Talk:Baryon

Manuals

• https://www.sendspace.com/filegroup/l%2Fg5mQJapWFij2H9ON2v3g
• https://www.sendspace.com/file/vssra7 (Page 17)
• https://www.sendspace.com/file/2euka5 (Page 49)

Attack Manuals

• https://www.sendspace.com/file/7gue6e (Pages 100, 104, 105)
• https://github.com/janvdherrewegen/bootl-attacks

Table

Production Start Date (<=)	PS2 Mechacon	PSP Syscon	PS3 Syscon	PSVita Syscon	PS4 Syscon	Used IC/CPU Core
08/2004 First	-	BARxx	-	-	-	NEC D790019 / D780032AY (78K0/78003xA, 64 pin)
07/2005 Legolas1/Legolas2	-	B30x	-	-	-	NEC D79F0036 / D78F0531 (78K0/KE2, 64 pin)
07/2007 Frodo	-	B40x	-	-	-	NEC D79F???? / D78F0544 (78K0/KF2, 84 pin)
07/2008 Samwise	-	3Axx	-	-	-	NEC D79F???? / D78F0534 (78K0/KE2, 64 pin)
03/2009 Samwise VA2	-	3Bxx	-	-	-	NEC D79F???? / D78F0534 (78K0/KE2, 64 pin)
05/2009 Strider	-	40xx	-	-	-	NEC D79F???? / D78F0544 (78K0/KF2, 84 pin)

Notes

• Codename BAR/B30/3A/3B is associated with 64 pin COTS BGA
• Likewise, B40/40 is associated with 84 pin Custom BGA

Bootrom List of Commands

External (0x8522-0x854B):
00 0x80F3 Reset
20 0x93FF Chip Erase
22 0x942F Block Erase
13 0x9379 Verify
32 0x9609 Block Blank Check
40 0x969F Programming
90 0x9994 Oscillating Frequency Set
9E 0x99ED ??
C0 0x9B08 Silicon Signature
C5 0x9B71 Version Get
70 0x9A5B Status
B0 0x9A79 Checksum
A0 0x9C04 Security Set
A4 0x9B97 EA Read?

Internal (0x9FC9 - 0x9FE6):
17 0x8218 EEPROMWrite
0F 0x84B3 ??
0E 0x84A8 CheckFLMD
0A 0x8475 FlashSetInfo
09 0x8399 FlashGetInfo
08 0x835D FlashBlockBlankCheck
06 0x8321 FlashBlockVerify
04 0x8252 FlashWordWrite
03 0x81DD FlashBlockErase
00 0x81BD FlashEnv