Appliance Information Manager: Difference between revisions
Jump to navigation
Jump to search
mNo edit summary |
mNo edit summary |
||
Line 18: | Line 18: | ||
! Packet ID | ! Packet ID | ||
! Description | ! Description | ||
! Parameters | |||
|- | |- | ||
| 0x19002 | | 0x19002 | ||
| Get Device Type | | Get Device Type | ||
| | |||
|- | |- | ||
| 0x19003 | | 0x19003 | ||
| Get Device ID | | Get Device ID | ||
| uint8_t out[0x10] | |||
|- | |- | ||
| 0x19004 | | 0x19004 | ||
| Get PS Code | | Get PS Code | ||
| | |||
|- | |- | ||
| 0x19005 | | 0x19005 | ||
| Get Open PS ID | | Get Open PS ID | ||
| uint8_t out[0x10] | |||
|- | |- | ||
| 0x19006 | | 0x19006 | ||
| Unknown | | Unknown | ||
| None extra | |||
|} | |} | ||
Revision as of 15:12, 12 July 2014
AIM Manager (App(liance?) Info Manager) is a Process socket service supported by the hypervisor (lv1).
It is used to retrieve the device type, device id, open psid and the pscode from the EID0 data that is passed in.
Responsible is the isolated SPU module aim_spu_module.self from CoreOS / Flash.
This service accessable from GameOS via Syscall: 867 (0x363)
and requires 0x40 Root Control Flags in SCE Header.
internally loaded@ Function Id : 0x19000 Port: 0x24
0x19000 - AIM
Packet ID | Description | Parameters |
---|---|---|
0x19002 | Get Device Type | |
0x19003 | Get Device ID | uint8_t out[0x10] |
0x19004 | Get PS Code | |
0x19005 | Get Open PS ID | uint8_t out[0x10] |
0x19006 | Unknown | None extra |
0x19002 - Get Device Type
- returns your consoles Target Id value:
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x85
Code Sample
calling from GameOS: int cellSsAimGetDeviceType(out:uint8[0x10])
0x19003 - Get Device ID
- returns your consoles IDPS
0x00 0x00 0x00 0x01 0x00 0x89 0x00 0x0B 0x14 0x00 0xEF 0xDD 0xCA 0x25 0x52 0x66 .....‰....ïÝÊ%Rf
Code Sample
calling from GameOS: int cellSsAimGetDeviceId(out:uint8[0x10])
0x19004 - Get PS Code
on my CECHJ04 it returns:
0x00 0x01 0x00 0x85 0x00 0x07 0x00 0x04
Code Sample
calling from GameOS: int cellSsAimGetPsCode(out:uint8[8])
0x19005 - Get Open PS ID
Code Sample
calling from GameOS: int cellSsAimGetOpenPsId(out:uint8[0x10])
0x19006 -
- usage found in bdp_BDVD for example...with 1 param (=0)
- seems to be handled by lv2_kernel, not aim itself.
- looks up for qa-flag (if flagged, sets token seed to an lv2 internal buffer), fself flag & device_id
calling from GameOS: int syscall(867,0x19006) note: this packet id doesnt need another parameter
Reverse Engineering in Lv1
Function Id : 0x19000 Port: 0x24 Process: 5
If you want to check out about it or get more things documented
consider looking at for example:
- coolstuff\hvdump315_reversing\proc_5\code_seg.idb
- coolstuff\hvdump341_reversing\proc_5\code_seg.idb
- coolstuff\hvdump355_reversing\proc_5\code_seg.idb
Reverse Engineering isolated module
a crossreference to SPU_Isolated_Modules_Reverse_Engineering#aim_spu_module
Debug messages
Address | Message | |
---|---|---|
? 3.41 ? | 355 CEX | |
0x36f0 | 0x3570 | "(spu)start aim spu module!\n" |
0x3710 | 0x3590 | "(spu) PU DMA area start address is not align 16byte\n" |
0x3750 | 0x35d0 | "(spu) PU EID area start address is not align 16byte\n" |
0x3790 | 0x3610 | "(spu) PU DMA area size is not equall to AIM_DMA_SIZE\n" |
This messages are DMAed to the ppu if a debug output address is specified.
Data
Address | Message | |
---|---|---|
? 3.41 ? | 355 CEX | |
0x37e0 | - | Reference tool fallback IDPS |
0x37f0 - ... | 0x3650 - ... | Start of AIM keys Keys#aim_keys |
0x3ac0 | 0x3870 | AES sbox (16*16 bytes) |
0x3c70 | 0x3a20 | AES inverse sbox (16*16 bytes) |
Functions
Address | Name | Parameters | Info | |
---|---|---|---|---|
3.41 CEX/DEX | 355 CEX | |||
0x9e0 | stop_func | unknown | Stops the module execution with various stop codes. | |
0xa18 | main_func | unknown | Main routine. | |
0xf18 | response | unknown | Sends response to ppu over DMA. | |
0x1158 | process_eid | unknown | Decrypts EID0. | |
0x1438 | prepare_print | unknown | Prepares debug output. | |
0x1440 | debug_print | unknown | As the name already states... (this outputs over DMA) | |
0x17f0 | - | - | AES 1 Part of aes implementation. | |
0x1c48 | aes_encrypt_ecb | - | AES 2 Part of aes implementation. | |
0x1df0 | cellCryptoSpuAesCbcCfb128Decrypt | - | AES 3 Probably part of aes implementation. | |
0x20f0 | aes_omac1 | - | AES 4 Probably part of aes implementation. | |
0x2300 | aes_set_key_dec | - | AES 5 Probably part of aes implementation. | |
0x2418 | aes_decrypt_ecb | - | AES 6 Part of aes implementation. | |
0x2608 | aes_decrypt_ecb_aligned | - | AES 7 Part of aes implementation. | |
0x30c0 | do_dma | ls_addr:$4, dma_effective_addr:$5, size:$6, tag_id:$7, unk0:$8, unk1:$9 | Used to dma data in and out of the isolated module's LS. | |
0x3168 | write_tag_mask_bit | mask_bit:$4 | Used to set a specific bit in MFC_WrTagMask. |
Disasm
The complete disassembly is available at [1].