Editing Talk:Non Volatile Storage

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
= Platform ID Samples =
some findings i have found you can delete if want :)
 
kernel 1.76
<pre>
Non Volatile Storage
01:01:01:01:01:01:01:01 -> Syrup Board
--------------------
02:01:01:01:03:01:0B:01 -> CVN-K04 Board
03:02:01:01:02:01:06:01 -> DUH-T1000AA SAA-001 Board, CUH-1003A B01 SAA-001 Board
03:02:02:01:01:01:05:01 -> CUH-1116A B01 SAB-001 Board
03:02:03:01:01:01:03:02 -> CAP-CH00XK-M0 SAC-001 Board
03:02:04:01:??:??:??:?? -> SAD-001 Board
03:02:05:01:01:01:05:01 -> CUH-21xx
03:02:05:01:01:07:05:01 -> CUH-2116A B01 SAE-00X Board
03:02:06:01:01:07:05:01 -> SAF-003 Board
04:01:01:01:01:01:04:01 -> DUT-DBW00JK-S0 HAC-001 Board
04:01:01:01:01:01:05:01 -> DUH-D7000JA HAC-001 Board
05:02:01:01:01:01:05:01 -> DUH-T7000AA NVX-00X Board
</pre>
 
* Remark: every byte value starts at 0x01 not 0x00.
 
Let decompose Platform ID as aa:bb:cc:dd:ee:ff:gg:hh.
* aa = type: 01: Syrup prototype, 02: Cavern prototype, 03: standard PS4, 04: PS4 PRO HAC prototype, 05: PS4 PRO NVX prototype
* bb = unknown
* cc = equivalent of product sub code: 01: SAA, 02: SAB, ... 06: SAF
* dd = unknown: always 01
* ee = unknown: 01, 02 or 03
* ff = unknown: 01 or 07
* gg = ?color?: 01, 03, 04, 05, 06, 0B
* hh = unknown: 01 or 02
 
= Findings from Kernel by Z80 =
 
From kernel of PS4 System Software version 1.76.
 
<source lang="C">
sceSblDevActVerifyCheckExpire:
sceSblDevActVerifyCheckExpire:
icc_nvs_read(0LL, 4uLL, 0x80LL, 0x68uLL, &data_ptr);
icc_nvs_read(0LL, 4uLL, 0x80LL, 0x68uLL, &data_ptr);
Line 85: Line 55:
sub_FFFFFFFF827D8E30:???
sub_FFFFFFFF827D8E30:???
icc_nvs_write(0LL, 4uLL, 0LL, 0x20uLL, &dipsw_FFFFFFFF836C0090);
icc_nvs_write(0LL, 4uLL, 0LL, 0x20uLL, &dipsw_FFFFFFFF836C0090);
</source>
From kernel of PS4 System Software version 1.00 Tool (DevKit).
<source lang="C">
sce_cam_error_put:
icc_nvs_read(0, 4u, 0x100, 0x100u, (__int64)v31);
icc_nvs_write(0LL, 4LL, 0x1FCLL, 4LL, &v29);
v18 = sce_device_error_log;
icc_nvs_write(0LL, 4LL, (unsigned __int16)(0x28 * (v18 % 6) + 0x100), 0x28LL, v32);
get_init_safe_mode:
icc_nvs_read(0, 4u, 0x20, 1u, (__int64)&v5) )
start_init:
if ( (unsigned int)icc_nvs_read(0, 4u, 0x20, 1u, (__int64)&v51) )
LABEL_43:
      panic((unsigned int)"failed to retrieve init_safe_mode", 4, v0, v1, v2, v3);
if ( (unsigned int)icc_nvs_read(0, 4u, 0x20, 1u, (__int64)&v51) )
        goto LABEL_43;
      if ( v51 == 0xFF )
        printf((unsigned int)"Falling back to orbis_diag...\n", 4, v0, v1, v2, v3);
      else
        printf((unsigned int)"%s is not found. trying next...\n", v52[0], v0, v1, v2, v3);
      goto LABEL_36;
sysctl_kern_init_safe_mode:
if ( (unsigned int)icc_nvs_read(0, 4u, 0x20, 1u, (__int64)&v13) )
    panic((unsigned int)"failed to retrieve init_safe_mode", 4, v5, v6, v7, v8);
sysctl_manumode:
result = icc_nvs_read(0, 4u, 0x2C00, 0x20u, (__int64)v8);
  if ( !(_DWORD)result )
  {
    if ( !(unsigned int)memcmp(v8, &sysctl_manumode_manu_mode_0xff, 0x20LL) )
result = icc_nvs_write(1LL, 4LL, 0x2C00LL, 0x20LL, &sysctl_manumode_manu_mode_0x00);
          if ( !(_DWORD)result )
          {
            bzero(v8, 32LL);
            result = icc_nvs_read(0, 4u, 0x2C00, 0x20u, (__int64)v8);
            if ( !(_DWORD)result )
              return 5 * (unsigned int)((unsigned int)memcmp(v8, &sysctl_manumode_manu_mode_0x00, 0x20LL) != 0);
lvp_configure_tccds:
if ( (unsigned int)(a1 - 2) < 4 || !a1 || (result = 0x16LL, a1 == 0xFF) )
  {
    v2 = icc_nvs_read(0, 4u, 0x322, 1u, (__int64)&v3);
    result = 5LL;
    if ( !v2 )
    {
      result = 0LL;
      if ( v3 != (_BYTE)a1 )
        return 5 * (unsigned int)((unsigned int)icc_nvs_write(0LL, 4LL, 0x322LL, 1LL, &v4) != 0);
</source>


= About EAP Hdd Key =
= About EAP Hdd Key =
Line 155: Line 63:
* unk_FFFFFFFF836BC010 (0x70) <- decrypted eap_hdd_key ?
* unk_FFFFFFFF836BC010 (0x70) <- decrypted eap_hdd_key ?


<source lang="C">
you have right
   v7 = icc_nvs_read(0LL, 4uLL, 0x200LL, v2, &enc_eap_key_);
   v7 = icc_nvs_read(0LL, 4uLL, 0x200LL, v2, &enc_eap_key_);
   if ( v7 ) {
   if ( v7 )
  {
     v12 = v7;
     v12 = v7;
     printf("icc_nvs_read failed: %d\n", v7, v8, v9, v10, v11, v19);
     printf("icc_nvs_read failed: %d\n", v7, v8, v9, v10, v11, v19);
Line 165: Line 74:
   v12 = &eap_key_;
   v12 = &eap_key_;
   if ( sceSblGetEAPInternalPartitionKey(&enc_eap_key_, &eap_key_) )
   if ( sceSblGetEAPInternalPartitionKey(&enc_eap_key_, &eap_key_) )
</source>
 
= bank 2 =
bank2 isnt probably backup bank its accessed by sub_FFFFFFFF827D2F50:qafutkn ??? icc_nvs_read(1LL, 4uLL, 0x0a00LL, 0x190uLL, &data_ptr);
 
whole nvs storage is accesible via /dev/sflash0s0x34 and size is 49152bytes probably


= From EMC =
= From EMC =
Please note that all contributions to PS4 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS4 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)
Retrieved from "http://www.psdevwiki.com/ps4/Talk:Non_Volatile_Storage"