Initial Program Loader: Difference between revisions

From PSP Developer wiki
Jump to navigation Jump to search
No edit summary
No edit summary
Line 1: Line 1:
IPL is loaded by [[PRE-IPL]].
Initial Program Loader, also named IPL is a PSP program that runs on boot and loads PSP Kernel. IPL is loaded by [[PRE-IPL]]. IPL can be stored either on the NAND or on the service mode "JIG" Memory Stick, depending of the PRE-IPL code.
 
IPL is divided into chunks of 0x1000 bytes, the size of the buffer used at address 0xBFD00000 where they are decrypted. The IPL blocks are standard KIRK cmd 1 blocks and passed directly to [[KIRK Crypto Engine]] for decryption.


= Tools =
= Tools =


[https://github.com/zecoxao/ipltool ipltool by zecoxao and cie]
== Decrypter / Encrypter ==
 
[https://github.com/zecoxao/ipltool ipltool by zecoxao and others]
 
== Custom IPL SDK ==


[https://github.com/DaveeFTW/iplsdk iplsdk by davee]
[https://github.com/DaveeFTW/iplsdk iplsdk by davee]
== Bruteforce forger ==
[https://github.com/mathieulh/Kirk-Bruteforce Kirk-Bruteforce by Team C+D]


= IPL Boot Sequence =
= IPL Boot Sequence =
Line 27: Line 37:
Part2 IPL (main.bin) is responsible for initializing the PSP hardware.
Part2 IPL (main.bin) is responsible for initializing the PSP hardware.


It has copies of it's own driver libraries similar to the drivers found in the firmware (including: sceNAND_Driver, sceDDR_Driver, sceIdStorage_Service, sceSYSREG_Driver, sceSYSCON_Driver, sceGPIO_Driver, sceClockgen_Driver, & sceI2C_Driver). Some of the initialisation of the hardware depends on data stored in IDStorage leaves (for example leaves 4, 5, 6). Note this is where TA082/086 motherboards 'brick' on 1.50 firmware. The clockgen hardware was changed on TA082/086 motherboards so the functions used to initialise it does not recognise the new hardware. And because part of the initialization depends on data stored in leaf 5, simply by invalidating leaf 5 (by corrupting the header), the initialization is skipped allowing the firmware to continue to boot.
It has copies of its own driver modules similar to the drivers found in the firmware (including: sceNAND_Driver, sceDDR_Driver, sceIdStorage_Service, sceSYSREG_Driver, sceSYSCON_Driver, sceGPIO_Driver, sceClockgen_Driver, & sceI2C_Driver). Some of the initialisation of the hardware depends on data stored in IDStorage leaves (for example leaves 4, 5, 6). Note this is where TA-082 / TA-086 motherboards 'brick' on 1.50 firmware. The clockgen hardware was changed on TA082/086 motherboards so the functions used to initialise it does not recognise the new hardware. And because part of the initialization depends on data stored in leaf 5, simply by invalidating leaf 5 (by corrupting the header), the initialization is skipped allowing the firmware to continue to boot.


After initializing the hardware (including the DDR RAM), Part2 IPL decrypts Part3 IPL (the payload) and loads it to address 0x08400000 (which is located in normal DDR RAM now that it has been initialised).
After initializing the hardware (including the DDR RAM), Part2 IPL decrypts Part3 IPL (the payload) and loads it to address 0x08400000 (which is located in normal DDR RAM now that it has been initialised).
Line 40: Line 50:


[https://web.archive.org/web/20090206152144/http://dark-alex.org/forum/viewtopic.php?f=44&t=1194&start=0 IPL security explanation by Dark_Alex]
[https://web.archive.org/web/20090206152144/http://dark-alex.org/forum/viewtopic.php?f=44&t=1194&start=0 IPL security explanation by Dark_Alex]
[https://lolhax.org/2011/07/03/a-look-at-the-ta-88v3-ipl-hash/ Explanation by Davee]

Revision as of 18:02, 19 February 2020

Initial Program Loader, also named IPL is a PSP program that runs on boot and loads PSP Kernel. IPL is loaded by PRE-IPL. IPL can be stored either on the NAND or on the service mode "JIG" Memory Stick, depending of the PRE-IPL code.

IPL is divided into chunks of 0x1000 bytes, the size of the buffer used at address 0xBFD00000 where they are decrypted. The IPL blocks are standard KIRK cmd 1 blocks and passed directly to KIRK Crypto Engine for decryption.

Tools

Decrypter / Encrypter

ipltool by zecoxao and others

Custom IPL SDK

iplsdk by davee

Bruteforce forger

Kirk-Bruteforce by Team C+D

IPL Boot Sequence

The decrypted IPL is composed of 3 parts: Part1 - the 'loader', Part2 - 'main.bin', and Part3 - the 'payload'.

Part1 is plaintext MIPS code, Part2 is gzip compressed, and Part3 is again encrypted (from 2.60 onwards, parts 2 & 3 are further encrypted again).

Part1 IPL (the loader)

One of the first things Part1 IPL does is reset the main CPU.

After reset the PRE-IPL mask ROM device is no longer mapped to memory at all (the 0x1FC00000 address range is then remapped to the 4KB RAM mentioned above to be used for the ME reset vector). This is why the PRE-IPL is no longer accessible once the IPL has booted.

Part1 IPL does some very basic hardware inits and decompresses the gzipped Part2 IPL (main.bin) to address 0x04000000 (still in EDRAM).

Part1 IPL then jumps to the entry address of main.bin (0x04000000) to initialize the hardware.

Part2 IPL (main.bin)

Part2 IPL (main.bin) is responsible for initializing the PSP hardware.

It has copies of its own driver modules similar to the drivers found in the firmware (including: sceNAND_Driver, sceDDR_Driver, sceIdStorage_Service, sceSYSREG_Driver, sceSYSCON_Driver, sceGPIO_Driver, sceClockgen_Driver, & sceI2C_Driver). Some of the initialisation of the hardware depends on data stored in IDStorage leaves (for example leaves 4, 5, 6). Note this is where TA-082 / TA-086 motherboards 'brick' on 1.50 firmware. The clockgen hardware was changed on TA082/086 motherboards so the functions used to initialise it does not recognise the new hardware. And because part of the initialization depends on data stored in leaf 5, simply by invalidating leaf 5 (by corrupting the header), the initialization is skipped allowing the firmware to continue to boot.

After initializing the hardware (including the DDR RAM), Part2 IPL decrypts Part3 IPL (the payload) and loads it to address 0x08400000 (which is located in normal DDR RAM now that it has been initialised).

It then jumps to the entry address of the Part3 IPL (0x08400000) to boot the firmware.

Part3 IPL (the payload)

TODO

See also

IPL security explanation by Dark_Alex

Explanation by Davee