Spock: Difference between revisions
Jump to navigation
Jump to search
| (11 intermediate revisions by the same user not shown) | |||
| Line 5: | Line 5: | ||
You can more or less access Spock through Lepton's ram (there is some hidden test mode on Lepton allowing you to do this). Mathieulh will tell more on this later if he ever get the time to clean up those sources. | You can more or less access Spock through Lepton's ram (there is some hidden test mode on Lepton allowing you to do this). Mathieulh will tell more on this later if he ever get the time to clean up those sources. | ||
= Structure = | = Mapping Structure (PSP) = | ||
<pre> | <pre> | ||
0xBDF00010 = CMD Number | 0xBDF00000 = Spock Signature | ||
0xBDF00004 = Spock Version | |||
0xBDF00008 = Spock Error | |||
0xBDF0000C = Spock Proc Phase | |||
0xBDF00010 = Spock CMD Number | |||
0xBDF00014 = Spock Result | |||
0xBDF00018 = Unknown? | |||
0xBDF0001C = Spock Status | |||
0xBDF00020 = Spock Status Asynchronous | |||
0xBDF00024 = Spock Status Asynchronous End | |||
0xBDF00028 = Spock Status End | |||
0xBDF0002C = Spock Source Address | |||
0xBDF00030 = Spock Destination Address | |||
sceUmdMan_driver_1b1bf9fd = sceUmdExecRead10Cmd | |||
sceUmdMan_driver_1b1bf9fd = sceUmdExecRead10Cmd (0xA) | |||
sceUmdMan_driver_e3716915 = sceUmdExecRead10Cmd (0xA) | |||
sceUmdMan_driver_f819e17c = sceUmdExecReadMKICmd (0x8) | |||
sceUmdMan_driver_6d17fd57 = sceUmdExecReadMKICmd (0x8) | |||
</pre> | </pre> | ||
| Line 28: | Line 44: | ||
0x0A: Decrypt UMD Disc Sector | 0x0A: Decrypt UMD Disc Sector | ||
0x0B: Reset SPOCK | 0x0B: Reset SPOCK | ||
0x0C: | 0x0C: Decrypt UMD Disc Sector Debug | ||
</pre> | </pre> | ||
| Line 62: | Line 78: | ||
== Command 11 (0xB) (Reset Spock) == | == Command 11 (0xB) (Reset Spock) == | ||
== Command 12 (0xC) ( | == Command 12 (0xC) (Decrypt UMD Disc Sector Debug) == | ||
* Seems to exist only on KICHO DENCHO PSP firmware and devkit firmware, inside UMDMAN.prx | * Seems to exist only on KICHO DENCHO PSP firmware and devkit firmware, inside UMDMAN.prx | ||
Latest revision as of 03:19, 10 May 2024
Spock is the PSP hardware cryptography engine responsible for the raw sector level decryption of UMD’s. Named after Captain Spock of Star Trek. Mapped to 0xBDF00000.
Executing commands[edit | edit source]
You can more or less access Spock through Lepton's ram (there is some hidden test mode on Lepton allowing you to do this). Mathieulh will tell more on this later if he ever get the time to clean up those sources.
Mapping Structure (PSP)[edit | edit source]
0xBDF00000 = Spock Signature 0xBDF00004 = Spock Version 0xBDF00008 = Spock Error 0xBDF0000C = Spock Proc Phase 0xBDF00010 = Spock CMD Number 0xBDF00014 = Spock Result 0xBDF00018 = Unknown? 0xBDF0001C = Spock Status 0xBDF00020 = Spock Status Asynchronous 0xBDF00024 = Spock Status Asynchronous End 0xBDF00028 = Spock Status End 0xBDF0002C = Spock Source Address 0xBDF00030 = Spock Destination Address sceUmdMan_driver_1b1bf9fd = sceUmdExecRead10Cmd (0xA) sceUmdMan_driver_e3716915 = sceUmdExecRead10Cmd (0xA) sceUmdMan_driver_f819e17c = sceUmdExecReadMKICmd (0x8) sceUmdMan_driver_6d17fd57 = sceUmdExecReadMKICmd (0x8)
Commands[edit | edit source]
SPOCK Operations: 0x01: Init1 0x02: Init2 0x03: Step1 0x04: Step2 0x05: Step3 0x06: 0x07: 0x08: Decrypt UMD master key 0x09: Decrypt IDStorage UMD leaves 0x0A: Decrypt UMD Disc Sector 0x0B: Reset SPOCK 0x0C: Decrypt UMD Disc Sector Debug
Command 1 (Init 1)[edit | edit source]
Command 2 (Init 2)[edit | edit source]
Command 3 (Step 1)[edit | edit source]
Command 4 (Step 2)[edit | edit source]
Command 5 (Step 3)[edit | edit source]
Command 6[edit | edit source]
Command 7[edit | edit source]
Command 8 (Decrypt UMD master key)[edit | edit source]
Command 9 (Decrypt IDStorage UMD leaves)[edit | edit source]
Spock command 9 key is used to decrypt UMD leaves stored in IDStorage. Those leaves are then used in Spock command 8 to decrypt the UMD master key (per disc key). Then this key is used in Spock command 10 to decrypt the UMD raw sectors. Each different PSP region seems to have its own set of UMD keys.
9F46F9FCFAB2AD0569F688D8794B92BA
more info on Spock by mathieulh
Command 10 (0xA) (Decrypt UMD raw sectors)[edit | edit source]
Command 11 (0xB) (Reset Spock)[edit | edit source]
Command 12 (0xC) (Decrypt UMD Disc Sector Debug)[edit | edit source]
- Seems to exist only on KICHO DENCHO PSP firmware and devkit firmware, inside UMDMAN.prx
Where are spock commands used[edit | edit source]
- Commands 8 and 0xA are used on psp retail firmware, as well as testkit firmware
- Commands 1, 2, 3, 4, 5, 8, 9, 0xA and 0xB are used on AV test tool firmware
- Commands 1, 2, 3, 4, 5, 8, 9, 0xA, 0xB and 0xC are used on Kicho Dencho firmware, which is a special factory firmware.
- Commands 1, 2, 3, 4, 5, 8, 9, 0xA, 0xB and 0xC are used on devkit firmware as well.
- Usage of these commands can always be found in UMDMAN.prx