Flash: Difference between revisions
Jump to navigation
Jump to search
(→Overview: block notes) |
m (wikify) |
||
| (21 intermediate revisions by 6 users not shown) | |||
| Line 1: | Line 1: | ||
== Overview == | == Overview == | ||
=== NOR Flash === | === NOR Flash === | ||
| Line 10: | Line 5: | ||
{| class="wikitable" | {| class="wikitable" | ||
|- | |- | ||
! type !! R. !! colspan="3" | Name !! Start Offset !! End Offset !! Size (h) !! Size (bytes) !! Notes | ! type !! R. !! colspan="3" | Name !! Start Offset !! End Offset !! Size (h) !! Size (bytes) !! Block !! Notes | ||
|- | |- | ||
| {{generic}} || rowspan="27" style="text-align:center" | [[Flash:First_Region|1]] || colspan="3" | [[Flash:0FACE0FF DEADBEEF|0FACE0FF DEADBEEF]] || 0x000000 || 0x00001FF || 0x200|| (512 bytes) || <small>magic header : 0x0000010 00 00 00 00 0F AC E0 FF 00 00 00 00 DE AD BE EF .....¬àÿ....Þ¾ï</small> | | {{generic}} || rowspan="27" style="text-align:center" | [[Flash:First_Region|1]] || colspan="3" | [[Flash:0FACE0FF DEADBEEF|0FACE0FF DEADBEEF]] || 0x000000 || 0x00001FF || 0x200|| (512 bytes) || 0h || <small>magic header : 0x0000010 00 00 00 00 0F AC E0 FF 00 00 00 00 DE AD BE EF .....¬àÿ....Þ¾ï</small> | ||
|- | |- | ||
| {{generic}} || colspan="3" | [[Flash:Flash_Format|Flash Format]] || 0x000200 || 0x00003FF || 0x200 || (512 bytes) || <small>00000200 49 46 49 00 00 00 00 01 00 00 00 02 00 00 00 00 IFI............. (only 0x10 or 16 bytes used)</small> | | {{generic}} || colspan="3" | [[Flash:Flash_Format|Flash Format]] || 0x000200 || 0x00003FF || 0x200 || (512 bytes) || 1h || <small>00000200 49 46 49 00 00 00 00 01 00 00 00 02 00 00 00 00 IFI............. (only 0x10 or 16 bytes used)</small> | ||
|- | |- | ||
| {{perconsole}} || colspan="3" | [[Flash:Flashregion_Table|Flashregion Table]] || 0x000400 || 0x0007FF || 0x400 || (1,024 bytes) || | | {{perconsole}} || colspan="3" | [[Flash:Flashregion_Table|Flashregion Table]] || 0x000400 || 0x0007FF || 0x400 || (1,024 bytes) || 2h || | ||
|- | |- | ||
| {{perconsole}} || 0 || colspan="2" | [[Flash:asecure_loader|asecure_loader]] || 0x000800 || 0x02EFFF || 0x2E800 || (262,144 bytes) || <small>contains metldr, extracted data starts from 0x000840, <abbr title="length of metldr data is notated @ offset 0x000081E-0x000081F">datasize</abbr> depends on metldr revision</small> | | {{perconsole}} || 0 || colspan="2" | [[Flash:asecure_loader|asecure_loader]] || 0x000800 || 0x02EFFF || 0x2E800 || (262,144 bytes) || 4h || <small>contains metldr, extracted data starts from 0x000840, <abbr title="length of metldr data is notated @ offset 0x000081E-0x000081F">datasize</abbr> depends on metldr revision</small> | ||
|- | |- | ||
| {{perconsole}} || rowspan="8" | 1 || colspan="2" | [[Flash:Encrypted_Individual_Data_-_eEID|eEID]] || 0x02F000 || 0x03EFFF || 0x10000 || (65,536 bytes) || | | {{perconsole}} || rowspan="8" | 1 || colspan="2" | [[Flash:Encrypted_Individual_Data_-_eEID|eEID]] || 0x02F000 || 0x03EFFF || 0x10000 || (65,536 bytes) || 178h || | ||
|- | |- | ||
| {{perconsole}} || 0 || [[Flash:Encrypted_Individual_Data_-_eEID#EID0|EID0]] || 0x02F070 || 0x02F8CF || 0x860 || (2,144 bytes) || <small>([[IDPS]] @ offset 0x0002F070 absolute / 0x00000070 inside eEID )</small> | | {{perconsole}} || 0 || [[Flash:Encrypted_Individual_Data_-_eEID#EID0|EID0]] || 0x02F070 || 0x02F8CF || 0x860 || (2,144 bytes) || || <small>([[IDPS]] @ offset 0x0002F070 absolute / 0x00000070 inside eEID )</small> | ||
|- | |- | ||
| {{perconsole}} || 1 || [[Flash:Encrypted_Individual_Data_-_eEID#EID1|EID1]] || 0x02F8D0 || 0x02FB6F || 0x2A0 || (672 bytes) || | | {{perconsole}} || 1 || [[Flash:Encrypted_Individual_Data_-_eEID#EID1|EID1]] || 0x02F8D0 || 0x02FB6F || 0x2A0 || (672 bytes) || || | ||
|- | |- | ||
| {{perconsole}} || 2 || [[Flash:Encrypted_Individual_Data_-_eEID#EID2|EID2]] || 0x02FB70 || 0x03029F || 0x730 || (1,840 bytes) || | | {{perconsole}} || 2 || [[Flash:Encrypted_Individual_Data_-_eEID#EID2|EID2]] || 0x02FB70 || 0x03029F || 0x730 || (1,840 bytes) || || | ||
|- | |- | ||
| {{perconsole}} || 3 || [[Flash:Encrypted_Individual_Data_-_eEID#EID3|EID3]] || 0x0302A0 || 0x03039F || 0x100 || (256 bytes) || | | {{perconsole}} || 3 || [[Flash:Encrypted_Individual_Data_-_eEID#EID3|EID3]] || 0x0302A0 || 0x03039F || 0x100 || (256 bytes) || || | ||
|- | |- | ||
| {{perconsole}} || 4 || [[Flash:Encrypted_Individual_Data_-_eEID#EID4|EID4]] || 0x0303A0 || 0x0303CF || 0x30 || (48 bytes) || | | {{perconsole}} || 4 || [[Flash:Encrypted_Individual_Data_-_eEID#EID4|EID4]] || 0x0303A0 || 0x0303CF || 0x30 || (48 bytes) || || | ||
|- | |- | ||
| {{perconsole}} || 5 || [[Flash:Encrypted_Individual_Data_-_eEID#EID5|EID5]] || 0x0303D0 || 0x030DCF || 0xA00 || (2,560 bytes) || | | {{perconsole}} || 5 || [[Flash:Encrypted_Individual_Data_-_eEID#EID5|EID5]] || 0x0303D0 || 0x030DCF || 0xA00 || (2,560 bytes) || || | ||
|- | |- | ||
| {{perconsole}} || F || [[Flash:Encrypted_Individual_Data_-_eEID#unreferenced_area|unreferenced area]] || 0x030DD0 || 0x03EFFF || 0xE22F || (57,903 bytes) || | | {{perconsole}} || F || [[Flash:Encrypted_Individual_Data_-_eEID#unreferenced_area|unreferenced area]] || 0x030DD0 || 0x03EFFF || 0xE22F || (57,903 bytes) || || | ||
|- | |- | ||
| {{perconsole}} || rowspan="5" | 2 || colspan="2" | [[Flash:Individual_System_Data_-_cISD|cISD]] || 0x03F000 || 0x03F7FF || 0x800 || (2,048 bytes) || | | {{perconsole}} || rowspan="5" | 2 || colspan="2" | [[Flash:Individual_System_Data_-_cISD|cISD]] || 0x03F000 || 0x03F7FF || 0x800 || (2,048 bytes) || 1F8h || | ||
|- | |- | ||
| {{perconsole}} || 0 || [[Flash:Individual_System_Data_-_cISD#cISD0|cISD0]] || 0x03F040 || 0x03F060 || 0x20 || (32 bytes) || | | {{perconsole}} || 0 || [[Flash:Individual_System_Data_-_cISD#cISD0|cISD0]] || 0x03F040 || 0x03F060 || 0x20 || (32 bytes) || || | ||
|- | |- | ||
| {{perconsole}} || 1 || [[Flash:Individual_System_Data_-_cISD#cISD1|cISD1]] || 0x03F060 || 0x03F260 || 0x200 || (512 bytes) || <small>console 2nd part serial @ 0x3F090 size 0x8</small> | | {{perconsole}} || 1 || [[Flash:Individual_System_Data_-_cISD#cISD1|cISD1]] || 0x03F060 || 0x03F260 || 0x200 || (512 bytes) || || <small>console 2nd part serial @ 0x3F090 size 0x8</small> | ||
|- | |- | ||
| {{perconsole}} || 2 || [[Flash:Individual_System_Data_-_cISD#cISD2|cISD2]] || 0x03F260 || 0x03F270 || 0x10 || (16 bytes) || | | {{perconsole}} || 2 || [[Flash:Individual_System_Data_-_cISD#cISD2|cISD2]] || 0x03F260 || 0x03F270 || 0x10 || (16 bytes) || || | ||
|- | |- | ||
| {{perconsole}} || F || [[Flash:Individual_System_Data_-_cISD#unreferenced area|unreferenced area]] || 0x03F270 || 0x03F7FF || 0x58F || (1,423 bytes) || | | {{perconsole}} || F || [[Flash:Individual_System_Data_-_cISD#unreferenced area|unreferenced area]] || 0x03F270 || 0x03F7FF || 0x58F || (1,423 bytes) || || | ||
|- | |- | ||
| {{perconsole}} || rowspan="3" | 3 || colspan="2" | [[Flash:Common_System_Data_-_cCSD|cCSD]] || 0x03F800 || 0x03FFFF || 0x800 || (2,048 bytes) || | | {{perconsole}} || rowspan="3" | 3 || colspan="2" | [[Flash:Common_System_Data_-_cCSD|cCSD]] || 0x03F800 || 0x03FFFF || 0x800 || (2,048 bytes) || 1FCh || | ||
|- | |- | ||
| {{perconsole}} || 0 || [[Flash:Common_System_Data_-_cCSD#cCSD0|cCSD0]] || 0x03F820 || 0x03F84F || 0x30 || (48 bytes) || | | {{perconsole}} || 0 || [[Flash:Common_System_Data_-_cCSD#cCSD0|cCSD0]] || 0x03F820 || 0x03F84F || 0x30 || (48 bytes) || || | ||
|- | |- | ||
| {{perconsole}} || F || [[Flash:Common_System_Data_-_cCSD#unreferenced_area|unreferenced area]] || 0x03F850 || 0x03FFFF || 0x7B0 || (1,968 bytes) || | | {{perconsole}} || F || [[Flash:Common_System_Data_-_cCSD#unreferenced_area|unreferenced area]] || 0x03F850 || 0x03FFFF || 0x7B0 || (1,968 bytes) || || | ||
|- | |- | ||
| {{perfirmware}} || 4 || colspan="2" | [[Flash:Revoke_Program#trvk_prg0|trvk_prg0]] || 0x040000 || 0x05FFFF || 0x20000 || (131,072 bytes) || | | {{perfirmware}} || 4 || colspan="2" | [[Flash:Revoke_Program#trvk_prg0|trvk_prg0]] || 0x040000 || 0x05FFFF || 0x20000 || (131,072 bytes) || 200h || | ||
|- | |- | ||
| {{perfirmware}} || 5 || colspan="2" | [[Flash:Revoke_Program#trvk_prg1|trvk_prg1]] || 0x060000 || 0x07FFFF || 0x20000 || (131,072 bytes) || | | {{perfirmware}} || 5 || colspan="2" | [[Flash:Revoke_Program#trvk_prg1|trvk_prg1]] || 0x060000 || 0x07FFFF || 0x20000 || (131,072 bytes) || 300h || | ||
|- | |- | ||
| {{perfirmware}} || 6 || colspan="2" | [[Flash:Revoke_Package#trvk_pkg0|trvk_pkg0]] || 0x080000 || 0x09FFFF || 0x20000 || (131,072 bytes) || | | {{perfirmware}} || 6 || colspan="2" | [[Flash:Revoke_Package#trvk_pkg0|trvk_pkg0]] || 0x080000 || 0x09FFFF || 0x20000 || (131,072 bytes) || 400h || | ||
|- | |- | ||
| {{perfirmware}} || 7 || colspan="2" | [[Flash:Revoke_Package#trvk_pkg1|trvk_pkg1]] || 0x0A0000 || 0x0BFFFF || 0x20000 || (131,072 bytes) || | | {{perfirmware}} || 7 || colspan="2" | [[Flash:Revoke_Package#trvk_pkg1|trvk_pkg1]] || 0x0A0000 || 0x0BFFFF || 0x20000 || (131,072 bytes) || 500h || | ||
|- | |- | ||
| {{perfirmware}} || 8 || colspan="2" | [[Flash:ROS#ros0|ros0]] || 0x0C0000 || 0x7BFFFF || 0x700000 || (7,340,032 bytes) || <small>Contains CoreOS files, [ | | {{perfirmware}} || 8 || colspan="2" | [[Flash:ROS#ros0|ros0]] || 0x0C0000 || 0x7BFFFF || 0x700000 || (7,340,032 bytes) || 600h || <small>Contains CoreOS files, [[Boot_Order|filecontent depends on firmware version]]</small> | ||
|- | |- | ||
| {{perfirmware}} || 9 || colspan="2" | [[Flash:ROS#ros1|ros1]] || 0x7C0000 || 0xEBFFFF || 0x700000 || (7,340,032 bytes) || <small>Contains CoreOS files, [ | | {{perfirmware}} || 9 || colspan="2" | [[Flash:ROS#ros1|ros1]] || 0x7C0000 || 0xEBFFFF || 0x700000 || (7,340,032 bytes) || 3E00h || <small>Contains CoreOS files, [[Boot_Order|filecontent depends on firmware version]]</small> | ||
|- | |- | ||
| {{perconsole}} || A || colspan="2" | [[Flash:cvtrm|cvtrm]] || 0xEC0000 || 0xEFFFFF || 0x40000 || (262,144 bytes) || | | {{perconsole}} || A || colspan="2" | [[Flash:cvtrm|cvtrm]] || 0xEC0000 || 0xEFFFFF || 0x40000 || (262,144 bytes) || 7600h || | ||
|- | |- | ||
| {{generic}} || rowspan="6" style="text-align:center" | [[Flash:Second_Region|2]] || colspan="3" | [[Flash:0FACE0FF_DEADFACE|0FACE0FF DEADFACE]] || 0xF00000 || 0xF00FFF || 0x1000 || (4096 bytes) || <small>magic header : 0xF00010 00 00 00 00 0F AC E0 FF 00 00 00 00 DE AD FA CE .....¬àÿ....ÞúÎ</small> <!--// after this area there are 248 not-used-blocks (filled with F's) starting at 0xF01000 and ending at 0xF1FFFF that are not represented in the table //--> | | {{generic}} || rowspan="6" style="text-align:center" | [[Flash:Second_Region|2]] || colspan="3" | [[Flash:0FACE0FF_DEADFACE|0FACE0FF DEADFACE]] || 0xF00000 || 0xF00FFF || 0x1000 || (4096 bytes) || 7800h || <small>magic header : 0xF00010 00 00 00 00 0F AC E0 FF 00 00 00 00 DE AD FA CE .....¬àÿ....ÞúÎ</small> <!--// after this area there are 248 not-used-blocks (filled with F's) starting at 0xF01000 and ending at 0xF1FFFF that are not represented in the table //--> | ||
|- | |- | ||
| {{generic}} || colspan="3" | [[Flash:CELL_EXTNOR_AREA|CELL_EXTNOR_AREA]] || 0xF20000 || 0xF3FFFF || 0x20000 || (131,072 bytes) || <small>([[Harddrive]] information is @ 0xF20200 absolute / 0x200 inside CELL_EXTNOR_AREA)</small> | | {{generic}} || colspan="3" | [[Flash:CELL_EXTNOR_AREA|CELL_EXTNOR_AREA]] || 0xF20000 || 0xF3FFFF || 0x20000 || (131,072 bytes) || 7900h || <small>([[Harddrive]] information is @ 0xF20200 absolute / 0x200 inside CELL_EXTNOR_AREA)</small> | ||
|- | |- | ||
| {{generic}} || colspan="3" | [[Flash:CELL_EXTNOR_AREA#F40000|CRL1]] || 0xF40000 || 0xF5FFFF || 0x20000 || (131,072 bytes) || <small>same as [[Flash:CELL_EXTNOR_AREA#F80000|F80000]]</small> | | {{generic}} || colspan="3" | [[Flash:CELL_EXTNOR_AREA#F40000|CRL1]] || 0xF40000 || 0xF5FFFF || 0x20000 || (131,072 bytes) || 7A00h || <small>same as [[Flash:CELL_EXTNOR_AREA#F80000|F80000]]</small> | ||
|- | |- | ||
| {{generic}} || colspan="3" | [[Flash:CELL_EXTNOR_AREA#F60000|DRL1]] || 0xF60000 || 0xF7FFFF || 0x20000 || (131,072 bytes) || <small>same as [[Flash:CELL_EXTNOR_AREA#FA0000|FA0000]] / <abbr title="when console is used for Bluray movies and connected online">sometimes</abbr> also contains [[Flash:CELL_EXTNOR_AREA#OCRL0200_section_inside_FF_block|OCRL0200]]</small> | | {{generic}} || colspan="3" | [[Flash:CELL_EXTNOR_AREA#F60000|DRL1]] || 0xF60000 || 0xF7FFFF || 0x20000 || (131,072 bytes) || 7B00h || <small>same as [[Flash:CELL_EXTNOR_AREA#FA0000|FA0000]] / <abbr title="when console is used for Bluray movies and connected online">sometimes</abbr> also contains [[Flash:CELL_EXTNOR_AREA#OCRL0200_section_inside_FF_block|OCRL0200]]</small> | ||
|- | |- | ||
| {{generic}} || colspan="3" | [[Flash:CELL_EXTNOR_AREA#F80000|CRL2]] || 0xF80000 || 0xF9FFFF || 0x20000 || (131,072 bytes) || <small>same as [[Flash:CELL_EXTNOR_AREA#F40000|F40000]]</small> | | {{generic}} || colspan="3" | [[Flash:CELL_EXTNOR_AREA#F80000|CRL2]] || 0xF80000 || 0xF9FFFF || 0x20000 || (131,072 bytes) || 7C00h || <small>same as [[Flash:CELL_EXTNOR_AREA#F40000|F40000]]</small> | ||
|- | |- | ||
| {{generic}} || colspan="3" | [[Flash:CELL_EXTNOR_AREA#FA0000|DRL2]] || 0xFA0000 || 0xFBFFFF || 0x20000 || (131,072 bytes) || <small>same as [[Flash:CELL_EXTNOR_AREA#F60000|F60000]] / <abbr title="when console is used for Bluray movies and connected online">sometimes</abbr> also contains [[Flash:CELL_EXTNOR_AREA#OCRL0200_section_inside_FF_block|OCRL0200]]</small> | | {{generic}} || colspan="3" | [[Flash:CELL_EXTNOR_AREA#FA0000|DRL2]] || 0xFA0000 || 0xFBFFFF || 0x20000 || (131,072 bytes) || 7D00h || <small>same as [[Flash:CELL_EXTNOR_AREA#F60000|F60000]] / <abbr title="when console is used for Bluray movies and connected online">sometimes</abbr> also contains [[Flash:CELL_EXTNOR_AREA#OCRL0200_section_inside_FF_block|OCRL0200]]</small> | ||
|- | |- | ||
| {{perconsole}} || rowspan="1" style="text-align:center" | <small>[[Flash:Lv0ldr_Region|lv0ldr]]</small> || colspan="3" | [[Flash:bootldr|bootldr]] || 0xFC0000 || 0xFFFFFF || 0x40000 || (262,144 bytes) || <small>End @ FEEAF0, FEEF70, FEF170, FEF570, FEF5F0, FEF600 in some dumps</small> | | {{perconsole}} || rowspan="1" style="text-align:center" | <small>[[Flash:Lv0ldr_Region|lv0ldr]]</small> || colspan="3" | [[Flash:bootldr|bootldr]] || 0xFC0000 || 0xFFFFFF || 0x40000 || (262,144 bytes) || 7E00h || <small>End @ FEEAF0, FEEF70, FEF170, FEF570, FEF5F0, FEF600 in some dumps</small> | ||
|- | |- | ||
|} | |}<br /> | ||
=== NAND Flash === | === NAND Flash === | ||
| Line 86: | Line 81: | ||
{| class="wikitable" | {| class="wikitable" | ||
|- | |- | ||
! type !! colspan="3" | Name !! Start Offset !! End Offset !! Size (h) !! Size (bytes) !! Notes | ! type !! colspan="3" | Name !! Start Offset !! End Offset !! Size (h) !! Size (bytes) !! Block !! Notes | ||
|- | |||
| {{perconsole}} || colspan="3" | [[Flash:bootldr|bootldr]] || 0x0000000 || 0x003FFFF || 0x40000 || (262,144 bytes) || 0h || <small><abbr title="length of bootldr data seems notated @ offset 0x2-0x3">datasize</abbr> depends on bootldr revision</small> | |||
|- | |||
| {{generic}} || colspan="3" | [[Flash:0FACE0FF_DEADBEEF|0FACE0FF DEADBEEF]] || 0x0040000 || 0x00401FF || 0x200 || (512 bytes) || 200h || <small>magic header : 0x040010 00 00 00 00 0F AC E0 FF 00 00 00 00 DE AD BE EF .....¬àÿ....Þ¾ï</small> | |||
|- | |||
| {{perconsole}} || colspan="3" | [[Flash:Flashregion_Table|Flashregion Table]] || 0x0040200 || 0x00407FF || 0x600 || (1,536 bytes) || 201h || | |||
|- | |||
| {{perconsole}} || 0 || colspan="2" | [[Flash:asecure_loader|asecure_loader]] || 0x0040800 || 0x00807FF || <abbr title="length is notated @ offset 0x004021D-0x004021F">0x40000</abbr> || (262,144 bytes) || 204h || <small>contains metldr, extracted data starts from 0x040840, <abbr title="length of metldr data is notated @ offset 0x004081E-0x004081F">datasize</abbr> depends on metldr revision</small> | |||
|- | |||
| {{perconsole}} || 1 || colspan="2" | [[Flash:Encrypted_Individual Data_-_eEID|eEID]] || 0x0080800 || 0x00907FF || <abbr title="length is notated @ offset 0x004024D-0x004024F">0x10000</abbr> || (65,536 bytes) || 404h || | |||
|- | |||
| {{perconsole}} || || 0 || [[Flash:Encrypted_Individual Data_-_eEID#EID0|EID0]] || 0x0080870 || 0x00810CF || 0x860 || (2,144 bytes) || || <small>([[IDPS]] @ offset 0x00080870 absolute / 0x00000070 inside eEID )</small> | |||
|- | |- | ||
| {{perconsole}} || | | {{perconsole}} || || 1 || [[Flash:Encrypted_Individual Data_-_eEID#EID1|EID1]] || 0x00810D0 || 0x008136F || 0x2A0 || (672 bytes) || || | ||
|- | |- | ||
| {{ | | {{perconsole}} || || 2 || [[Flash:Encrypted_Individual Data_-_eEID#EID2|EID2]] || 0x0081370 || 0x0081A9F || 0x730 || (1,840 bytes) || || | ||
|- | |- | ||
| {{perconsole}} || | | {{perconsole}} || || 3 || [[Flash:Encrypted_Individual Data_-_eEID#EID3|EID3]] || 0x0081AA0 || 0x0081B9F || 0x100 || (256 bytes) || || | ||
|- | |- | ||
| {{perconsole}} || | | {{perconsole}} || || 4 || [[Flash:Encrypted_Individual Data_-_eEID#EID4|EID4]] || 0x0081BA0 || 0x0081BCF || 0x30 || (48 bytes) || || | ||
|- | |- | ||
| {{perconsole}} || | | {{perconsole}} || || 5 || [[Flash:Encrypted_Individual Data_-_eEID#EID5|EID5]] || 0x0081BD0 || 0x00825CF || 0xA00 || (2,560 bytes) || || | ||
|- | |- | ||
| {{perconsole}} || || | | {{perconsole}} || || F || [[Flash:Encrypted_Individual Data_-_eEID#unreferenced_area|unreferenced area]] || 0x00825D0 || 0x00907FF || 0xE22F || (57,903 bytes) || || | ||
|- | |- | ||
| {{perconsole}} || | | {{perconsole}} || 2 || colspan="2" | [[Flash:Individual_System_Data_-_cISD|cISD]] || 0x0090800 || 0x0090FFF || <abbr title="length is notated @ offset 0x004027D-0x004027F">0x800</abbr> || (2,048 bytes) || 484h || | ||
|- | |- | ||
| {{perconsole}} || || | | {{perconsole}} || || 0 || [[Flash:Individual_System_Data_-_cISD#cISD0|cISD0]] || 0x0090840 || 0x009085F || 0x20 || (32 bytes) || || | ||
|- | |- | ||
| {{perconsole}} || || | | {{perconsole}} || || 1 || [[Flash:Individual_System_Data_-_cISD#cISD1|cISD1]] || 0x0090860 || 0x0090A5F || 0x200 || (512 bytes) || || <small>console 2nd part serial @ 0x90890 size 0x8</small> | ||
|- | |- | ||
| {{perconsole}} || || | | {{perconsole}} || || 2 || [[Flash:Individual_System_Data_-_cISD#cISD2|cISD2]] || 0x0090A60 || 0x0090A6F || 0x10 || (16 bytes) || || | ||
|- | |- | ||
| {{perconsole}} || || | | {{perconsole}} || || F || [[Flash:Individual_System_Data_-_cISD##unreferenced_area|unreferenced area]] || 0x0090A70 || 0x0090FFF || 0x58F || (1,423 bytes) || || | ||
|- | |- | ||
| {{perconsole}} || | | {{perconsole}} || 3 || colspan="2" | [[Flash:Common_System_Data_-_cCSD|cCSD]] || 0x0091000 || 0x00917FF || <abbr title="length is notated @ offset 0x00402AD-0x00402AF">0x800</abbr> || (2,048 bytes) || 488h || | ||
|- | |- | ||
| {{perconsole}} || | | {{perconsole}} || || 0 || [[Flash:Common_System_Data_-_cCSD#cCSD0|cCSD0]] || 0x0091020 || 0x009104F || 0x30 || (48 bytes) || || | ||
|- | |- | ||
| {{perconsole}} || || | | {{perconsole}} || || F || [[Flash:Common_System_Data_-_cCSD#unreferenced_area|unreferenced area]] || 0x0091050 || 0x00917FF || 0x7B0 || (1,968 bytes) || || | ||
|- | |- | ||
| {{ | | {{perfirmware}} || 4 || colspan="2" | [[Flash:Revoke_Program#trvk_prg|trvk_prg]] || 0x0091800 || 0x00937FF || <abbr title="length of trvk_prg0+trvk_prg1 combined is notated @ offset 0x00402DD-0x00402DF">0x2000</abbr> || (8,192 bytes) || 48Ch || <small>extracted size is 0x2000 for trvk_prg0 + trvk_prg1 combined as trvk_prg (8,192 bytes)</small> | ||
|- | |- | ||
| {{ | | {{perfirmware}} || 5 || colspan="2" | [[Flash:Revoke_Package#trvk_pkg|trvk_pkg]] || 0x0093800 || 0x00957FF || <abbr title="length of trvk_pkg0+trvk_pkg1 combined is notated @ offset 0x004030D-0x004030F">0x2000</abbr> || (8,192 bytes) || 49Ch || <small>extracted size is 0x2000 for trvk_pkg0 + trvk_pkg1 combined as trvk_pkg (8,192 bytes)</small> | ||
|- | |- | ||
| {{ | | {{generic}} || 6 || colspan="2" | [[Flash:creserved_0|creserved_0]] || 0x0095800 || 0x00BFFFF || <abbr title="length is notated @ offset 0x004033D-0x004033F">0x2A800</abbr> || (174,080 bytes) || 4ACh || | ||
|- | |- | ||
| {{ | | {{perfirmware}} || 7 || colspan="2" | [[Flash:ROS|ros]] || 0x00C0000 || 0x0EBFFFF || <abbr title="length of both ROS0+ROS1 combined is notated @ offset 0x004036D-0x004036F">0xE00000</abbr> || (14,680,064 bytes) || 600h | ||
|- | |- | ||
| {{ | | {{perfirmware}} || || 0 || [[Flash:ROS##ros0|ros0]] || 0x00C0020 || 0x07C000F || 0x6FFFF0 || (7,340,016 bytes) || || <small>Contains CoreOS files, [[Boot_Order|filecontent depends on firmware version]]</small> | ||
|- | |- | ||
| {{ | | {{perfirmware}} || || 1 || [[Flash:ROS##ros1|ros1]] || 0x07C0010 || 0x0EBFFFF || 0x6FFFF0 || (7,340,016 bytes) || || <small>Contains CoreOS files, [[Boot_Order|filecontent depends on firmware version]]</small> | ||
|- | |- | ||
| {{ | | {{perconsole}} || 8 || colspan="2" | [[Flash:cvtrm|cvtrm]] || 0x0EC0000 || 0x0EFFFFF || <abbr title="length is notated @ offset 0x004039D-0x004039F">0x40000</abbr> || (262,144 bytes) || || | ||
|- | |- | ||
| {{ | | {{perconsole}} || || M || SCEIVTRM || 0x0EC0000 || 0x0EC000F || 0x10 || (16 bytes) || || <small>magic header : 0x0D80000 53 43 45 49 56 54 52 4D 00 00 00 00 00 00 00 A8 SCEIVTRM.......¨</small> | ||
|- | |- | ||
| {{ | | {{perconsole}} || || 0 || VTRM0 || ~varies || ~varies || ~varies || ~varies || || <small>magic header : 0x0D80020 00 00 00 00 56 54 52 4D 00 00 00 00 00 00 00 04 ....VTRM........</small> | ||
|- | |- | ||
| {{ | | {{perconsole}} || || 1 || VTRM1 || ~varies || ~varies || ~varies || ~varies || || <small>magic header : 0x0D80400 00 00 00 00 56 54 52 4D 00 00 00 00 00 00 00 04 ....VTRM........</small> | ||
|- | |- | ||
| {{ | | {{perconsole}} || colspan="3" | eFlash area || 0x0F00000 || 0xEFFFFFF || 0xE100000 || (235,929,600 bytes) || 7800h || <small>Note: eFlash region table & all dev_flash regions are encrypted with a per console keys by ENCDEC device. | ||
magic header :0x0F00010 00 00 00 00 0F AC E0 FF 00 00 00 00 DE AD FA CE .....¬ая....Ю.ъО</small> | |||
|- | |- | ||
| {{ | | {{perconsole}} || 0 || colspan="2" | eFlash region table || 0x0F000C0 || || || || || <small>There are 5 regions: /dev_flash, /dev_flash2, /dev_flash3, OtherOS & Unknown/FF-region. Note: first 0x40000 bytes not counted because of masking bootldr by HV.</small> | ||
|- | |- | ||
| {{perconsole}} || | | {{perconsole}} || 1 || {{perfirmware}} || /dev_flash (FAT16) [[Hypervisor_Reverse_Engineering#GameOS.27s_dev_flash|GameOS devflash]] || 0x0F40000 || 0xD6FFFFF || 0xC7C0000 || (209,453,056 bytes) || || <small>offset taken from region table (0x7800*0x200+0x40000=0x0F40000)</small> | ||
|- | |- | ||
| {{perconsole}} || || | | {{perconsole}} || 2 || {{generic}} || /dev_flash2 (FAT16) [[XRegistry.sys|XRegistry]] || 0xD700000 || 0xE6FFFFF || 0x1000000 || (16,777,216 bytes) || || <small>offset taken from region table (0x6B600*0x200+0x40000=0xD700000)</small> | ||
|- | |- | ||
| {{perconsole}} || || | | {{perconsole}} || 3 || {{perfirmware}} || /dev_flash3 (FAT12) [[Hypervisor_Reverse_Engineering#Content_Revocation_List_.28CRL.29|CRL]]/[[Hypervisor_Reverse_Engineering#Drive_Revocation_List_.28DRL.29|DRL]] || 0xE700000 || 0xE77FFFF || 0x80000 || (524,288 bytes) || || <small>offset taken from region table (0x73600*0x200+0x40000=0xE700000)</small> | ||
|- | |- | ||
| {{ | | {{generic}} || 4 || {{generic}} || [[Flash:cell_ext_os_area|cell_ext_os_area]] || 0xE780000 || 0xE78000F || 0x10 || (16 bytes) || 73C00h || <small>magic header : 0xE780000 63 65 6C 6C 5F 65 78 74 5F 6F 73 5F 61 72 65 61 cell_ext_os_area</small> | ||
|- | |- | ||
| {{generic}} || | | {{generic}} || || {{generic}} || [[Flash:OtherOS|OtherOS]] || 0xE780800 || ~varies || ~varies || ~varies || 73C04h || <small>OtherOS loader/init.rd</small> | ||
|- | |- | ||
| {{generic}} || | | {{generic}} || 5 || {{generic}} || Unknown/FF-region || 0xEFC0000 || 0xEFFFFFF || 0x40000 || (262,144 bytes) || 77E00h || | ||
|- | |- | ||
| {{perconsole}} || colspan="3" | [[Flash:bootldr|bootldr]] || 0xF000000 || 0xF03FFFF || 0x40000 || (262,144 bytes) || <small><abbr title="length of bootldr data seems notated @ offset 0x2-0x3">datasize</abbr> depends on bootldr revision</small> | | {{perconsole}} || colspan="3" | [[Flash:bootldr|bootldr]] || 0xF000000 || 0xF03FFFF || 0x40000 || (262,144 bytes) || 78000h || <small><abbr title="length of bootldr data seems notated @ offset 0x2-0x3">datasize</abbr> depends on bootldr revision</small> | ||
|- | |- | ||
| {{perconsole}} || || F || [[Flash:unreferenced_area|unreferenced area]] || 0xF040000 || 0xFFFFFFF || 0xFC0000 || (16,515,072 bytes) || | | {{perconsole}} || || F || [[Flash:unreferenced_area|unreferenced area]] || 0xF040000 || 0xFFFFFFF || 0xFC0000 || (16,515,072 bytes) || 78200h || | ||
|- | |- | ||
|}<br />< | |}<br /> | ||
== Notes == | |||
*All offsets on the index page are absolute. Offsets on subpages are relative within each section (unless otherwise mentioned) | |||
*eMMC is mapped in the same way as NAND. It uses 256Mb, the GameOS deviceID is identical & all the NAND offsets from the table above can be safely used. | |||
*NOR and NAND are [http://en.wikipedia.org/wiki/Block_%28data_storage%29 blockdevices] and thus: | |||
**The minimal chunk of data that can be read/written is a block (with flashdevices also named page). A block that has never been written (only erased/formatted) is filled with 0xFF's. When bytes are written to a block, the entire block must be written. The write process fills the nonused bytes (slack space) at the remainder of the block with 0x00's | |||
**1 block = 512 bytes (0x200) which conveniently correlates to the standard [http://en.wikipedia.org/wiki/Disk_sector sectorsize] used on magneto/optical drives | |||
== Common Flash Interface (CFI) == | |||
An access to the common flash interface can be enabled by writing to the physical address space of flash memory device, for example, you can use ps3sbmmio driver on Linux. | |||
Enter CFI | |||
{{Keyboard|content=<syntaxhighlight lang="bash"> | |||
printf '\x98\x98' | dd of=/dev/ps3sbmmio bs=1 count=2 seek=$((0x1f0000aa)) | |||
</syntaxhighlight>}} | |||
Dump CFI tables | |||
{{Keyboard|content=<syntaxhighlight lang="bash"> | |||
for i in {0..127}; do dd if=/dev/ps3sbmmio bs=1 count=1 skip=$((0x1f000001+$i*2)) >> cfi_tables.bin 2>/dev/null; done; | |||
xxd cfi_tables.bin | |||
</syntaxhighlight>}} | |||
Exit from CFI | |||
{{Keyboard|content=<syntaxhighlight lang="bash"> | |||
printf '\xf0\xf0' | dd of=/dev/ps3sbmmio bs=1 count=2 seek=$((0x1f000000)) | |||
</syntaxhighlight>}} | |||
Here is an output from Slim console (JTP-001): | |||
'''Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F''' | |||
0000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | |||
0000010 <abbr title="'QRY' magic - CFI Query Identification String table">51 52 59</abbr> <abbr title="Manufacturer ID - Lower Byte">02</abbr> <abbr title="Manufacturer ID - Upper Byte">00</abbr> <abbr title="Starting Address for “Primary Vendor-Specific Extended Query” table - Lower Byte">40</abbr> <abbr title="Starting Address for “Primary Vendor-Specific Extended Query” table - Upper Byte">00</abbr> <abbr title="Alternate Manufacturer ID - Lower Byte">00</abbr> <abbr title="Alternate Manufacturer ID - Upper Byte">00</abbr> <abbr title="Starting Address for 'Alternate Vendor-Specific Extended Query' table - Upper Byte">00</abbr> <abbr title="Starting Address for 'Alternate Vendor-Specific Extended Query' table - Lower Byte">00</abbr> <abbr title="VCC lower limit">27</abbr> <abbr title="VCC upper limit">36</abbr> <abbr title="VPP lower limit (00 on single supply devices)">00</abbr> <abbr title="VCC upper limit (00 on single supply devices)">00</abbr> <abbr title="typical word programming time from Erase and Programming Performance table in datasheet (2powerN μs)">06</abbr> QRY..@.....'6... | |||
0000020 <abbr title="typical buffer programming time (2powerN μs)">06</abbr> <abbr title="typical sector erase time (2powerN ms)">09</abbr> <abbr title="typical chip erase time (2powerN ms)">10</abbr> <abbr title="maximum word programming time (2powerN * typical word programming time)">03</abbr> <abbr title="maximum buffer programming time (2powerN * typical buffer programming time)">05</abbr> <abbr title="maximum sector erase time (2powerN * typical sector erase time)">03</abbr> <abbr title="maximum chip erase time (2powerN * typical chip erase time)">02</abbr> <abbr title="device density in 2powerN bytes">18</abbr> <abbr title="x8/x16 interface - Lower Byte">02</abbr> <abbr title="x8/x16 interface - Upper Byte">00</abbr> <abbr title="Buffer length - Lower Byte (2powerN)">06</abbr> <abbr title="Buffer length - Upper Byte (2powerN)">00</abbr> <abbr title="Number of Erase Block Regions">01</abbr> <abbr title="Region1: Number of sectors - Lower Byte">7f</abbr> <abbr title="Region1: Number of sectors - Upper Byte">00</abbr> <abbr title="Region1: Density - Lower Byte">00</abbr> ................ | |||
0000030 <abbr title="Region1: Density - Upper Byte">02</abbr> <abbr title="Region2: Number of sectors - Lower Byte">00</abbr> <abbr title="Region2: Number of sectors - Upper Byte">00</abbr> <abbr title="Region2: Density - Lower Byte">00</abbr> <abbr title="Region2: Density - Upper Byte">00</abbr> <abbr title="Region3: Number of sectors - Lower Byte">00</abbr> <abbr title="Region3: Number of sectors - Upper Byte">00</abbr> <abbr title="Region3: Density - Lower Byte">00</abbr> <abbr title="Region3: Density - Upper Byte">00</abbr> <abbr title="Region4: Number of sectors - Lower Byte">00</abbr> <abbr title="Region4: Number of sectors - Upper Byte">00</abbr> <abbr title="Region4: Density - Lower Byte">00</abbr> <abbr title="Region4: Density - Upper Byte">00</abbr> ff ff ff ................ | |||
0000040 <abbr title="'PRI' magic - Primary Vendor-Specific Extended Query table">50 52 49</abbr> <abbr title="CFI major version number in ASCII">31</abbr> <abbr title="CFI minor version number in ASCII">33</abbr> <abbr title="Address Sensitive Lock / Process technology">14</abbr> <abbr title="Erase Suspend support">02</abbr> <abbr title="Sector Group">01</abbr> <abbr title="Temporary Sector Unprotect support">00</abbr> <abbr title="Sector Protection Scheme">08</abbr> <abbr title="Number of Sectors Outside Bank 1">00</abbr> <abbr title="Burst Mode support">00</abbr> <abbr title="Page Mode support">02</abbr> <abbr title="Acceleration Power Supply Voltage lower limit">b5</abbr> <abbr title="Acceleration Power Supply Voltage upper limit">c5</abbr> <abbr title="Sector and WP# Pin Protection Scheme">04</abbr> PRI13........... | |||
0000050 <abbr title="Program Suspend support">01</abbr> ff ff ff ff ff ff <abbr title="Number of Banks (ff when nonbanked)">ff</abbr> <abbr title="Number of sectors in Bank A (ff when nonbanked)">ff</abbr> <abbr title="Number of sectors in Bank B (ff when nonbanked)">ff</abbr> <abbr title="Number of sectors in Bank C (ff when nonbanked)">ff</abbr> <abbr title="Number of sectors in Bank D (ff when nonbanked)">ff</abbr> ff ff ff ff ................ | |||
0000060 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ | |||
0000070 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ | |||
Mouseover for byte usage description as explained in the below linked Spansion Application Note for CFI | |||
=== Reference === | |||
* [http://www.spansion.com/Support/Application%20Notes/Quick_Guide_to_CFI_AN.pdf Quick Guide to Common Flash Interface] | |||
[[Category: | {{Flash}}<noinclude>[[Category:Main]]</noinclude> | ||
Latest revision as of 13:24, 17 June 2022
Overview[edit | edit source]
NOR Flash[edit | edit source]
The following is a list of files stored in NOR Flash
| type | R. | Name | Start Offset | End Offset | Size (h) | Size (bytes) | Block | Notes | ||
|---|---|---|---|---|---|---|---|---|---|---|
| gen | 1 | 0FACE0FF DEADBEEF | 0x000000 | 0x00001FF | 0x200 | (512 bytes) | 0h | magic header : 0x0000010 00 00 00 00 0F AC E0 FF 00 00 00 00 DE AD BE EF .....¬àÿ....Þ¾ï | ||
| gen | Flash Format | 0x000200 | 0x00003FF | 0x200 | (512 bytes) | 1h | 00000200 49 46 49 00 00 00 00 01 00 00 00 02 00 00 00 00 IFI............. (only 0x10 or 16 bytes used) | |||
| pc | Flashregion Table | 0x000400 | 0x0007FF | 0x400 | (1,024 bytes) | 2h | ||||
| pc | 0 | asecure_loader | 0x000800 | 0x02EFFF | 0x2E800 | (262,144 bytes) | 4h | contains metldr, extracted data starts from 0x000840, datasize depends on metldr revision | ||
| pc | 1 | eEID | 0x02F000 | 0x03EFFF | 0x10000 | (65,536 bytes) | 178h | |||
| pc | 0 | EID0 | 0x02F070 | 0x02F8CF | 0x860 | (2,144 bytes) | (IDPS @ offset 0x0002F070 absolute / 0x00000070 inside eEID ) | |||
| pc | 1 | EID1 | 0x02F8D0 | 0x02FB6F | 0x2A0 | (672 bytes) | ||||
| pc | 2 | EID2 | 0x02FB70 | 0x03029F | 0x730 | (1,840 bytes) | ||||
| pc | 3 | EID3 | 0x0302A0 | 0x03039F | 0x100 | (256 bytes) | ||||
| pc | 4 | EID4 | 0x0303A0 | 0x0303CF | 0x30 | (48 bytes) | ||||
| pc | 5 | EID5 | 0x0303D0 | 0x030DCF | 0xA00 | (2,560 bytes) | ||||
| pc | F | unreferenced area | 0x030DD0 | 0x03EFFF | 0xE22F | (57,903 bytes) | ||||
| pc | 2 | cISD | 0x03F000 | 0x03F7FF | 0x800 | (2,048 bytes) | 1F8h | |||
| pc | 0 | cISD0 | 0x03F040 | 0x03F060 | 0x20 | (32 bytes) | ||||
| pc | 1 | cISD1 | 0x03F060 | 0x03F260 | 0x200 | (512 bytes) | console 2nd part serial @ 0x3F090 size 0x8 | |||
| pc | 2 | cISD2 | 0x03F260 | 0x03F270 | 0x10 | (16 bytes) | ||||
| pc | F | unreferenced area | 0x03F270 | 0x03F7FF | 0x58F | (1,423 bytes) | ||||
| pc | 3 | cCSD | 0x03F800 | 0x03FFFF | 0x800 | (2,048 bytes) | 1FCh | |||
| pc | 0 | cCSD0 | 0x03F820 | 0x03F84F | 0x30 | (48 bytes) | ||||
| pc | F | unreferenced area | 0x03F850 | 0x03FFFF | 0x7B0 | (1,968 bytes) | ||||
| pf | 4 | trvk_prg0 | 0x040000 | 0x05FFFF | 0x20000 | (131,072 bytes) | 200h | |||
| pf | 5 | trvk_prg1 | 0x060000 | 0x07FFFF | 0x20000 | (131,072 bytes) | 300h | |||
| pf | 6 | trvk_pkg0 | 0x080000 | 0x09FFFF | 0x20000 | (131,072 bytes) | 400h | |||
| pf | 7 | trvk_pkg1 | 0x0A0000 | 0x0BFFFF | 0x20000 | (131,072 bytes) | 500h | |||
| pf | 8 | ros0 | 0x0C0000 | 0x7BFFFF | 0x700000 | (7,340,032 bytes) | 600h | Contains CoreOS files, filecontent depends on firmware version | ||
| pf | 9 | ros1 | 0x7C0000 | 0xEBFFFF | 0x700000 | (7,340,032 bytes) | 3E00h | Contains CoreOS files, filecontent depends on firmware version | ||
| pc | A | cvtrm | 0xEC0000 | 0xEFFFFF | 0x40000 | (262,144 bytes) | 7600h | |||
| gen | 2 | 0FACE0FF DEADFACE | 0xF00000 | 0xF00FFF | 0x1000 | (4096 bytes) | 7800h | magic header : 0xF00010 00 00 00 00 0F AC E0 FF 00 00 00 00 DE AD FA CE .....¬àÿ....ÞúÎ | ||
| gen | CELL_EXTNOR_AREA | 0xF20000 | 0xF3FFFF | 0x20000 | (131,072 bytes) | 7900h | (Harddrive information is @ 0xF20200 absolute / 0x200 inside CELL_EXTNOR_AREA) | |||
| gen | CRL1 | 0xF40000 | 0xF5FFFF | 0x20000 | (131,072 bytes) | 7A00h | same as F80000 | |||
| gen | DRL1 | 0xF60000 | 0xF7FFFF | 0x20000 | (131,072 bytes) | 7B00h | same as FA0000 / sometimes also contains OCRL0200 | |||
| gen | CRL2 | 0xF80000 | 0xF9FFFF | 0x20000 | (131,072 bytes) | 7C00h | same as F40000 | |||
| gen | DRL2 | 0xFA0000 | 0xFBFFFF | 0x20000 | (131,072 bytes) | 7D00h | same as F60000 / sometimes also contains OCRL0200 | |||
| pc | lv0ldr | bootldr | 0xFC0000 | 0xFFFFFF | 0x40000 | (262,144 bytes) | 7E00h | End @ FEEAF0, FEEF70, FEF170, FEF570, FEF5F0, FEF600 in some dumps | ||
NAND Flash[edit | edit source]
The following is a list of files stored in NAND Flash
| type | Name | Start Offset | End Offset | Size (h) | Size (bytes) | Block | Notes | ||
|---|---|---|---|---|---|---|---|---|---|
| pc | bootldr | 0x0000000 | 0x003FFFF | 0x40000 | (262,144 bytes) | 0h | datasize depends on bootldr revision | ||
| gen | 0FACE0FF DEADBEEF | 0x0040000 | 0x00401FF | 0x200 | (512 bytes) | 200h | magic header : 0x040010 00 00 00 00 0F AC E0 FF 00 00 00 00 DE AD BE EF .....¬àÿ....Þ¾ï | ||
| pc | Flashregion Table | 0x0040200 | 0x00407FF | 0x600 | (1,536 bytes) | 201h | |||
| pc | 0 | asecure_loader | 0x0040800 | 0x00807FF | 0x40000 | (262,144 bytes) | 204h | contains metldr, extracted data starts from 0x040840, datasize depends on metldr revision | |
| pc | 1 | eEID | 0x0080800 | 0x00907FF | 0x10000 | (65,536 bytes) | 404h | ||
| pc | 0 | EID0 | 0x0080870 | 0x00810CF | 0x860 | (2,144 bytes) | (IDPS @ offset 0x00080870 absolute / 0x00000070 inside eEID ) | ||
| pc | 1 | EID1 | 0x00810D0 | 0x008136F | 0x2A0 | (672 bytes) | |||
| pc | 2 | EID2 | 0x0081370 | 0x0081A9F | 0x730 | (1,840 bytes) | |||
| pc | 3 | EID3 | 0x0081AA0 | 0x0081B9F | 0x100 | (256 bytes) | |||
| pc | 4 | EID4 | 0x0081BA0 | 0x0081BCF | 0x30 | (48 bytes) | |||
| pc | 5 | EID5 | 0x0081BD0 | 0x00825CF | 0xA00 | (2,560 bytes) | |||
| pc | F | unreferenced area | 0x00825D0 | 0x00907FF | 0xE22F | (57,903 bytes) | |||
| pc | 2 | cISD | 0x0090800 | 0x0090FFF | 0x800 | (2,048 bytes) | 484h | ||
| pc | 0 | cISD0 | 0x0090840 | 0x009085F | 0x20 | (32 bytes) | |||
| pc | 1 | cISD1 | 0x0090860 | 0x0090A5F | 0x200 | (512 bytes) | console 2nd part serial @ 0x90890 size 0x8 | ||
| pc | 2 | cISD2 | 0x0090A60 | 0x0090A6F | 0x10 | (16 bytes) | |||
| pc | F | unreferenced area | 0x0090A70 | 0x0090FFF | 0x58F | (1,423 bytes) | |||
| pc | 3 | cCSD | 0x0091000 | 0x00917FF | 0x800 | (2,048 bytes) | 488h | ||
| pc | 0 | cCSD0 | 0x0091020 | 0x009104F | 0x30 | (48 bytes) | |||
| pc | F | unreferenced area | 0x0091050 | 0x00917FF | 0x7B0 | (1,968 bytes) | |||
| pf | 4 | trvk_prg | 0x0091800 | 0x00937FF | 0x2000 | (8,192 bytes) | 48Ch | extracted size is 0x2000 for trvk_prg0 + trvk_prg1 combined as trvk_prg (8,192 bytes) | |
| pf | 5 | trvk_pkg | 0x0093800 | 0x00957FF | 0x2000 | (8,192 bytes) | 49Ch | extracted size is 0x2000 for trvk_pkg0 + trvk_pkg1 combined as trvk_pkg (8,192 bytes) | |
| gen | 6 | creserved_0 | 0x0095800 | 0x00BFFFF | 0x2A800 | (174,080 bytes) | 4ACh | ||
| pf | 7 | ros | 0x00C0000 | 0x0EBFFFF | 0xE00000 | (14,680,064 bytes) | 600h | ||
| pf | 0 | ros0 | 0x00C0020 | 0x07C000F | 0x6FFFF0 | (7,340,016 bytes) | Contains CoreOS files, filecontent depends on firmware version | ||
| pf | 1 | ros1 | 0x07C0010 | 0x0EBFFFF | 0x6FFFF0 | (7,340,016 bytes) | Contains CoreOS files, filecontent depends on firmware version | ||
| pc | 8 | cvtrm | 0x0EC0000 | 0x0EFFFFF | 0x40000 | (262,144 bytes) | |||
| pc | M | SCEIVTRM | 0x0EC0000 | 0x0EC000F | 0x10 | (16 bytes) | magic header : 0x0D80000 53 43 45 49 56 54 52 4D 00 00 00 00 00 00 00 A8 SCEIVTRM.......¨ | ||
| pc | 0 | VTRM0 | ~varies | ~varies | ~varies | ~varies | magic header : 0x0D80020 00 00 00 00 56 54 52 4D 00 00 00 00 00 00 00 04 ....VTRM........ | ||
| pc | 1 | VTRM1 | ~varies | ~varies | ~varies | ~varies | magic header : 0x0D80400 00 00 00 00 56 54 52 4D 00 00 00 00 00 00 00 04 ....VTRM........ | ||
| pc | eFlash area | 0x0F00000 | 0xEFFFFFF | 0xE100000 | (235,929,600 bytes) | 7800h | Note: eFlash region table & all dev_flash regions are encrypted with a per console keys by ENCDEC device.
magic header :0x0F00010 00 00 00 00 0F AC E0 FF 00 00 00 00 DE AD FA CE .....¬ая....Ю.ъО | ||
| pc | 0 | eFlash region table | 0x0F000C0 | There are 5 regions: /dev_flash, /dev_flash2, /dev_flash3, OtherOS & Unknown/FF-region. Note: first 0x40000 bytes not counted because of masking bootldr by HV. | |||||
| pc | 1 | pf | /dev_flash (FAT16) GameOS devflash | 0x0F40000 | 0xD6FFFFF | 0xC7C0000 | (209,453,056 bytes) | offset taken from region table (0x7800*0x200+0x40000=0x0F40000) | |
| pc | 2 | gen | /dev_flash2 (FAT16) XRegistry | 0xD700000 | 0xE6FFFFF | 0x1000000 | (16,777,216 bytes) | offset taken from region table (0x6B600*0x200+0x40000=0xD700000) | |
| pc | 3 | pf | /dev_flash3 (FAT12) CRL/DRL | 0xE700000 | 0xE77FFFF | 0x80000 | (524,288 bytes) | offset taken from region table (0x73600*0x200+0x40000=0xE700000) | |
| gen | 4 | gen | cell_ext_os_area | 0xE780000 | 0xE78000F | 0x10 | (16 bytes) | 73C00h | magic header : 0xE780000 63 65 6C 6C 5F 65 78 74 5F 6F 73 5F 61 72 65 61 cell_ext_os_area |
| gen | gen | OtherOS | 0xE780800 | ~varies | ~varies | ~varies | 73C04h | OtherOS loader/init.rd | |
| gen | 5 | gen | Unknown/FF-region | 0xEFC0000 | 0xEFFFFFF | 0x40000 | (262,144 bytes) | 77E00h | |
| pc | bootldr | 0xF000000 | 0xF03FFFF | 0x40000 | (262,144 bytes) | 78000h | datasize depends on bootldr revision | ||
| pc | F | unreferenced area | 0xF040000 | 0xFFFFFFF | 0xFC0000 | (16,515,072 bytes) | 78200h | ||
Notes[edit | edit source]
- All offsets on the index page are absolute. Offsets on subpages are relative within each section (unless otherwise mentioned)
- eMMC is mapped in the same way as NAND. It uses 256Mb, the GameOS deviceID is identical & all the NAND offsets from the table above can be safely used.
- NOR and NAND are blockdevices and thus:
- The minimal chunk of data that can be read/written is a block (with flashdevices also named page). A block that has never been written (only erased/formatted) is filled with 0xFF's. When bytes are written to a block, the entire block must be written. The write process fills the nonused bytes (slack space) at the remainder of the block with 0x00's
- 1 block = 512 bytes (0x200) which conveniently correlates to the standard sectorsize used on magneto/optical drives
Common Flash Interface (CFI)[edit | edit source]
An access to the common flash interface can be enabled by writing to the physical address space of flash memory device, for example, you can use ps3sbmmio driver on Linux.
Enter CFI
printf '\x98\x98' | dd of=/dev/ps3sbmmio bs=1 count=2 seek=$((0x1f0000aa))
Dump CFI tables
for i in {0..127}; do dd if=/dev/ps3sbmmio bs=1 count=1 skip=$((0x1f000001+$i*2)) >> cfi_tables.bin 2>/dev/null; done; xxd cfi_tables.bin
Exit from CFI
printf '\xf0\xf0' | dd of=/dev/ps3sbmmio bs=1 count=2 seek=$((0x1f000000))
Here is an output from Slim console (JTP-001):
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0000010 51 52 59 02 00 40 00 00 00 00 00 27 36 00 00 06 QRY..@.....'6... 0000020 06 09 10 03 05 03 02 18 02 00 06 00 01 7f 00 00 ................ 0000030 02 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ................ 0000040 50 52 49 31 33 14 02 01 00 08 00 00 02 b5 c5 04 PRI13........... 0000050 01 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ 0000060 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ 0000070 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
Mouseover for byte usage description as explained in the below linked Spansion Application Note for CFI
Reference[edit | edit source]
| |||||||||||||||||||||||||||||||||||||||||||||
