Editing Non Volatile Storage

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
The PS4 Non Volatile Storage (NVS) is, like in PS3 and PS Vita, a storage that has two properties: it remains accessible after electricity shortage (unlike RAM) and it is non-removeable (unlike HDD). NVS is mostly used for storing tokens and flags.
Same as PS3's NVS, used for storing tokens and flags. You can access it by using the function icc_nvs_read (or by ftp'ing the respective regions with root flags server).<br>
Seems that a total of 7 regions(blocks) exist in 2 banks, main bank and backup bank <br>
The kernel accesses only the 5th and the 2nd region, however it's possible to read the other 5 (also the entirety of it by reading /dev/sflash0s0x34 with BUF_SIZE 0x200 from ftp ).<br>
Most, if not all, of the NVS regions can be accessed also in sflash, starting with offset 0x1C4000.


On PS4, there are 2 Non Volatile Storages, one in the [[Serial Flash]] and one in the [[Syscon]] EEPROM. On PS3, NVS is stored in Serial Flash (NAND or NOR) whilst on PS Vita, NVS is part of Syscon EEPROM. There is also the Secure NVS (SNVS), which is a secure area of the Syscon NVS. SNVS is encrypted with some SAMU keys and can be accessed only after doing a handshake.
= Mapping of the area (NVS service) =
 
= Syscon NVS =
 
See [[Syscon]].
 
https://fail0verflow.com/blog/2018/ps4-syscon/
 
Syscon NVS is accessible from EMC but only after doing the handshake to unlock EMC functionalities.
 
= Serial Flash NVS =
 
PS4 [[Serial Flash]] NVS is usually stored at offset 0x1C4000 (it depends on the Serial Flash MBR). The size of the whole Serial Flash NVS is 0xC000 bytes.
 
Serial Flash NVS can be accessed from Kernel by calling the function icc_nvs_read. It can also be read by calling IO functions, with System privileges, to open <code>/dev/sflash0s0x34</code>.
 
== Serial Flash NVS Banks ==
 
A total of 7 blocks exist in 2 banks: main bank and backup bank. The kernel makes use only of the bank 0 block 4 and the bank 1 block 1, even though it is possible to read/write the other 5 banks. Indeed, <code>/dev/sflash0s0x34</code> access is provided to System applications and to Kernel.


{| class="wikitable sortable"
{| class="wikitable sortable"
Line 25: Line 10:
! Bank # !! Block # !! Start Offset in /dev/sflash0s0x34 !! Start Offset in Sflash !! Size !! Notes
! Bank # !! Block # !! Start Offset in /dev/sflash0s0x34 !! Start Offset in Sflash !! Size !! Notes
|-
|-
| 0 || 0 || 0 || 0x1C4000 || 0x3000 || emc region
| 0 || 0 || 0 || 0x1C4000 || 0x3000 || does not match, probably one (sflash or nvs, likely sflash) updates data
|-
|-
| 0 || 1 || 0x3000 || 0x1C7000 || 0x1000 || pd region
| 0 || 1 || 0x3000 || 0x1C7000 || 0x1000 || match
|-
|-
| 0 || 2 || 0x4000 || 0x1C8000 || 0x800 || ds region
| 0 || 2 || 0x4000 || 0x1C8000 || 0x800 || match, console data region
|-
|-
| 0 || 3 || 0x4800 || 0x1C8800 || 0x800 || cs region
| 0 || 3 || 0x4800 || 0x1C8800 || 0x800 || match, all ffs?
|-
|-
| 0 || 4 || 0x5000 || 0x1C9000 || 0x3000 || active/inactive os region 1
| 0 || 4 || 0x5000 || 0x1C9000 || 0x3000 || match, tokens and flags region
|-
|-
| 1 || 0 || 0x8000 || 0x1CC000 || 0x3000 || active/inactive os region 2
| 1 || 0 || 0x8000 || 0x1CC000 || 0x3000 || match, tokens and flags region (backup)
|-
|-
| 1 || 1 || 0xB000 || 0x1CF000 || 0x1000 || unknown region
| 1 || 1 || 0xB000 || 0x1CF000 || 0x1000 || match
|}
|}


== Detailed Serial Flash NVS Structure ==
= Mapping of the detailed area (NVS service) =


{| class="wikitable sortable"
{| class="wikitable sortable"
|-
|-
! Bank # !! Block # !! Start Offset in /dev/iccnvs<block> !! Start Offset in Sflash !! Size !! Notes
! Bank # !! Block # !! Start Offset in /dev/sflash0s0x34 !! Start Offset in Sflash !! Size !! Notes
|-
| 0 || 0 || 0 || 0x1C4000 || 0x8 || Platform ID (e.g 04 01 01 01 01 01 04 01)
|-
| 0 || 0 || 0x21 || 0x1C4021 || 0x6 || Unknown (e.g 02 BC 60 A7 28 83 66)
|-
| 0 || 0 || 0x27 || 0x1C4027 || 0x6 || Unknown
|-
| 0 || 0 || 0x4E || 0x1C404E || 0x2 || Unknown (e.g 25 16)
|-
| 0 || 0 || 0x50 || 0x1C4050 || 0x5 || Unknown (e.g 12 FF 00 00 00)
|-
|-
| 0 || 0 || 0x60 || 0x1C4060 || 0x5 || Unknown (e.g 04 02 01 01 02)
| 0 || 0 || 0 || 0x1C4000 || 0x8 ||  
|-
|-
| 0 || 0 || 0x73 || 0x1C4073 || 0x1 || Unknown (e.g 01)
| 0 || 0 || 0x20 || 0x1C4020 || 0x6 ||  
|-
|-
| 0 || 0 || 0x76 || 0x1C4076 || 0x1 || Unknown (e.g 01)
| 0 || 0 || 0x50 || 0x1C4050 || 0x1 ||  
|-
|-
| 0 || 0 || 0x7A || 0x1C407A || 0x6 || Unknown (e.g 00 00 00 00 00 38)
| 0 || 0 || 0x60 || 0x1C4060 || 0x5 ||  
|-
|-
| 0 || 0 || 0x80 || 0x1C4080 || 0x1 || Unknown (e.g. 00)
| 0 || 0 || 0x76 || 0x1C4076 || 0x1 ||  
|-
|-
| 0 || 0 || 0x82 || 0x1C4082 || 0x3 || Unknown (e.g. 01 01 01)
| 0 || 0 || 0x7A || 0x1C407A || 0x6 ||  
|-
|-
| 0 || 0 || 0x91 || 0x1C4091 || 0x2 || Unknown (e.g 00 00)
| 0 || 0 || 0x80 || 0x1C4080 || 0x1 ||  
|-
|-
| 0 || 0 || 0x96 || 0x1C4096 || 0x3 ||  
| 0 || 0 || 0x96 || 0x1C4096 || 0x3 ||  
|-
|-
| 0 || 0 || 0x9A || 0x1C409A || 0x2 || Unknown (e.g 02 02)
| 0 || 0 || 0x9A || 0x1C409A || 0x2 ||  
|-
| 0 || 0 || 0x9E || 0x1C409E || 0x2 || Unknown (e.g 00 00)
|-
| 0 || 0 || 0xA0 || 0x1C40A0 || 0x3 || Unknown (e.g 01 01 01)
|-
|-
| 0 || 0 || 0xAC || 0x1C40AC || 0x4 ||  
| 0 || 0 || 0xAC || 0x1C40AC || 0x4 ||  
|-
|-
| 0 || 0 || 0xC5 || 0x1C40C5 || 0x3 || Unknown (e.g AA AA AA)
| 0 || 0 || 0x7FE || 0x1C47FE || 0x2 ||  
|-
| 0 || 0 || 0x204 || 0x1C4204 || 0x1 || Unknown (e.g 00)
|-
| 0 || 0 || 0x20B || 0x1C420B || 0x1 || Unknown (e.g 00)
|-
| 0 || 0 || 0x210 || 0x1C4210 || 0x2 || Unknown (e.g 49 42)
|-
| 0 || 0 || 0x7FE || 0x1C47FE || 0x2 || Unknown (e.g AF 31)
|-
|-
| 0 || 0 || 0x801 || 0x1C4801 || 0x1 ||  
| 0 || 0 || 0x801 || 0x1C4801 || 0x1 ||  
Line 104: Line 67:
| 0 || 0 || 0xFFE || 0x1C4FFE || 0x2 ||  
| 0 || 0 || 0xFFE || 0x1C4FFE || 0x2 ||  
|-
|-
| 0 || 0 || 0x1000 || 0x1C5000 || 0x4 || soc wakeup source (Only one possible value 00 07 FF 07)
| 0 || 0 || 0x1000 || 0x1C5000 || 0x64 ||  
|-
| 0 || 0 || 0x1004 || 0x1C5004 || 0x4 || eap wakeup source (Only one possible value 00 07 FF 07)
|-
| 0 || 0 || 0x1008 || 0x1C5008 || 0x4 || soc wakeup source beep (Possible Values 00 03 0C 04) or (anything between 00 00 00 00 and FF 03 00 00)
|-
| 0 || 0 || 0x100C || 0x1C500C || 0x4 || eap wakeup source beep (Possible Values 00 00 00 04) or (anything between 00 00 00 00 and FF 03 00 00)
|-
| 0 || 0 || 0x1030 || 0x1C5030 || 0x4 || NumberOfBootShutdown
|-
| 0 || 0 || 0x1034 || 0x1C5034 || 0x4 || NumberOfBootShutdown as well
|-
| 0 || 0 || 0x1038 || 0x1C5038 || 0x8 || dbi_time
|-
| 0 || 0 || 0x1040 || 0x1C5040 || 0x4 || NumberOfBootShutdown as well
|-
| 0 || 0 || 0x1044 || 0x1C5044 || 0x4 || NumberOfBootShutdown as well
|-
| 0 || 0 || 0x1048 || 0x1C5048 || 0x8 || dbi_time as well
|-
| 0 || 0 || 0x1050 || 0x1C5050 || 0x4 || NumberOfBootShutdown as well
|-
| 0 || 0 || 0x1054 || 0x1C5054 || 0x4 || NumberOfBootShutdown as well
|-
| 0 || 0 || 0x1058 || 0x1C5058 || 0x8 || dbi_time as well
|-
|-
| 0 || 0 || 0x1220 || 0x1C5220 || 0x18 ||  
| 0 || 0 || 0x1220 || 0x1C5220 || 0x18 ||  
Line 192: Line 131:
| 0 || 0 || 0x2000 || 0x1C6000 || 0x8 ||  
| 0 || 0 || 0x2000 || 0x1C6000 || 0x8 ||  
|-
|-
| 0 || 1 || 0x0 || 0x1C7000 || 0x40 ||  
| 0 || 1 || 0x3000 || 0x1C7000 || 0x40 ||  
|-
| 0 || 1 || 0x18 || 0x1C7018 || 0x1  || Wlan5GHzInfo (00 Not Supported 0C Supported, some reach 8C Supported, max reach (ac?) )
|-
| 0 || 1 || 0x40 || 0x1C7040 || 0x10 || trsw_attach (e.g 1F FF 00 00 07 FF FF 07 FF FF 00 00 00 00 00 00)
|-
| 0 || 1 || 0xA0 || 0x1C70A0 || 0x2 || VrmOcp
|-
| 0 || 1 || 0xB0 || 0x1C70B0 || 0x1 || ????
|-
| 0 || 1 || 0xB1 || 0x1C70B1 || 0x1 || rtc info.corrMode
|-
| 0 || 1 || 0xB2 || 0x1C70B2 || 0x1 || rtc info.corrValue
|-
| 0 || 1 || 0xB3 || 0x1C70B3 || 0x1 || rtc info.corrValueExt
|-
| 0 || 1 || 0xC0 || 0x1C70C0 || 0x1 || ????
|-
| 0 || 2 || 0x0 || 0x1C8000 || 0xE || KibanID (e.g 33001D00836391)
|-
| 0 || 2 || 0x10 || 0x1C8010 || 0x10 || SOCUID (e.g DA 24 7A 4C FB AB D3 CA D0 95 53 7C 7B F1 45 A9)
|-
| 0 || 2 || 0x20 || 0x1C8020 || 0x10 || ViopData
|-
| 0 || 2 || 0x30 || 0x1C8030 || 0x11 || Used in FW 5.05. Unique identifier of console, hw_info (e.g 00TS4DB00K2180050)
|-
| 0 || 2 || 0x41 || 0x1C8041 || 0x1F || Used in later firmwares. Unique identifier of console, hw_model (e.g DUT-DBW00JK-S0ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ) aka Product Name
|-
| 0 || 2 || 0x60 || 0x1C8060 || 0x38 || Unknown
|-
| 0 || 2 || 0x98 || 0x1C8098 || 0x8 || Unknown (e.g A8 32 2A 40 67 9E 01 30)
|-
| 0 || 2 || 0xA0 || 0x1C80A0 || 0x8 || Unknown (e.g 07 4C 11 63 6E B6 72 03)
|-
| 0 || 2 || 0xA8 || 0x1C80A8 || 0x4 || Unknown (e.g 07 8F 31 51)
|-
| 0 || 2 || 0xAF || 0x1C80AF || 0x1 || Unknown (e.g C2)
|-
| 0 || 2 || 0xB0 || 0x1C80B0 || 0x8 || Unknown (e.g 01 01 01 01 06 06 06 06 FF FF)
|-
| 0 || 2 || 0xC0 || 0x1C80C0 || 0xD || (e.g 0000027452252) Product Code (first 5 zeroes are Product Code Branch Number)
|-
| 0 || 2 || 0x100 || 0x1C8100 || 0x20 || (e.g 00 02 F4 C1 64 E6 83 41 0C D0 8D 91 38 56 50 AE 15 3E 60 9E 70 16 17 1A 1C 18 26 25 1B 1B F5 F7)
|-
| 0 || 2 || 0x7D0 || 0x1C87D0 || 0x20 || Manufacturing Process Flags (01 enabled, 00 disabled) (e.g 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 00)
|-
| 0 || 2 || 0x7F0 || 0x1C87F0 || 0x2 ||  (e.g 01 FF) -> Disc Boot Time
|-
| 0 || 2 || 0x7FE || 0x1C87FE || 0x2 ||  (e.g FF FF) -> Disc Boot Time
|-
| 0 || 3 || 0x7B0 || 0x1C8FB0 || 0x1 || CS Config Mode
|-
| 0 || 4 || 0x0 || 0x1C9000 || 0x20 || DIP Switches (see below)
|-
|-
| 0 || 4 || 0x0  || 0x1C9000 || 0x1 || SCE_REGMGR_ENT_KEY_DEVENV_TOOL_boot_param (FE Development Mode) (FB Assist Mode) (FF Release Mode)
| 0 || 1 || 0x3040 || 0x1C7040 || 0x10 || trsw_attach
|-
|-
| 0 || 4 || 0x3 || 0x1C9003 || 0x1 || Memory Budget (0xFF Normal, 0xFE Large)
| 0 || 1 || 0x30A0 || 0x1C70A0 || 0x2 || get_icc_max
|-
|-
| 0 || 4 || 0x5 || 0x1C9005 || 0x1 || Slow HDD Mode (0xFE ON) (0xFF OFF)
| 0 || 2 || 0x4000 || 0x1C8000 || 0x4C || Serial Number + model Type (CUH-XXXXX), see below
|-
|-
| 0 || 4 || 0xB || 0x1C900B || 0x1 || Unknown (0x87 on prototype DevKit)
| 0 || 2 || 0x4010 || 0x1C8010 || 0x10 || SOCUID
|-
|-
| 0 || 4 || 0x10 || 0x1C9010 || 0x1 || vsh_4K Mode (0xFE ON) (0xFF OFF)
| 0 || 2 || 0x4030 || 0x1C8030 || 0x11 || Used in 5.05, Unique Identifier of Console, hw_info
|-
|-
| 0 || 4 || 0x1F || 0x1C901F || 0x1 || ??? (e.g 7F)
| 0 || 2 || 0x4041 || 0x1C8041 || 0x1F || Used in later firmwares, Unique Identifier of Console, hw_model
|-
|-
| 0 || 4 || 0x20 || 0x1C9020 || 0x1 || init_safe_mode flag (e.g F1)
| 0 || 2 || 0x4060 || 0x1C8060 || 0x58 ||  
|-
|-
| 0 || 4 || 0x21 || 0x1C9021 || 0x1 || sysctl_machdep_cavern_dvt1_init_update
| 0 || 2 || 0x40C0 || 0x1C80C0 || 0xD ||  
|-
|-
| 0 || 4 || 0x30 || 0x1C9030 || 0x1 || trsw_probe (01 for [ WLAN mode : FT ], else [ WLAN mode : OFF ]) also bt_sdio_probe and trs_probe
| 0 || 2 || 0x4100 || 0x1C8100 || 0x20 ||  
|-
|-
| 0 || 4 || 0x38 || 0x1C9038 || 0x1 || gigabit ethernet (gbe) related
| 0 || 2 || 0x47D0 || 0x1C87D0 || 0x10 || all zeroes usually
|-
|-
| 0 || 4 || 0x50 || 0x1C9050 || 0x1 || is_extra_clock_available_rtc_status
| 0 || 2 || 0x47F0 || 0x1C87F0 || 0x1 ||  
|-
|-
| 0 || 4 || 0x60 || 0x1C9060 || 0x4 || SMI SDK version (e.g 00 00 50 02 (2.50)) (minimal version)
| 0 || 4 || 0x5000 || 0x1C9000 || 0x20 || dipswitch flags, see below
|-
|-
| 0 || 4 || 0x64 || 0x1C9064 || 0x1 || ?????
| 0 || 4 || 0x5000  || 0x1C9000 || 0x1 || SCE_REGMGR_ENT_KEY_DEVENV_TOOL_boot_param (FE Development Mode) (FB Assist Mode) (FF Release Mode)
|-
|-
| 0 || 4 || 0x65 || 0x1C9065 || 0x1 || CsBackupMode
| 0 || 4 || 0x5003 || 0x1C9003 || 0x1 || Memory Budget (0xFF Normal, 0xFE Large)
|-
|-
| 0 || 4 || 0x67 || 0x1C9067 || 0x1 || ?????
| 0 || 4 || 0x5005 || 0x1C9005 || 0x1 || Slow HDD Mode (0xFE ON) (0xFF OFF)
|-
|-
| 0 || 4 || 0x68 || 0x1C9068 || 0x4 || Current SDK version 2 (e.g 00 00 05 05 (5.05))
| 0 || 4 || 0x500B || 0x1C900B || 0x1 || Unknown (0x87 on proto devkit)
|-
|-
| 0 || 4 || 0x70 || 0x1C9070 || 0x4 || manu_mode related (sdk version?)
| 0 || 4 || 0x5010 || 0x1C9010 || 0x1 || vsh_4K Mode (0xFE ON) (0xFF OFF)
|-
|-
| 0 || 4 || 0x74 || 0x1C9074 || 0x4 || Unknown (e.g. 84 72 4E 57)
| 0 || 4 || 0x5020 || 0x1C9020 || 0x1 || init_safe_mode flag
|-
|-
| 0 || 4 || 0x7C || 0x1C907C || 0x4 || manu_mode related (sdk version?)
| 0 || 4 || 0x5021 || 0x1C9021 || 0x1 || sysctl_machdep_cavern_dvt1_init_update
|-
|-
| 0 || 4 || 0x80 || 0x1C9080 || varies (0x68-0x6C) || acf token <- checked by sceSblDevActVerifyCheckExpire
| 0 || 4 || 0x5030 || 0x1C9030 || 0x1 || trsw_probe (01 for [ WLAN mode : FT ], else [ WLAN mode : OFF ]) also bt_sdio_probe and trs_probe
|-
|-
| 0 || 4 || 0x100 || 0x1C9100 || 0xF0 || sce_cam_error_put
| 0 || 4 || 0x5038 || 0x1C9038 || 0x1 || ethernet related (gbe)
|-
|-
| 0 || 4 || 0x200 || 0x1C9200 || varies (0x40-0x60) || scrambled/obfuscated eap hdd key <- checked by g_crypt_deferred_init, also checked by read_idstorage
| 0 || 4 || 0x5050 || 0x1C9050 || 0x1 || is_extra_clock_available_rtc_status
|-
|-
| 0 || 4 || 0x300 || 0x1C9300 || 0x30 || sam/liverpool flags (see below)
| 0 || 4 || 0x5064 || 0x1C9064 || 0x4 || sdk version?
|-
|-
| 0 || 4 || 0x301 || 0x1C9301 || 1 || unknown (01 = enabled) (only available for prototype)
| 0 || 4 || 0x5070 || 0x1C9070 || 0x4 || manu_mode related (sdk version?)
|-
|-
| 0 || 4 || 0x310 || 0x1C9310 || 1 || sam_memtest (01 = enabled)
| 0 || 4 || 0x5074 || 0x1C9074 || 0x4 || Unknown (e.g. 84 72 4E 57)
|-
|-
| 0 || 4 || 0x311 || 0x1C9311 || 1 || unknown (01 = enabled) (only available for prototype)
| 0 || 4 || 0x507C || 0x1C907C || 0x4 || manu_mode related (sdk version?)
|-
|-
| 0 || 4 || 0x312 || 0x1C9312 || 1 || sam_rngtest (01 = enabled)
| 0 || 4 || 0x5080 || 0x1C9080 || varies (0x68-0x6C) || acf token <- checked by sceSblDevActVerifyCheckExpire
|-
|-
| 0 || 4 || 0x31F || 0x1C931F || 1 || extra UART. 0xFF - extra UART disabled, 0x00 - extra UART enabled when ???, 0x01 - extra UART enabled
| 0 || 4 || 0x5100 || 0x1C9100 || 0x100 || sce_cam_error_put
|-
|-
| 0 || 4 || 0x320 || 0x1C9320 || 1 || lvp_configure_get_gddr5clk (0x14 = 500Mhz) (whatever value here is multiplied by 0x19 to get final value) (0xED max value, 5925Mhz) (500Mhz will semi-brick the console with DCT errors, however for some stupid reason BwE's lets user pick ranges from 400 to 2250MHz)
| 0 || 4 || 0x5200 || 0x1C9200 || varies (0x40-0x60) || scrambled/obfuscated eap hdd key <- checked by g_crypt_deferred_init, also checked by read_idstorage
|-
|-
| 0 || 4 || 0x322 || 0x1C9322 || 1 || lvp_configure_tccds
| 0 || 4 || 0x5301 || 0x1C9301 || 1 || unknown (01 = enabled)
|-
|-
| 0 || 4 || 0x323 || 0x1C9323 || 1 || sam_boot_flags (anything other than FF for enabled)
| 0 || 4 || 0x5311 || 0x1C9311 || 1 || unknown (01 = enabled)
|-
|-
| 0 || 4 || 0x329 || 0x1C9329 || 1 || related to lvp_config (likely gddr5DebugFlag, 1->Read DBI disabled, 2->Write DBI disabled, 4->ABI disabled, 8->Force auto precharge enabled, 0x10 -> Bank swap disabled, 0x20-> Bank swizzle mode disabled, 0x3F -> Everything set)
| 0 || 4 || 0x531F || 0x1C931F || 1 || UART boot param? (setting this to 1 enables UART output on boot)
|-
|-
| 0 || 4 || 0x3B0 || 0x1C93B0 || 1 || ????
| 0 || 4 || 0x5320 || 0x1C9320 || 1 || lvp_configure_get_gddr5clk
|-
|-
| 0 || 4 || 0x400 || 0x1C9400 || 0x800 || dev/qaf/utkn region (see below)
| 0 || 4 || 0x5322 || 0x1C9322 || 1 || lvp_configure_tccds
|-
|-
| 0 || 4 || 0x400 || 0x1C9400 || 0x210 || token???
| 0 || 4 || 0x5329 || 0x1C9329 || 1 || related to lvp_config
|-
|-
| 0 || 4 || 0x150 || 0x1C9650 || 0x290 || qafutkn_ioctl?
| 0 || 4 || 0x5400 || 0x1C9400 || 0x210 || token ???
|-
|-
| 0 || 4 || 0x900 || 0x1C9900 || 0x100 || acf RSA signature
| 0 || 4 || 0x5650 || 0x1C9650 || 0x290 || qafutkn_ioctl
|-
|-
| 0 || 4 || 0xA00 || 0x1C9A00 || 0x190 || token???
| 0 || 4 || 0x5900 || 0x1C9900 || 0x100 || acf signature
|-
|-
| 0 || 4 || 0xC00 || 0x1C9C00 || 0x3C || HDD Info (byte swapped ASCII) (e.g "GHTSH ST4501019A6E08                    613081DJ0124FZD129SN" for an HGST HDD)
| 0 || 4 || 0x5A00 || 0x1C9A00 || 0x190 || token ???
|-
|-
| 0 || 4 || 0xC3C || 0x1C9C3C || 0x04 || Unknown (e.g 05 C6 0A 00)
| 0 || 4 || 0x5C00 || 0x1C9C00 || 0x3C || HDD Info (e.g GHTSH ST4501019A6E08                    613081DJ0124FZD129SN)
|-
|-
| 0 || 4 || 0xC40 || 0x1C9C40 || 0x130 || setPupExpirationStatus
| 0 || 4 || 0x5C3C || 0x1C9C3C || 0x04 || Unknown (e.g 05 C6 0A 00)
|-
|-
| 0 || 4 || 0x1000 || 0x1CA000 || 0x300 || Registry Manager NVS area 1
| 0 || 4 || 0x5C40 || 0x1C9C40 || 0x130 || setPupExpirationStatus
|-
|-
| 0 || 4 || 0x100E || 0x1CA00E || 0x1 || Unknown (Not Regions)
| 0 || 4 || 0x6000 || 0x1CA000 || 0x300 || wrappNvsRead, or regMgrNvsRead
|-
|-
| 0 || 4 || 0x1040 || 0x1CA040 || 0x1 || Circle Button Behaviour (0x01 for Circle as Go Back) (0x00 for Circle as Accept)
| 0 || 4 || 0x600E || 0x1CA00E || 0x1 || Unknown (Not Regions)
|-
|-
| 0 || 4 || 0x1300 || 0x1CA300 || 0x300 || Registry Manager NVS area 2
| 0 || 4 || 0x6040 || 0x1CA040 || 0x1 || Circle Button Behaviour (0x01 is Circle Go Back) (0x00 is Circle Accept)
|-
|-
| 0 || 4 || 0x1600 || 0x1CA600 || 0x20 || Registry Manager Entitlement Key NVS area (see below)
| 0 || 4 || 0x6300 || 0x1CA300 || 0x300 || wrappNvsRead, or regMgrNvsRead
|-
|-
| 0 || 4 || 0x1600 || 0x1CA600 || 0x1 || SCE_REGMGR_ENT_KEY_SYSTEM_SPECIFIC_idu_mode (0x01 enabled, 0x00 or 0xFF disabled)
| 0 || 4 || 0x6600 || 0x1CA600 || 0x20 || Modes (See Below)
|-
|-
| 0 || 4 || 0x1601 || 0x1CA601 || 0X1 || SCE_REGMGR_ENT_KEY_SYSTEM_update_mode (0xFF or 0x00 disabled) (0x10, 0x20, 0x30, 0x31, 0x32, 0x50 enabled)
| 0 || 4 || 0x6600 || 0x1CA600 || 0x1 || SCE_REGMGR_ENT_KEY_SYSTEM_SPECIFIC_idu_mode (0x01 Enabled 0x00 or 0xFF Disabled)
|-
|-
| 0 || 4 || 0x1602 || 0x1CA602 || 0x1 || SCE_REGMGR_ENT_KEY_SYSTEM_SPECIFIC_show_mode (0x01 Enabled, 0x00 Disabled) (TestKit only)
| 0 || 4 || 0x6601 || 0x1CA601 || 0X1 || SCE_REGMGR_ENT_KEY_SYSTEM_update_mode (0xFF or 0x00 disabled) (0x10, 0x20, 0x30, 0x31, 0x32, 0x50 enabled)
|-
|-
| 0 || 4 || 0x1603 || 0x1CA603 || 0x1 || SCE_REGMGR_ENT_KEY_REGISTRY_recover
| 0 || 4 || 0x6602 || 0x1CA602 || 0x1 || SCE_REGMGR_ENT_KEY_SYSTEM_SPECIFIC_show_mode (0x01 Enabled 0x00 Disabled) (Testkit Only!)
|-
|-
| 0 || 4 || 0x1604 || 0x1CA604 || 0x4 || SCE_REGMGR_ENT_KEY_SYSTEM_soft_version (deprecated) (DevKit only?)
| 0 || 4 || 0x6603 || 0x1CA603 || 0x1 || SCE_REGMGR_ENT_KEY_REGISTRY_recover
|-
|-
| 0 || 4 || 0x1609 || 0x1CA609 || 0x1 || SCE_REGMGR_ENT_KEY_SYSTEM_SPECIFIC_arcade_mode
| 0 || 4 || 0x6604 || 0x1CA604 || 0x4 || SCE_REGMGR_ENT_KEY_SYSTEM_soft_version (deprecated) (devkit only?)
|-
|-
| 0 || 4 || 0x2C00 || 0x1CBC00 || 0x20 || manufacturing mode (all zeroes for enabled, all FFs for disabled)
| 0 || 4 || 0x6609 || 0x1CA609 || 0x1 || SCE_REGMGR_ENT_KEY_SYSTEM_SPECIFIC_arcade_mode
|-
|-
| 0 || 4 || 0x2C40 || 0x1CBC40 || 0x20 ||  
| 0 || 4 || 0x7C00 || 0x1CBC00 || 0x20 || manu mode (all zeroes for enabled, all ffs for disabled)
|-
|-
| 0 || 4 || 0x2CC0 || 0x1CBCC0 || 0x20 || srtc_modevent
| 0 || 4 || 0x7C40 || 0x1CBC40 || 0x20 ||  
|-
|-
| 1 || 0 || 0x0 || 0x1CC000 || 0x1000 || Equivalent (active/inactive bank) of NVS region 0x5000-0x5FFF. First 0x1000 bytes are usually a 1:1 copy.
| 0 || 4 || 0x7CC0 || 0x1CBCC0 || 0x20 || srtc_modevent
|-
|-
| 1 || 0 || 0x1000 || 0x1CD000 || 0x1000 || Equivalent (active/inactive bank) of NVS area 0x6000-0x6FFF
| ? || ? || ??? || 0x1CC31F || 1 || unknown (01 = enabled)
|-
|-
| 1 || 0 || 0x1000 || 0x1CE000 || 0x1000 || Unknown
| ? || ? || ??? || 0x1CF000 || 1 || ?? FF disabled 00 enabled
|-
|-
| ? || ? || ??? || 0x1CF000 || 1 || ?? FF disabled, 00 enabled
|}
|}
Please note that all contributions to PS4 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS4 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)
Retrieved from "http://www.psdevwiki.com/ps4/Non_Volatile_Storage"