Talk:SC EEPROM: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
No edit summary
 
(53 intermediate revisions by 2 users not shown)
Line 4: Line 4:


Pseudo-code:
Pseudo-code:
<source lang="python">
<syntaxhighlight lang="python">
def check_bootrom_diag_mode(mode, param)
def check_bootrom_diag_mode(mode, param)
         diag_mode = get_eeprom_bootrom_diag()
         diag_mode = get_eeprom_bootrom_diag()
Line 16: Line 16:
                 param = -1
                 param = -1
         return 1
         return 1
</source>
</syntaxhighlight>


== EEPROM Dumps ==
== EEPROM Dumps ==
Line 28: Line 28:
== Bus Pirate stuff ==
== Bus Pirate stuff ==


http://i.imgur.com/48rbR51.png
https://www.psdevwiki.com/ps3/File:48rbR51.png


(needs more wikifying)
(needs more wikifying)
Line 73: Line 73:


http://rmscrypt.wordpress.com/2011/02/01/lets-look-at-syscon/
http://rmscrypt.wordpress.com/2011/02/01/lets-look-at-syscon/
= BE Count region =
The format of this region is weird, in mullions have a size of 0x200 but it was reduced to 0x100 for sherwoods<br>
In sherwoods it seems to start with 2 bytes (bringup counter), 2 bytes (shutdown counter), 4 bytes (total runtime in seconds), 4 bytes (unknown, but the last 2 bytes are always 0000), then value 0x3CEF0000 (unknown, seems to be static). The rest of the region is filled with FF, some consoles have 2 bytes used at relative offset 0x20 (as example, with value 0x55AA)
Example (CokR40, REX-001emmc, SW3-304)
<pre>
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000800  05 B6 05 23 00 3D AD FA F4 80 00 00 3C EF 00 00  .¶.#.=­úô€..<ï..
00000810  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000820  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000830  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000840  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000850  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000860  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000870  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000880  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000890  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
Example (CokG11, DYN-001, SW2-301)
<pre>
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000800  07 C8 07 94 00 9E 23 A6 F4 80 00 00 3C EF 00 00  .È.”.ž#¦ô€..<ï..
00000810  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000820  55 AA FF FF FF FF FF FF FF FF FF FF FF FF FF FF  Uªÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000830  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000840  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000850  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000860  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000870  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000880  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000890  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
*Note the bytes at relative offset 0x20 with value 0x55AA, this bytes are a rarity, only found in 1 syscon dump from 10 checked
----
Example (CokE10, DIA-002, CXR714120-302GB), 5 dumps of the same motherboard after 4 reboots
<pre style="height:600px">
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000  00 0C 00 0A 00 00 00 6A FF FF FF FF FF FF FF FF  .......jÿÿÿÿÿÿÿÿ
00000010  FF FF FF FF F4 00 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000020  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000030  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000040  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000050  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000060  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000070  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000080  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000090  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000F0  FF FF FF FF FF FF FF FF 91 FF FF FF 30 09 45 0D  ÿÿÿÿÿÿÿÿ‘ÿÿÿ0.E.
00000100  00 0D 00 09 00 00 00 84 FF FF FF FF FF FF FF FF  .......„ÿÿÿÿÿÿÿÿ
00000110  FF FF FF FF F4 00 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000120  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000130  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000140  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000150  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000160  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000170  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000180  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000190  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001F0  FF FF FF FF FF FF FF FF 8F FF FF FF 38 09 43 0D  ÿÿÿÿÿÿÿÿ.ÿÿÿ8.C.
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000  00 0E 00 0A 00 00 00 94 FF FF FF FF FF FF FF FF  .......”ÿÿÿÿÿÿÿÿ
00000010  FF FF FF FF F4 02 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000020  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000030  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000040  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000050  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000060  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000070  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000080  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000090  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000F0  FF FF FF FF FF FF FF FF 93 FF FF FF 30 0B 45 0F  ÿÿÿÿÿÿÿÿ“ÿÿÿ0.E.
00000100  00 0D 00 0B 00 00 00 84 FF FF FF FF FF FF FF FF  .......„ÿÿÿÿÿÿÿÿ
00000110  FF FF FF FF F4 00 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000120  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000130  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000140  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000150  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000160  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000170  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000180  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000190  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001F0  FF FF FF FF FF FF FF FF 91 FF FF FF 38 09 45 0D  ÿÿÿÿÿÿÿÿ‘ÿÿÿ8.E.
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000  00 0E 00 0C 00 00 00 94 FF FF FF FF FF FF FF FF  .......”ÿÿÿÿÿÿÿÿ
00000010  FF FF FF FF F4 02 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000020  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000030  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000040  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000050  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000060  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000070  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000080  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000090  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000F0  FF FF FF FF FF FF FF FF 95 FF FF FF 30 0B 47 0F  ÿÿÿÿÿÿÿÿ•ÿÿÿ0.G.
00000100  00 0F 00 0B 00 00 00 A4 FF FF FF FF FF FF FF FF  .......¤ÿÿÿÿÿÿÿÿ
00000110  FF FF FF FF F4 00 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000120  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000130  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000140  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000150  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000160  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000170  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000180  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000190  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001F0  FF FF FF FF FF FF FF FF 93 FF FF FF 38 0B 45 0F  ÿÿÿÿÿÿÿÿ“ÿÿÿ8.E.
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000  00 10 00 0C 00 00 00 B4 FF FF FF FF FF FF FF FF  .......´ÿÿÿÿÿÿÿÿ
00000010  FF FF FF FF F4 02 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000020  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000030  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000040  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000050  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000060  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000070  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000080  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000090  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000F0  FF FF FF FF FF FF FF FF 97 FF FF FF 30 0D 47 11  ÿÿÿÿÿÿÿÿ—ÿÿÿ0.G.
00000100  00 0F 00 0D 00 00 00 A4 FF FF FF FF FF FF FF FF  .......¤ÿÿÿÿÿÿÿÿ
00000110  FF FF FF FF F4 00 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000120  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000130  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000140  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000150  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000160  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000170  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000180  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000190  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001F0  FF FF FF FF FF FF FF FF 95 FF FF FF 38 0B 47 0F  ÿÿÿÿÿÿÿÿ•ÿÿÿ8.G.
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000  00 10 00 0E 00 00 00 B4 FF FF FF FF FF FF FF FF  .......´ÿÿÿÿÿÿÿÿ
00000010  FF FF FF FF F4 02 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000020  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000030  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000040  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000050  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000060  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000070  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000080  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000090  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000F0  FF FF FF FF FF FF FF FF 99 FF FF FF 30 0D 49 11  ÿÿÿÿÿÿÿÿ™ÿÿÿ0.I.
00000100  00 11 00 0D 00 00 00 C7 FF FF FF FF FF FF FF FF  .......Çÿÿÿÿÿÿÿÿ
00000110  FF FF FF FF F4 00 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000120  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000130  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000140  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000150  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000160  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000170  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000180  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000190  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001F0  FF FF FF FF FF FF FF FF 97 FF FF FF 38 0D 47 11  ÿÿÿÿÿÿÿÿ—ÿÿÿ8.G.
</pre>


= Experimental table =
= Experimental table =
Line 78: Line 307:


{| class="wikitable sortable" style="line-height:100%; font-size:85%"
{| class="wikitable sortable" style="line-height:100%; font-size:85%"
|+ Round 2
|+ Round 3
! colspan="3" | Area !! colspan="4" | [[Syscon_Hardware|<abbr title="Only Mullion syscons have a direct SPI access to the EEPROM>SPI</abbr> / <abbr title="All syscons have a UART access>UART</abbr>]] !! colspan="6" | [[LV2_Functions_and_Syscalls#process_socket_service_syscalls|Syscall 863]] !! class="unsortable" rowspan="3" | Data Name !! class="unsortable" rowspan="3" | Wikitable builder Notes (temporal)
! colspan="3" | Area !! colspan="4" | [[Syscon_Hardware|<abbr title="Only Mullion syscons have a direct SPI access to the EEPROM>SPI</abbr> / <abbr title="All syscons have a UART access>UART</abbr>]] !! colspan="5" | [[LV2_Functions_and_Syscalls#process_socket_service_syscalls|Syscall 863]] (sys_ss_update_manager) !! class="unsortable" rowspan="3" | Data Name !! class="unsortable" rowspan="3" | Wikitable builder Notes (temporal)
|-
|-
! class="unsortable" rowspan="2" | Name !! class="unsortable" rowspan="2" | Size !! class="unsortable" style="padding:1px" rowspan="2" | [[Template:Syscon_checksums|<Abbr title="Checksum">csum</abbr>]] !! colspan="2" | [[Mullion]] !! style="padding:1px" | [[Sherwood]] !! style="padding:1px" | whitelist !! class="unsortable" style="padding:1px" rowspan="2" | [[SC_Communication#Syscon_Services|Block ID<br>NVS Region]] !! colspan="3" | whitelist !! rowspan="2" | Offset !! class="unsortable" rowspan="2" | Size
! class="unsortable" rowspan="2" | Name !! class="unsortable" rowspan="2" | Size !! class="unsortable" style="padding:1px" rowspan="2" | [[Template:Syscon_checksums|<Abbr title="Checksum">csum</abbr>]] !! colspan="2" | [[Mullion]] !! style="padding:1px" | [[Sherwood]] !! style="padding:1px" | Whitelist !! class="unsortable" style="padding:1px" colspan="2" | [[SC_Manager#0x900B_-_SC_Read_EPROM|Block Access]] !! colspan="3" | Whitelist
|-
|-
! [[Syscon_CXR713_Series|CXR713]] !! [[Syscon_CXR714_Series|CXR714]] !! [[Syscon_SW_Series|SW]]/[[Syscon_SW2_Series|2]]/[[Syscon_SW3_Series|3]]<small><abbr title="Emulated EEPROM">(emu)</abbr></small> !! class="unsortable" | [[Syscon_Firmware#Command_list|EEP]] !! class="unsortable" | lv1/[[Dispatcher_Manager|DM]] !! class="unsortable" | [[Update_Manager|UM]] !! class="unsortable" | [[SC_Manager|SCM]]
! <abbr title="201GB, 202GB">32KB</abbr> !! <abbr title="203GB, 301GB, 302GB, 303GB, 304GB">20KB</abbr> !! [[Syscon_SW_Series|SW]]/[[Syscon_SW2_Series|2]]/[[Syscon_SW3_Series|3]]<small><abbr title="Emulated EEPROM">(emu)</abbr></small> !! class="unsortable" | [[Syscon_Firmware#Command_list|EEP]] !! ID !! Offset !! class="unsortable" | [[SC_Manager|SCM]] !! class="unsortable" | [[Update_Manager|UM]] !! class="unsortable" | [[Dispatcher_Manager|DM]]
|- class="sorttop"
|- class="sorttop"
! colspan="15" style="padding:0px" |
! colspan="14" style="padding:0px" |
|-
! Authenticated Data !! 0x2600 !! {{no}}
| 0x0000 || 0x0000 || ? || {{exploitable}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} ||  || Data table (0x160+(0x9*0x400)) ?
|- {{cellcolors|#ddddff}}
|- {{cellcolors|#ddddff}}
! System Info !! 0x200 !! {{no}}
! System Info !! 0x200 !! {{no}}
| 0x2600 || 0x2600 || ? || {{exploitable}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x200 ||  ||  
| 0x2600 || 0x2600 || <abbr title="SW at 0x70000, or SW2/3 at 0xB0000">0x70000</abbr> ? || {{exploitable}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} ||  || This wikitable row needs to be splitted up to 5+ rows
|- {{cellcolors|#ffffcc}}
|- {{cellcolors|#ffffcc}}
! Patch 1 !! 0x400 !! {{No}}
! Patch 1 !! 0x400 !! {{No}}
| 0x2800 || 0x2800 || <abbr title="On Sherwood the patch isn't even stored in the emulated eeprom, it's stored inside the firmware (0x2000-0x2FFF)>0x2000 ?</abbr> || {{exploitable}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x400 || [[Syscon_Firmware#Syscon_patches|Syscon Firmware Patch]] (top half) Encrypted ||  
| <abbr title="Encrypted">0x2800</abbr> || <abbr title="Encrypted">0x2800</abbr> || <abbr title="The patch, in decrypted format, is stored in a contiguos area in FLASH, offset 0x2000, length 0x1000>0x2000</abbr> || {{exploitable}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || [[Syscon_Firmware#Syscon_patches|Syscon Firmware Patch]] (top half) ||  
|- {{cellcolors|lightgrey}}
|- {{cellcolors|lightgrey}}
! - !! 0x300 !! {{No}}
! - !! 0x300 !! {{No}}
| 0x2C00 || 0x2C00 || 0x0B00 ? || {{yes}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x300 || style="text-align:center" | ''not used'' || Filled with FF's
| 0x2C00 || 0x2C00 || 0x0B00 || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || style="text-align:center" | ''not used'' || Filled with FF's
|-
|-
! Industry Area !! 0x100 !! {{no}}
! Industry Area !! 0x100 !! {{no}}
| 0x2F00 || 0x2F00 || 0x0E00 || {{yes}} || 0x10 || {{patchable}} || {{yes}} || {{yes}} || 0x02F00 ||  ||  || This wikitable row needs to be splitted up to 20+ rows
| 0x2F00 || 0x2F00 || 0x0E00 || {{yes}} || 0x10 || 0x02F00 || {{yes}} || {{yes}} || {{patchable}} ||  || This wikitable row needs to be splitted up to 20+ rows
|- {{cellcolors|#e3e3e3}}
|- {{cellcolors|#e3e3e3}}
! Customer Service Area !! 0x100 !! {{no}}
! Customer Service Area !! 0x100 !! {{no}}
| 0x3000 || 0x3000 || 0x0F00 || {{yes}} || 0x20 || {{patchable}} || {{yes}} || {{yes}} || 0x03000 || 0x100 ||  || Filled with FF's ?
| 0x3000 || 0x3000 || 0x0F00 || {{yes}} || 0x20 || 0x03000 || {{yes}} || {{yes}} || {{patchable}} ||  || Filled with FF's ?
|-
|-
! Platform Config !! 0x100 !! {{yes}}
! Platform Config !! 0x100 !! {{yes}}
| 0x3100 || 0x3100 || 0x0000~ ? || {{yes}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x100 ||  ||  
| 0x3100 || 0x3100 || 0x0040~ || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} ||  || This wikitable row needs to be splitted up to 5+ rows
|-
|-
! Hardware Config !! 0x100 !! {{yes}}
! Hardware Config !! 0x100 !! {{yes}}
| 0x3200 || 0x3200 || 0x0000~ ? || {{yes}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x100 ||  ||  
| 0x3200 || 0x3200 || 0x0140~ || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} ||  || This wikitable row needs to be splitted up to 40+ rows
|-
|-
! Thermal Config !! 0x200 !! {{yes}}
! Thermal Config !! 0x200<!-- size reduced to 0x1B0 for sherwoods ? --> !! {{yes}}
| 0x3300 || 0x3300 || 0x0250 || {{yes}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x200 || [[Syscon_Thermal_Config/structs|Data table]]. See: [[Syscon Thermal Config]] ||  
| 0x3300 || 0x3300 || 0x0250 (size 0x1B0) || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || [[Syscon_Thermal_Configs/structs|Data table]]. See: [[Syscon Thermal Configs]] ||  
|-
|-
! On/Off Count/Time !! 0x200 !! {{no}}
! BE Count !! 0x200<!-- size reduced to 0x100 for sherwoods ? --> !! {{no}}
| 0x3500 || 0x3500 || 0x0800 ? || {{yes}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x200 || Data table ||  
| 0x3500 || 0x3500 || 0x0800 (size 0x100) || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || Data table ||  
|-
|-
! Error Log !! 0x100 !! {{no}}
! Error Log !! 0x100 !! {{no}}
| 0x3700 || 0x3700 || 0x0900 || {{yes}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x100 || Data table. See: [[Syscon Error Codes]] ||  
| 0x3700 || 0x3700 || 0x0900 || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || Data table. See: [[Syscon Error Codes]] ||  
|- {{cellcolors|lightgrey}}
|- {{cellcolors|lightgrey}}
! - !! 0x100 !! {{No}}
! - !! 0x100 !! {{No}}
| 0x3800 || 0x3800 || N/A ? || {{yes}} ? || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x100 || style="text-align:center" | ''not used'' || Filled with FF's
| 0x3800 || 0x3800 || N/A ? || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || style="text-align:center" | ''not used'' || Filled with FF's
|-
|-
! Board Config !! 0x100 !! {{yes}}
! Board Config/Debug !! 0x100 !! {{yes}}
| 0x3900 || 0x3900 || 0x0000~ ? || {{yes}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x100 ||  ||  
| 0x3900 || 0x3900 || 0x0000~ ? || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} ||  || This wikitable row needs to be splitted up to 15+ rows
|-
|-
! HDMI/DVE Config !! 0x100 !! {{no}}
! HDMI/DVE Config !! 0x100 !! {{no}}
| 0x3A00 || 0x3A00 || 0x0A00 ? || {{yes}} ? || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x100 ||  ||  
| 0x3A00 || 0x3A00 || 0x0A00 || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} ||  || This wikitable row needs to be splitted up to 5+ rows
|- {{cellcolors|lightgrey}}
|- {{cellcolors|lightgrey}}
! - !! 0x100 !! {{No}}
! - !! 0x100 !! {{No}}
| 0x3B00 || 0x3B00 || N/A ? || {{yes}} ? || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x100 || style="text-align:center" | ''not used'' || Filled with FF's
| 0x3B00 || 0x3B00 || N/A ? || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || style="text-align:center" | ''not used'' || Filled with FF's
|- {{cellcolors|lightgrey}}
! - !! 0x200 !! {{yes}}
| 0x3C00 || 0x3C00 || 0x0400~ ? || {{yes}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x200 || style="text-align:center" | ''not used'' || Filled with FF's
|- {{cellcolors|lightgrey}}
! - !! 0x200 !! {{yes}}
| 0x3E00 || 0x3E00 || 0x0600 ? || {{yes}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x200 || style="text-align:center" | ''not used'' || Filled with FF's
|- {{cellcolors|lightgrey}}
! - !! 0x400 !! {{No}}
| 0x4000 || 0x7000 || N/A ? || {{yes}} ? || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x400 || style="text-align:center" | ''not used'' || Filled with FF's
|- {{cellcolors|lightgrey}}
|- {{cellcolors|lightgrey}}
! - !! 0xB00 !! {{No}}
! Config Ring !! 0x200 !! {{yes}}
| 0x4400 || 0x7400 || N/A ? || {{yes}} ? || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0xB00 || style="text-align:center" | ''not used'' || Filled with FF's
| 0x3C00 || 0x3C00 || 0x0400 ? || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || style="text-align:center" | ''not used'' || <abbr title="When filled with 0xFF's the checksum at the last 2 bytes is 0xFF00">Filled with FF's</abbr>
|- {{cellcolors|lightgrey}}
|- {{cellcolors|lightgrey}}
! - !! 0x2000 !! {{No}}
! Debug 2 !! 0x200 !! {{yes}}
| 0x5000 || 0x5000 || N/A ? || {{yes}} ? || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0x2000 || style="text-align:center" | ''not used'' || Filled with FF's
| 0x3E00 || 0x3E00 || 0x0600 ? || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || style="text-align:center" | ''not used'' || <abbr title="When filled with 0xFF's the checksum at the last 2 bytes is 0xFF00">Filled with FF's</abbr>
|- {{cellcolors|#888}}
! - !! 0x3000 !! {{No}}
| 0x4000 || N/A || N/A || {{yes}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || style="text-align:center" | ''reserved'' || Filled with FF's
|- {{cellcolors|#e3e3e3}}
|- {{cellcolors|#e3e3e3}}
! System Config ? !! 0x100 !! {{no}}
! System Config ? !! 0x100 !! {{no}}
| 0x7000 || 0x4000 || 0x1000 || {{yes}} || 0x0 || {{patchable}} || {{patchable}} || {{yes}} || 0x48000 || 0x100 ||  || Filled with FF's ?
| 0x7000 || 0x4000 || 0x1000 || {{yes}} || 0x0 || 0x48000 || {{yes}} || {{patchable}} || {{patchable}} ||  || Filled with FF's ?
|-
|-
! Hypervisor Config ? !! 0x100 !! {{no}}
! Event Log ? !! 0x100 !! {{no}}
| 0x7100 || 0x4100 || 0x1100 || {{yes}} || 0x1 || {{patchable}} || {{patchable}} || {{yes}} || 0x48800 ||  || Data table (0x10+(0x6*0x28)) || <abbr title="It looks like a data table with a 0x10 header and six entries of 0x28 bytes lenght">Header + Data table ?</abbr>
| 0x7100 || 0x4100 || 0x1100 || {{yes}} || 0x1 || 0x48800 || {{yes}} || {{patchable}} || {{patchable}} || Data table (0x10+(0x6*0x28)) || <abbr title="It looks like a data table with a 0x10 header and six entries of 0x28 bytes lenght">Header + Data table ?</abbr>
|-
|-
! Flags and Tokens !! 0x100 !! {{no}}
! Flags and Tokens !! 0x100 !! {{no}}
| 0x7200 || 0x4200 || 0x1200 || {{yes}} || 0x2 || {{patchable}} || <abbr title="Every individual value needs a specific tag">Yes<br>or<br>Patch*</abbr> || {{yes}} || 0x48C00 ||  ||  || This wikitable row needs to be splitted up to 50+ rows
| 0x7200 || 0x4200 || 0x1200 || {{yes}} || 0x2 || 0x48C00 || {{yes}} || <abbr title="Every individual value needs a specific tag, either yes or patch">varies</abbr> || {{patchable}} ||  || This wikitable row needs to be splitted up to 50+ rows
|- {{cellcolors|#e3e3e3}}
|- {{cellcolors|#e3e3e3}}
! System Data ? !! 0x100 !! {{no}}
! System Data ? !! 0x100 !! {{no}}
| 0x7300 || 0x4300 || 0x1300 || {{yes}} || 0x3 || {{patchable}} || {{patchable}} || {{yes}} || 0x48D00 || 0x100 ||  || Filled with FF's ?
| 0x7300 || 0x4300 || 0x1300 || {{yes}} || 0x3 || 0x48D00 || {{yes}} || {{patchable}} || {{patchable}} ||  || Filled with FF's ?
|- {{cellcolors|#ffffcc}}
|- {{cellcolors|#ffffcc}}
! Patch 2 !! 0xC00 !! {{No}}
! Patch 2 !! 0xC00 !! {{No}}
| 0x7400 || 0x4400 || <abbr title="On Sherwood the patch isn't even stored in the emulated eeprom, it's stored inside the firmware (0x2000-0x2FFF)>0x2400 ?</abbr> || {{exploitable}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || ? || 0xC00 || [[Syscon_Firmware#Syscon_patches|Syscon Firmware Patch]] (bottom half) Encrypted ||
| <abbr title="Encrypted">0x7400</abbr> || <abbr title="Encrypted">0x4400</abbr> || <abbr title="The patch, in decrypted format, is stored in a contiguos area in FLASH, offset 0x2000, length 0x1000>0x2400</abbr> || {{exploitable}} || {{no}} || {{no}} || {{patchable}} || {{patchable}} || {{patchable}} || [[Syscon_Firmware#Syscon_patches|Syscon Firmware Patch]] (bottom half) ||
|}
|}

Latest revision as of 23:45, 6 May 2023

Memory test diagnosis NVS flag[edit source]

There is a NVS flag which enables a special diagnostic mode at startup. This flag is enabled on Proto/DECR. It allows memtest diagnose.

Pseudo-code: 

def check_bootrom_diag_mode(mode, param)
        diag_mode = get_eeprom_bootrom_diag()
        if diag_mode & 0x1:
                if diag_mode & 0x100:
                        return 0
                mode = (diag_mode >> 3) & 0x1
                param = (diag_mode >> 3) & 0x1
        else:
                mode = (diag_mode >> 1) & 0x1
                param = -1
        return 1

EEPROM Dumps[edit source]

EEPROM Strings (CP memory dump, DECR)[edit source]

http://pastie.org/private/usd2zi8mw3igycsh1a395q -> DEAD LINK

Bus Pirate stuff[edit source]

https://www.psdevwiki.com/ps3/File:48rbR51.png

(needs more wikifying)

On standby[edit source]

  • Note: during this time the plaintext EEPROM is never read even once!
  • Additionally, the areas 0x26B0, 0x26D0 are not read
  • Checks status
  • Unlocks Write Command
  • Reads PATCH top half region
  • Reads PATCH bottom half region
  • Reads 0x2790?(0x20)
  • Reads 0x27B0?(0x10)
  • Reads 0x26D0 (0x10)
  • Reads some configs? (around >0x31XX area)
  • Reads 0x0 (0x10)
  • Reads some configs?
  • Reads 0x10(0x280) (EID1)?
  • Reads 0x3A00 (0x1)
  • Reads 0x290 (0x10) (EID1 CMAC?)
  • Reads 0x2A0 (0x20)
  • Reads 0x2C0 (0x20)
  • Reads 0x2E0 (0x20)
  • Writes some stuff to 0x2C0/0x2E0/0x2A0 (mostly ff's)
  • ReReads EID1 and CMAC
  • Reads 0x360
  • Reads 0x370
  • Writes (again) mostly ff's to 0x360 and 0x370
  • ReReads EID1 and CMAC
  • Does same process with 0x460 and 0x470
  • Reads 0x2710 and 0x2730 (0x20,0x10) ???
  • Reads 0x2700 (0x10)
  • fini!

MemoryMap Syscon BB Chip[edit source]

0x1000-0x1FFF:PTCH Region (patch written here)

Nice read about Syscon EEPROM[edit source]

http://rmscrypt.wordpress.com/2011/02/01/lets-look-at-syscon/

BE Count region[edit source]

The format of this region is weird, in mullions have a size of 0x200 but it was reduced to 0x100 for sherwoods
In sherwoods it seems to start with 2 bytes (bringup counter), 2 bytes (shutdown counter), 4 bytes (total runtime in seconds), 4 bytes (unknown, but the last 2 bytes are always 0000), then value 0x3CEF0000 (unknown, seems to be static). The rest of the region is filled with FF, some consoles have 2 bytes used at relative offset 0x20 (as example, with value 0x55AA)

Example (CokR40, REX-001emmc, SW3-304) 

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000800  05 B6 05 23 00 3D AD FA F4 80 00 00 3C EF 00 00  .¶.#.=­úô€..<ï..
00000810  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000820  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000830  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000840  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000850  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000860  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000870  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000880  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000890  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

Example (CokG11, DYN-001, SW2-301) 

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000800  07 C8 07 94 00 9E 23 A6 F4 80 00 00 3C EF 00 00  .È.”.ž#¦ô€..<ï..
00000810  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000820  55 AA FF FF FF FF FF FF FF FF FF FF FF FF FF FF  Uªÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000830  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000840  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000850  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000860  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000870  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000880  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000890  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000008F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  • Note the bytes at relative offset 0x20 with value 0x55AA, this bytes are a rarity, only found in 1 syscon dump from 10 checked

Example (CokE10, DIA-002, CXR714120-302GB), 5 dumps of the same motherboard after 4 reboots 

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  00 0C 00 0A 00 00 00 6A FF FF FF FF FF FF FF FF  .......jÿÿÿÿÿÿÿÿ
00000010  FF FF FF FF F4 00 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000020  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000030  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000040  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000050  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000060  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000070  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000080  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000090  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000F0  FF FF FF FF FF FF FF FF 91 FF FF FF 30 09 45 0D  ÿÿÿÿÿÿÿÿ‘ÿÿÿ0.E.
00000100  00 0D 00 09 00 00 00 84 FF FF FF FF FF FF FF FF  .......„ÿÿÿÿÿÿÿÿ
00000110  FF FF FF FF F4 00 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000120  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000130  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000140  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000150  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000160  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000170  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000180  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000190  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001F0  FF FF FF FF FF FF FF FF 8F FF FF FF 38 09 43 0D  ÿÿÿÿÿÿÿÿ.ÿÿÿ8.C.

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  00 0E 00 0A 00 00 00 94 FF FF FF FF FF FF FF FF  .......”ÿÿÿÿÿÿÿÿ
00000010  FF FF FF FF F4 02 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000020  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000030  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000040  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000050  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000060  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000070  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000080  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000090  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000F0  FF FF FF FF FF FF FF FF 93 FF FF FF 30 0B 45 0F  ÿÿÿÿÿÿÿÿ“ÿÿÿ0.E.
00000100  00 0D 00 0B 00 00 00 84 FF FF FF FF FF FF FF FF  .......„ÿÿÿÿÿÿÿÿ
00000110  FF FF FF FF F4 00 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000120  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000130  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000140  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000150  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000160  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000170  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000180  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000190  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001F0  FF FF FF FF FF FF FF FF 91 FF FF FF 38 09 45 0D  ÿÿÿÿÿÿÿÿ‘ÿÿÿ8.E.

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  00 0E 00 0C 00 00 00 94 FF FF FF FF FF FF FF FF  .......”ÿÿÿÿÿÿÿÿ
00000010  FF FF FF FF F4 02 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000020  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000030  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000040  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000050  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000060  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000070  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000080  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000090  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000F0  FF FF FF FF FF FF FF FF 95 FF FF FF 30 0B 47 0F  ÿÿÿÿÿÿÿÿ•ÿÿÿ0.G.
00000100  00 0F 00 0B 00 00 00 A4 FF FF FF FF FF FF FF FF  .......¤ÿÿÿÿÿÿÿÿ
00000110  FF FF FF FF F4 00 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000120  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000130  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000140  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000150  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000160  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000170  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000180  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000190  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001F0  FF FF FF FF FF FF FF FF 93 FF FF FF 38 0B 45 0F  ÿÿÿÿÿÿÿÿ“ÿÿÿ8.E.

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  00 10 00 0C 00 00 00 B4 FF FF FF FF FF FF FF FF  .......´ÿÿÿÿÿÿÿÿ
00000010  FF FF FF FF F4 02 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000020  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000030  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000040  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000050  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000060  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000070  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000080  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000090  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000F0  FF FF FF FF FF FF FF FF 97 FF FF FF 30 0D 47 11  ÿÿÿÿÿÿÿÿ—ÿÿÿ0.G.
00000100  00 0F 00 0D 00 00 00 A4 FF FF FF FF FF FF FF FF  .......¤ÿÿÿÿÿÿÿÿ
00000110  FF FF FF FF F4 00 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000120  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000130  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000140  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000150  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000160  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000170  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000180  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000190  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001F0  FF FF FF FF FF FF FF FF 95 FF FF FF 38 0B 47 0F  ÿÿÿÿÿÿÿÿ•ÿÿÿ8.G.

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  00 10 00 0E 00 00 00 B4 FF FF FF FF FF FF FF FF  .......´ÿÿÿÿÿÿÿÿ
00000010  FF FF FF FF F4 02 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000020  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000030  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000040  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000050  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000060  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000070  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000080  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000090  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000F0  FF FF FF FF FF FF FF FF 99 FF FF FF 30 0D 49 11  ÿÿÿÿÿÿÿÿ™ÿÿÿ0.I.
00000100  00 11 00 0D 00 00 00 C7 FF FF FF FF FF FF FF FF  .......Çÿÿÿÿÿÿÿÿ
00000110  FF FF FF FF F4 00 00 00 FF FF FF FF FF FF FF FF  ÿÿÿÿô...ÿÿÿÿÿÿÿÿ
00000120  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000130  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000140  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000150  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000160  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000170  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000180  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000190  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000001F0  FF FF FF FF FF FF FF FF 97 FF FF FF 38 0D 47 11  ÿÿÿÿÿÿÿÿ—ÿÿÿ8.G.

Experimental table[edit source]

The goal is to join together all the "memory map" info in a single table

Round 3
Area SPI / UART Syscall 863 (sys_ss_update_manager) Data Name Wikitable builder Notes (temporal)
Name Size csum Mullion Sherwood Whitelist Block Access Whitelist
32KB 20KB SW/2/3(emu) EEP ID Offset SCM UM DM
Authenticated Data 0x2600 No 0x0000 0x0000 ?  Exploit  No No  Patch   Patch   Patch  Data table (0x160+(0x9*0x400)) ?
System Info 0x200 No 0x2600 0x2600 0x70000 ?  Exploit  No No  Patch   Patch   Patch  This wikitable row needs to be splitted up to 5+ rows
Patch 1 0x400 No 0x2800 0x2800 0x2000  Exploit  No No  Patch   Patch   Patch  Syscon Firmware Patch (top half)
- 0x300 No 0x2C00 0x2C00 0x0B00 Yes No No  Patch   Patch   Patch  not used Filled with FF's
Industry Area 0x100 No 0x2F00 0x2F00 0x0E00 Yes 0x10 0x02F00 Yes Yes  Patch  This wikitable row needs to be splitted up to 20+ rows
Customer Service Area 0x100 No 0x3000 0x3000 0x0F00 Yes 0x20 0x03000 Yes Yes  Patch  Filled with FF's ?
Platform Config 0x100 Yes 0x3100 0x3100 0x0040~ Yes No No  Patch   Patch   Patch  This wikitable row needs to be splitted up to 5+ rows
Hardware Config 0x100 Yes 0x3200 0x3200 0x0140~ Yes No No  Patch   Patch   Patch  This wikitable row needs to be splitted up to 40+ rows
Thermal Config 0x200 Yes 0x3300 0x3300 0x0250 (size 0x1B0) Yes No No  Patch   Patch   Patch  Data table. See: Syscon Thermal Configs
BE Count 0x200 No 0x3500 0x3500 0x0800 (size 0x100) Yes No No  Patch   Patch   Patch  Data table
Error Log 0x100 No 0x3700 0x3700 0x0900 Yes No No  Patch   Patch   Patch  Data table. See: Syscon Error Codes
- 0x100 No 0x3800 0x3800 N/A ? Yes No No  Patch   Patch   Patch  not used Filled with FF's
Board Config/Debug 0x100 Yes 0x3900 0x3900 0x0000~ ? Yes No No  Patch   Patch   Patch  This wikitable row needs to be splitted up to 15+ rows
HDMI/DVE Config 0x100 No 0x3A00 0x3A00 0x0A00 Yes No No  Patch   Patch   Patch  This wikitable row needs to be splitted up to 5+ rows
- 0x100 No 0x3B00 0x3B00 N/A ? Yes No No  Patch   Patch   Patch  not used Filled with FF's
Config Ring 0x200 Yes 0x3C00 0x3C00 0x0400 ? Yes No No  Patch   Patch   Patch  not used Filled with FF's
Debug 2 0x200 Yes 0x3E00 0x3E00 0x0600 ? Yes No No  Patch   Patch   Patch  not used Filled with FF's
- 0x3000 No 0x4000 N/A N/A Yes No No  Patch   Patch   Patch  reserved Filled with FF's
System Config ? 0x100 No 0x7000 0x4000 0x1000 Yes 0x0 0x48000 Yes  Patch   Patch  Filled with FF's ?
Event Log ? 0x100 No 0x7100 0x4100 0x1100 Yes 0x1 0x48800 Yes  Patch   Patch  Data table (0x10+(0x6*0x28)) Header + Data table ?
Flags and Tokens 0x100 No 0x7200 0x4200 0x1200 Yes 0x2 0x48C00 Yes varies  Patch  This wikitable row needs to be splitted up to 50+ rows
System Data ? 0x100 No 0x7300 0x4300 0x1300 Yes 0x3 0x48D00 Yes  Patch   Patch  Filled with FF's ?
Patch 2 0xC00 No 0x7400 0x4400 0x2400  Exploit  No No  Patch   Patch   Patch  Syscon Firmware Patch (bottom half)
Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=Talk:SC_EEPROM&oldid=71231"