Iso module

From PS3 Developer wiki
Jump to: navigation, search


Isolated modules are used for de-/encryption, rehashing etc.

Commonly found in CoreOS, dev_flash, embedded sony selfs and service packages like Remarry Bluray Drive.

They are SPU .self binaries which can be called whenever needed: e.g. decrypting and hashcheck EID0 for Target ID inside IDPS when called upon by lv1 (HyperVisor) to set up restrictions for Retail/CEX or Debug/DEX etc.

Note: This page lists all isolated modules, except bootldr, metldr and other loaders from CoreOS, see also Boot Order

Known isolated modules[edit]

Module Usage Location Remarks
AacsModule.spu.isoself EID3 and theoretically OCRL /dev_flash/bdplayer
aim_spu_module.self EID0 (section 0x00 and 0x0A) CoreOS
CprmModule.spu.isoself EID3 /dev_flash/bdplayer
CssModule.spu.isoself /dev_flash/bdplayer
fdm_spu_module EID2, Remarry Bluray Drive 2.43 JIG PUP
manu_info_spu_module.self CoreOS (since FW 3.50)
mc_iso_spu_module.self PS2 CoreOS
me_iso_for_ps2emu.self PS2 CoreOS (since FW 3.70)
me_iso_spu_module.self PS2 CoreOS
SacModule.spu.isoself EID3, SuperAudioCD /dev_flash/vsh/module
sb_iso_spu_module.self South Bridge CoreOS
sc_iso.self syscon CoreOS
sc_iso_factory.self syscon 2.43 JIG PUP
spu_handler.isoself PSP Savegames self inside /dev_flash/sys/internal/libchnnlsv.sprx
spu_handler.isoself PSP self inside /dev_flash/pspemu/release/emulator_drm.sprx mself (since FW 3.15)
spu_mode_auth.self 2.43 JIG PUP
spu_pkg_rvk_verifier.self CoreOS
spu_token_processor.self systemtokens, QA Flagging CoreOS
spu_utoken_processor.self usertokens CoreOS (since FW 2.40)
ss_sc_init.self syscon 2.43 JIG PUP
sv_iso_for_ps2emu.self PS2 CoreOS (since FW 3.70)
sv_iso_spu_module.self EID4, PS2, bluray CoreOS


sc_iso.self is used by the system to handle communications to/from syscon. Once debug printing is enabled after you load it, you can see some of the internal workings including error codes for when you are trying to use the module on your own.

Communicating w/ sc_iso.self[edit]

Look in the hv bible for more detailed info, but the gist is this:

1) Send the mbmsg start packet {1, 1, [sc_iso_cmd], [sc_iso_cmd_size]}. This is in response to the 0x80 mbox int.
2) On 0x81 mbox int, receive the packet (same location you sent it from), do stuff, then write back new packets and then spu_in_mbox_write(problem, seqno++)

Error Value Meaning
0x80010283 Bad hdr->seqno (in dma_get)
0x80010284 Bad hdr->mbmsg (in dma_get)
0x80010285 is_align_ok fail (in dma_get)
0x81010101 sc_iso command failed
0x81010106 Bad input command value
0x81010607 Bad parameter for Get SRH (0x4)
0x81010801 Init for VTRM (0x6) write mngblk failed
0x81010807 Bad parameters for Init for VTRM (0x6)
0x81010907 Bad parameters for get_region_data (0x7)
0x81010A07 Bad parameters for set_region_data (0x8)
0x81010B01 Read mngblk failed for Init For Updater (0xE)
0x81010B07 Bad parameter for Init For Updater (0xE)
0x81011E07 Bad parameter for encrypt (0x1) / decrypt (0x2)