Talk:SC EEPROM

Memory test diagnosis NVS flag

There is a NVS flag which enables a special diagnostic mode at startup. This flag is enabled on Proto/DECR. It allows memtest diagnose.

Pseudo-code:

def check_bootrom_diag_mode(mode, param)
        diag_mode = get_eeprom_bootrom_diag()
        if diag_mode & 0x1:
                if diag_mode & 0x100:
                        return 0
                mode = (diag_mode >> 3) & 0x1
                param = (diag_mode >> 3) & 0x1
        else:
                mode = (diag_mode >> 1) & 0x1
                param = -1
        return 1

EEPROM Dumps

• https://mega.co.nz/#!Bk1ESBZT!pqAB6riHhZSCPAftvjm2MFf3j0It61huT3WT2AbWS-A -> DEAD LINK

EEPROM Strings (CP memory dump, DECR)

http://pastie.org/private/usd2zi8mw3igycsh1a395q -> DEAD LINK

Bus Pirate stuff

http://i.imgur.com/48rbR51.png

(needs more wikifying)

On standby

• Note: during this time the plaintext EEPROM is never read even once!
• Additionally, the areas 0x26B0, 0x26D0 are not read

• Checks status
• Unlocks Write Command
• Reads PATCH top half region
• Reads PATCH bottom half region
• Reads 0x2790?(0x20)
• Reads 0x27B0?(0x10)
• Reads 0x26D0 (0x10)
• Reads some configs? (around >0x31XX area)
• Reads 0x0 (0x10)
• Reads some configs?
• Reads 0x10(0x280) (EID1)?
• Reads 0x3A00 (0x1)
• Reads 0x290 (0x10) (EID1 CMAC?)
• Reads 0x2A0 (0x20)
• Reads 0x2C0 (0x20)
• Reads 0x2E0 (0x20)
• Writes some stuff to 0x2C0/0x2E0/0x2A0 (mostly ff's)
• ReReads EID1 and CMAC
• Reads 0x360
• Reads 0x370
• Writes (again) mostly ff's to 0x360 and 0x370
• ReReads EID1 and CMAC
• Does same process with 0x460 and 0x470
• Reads 0x2710 and 0x2730 (0x20,0x10) ???
• Reads 0x2700 (0x10)
• fini!

MemoryMap Syscon BB Chip

0x1000-0x1FFF:PTCH Region (patch written here)

Nice read about Syscon EEPROM

http://rmscrypt.wordpress.com/2011/02/01/lets-look-at-syscon/

Experimental table

The goal is to join together all the "memory map" info in a single table

Round 2

Area			SPI / UART				Syscall 863						Data Name	Wikitable builder Notes (temporal)
Name	Size	csum	Mullion		Sherwood	whitelist	Block ID NVS Region	whitelist			Offset	Size
			32KB	20KB	SW/2/3(emu)	EEP		lv1/DM	UM	SCM
Authenticated Data	0x2560	No	0x0000	0x0000	?	Exploit	No	Patch	Patch	Patch	?			Data table (0x160+(0x9*0x400)) ?
?	0x150	No	0x2560	0x2560	?	Exploit	No	Patch	Patch	Patch	?			Filled with FF's ?
System Info	0x150	No	0x26B0	0x26B0	0x0000~ ?	Exploit	No	Patch	Patch	Patch	?			This wikitable row needs to be splitted up to 5+ rows
Patch 1	0x400	No	0x2800	0x2800	0x2000(flash)	Exploit	No	Patch	Patch	Patch	?	0x400	Syscon Firmware Patch (top half)
-	0x300	No	0x2C00	0x2C00	0x0B00	Yes/UART	No	Patch	Patch	Patch	?	0x300	not used	Filled with FF's
Industry Area	0x100	No	0x2F00	0x2F00	0x0E00	Yes/UART	0x10	Patch	Yes	Yes	0x02F00			This wikitable row needs to be splitted up to 20+ rows
Customer Service Area	0x100	No	0x3000	0x3000	0x0F00	Yes/UART	0x20	Patch	Yes	Yes	0x03000	0x100		Filled with FF's ?
Platform Config	0x100	Yes	0x3100	0x3100	0x0040~	Yes/UART	No	Patch	Patch	Patch	?	0x100		This wikitable row needs to be splitted up to 5+ rows
Hardware Config	0x100	Yes	0x3200	0x3200	0x0140~	Yes/UART	No	Patch	Patch	Patch	?	0x100		This wikitable row needs to be splitted up to 40+ rows
Thermal Config	0x200	Yes	0x3300	0x3300	0x0250~	Yes/UART	No	Patch	Patch	Patch	?	0x200	Data table. See: Syscon Thermal Configs
On/Off Count/Time	0x200	No	0x3500	0x3500	0x0800~ ?	Yes/UART	No	Patch	Patch	Patch	?	0x200	Data table
Error Log	0x100	No	0x3700	0x3700	0x0900	Yes/UART	No	Patch	Patch	Patch	?	0x100	Data table. See: Syscon Error Codes
-	0x100	No	0x3800	0x3800	N/A ?	Yes/UART	No	Patch	Patch	Patch	?	0x100	not used	Filled with FF's
Board Config/Debug	0x100	Yes	0x3900	0x3900	0x0000~ ?	Yes/UART	No	Patch	Patch	Patch	?	0x100		This wikitable row needs to be splitted up to 15+ rows
HDMI/DVE Config	0x100	No	0x3A00	0x3A00	0x0A00	Yes/UART	No	Patch	Patch	Patch	?	0x100		This wikitable row needs to be splitted up to 5+ rows
-	0x100	No	0x3B00	0x3B00	N/A ?	Yes/UART	No	Patch	Patch	Patch	?	0x100	not used	Filled with FF's
Config Ring	0x200	Yes	0x3C00	0x3C00	0x0400 ?	Yes/UART	No	Patch	Patch	Patch	?	0x200	not used	Filled with FF's
Debug 2	0x200	Yes	0x3E00	0x3E00	0x0600 ?	Yes/UART	No	Patch	Patch	Patch	?	0x200	not used	Filled with FF's
-	0x3000	No	0x4000	N/A	N/A	Yes/UART	No	Patch	Patch	Patch	?	0x3000	reserved	Filled with FF's
System Config ?	0x100	No	0x7000	0x4000	0x1000	Yes/UART	0x0	Patch	Patch	Yes	0x48000	0x100		Filled with FF's ?
Hypervisor Config ?	0x100	No	0x7100	0x4100	0x1100	Yes/UART	0x1	Patch	Patch	Yes	0x48800		Data table (0x10+(0x6*0x28))	Header + Data table ?
Flags and Tokens	0x100	No	0x7200	0x4200	0x1200	Yes/UART	0x2	Patch	Yes or Patch*	Yes	0x48C00			This wikitable row needs to be splitted up to 50+ rows
System Data ?	0x100	No	0x7300	0x4300	0x1300	Yes/UART	0x3	Patch	Patch	Yes	0x48D00	0x100		Filled with FF's ?
Patch 2	0xC00	No	0x7400	0x4400	0x2000(flash)	Exploit	No	Patch	Patch	Patch	?	0xC00	Syscon Firmware Patch (bottom half)