0) |
4 KB | 8 | 0x1000 | 0x8 | Same | HDD Partition Table (Physical HDD Device) | |||||||||||||
ps3vflash (3.1) |
? | SCE_CELLOS_PME PS3_LPAR |
1070000001000001 1070000002000001 |
0B 03 |
↑:No ↓:No |
↑:AES-CBC-192 (ata_key1, IV=0) ↓:AES-XTS-128 (encdec_key1, encdec_key2) |
↑:AES-XTS-128 (ata_key1, ata_key2) ↓:AES-XTS-128 (encdec_key1, encdec_key2) |
Raw access | 256 MB | 524.288 | 0x10000000 | 0x80000 | Any | First region of HDD, contains VFLASH. (only NOR) | |||||
ps3vflasha (3.1(1.0)) |
4 KB | 8 | 0x1000 | 0x8 | Same | VFLASH Partition Table (Virtual FLASH Device, only NOR) | |||||||||||||
ps3vflashb (3.1(1.1)) |
? | SCE_CELLOS_PME | 1070000001000001 | 03 | ↑:No ↓:No |
↑:AES-CBC-192 (ata_key1, IV=0) ↓:AES-XTS-128 (encdec_key1, encdec_key2) |
↑:AES-XTS-128 (ata_key1, ata_key2) ↓:AES-XTS-128 (encdec_key1, encdec_key2) |
Raw access ? | 14,75 MB | 30.200 | 0xEBF000 | 0x75F8 | Same | "mirror" of real NOR second region: "ps3nflashb" ? | |||||
256 KB | 512 | 0x40000 | 0x200 | Same | ? | ||||||||||||||
ps3vflashc (3.1(1.2)) |
CELL_FS_IOS:BUILTIN_FLSH1 dev_flash |
PS3_LPAR SCE_CELLOS_PME PS2_*LPAR |
1070000002000001 1070000001000001 1020000003000001 |
03 03 01 |
↑:No ↓:No |
↑:AES-CBC-192 (ata_key1, IV=0) ↓:AES-XTS-128 (encdec_key1, encdec_key2) |
↑:AES-XTS-128 (ata_key1, ata_key2) ↓:AES-XTS-128 (encdec_key1, encdec_key2) |
FAT16 | 199,75 MB | 409.088 | 0xC7C0000 | 0x63E00 | Same | Firmware files | |||||
ps3vflashd (3.1(1.3)) |
CELL_FS_IOS:BUILTIN_FLSH2 dev_flash2 |
PS3_LPAR SCE_CELLOS_PME |
1070000002000001 1070000001000001 |
03 03 |
↑:No ↓:No |
↑:AES-CBC-192 (ata_key1, IV=0) ↓:AES-XTS-128 (encdec_key1, encdec_key2) |
↑:AES-XTS-128 (ata_key1, ata_key2) ↓:AES-XTS-128 (encdec_key1, encdec_key2) |
FAT16 | 16 MB | 32.768 | 0x1000000 | 0x8000 | Same | XRegistry (Console/User settings) | |||||
ps3vflashe (3.1(1.4)) |
CELL_FS_IOS:BUILTIN_FLSH3 dev_flash3 |
PS3_LPAR SCE_CELLOS_PME |
1070000002000001 1070000001000001 |
03 03 |
↑:No ↓:No |
↑:AES-CBC-192 (ata_key1, IV=0) ↓:AES-XTS-128 (encdec_key1, encdec_key2) |
↑:AES-XTS-128 (ata_key1, ata_key2) ↓:AES-XTS-128 (encdec_key1, encdec_key2) |
FAT12 | 512 KB | 1.024 | 0x80000 | 0x400 | Same | CRL/DRL (Bluray revocation lists) | |||||
ps3vflashf (3.1(1.5)) |
CELL_FS_IOS:BUILTIN_FLSH4 dev_flash4 ? |
PS3_LPAR SCE_CELLOS_PME LINUX_LPAR |
1070000002000001 1070000001000001 1080000004000001 |
03 03 03 |
↑:No ↓:No |
↑:AES-CBC-192 (ata_key1, IV=0) ↓:AES-XTS-128 (encdec_key1, encdec_key2) |
↑:AES-XTS-128 (ata_key1, ata_key2) ↓:AES-XTS-128 (encdec_key1, encdec_key2) |
Raw access | 4 MB | 8.192 | 0x400000 | 0x2000 | Any | cell_ext_os_area + OtherOS bootloader (compressed: otheros.bld) |
cell_ext_os_area + OtherOS++ bootloader (uncompressed: dtbImage.ps3.bin) | ||||
4,25 MB | 8.704 | 0x440000 | 0x2200 | Same | ? | ||||||||||||||
ps3vflashg (3.1(1.6)) |
? | SCE_CELLOS_PME | 1070000001000001 | 03 | ↑:No ↓:No |
↑:AES-CBC-192 (ata_key1, IV=0) ↓:AES-XTS-128 (encdec_key1, encdec_key2) |
↑:AES-XTS-128 (ata_key1, ata_key2) ↓:AES-XTS-128 (encdec_key1, encdec_key2) |
Raw access ? | 256 KB | 512 | 0x40000 | 0x200 | Same | ? | |||||
16,25 MB | 33.280 | 0x1040000 | 0x8200 | No ? | Padding | ||||||||||||||
ps3vflashh (3.1(1.7)) |
? | No | No | No | ↑:No ↓:No |
↑:AES-CBC-192 (ata_key1, IV=0) ↓:AES-XTS-128 (encdec_key1, encdec_key2) |
↑:AES-XTS-128 (ata_key1, ata_key2) ↓:AES-XTS-128 (encdec_key1, encdec_key2) |
All supported by linux |
Any | Not used | Linux/FreeBSD for NOR PS3's Based on graf drivers (deprecated) | ||||||||
8 KB | 16 | 0x2000 | 0x10 | Same ? | Padding ? | ||||||||||||||
ps3db (3.2) |
CELL_FS_UTILITY:HDD0 dev_hdd0 |
SCE_CELLOS_PME PS3_LPAR PS2_*LPAR |
1070000001000001 1070000002000001 1020000003000001 |
03 03 03 |
AES-CBC-192 (ata_key1, IV=0) | AES-XTS-128 (ata_key1, ata_key2) | UFS2 | Any | GameOS | ||||||||||
4 KB | 8 | 0x1000 | 0x8 | Same ? | Padding | ||||||||||||||
ps3dc (3.3) |
CELL_FS_UTILITY:HDD1 dev_hdd1 |
SCE_CELLOS_PME PS3_LPAR |
1070000001000001 1070000002000001 |
03 03 |
AES-CBC-192 (ata_key1, IV=0) | AES-XTS-128 (ata_key1, ata_key2) | FAT16 | 2 GB | 4.194.296 | 0x7FFFF000 | 0x3FFFF8 | Same | GameOS Cache | ||||||
4 KB | 8 | 0x1000 | 0x8 | Same ? | Padding | ||||||||||||||
ps3dd (3.4) |
CELL_FS_UTILITY:HDD2 dev_hdd2 ? |
PS3_LPAR SCE_CELLOS_PME LINUX_LPAR |
1070000002000001 1070000001000001 1080000004000001 |
03 03 03 |
AES-CBC-192 (ata_key1, IV=0) | AES-XTS-128 (ata_key1, ata_key2) | All supported by linux |
10GB (0x13FFFF8 sectors) All available - 10GB (All - 0x13FFFF8 sectors) |
Any | OtherOS (disabled in firmware 3.21) |
Linux/FreeBSD for NAND/NOR PS3's Based on glevand drivers | ||||||||
4 KB | 8 | 0x1000 | 0x8 | Same ? | Padding |
HDD partitions table info[edit source]
- This table (pretends to) show all the posible partition layouts in all PS3 models, even when there are 2 big differences that changes partition positions (and consequently region names in Otheros/linux)
- Flash type
- NAND flash 256mb - All firmware is stored in real NAND flash
- NOR flash 16mb - A small part of the firmware is stored in real NOR flash, and most of the firmware is stored in the first "virtual flash" (ps3vflash) partition in HDD (his position makes the other partitions to be displaced)
- OtherOS bootloader installation (usually petitboot or kboot)
- OtherOS bootloader official - petitboot is installed in region (1.5), his size is smaller than the region so no need to resize
- OtherOS++ bootloader unofficial - petitboot is installed in region (1.5), his size is bigger than the region so the region is resized conveniently (usually up to 8MB = 16384 sectors)
- OtherOS installation
- OtherOS official for NAND models - Linux/FreeBSD installed at region (3.4), last region of the HDD
- OtherOS++ unofficial for NOR models - Linux/FreeBSD installed at region (1.7), last region of vflash is created and resized conveniently (firmware installers doesnt creates this region)
- OtherOS/OtherOS++ unofficial for NOR/NAND models - Linux/FreeBSD installed at region (3.4), last region of the HDD
- Flash type
- Devices contains a single physical partition
- Physical partitions contains one or more logicall partitions
- Padding Notes:
- 7th region of vflash (ps3vflashg) ends at sector 0x77E00. vflash is 0x80000 sectors size, so the "not used area" after ps3vflashg has a size of: 0x80000 - 0x77E00 = 0x8200 sectors = 17039360 bytes (16,25 MB)
- The official padding between HDD regions defined in "HDD Partition Table" seems to be 0x8 sectors size (see graf notes and the example below) but the padding can be different when using unnofficial rebuild methods (create_hdd_region.sh adds a padding of 0x8 sectors before and another 0x8 sectors after the new region, concatenating new regions with this script generates double padding). Or when modifying the "HDD Partition Table" manually is posible to remove all padding then let the system generate the new region by himself
- VFLASH displacement
- NAND: ps3db region starts at sector 0x18 (displaced 0x8 sectors by "HDD partition table" + 0x10 by ?)
- NOR: ps3db region starts at sector 0x80018 (displaced 0x8 sectors by "HDD partition table" + 0x80000 by VFLASH + 0x10 by ?)
- Sector backup/restore tips
- There are some specific sectors that contains criticall data or are prone to be lost, sectors can be regenerated by having the related keys, or can be overwritted from another hdd formatted in the same PS3 (all hdds formatted by the same PS3 shares the same encryption with the same keys)
- Some users lost the "HDD partition table" when connecting the HDD to a windows PC, because windows will try to "initialize" the HDD, and this initialization implyes to write an MBR of size 1 sector (so if the user accepts the initialization the first sector of the HDD will be lost). This can be solved by connecting another hdd to PS3 and allow PS3 to format it (this regenerates the HDD partition table), then is posible to connect the HDD to PC and "backup" the first sector with a hexeditor (like HxD)... this sector can be used to repair the other HDD. This process doesnt needs any key, is just a copy-paste of sectors from 2 HDD's
- When the "boot otheros" flag is used under GameOS, but the petitboot partition is damaged, or petitboot is not present, corrupted, etc... (or when failing at updating petitboot) the console enters is a loop/brick where the bootchain tryes to boot from petitboot, but the system is not able to find it. To fix this problem is needed to "regenerate" the contents of the petitboot region in PC as explained here: how to fix a corrupted petitboot region in PC. This process needs the keys
- Alternativelly, is posible to make backups of this criticall sectors in PC just in case some day are needed. Having the backuped sectors the fix consists simply in a copy-paste of them, no keys needed
- Encryption Notes: ?????
- Encryption is made "by sector" (data is accessed in chunks of 512 bytes and encrypted/decrypted individually), applyed "at write time" (only used sectors are encrypted), and "by device" (real and virtual devices). In the practise this means for PS3 NAND models all the HDD sectors are under 1 single encryption layer, but for PS3 NOR models (with a "virtual flash device" embedded inside "real hdd device") there is a "top" encryption layer over the whole HDD, and a "bottom" encryption layer over VFLASH (or in other words... in NOR models the sectors inside VFLASH are encrypted 2 times)
- HDD encryption layer (top), based in the ata-data-key:
- FAT-NAND (no vflash): AES-CBC-192 (ata-data-key and zeroed IV)
- FAT-NOR (with vflash): AES-CBC-192 (ata-data-key and zeroed IV) ?
- SLIM-NOR (with vflash): XTS-AES-128 (ata-data-key and ata-tweak-key)
- VFLASH encryption layer (bottom), based in the encdec-key:
- FAT-NOR (with vflash): AES-CBC-128 (encdec-key and zeroed IV)
- SLIM-NOR (with vflash): XTS-AES-128 (encdec-data-key and encdec-tweak-key)
- HDD Partition Table example from a PS3 DECHA00A (NAND flash) with official OtherOS installed under firmware 2.80 ---> http://www.mediafire.com/download/ou90bz0h0mw8tco/HDD_ptab_DECHA00A_OtherOS
Partition formatting in a service mode firmware installation for NOR flash. Google it: http://lmgtfy.com/?q=site%3Ahttp%3A%2F%2Fpastebin.com%2F+%22vflash+is+enabled...%22
manufacturing updating start PackageName = /dev_usb000/PS3UPDAT.PUP settle polling interval success vflash is enabled... creating system regions... create storage region: (region id = 1) create storage region: (region id = 2) format partition: (region_id = 2, CELL_FS_UTILITY:HDD0, CELL_FS_UFS) create storage region: (region id = 3) format partition: (region_id = 3, CELL_FS_UTILITY:HDD1, CELL_FS_FAT) creating system regions done. boot from nor flash... creating nor flash regions... create storage region: (region id = 2) create storage region: (region id = 3) creating flash regions... create storage region: (region id = 1) create storage region: (region id = 2) format partition: (region_id = 2, CELL_FS_IOS:BUILTIN_FLSH1, CELL_FS_FAT) create storage region: (region id = 3) format partition: (region_id = 3, CELL_FS_IOS:BUILTIN_FLSH2, CELL_FS_FAT) create storage region: (region id = 4) format partition: (region_id = 4, CELL_FS_IOS:BUILTIN_FLSH3, CELL_FS_FAT) create storage region: (region id = 5) create storage region: (region id = 6)
Partition formatting in a service mode firmware installation for NAND flash. Google it: http://lmgtfy.com/?q=site%3Ahttp%3A%2F%2Fpastebin.com%2F+%22vflash+is+disabled...%22
manufacturing updating start PackageName = /dev_usb000/PS3UPDAT.PUP settle polling interval success vflash is disabled... boot from nand flash... creating flash regions... create storage region: (region id = 2) format partition: (region_id = 2, CELL_FS_IOS:BUILTIN_FLSH1, CELL_FS_FAT) create storage region: (region id = 3) format partition: (region_id = 3, CELL_FS_IOS:BUILTIN_FLSH2, CELL_FS_FAT) create storage region: (region id = 4) format partition: (region_id = 4, CELL_FS_IOS:BUILTIN_FLSH3, CELL_FS_FAT) create storage region: (region id = 5) create storage region: (region id = 6)
Other flash/hdd regions. Google it: http://lmgtfy.com/?q=site%3Ahttp%3A%2F%2Fpastebin.com%2F+%22CELL_FS_UTILITY%3AHDD2%22 and Mountpoints
Experimental attempt to recover deleted files from gameos partition: http://playstationhax.it/forums/topic/826-recovering-deleted-save-games-eid-dumper-troubles-mounting-the-encrypted-ufs2-filesystem/
Speed tests running in PS3 natively[edit source]
Brand | Series | Model | Linux | GameOs | ||
---|---|---|---|---|---|---|
[hdparm -Tt] | N/A | |||||
Cache read (MB/s) |
Disk read (MB/s) |
Link | ||||
Fujitsu | MHW | MHW2040BH | N/A | |||
MHZ | MHZ2080BH | N/A | ||||
MHZ2160BH | N/A | |||||
Hitachi | Travelstar 5K160 | HTS541640J9SA00 | N/A | |||
Travelstar 5K250 | HTS542580K9SA00 | N/A | ||||
Travelstar 5K500 | HTS545012B9SA00 | N/A | ||||
Travelstar Z5K500 | HTS545050A7E380 | N/A | ||||
Seagate | Momentus 5400.2 | ST96812AS | N/A | |||
Momentus 5400.3 | ST980811AS | N/A | ||||
LD25 SATA | ST920217AS | N/A | ||||
ST9402115AS | N/A | |||||
LD25 5400.2 | ST940210AS | N/A | ||||
Toshiba | MKxx52GSX | MK8052GSX | N/A | |||
MK1652GSX | N/A | |||||
MKxx55GSX | MK1255GSX | N/A | ||||
MK2555GSX | N/A | |||||
MKxx65GSX | MK1665GSX | N/A | ||||
MK3265GSX | N/A | |||||
MKxx76GSX | MK1676GSX | N/A | ||||
MK3276GSX | N/A | |||||
HDD vs SSD[edit source]
Phat NAND HDD Entropy Table (After zerofill,no vflash)[edit source]
Start Offset | End Offset | Size | Description |
---|---|---|---|
0x0000 | 0x1000 | 0x1000 | Header |
0x4000 | 0x16000 | 0x12000 | unknown |
0x18000 | 0x28000 | 0x10000 | unknown |
Slim NOR HDD Data Table (After zerofill,vflash)[edit source]
Start Offset | End Offset | Size | Description |
---|---|---|---|
0x0 | 0x2000 | 0x2000 | Header |
0x4400 | 0x8118240 | please fill | unk |
0x8119000 | 0x8149960 | please fill | unk |
0x814B000 | 0x8152CB0 | please fill | unk |
0x8153000 | 0x81530C0 | please fill | unk |
0x8155000 | 0x8159B10 | please fill | unk |
0x815B000 | 0x815E3D0 | please fill | unk |
0x815F000 | 0x8166190 | please fill | unk |
0x8167000 | 0x817B750 | please fill | unk |
0x817D000 | 0x817D5C0 | please fill | unk |
0x817F000 | 0x818A500 | please fill | unk |
0x818B000 | 0x818CDC0 | please fill | unk |
0x818D000 | 0x81C9F10 | please fill | unk |
0x81CB000 | 0x81D1FD0 | please fill | unk |
0x81D3000 | 0x81D9E20 | please fill | unk |
0x81DB000 | 0x81DB1B0 | please fill | unk |
0x81DD000 | 0x81DD0A0 | please fill | unk |
0x81DF000 | 0x81DF090 | please fill | unk |
0x81E1000 | 0x81E1080 | please fill | unk |
0x81E3000 | 0x81E3090 | please fill | unk |
0x81E5000 | 0x81E50A0 | please fill | unk |
0x81E7000 | 0x81E70A0 | please fill | unk |
0x81E9000 | 0x81E9090 | please fill | unk |
0x81EB000 | 0x81F4CD0 | please fill | unk |
- There is actual readable data near the end of the disk, so this has been renamed to Data Table instead of Entropy Table
- The table is incomplete, please help filling it.
- the dump and key
GameOS fsck[edit source]
code uses memory container ( there is also fsck without ) - does fsck on hdd0:
LOAD:0000000000030270 .set var_3C, -0x3C LOAD:0000000000030270 .set var_38, -0x38 LOAD:0000000000030270 .set var_34, -0x34 LOAD:0000000000030270 .set var_30, -0x30 LOAD:0000000000030270 .set var_20, -0x20 LOAD:0000000000030270 .set var_18, -0x18 LOAD:0000000000030270 .set arg_10, 0x10 LOAD:0000000000030270 LOAD:0000000000030270 lis r9, aFsck_cfs@h # "fsck_cfs" LOAD:0000000000030274 mflr r0 LOAD:0000000000030278 lis r11, aY@h # "-y" LOAD:000000000003027C lis r10, aHdd0@h # "hdd0" LOAD:0000000000030280 stdu r1, -0xB0(r1) LOAD:0000000000030284 addi r9, r9, aFsck_cfs@l # "fsck_cfs" LOAD:0000000000030288 addi r11, r11, aY@l # "-y" LOAD:000000000003028C addi r10, r10, aHdd0@l # "hdd0" LOAD:0000000000030290 std r28, 0xB0+var_20(r1) LOAD:0000000000030294 li r3, 1 = "App" LOAD:0000000000030298 li r28, 0 LOAD:000000000003029C stw r11, 0xB0+var_38(r1) LOAD:00000000000302A0 std r0, 0xB0+arg_10(r1) LOAD:00000000000302A4 stw r9, 0xB0+var_3C(r1) LOAD:00000000000302A8 stw r10, 0xB0+var_34(r1) LOAD:00000000000302AC std r29, 0xB0+var_18(r1) LOAD:00000000000302B0 stw r28, 0xB0+var_30(r1) LOAD:00000000000302B4 bl _vsh_E7C34044_getMemoryContainerId LOAD:00000000000302B8 clrldi r4, r3, 32 LOAD:00000000000302BC addi r6, r1, 0xB0+var_40 LOAD:00000000000302C0 li r5, 0x200 LOAD:00000000000302C4 lis r3, 0x200 LOAD:00000000000302C8 stw r28, 0xB0+var_40(r1) LOAD:00000000000302CC bl sys_memory_allocate_from_container LOAD:00000000000302D0 lis r7, stru_1429E8@h LOAD:00000000000302D4 lwz r5, 0xB0+var_40(r1) LOAD:00000000000302D8 addi r4, r1, 0xB0+var_3C LOAD:00000000000302DC addi r7, r7, stru_1429E8@l LOAD:00000000000302E0 lis r6, 0x200 LOAD:00000000000302E4 li r8, 0 LOAD:00000000000302E8 li r3, 3 LOAD:00000000000302EC bl _fs_utility_init_1F3CD9F1 LOAD:00000000000302F0 li r11, 0x15D # sys_memory_free LOAD:00000000000302F4 mr r29, r3 LOAD:00000000000302F8 lwz r3, 0xB0+var_40(r1) LOAD:00000000000302FC sc LOAD:0000000000030300 clrldi r3, r29, 32 LOAD:0000000000030304 bl _sysPrxForUser_sys_ppu_thread_exit LOAD:0000000000030308 lis r9, dword_146D74@h LOAD:000000000003030C ld r0, 0xB0+arg_10(r1) LOAD:0000000000030310 ld r29, 0xB0+var_18(r1) LOAD:0000000000030314 mtlr r0 LOAD:0000000000030318 stw r28, dword_146D74@l(r9) LOAD:000000000003031C ld r28, 0xB0+var_20(r1) LOAD:0000000000030320 addi r1, r1, 0xB0 LOAD:0000000000030324 blr LOAD:0000000000030324 # End of function fsck_cfs_main
DECR (reference tool) and GECR (arcade)[edit source]
Uses 3.5" (size) hdd's
- DECR-1000 - 2x Seagate Barracuda ST3400820A6 (7200.10 400Gbytes [email protected] [email protected])
Firmware Patches[edit source]
emer_init[edit source]
Patch to increase acceptable HDD capacity for error "The installed hard disk is not supported. You must install a hard disk that is compatible with this system." Without patch recovery will throw this error when hdd capacity is above 1,649,267,441,664 bytes. With patch error will be shown for hdd above 2,130,303,778,816 bytes. 1,75TB limited drives should be accepted again. Untested on real hardware, use with caution (hw flasher required)! Sorry for short hex pattern, but it should be ok for manual patch (4.75 in this case).
- Search for:
38 00 01 80
Replace to:
38 00 01 F0
For full 2TB replace to (There are likely other factors which will fail):
38 00 02 01