User talk:Zecoxao

Vita Shennanigans

• check https://playstationdev.wiki/psvitadevwiki/index.php?title=Ernie

DYN-001 Shennanigans

• check https://www.psdevwiki.com/ps3/Keys#DYN-001_body_key
• check https://www.psdevwiki.com/ps3/Keys#DYN-001_hasher_key
• check https://psdevwiki.com/ps3/Service_Connectors#CN.3F.3F.3F.3F

PSP Shennanigans

• check https://playstationdev.wiki/pspdevwiki/index.php?title=Baryon

How

• By enabling diagnostic mode on the ps3, we can enable the use of JTAG again (it's temporarily disabled when diag mode isn't set) false
• It is possible to dump the syscon firmware using this method (in unencrypted state) false
• The JTAG registers/TAP-controllers need to be bruteforced / reverse engineered false
• The leaked service manuals present information about the pins connected to the JigPin false
• The ObjectiveSuite contains an object (DIAGSERVICE) used to diagnose the ps3 using JTAG false
• Using a DIY JigPin would facilitate the task, but we still need more info about the hardware and software interface used by ObjectiveSuite to handle this. false
• This would probably work on ps4 too (provided that the diag pin and the JTAG pins still exist) false
• f0f's method is a viable way to get the ROM from later syscons
• tx function can be produced and it's not required for bruteforcing
• ocd flag is located somewhere in the second SFR area (which covers 0x800 bytes, minus already documented flags)
• code base is located somewhere in the backup ram ( 0x800 bytes) or in the second SFR area (0x800 bytes)
• second SFR area ranges from 0xF0000 to 0xF0800
• backup ram ranges from 0xF0800 to 0xF1000
• ocd flag is likely 0xF07F5 since the other SFRs are the same from RL78 to 78K0R
• 486 registers from the 2nd SFR range are publically documented (https://www.youtube.com/watch?v=FdveKrmoA7E)
• 1562 registers are not documented (0xF01E7 - 0xF07FF)
• minimum scan area would be 0xE1A bytes (covering code base only and assuming ocd flag is the known value of 0xF07F5)
• maximum scan area would be 0x55FC8A bytes (same as above and assuming ocd flag isn't known (times 0x619 bytes)
• assuming that the code base is in the 2nd SFR area on RL78 and that the two devices are very similar, we could narrow down the minimum scan area to 0x61A bytes
• IC4002 is sony's syscon naming in oficial service docs

//TX FUNC, 78K0R CASE
//TAKING NOTE THAT PS3 SYSCON is uPD78F11XX, where X is A, B or C
//ASIM -> 0xFFF8C
//TXS  -> 0xFFF8F 
<pre>
ROM:000EFF05                 set1    byte_FFF8C.7
ROM:000EFF08                 nop
ROM:000EFF09                 mov     byte_FFF8F, a
ROM:000EFF0B
ROM:000EFF0B loc_EFF0B:                              ; CODE XREF: ROM:loc_EFF0B↓j
ROM:000EFF0B                 bf      byte_FFF8B.0, loc_EFF0B
ROM:000EFF0F                 mov     byte_FFF8B, #0
ROM:000EFF12                 clr1    byte_FFF8C.7
ROM:000EFF15                 ret

• OCD Flag at 0xF07EC
• Entry Point at 0xF07F0
• All SW Models use 0xFFF as block size (SW, SW2, SW3)
• SW Uses 0x80000 as total ROM size. SW2,SW3 use 0xC0000 as total rom size
• To use block related commands, one must send signature check command before sending the block check/erase/program command
• 0xFFFFFED0(IV error?) 0xFFFFFED1 (hash error?) 0xFFFFFED2 (magic error)

To wikify

• Wikify begin (please wait...)
• Roxanne, if you could also take care of these : http://pastebin.com/s75FzYxd , that would be awesome (i'm not sure what happened to eussNL so, i leave it on your hands.)
  • When I get my left hand back, then we can check this out together. Roxanne

request_idps generated files binary xor

• [2 generated cex files]
• [2 generated decr files]
• [2 generated dex files]

Note: files are padded 8 bytes at start, for convenience

Wii Key/IV Goodness

Type	Key	Description
Key	9258A75264960D82676F904456882A73	Boot1 Decryption Key
IV	00000000000000000000000000000000	Boot1/2 Decryption IV
Key	A1604A6A7123B529AE8BEC32C816FCAA	Boot2 Decryption Key (Devel)
Key	EBE42A225E8593E448D9C5457381AAF7	Boot2 Decryption Key (Prod)
RSA Key	D01FE100D43556B24B56DAE971B5A5D3 84B93003BE1BBF28A2305B060645467D 5B0251D2561A274F9E9F9CEC646150AB 3D2AE3366866ACA4BAE81AE3D79AA6B0 4A8BCBA7E6FB648945EBDFDB85BA091F D7D114B5A3A780E3A22E6ECD87B5A4C6 F910E4032208814B0CEEA1A17DF73969 5F617EF63528DB949637A056037F7B32 413895C0A8F1982E1565E38EEDC22E59 0EE2677B8609F48C2E303FBC405CAC18 042F822084E4936803DA7F4134924856 2B8EE12F78F803246330BC7BE7EE724A F458A472E7AB46A1A7C10C2F18FA07C3 DDD89806A11C9CC130B247A33C8D47DE 67F29E5577B11C43493D5BBA7634A7E4 E71531B7DF5981FE24A114554CBD8F00 5CE1DB35085CCFC77806B6DE254068A2 6CB5492D4580438FE1E5A9ED75C5ED45 1DCE789439CCC3BA28A2312A1B8719EF 0F73B713950C02591A7462A607F37C0A A7A18FA943A36D752A5F4192F0136100 AA9CB41BBE14BEB1F9FC692FDFA09446 DE5A9DDE2CA5F68C1C0C21429287CB2D AAA3D263752F73E09FAF4479D2817429 F69800AFDE6B592DC19882BDF581CCAB F2CB91029EF35C4CFDBBFF49C1FA1B2F E31DE7A560ECB47EBCFE32425B956F81 B69917487E3B789151DB2E78B1FD2EBE 7E626B3EA165B4FB00CCB751AF507329 C4A3939EA6DD9C50A0E7386B0145796B 41AF61F78555944F3BC22DC3BD0D00F8 798A42B1AAA08320659AC7395AB4F329	Root Key (Devel)
RSA Key	F8246C58BAE7500301FBB7C2EBE00105 71DA922378F0514EC0031DD0D21ED3D0 7EFC852069B5DE9BB951A8BC90A24492 6D379295AE9436AAA6A302510C7B1DED D5FB20869D7F3016F6BE65D383A16DB3 321B95351890B17002937EE193F57E99 A2474E9D3824C7AEE38541F567E7518C 7A0E38E7EBAF41191BCFF17B42A6B4ED E6CE8DE7318F7F5204B3990E226745AF D485B24493008B08C7F6B7E56B02B3E8 FE0C9D859CB8B68223B8AB27EE5F6538 078B2DB91E2A153E85818072A23B6DD9 3281054F6FB0F6F5AD283ECA0B7AF354 55E03DA7B68326F3EC834AF314048AC6 DF20D28508673CAB62A2C7BC131A533E 0B66806B1C30664B372331BDC4B0CAD8 D11EE7BBD9285548AAEC1F66E821B3C8 A0476900C5E688E80CCE3C61D69CBBA1 37C6604F7A72DD8C7B3E3D51290DAA6A 597B081F9D3633A3467A356109ACA7DD 7D2E2FB2C1AEB8E20F4892D8B9F8B46F 4E3C11F4F47D8B757DFEFEA3899C3359 5C5EFDEBCBABE8413E3A9A803C69356E B2B2AD5CC4C858455EF5F7B30644B47C 64068CDF809F76025A2DB446E03D7CF6 2F34E702457B02A4CF5D9DD53CA53A7C A629788C67CA08BFECCA43A957AD16C9 4E1CD875CA107DCE7E0118F0DF6BFEE5 1DDBD991C26E60CD4858AA592C820075 F29F526C917C6FE5403EA7D4A50CEC3B 7384DE886E82D2EB4D4E42B5F2B149A8 1EA7CE7144DC2994CFC44E1F91CBD495	Root Key (Prod)
Key	67C6697351FF4AEC29CDBAABF2FBE346	DVD Key (Devel)
Key	AB01B9D8E1622B08AFBAD84DBFC2A55D	App Key
IV	216712E6AA1F689F95C5A22324DC6A98	App IV
Key	2B7E151628AED2A6ABF7158809CF4F3C	SW Key
IV	00000000000000000000000000000000	SW IV
Key	0E65378199BE4517AB06EC22451A5793	MD5 Blanker

Wii U Key/IV Goodness

. .

Type	Key	SHA1	Status	Description
Key	key:0ADC3A209A563EC90CFE09F324821670	sha1:7A21E70751DD0BA38B3A0F4A1E6E7AF5AA34A9A3	Valid	Wii U Xor
Key	key:E5959ADF673CA63143A744080EE67FE4	sha1:5BAA45B5E9020ADF4C1117BD7F7B04A0385DE04E	Valid	USB Stor ENC
Key	key:7B118F321870DAB70AF6F207ED2972BA	sha1:09EDC0533DDB270DF18B644320DAD6105CCA4FAA	Valid	SSL ENC/DEC
Key	key:EBE42A225E8593E448D9C5457381AAF7	sha1:EBEAE6D2762D4D3EA160A6D8327FAC9A25F8062B	Valid	Wii Common
Key	key:3B8D192A39B759A8DF501FC5DA8EC3E2	sha1:1505970D69AE87FD4A89F02D9A5A20E6D144F017	Valid	Wii U SEEPROM
Key	key:805E6285CD487DE0FAFFAA65A6985E17	sha1:2BA6F692DDBF0B3CD267E9374FA7DD849E80F8AB	Valid	Wii U Expresso Ancast
Key	key:2EFE8ABCEDBB7BAAE3C0ED92FA29F866	sha1:CE3641B2660253F5A7E789DB297BE2C1585B3054	Valid	vWii Expresso Ancast
IV	key:596D5A9AD705F94FE158026FEAA7B887	sha1:C1A8BFFB7CA5271677D4242989C6FFE44FD3DC7D	Valid	Wii U Expresso Ancast / vWii Expresso Ancast
Key	key:B5D8AB06ED7F6CFC529F2CE1B4EA32FD	sha1:D8B4970A7ED12E1002A0C4BF89BEE171740D268B	Valid	Wii U Starbuck Ancast
IV	key:91C9D008312851EF6B228BF14BAD4322	sha1:8377C1B51FD6AEAB9D6F48A8E858F53AEBFD0BE3	Valid	Wii U Starbuck Ancast
Key	key:D7B00402659BA2ABD2CB0DB27FA2B656	sha1:6A0B87FC98B306AE3366F0E0A88D0B06A2813313	Valid	Wii U Common
Key	key:30BFC76E7C19AFBB23163330CED7C28D	sha1:2B30B703C6676C8124C7347B30C7972FFEAE2B39	Valid	vWii Common
Key	-	sha1:56DD59752E6AF1E55FC2EE7074ABE2D2C9E70A10	Confirmation Needed	boot1
IV	key:4FCD24A0E4D3AB6FAE8DFD8108581DCF	sha1:A1A87792B95D0294C0867C93D46C3068C1C6D322	Valid	boot1
Binary	-	sha1:EE28D0BE718055423EE79D89889EBE386E5B0C2D	Found	boot0
Binary	-	sha1:3D331B3165F9638C6CD6221702B2F736F7FCF931	Found	BootROM

Switch Key/IV Goodness

Type	Key	SHA1/SHA256	Status	Description
AES-CTR	key:F4ECA1685C1E4DF77F19DB7B44A985CA	sha1:8C98FF409724784DDF3E3D39B60B25B7087FF537	Valid	stage1_key_00
AES-128-ECB	key:C2CAAFF089B9AED55694876055271C7D	sha1:4A98D62FF6EC0A042B7592219200E37DD9603479	Valid	package1_key_00
AES-128-ECB	key:54E1B8E999C2FD16CD07B66109ACAAA6	sha1:8CEC47B1B3974EED32C03B11A9DE0133D9E0F00B	Valid	master_key_01
AES-128-ECB	key:4F6B10D33072AF2F250562BFF06B6DA3	sha1:ADD1D37E4A5C540AEEEF4050A2AB98E8B0DC1D04	Valid	master_key_02
AES-CTR	key:A35A19CB14404B2F4460D343D178638D	sha1:4D64731F7AFA031C7EEAE3EB2F462D55FF8FF5AE	Valid	package2_key_00
Kernel	-	sha1:124BEFB2895BBA4DB1726485DAF6684B33EF5F51	Valid	1.00 Encrypted Kernel
System Modules	-	sha1:96BF598BD162D5D8C87F2B25741F758F47730C88	Valid	1.00 Encrypted System Modules
Modulus	B36554FB0AB01E85A7F6CF918EBA9699 0D8B91692AEE01204F345C2C4F4E37C7 F10BD4CDA17F93F13359CEB1E9DD26E6 F3BB7787467AD64E474AD141B7794A38 066ECF618FCDC1400BFA26DCC0345183 D93B11543B9627329A95BE1E681150A0 6B10A8838BF5FCBC90847A5A5C4352E6 C826E9FE06A08B530FAF1EC41C0BCF50 1AA4F35CFBF097E4DE320A9FE35AAAB7 447F5C3360B90F222D332AE969793142 8FE43A138BE726BD08876CA6F273F68E A7F2FEFB6C28660DBDD7EB42A878E6B8 6BAEC7A9E2406E892082258E3C6A60D7 F3568EEC8D518A633C0478230E900CB4 E7863B4F8E130947320E04B84D5BB046 71B05CF4AD634FC5E2AC1EC43396097B	sha1:F847ED0465C0DFDCD2C28B3E1A6DA0C0F01FBBC5	Valid	Public Debug
Modulus	8D13A7776AE5DCC03B25D058E4206959 554BAB7040082807A8A7FD0F312E11FE 47A0F99DDF80DB865A2789CD976C85C5 6C397F41F2FF2420C395A6F79D4A4574 8B5D288AC699356885A56432809FD348 39A21D246769DF75AC12B5BDC32990BE 37E4A0809ABE36BF1F2CAB2BADF59732 9A429D098B08F06347A3E91B36D82D8A D7E1541195E44588698A2B35CED0A50B D55DACDBAF114DCAB81EE7019EF446A3 8A946D76BD8AC83BD231580C79A826E9 D1799CCBD42B6A4FC6CCCF90A7B99847 FDFA4C6C6F81873BCAB850F63E395D4D 973F0F353953FBFACDABA87A629A3FF2 0927963F079A91F716BFC63A825A4BCF 4950958C55807E39B148051E21C7244F	sha1:A809E09F8BD790446B86F28B84A6D0F36481A245	Valid	Public Retail

Regarding Jokes

• Sorry, but it's difficult to distinguish Contributors with Spam Users, especially when you aren't logged in and when you log in to your account with different IP Addresses (and especially with this current Spam situation). It won't happen for a second time. Roxanne 21th December 2015 (18:12 GMT+1)
  • It's ok, i should've logged, but i keep formatting my pc, so i always forget :) In the end it was my fault. Thanks for the feedback though Zecoxao
    • OK and to answer your question regarding the newest DEX Firmwares, I'm on CEX but I'm still on this Firmware. Is this Good or Bad? :) (Roxanne 22th December 2015 (22:56 GMT+1)
      • it'd be nice to test some psgroove on it :)
        • http://www.psdevwiki.com/ps3/User:Not_Zecoxao is still needed?
          • nope

ebootrom wikify

https://yadi.sk/d/z2Vr1NE_DZ6eHQ