Loaders
Jump to navigation
Jump to search
Explaination
Loaders are used for loading other modules.
Commonly found in CoreOS and Flash.
Known loaders
| Loader | Location | Type | Remarks |
|---|---|---|---|
| bootldr | Flash | Boot Loader | primary loader from chain of trust |
| metldr | Flash | Meta Loader | aka asecure_loader. Loads other loaders |
| appldr | CoreOS | Application Loader | loads userspace [f]selfs e.g. vsh.self, videoplayer_plugin.sprx, disc EBOOT.BINs, NPDRM EBOOT.BINs |
| isoldr | CoreOS | Isolation Loader | loading isolated SPU modules |
| lv1ldr | CoreOS | Hypervisor Loader | loads lv1.self (Hypervisor) |
| lv2ldr | CoreOS | Supervisor Loader | loads lv2_kernel.self (Supervisor kernel) |
Loader encapsulation in lv0
| version | decrypted SHA1 hash | isoldr | appldr | lv1ldr | lv2ldr | Remarks |
|---|---|---|---|---|---|---|
| 3.60 | 7A051A4A228C5C7256B9DD3ECC0CFABB605490E3 | D/L ; contains weird 2nd loaders that could not be decrypted (named [loader name]_2) | ||||
| 3.61 | 832CE19B420895B7C89D0DD3D346B9B4254F0902 | |||||
| 3.65 | C9F7F42BFB30A9FB9FF1394D18F8C490FA20E51D | |||||
| 3.66 | 110CEA044B059AC8E89C52121DD94EB062605180 | |||||
| 3.70 | B0CE989CEA9994A7424BC64C49B477ACB9759C45 | |||||
| 3.72 | E6ABA3DBBAB9CCCFA8B9D4C75AF9BC2CD2A470CC | |||||
| 3.73 | 17E363EC32AE2C35410250FD147500EAB27C7229 | |||||
| 3.74 | 048C7F30C6FEC76029DE7107C6EA825D778464D3 | |||||
| 4.00 | B1BD5C738EA8B4C5882DF3816802042015E57765 | |||||
| 4.01 | DB42B9FC98E927536F9BDE68517DC7EF6A3E7630 | |||||
| 4.10 | ED6B89DE996DA92B670A515342E5BA44C506CCB8 | |||||
| 4.11 | 5A80C633C7679FB24FEC9E603058A65010F1CC59 | |||||
| 4.20 | 69F14D7512177EAE3DB6A00764CB242D1683511C | |||||
| 4.21 | DB4E4CF6A795D8AB93200B4ACDA7978028601EDC | |||||
| 4.23 | AC7BDA2E7E093D4FDDE801FAFAB42F55B92506C4 | |||||
| 4.25 | A6DE36E9178C75B3C557E3056C8BAE5A13C83038 | |||||
| 4.26 | 042ACDE3A986B50F8C58450798DD866130EB85EA | |||||
| 4.30 | 44A048CC7F990A9EE5400695BC0D9EE283BAB02F |
Stop Codes
| Stop Code | Module | Remark |
|---|---|---|
| 0x30 | isoldr/appldr | Version mismatch (isoldr version differs from version returned by SPU channel 73). |
| 0x16 | isoldr | Revoke List Error |
| 0x17 | isoldr | Adresses needs to be aligned |
| 0x21 | lv1ldr | ??? |
| 0x27 | appldr | SPU arg at 0x3E840 |
| 0x20 | metldr | header error |
| 0x23 | metldr | ECDSA signature failure |
0x27
When booting, lv1ldr store its version in this region writing to ch_72.
isoldr asks for the version in two chuncks, if you want to pass version 3.41 (0x0003004100000000)
Note: this version check was recently added, maybe in fw 3.41
//for ch_73_round_0 data0 = 0x00030041; //for ch_73_round_1 data1 = 0x00000000;
lv1ldr
Used for loading the hypervisor (lv1.self). It also handles some initialization of the ATA and ENCDEC subsystems.
LS Parameters Layout
| Address | Usage | Comments |
|---|---|---|
| 0x34CB0 | Unknown | DMA read from ch74 20 times. |
| 0x3E000 | Wait flag | If (flag==0){wait;} // use 0xFF00000000ULL |
| 0x3E800 | Arguments |
lv2ldr
Used to verify and decrypt lv2 selfs (lv2_kernel.self, ps2_emu.self, ps2_gxemu.self, ps2_softemu.self, ps2_netemu.self)
And to install RVK-list.
LS Parameters layout
| Address | Usage | Comments |
|---|---|---|
| 0x3E000 | Wait flag | If (flag==0){wait;} // use 0xFF00000000ULL |
| 0x3E800 | Arguments | |
| 0x3F000 | Program revoke list |
Arguments
| Size | Name | Value |
|---|---|---|
| u64 | lpar_auth_id | 0x1070000002000001 |
| u8 | *lv2_in | lv2 self - address in ram |
| u8 | *lv2_out | where to decrypt lv2 - address in ram |
| u64 | field18 | -1 |
| u8[40] | res1 | Unknown / Not used |
| u64 | field48 | 1 |
| u8[16] | res2 | Unknown / Not used |
appldr
Used to verify and decrypt userland program/data segments (system libraries, vsh and its modules, games, edat and sdat files)
Allows to authenticate fselfs by following Target_ids from EID0: 0x81, 0x82, 0xA0.
LS Parameters layout
| Address | Usage | Comments |
|---|---|---|
| 0x3E000 | Wait flag | If (flag==0){wait;} // use 0xFF00000000ULL |
| 0x3E400 | EID0 | |
| 0x3E800 | Arguments | |
| 0x3EC00 | QA-Flag Info | u64 qaflag_exist_flag //If existed, set to 0, otherwise -1 u64 unk0 //always 0 u8[0x50] qa_token u8[0x2A] qa_token_signature u8[0x6] padding |
| 0x3EE00 | LV2 Protection Info | u64 hashed memory effective addr u64 hashed memory size u8[0x14] expected_hmac_hash u8[0xC] padding |
| 0x3F000 | Program revoke list |
Arguments
For authenticate_program_segment, firmware 0.8x
| Size | Name | Value |
|---|---|---|
| u64 | program_auth_id | subject program authority id |
| u64 | lpar_auth_id | subject logical partition authority id |
| u64 | self_header_addr | |
| u64 | program_segment_addr | |
| u64 | program_segment_index | |
| u64 | destination_addr | where to decrypt |
| u64 | capability_addr | capability flags will be placed to this addr |
| u64 | flag | |
| u64 | field40 | unknown/pad |
| u64 | field48 | 2 (on modern fws it could be 2 or 3 or 5) |
For authenticate_program_segment, firmware 4.7x
| Size | Name | Value |
|---|---|---|
| u64 | subarguments_addr | subarguments effective address |
| u64 | lpar_auth_id | subject logical partition authority id |
| u64 | field48 | 5 (checked by appldr, if doesnot match -> appldr will be stoped with err code 0x27) |
subarguments
| Size | Name | Value |
|---|---|---|
| u64 | program_auth_id | |
| u64 | self_header_addr | |
| u64 | ? | |
| u64 | ? | |
| u64 | ? | |
| u64 | capability_addr | capability flags (0x20 bytes) will be copyed at this effective addr |
| u64 | flag | some flags // flag & 0xFFFF must be <=2 for APP, 3 for UNK7/seven, 4 for NPDRM_APP, 5 for EDAT |
isoldr
Used for loading isolated SPU modules.
LS Parameters layout
| Address | Usage | Comments |
|---|---|---|
| 0x3E000 | Wait flag | If (flag==0){wait;} // use 0xFF00000000ULL |
| 0x3E400 | EID0 | |
| 0x3E800 | Arguments | |
| 0x3EC00 | QA-Token | If not used set to -1 |
| 0x3F000 | Program revoke list |
Stop Codes
| Stop Code | Remark |
|---|---|
| 0x0D | Revocation check failed. |
| 0x0E | Signature check failed. |
| 0x0F | Revoke list verification failed. |
| 0x11 | Revoke list verification failed (header). |
| 0x12 | SELF segment verification internal error. |
| 0x13 | SELF verification failed. |
| 0x16 | Revoke list verification failed. |
| 0x17 | Isolated module EA is not aligned. |
| 0x1D | SELF segment verification internal error (ELF32 header). |
| 0x25 | Auth-ID error? |
Arguments
Depending which isolated module you want to load, you would need to pass it different arguments.
| Size | Name | spp_verifier |
|---|---|---|
| u64 | prog_auth_id | 0x1050000003000001 |
| u64 | lpar_auth_id | 0x1070000002000001 |
| u64 | *spu_module | SPU - address in ram |
| u64 | *spu_module_arg1 | Profile - address in ram |
| u64 | spu_module_arg1_size | sizeof(profile) |
| u64 | *spu_module_arg2 | Not used |
| u64 | spu_module_arg2_size | Not used |
| u8 | res1[16] | Unknown |
| u64 | field48 | 3 |
| u8 res2[16] | Unknown |
| Size | Name | aim_spu_module |
|---|---|---|
| u64 | prog_auth_id | 0x1050000003000001 |
| u64 | lpar_auth_id | 0x1070000002000001 |
| u64 | *spu_module | SPU - address in ram |
| u64 | *spu_module_arg1 | aim_spu_args - address in ram |
| u64 | spu_module_arg1_size | 0x80 |
| u64 | *spu_module_arg2 | eid0 - address in ram |
| u64 | spu_module_arg2_size | sizeof(eid0) |
| u64 | field48 | 3 |
union aim_spu_args {
struct {
void *buf; // debug_info buffer address
u64 buf_size; // debug_info buffer size
u32 param; // 0x01 device type, 0x02 device id, 0x03 pscode, 0x04 psid
} in;
struct {
u8 result[0x10]; // no need to explain...
} out;
};
