Talk:Hypervisor Reverse Engineering: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
m (→‎RSXFIFOCommands: new section)
m (Text replacement - "→‎/TEMPORARY" to "/: http://ps3devwiki.com/files")
 
(57 intermediate revisions by 20 users not shown)
Line 1: Line 1:
Merge needed of info from:
[https://web.archive.org/web/20130623170001/https://webcache.googleusercontent.com/search?q=cache:http%3A%2F%2Fwiki.gitbrew.org%2Fwikibrew%2FPS3%3AHvReverseEngineering wiki.gitbrew.org]
and
[https://web.archive.org/web/20111217183835/http://www.ps3devwiki.com/index.php?title=Talk:Hypervisor_Reverse_Engineering]


=emer init.self=
== MMIO / Memorymap ==
{| class="wikitable sortable"
|-
! Physical Address !! Size !! <abbr title="DeviceID">ID</abbr> !! Usage !! Address<br />in HV dump<br />(3.15) !! Notes
|-
| 0x800000 || 0x20000 ||  || LV0 Code Region || ||
|-
| 0x200000 || 0x400000 ||  || LV1 Code Region || ||
|-
| 0x8000000 / 0x1000000(DECR) || 0x800000 || || LV2 Region || || The region you get when you dump lv2
|-
| 0x20000000000 || 0x80000 ||  || SPE0 MMIO Memory Region || || (be.0.bp_base)
|-
| 0x20000080000 || 0x80000 ||  || SPE1 MMIO Memory Region || 0x003ABC20 ||
|-
| 0x20000100000 || 0x80000 ||  || SPE2 MMIO Memory Region || 0x003AAD70 ||
|-
| 0x20000180000 || 0x80000 ||  || SPE3 MMIO Memory Region || 0x003A8880 || panic on read
|-
| 0x20000200000 || 0x80000 ||  || SPE4 MMIO Memory Region || 0x003B4F70 ||
|-
| 0x20000280000 || 0x80000 ||  || SPE5 MMIO Memory Region || 0x003AB700 ||
|-
| 0x20000300000 || 0x80000 ||  || SPE6 MMIO Memory Region || 0x003B5BE0 ||
|-
| 0x20000509000 || 0x1000 ||  || Pervasive Memory ||  || Contains 48 bit Serial Number at position 0xC80 size 0x08
|-
|  || 0x1000 ||  || SPE1 Shadow Registers Memory Region || 0x003ABDA0 ||
|-
|  || 0x1000 ||  || SPE2 Shadow Registers Memory Region || 0x003B4290 ||
|-
|  || 0x1000 ||  || SPE3 Shadow Registers Memory Region || 0x003A8A00 ||
|-
|  || 0x1000 ||  || SPE4 Shadow Registers Memory Region || 0x003B50F0 ||
|-
|  || 0x1000 ||  || SPE5 Shadow Registers Memory Region || 0x001FFC90 ||
|-
|  || 0x1000 ||  || SPE6 Shadow Registers Memory Region || 0x003AE5B0 ||
|-
| 0x2000050A0C8 || 0x4 || || XDR Memory Channel Size (Type 1) || || Shift right 49 and add 0x20 for size.
|-
| 0x2000050A188 || 0x4 || || XDR Memory Channel Size (Type 0) || || Shift right 49 and add 0x20 for size.
|-
| 0x2000050A210 || 0x4 || || XDR Memory Channel Type || || For use with above memory locations
|-
| 0x24000000000 ||  ||  || SB bus subsystem ||  || (be.0.ioif1.addr)
|-
| 0x24000002000 || 0x200 || 1 || SATA Controller 1 ||  ||
|-
| 0x24000002200 || 0x200 || 2 || SATA Controller 2 ||  ||
|-
| 0x24000002400 || 0x200 || 3 || USB Controller 1 ||  ||
|-
| 0x24000002600 || 0x200 || 4 || USB Controller 2 ||  ||
|-
| 0x24000002800 || 0x200 || 0 || Gelic Device ||  ||
|-
| 0x24000002C00 || 0x200 || 7 || ENCDEC Device ||  ||
|-
| 0x24000008000 || 0x1000 ||  || SB bus External interrupt controller ||  || Found while looking at linux kernel src. (spider-pic.c)
|-
| 0x24000008100 ||  ||  || SB bus interrupt handler || 0x002B9CC4 ||
|-
| 0x24000008104 ||  ||  || SB bus interrupt handler ||  ||
|-
| 0x24000087000 || || || SB status/info || ||
|-
| 0x2400008C000 || || || SYSCON (receive packetheader) ||  ||
|-
| 0x2400008C010 || || || SYSCON (receive packetbody) ||  ||
|-
| 0x2400008CFF0 || || || SYSCON (receive ?) ||  ||
|-
| 0x2400008CFF4 || || || SYSCON (send ?) ||  ||
|-
| 0x2400008D000 || || || SYSCON (send  packetheader)||  ||
|-
| 0x2400008D010 || || || SYSCON (send packetbody) ||  ||
|-
| 0x2400008DFF0 || || || SYSCON (send ?) ||  ||
|-
| 0x2400008DFF4 || || || SYSCON (receive ?) ||  ||
|-
| 0x2400008E000 || || || SYSCON (receive ?) ||  ||
|-
| 0x2400008E004 || || || SYSCON (receive test bit 0x2) ||  ||
|-
| 0x2400008E100 || || || SYSCON (send notify) ||  ||
|-
| 0x24003000000 || 0x1000 || 1 || SATA Controller 1 ||  ||
|-
| 0x24003001000 || 0x1000 || 2 || SATA Controller 2 ||  ||
|-
| 0x24003004000 || 0x1000 || 0 || Gelic Device ||  ||
|-
| 0x24003005000 || 0x1000 || 7 || ENCDEC Device ||  ||
|-
| 0x24003005200 || 0x4 || 7 || ENCDEC Device ||  || 0 != ENCDEC Test Mode
|-
| 0x24003006000 || 0x1000 || 7 || ENCDEC Device ||  ||
|-
| 0x240030060A0 || 0x4 || 7 || ENCDEC Device ||  || EdecKgenFlash Command (0x84)
|-
| 0x24003010000 || 0x10000 || 3 || USB Controller 1 || 0x001FDF00 ||
|-
| 0x24003020000 || 0x10000 || 4 || USB Controller 2 || 0x003B3850 ||
|-
| 0x24003800000 || 0x1000 || 1 || SATA Controller 1 ||  ||
|-
| 0x24003801000 || 0x1000 || 2 || SATA Controller 2 ||  ||
|-
| 0x24003802000 || 0x1000 || 1 || SATA Controller 1 ||  ||
|-
| 0x24003803000 || 0x1000 || 2 || SATA Controller 2 ||  ||
|-
| 0x24003810000 || 0x10000 || 3 || USB Controller 1 || 0x003B6E50 ||
|-
| 0x24003820000 || 0x10000 || 4 || USB Controller 2 || 0x003B9950 ||
|-
| 0x2401F000000 || 0x1000000 || || NOR Flash || ||
|-
| 0x2401FC00000 || 0x40000 || || SYS ROM || || lv0ldr/bootldr
|-
| 0x28000000000 || 0x2000 ||  || AV Manager (/dev/ioif0) ||  || (be.0.ioif0.addr) only mmap system call
|-
| 0x28001800000 || 0x1000 ||  || AV Manager (/dev/ioif0) ||  || only mmap system call
|-
| 0x28000600000 || 0x4000 ||  || AV Manager (/dev/ioif0) - Output Control Registers ||  || only mmap system call. First 0x2000 for head 0. Next 0x2000 for head 1.
|-
| 0x28000680000 || 0x4000 ||  || AV Manager (/dev/ioif0) - PLL Control Registers ||  || only mmap system call. First 0x2000 for head 0. Next 0x2000 for head 1.
|-
| 0x28000080000 || 0x8000 ||  || AV Manager (/dev/ioif0) ||  || only mmap system call
|-
| 0x28000088000 || 0x1000 ||  || AV Manager (/dev/ioif0) ||  || only mmap system call
|-
| 0x2800000C000 || 0x1000 ||  || AV Manager (/dev/ioif0) ||  || only mmap system call
|-
| 0x2800008A000 || 0x1000 ||  || AV Manager (/dev/ioif0) ||  || only mmap system call
|-
| 0x2800008C000 || 0x1000 ||  || AV Manager (/dev/ioif0) ||  || only mmap system call
|-
| 0x28080000000 || 0xFE00000 || 1 || GPU Device Memory Region || 0x003AF380 ||
|-
| 0x3C0000 || 0xC000 || 2 || GPU Device Memory Region || 0x003AF500 ||
|-
| 0x2808FE00000 || 0x40000 || 3 || GPU Device Memory Region || 0x003AF680 ||
|-
| 0x28000C00000 || 0x20000 || 4 || GPU Device Memory Region || 0x003AFC30 ||
|-
| 0x28000080100 || 0x8000 || 5 || GPU Device Memory Region || 0x003BB420 ||
|-
| 0x2808FC00000 || 0x400000 || || RSX Internal State Memory Area (All) || ||
|-
| 0x2808FF80000 || 0x80000 || || RAMIN (Encompasses RAMHT,RAMFC,DMA Objects, Graphic Objects and GRAPH) || ||
|-
| 0x2808FF90000 || 0x4000 || || RAM Hash Table || ||
|-
| 0x2808FFA0000 || 0x1000 || || RAM FIFO Context || ||
|-
| 0x2808FFC0000 || 0x10000 || || DMA Objects || ||
|-
| 0x2808FFD0000 || 0x10000 || || Graphic Objects || ||
|-
| 0x2808FFE0000 || 0x10000 || || Graphic Context || ||
|-
|  ||  || 9 || FLASH Controller device (StarShip - SS) ||  || FLASH controller doesn't have MMIO regions
|-
| 0x000000000000 || 0x1000000 ||  || GameOS ||  ||
|-
| 0x700020000000 || 0xA0000 ||  || GameOS ||  ||
|-
| 0x700020000000 || 0xE900000 ||  || GameOS ||  ||
|-
| 0x800000000F000000 || 0x40000 ||  || GameOS HTAB ||  ||
|-
|}
 
* Linux driver for playing with BE MMIO: http://pastie.org/private/zkzpmj5j6hixacxppk9waq [https://pastebin.com/Y6ZEDdi3 mirror]
 
== PS3 ea memory map ==
<pre>
  0xFFFF_FFFF  +-------------------------------+
              | SPU Thread Mapping Area      | 
  0xF000_0000  +-------------------------------+
              | Raw SPU Mapping Area          | 
  0xE000_0000  +-------------------------------+
              | User Area                    | 
  0xD000_0000  +-------------------------------+
              | RSX Frame Buffer Mapping Area | 
  0xC000_0000  +-------------------------------+
              | MMapper Fixed Area            | 
  0xB000_0000  +-------------------------------+
              |                              | 
              | User Area (heap, ...)        | 
              |                              | 
              |                              | 
              |                              | 
  0x5000_0000  +-------------------------------+
              | PPU/SPU Local Segment        | 
              | (.ppu_data)                  | 
  0x4001_0000  +-------------------------------+
              | PPU/SPU Local Segment        | 
              | (.ppu_rodata)                | 
  0x4000_0000  +-------------------------------+
              | PPU/SPU/RSX Shared Segment    | 
              | (.sdata, .rsx_image)          | 
  0x3001_0000  +-------------------------------+
              | PPU/SPU/RSX Shared Segment    | 
              | (.srodata, .rsx_image)        | 
  0x3000_0000  +-------------------------------+
              | PPU/SPU Shared Segment        | 
              | (.text, .data, .bss, ...)    | 
  0x0001_0000  +-------------------------------+
              | Unmapped Area                | 
  0x0000_0000  +-------------------------------+
</pre>
 
https://web.archive.org/web/20141119024023/http://pastie.org/private/bfqqa2cpadolns9bm0eqa
 
== History of Packet ID Entries ==
 
* 0x18000 <- [[Dispatcher_Manager]]
* 0x8000  <- ???
* 0x17000 <- [[Indi_Info_Manager]]
* 0x10000 <- [[SB_Manager]]
* 0x9000  <- [[SC_Manager]]
* 0x14000 <- [[Secure_LPAR_Loader]]
* 0x15000 <- [[Secure_Profile_Loader]]
* 0x3000  <- [[Secure_RTC_Manager]]
* 0x5000  <- [[Storage_Manager]]
* 0x11000 <- [[Security_Policy_Manager]]
* 0x6000  <- [[Update_Manager]]
* 0x2000  <- [[Virtual_TRM_Manager]]
* 0x19000 <- [[AIM_Manager]]
* 0x22000 <- [[Factory_Data_Manager]]
* 0x24000 <- [[USB_Dongle_Authenticator]]
* 0x25000 <- [[User_Token_Manager]]
* 0x84000 <- http://paste.ubuntu.com/25395752/
 
from SPM
 
[http://pastie.org/private/mdw6lcgcp6sby1qvlipog possible process names][https://pastebin.com/1Z1vG23V]
[http://pastie.org/private/guigb77nctwvsq50tkaeq possible process / packet ids 1][https://pastebin.com/D8VeZ02B]
[http://pastie.org/private/j7cv141bu5jw2acundzla possible process / packet ids 2][https://pastebin.com/fy4KZfmJ]
 
==coolstuf==
Graf_Chokolo's HV BIBLE .rar    163 MB
Torrent InfoHash (Base16): 8E0FC6B483D8439BC7E1D6148632022DC390CE19
Torrent InfoHash (Base32): RYH4NNED3BBZXR7B2YKIMMQCFXBZBTQZ
coolstuff.rar (172474327 Bytes)
SHA1: F8DF8A5D6ABEFD20CE02EFE883D22FE90CC11845
MD5: C0976820D0F4DA9D0C8674083E7F8B36
CRC32: 7CAECB85  /  CRC16: 69BB
 
Repositories:
* https://www.sendspace.com/file/klddg3
* http://www.sendspace.com/file/qlkzkd
* http://www.mirrorcreator.com/files/0NFBM0PC/coolstuff_0.rar_links
* http://www.mirrorcreator.com/files/0ROETOUP/coolstuff.rar_links
* http://fileape.com/index.php?act=download&id=aG4VzHXWKqwXbi50
 
* https://web.archive.org/web/*/http://ps3devwiki.com/files/coolstuf/
 
===Content===
<pre>
dump_lv2_reversing/dev_rflash1/dev1_reg0_16MB.bin 16 MB
dump_lv2_reversing/dev_rflash1/dump_files.sh 0.3 KB
dump_lv2_reversing/dev_rflash1/dump_flash_315.bin 16 MB
dump_lv2_reversing/dev_rflash1/files/asecure_loader 0.2 MB
dump_lv2_reversing/dev_rflash1/files/cCSD 2 KB
dump_lv2_reversing/dev_rflash1/files/cISD 2 KB
dump_lv2_reversing/dev_rflash1/files/eEID 64 KB
dump_lv2_reversing/dev_rflash1/files/EID/EID0 2.1 KB
dump_lv2_reversing/dev_rflash1/files/EID/EID1 0.7 KB
dump_lv2_reversing/dev_rflash1/files/EID/EID2 1.8 KB
dump_lv2_reversing/dev_rflash1/files/EID/EID3 0.3 KB
dump_lv2_reversing/dev_rflash1/files/EID/EID4 0 KB
dump_lv2_reversing/dev_rflash1/files/EID/EID5 2.5 KB
dump_lv2_reversing/dev_rflash1/files/metldr 58.3 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/aim_spu_module.self 17.1 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/appldr 0.1 MB
dump_lv2_reversing/dev_rflash1/files/sdk_330/default.spp 8.7 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/emer_init.self 0.5 MB
dump_lv2_reversing/dev_rflash1/files/sdk_330/eurus_fw.bin 0.4 MB
dump_lv2_reversing/dev_rflash1/files/sdk_330/hdd_copy.self 0.4 MB
dump_lv2_reversing/dev_rflash1/files/sdk_330/isoldr 75.7 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/lv0 0.2 MB
dump_lv2_reversing/dev_rflash1/files/sdk_330/lv1.self 1.2 MB
dump_lv2_reversing/dev_rflash1/files/sdk_330/lv1ldr 0.1 MB
dump_lv2_reversing/dev_rflash1/files/sdk_330/lv2ldr 91.5 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/lv2_kernel.self 1.4 MB
dump_lv2_reversing/dev_rflash1/files/sdk_330/mc_iso_spu_module.self 32.1 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/me_iso_spu_module.self 34.2 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/sb_iso_spu_module.self 23.4 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/sc_iso.self 84.8 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/sdk_version 0 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/spp_verifier.self 54 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/spu_pkg_rvk_verifier.self 62.7 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/spu_token_processor.self 23.1 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/spu_utoken_processor.self 25.5 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/sv_iso_spu_module.self 48.1 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/aim_spu_module.self 17.1 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/appldr 0.1 MB
dump_lv2_reversing/dev_rflash1/files/sdk_341/default.spp 8.7 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/emer_init.self 0.5 MB
dump_lv2_reversing/dev_rflash1/files/sdk_341/eurus_fw.bin 0.4 MB
dump_lv2_reversing/dev_rflash1/files/sdk_341/hdd_copy.self 0.4 MB
dump_lv2_reversing/dev_rflash1/files/sdk_341/isoldr 76.1 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/lv0 0.2 MB
dump_lv2_reversing/dev_rflash1/files/sdk_341/lv1.self 1.2 MB
dump_lv2_reversing/dev_rflash1/files/sdk_341/lv1ldr 0.1 MB
dump_lv2_reversing/dev_rflash1/files/sdk_341/lv2ldr 92 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/lv2_kernel.self 1.4 MB
dump_lv2_reversing/dev_rflash1/files/sdk_341/mc_iso_spu_module.self 32.1 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/me_iso_spu_module.self 34.2 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/sb_iso_spu_module.self 23.4 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/sc_iso.self 84.8 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/sdk_version 0 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/spp_verifier.self 54 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/spu_pkg_rvk_verifier.self 62.7 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/spu_token_processor.self 23.1 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/spu_utoken_processor.self 25.5 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/sv_iso_spu_module.self 48.1 KB
dump_lv2_reversing/dev_rflash1/files/trvk_pkg0 0.1 MB
dump_lv2_reversing/dev_rflash1/files/trvk_pkg1 0.1 MB
dump_lv2_reversing/dev_rflash1/files/trvk_prg0 0.1 MB
dump_lv2_reversing/dev_rflash1/files/trvk_prg1 0.1 MB
dump_lv2_reversing/dev_rflash1/toc.txt 4 KB
dump_lv2_reversing/dump_lv2.bin 8 MB
dump_lv2_reversing/dump_lv2.idb 50 MB
dump_lv2_reversing/dump_lv2_315.bin 8 MB
dump_lv2_reversing/dump_lv2_315.idb 38 MB
dump_lv2_reversing/htab/dump_htab.bin 0.3 MB
dump_lv2_reversing/htab/dump_htab.c 1.7 KB
dump_lv2_reversing/htab/dump_htab.exe 18.4 KB
dump_lv2_reversing/htab/dump_htab.txt 2.2 MB
dump_lv2_reversing/lv2_dump3.41debug.bin 8 MB
dump_lv2_reversing/lv2_kernel_341_decrypted.elf 3.3 MB
dump_lv2_reversing/lv2_kernel_service_jig_self.bin 3.5 MB
dump_lv2_reversing/lv2_kernel_service_jig_self.idb 23 MB
dump_lv2_reversing/mem/dump_lpar_ra.bin 1 MB
dump_lv2_reversing/mem/memory_regions.txt 0.4 KB
dump_lv2_reversing/sce/sce.txt 0.9 KB
dump_lv2_reversing/slb/dump_lv2_slb.bin 1 KB
dump_lv2_reversing/slb/dump_lv2_slb.txt 2.4 KB
dump_lv2_reversing/spp/default_decrypted.spp 8.7 KB
dump_lv2_reversing/update_manager/EID0_0x0.bin 2.1 KB
hvdump315_reversing/dump_proc.sh 0.3 KB
hvdump315_reversing/eeprom/offsets.txt 0.1 KB
hvdump315_reversing/files/EID0 2.1 KB
hvdump315_reversing/files/ss_server1.fself 0.5 MB
hvdump315_reversing/files/ss_server2.fself 0.3 MB
hvdump315_reversing/files/ss_server3.fself 0.2 MB
hvdump315_reversing/files/sysmgr_ss.fself 0.4 MB
hvdump315_reversing/htab/dump_htab.c 1.7 KB
hvdump315_reversing/htab/dump_htab.exe 18.4 KB
hvdump315_reversing/htab/lpar1_vas2_htab.txt 2.2 MB
hvdump315_reversing/htab/lpar2_vas3_htab.txt 8.8 MB
hvdump315_reversing/htab/lpar2_vas48_htab.txt 8.8 MB
hvdump315_reversing/hvcall/99.txt 0.2 KB
hvdump315_reversing/hvdump315 16 MB
hvdump315_reversing/hvdump315.idb 79 MB
hvdump315_reversing/misc/tbfreq.txt 0 KB
hvdump315_reversing/otheros/build-petitboot.txt 2.3 KB
hvdump315_reversing/otheros/debian_netboot/initrd.gz 5.4 MB
hvdump315_reversing/otheros/debian_netboot/vmlinux 11 MB
hvdump315_reversing/otheros/debian_netboot/yaboot.conf 0.6 KB
hvdump315_reversing/otheros/dev_rflash_lx/exoboot 5.2 MB
hvdump315_reversing/otheros/dev_rflash_lx/lv2_kernel_service_jig_self.bin 3.5 MB
hvdump315_reversing/otheros/dev_rflash_lx/petitboot_network_zImage.ps3.bin 7.7 MB
hvdump315_reversing/otheros/dev_rflash_lx/petitboot_zImage.ps3.bin 7.6 MB
hvdump315_reversing/otheros/exoboot 5.2 MB
hvdump315_reversing/otheros/exoboot.idb 30 MB
hvdump315_reversing/otheros/otheros.bld 3.1 MB
hvdump315_reversing/otheros/otheros.elf 14 MB
hvdump315_reversing/otheros/otheros.i64 63 MB
hvdump315_reversing/otheros/petitboot-compile-howto.txt 0.8 KB
hvdump315_reversing/otheros/petitboot.bld 3.4 MB
hvdump315_reversing/otheros/petitboot_network.bld 3.5 MB
hvdump315_reversing/otheros/petitboot_network_zImage.ps3.bin 7.7 MB
hvdump315_reversing/otheros/petitboot_network_zImage.ps3.idb 40 MB
hvdump315_reversing/otheros/petitboot_zImage.ps3.bin 7.6 MB
hvdump315_reversing/otheros/petitboot_zImage.ps3.idb 33 MB
hvdump315_reversing/otheros/ps3-boot-recovery-howto.txt 4.5 KB
hvdump315_reversing/otheros/ps3-bootloader-install-howto.txt 3.6 KB
hvdump315_reversing/otheros/ps3-debian-install-howto.txt 5.3 KB
hvdump315_reversing/otheros/ps3-debian-install.pdf 90.6 KB
hvdump315_reversing/otheros/ps3-petitboot-09.11.30-cui 8 MB
hvdump315_reversing/otheros/ps3-petitboot-09.11.30-cui.bld 3.2 MB
hvdump315_reversing/proc_3/code_seg.addr 0.6 KB
hvdump315_reversing/proc_3/code_seg.bin 0.1 MB
hvdump315_reversing/proc_3/code_seg.idb 1.8 MB
hvdump315_reversing/proc_3/data_seg.addr 0.2 KB
hvdump315_reversing/proc_3/data_seg.bin 36 KB
hvdump315_reversing/proc_3/stack_seg.addr 0.1 KB
hvdump315_reversing/proc_3/stack_seg.bin 12 KB
hvdump315_reversing/proc_3/unknown_seg.addr 0.1 KB
hvdump315_reversing/proc_3/unknown_seg.bin 28 KB
hvdump315_reversing/proc_5/code_seg.addr 0.9 KB
hvdump315_reversing/proc_5/code_seg.bin 0.2 MB
hvdump315_reversing/proc_5/code_seg.idb 2.8 MB
hvdump315_reversing/proc_5/data_seg.addr 0.2 KB
hvdump315_reversing/proc_5/data_seg.bin 44 KB
hvdump315_reversing/proc_5/stack_seg.addr 0.1 KB
hvdump315_reversing/proc_5/stack_seg.bin 12 KB
hvdump315_reversing/proc_5/unknown_seg.addr 0 KB
hvdump315_reversing/proc_5/unknown_seg.bin 8 KB
hvdump315_reversing/proc_6/code_seg.addr 1.8 KB
hvdump315_reversing/proc_6/code_seg.bin 0.3 MB
hvdump315_reversing/proc_6/code_seg.idb 5.1 MB
hvdump315_reversing/proc_6/data_seg.addr 0.3 KB
hvdump315_reversing/proc_6/data_seg.bin 68 KB
hvdump315_reversing/proc_6/stack_seg.addr 0.1 KB
hvdump315_reversing/proc_6/stack_seg.bin 12 KB
hvdump315_reversing/proc_6/unknown_seg_1.addr 0 KB
hvdump315_reversing/proc_6/unknown_seg_1.bin 4 KB
hvdump315_reversing/proc_6/unknown_seg_2.addr 0 KB
hvdump315_reversing/proc_6/unknown_seg_2.bin 4 KB
hvdump315_reversing/proc_9/.unknown_seg_2.addr.swp 12 KB
hvdump315_reversing/proc_9/code_seg.addr 1.4 KB
hvdump315_reversing/proc_9/code_seg.bin 0.3 MB
hvdump315_reversing/proc_9/code_seg.idb 3.6 MB
hvdump315_reversing/proc_9/data_seg.addr 0.4 KB
hvdump315_reversing/proc_9/data_seg.bin 72 KB
hvdump315_reversing/proc_9/stack_seg.addr 0.1 KB
hvdump315_reversing/proc_9/stack_seg.bin 12 KB
hvdump315_reversing/proc_9/unknown_seg_1.addr 0.1 KB
hvdump315_reversing/proc_9/unknown_seg_1.bin 16 KB
hvdump315_reversing/proc_9/unknown_seg_2.addr 0.6 KB
hvdump315_reversing/proc_9/unknown_seg_3.addr 0 KB
hvdump315_reversing/proc_9/unknown_seg_3.bin 8 KB
hvdump315_reversing/repo_nodes/dump_repo_nodes.c 1.7 KB
hvdump315_reversing/repo_nodes/dump_repo_nodes.exe 17.9 KB
hvdump315_reversing/repo_nodes/hash_repo_node.c 1.5 KB
hvdump315_reversing/repo_nodes/hash_repo_node.exe 17.2 KB
hvdump315_reversing/repo_nodes/repo_nodes.txt 77.8 KB
hvdump315_reversing/repo_nodes/repo_nodes_storage_disk.txt 8.1 KB
hvdump315_reversing/repo_nodes/repo_nodes_storage_rbd.txt 8.1 KB
hvdump315_reversing/ss/.packet_and_function_ids.txt.swp 12 KB
hvdump315_reversing/ss/laid_and_paid.txt 3.3 KB
hvdump315_reversing/ss/packet_and_function_ids.txt 0.5 KB
hvdump341_reversing/dev_rflash1/metldr 58.2 KB
hvdump341_reversing/dump_flash_fat.bin 16 MB
hvdump341_reversing/dump_lv1_latest.bin 16 MB
hvdump341_reversing/dump_proc.sh 0.3 KB
hvdump341_reversing/hv_mmap_exploit_341.bin 16 MB
hvdump341_reversing/hv_mmap_exploit_341.idb 68 MB
hvdump341_reversing/lv1_341_decrypted.elf 3.8 MB
hvdump341_reversing/lv1_341_decrypted.i64 22 MB
hvdump341_reversing/proc_3/code_seg.addr 0.6 KB
hvdump341_reversing/proc_3/code_seg.bin 0.1 MB
hvdump341_reversing/proc_3/code_seg.idb 1.2 MB
hvdump341_reversing/proc_3/data_seg.addr 0.2 KB
hvdump341_reversing/proc_3/data_seg.bin 36 KB
hvdump341_reversing/proc_3/stack_seg.addr 0.1 KB
hvdump341_reversing/proc_3/unknown_seg_1.addr 0.1 KB
hvdump341_reversing/proc_3/unknown_seg_1.bin 28 KB
hvdump341_reversing/proc_3/unknown_seg_2.addr 0 KB
hvdump341_reversing/proc_3/unknown_seg_2.bin 4 KB
hvdump341_reversing/proc_5/code_seg.addr 0.9 KB
hvdump341_reversing/proc_5/code_seg.bin 0.2 MB
hvdump341_reversing/proc_5/code_seg.idb 1.8 MB
hvdump341_reversing/proc_5/data_seg.addr 0.2 KB
hvdump341_reversing/proc_5/data_seg.bin 44 KB
hvdump341_reversing/proc_5/stack_seg.addr 0.1 KB
hvdump341_reversing/proc_5/stack_seg.bin 12 KB
hvdump341_reversing/proc_5/unknown_seg.addr 0 KB
hvdump341_reversing/proc_5/unknown_seg.bin 8 KB
hvdump341_reversing/proc_6/code_seg.addr 1.8 KB
hvdump341_reversing/proc_6/code_seg.bin 0.3 MB
hvdump341_reversing/proc_6/code_seg.idb 3 MB
hvdump341_reversing/proc_6/data_seg.addr 0.3 KB
hvdump341_reversing/proc_6/data_seg.bin 68 KB
hvdump341_reversing/proc_6/stack_seg.addr 0.1 KB
hvdump341_reversing/proc_6/stack_seg.bin 12 KB
hvdump341_reversing/proc_6/unknown_seg_1.addr 0 KB
hvdump341_reversing/proc_6/unknown_seg_1.bin 4 KB
hvdump341_reversing/proc_6/unknown_seg_2.addr 0 KB
hvdump341_reversing/proc_6/unknown_seg_2.bin 4 KB
hvdump341_reversing/proc_9/code_seg.addr 1.3 KB
hvdump341_reversing/proc_9/code_seg.bin 0.2 MB
hvdump341_reversing/proc_9/code_seg.idb 2.4 MB
hvdump341_reversing/proc_9/data_seg.addr 0.3 KB
hvdump341_reversing/proc_9/data_seg.bin 56 KB
hvdump341_reversing/proc_9/stack_seg.addr 0.1 KB
hvdump341_reversing/proc_9/stack_seg.bin 12 KB
hvdump341_reversing/proc_9/unknown_seg_1.addr 0.1 KB
hvdump341_reversing/proc_9/unknown_seg_1.bin 16 KB
hvdump341_reversing/proc_9/unknown_seg_2.addr 0 KB
hvdump341_reversing/proc_9/unknown_seg_2.bin 8 KB
hvdump341_reversing/proc_elfs/pme_init 0.1 MB
hvdump341_reversing/proc_elfs/pme_init.i64 0.5 MB
hvdump341_reversing/repo_nodes/dump_repo_nodes.c 1.8 KB
hvdump341_reversing/repo_nodes/dump_repo_nodes.exe 17.9 KB
hvdump341_reversing/repo_nodes/repo_nodes.txt 77.4 KB
hvdump341_reversing/sc_eprom_after_set_token/sc_eprom_dump_0x02F00_0x02FFF.bin 0.3 KB
hvdump341_reversing/sc_eprom_after_set_token/sc_eprom_dump_0x03000_0x030FF.bin 0.3 KB
hvdump341_reversing/sc_eprom_after_set_token/sc_eprom_dump_0x48000_0x480FF.bin 0.3 KB
hvdump341_reversing/sc_eprom_after_set_token/sc_eprom_dump_0x48800_0x488FF.bin 0.3 KB
hvdump341_reversing/sc_eprom_after_set_token/sc_eprom_dump_0x48C00_0x48CFF.bin 0.3 KB
hvdump341_reversing/sc_eprom_after_set_token/sc_eprom_dump_0x48D00_0x48DFF.bin 0.3 KB
hvdump341_reversing/sc_eprom_before_set_token/sc_eprom_dump_0x02F00_0x02FFF.bin 0.3 KB
hvdump341_reversing/sc_eprom_before_set_token/sc_eprom_dump_0x03000_0x030FF.bin 0.3 KB
hvdump341_reversing/sc_eprom_before_set_token/sc_eprom_dump_0x48000_0x480FF.bin 0.3 KB
hvdump341_reversing/sc_eprom_before_set_token/sc_eprom_dump_0x48800_0x488FF.bin 0.3 KB
hvdump341_reversing/sc_eprom_before_set_token/sc_eprom_dump_0x48C00_0x48CFF.bin 0.3 KB
hvdump341_reversing/sc_eprom_before_set_token/sc_eprom_dump_0x48D00_0x48DFF.bin 0.3 KB
hvdump341_reversing/spus/isoldr_341.elf 75.6 KB
hvdump341_reversing/spus/isoldr_341_objdump.asm 0.7 MB
hvdump341_reversing/spus/sb_iso_spu_module.elf 62.5 KB
hvdump341_reversing/spus/sb_iso_spu_module_ida.asm 0.2 MB
hvdump341_reversing/spus/sb_iso_spu_module_objdump.asm 0.5 MB
hvdump341_reversing/spus/sc_iso.elf 81.7 KB
hvdump341_reversing/spus/sc_iso_ida.asm 0.4 MB
hvdump341_reversing/spus/sc_iso_objdump.asm 0.8 MB
hvdump341_reversing/spus/spu_token_processor.elf 22.3 KB
hvdump341_reversing/spus/spu_token_processor_ida.asm 0.1 MB
hvdump341_reversing/spus/spu_token_processor_objdump.asm 0.2 MB
hvdump355_reversing/dump_proc.sh 0.3 KB
hvdump355_reversing/dump_protpages/dump_protpages.c 2.1 KB
hvdump355_reversing/dump_protpages/dump_protpages.exe 11.5 KB
hvdump355_reversing/dump_protpages/dump_protpages.exe.stackdump 0.8 KB
hvdump355_reversing/hvdump_355.bin 16 MB
hvdump355_reversing/hvdump_355.idb 67 MB
hvdump355_reversing/proc_3/code_seg.addr 0.7 KB
hvdump355_reversing/proc_3/code_seg.bin 0.1 MB
hvdump355_reversing/proc_3/code_seg.idb 1.3 MB
hvdump355_reversing/proc_3/data_seg.addr 0.2 KB
hvdump355_reversing/proc_3/data_seg.bin 36 KB
hvdump355_reversing/proc_3/pages 1.1 KB
hvdump355_reversing/proc_3/stack_seg.addr 0.1 KB
hvdump355_reversing/proc_3/stack_seg.bin 12 KB
hvdump355_reversing/proc_3/unknown_seg.addr 0.2 KB
hvdump355_reversing/proc_3/unknown_seg.bin 32 KB
hvdump355_reversing/proc_5/code_seg.addr 1 KB
hvdump355_reversing/proc_5/code_seg.bin 0.2 MB
hvdump355_reversing/proc_5/code_seg.idb 1.6 MB
hvdump355_reversing/proc_5/data_seg.addr 0.2 KB
hvdump355_reversing/proc_5/data_seg.bin 44 KB
hvdump355_reversing/proc_5/pages 1.3 KB
hvdump355_reversing/proc_5/stack_seg.addr 0.1 KB
hvdump355_reversing/proc_5/stack_seg.bin 12 KB
hvdump355_reversing/proc_5/unknown_seg.addr 0 KB
hvdump355_reversing/proc_5/unknown_seg.bin 8 KB
hvdump355_reversing/proc_6/code_seg.addr 2 KB
hvdump355_reversing/proc_6/code_seg.bin 0.3 MB
hvdump355_reversing/proc_6/code_seg.idb 3.3 MB
hvdump355_reversing/proc_6/data_seg.addr 0.4 KB
hvdump355_reversing/proc_6/data_seg.bin 68 KB
hvdump355_reversing/proc_6/pages 2.4 KB
hvdump355_reversing/proc_6/stack_seg.addr 0.1 KB
hvdump355_reversing/proc_6/stack_seg.bin 12 KB
hvdump355_reversing/proc_6/unknown_seg1.addr 0 KB
hvdump355_reversing/proc_6/unknown_seg1.bin 4 KB
hvdump355_reversing/proc_6/unknown_seg2.addr 0 KB
hvdump355_reversing/proc_6/unknown_seg2.bin 4 KB
hvdump355_reversing/proc_9/code_seg.addr 1.4 KB
hvdump355_reversing/proc_9/code_seg.bin 0.2 MB
hvdump355_reversing/proc_9/code_seg.idb 2.1 MB
hvdump355_reversing/proc_9/data_seg.addr 0.3 KB
hvdump355_reversing/proc_9/data_seg.bin 56 KB
hvdump355_reversing/proc_9/pages 2.5 KB
hvdump355_reversing/proc_9/stack_seg.addr 0.1 KB
hvdump355_reversing/proc_9/stack_seg.bin 12 KB
hvdump355_reversing/proc_9/unknown_seg1.addr 0.1 KB
hvdump355_reversing/proc_9/unknown_seg1.bin 16 KB
hvdump355_reversing/proc_9/unknown_seg2.addr 0 KB
hvdump355_reversing/proc_9/unknown_seg2.bin 8 KB
payload.tar.gz 96.2 KB
ps3wiki/Basic Bluray disc authentication procedure.htm 13.3 KB
ps3wiki/Booting Linux from internal HDD.htm 8.4 KB
ps3wiki/Booting Linux from internal HDD_2.htm 9.2 KB
ps3wiki/Booting Linux on 3.41 PS3 with petitboot from internal HDD.htm 9.1 KB
ps3wiki/Booting Linux on 3.41 PS3 with petitboot from internal HDD2.htm 10 KB
ps3wiki/Booting petitboot from VFLASH.htm 20.2 KB
ps3wiki/Booting_Linux_2.6_kernel_on_running_PS3_Linux_with_kexec.htm 1 KB
ps3wiki/Cell Programming Tutorial – IBM.htm 10.7 KB
ps3wiki/Drk notes.htm 13.8 KB
ps3wiki/Dump_of_all_repository_nodes_from_HV_3.15.htm 1 KB
ps3wiki/Dump_of_all_repository_nodes_from_HV_3.41_dump_made_from_GameOS.htm 84.5 KB
ps3wiki/Error_codes.htm 0.8 KB
ps3wiki/Hardware flashing.htm 7.9 KB
ps3wiki/Hypervisor Reverse Engineering.htm 0.3 MB
ps3wiki/Installing Linux on internal HDD.htm 14.7 KB
ps3wiki/Lv-2 syscalls.htm 26.4 KB
ps3wiki/Lv-2_functions.htm 0.8 KB
ps3wiki/Main Page.htm 14.9 KB
ps3wiki/PDB file format.htm 14.8 KB
ps3wiki/PS3 Payload Developement.htm 29.5 KB
ps3wiki/PSGroove.htm 15 KB
ps3wiki/PSJailbreak Exploit Payload Reverse Engineering.htm 14.7 KB
ps3wiki/PSJailbreak Exploit Reverse Engineering.htm 22.4 KB
ps3wiki/PSJailbreak Payload Reverse Engineering.htm 52.4 KB
ps3wiki/PUP File Format.htm 11.4 KB
ps3wiki/Self Crypto.htm 8.3 KB
ps3wiki/SELF File Format and Decryption.htm 17.3 KB
ps3wiki/Self file format.htm 12.4 KB
ps3wiki/Self file format_2.htm 13.1 KB
ps3wiki/Talk.Lv-2 functions.htm 7.8 KB
ps3wiki/Talk.SELF File Format and Decryption.htm 18.4 KB
ps3wiki/XRegistry File Format.htm 51.9 KB
ps3wiki/XRegistry File Format_2.htm 52.7 KB
</pre>
 
==emer init.self==
 
=== Program 1 ===
 
Crossreference: [https://web.archive.org/web/20110927024647/http://portal.gitbrew.org/wikibrew/PS3:HvReverseEngineering:emer_init.self:Program_1 gitbrew.org::emer_init.self:Program_1] <br />


===Program 1===
<pre>
<pre>
0x40000                          # bind object to subchannel 0
0x40000                          # bind object to subchannel 0
Line 222: Line 835:
</pre>
</pre>


===Program 2===
=== Program 2 ===
 
Crossreference: [https://web.archive.org/web/20110927023704/http://portal.gitbrew.org/wikibrew/PS3:HvReverseEngineering:emer_init.self:Program_2 gitbrew.org::emer_init.self:Program_2] <br />
<pre>
<pre>
0x80308
0x80308
0x207
0x207
0x0
0x0
</pre>


===Program 3===
0x40304
<pre>
0x0
0x42000                      # bind object to subchannel 1
 
0x31337303
0xC0350
0x207
0x0
0xFF
 
0x4034C
0xFF
 
0xC035C
0x1E00
0x1E00
0x1E00
 
0x4031C
0x0
 
0x4037C
0x0
 
0x40310
0x0
 
0x4036C
0x0
 
0x40320
0x80068006
 
0x80314
0x10001
0x0
 
0x41D8C
0xFFFFFF00
 
0x41D94
0x0
 
0x40100
0x0
 
0x40324
0x1010101
 
0x4183C
0x0
 
0x41830
0x405
 
0x80384
0x0
0x3F800000
 
0x40380
0x0
 
0x40A6C
0x201
 
0x40A70
0x1
 
0x40A74
0x0
 
0x40300
0x1
 
0x41FEC
0x0
 
0x41FC0
0x0
 
0x41834
0x901


0xC2180                      # method of subchannel 1
0x403B8
0x66604200
0x8
0xFEED0001
0xFEED0000


0x46000                      # bind object to subchannel 3
0x40374
0x313371C3
0x0


0xC6180                      # method of subchannel 3
0x40378
0x66604200
0x1503
0xFEED0000
0xFEED0000


0x4A000                      # bind object to subchannel 5
0x41EE0
0x31337808
0x3F800000


0x20A180                      # method of subchannel 5
0x40A68
0x66604200
0x0
0x0
0x80A78
0x0
0x0
0x0
0x0
0x41DAC
0x0
0x0
0x41DB0
0xFFFFFFFF
0x808C0
0x10000000
0x10000000
0x40368
0x1D01
0xC0330
0x207
0x0
0x0
0xFF
0x4032C
0xFF
0xC033C
0x1E00
0x1E00
0x1E00
0x40328
0x0
0x0
0x313371C3


0x8A2FC                      # method of subchannel 5
for (x = 0; x < 16; x++)
0x3
{
0x4
    0x41A08 + (x * 0x20)
    0x30101
 
    0x41A1C + (x * 0x20)
    0x0


0x48000                      # bind object to subchannel 4
    0x41A0C + (x * 0x20)
0x31337A73
    0x60000


0x88180                      # method of subchannel 4
    0x41A14 + (x * 0x20)
0x66604200
    0x2052000
0xFEED0000
}


0x4C000                      # bind object to subchannel 6
0x40348
0x3137AF00
0x0


0x4C180                      # method of subchannel 6
for (x = 0; x < 16; x++)
0x66604200
{
</pre>
    0x41740 + (x * 0x4)
    0x2


    0x41680 + (x * 0x4)
    0x0
}


----
0x80A00
0x10000000
0x10000000


=RSXFIFOCommands=
0x80394
0x0
0x3F800000


=Commands=
0x200A20
2048.0
2048.0
0.5
0x0
2048.0
2048.0
0.5
0x0


==NOP (0x00000100)==
0x200A20
2048.0
2048.0
0.5
0x0
2048.0
2048.0
0.5
0x0


* Nop
0x41D7C
0xFFFF0000


<pre>
0x4182C
0x00000100
0x1B02
</pre>


==CALL (0x00000002)==
0x41D90
0x0


* Calls a function at the specified offset.
0x40370
* Command size is '''0'''.
0x0
* The parameter is offset in FIFO buffer.


<pre>
0x41828
<offset> | 0x00000002
0x1B02
</pre>


==RET (0x00020000)==
0x403BC
0x0


* Returns from a function.
0x41DB4
* Command size is '''0'''.
0x0


<pre>
0x41EE4
0x00020000
0x0
</pre>


==JMP (0x20000000)==
0x41EE8
0x0


* Jumps to the specified offset.
0x41838
* Command size is '''0'''.
0x0
* The parameter is offset in FIFO buffer.


<pre>
0x4147C
0x20000000 | <offset>
0x0
</pre>


==COLOR MASK (0x00040324)==
0x41E98
0x1000000


* Sets color mask.
0x41478
* Command size is '''1'''.
0x0
* The parameter is color mask.


<pre>
0x41FF0
0x00040324
0xFFFF
<color mask>
</pre>


==FRONT POLYGON MODE (0x00041828)==
0x417CC
0x0


* Sets front polygon mode.
for (x = 0; x < 16; x++)
* Command size is '''1'''.
{
* The parameter is front polygon mode.
    0x40908 + (x * 0x20)
    0x101


<pre>
    0x4091C + (x * 0x20)
0x00041828
    0x0
<front polygon mode>
</pre>


== RSXFIFOCommands ==
    0x4090C + (x * 0x20)
    0x60000


=Commands=
    0x40914 + (x * 0x20)
    0x0
}


==NOP (0x00000100)==
0x40238
0x0


* Nop
0x41D78
0x1


<pre>
0x4142C
0x00000100
0x0
</pre>


==CALL (0x00000002)==
0x41FF8
0x0


* Calls a function at the specified offset.
0x41FE8
* Command size is '''0'''.
0x0
* The parameter is offset in FIFO buffer.
</pre>


===Program 3===
Crossreference: [http://portal.gitbrew.org/wikibrew/PS3:HvReverseEngineering:emer_init.self:Program_2 gitbrew.org::emer_init.self:Program_2] <br />
<pre>
<pre>
<offset> | 0x00000002
0x42000                      # bind object to subchannel 1
</pre>
0x31337303


==RET (0x00020000)==
0xC2180                      # method of subchannel 1
0x66604200
0xFEED0001
0xFEED0000


* Returns from a function.
0x46000                      # bind object to subchannel 3
* Command size is '''0'''.
0x313371C3


<pre>
0xC6180                      # method of subchannel 3
0x00020000
0x66604200
</pre>
0xFEED0000
0xFEED0000


==JMP (0x20000000)==
0x4A000                      # bind object to subchannel 5
0x31337808


* Jumps to the specified offset.
0x20A180                      # method of subchannel 5
* Command size is '''0'''.
0x66604200
* The parameter is offset in FIFO buffer.
0x0
0x0
0x0
0x0
0x0
0x0
0x313371C3
 
0x8A2FC                      # method of subchannel 5
0x3
0x4


<pre>
0x48000                      # bind object to subchannel 4
0x20000000 | <offset>
0x31337A73
</pre>


==COLOR MASK (0x00040324)==
0x88180                      # method of subchannel 4
0x66604200
0xFEED0000


* Sets color mask.
0x4C000                      # bind object to subchannel 6
* Command size is '''1'''.
0x3137AF00
* The parameter is color mask.


<pre>
0x4C180                      # method of subchannel 6
0x00040324
0x66604200
<color mask>
</pre>
</pre>


==FRONT POLYGON MODE (0x00041828)==
----


* Sets front polygon mode.
== About RSX ==
* Command size is '''1'''.
* The parameter is front polygon mode.


<pre>
<pre>
0x00041828
RAMIN is on VRAM.
<front polygon mode>
0x28002010000 contains the same as 0x2808FF90000
0x28002050000 contains the same as 0x2808FFD0000
you can prove that by writing in one offset and reading the other
0x2808XXXXXXX is BAR1 (i.e. VRAM on Nvidia GPUs)
0x28002XXXXXX is BAR2 (i.e. PRAMIN on Nvidia GPUs)
</pre>
</pre>

Latest revision as of 05:26, 17 April 2023

Merge needed of info from: wiki.gitbrew.org and [1]

MMIO / Memorymap[edit source]

Physical Address Size ID Usage Address
in HV dump
(3.15)		 Notes
0x800000 0x20000 LV0 Code Region
0x200000 0x400000 LV1 Code Region
0x8000000 / 0x1000000(DECR) 0x800000 LV2 Region The region you get when you dump lv2
0x20000000000 0x80000 SPE0 MMIO Memory Region (be.0.bp_base)
0x20000080000 0x80000 SPE1 MMIO Memory Region 0x003ABC20
0x20000100000 0x80000 SPE2 MMIO Memory Region 0x003AAD70
0x20000180000 0x80000 SPE3 MMIO Memory Region 0x003A8880 panic on read
0x20000200000 0x80000 SPE4 MMIO Memory Region 0x003B4F70
0x20000280000 0x80000 SPE5 MMIO Memory Region 0x003AB700
0x20000300000 0x80000 SPE6 MMIO Memory Region 0x003B5BE0
0x20000509000 0x1000 Pervasive Memory Contains 48 bit Serial Number at position 0xC80 size 0x08
0x1000 SPE1 Shadow Registers Memory Region 0x003ABDA0
0x1000 SPE2 Shadow Registers Memory Region 0x003B4290
0x1000 SPE3 Shadow Registers Memory Region 0x003A8A00
0x1000 SPE4 Shadow Registers Memory Region 0x003B50F0
0x1000 SPE5 Shadow Registers Memory Region 0x001FFC90
0x1000 SPE6 Shadow Registers Memory Region 0x003AE5B0
0x2000050A0C8 0x4 XDR Memory Channel Size (Type 1) Shift right 49 and add 0x20 for size.
0x2000050A188 0x4 XDR Memory Channel Size (Type 0) Shift right 49 and add 0x20 for size.
0x2000050A210 0x4 XDR Memory Channel Type For use with above memory locations
0x24000000000 SB bus subsystem (be.0.ioif1.addr)
0x24000002000 0x200 1 SATA Controller 1
0x24000002200 0x200 2 SATA Controller 2
0x24000002400 0x200 3 USB Controller 1
0x24000002600 0x200 4 USB Controller 2
0x24000002800 0x200 0 Gelic Device
0x24000002C00 0x200 7 ENCDEC Device
0x24000008000 0x1000 SB bus External interrupt controller Found while looking at linux kernel src. (spider-pic.c)
0x24000008100 SB bus interrupt handler 0x002B9CC4
0x24000008104 SB bus interrupt handler
0x24000087000 SB status/info
0x2400008C000 SYSCON (receive packetheader)
0x2400008C010 SYSCON (receive packetbody)
0x2400008CFF0 SYSCON (receive ?)
0x2400008CFF4 SYSCON (send ?)
0x2400008D000 SYSCON (send packetheader)
0x2400008D010 SYSCON (send packetbody)
0x2400008DFF0 SYSCON (send ?)
0x2400008DFF4 SYSCON (receive ?)
0x2400008E000 SYSCON (receive ?)
0x2400008E004 SYSCON (receive test bit 0x2)
0x2400008E100 SYSCON (send notify)
0x24003000000 0x1000 1 SATA Controller 1
0x24003001000 0x1000 2 SATA Controller 2
0x24003004000 0x1000 0 Gelic Device
0x24003005000 0x1000 7 ENCDEC Device
0x24003005200 0x4 7 ENCDEC Device 0 != ENCDEC Test Mode
0x24003006000 0x1000 7 ENCDEC Device
0x240030060A0 0x4 7 ENCDEC Device EdecKgenFlash Command (0x84)
0x24003010000 0x10000 3 USB Controller 1 0x001FDF00
0x24003020000 0x10000 4 USB Controller 2 0x003B3850
0x24003800000 0x1000 1 SATA Controller 1
0x24003801000 0x1000 2 SATA Controller 2
0x24003802000 0x1000 1 SATA Controller 1
0x24003803000 0x1000 2 SATA Controller 2
0x24003810000 0x10000 3 USB Controller 1 0x003B6E50
0x24003820000 0x10000 4 USB Controller 2 0x003B9950
0x2401F000000 0x1000000 NOR Flash
0x2401FC00000 0x40000 SYS ROM lv0ldr/bootldr
0x28000000000 0x2000 AV Manager (/dev/ioif0) (be.0.ioif0.addr) only mmap system call
0x28001800000 0x1000 AV Manager (/dev/ioif0) only mmap system call
0x28000600000 0x4000 AV Manager (/dev/ioif0) - Output Control Registers only mmap system call. First 0x2000 for head 0. Next 0x2000 for head 1.
0x28000680000 0x4000 AV Manager (/dev/ioif0) - PLL Control Registers only mmap system call. First 0x2000 for head 0. Next 0x2000 for head 1.
0x28000080000 0x8000 AV Manager (/dev/ioif0) only mmap system call
0x28000088000 0x1000 AV Manager (/dev/ioif0) only mmap system call
0x2800000C000 0x1000 AV Manager (/dev/ioif0) only mmap system call
0x2800008A000 0x1000 AV Manager (/dev/ioif0) only mmap system call
0x2800008C000 0x1000 AV Manager (/dev/ioif0) only mmap system call
0x28080000000 0xFE00000 1 GPU Device Memory Region 0x003AF380
0x3C0000 0xC000 2 GPU Device Memory Region 0x003AF500
0x2808FE00000 0x40000 3 GPU Device Memory Region 0x003AF680
0x28000C00000 0x20000 4 GPU Device Memory Region 0x003AFC30
0x28000080100 0x8000 5 GPU Device Memory Region 0x003BB420
0x2808FC00000 0x400000 RSX Internal State Memory Area (All)
0x2808FF80000 0x80000 RAMIN (Encompasses RAMHT,RAMFC,DMA Objects, Graphic Objects and GRAPH)
0x2808FF90000 0x4000 RAM Hash Table
0x2808FFA0000 0x1000 RAM FIFO Context
0x2808FFC0000 0x10000 DMA Objects
0x2808FFD0000 0x10000 Graphic Objects
0x2808FFE0000 0x10000 Graphic Context
9 FLASH Controller device (StarShip - SS) FLASH controller doesn't have MMIO regions
0x000000000000 0x1000000 GameOS
0x700020000000 0xA0000 GameOS
0x700020000000 0xE900000 GameOS
0x800000000F000000 0x40000 GameOS HTAB

PS3 ea memory map[edit source]

  0xFFFF_FFFF  +-------------------------------+
               | SPU Thread Mapping Area       |   
  0xF000_0000  +-------------------------------+
               | Raw SPU Mapping Area          |   
  0xE000_0000  +-------------------------------+
               | User Area                     |   
  0xD000_0000  +-------------------------------+
               | RSX Frame Buffer Mapping Area |   
  0xC000_0000  +-------------------------------+
               | MMapper Fixed Area            |   
  0xB000_0000  +-------------------------------+
               |                               |   
               | User Area (heap, ...)         |   
               |                               |   
               |                               |   
               |                               |   
  0x5000_0000  +-------------------------------+
               | PPU/SPU Local Segment         |   
               | (.ppu_data)                   |   
  0x4001_0000  +-------------------------------+ 
               | PPU/SPU Local Segment         |   
               | (.ppu_rodata)                 |   
  0x4000_0000  +-------------------------------+
               | PPU/SPU/RSX Shared Segment    |   
               | (.sdata, .rsx_image)          |   
  0x3001_0000  +-------------------------------+ 
               | PPU/SPU/RSX Shared Segment    |   
               | (.srodata, .rsx_image)        |   
  0x3000_0000  +-------------------------------+ 
               | PPU/SPU Shared Segment        |   
               | (.text, .data, .bss, ...)     |   
  0x0001_0000  +-------------------------------+
               | Unmapped Area                 |   
  0x0000_0000  +-------------------------------+

https://web.archive.org/web/20141119024023/http://pastie.org/private/bfqqa2cpadolns9bm0eqa

History of Packet ID Entries[edit source]

from SPM

possible process names[2] possible process / packet ids 1[3] possible process / packet ids 2[4]

coolstuf[edit source]

Graf_Chokolo's HV BIBLE .rar 163 MB 

Torrent InfoHash (Base16): 8E0FC6B483D8439BC7E1D6148632022DC390CE19
Torrent InfoHash (Base32): RYH4NNED3BBZXR7B2YKIMMQCFXBZBTQZ

coolstuff.rar (172474327 Bytes) 

SHA1: F8DF8A5D6ABEFD20CE02EFE883D22FE90CC11845
MD5: C0976820D0F4DA9D0C8674083E7F8B36
CRC32: 7CAECB85  /  CRC16: 69BB

Repositories:

Content[edit source]

dump_lv2_reversing/dev_rflash1/dev1_reg0_16MB.bin 16 MB
dump_lv2_reversing/dev_rflash1/dump_files.sh 0.3 KB
dump_lv2_reversing/dev_rflash1/dump_flash_315.bin 16 MB
dump_lv2_reversing/dev_rflash1/files/asecure_loader 0.2 MB
dump_lv2_reversing/dev_rflash1/files/cCSD 2 KB
dump_lv2_reversing/dev_rflash1/files/cISD 2 KB
dump_lv2_reversing/dev_rflash1/files/eEID 64 KB
dump_lv2_reversing/dev_rflash1/files/EID/EID0 2.1 KB
dump_lv2_reversing/dev_rflash1/files/EID/EID1 0.7 KB
dump_lv2_reversing/dev_rflash1/files/EID/EID2 1.8 KB
dump_lv2_reversing/dev_rflash1/files/EID/EID3 0.3 KB
dump_lv2_reversing/dev_rflash1/files/EID/EID4 0 KB
dump_lv2_reversing/dev_rflash1/files/EID/EID5 2.5 KB
dump_lv2_reversing/dev_rflash1/files/metldr 58.3 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/aim_spu_module.self 17.1 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/appldr 0.1 MB
dump_lv2_reversing/dev_rflash1/files/sdk_330/default.spp 8.7 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/emer_init.self 0.5 MB
dump_lv2_reversing/dev_rflash1/files/sdk_330/eurus_fw.bin 0.4 MB
dump_lv2_reversing/dev_rflash1/files/sdk_330/hdd_copy.self 0.4 MB
dump_lv2_reversing/dev_rflash1/files/sdk_330/isoldr 75.7 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/lv0 0.2 MB
dump_lv2_reversing/dev_rflash1/files/sdk_330/lv1.self 1.2 MB
dump_lv2_reversing/dev_rflash1/files/sdk_330/lv1ldr 0.1 MB
dump_lv2_reversing/dev_rflash1/files/sdk_330/lv2ldr 91.5 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/lv2_kernel.self 1.4 MB
dump_lv2_reversing/dev_rflash1/files/sdk_330/mc_iso_spu_module.self 32.1 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/me_iso_spu_module.self 34.2 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/sb_iso_spu_module.self 23.4 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/sc_iso.self 84.8 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/sdk_version 0 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/spp_verifier.self 54 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/spu_pkg_rvk_verifier.self 62.7 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/spu_token_processor.self 23.1 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/spu_utoken_processor.self 25.5 KB
dump_lv2_reversing/dev_rflash1/files/sdk_330/sv_iso_spu_module.self 48.1 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/aim_spu_module.self 17.1 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/appldr 0.1 MB
dump_lv2_reversing/dev_rflash1/files/sdk_341/default.spp 8.7 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/emer_init.self 0.5 MB
dump_lv2_reversing/dev_rflash1/files/sdk_341/eurus_fw.bin 0.4 MB
dump_lv2_reversing/dev_rflash1/files/sdk_341/hdd_copy.self 0.4 MB
dump_lv2_reversing/dev_rflash1/files/sdk_341/isoldr 76.1 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/lv0 0.2 MB
dump_lv2_reversing/dev_rflash1/files/sdk_341/lv1.self 1.2 MB
dump_lv2_reversing/dev_rflash1/files/sdk_341/lv1ldr 0.1 MB
dump_lv2_reversing/dev_rflash1/files/sdk_341/lv2ldr 92 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/lv2_kernel.self 1.4 MB
dump_lv2_reversing/dev_rflash1/files/sdk_341/mc_iso_spu_module.self 32.1 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/me_iso_spu_module.self 34.2 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/sb_iso_spu_module.self 23.4 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/sc_iso.self 84.8 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/sdk_version 0 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/spp_verifier.self 54 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/spu_pkg_rvk_verifier.self 62.7 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/spu_token_processor.self 23.1 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/spu_utoken_processor.self 25.5 KB
dump_lv2_reversing/dev_rflash1/files/sdk_341/sv_iso_spu_module.self 48.1 KB
dump_lv2_reversing/dev_rflash1/files/trvk_pkg0 0.1 MB
dump_lv2_reversing/dev_rflash1/files/trvk_pkg1 0.1 MB
dump_lv2_reversing/dev_rflash1/files/trvk_prg0 0.1 MB
dump_lv2_reversing/dev_rflash1/files/trvk_prg1 0.1 MB
dump_lv2_reversing/dev_rflash1/toc.txt 4 KB
dump_lv2_reversing/dump_lv2.bin 8 MB
dump_lv2_reversing/dump_lv2.idb 50 MB
dump_lv2_reversing/dump_lv2_315.bin 8 MB
dump_lv2_reversing/dump_lv2_315.idb 38 MB
dump_lv2_reversing/htab/dump_htab.bin 0.3 MB
dump_lv2_reversing/htab/dump_htab.c 1.7 KB
dump_lv2_reversing/htab/dump_htab.exe 18.4 KB
dump_lv2_reversing/htab/dump_htab.txt 2.2 MB
dump_lv2_reversing/lv2_dump3.41debug.bin 8 MB
dump_lv2_reversing/lv2_kernel_341_decrypted.elf 3.3 MB
dump_lv2_reversing/lv2_kernel_service_jig_self.bin 3.5 MB
dump_lv2_reversing/lv2_kernel_service_jig_self.idb 23 MB
dump_lv2_reversing/mem/dump_lpar_ra.bin 1 MB
dump_lv2_reversing/mem/memory_regions.txt 0.4 KB
dump_lv2_reversing/sce/sce.txt 0.9 KB
dump_lv2_reversing/slb/dump_lv2_slb.bin 1 KB
dump_lv2_reversing/slb/dump_lv2_slb.txt 2.4 KB
dump_lv2_reversing/spp/default_decrypted.spp 8.7 KB
dump_lv2_reversing/update_manager/EID0_0x0.bin 2.1 KB
hvdump315_reversing/dump_proc.sh 0.3 KB
hvdump315_reversing/eeprom/offsets.txt 0.1 KB
hvdump315_reversing/files/EID0 2.1 KB
hvdump315_reversing/files/ss_server1.fself 0.5 MB
hvdump315_reversing/files/ss_server2.fself 0.3 MB
hvdump315_reversing/files/ss_server3.fself 0.2 MB
hvdump315_reversing/files/sysmgr_ss.fself 0.4 MB
hvdump315_reversing/htab/dump_htab.c 1.7 KB
hvdump315_reversing/htab/dump_htab.exe 18.4 KB
hvdump315_reversing/htab/lpar1_vas2_htab.txt 2.2 MB
hvdump315_reversing/htab/lpar2_vas3_htab.txt 8.8 MB
hvdump315_reversing/htab/lpar2_vas48_htab.txt 8.8 MB
hvdump315_reversing/hvcall/99.txt 0.2 KB
hvdump315_reversing/hvdump315 16 MB
hvdump315_reversing/hvdump315.idb 79 MB
hvdump315_reversing/misc/tbfreq.txt 0 KB
hvdump315_reversing/otheros/build-petitboot.txt 2.3 KB
hvdump315_reversing/otheros/debian_netboot/initrd.gz 5.4 MB
hvdump315_reversing/otheros/debian_netboot/vmlinux 11 MB
hvdump315_reversing/otheros/debian_netboot/yaboot.conf 0.6 KB
hvdump315_reversing/otheros/dev_rflash_lx/exoboot 5.2 MB
hvdump315_reversing/otheros/dev_rflash_lx/lv2_kernel_service_jig_self.bin 3.5 MB
hvdump315_reversing/otheros/dev_rflash_lx/petitboot_network_zImage.ps3.bin 7.7 MB
hvdump315_reversing/otheros/dev_rflash_lx/petitboot_zImage.ps3.bin 7.6 MB
hvdump315_reversing/otheros/exoboot 5.2 MB
hvdump315_reversing/otheros/exoboot.idb 30 MB
hvdump315_reversing/otheros/otheros.bld 3.1 MB
hvdump315_reversing/otheros/otheros.elf 14 MB
hvdump315_reversing/otheros/otheros.i64 63 MB
hvdump315_reversing/otheros/petitboot-compile-howto.txt 0.8 KB
hvdump315_reversing/otheros/petitboot.bld 3.4 MB
hvdump315_reversing/otheros/petitboot_network.bld 3.5 MB
hvdump315_reversing/otheros/petitboot_network_zImage.ps3.bin 7.7 MB
hvdump315_reversing/otheros/petitboot_network_zImage.ps3.idb 40 MB
hvdump315_reversing/otheros/petitboot_zImage.ps3.bin 7.6 MB
hvdump315_reversing/otheros/petitboot_zImage.ps3.idb 33 MB
hvdump315_reversing/otheros/ps3-boot-recovery-howto.txt 4.5 KB
hvdump315_reversing/otheros/ps3-bootloader-install-howto.txt 3.6 KB
hvdump315_reversing/otheros/ps3-debian-install-howto.txt 5.3 KB
hvdump315_reversing/otheros/ps3-debian-install.pdf 90.6 KB
hvdump315_reversing/otheros/ps3-petitboot-09.11.30-cui 8 MB
hvdump315_reversing/otheros/ps3-petitboot-09.11.30-cui.bld 3.2 MB
hvdump315_reversing/proc_3/code_seg.addr 0.6 KB
hvdump315_reversing/proc_3/code_seg.bin 0.1 MB
hvdump315_reversing/proc_3/code_seg.idb 1.8 MB
hvdump315_reversing/proc_3/data_seg.addr 0.2 KB
hvdump315_reversing/proc_3/data_seg.bin 36 KB
hvdump315_reversing/proc_3/stack_seg.addr 0.1 KB
hvdump315_reversing/proc_3/stack_seg.bin 12 KB
hvdump315_reversing/proc_3/unknown_seg.addr 0.1 KB
hvdump315_reversing/proc_3/unknown_seg.bin 28 KB
hvdump315_reversing/proc_5/code_seg.addr 0.9 KB
hvdump315_reversing/proc_5/code_seg.bin 0.2 MB
hvdump315_reversing/proc_5/code_seg.idb 2.8 MB
hvdump315_reversing/proc_5/data_seg.addr 0.2 KB
hvdump315_reversing/proc_5/data_seg.bin 44 KB
hvdump315_reversing/proc_5/stack_seg.addr 0.1 KB
hvdump315_reversing/proc_5/stack_seg.bin 12 KB
hvdump315_reversing/proc_5/unknown_seg.addr 0 KB
hvdump315_reversing/proc_5/unknown_seg.bin 8 KB
hvdump315_reversing/proc_6/code_seg.addr 1.8 KB
hvdump315_reversing/proc_6/code_seg.bin 0.3 MB
hvdump315_reversing/proc_6/code_seg.idb 5.1 MB
hvdump315_reversing/proc_6/data_seg.addr 0.3 KB
hvdump315_reversing/proc_6/data_seg.bin 68 KB
hvdump315_reversing/proc_6/stack_seg.addr 0.1 KB
hvdump315_reversing/proc_6/stack_seg.bin 12 KB
hvdump315_reversing/proc_6/unknown_seg_1.addr 0 KB
hvdump315_reversing/proc_6/unknown_seg_1.bin 4 KB
hvdump315_reversing/proc_6/unknown_seg_2.addr 0 KB
hvdump315_reversing/proc_6/unknown_seg_2.bin 4 KB
hvdump315_reversing/proc_9/.unknown_seg_2.addr.swp 12 KB
hvdump315_reversing/proc_9/code_seg.addr 1.4 KB
hvdump315_reversing/proc_9/code_seg.bin 0.3 MB
hvdump315_reversing/proc_9/code_seg.idb 3.6 MB
hvdump315_reversing/proc_9/data_seg.addr 0.4 KB
hvdump315_reversing/proc_9/data_seg.bin 72 KB
hvdump315_reversing/proc_9/stack_seg.addr 0.1 KB
hvdump315_reversing/proc_9/stack_seg.bin 12 KB
hvdump315_reversing/proc_9/unknown_seg_1.addr 0.1 KB
hvdump315_reversing/proc_9/unknown_seg_1.bin 16 KB
hvdump315_reversing/proc_9/unknown_seg_2.addr 0.6 KB
hvdump315_reversing/proc_9/unknown_seg_3.addr 0 KB
hvdump315_reversing/proc_9/unknown_seg_3.bin 8 KB
hvdump315_reversing/repo_nodes/dump_repo_nodes.c 1.7 KB
hvdump315_reversing/repo_nodes/dump_repo_nodes.exe 17.9 KB
hvdump315_reversing/repo_nodes/hash_repo_node.c 1.5 KB
hvdump315_reversing/repo_nodes/hash_repo_node.exe 17.2 KB
hvdump315_reversing/repo_nodes/repo_nodes.txt 77.8 KB
hvdump315_reversing/repo_nodes/repo_nodes_storage_disk.txt 8.1 KB
hvdump315_reversing/repo_nodes/repo_nodes_storage_rbd.txt 8.1 KB
hvdump315_reversing/ss/.packet_and_function_ids.txt.swp 12 KB
hvdump315_reversing/ss/laid_and_paid.txt 3.3 KB
hvdump315_reversing/ss/packet_and_function_ids.txt 0.5 KB
hvdump341_reversing/dev_rflash1/metldr 58.2 KB
hvdump341_reversing/dump_flash_fat.bin 16 MB
hvdump341_reversing/dump_lv1_latest.bin 16 MB
hvdump341_reversing/dump_proc.sh 0.3 KB
hvdump341_reversing/hv_mmap_exploit_341.bin 16 MB
hvdump341_reversing/hv_mmap_exploit_341.idb 68 MB
hvdump341_reversing/lv1_341_decrypted.elf 3.8 MB
hvdump341_reversing/lv1_341_decrypted.i64 22 MB
hvdump341_reversing/proc_3/code_seg.addr 0.6 KB
hvdump341_reversing/proc_3/code_seg.bin 0.1 MB
hvdump341_reversing/proc_3/code_seg.idb 1.2 MB
hvdump341_reversing/proc_3/data_seg.addr 0.2 KB
hvdump341_reversing/proc_3/data_seg.bin 36 KB
hvdump341_reversing/proc_3/stack_seg.addr 0.1 KB
hvdump341_reversing/proc_3/unknown_seg_1.addr 0.1 KB
hvdump341_reversing/proc_3/unknown_seg_1.bin 28 KB
hvdump341_reversing/proc_3/unknown_seg_2.addr 0 KB
hvdump341_reversing/proc_3/unknown_seg_2.bin 4 KB
hvdump341_reversing/proc_5/code_seg.addr 0.9 KB
hvdump341_reversing/proc_5/code_seg.bin 0.2 MB
hvdump341_reversing/proc_5/code_seg.idb 1.8 MB
hvdump341_reversing/proc_5/data_seg.addr 0.2 KB
hvdump341_reversing/proc_5/data_seg.bin 44 KB
hvdump341_reversing/proc_5/stack_seg.addr 0.1 KB
hvdump341_reversing/proc_5/stack_seg.bin 12 KB
hvdump341_reversing/proc_5/unknown_seg.addr 0 KB
hvdump341_reversing/proc_5/unknown_seg.bin 8 KB
hvdump341_reversing/proc_6/code_seg.addr 1.8 KB
hvdump341_reversing/proc_6/code_seg.bin 0.3 MB
hvdump341_reversing/proc_6/code_seg.idb 3 MB
hvdump341_reversing/proc_6/data_seg.addr 0.3 KB
hvdump341_reversing/proc_6/data_seg.bin 68 KB
hvdump341_reversing/proc_6/stack_seg.addr 0.1 KB
hvdump341_reversing/proc_6/stack_seg.bin 12 KB
hvdump341_reversing/proc_6/unknown_seg_1.addr 0 KB
hvdump341_reversing/proc_6/unknown_seg_1.bin 4 KB
hvdump341_reversing/proc_6/unknown_seg_2.addr 0 KB
hvdump341_reversing/proc_6/unknown_seg_2.bin 4 KB
hvdump341_reversing/proc_9/code_seg.addr 1.3 KB
hvdump341_reversing/proc_9/code_seg.bin 0.2 MB
hvdump341_reversing/proc_9/code_seg.idb 2.4 MB
hvdump341_reversing/proc_9/data_seg.addr 0.3 KB
hvdump341_reversing/proc_9/data_seg.bin 56 KB
hvdump341_reversing/proc_9/stack_seg.addr 0.1 KB
hvdump341_reversing/proc_9/stack_seg.bin 12 KB
hvdump341_reversing/proc_9/unknown_seg_1.addr 0.1 KB
hvdump341_reversing/proc_9/unknown_seg_1.bin 16 KB
hvdump341_reversing/proc_9/unknown_seg_2.addr 0 KB
hvdump341_reversing/proc_9/unknown_seg_2.bin 8 KB
hvdump341_reversing/proc_elfs/pme_init 0.1 MB
hvdump341_reversing/proc_elfs/pme_init.i64 0.5 MB
hvdump341_reversing/repo_nodes/dump_repo_nodes.c 1.8 KB
hvdump341_reversing/repo_nodes/dump_repo_nodes.exe 17.9 KB
hvdump341_reversing/repo_nodes/repo_nodes.txt 77.4 KB
hvdump341_reversing/sc_eprom_after_set_token/sc_eprom_dump_0x02F00_0x02FFF.bin 0.3 KB
hvdump341_reversing/sc_eprom_after_set_token/sc_eprom_dump_0x03000_0x030FF.bin 0.3 KB
hvdump341_reversing/sc_eprom_after_set_token/sc_eprom_dump_0x48000_0x480FF.bin 0.3 KB
hvdump341_reversing/sc_eprom_after_set_token/sc_eprom_dump_0x48800_0x488FF.bin 0.3 KB
hvdump341_reversing/sc_eprom_after_set_token/sc_eprom_dump_0x48C00_0x48CFF.bin 0.3 KB
hvdump341_reversing/sc_eprom_after_set_token/sc_eprom_dump_0x48D00_0x48DFF.bin 0.3 KB
hvdump341_reversing/sc_eprom_before_set_token/sc_eprom_dump_0x02F00_0x02FFF.bin 0.3 KB
hvdump341_reversing/sc_eprom_before_set_token/sc_eprom_dump_0x03000_0x030FF.bin 0.3 KB
hvdump341_reversing/sc_eprom_before_set_token/sc_eprom_dump_0x48000_0x480FF.bin 0.3 KB
hvdump341_reversing/sc_eprom_before_set_token/sc_eprom_dump_0x48800_0x488FF.bin 0.3 KB
hvdump341_reversing/sc_eprom_before_set_token/sc_eprom_dump_0x48C00_0x48CFF.bin 0.3 KB
hvdump341_reversing/sc_eprom_before_set_token/sc_eprom_dump_0x48D00_0x48DFF.bin 0.3 KB
hvdump341_reversing/spus/isoldr_341.elf 75.6 KB
hvdump341_reversing/spus/isoldr_341_objdump.asm 0.7 MB
hvdump341_reversing/spus/sb_iso_spu_module.elf 62.5 KB
hvdump341_reversing/spus/sb_iso_spu_module_ida.asm 0.2 MB
hvdump341_reversing/spus/sb_iso_spu_module_objdump.asm 0.5 MB
hvdump341_reversing/spus/sc_iso.elf 81.7 KB
hvdump341_reversing/spus/sc_iso_ida.asm 0.4 MB
hvdump341_reversing/spus/sc_iso_objdump.asm 0.8 MB
hvdump341_reversing/spus/spu_token_processor.elf 22.3 KB
hvdump341_reversing/spus/spu_token_processor_ida.asm 0.1 MB
hvdump341_reversing/spus/spu_token_processor_objdump.asm 0.2 MB
hvdump355_reversing/dump_proc.sh 0.3 KB
hvdump355_reversing/dump_protpages/dump_protpages.c 2.1 KB
hvdump355_reversing/dump_protpages/dump_protpages.exe 11.5 KB
hvdump355_reversing/dump_protpages/dump_protpages.exe.stackdump 0.8 KB
hvdump355_reversing/hvdump_355.bin 16 MB
hvdump355_reversing/hvdump_355.idb 67 MB
hvdump355_reversing/proc_3/code_seg.addr 0.7 KB
hvdump355_reversing/proc_3/code_seg.bin 0.1 MB
hvdump355_reversing/proc_3/code_seg.idb 1.3 MB
hvdump355_reversing/proc_3/data_seg.addr 0.2 KB
hvdump355_reversing/proc_3/data_seg.bin 36 KB
hvdump355_reversing/proc_3/pages 1.1 KB
hvdump355_reversing/proc_3/stack_seg.addr 0.1 KB
hvdump355_reversing/proc_3/stack_seg.bin 12 KB
hvdump355_reversing/proc_3/unknown_seg.addr 0.2 KB
hvdump355_reversing/proc_3/unknown_seg.bin 32 KB
hvdump355_reversing/proc_5/code_seg.addr 1 KB
hvdump355_reversing/proc_5/code_seg.bin 0.2 MB
hvdump355_reversing/proc_5/code_seg.idb 1.6 MB
hvdump355_reversing/proc_5/data_seg.addr 0.2 KB
hvdump355_reversing/proc_5/data_seg.bin 44 KB
hvdump355_reversing/proc_5/pages 1.3 KB
hvdump355_reversing/proc_5/stack_seg.addr 0.1 KB
hvdump355_reversing/proc_5/stack_seg.bin 12 KB
hvdump355_reversing/proc_5/unknown_seg.addr 0 KB
hvdump355_reversing/proc_5/unknown_seg.bin 8 KB
hvdump355_reversing/proc_6/code_seg.addr 2 KB
hvdump355_reversing/proc_6/code_seg.bin 0.3 MB
hvdump355_reversing/proc_6/code_seg.idb 3.3 MB
hvdump355_reversing/proc_6/data_seg.addr 0.4 KB
hvdump355_reversing/proc_6/data_seg.bin 68 KB
hvdump355_reversing/proc_6/pages 2.4 KB
hvdump355_reversing/proc_6/stack_seg.addr 0.1 KB
hvdump355_reversing/proc_6/stack_seg.bin 12 KB
hvdump355_reversing/proc_6/unknown_seg1.addr 0 KB
hvdump355_reversing/proc_6/unknown_seg1.bin 4 KB
hvdump355_reversing/proc_6/unknown_seg2.addr 0 KB
hvdump355_reversing/proc_6/unknown_seg2.bin 4 KB
hvdump355_reversing/proc_9/code_seg.addr 1.4 KB
hvdump355_reversing/proc_9/code_seg.bin 0.2 MB
hvdump355_reversing/proc_9/code_seg.idb 2.1 MB
hvdump355_reversing/proc_9/data_seg.addr 0.3 KB
hvdump355_reversing/proc_9/data_seg.bin 56 KB
hvdump355_reversing/proc_9/pages 2.5 KB
hvdump355_reversing/proc_9/stack_seg.addr 0.1 KB
hvdump355_reversing/proc_9/stack_seg.bin 12 KB
hvdump355_reversing/proc_9/unknown_seg1.addr 0.1 KB
hvdump355_reversing/proc_9/unknown_seg1.bin 16 KB
hvdump355_reversing/proc_9/unknown_seg2.addr 0 KB
hvdump355_reversing/proc_9/unknown_seg2.bin 8 KB
payload.tar.gz 96.2 KB
ps3wiki/Basic Bluray disc authentication procedure.htm 13.3 KB
ps3wiki/Booting Linux from internal HDD.htm 8.4 KB
ps3wiki/Booting Linux from internal HDD_2.htm 9.2 KB
ps3wiki/Booting Linux on 3.41 PS3 with petitboot from internal HDD.htm 9.1 KB
ps3wiki/Booting Linux on 3.41 PS3 with petitboot from internal HDD2.htm 10 KB
ps3wiki/Booting petitboot from VFLASH.htm 20.2 KB
ps3wiki/Booting_Linux_2.6_kernel_on_running_PS3_Linux_with_kexec.htm 1 KB
ps3wiki/Cell Programming Tutorial – IBM.htm 10.7 KB
ps3wiki/Drk notes.htm 13.8 KB
ps3wiki/Dump_of_all_repository_nodes_from_HV_3.15.htm 1 KB
ps3wiki/Dump_of_all_repository_nodes_from_HV_3.41_dump_made_from_GameOS.htm 84.5 KB
ps3wiki/Error_codes.htm 0.8 KB
ps3wiki/Hardware flashing.htm 7.9 KB
ps3wiki/Hypervisor Reverse Engineering.htm 0.3 MB
ps3wiki/Installing Linux on internal HDD.htm 14.7 KB
ps3wiki/Lv-2 syscalls.htm 26.4 KB
ps3wiki/Lv-2_functions.htm 0.8 KB
ps3wiki/Main Page.htm 14.9 KB
ps3wiki/PDB file format.htm 14.8 KB
ps3wiki/PS3 Payload Developement.htm 29.5 KB
ps3wiki/PSGroove.htm 15 KB
ps3wiki/PSJailbreak Exploit Payload Reverse Engineering.htm 14.7 KB
ps3wiki/PSJailbreak Exploit Reverse Engineering.htm 22.4 KB
ps3wiki/PSJailbreak Payload Reverse Engineering.htm 52.4 KB
ps3wiki/PUP File Format.htm 11.4 KB
ps3wiki/Self Crypto.htm 8.3 KB
ps3wiki/SELF File Format and Decryption.htm 17.3 KB
ps3wiki/Self file format.htm 12.4 KB
ps3wiki/Self file format_2.htm 13.1 KB
ps3wiki/Talk.Lv-2 functions.htm 7.8 KB
ps3wiki/Talk.SELF File Format and Decryption.htm 18.4 KB
ps3wiki/XRegistry File Format.htm 51.9 KB
ps3wiki/XRegistry File Format_2.htm 52.7 KB

emer init.self[edit source]

Program 1[edit source]

Crossreference: gitbrew.org::emer_init.self:Program_1 

0x40000                          # bind object to subchannel 0
0x31337000

0x3C0180
0x66604200
0xFEED0000
0xFEED0001
0xFEED0000
0x0
0xFEED0000
0xFEED0000
0xFEED0000
0xFEED0001
0x66606660
0x66626660
0x0
0x0
0xFEED0000
0xFEED0000

0x40060
0x66616661

0x340200
0x0
0x0
0x121
0x40
0x0
0x0
0x0
0x40
0x1
0x80
0x100
0x40
0x0

0x100280
0x40
0x40
0x0
0x0

0x41D80
0x3

0x4802B8
0x0
0x0
0xFFF0000
0xFFF0000
0xFFF0000
0xFFF0000
0xFFF0000
0xFFF0000
0xFFF0000
0xFFF0000
0xFFF0000
0xFFF0000
0xFFF0000
0xFFF0000
0xFFF0000
0xFFF0000
0xFFF0000

0x81D98
0xFFF0000
0xFFF0000

0x41DA4
0x0

0x403B0
0x10

0x41454
0x0

0x41FF4
0x3FFFFF

0x181FC0
0x0
0x6144321
0xEDCBA987
0x6F
0x171615
0x1B1A19

0x280B40
0x0
0x0
0x0
0x0
0x0
0x0
0x0
0x0
0x0
0x0

0x40A0C
0x0

0xC0A60
0x0
0x0
0x0

0x80A78
0x0
0x0

0x41428
0x1

0x41D88
0x1000

0x41E94
0x11

0x41450
0x80003

0x41FE0
0x2000000

0x400B00
0x2DC8
0x2DC8
0x2DC8
0x2DC8
0x2DC8
0x2DC8
0x2DC8
0x2DC8
0x2DC8
0x2DC8
0x2DC8
0x2DC8
0x2DC8
0x2DC8
0x2DC8
0x2DC8

0x1008CC
0x800
0x0
0x0
0x0

0x100240
0xFFFF
0x0
0x0
0x0
0x0

0xC003C0
0x10101
0x10101
0x10101
0x10101
0x10101
0x10101
0x10101
0x10101
0x10101
0x10101
0x10101
0x10101
0x10101
0x10101
0x10101
0x10101
0x7421
0x7421
0x7421
0x7421
0x7421
0x7421
0x7421
0x7421
0x7421
0x7421
0x7421
0x7421
0x7421
0x7421
0x7421
0x7421
0x9AABAA98
0x66666789
0x98766666
0x89AABAA9
0x99999999
0x88888889
0x98888888
0x99999999
0x56676654
0x33333345
0x54333333
0x45667665
0xAABBBA99
0x66667899
0x99876666
0x99ABBBAA

0x81738
0x0
0x0

0x4E000                          # bind object to subchannel 7
0xCAFEBABE

Program 2[edit source]

Crossreference: gitbrew.org::emer_init.self:Program_2 

0x80308
0x207
0x0

0x40304
0x0

0xC0350
0x207
0x0
0xFF

0x4034C
0xFF

0xC035C
0x1E00
0x1E00
0x1E00

0x4031C
0x0

0x4037C
0x0

0x40310
0x0

0x4036C
0x0

0x40320
0x80068006

0x80314
0x10001
0x0

0x41D8C
0xFFFFFF00

0x41D94
0x0

0x40100
0x0

0x40324
0x1010101

0x4183C
0x0

0x41830
0x405

0x80384
0x0
0x3F800000

0x40380
0x0

0x40A6C
0x201

0x40A70
0x1

0x40A74
0x0

0x40300
0x1

0x41FEC
0x0

0x41FC0
0x0

0x41834
0x901

0x403B8
0x8

0x40374
0x0

0x40378
0x1503

0x41EE0
0x3F800000

0x40A68
0x0

0x80A78
0x0
0x0

0x41DAC
0x0

0x41DB0
0xFFFFFFFF

0x808C0
0x10000000
0x10000000

0x40368
0x1D01

0xC0330
0x207
0x0
0xFF

0x4032C
0xFF

0xC033C
0x1E00
0x1E00
0x1E00

0x40328
0x0

for (x = 0; x < 16; x++)
{
    0x41A08 + (x * 0x20)
    0x30101

    0x41A1C + (x * 0x20)
    0x0

    0x41A0C + (x * 0x20)
    0x60000

    0x41A14 + (x * 0x20)
    0x2052000
}

0x40348
0x0

for (x = 0; x < 16; x++)
{
    0x41740 + (x * 0x4)
    0x2

    0x41680 + (x * 0x4)
    0x0
}

0x80A00
0x10000000
0x10000000

0x80394
0x0
0x3F800000

0x200A20
2048.0
2048.0
0.5
0x0
2048.0
2048.0
0.5
0x0

0x200A20
2048.0
2048.0
0.5
0x0
2048.0
2048.0
0.5
0x0

0x41D7C
0xFFFF0000

0x4182C
0x1B02

0x41D90
0x0

0x40370
0x0

0x41828
0x1B02

0x403BC
0x0

0x41DB4
0x0

0x41EE4
0x0

0x41EE8
0x0

0x41838
0x0

0x4147C
0x0

0x41E98
0x1000000

0x41478
0x0

0x41FF0
0xFFFF

0x417CC
0x0

for (x = 0; x < 16; x++)
{
    0x40908 + (x * 0x20)
    0x101

    0x4091C + (x * 0x20)
    0x0

    0x4090C + (x * 0x20)
    0x60000

    0x40914 + (x * 0x20)
    0x0
}

0x40238
0x0

0x41D78
0x1

0x4142C
0x0

0x41FF8
0x0

0x41FE8
0x0

Program 3[edit source]

Crossreference: gitbrew.org::emer_init.self:Program_2 

0x42000                       # bind object to subchannel 1
0x31337303

0xC2180                       # method of subchannel 1
0x66604200
0xFEED0001
0xFEED0000

0x46000                       # bind object to subchannel 3
0x313371C3

0xC6180                       # method of subchannel 3
0x66604200
0xFEED0000
0xFEED0000

0x4A000                       # bind object to subchannel 5
0x31337808

0x20A180                      # method of subchannel 5
0x66604200
0x0
0x0
0x0
0x0
0x0
0x0
0x313371C3

0x8A2FC                       # method of subchannel 5
0x3
0x4

0x48000                       # bind object to subchannel 4
0x31337A73

0x88180                       # method of subchannel 4
0x66604200
0xFEED0000

0x4C000                       # bind object to subchannel 6
0x3137AF00

0x4C180                       # method of subchannel 6
0x66604200

About RSX[edit source]

RAMIN is on VRAM.
0x28002010000 contains the same as 0x2808FF90000
0x28002050000 contains the same as 0x2808FFD0000
you can prove that by writing in one offset and reading the other
0x2808XXXXXXX is BAR1 (i.e. VRAM on Nvidia GPUs)
0x28002XXXXXX is BAR2 (i.e. PRAMIN on Nvidia GPUs)
Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=Talk:Hypervisor_Reverse_Engineering&oldid=70752"