Syscon Firmware

Description

The system controller firmware (also known as the syscon firmware) is the software stored inside syscon. Is composed by the base firmware (not updateable in retail syscon models) and a optional patch that is applyed virtually on runtime on top of the base firmware
The syscon update packages (also known as syscon patches) for retail PS3 models are distributed in PKG format inside the Update_files.tar of the PS3UPDAT.PUPs. Syscon patches appear to always be 5KB (5376 bytes) in size.

Update procedure

The PS3 firmware installer PUP's contains a collection of syscon patches for all the different syscon's chips used in the different motherboard models. The ps3swu.self (system updater) checks the syscon SoftID and installs the compatible patch accordingly (via updater manager ss service).
The non-retail PS3 models with syscon CXR713F120A don't have patches, this special syscon model with the "F" product code (that seems to indicate that is fully flasheable) allows to overwrite the base syscon firmware through the Communication Processor

Syscon firmwares

Mullion

SoftID	Firmware version	Build target	Build date	Adds support for Platform IDs	Corresponding SDK version	Notes
-	v0.4.5_b4	BACKUP	2005	(Cyt1.0), (Cyt1.1), (Cyt2.1), (Cok01)	0.40	Only used on the backup bank of flash models
06DA	v0.6.1_c8	CYTOLOGY	2006/01/31	Cyt1.2, Cyt2.0, Cyt2.2, (Cok02), (Cok03)	0.80
073E	v0.6.10_c4	CYTOLOGY	2006/03/01	(Cok05)	0.81
07FF	v0.6.11_c4	CYTOLOGY	2006/03/27	Cyt3.0, Cyt3.1, Cyt3.2, (Cok08)	0.82
086C	v0.6.12_c5	CYTOLOGY	2006/04/11	-	0.83
08F1	v0.6.12_c7	CYTOLOGY	2006/04/22	-	0.83
0955	v0.6.14_c4	CYTOLOGY	2006/05/01	-	0.84
0AF4	v0.8.4_c8	CYTOLOGY	2006/06/23	(Cok11)	0.85
0B48	v0.9.9_c1	CYTOLOGY	2006/07/07	Cyt3.3, Cyt3.4, (Cok12), (Cok13), (Cok14)	0.90
0B67	v0.9.13_k1	COOKIE	2006	-	-
0B74	v0.9.14_c1	CYTOLOGY	2006/08/03	-	0.91
0B8E	v1.0.0_k1	COOKIE (201)	2006	-	-
0B9D	v1.0.1_c1	CYTOLOGY	2006/08/31	-	0.93
0C16	v1.1.3_k1	COOKIE (202)	2006	CokB10	-	not dumped yet
0C23	v1.0.3_c1	CYTOLOGY	2006/12/04	-	1.50
0D52	v1.2.3_k1	COOKIE (203)	2007	CokC10, CokC11, CokC12	-	not dumped yet
0D79	v1.0.4_c1	CYTOLOGY	2007/06/21	-	1.90
0DBF	v1.3.3_k1	COOKIE (301)	2007	CokD10	-
0E4E	v1.0.4_c2	CYTOLOGY	2007/11/08	-	2.40
0E69	v1.4.4_k2	COOKIE (302)	2007	CokE10, Deb01	-
0F29	v1.5.0_k2	COOKIE (303)	2009	-	-	Removes hardcoding from previous firmware, adds support for 65nm RSX - not dumped yet
0F38	v1.5.1_k2	COOKIE (304)	2010	-	-	Adds support for 40nm RSX
0F3B	v1.0.5_c1	CYTOLOGY	2010/05/12	-	3.60

Sherwood

SoftID	Firmware version	Build target	Build date	Adds support for Platform IDs	Dumped?
0658	??.??	-	2008	CokF10	NO
065D	00.17	SW-301	2008	-	YES
????	??.??	SW-302	2008	-	NO
0832	01.11	SW2-301	2009	CokG10, CokG11	YES
08A0	??.??	SW2-302	2009	CokH10, CokH11	NO
08C2	??.??	SW2-303	2010	CokJ13, CokJ20	NO
0918	02.03	SW3-301	2011	CokK10	NO
098F	??.??	SW3-302	2012	CokM20, CokM40	NO
????	??.??	SW3-303	2013	CokN10, CokN30	NO
????	??.??	SW3-304	2013	-	PARTIALLY

Syscon patches

These patches are in full Retail/CEX and Debug/DEX firmwares. Are intended to fix some problem in the syscon firmware

• Firmware 1.30 (December 6, 2006) Disables UART access to the Syscon EEPROM patch region (not for 0832)
• Firmware 1.81 (June 15, 2007) Patch for the HDMI display data channel read function (only for 0B8E and 0C16)
• Firmware 3.00 (September 1, 2009) Unknown patch (only for 0832)
• Firmware 3.40 (June 29, 2010) Patch for the rtc read function (not for 0832)
• Firmware 3.41 (July 26, 2010) No patch added

SoftID	sys_con_firmware package	1.00-1.30	1.30-1.80	1.81-2.80	3.00-3.30	3.40	3.41-4.75	Notes
0B8E	SYS_CON_FIRMWARE_01000004.pkg	No	Yes	No	No	No	No	Superseded by SYS_CON_FIRMWARE_01000005.pkg
	SYS_CON_FIRMWARE_01000005.pkg	No	No	Yes	Yes	No	No	Superseded by SYS_CON_FIRMWARE_01000006.pkg
	SYS_CON_FIRMWARE_01000006.pkg	No	No	No	No	Yes	Yes
0C16	SYS_CON_FIRMWARE_01010302.pkg	No	No	Yes	Yes	No	No	Superseded by SYS_CON_FIRMWARE_01010303.pkg
	SYS_CON_FIRMWARE_01010303.pkg	No	No	No	No	Yes	Yes
0D52	SYS_CON_FIRMWARE_01020302.pkg	No	No	No	No	Yes	Yes
0DBF	SYS_CON_FIRMWARE_01030302.pkg	No	No	No	No	Yes	Yes
0E69	SYS_CON_FIRMWARE_01040402.pkg	No	No	No	No	Yes	Yes
0F29	SYS_CON_FIRMWARE_01050002.pkg	No	No	No	No	Yes	Yes
0F38	SYS_CON_FIRMWARE_01050101.pkg	No	No	No	No	No	Yes
0832	SYS_CON_FIRMWARE_S1_00010002083E0832.pkg	No	No	No	Yes	Yes	Yes

The screen More System Information allows to see some details related with syscon. The syscon firmware version can be derived from the SoftID, and additionally if there is a patch installed the PatchID displayed in the screen contains both, the syscon firmware version and the patch version. Note also that there is a direct relationship in between the PatchID displayed in the screen and the patch filename

• Mullion PatchID names format
  • 0B8E.0000000000000000@SC = syscon firmware v1.0.0, not patched
  • 0B8E.0001000000000006@SC = syscon firmware v1.0.0, patch v6 (filename SYS_CON_FIRMWARE_01000006.pkg)
  • 0C16.0000000000000000@SC = syscon firmware v1.1.3, not patched
  • 0C16.0001000100030003@SC = syscon firmware v1.1.3, patch v3 (filename SYS_CON_FIRMWARE_01010303.pkg)
• Sherwood PatchID names format (unknown)
  • 0832.0000000000000000@SC = syscon firmware v1.11, not patched
  • 0832.00010002083E0832@SC = syscon firmware v1.2 ?, patch v83E.832 ? (filename SYS_CON_FIRMWARE_S1_00010002083E0832.pkg)
    • Note the PatchID suffix 0832 is the factory SoftID of SW2-301, and 83E is an unknown SoftID. See: talk

Package structure

Sys_con_firmware Packages can be unpacked with unpkg. See PKG files and Certified File

Header

Address	Length	Value	Description
0x00	0x4	ASCI:"SCE"	SCE magic header
0x04	0x4	0x2	Flags
0x08	0x4	0x3	Type (0x3 = PKG)
0x0C	0x4	0x0	Blank/Unknown
0x10	0x4	0x0	Blank/Unknown
0x10	0x8	0x280	Start Data Offset (hdr_len)
0x18	0x8	0x1080	Data Size (dec_size)
0x20	0x260	-	Header
0x280	0x40	-	info0 section (see below)
0x2C0	0x40	-	info1 section (see below)
0x300	0x1000	-	content section

Info0

Address	Length	Value	Description
0x00	0x4	0x3
0x04	0x4	0x8
0x08	0x8	-	SC firmware revision (the high word of it is the SC type)
0x0C	0x4	0x0B8E(1.30-4.84) 0x0C16(1.81-4.84) 0x0D52(3.40-4.84) 0x0DBF(3.40-4.84) 0x0E69(3.40-4.84) 0x0F29(3.40-4.84) 0x0F38(3.41-4.84) 0x065D 0x0832(3.00-4.84) 0x08A0 0x08C2 0x0918	'SoftID'
0x10	0x8	0x0001000000000004 0x0001000000000005 0x0001000000000006 0x0001000100030002 0x0001000100030003 0x0001000200030002 0x0001000300030002 0x0001000400040002 0x0001000500000002 0x0001000500010001 0x00010002083E0832	'PatchID'
0x18	0x8	0x1000	Content Data Size
0x20	0x8	0x1000	Content Compressed Data Size
0x28	0x8	0x0
0x30	0x10	0x0

Note: PS3 firmwares cannot deal with compressed syscon firmwares, so they will abort the update process in that case.

Note2: The PatchID is also present in the first 8 bytes of decrypted content but 16bit swapped for ARM BGAs

Info1

Address	Length	Value	Description
0x00	0x4	0x0
0x04	0x4	0x3
0x08	0x8	0x40	Offset/size?
0x10	0x4	0x0
0x14	0x4	0x0
0x18	0x8	0x1000	Content Data Size?
0x20	0x8	0x1
0x28	0x8	0x1
0x30	0x10	0x0

Content

Address	Length	Value	Description
0x0	0x1000	-	content

Decryption

Packages can be decrypted with the unpkg tool. Decrypted content of the updates appears to always be 0x1000 bytes (4KB).

Patch Decryption/Hashing

The following is all theoretical and is intended to discard possibilities about modes of operation used by aes when decrypting body of firmware/patch

We know that:

• Two key expansions are used before applying crypto on body (one probably for hashing. the other for decrypting with cbc)
• Encrypt is used when applying crypto on body TopHalf (forward ttables) and Decrypt is used when applying on body Bottomhalf (inverse ttables)
• Authenticated regions uses a form of what seems to be some ECB with tweak xoring (as graf once said about XTS)
• XTS was introduced in 2007 and SysCon from ps3 exists for far more time than that (2003)
• XEX is a close relative of XTS that was introduced in 1984
• PS4 uses XTS for Authenticated Regions or SNVS (with sector size of 0x20 being used. is this even considered safe?)
• 4 regions can be controlled for DPA and they are: 0x2790 (size 0x20) (FFs), patch header (most notably at offset 0x4 of header size 0x10 and 0x30 size 0x10), patch body tophalf(+0x40) and patch body bottomhalf(+0x50)
• here are the DPA bytes for each of the controlable sections:
• 21 06 23 DC A2 98 99 4D XX 87 F8 40 FC 48 1C BF (section 2/FF's from 0x2790 on DIA-001) -> 210623DCA298994DFE87F840FC481CBF
• 21 06 23 DC A2 98 99 4D XX 87 F8 40 FC 48 1C BF (section 2/FF's from 0x2790 on DEB-001) -> 210623DCA298994DFE87F840FC481CBF
• 16 32 47 79 C3 2C 47 D3 2B 39 CA B5 83 41 0E D5 (section 3/header from DIA-001 patch content)
• XX XX XX XX 7B FC 27 CD D5 9A 05 09 3A DF E4 75 (section 3/header AA from DEB-001 patch content) -> 6E9CE7C57BFC27CDD59A05093ADFE475
• 92 4A 87 88 20 59 6C 49 9F 0E 7D 77 2F 38 4C FC (section 3/header DD from DEB-001 patch content)
• 7D C6 3B 3B 69 DF 67 4C 94 D7 D4 A8 E0 F8 5B B2 (section 4/body from DIA-001 patch content/tophalf/forward)
• 73 XX F0 3D XX 9A F0 92 4D XX 62 DA XX 48 3C DB (section 4/body from DIA-001 patch content/bottomhalf/inverse)
• 49 1F 7B 0A 48 BD 79 33 4E 16 89 F6 B0 25 86 48 (section 4/body from DEB-001 patch content/tophalf/forward)
• 14 4D F1 D3 21 B6 17 46 60 81 42 E5 02 C9 07 66 (section 4/body from DEB-001 patch content/bottomhalf/inverse/PROPER) -> 6B3583DA1AA6B49106E1641178EE68C8 (inverse ttables)
• some bytes are considered "weak" bytes and should be bruteforced in the eventuality these keys fail
• another possibility is that both the header and the body are hashed and then decrypted, using for example, cmac and cbc
• since key expansions take 10 "hills" in the analysis, it should be safe to assume that AES-128 is used(because it uses 10 rounds).
• 6554cff202c3bfdd9740901070b705bf : correct md5 for patch content we are trying keys on (DIA-001)
• 4875ad06a1499cc516a0d4d92e595794 : correct md5 for patch content we are trying keys on (DEB-001/DIA-002)
• trying a different header/body patch content from another similar board will result into failure of decrypting body, which means that the header is checked for authenticity and that the header hash is NOT in the header
• altering the patch header doesn't cause the patch header dpa bytes to change (a test was done with 4 bytes and the result was 16 32 47 79, which matches the other patch dpa recovered bytes)
• there are in fact not 4 but 5 aes sections. the last one seems to be body related, as changing the body even one bit makes the last aes section disappear.
• section 2 is divided into two sections, corresponding to TopHalf and BottomHalf of patch area.
• TopHalf uses forward ttables/sbox. BottomHalf uses inverse ttables/sbox
• TopHalf is ONLY the very first 0x10 bytes AFTER the header and into the body (corresponding to 0x40 in header size 0x10)
• BottomHalf is the rest of the body itself.
• DYN-001 processes one entire chunk of 0x1000 bytes, 0x40 for header and 0xFC0 for body, and not two of 0x400 and 0xC00 like the Sony models
• 504 aes operations are done for the body (252/0xFC for cmac and 252/0xFC for cbc). it is unknown if cmac comes first or it is cbc.
• All attacks show weak bytes in comparisson with CXR(F), likely due to CXR being optimized for the attack (removed resistors/capacitors, etc)

Header

The header format is partially unknown at this stage. All the Firmwares patches are written in little endian.

Offset	Length	Notes	Related DECR Error	Notes
0x0	0x4	Magic	FFFFFED2 (Magic Error)
0x4	0x10	Header CMAC1	FFFFFED1 (Header Check Error)	CMAC of Partial Header (0x10,0x30 size) with header first 4 bytes instead of random 4 bytes and where Header CMAC2 is zeroed Concatenated with Encrypted Body
0x14	0x10	Header CMAC2	FFFFFED1 (Header Check Error)	CMAC of Header (where this cmac has been zeroed)
0x24	0x4	Padding	FFFFFED1 (Header Check Error)
0x28	0x4	Total size	FFFFFED1 (Header Check Error)
0x2c	0x4	Size of binary	FFFFFED1 (Header Check Error)
0x30	0x10	IV for AES-128 CBC	FFFFFED1 (Header Check Error)
0x40	0xfc0	Encrypted binary	FFFFFED0 (Data Check Error) / FFFFFECF (Data Size Check Error)

• Note: For the weird bogus update ONLY: FFFFFF37 (Alignment Error?) (Trying any data size between 0x41 and 0x4C bytes)
• Note2: v0.6.14c4 is the bogus update (only update with a weird header)
• Note3: setting data between 0x40 to 0x4C to zero in bogus update yields error FFFFFED0

Samples

00000000  1B 2D 70 0F AB 5E B3 99 68 20 FE 3D E1 80 6A 1D  .-p.«^³™h þ=á€j.
00000010  B8 FD 37 CF CD 45 85 AB 51 F7 05 E3 EA 32 A5 EA  ¸ý7ÏÍE…«Q÷.ãê2¥ê
00000020  67 45 F9 48 00 00 00 00 00 10 00 00 C0 0F 00 00  gEùH........À...
00000030  8B 04 07 F9 9B A2 90 3A 75 89 F1 42 12 59 DA 0D  ‹..ù›¢.:u‰ñB.YÚ.
00000040  21 7C A2 C3 5A E4 78 00 10 8D 4B F7 A2 73 9C 63  !|¢ÃZäx...K÷¢sœc
00000050  5D 8D 5D 49 16 C7 6F 2C AD 33 FE 1F D3 6C A1 CA  ].]I.Ço,.3þ.Ól¡Ê
00000060  BA AD 2B FE 8F 33 71 D7 C5 E6 5C FF BF 77 6C 80  º.+þ.3q×Åæ\ÿ¿wl€
00000070  F2 BE 11 BB 3C 52 52 DC A9 68 E5 24 AD 4F F3 48  ò¾.»<RRÜ©hå$.OóH

-From v1.0.4c2_TMU510_u-

00000000   73 79 73 31 73 47 59 5D  FB 85 3B 7B 4A 28 10 5D   sys1sGY]û…;{J( ]
00000010   46 EE 8C 01 3C B4 F1 82  1E 18 4F B7 4A 56 FC C7   FîŒ <´ñ‚  O·JVüÇ
00000020   FF 83 0B E0 00 00 00 00  40 00 06 00 00 00 06 00   ÿƒ à    @       
00000030   69 B6 02 69 3A 97 8B 1C  4E 18 D4 E0 63 7D CA 94   i¶ i:—‹ N Ôàc}Ê”
00000040   4B A0 79 34 79 41 BD 09  BB 68 D4 0A A0 B7 05 78   K y4yA½ »hÔ  · x
00000050   D9 8F 8F 28 6C 9A 1B 61  CF A1 E7 49 7D CA C4 A3   Ù  (lš aÏ¡çI}ÊÄ£
00000060   A4 4D 4B E0 AE 48 86 03  B1 43 F2 47 C0 C4 1D 4F   ¤MKà®H† ±CòGÀÄ O
00000070   FA E8 43 A7 1E 6E 79 8C  E5 FF 04 20 E9 44 09 B5   úèC§ nyŒåÿ  éD µ

Observations

• The first 4 bytes (0x1B2D700F) appear static in each package.
• The next 0x20 bytes appear to change with each package
• The following 12 bytes (0x0000000000100000C00F0000) also appear static, but it's the firmware size and fw size - header size; infact if correctly converted to little endian 00000000 00001000 00000fc0, where 00000000 is Unknown, 00001000 is 4096 in dec (file size) and 00000fc0 is 4032 in dec (update size).
• On the DECH fw, the update works in the same way: 000000004000060000000600 converted will be: 00000000 00060040 00060000, where, 00000000 is probably padding, file size 00060040, 00060000 update size
• the first 0x40 bytes probably are IV + HASH + update infos. probably the algorithm used is AES.
• algorithm used is aes 128 cbc on the body (iv is at + 0x30)

Patch structure

Mullion Patch Content

Offset	Size	Notes	Number
0x00	0x2	Major Version	1
0x02	0x2	Minor Version	1
0x04	0x2	Major Revision	1
0x06	0x2	Minor Revision	1
0x08	0x10	Patch Addresses	4*4
0x18	0x10	Patch Instruction / Data	4*4
0x28	0x10	Patch Jump Instruction Addresses	4*4
0x38	0x388	Additional Patch Instructions	1
0x3C0	0xC00	HDMI Patch	1

Sherwood Patch Content

Offset	Size	Notes	Number
0x00	0x4	Magic	1
0x04	0x2	Major Version	1
0x06	0x2	Minor Version	1
0x08	0x2	Major Revision	1
0x0A	0x2	Minor Revision	1
0x0C	0x4	Absolute Table Address	1
0x10	0x2	Data Size	1
0x12	0x2	Data Checksum	1
0x14	0x2	Patch Checksum	1
0x16	0x2	Relative (0x2000) Data Address	1
0x18	0x2	Relative (0x2000) Table Address	1
------	0x80	Table with Addresses	32*4
------	------	Data (not parsed on SW)	-

Command list (Mullion)

External commands

Address	Command	Subcommand	Permission
0x32959	BOOT	MODE	0x000080D6
0x329D5	BOOT	CONT	0x000080D5
0x342D7	SHUTDOWN	-	0x0000C0D5
0x32A51	HALT	-	0x0000C0D5
0x32A85	BOOTENABLE	-	0x0000809A
0x33491	AUTH1	-	0x0000C0EF
0x33525	AUTH2	-	0x0000C0EF
0x33619	AUTHVER	SET	0x0000C0DF
0x335BF	AUTHVER	GET	0x0000C0FF
0x32AC3	EEP	INIT	0x000080DA
0x32C51	EEP	SET	0x0000C0DF
0x32D3D	EEP	GET	0x0000C0DF
0x32EA7	PDAREA	SET	0x0000C0DF
0x32E3B	PDAREA	GET	0x0000C0DF
0x330C5	CSAREA	SET	0x0000C0DF
0x33057	CSAREA	GET	0x0000C0DF
0x33169	VID	GET	0x0000C0D5
0x331D7	CID	GET	0x0000C0D5
0x3321D	ECID	GET	0x0000C0D5
0x3325D	REV	SB	0x0000C0D5
0x3328D	SPU	INFO	0x0000C0D5
0x332E1	KSV	-	0x0000C0D5
0x33685	FAN	SETPOLICY	0x0000C0D7
0x33717	FAN	GETPOLICY	0x0000C0D7
0x33781	FAN	START	0x0000C0D7
0x33781	FAN	STOP	0x0000C0D7
0x33951	FAN	SETDUTY	0x0000C0D7
0x339C3	FAN	GETDUTY	0x0000C0D7
0x33A27	R8	-	0x0000C0DF
0x33AD1	W8	-	0x0000C0DF
0x33B71	R16	-	0x0000C0DF
0x33C19	W16	-	0x0000C0DF
0x33CBB	R32	-	0x0000C0DF
0x33E49	W32	-	0x0000C0DF
0x33EE9	RBE	-	0x0000C0D5
0x33F91	WBE	-	0x0000C0D5
0x34049	PORTSTAT	-	0x0000C0DF
0x332BF	VER	-	0x0000C0FF
0x341C5	BUZ	-	0x00008096
0x342D7	SERVFAN	-	0x0000C0D7
0x341F9	ERRLOG	START	0x0000C0DF
0x34221	ERRLOG	STOP	0x0000C0DF
0x34249	ERRLOG	GET	0x0000C0FF
0x342B3	ERRLOG	CLEAR	0x0000C0DF

Internal commands

Command	Address	Perms	SubCommands	Description
becount	0xCA7D	0xDD0C0000	-	Display bringup/shutdown count + Power-on time
bepgoff	0xA4E7	0xD00C0000	-	BE power grid off
bepkt	0x2435D	0xDC0C0000	show/set/unset/mode/debug/help	Packet permissions
bestat	0xD413	0xFD0F0000	-	Get status of BE
boardconfig	0x99C7	0xDC0C0000	-	Displays board configuration (NOT WORKING?)
bootbeep	0x1EA67	0xF0000000	stat/on/off	Boot beep
bringup	0xD597	0xFD0F0000	-	Turn PS3 on
bsn	0xD805	0xF00F0000	-	Get board serial number
bstatus	0x24269	0xDD0C0000	-	HDMI related status
buzz	0xA4FF	0xDC0C0000	[freq]	Activate buzzer
buzzpattern	0xA8B7	0xDC0C0000	[freq] [pattern] [count]	Buzzer pattern
clear_err	0x2595B	0xDD0C0000	last/eeprom/all	Clear errors
clearerrlog	0xB8CB	0xDD0C0000	-	Clears error log
comm	0x9919	0xDC0C0000	-	Communication mode
commt	0x24907	0xDC0C0000	help/start/stop/send	Manual BE communication
cp	0x1E077	0xF0000000	ready/busy/reset/beepremote/beep2kn1n3/beep2kn2n3	CP control commands
csum	0xD687	0xFF0F0000	-	Firmware checksum
devpm	0xD053	0xDD0C0000	ata/pci/pciex/rsx	Device power management
diag	0x9AAD	0xD00C0000	...	Diag (execute without param to show help) (NOT WORKING?)
disp_err	0x25911	0xDD0C0000	-	Displays errors
duty	0x9B23	0xDD0C0000	get/set/getmin/setmin/getmax/setmax/getinmin/setinmin/getinmax/setinmax	Fan policy
dve	0x2995D	0xDC0C0000	help/set/save/show	DVE chip parameters
eepcsum	0xAA65	0xDD0C0000	-	Does nothing
eepromcheck	0x9A1D	0x000C0000	[id]	Check eeprom
eeprominit	0x9A65	0x000C0000	[id]	Init eeprom
ejectsw	0xD611	0xFD0F0000	-	Eject switch
errlog	0xB7ED	0xFF0C0000	-	Gets the error log
fancon	0xD26D	0x0D000000	-	Does nothing
fanconautotype	0xC075	0xDD0C0000	-	Does nothing
fanconmode	0xBF35	0xDD0C0000	get	Fan control mode
fanconpolicy	0xBBC9	0xDD0C0000	get/set/getini/setini	Fan control policy
fandiag	0x1E91B	0xF0000000	-	Fan test
faninictrl	0xD3D9	0x0D000000	-	Does nothing
fanpol	0xCA31	0xDD0C0000	-	Does nothing
fanservo	0xBF29	0xDD0C0000	-	Does nothing
fantbl	0xC087	0xDD0C0000	get/set/getini/setini/gettable/settable	Fan table: get/set - currently in RAM/in use ; getini/setini - stored in EEPROM (!! in COK the chksum does not updated automatically !!) fantbl - Fan Table set/get command Usage: fantbl set fanconNo pNo tempD tempU duty ex. fantbl set 0 p1 0x1400 0x1E40 0xC0 ex. fantbl set 0 p1 20.0 30.25 75 Usage: fantbl get fanconNo ex. fantbl get 1
firmud	0xD61D	0xFDFF0000	-	Firmware update
geterrlog	0xB84F	0xDD0C0000	[id]	Gets error log
getrtc	0xA6F3	0xDD0C0000	-	Gets rtc
halt	0x1E107	0xF0000000	-	Halts syscon
hdmi	0x29F39	0xDD0C0000	...	HDMI (various commands, use help) [HDMI Help] HDMI System Start  :$ hdmi setup ([ChannelNo]) [HDMI Help] Show IC Type  :$ hdmi ictype [ChannelNo] [HDMI Help] Display EDID  :$ hdmi redid [ChannelNo] (p) [HDMI Help] Display KSV  :$ hdmi rksv [ChannelNo] [HDMI Help] SiI Register Read  :$ hdmi r [ChannelNo] [TargetDevID(0/1)] [OffsetAddr(hex)] [ReadSize(hex)] [HDMI Help] SiI Register Write  :$ hdmi w [ChannelNo] [TargetDevID(0/1)] [OffsetAddr(hex)] [WriteData(hex)] [HDMI Help] Set 12bit Param  :$ hdmi 12bit [ChannelNo] (d1:0 - d5:4) [HDMI Help] Set 10bit Param  :$ hdmi 10bit [ChannelNo] (d1:0 - d5:4) [HDMI Help] DDC Bus Read  :$ hdmi dr [ChannelNo] [TargetDevID(0/1)] [OffsetAddr(hex)] [ReadSize(hex)] [HDMI Help] DDC Bus Write  :$ hdmi dw [OffsetAddr(hex)] [WriteData(hex)] [HDMI Help] Show Channel Status  :$ hdmi chstat [ChannelNo] [HDMI Help] Debug Log Verbose  :$ hdmi vbs ([Verbose Setting(hex)]) [HDMI Help] HDMI System Shutdown  :$ hdmi letup ([ChannelNo]) [HDMI Help] HDMI Eleguler Test  :$ hdmi hwreset ([ChannelNo]) [HDMI Help] HDMI Eleguler Test KPL  :$ hdmi hwreset2 ([ChannelNo]) [HDMI Help] HDMI Manage Struct Dump  :$ hdmi dumpst ([ChannelNo]) [HDMI Help] Show HDMI and DVE Port Num:$ hdmi ports [HDMI Help] Show Timer Value  :$ hdmi timer [HDMI Help] Show I2C Resource  :$ hdmi i2c [HDMI Help] Show Patch Information  :$ hdmi patch [HDMI Help] Resolution Reset  :$ hdmi resrst [ChannelNo] [HDMI Help] Show this Message  :$ hdmi help
hdmiid	0x29D1D	0xDC0F0000	-	Get HDMI id's
hdmiid2	0x29D81	0xDC0F0000	-	Get HDMI id's
hversion	0x2422F	0xDD0C0000	-	Platform ID
hyst	0xAEF5	0xDD0C0000	get/set/getini/setini	Temperature zones
lasterrlog	0xB7FF	0xDD0C0000	-	Last error from log
ledmode	0xA80B	0xDC0C0000	[id] [id]	Get led mode
LS	0x2421B	0xDD0C0000	-	LabStation Mode
ltstest	0xCB97	0xDD0C0000	get/set be/rsx	?Temp related? values
osbo	0x1EA3F	0xF0000000	-	Sets 0x2000F60
patchcsum	0xD9F7	0xDD0C0000	-	Patch checksum
patchvereep	0xD9B1	0xDD0C0000	-	Patch version eeprom
patchverram	0xD965	0xDD0C0000	-	Patch version ram
poll	0x240E3	0xDD0C0000	-	Poll log
portscan	0xDA0D	0xDD0C0000	[port]	Scan port (NOT WORKING?)
powbtnmode	0xB911	0xDC0C0000	[mode (0/1)]	Power button mode
powerstate	0xCE6F	0xDD0C0000	-	Get power state
powersw	0xD5F9	0xFD0F0000	-	Power switch
powupcause	0xB621	0xDD0C0000	-	Power up cause
printmode	0x99D9	0xDC0C0000	[mode (0/1/2/3)]	Set printmode
printpatch	0xD94F	0xDD0C0000	-	Prints patch
r	0x8CA5	0xDD0C0000	[offset] [length]	Read byte from SC
r16	0x8ED5	0xDD0C0000	[offset] [length]	Read word from SC
r32	0x9191	0xDD0C0000	[offset] [length]	Read dword from SC
r64	0x935D	0xDD0C0000	[offset] [length]	Read qword from SC
r64d	0x948F	0xDD0C0000	[offset] [length]	Read ?qword data? from SC
rbe	0x96F9	0xDD0C0000	[offset]	Read from BE
recv	0x24135	0xDD0C0000	-	Receive something
resetsw	0xD605	0xFC0F0000	-	Reset switch
restartlogerrtoeep	0xB903	0xDD0C0000	-	Reenable error logging to eeprom
revision	0xD7E1	0xFFFF0000	-	Get softid
rrsxc	0xD313	0xDD0C0000	[offset] [length]	Read from RSX
rtcreset	0xA7BB	0x000C0000	-	Reset RTC
scagv2	0xE24F	0xFF000000	-	Auth related?
scasv2	0xE207	0xDD000000	-	Auth related?
scclose	0xE1EF	0xFF000000	-	Auth related?
scopen	0xE121	0xFF000000	-	Auth related?
send	0x2416F	0xDD0C0000	[variable]	Send something
shutdown	0xD5C5	0xFD0F0000	-	PS3 shutdown
startlogerrtsk	0xB8E7	0xDD0C0000	-	Start error log task
stoplogerrtoeep	0xB8F5	0xDD0C0000	-	Stop error logging to eeprom
stoplogerrtsk	0xB8D9	0xDD0C0000	-	Stop error log task
syspowdown	0xB6E9	0xDD0C0000	3 params	System power down
task	0x15005	0xDD0C0000	-	Print tasks
thalttest	0xD813	0x000F0000	-	Does nothing
thermfatalmode	0xCA3B	0xDD0C0000	canboot/cannotboot	Set thermal boot mode
therrclr	0xD3E5	0xDD0C0000	-	Thermal register clear
thrm	0xBF1D	0xDD0C0000	-	Does nothing
tmp	0xAA69	0xDD0C0000	[zone]	Get temperature
trace	0xB951	0xDD0C0000	...	Trace tasks (use help) Usage: trace command param command: [status/start/stop/dump/print/id] param (with `id' command): available characters: [0-9][,][-] ex. trace id 1-12,16
trp	0xAB2F	0xDD0C0000	get/set/getini/setini	Temperature zones
tsensor	0xA279	0xDD0C0000	[sensor]	Get raw temperature
tshutdown	0xB2A1	0xDD0C0000	get/set/getini/setini	Thermal shutdown
tshutdowntime	0xC95D	0xDD0C0000	[time]	Thermal shutdown time
tzone	0xB5E1	0xDD0C0000	-	Show thermal zones
version	0xD65F	0xFFFF0000	-	SC firmware version
w	0x8BF9	0xDD0C0000	[offset] [value]	Write byte to SC
w16	0x8E2D	0xDD0C0000	[offset] [value]	Write word to SC
w32	0x8FED	0xDD0C0000	[offset] [value]	Write dword to SC
w64	0x92A9	0xDD0C0000	[offset] [value]	Write qword to SC
wbe	0x9665	0xDD0C0000	[offset] [value]	Write to BE
wmmto	0xCB3B	0xDC0C0000	get	Get watch dog timeout
wrsxc	0xD279	0xDD0C0000	[offset] [value]	Write to RSX
xdrdiag	0x1E711	0xF0000000	start/info/result	XDR diag
xiodiag	0x1E875	0xF0000000	-	XIO diag
xrcv	0x25313	0xDC0C0000	-	Xmodem receive

Command list (Sherwood)

Very similar to PS4 southbridge firmware. Only difference here is the string Playstation 3

• A_AUTH = 0x0700
• B_AUTH = 0x0B00
• INT = 0x0300 (Command not available from UART interface. Can be unlocked by patching syscon firmware)
• ANY = 0x0F00

SW-301

Address	Command	Permission
0x32030	hdmi	A_AUTH
0x2FB30	tsensor	A_AUTH
0x2FE7F	tmp	A_AUTH
0x2FFA6	trp	A_AUTH
0x301D8	tshutdown	A_AUTH
0x3041B	tzone	A_AUTH
0x30482	thrm	A_AUTH
0x307EF	duty	A_AUTH
0x30C0D	fanconpolicy	A_AUTH
0x30DF9	fanconmode	A_AUTH
0x30F3B	fantbl	A_AUTH
		N/A ?
		N/A ?
		N/A ?
0x305F2	hyst	A_AUTH
0x313EB	powupcause	A_AUTH
0x31460	syspowdown	A_AUTH
0x316C6	devpm	A_AUTH
0x318CF	powerstate	A_AUTH
0x31AC2	nonfatalerror	A_AUTH
0x2F82A	getrtc	INT
0x2ED2B	help	A_AUTH
0x2EED7	meminfo	INT
0x2EF63	rbe	INT
0x2F1FC	DISABLEALLERASE	A_AUTH
0x2F281	task	INT
0x2F460	cleareep	INT
0x2F499	commt	INT
0x2F79B	bestat	A_AUTH
0x2DAC3	bringup	A_AUTH
0x2DC1C	shutdown	A_AUTH
0x2DC9B	r	A_AUTH
0x2DC9B	r16	A_AUTH
0x2DC9B	r32	A_AUTH
0x2E7BC	r64	A_AUTH
0x2E7BC	r64d	A_AUTH
0x2E03B	w	A_AUTH
0x2E03B	w16	A_AUTH
0x2E03B	w32	A_AUTH
0x2E6C1	w64	A_AUTH
0x2E6C1	wbe	A_AUTH
0x2DAC3	BOOT	A_AUTH
0x2DC1C	HALT	A_AUTH
0x2DC7B	BOOTENABLE	A_AUTH
0x2DC9B	R8	A_AUTH
0x2DC9B	R16	A_AUTH
0x2DC9B	R32	A_AUTH
0x2E03B	W8	A_AUTH
0x2E03B	W16	A_AUTH
0x2E03B	W32	A_AUTH
0x2E8C2	EEP	A_AUTH
0x2E9B8	PDAREA	A_AUTH
0x2E9B8	CSAREA	A_AUTH
0x2EC36	portset	INT
0x2ECF9	extend	A_AUTH
0x80D0	version	ANY
0x812B	revision	ANY
0x8251	setcmdlong	ANY
0x81C3	VER	ANY
0x8251	SETCMDLONG	ANY
0x8356	csum	A_AUTH
0x8555	AUTH1	B_AUTH
0x8555	AUTH2	B_AUTH
0x86FB	AUTHVER	ANY
0x311DA	ERRLOG	ANY
0x311DA	errlog	ANY
0x31C87	powersw	A_AUTH
0x31CA5	ejectsw	A_AUTH
		N/A ?
0x31CC5	buzzduty	INT
0x31D24	buzz	INT
0x33F98	VID	A_AUTH
0x340BF	CID	A_AUTH
0x340BF	ECID	A_AUTH
0x34211	SPU	A_AUTH
0x342BC	REV	A_AUTH
0x34363	KSV	A_AUTH
		N/A ?
0x3441B	portscan	A_AUTH
0x33F46	eepcsum	A_AUTH
0x346DD	patchinfo	A_AUTH
0x346F3	poll	INT
0x3470F	recv	INT
0x3472B	send	INT
0x34747	LS	INT
0x34763	hversion	INT

.

SW2-301

Address	Command	Permission
0x3D989	hdmi	A_AUTH
0x3B1CF	tsensor	A_AUTH
0x3B3D5	tmp	A_AUTH
0x3B627	trp	A_AUTH
0x3B645	tshutdown	A_AUTH
0x3B663	tzone	A_AUTH
0x3B6C9	thrm	A_AUTH
0x3B95D	duty	A_AUTH
0x3BBB9	fanconpolicy	A_AUTH
0x3BD48	fanconmode	A_AUTH
0x3BE58	fantbl	A_AUTH
0x3C07D	fanservo	A_AUTH
0x3C2E2	fanservostat	A_AUTH
		N/A ?
0x3B7F0	hyst	A_AUTH
0x3C695	powupcause	A_AUTH
0x3C70A	syspowdown	A_AUTH
0x3C98A	devpm	A_AUTH
0x3CB93	powerstate	A_AUTH
0x3CDF0	nonfatalerror	A_AUTH
0x3AD68	getrtc	INT
0x3A280	help	A_AUTH
0x3A42C	meminfo	INT
0x3A4B8	rbe	INT
0x3A751	DISABLEALLERASE	A_AUTH
0x3A7D6	task	INT
0x3A99E	cleareep	INT
0x3A9D7	commt	INT
0x3ACD9	bestat	A_AUTH
0x39018	bringup	A_AUTH
0x39171	shutdown	A_AUTH
0x391F0	r	A_AUTH
0x391F0	r16	A_AUTH
0x391F0	r32	A_AUTH
0x39D11	r64	A_AUTH
0x39D11	r64d	A_AUTH
0x39590	w	A_AUTH
0x39590	w16	A_AUTH
0x39590	w32	A_AUTH
0x39C16	w64	A_AUTH
0x39C16	wbe	A_AUTH
0x39018	BOOT	A_AUTH
0x39171	HALT	A_AUTH
0x391D0	BOOTENABLE	A_AUTH
0x391F0	R8	A_AUTH
0x391F0	R16	A_AUTH
0x391F0	R32	A_AUTH
0x39590	W8	A_AUTH
0x39590	W16	A_AUTH
0x39590	W32	A_AUTH
0x39E17	EEP	A_AUTH
0x39F0D	PDAREA	A_AUTH
0x39F0D	CSAREA	A_AUTH
0x3A18B	portset	INT
0x3A24E	extend	A_AUTH
0xA0F1	version	ANY
0xA14C	revision	ANY
0xA272	setcmdlong	ANY
0xA1E4	VER	ANY
0xA272	SETCMDLONG	ANY
0xA37B	csum	A_AUTH
0xA5AF	AUTH1	B_AUTH
0xA5AF	AUTH2	B_AUTH
0xA755	AUTHVER	ANY
0x3C484	ERRLOG	ANY
0x3C484	errlog	ANY
0x3D005	powersw	A_AUTH
0x3D023	ejectsw	A_AUTH
		N/A ?
0x3D043	buzzduty	INT
0x3D0A2	buzz	INT
0x3FC43	VID	A_AUTH
0x3FD6A	CID	A_AUTH
0x3FD6A	ECID	A_AUTH
0x3FEBC	SPU	A_AUTH
0x3FF67	REV	A_AUTH
0x4000E	KSV	A_AUTH
		N/A ?
0x400C6	portscan	A_AUTH
0x3FBF1	eepcsum	A_AUTH
0x40388	patchinfo	A_AUTH
0x4039E	poll	INT
0x403BA	recv	INT
0x403D6	send	INT
0x403F2	LS	INT
0x4040E	hversion	INT

.

SW3-304

Address	Command	Permission
0x3E21D	hdmi	A_AUTH
0x3B8F0	tsensor	A_AUTH
0x3BAF6	tmp	A_AUTH
0x3BD48	trp	A_AUTH
0x3BD66	tshutdown	A_AUTH
0x3BD84	tzone	A_AUTH
0x3BDEA	thrm	A_AUTH
0x3C07E	duty	A_AUTH
0x3C2DA	fanconpolicy	A_AUTH
0x3C469	fanconmode	A_AUTH
0x3C579	fantbl	A_AUTH
0x3C79E	fanservo	A_AUTH
0x3CA03	fanservostat	A_AUTH
0x3CB6B	fanservosetval	A_AUTH
0x3BF11	hyst	A_AUTH
0x3CE8E	powupcause	A_AUTH
0x3CF03	syspowdown	A_AUTH
0x3D183	devpm	A_AUTH
0x3D38C	powerstate	A_AUTH
0x3D5E9	nonfatalerror	A_AUTH
0x3B489	getrtc	INT
0x3A9A1	help	A_AUTH
0x3AB4D	meminfo	INT
0x3ABD9	rbe	INT
0x3AE72	DISABLEALLERASE	A_AUTH
0x3AEF7	task	INT
0x3B0BF	cleareep	INT
0x3B0F8	commt	INT
0x3B3FA	bestat	A_AUTH
0x39739	bringup	A_AUTH
0x39892	shutdown	A_AUTH
0x39911	r	A_AUTH
0x39911	r16	A_AUTH
0x39911	r32	A_AUTH
0x3A432	r64	A_AUTH
0x3A432	r64d	A_AUTH
0x39CB1	w	A_AUTH
0x39CB1	w16	A_AUTH
0x39CB1	w32	A_AUTH
0x3A337	w64	A_AUTH
0x3A337	wbe	A_AUTH
0x39739	BOOT	A_AUTH
0x39892	HALT	A_AUTH
0x398F1	BOOTENABLE	A_AUTH
0x39911	R8	A_AUTH
0x39911	R16	A_AUTH
0x39911	R32	A_AUTH
0x39CB1	W8	A_AUTH
0x39CB1	W16	A_AUTH
0x39CB1	W32	A_AUTH
0x3A538	EEP	A_AUTH
0x3A62E	PDAREA	A_AUTH
0x3A62E	CSAREA	A_AUTH
0x3A8AC	portset	INT
0x3A96F	extend	A_AUTH
0xA0FF	version	ANY
0xA15A	revision	ANY
0xA280	setcmdlong	ANY
0xA1F2	VER	ANY
0xA280	SETCMDLONG	ANY
0xA389	csum	A_AUTH
0xA5BD	AUTH1	B_AUTH
0xA5BD	AUTH2	B_AUTH
0xA763	AUTHVER	ANY
0x3CC7D	ERRLOG	ANY
0x3CC7D	errlog	ANY
0x3D7FE	powersw	A_AUTH
0x3D81C	ejectsw	A_AUTH
0x3D83C	doorsw	A_AUTH
0x3D8D7	buzzduty	INT
0x3D936	buzz	INT
0x404D8	VID	A_AUTH
0x405FF	CID	A_AUTH
0x405FF	ECID	A_AUTH
0x40751	SPU	A_AUTH
0x407FC	REV	A_AUTH
0x408A3	KSV	A_AUTH
0x4095B	MOUNTINFO	A_AUTH
0x40A2A	portscan	A_AUTH
0x40486	eepcsum	A_AUTH
0x40CF2	patchinfo	A_AUTH
0x40D08	poll	INT
0x40D24	recv	INT
0x40D40	send	INT
0x40D5C	LS	INT
0x40D78	hversion	INT

Access to Syscon from Linux

Access SysCon ROM without needing ps3dm-utils: http://wiki.gitbrew.org/wikibrew/PS3:HvReverseEngineering#SYSCON

Placeholder for bga patch key generation

34 3A 00 00 00 00 5F 5F 53 43 45 49 53 59 53 31

4:....__SCEISYS1

OR (slim DYN-001)

00 00 00 00 5F 5F 5F 5F 53 43 45 49 53 59 53 31

....____SCEISYS1

• replace 4 dots with soft id in decimal form, xor with 0x140 key and with cipher patcher key and encrypt with master patcher key to obtain cipher master key for that soft id

• replace 4 dots with soft id in decimal form, xor with 0x140 key and with hasher patcher key and encrypt with master patcher key to obtain hasher master key for that soft id