Iso module
Explanation
Isolated modules are used for de-/encryption, rehashing etc.
Commonly found in CoreOS, dev_flash, embedded sony selfs and service packages like Remarry Bluray Drive.
They are SPU .self binaries which can be called whenever needed: e.g. decrypting and hashcheck EID0 for Product Code inside IDPS when called upon by lv1 (HyperVisor) to set up restrictions for Retail/CEX or Debug/DEX etc.
Note: This page lists all isolated modules, except bootldr, metldr and other loaders from CoreOS, see also Boot Order
Known isolated modules
| Module | Usage | Location | Remarks |
|---|---|---|---|
| AacsModule.spu.isoself | EID3 and theoretically OCRL | /dev_flash/bdplayer | |
| aim_spu_module.self | EID0 (section 0x00 and 0x0A) | CoreOS | |
| CprmModule.spu.isoself | EID3 | /dev_flash/bdplayer | |
| CssModule.spu.isoself | /dev_flash/bdplayer | ||
| fdm_spu_module | EID2, Remarry Bluray Drive | 2.43 JIG PUP | |
| manu_info_spu_module.self | CoreOS (since FW 3.50) | ||
| mc_iso_spu_module.self | PS2 | CoreOS | |
| me_iso_for_ps2emu.self | PS2 | CoreOS (since FW 3.70) | |
| me_iso_spu_module.self | PS2 | CoreOS | |
| SacModule.spu.isoself | EID3, SuperAudioCD | /dev_flash/vsh/module | |
| sb_iso_spu_module.self | South Bridge | CoreOS | |
| sc_iso.self | syscon | CoreOS | |
| sc_iso_factory.self | syscon | 2.43 JIG PUP | |
| spu_handler.isoself | PSP Savegames | self inside /dev_flash/sys/internal/libchnnlsv.sprx | |
| spu_handler.isoself | PSP | self inside /dev_flash/pspemu/release/emulator_drm.sprx mself (since FW 3.15) | |
| spu_mode_auth.self | 2.43 JIG PUP | ||
| spu_pkg_rvk_verifier.self | CoreOS | ||
| spu_token_processor.self | systemtokens, QA Flagging | CoreOS | |
| spu_utoken_processor.self | usertokens | CoreOS (since FW 2.40) | |
| ss_sc_init.self | syscon | 2.43 JIG PUP | |
| sv_iso_for_ps2emu.self | EID4, PS2 | CoreOS (since FW 3.70) | |
| sv_iso_spu_module.self | EID0, EID4, PS2, bluray | CoreOS |
sc_iso.self
sc_iso.self is used by the system to handle communications to/from syscon. Once debug printing is enabled after you load it, you can see some of the internal workings including error codes for when you are trying to use the module on your own.
Communicating w/ sc_iso.self
Look in the hv bible for more detailed info, but the gist is this:
1) Send the mbmsg start packet {1, 1, [sc_iso_cmd], [sc_iso_cmd_size]}. This is in response to the 0x80 mbox int.
2) On 0x81 mbox int, receive the packet (same location you sent it from), do stuff, then write back new packets and then spu_in_mbox_write(problem, seqno++)
| Error Value | Meaning |
|---|---|
| 0x80010283 | Bad hdr->seqno (in dma_get) |
| 0x80010284 | Bad hdr->mbmsg (in dma_get) |
| 0x80010285 | is_align_ok fail (in dma_get) |
| 0x81010101 | sc_iso command failed |
| 0x81010106 | Bad input command value |
| 0x81010607 | Bad parameter for Get SRH (0x4) |
| 0x81010801 | Init for VTRM (0x6) write mngblk failed |
| 0x81010807 | Bad parameters for Init for VTRM (0x6) |
| 0x81010907 | Bad parameters for get_region_data (0x7) |
| 0x81010A07 | Bad parameters for set_region_data (0x8) |
| 0x81010B01 | Read mngblk failed for Init For Updater (0xE) |
| 0x81010B07 | Bad parameter for Init For Updater (0xE) |
| 0x81011E07 | Bad parameter for encrypt (0x1) / decrypt (0x2) |
Iso module main arguments
| Register | Value |
|---|---|
| r3 | uint64_t iso_module_arg0 |
| r4 | uint64_t iso_module_arg1 |
| r5 | uint64_t iso_module_arg2 |
| r6 | uint64_t iso_module_arg3 |
| r7 | uint128_t indiv_data0_part0 |
| r8 | uint128_t indiv_data0_part1 |
| r9 | uint128_t indiv_data0_part2 |
| r10 | uint128_t indiv_data0_part3 |
| r11 | uint128_t indiv_data1_part0 |
| r12 | uint128_t indiv_data1_part1 |
| r13 | uint128_t indiv_data1_part2 |
| r14 | uint128_t indiv_data1_part3 |
| r15 | uint128_t indiv_data2_part0 |
| r16 | uint128_t indiv_data2_part1 |
| r17 | uint128_t indiv_data2_part2 |
| r18 | uint128_t indiv_data2_part3 |
| r19 | uint128_t indiv_data3_part0 |
| r20 | uint128_t indiv_data3_part1 (EID0_KEY_first_part for sv_iso_module only) |
| r21 | uint128_t indiv_data3_part2 (EID0_KEY_second_part for sv_iso_module only) |
| r22 | uint128_t indiv_data3_part3 (EID0_IV for sv_iso_module only) |
| r23 | uint32_t entry_point |
| r24 | uint64_t forced_sdk_minver (passed from metldr) |
