Editing SC Communication

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 15: Line 15:
! Offset (from start of address space) !! Size !! Description
! Offset (from start of address space) !! Size !! Description
|-
|-
|0xC000 || 0xFF0 || Syscon packet send area (Cell reads from here)
|0xC000 || 0xFF0 || Syscon packet send area
|-
|-
|0xCFF0 || 0x4  || Syscon packet TX counter
|0xCFF0 || 0x4  || Syscon sent packet counter
|-
|-
|0xCFF4 || 0x4  || Syscon packet RX counter
|0xCFF4 || 0x4  || Syscon sent packet acknowledge counter
|-
|-
|0xD000 || 0xFF0 || Cell packet send area
|0xD000 || 0xFF0 || Syscon packet receive area
|-
|-
|0xDFF0 || 0x4  || Cell packet TX counter
|0xDFF0 || 0x4  || Syscon received packet counter
|-
|-
|0xDFF4 || 0x4  || Cell packet RX counter
|0xDFF4 || 0x4  || Syscon received packet acknowledge counter
|-
|-
|0xE100 || 0x4  || Tells syscon there is a packet to be received
|0xE100 || 0x4  || Tells syscon there is a packet to be received
Line 37: Line 37:
=Syscon Services=
=Syscon Services=
* To be completed... (see {{talk}} page for examples)
* To be completed... (see {{talk}} page for examples)
<pre>
03 SERV_SDA        (not available on Sherwood)
10 SERV_DEVPM
11 SERV_THERM
12 SERV_SETCFG
13 SERV_SYSPM
14 SERV_NVS
15 SERV_SIRCS      (not available on Sherwood)
16 SERV_NOTIF
17 SERV_INTR_NOTIF  (not available on Sherwood)
18 SERV_VERS
1B SERV_LIVELOCK
1C SERV_OSWDT
1E SERV_DIAG        (not available on Sherwood)
1F SERV_SECU
20 SERV_CONSOLE
2D SERV_PATCH
30 SERV_HDMI
40 SERV_LS
50 SERV_STORAGE    (not available on Sherwood)
F1 CC_CGMS_191F8
F2 SERV_LS_DATA_23EBC
</pre>


{| class="wikitable FCK__ShowTableBorders"
{| class="wikitable FCK__ShowTableBorders"
Line 69: Line 44:
| 0x03 || Device Access Service - Used for eeprom read/write.
| 0x03 || Device Access Service - Used for eeprom read/write.
|-
|-
| 0x10 || Device Power Service (PS2 PCI Bus Power On/Off)
| 0x10 || PS2 PCI Bus Power On/Off
|-
|-
| 0x11 || Time Zone Presence, Temperature, Thermal Alert Mode,  
| 0x11 || Time Zone Presence, Temperature, Thermal Alert Mode,  
Line 77: Line 52:
| 0x13 || Power Service - Controls system power and related info. (Power Up/Power Button Mode, Wake Source, RTC too.)
| 0x13 || Power Service - Controls system power and related info. (Power Up/Power Button Mode, Wake Source, RTC too.)
|-
|-
| 0x14 || NVS Service - Used for eeprom read/write. See: [[SC Manager#0x900B - SC Read EPROM]]
| 0x14 || NVS Service - Used for eeprom read/write.
|-
| 0x15 || Serial Infrared Remote Control System
|-
| 0x16 || Notification / (LED / Buzzer) Service - Controls the lights on the console and the ring buzzer.
|-
|-
| 0x17 || Interrupt Notification Service
| 0x16 || LED / Buzzer Service - Controls the lights on the console and the ring buzzer.
|-
|-
| 0x18 || Version Service - Versioning related (SC Type/Major-,Minor Version)
| 0x18 || Version Service - Versioning related (SC Type/Major-,Minor Version)
Line 89: Line 60:
| 0x1B || Livelock(?) Service - Checks for permission to use other services.  
| 0x1B || Livelock(?) Service - Checks for permission to use other services.  
|-
|-
| 0x1C || Operating System Watch Dog Timer
| 0x20 || Syscon Debug Output(?) - Used to send a string to syscon.
|-
| 0x1E || Diag Service
|-
| 0x20 || Syscon Console Output - Used to send a string to syscon.
|-
| 0x2D || Syscon Patch Service
|-
| 0x30 || A/V Service / HDMI Service
|-
| 0x40 || LabStation (Fun Stuff)
|-
|-
| 0x50 || Storage Service
| 0x2D || (used when getting Patch/ROM Version in EPROM)
|-
|-
| 0x1F || Secure Services. (sc_secure_service)
| 0x30 || A/V Service.
|-
|-
| 0xF1 || Copy Generation Management System Configuration
| 0x1F || Authenticated Services. (sc_secure_service)
|-
| 0xF2 || LabStation Data (More FunStuff)
|-
|-
| 0xFF || Syscon Init (Seen in lv0ldr init sequence to syscon: [[User_talk:JuanNadie]])
| 0xFF || Syscon Init (Seen in lv0ldr init sequence to syscon: [[User_talk:JuanNadie]])
Line 121: Line 80:
! What? !! Description || Data || Notes
! What? !! Description || Data || Notes
|-
|-
| AUTH1 || AUTH1 Header || 0x1F, 0x01, 0x00, 0x00, 0x00, 0x00, 0x80, 0x20, 0x00, 0x00, 0x00, 0x00,<br>0x00, 0x30, 0x00, 0x30 || On AUTH1 UART SC Packets it's instead 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
| AUTH1 || AUTH1 Header || 0x1F, 0x01, 0x00, 0x00, 0x00, 0x00, 0x80, 0x20, 0x00, 0x00, 0x00, 0x00,<br>0x00, 0x30, 0x00, 0x30 || On AUTH1 Retail SC Packets it's instead 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
|-
|-
| AUTH2 || AUTH2 Header || 0x1F, 0x01, 0x00, 0x01, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,<br>0x00, 0x30, 0x00, 0x30 || On AUTH2 UART SC Packets it's instead 0x10, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
| AUTH2 || AUTH2 Header || 0x1F, 0x01, 0x00, 0x01, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,<br>0x00, 0x30, 0x00, 0x30 || On AUTH2 Retail SC Packets it's instead 0x10, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
|-
|-
| Debug Output || Sends string to Syscon TTY || 0x20, 0x01, 0x00, 0x07, 0x00, 0x00, 0x80, 0x28, 0x00, 0x00, 0x00, 0x00<br>|| Start message with 0x00. Will print as much as packet length.
| Debug Output || Sends string to Syscon TTY || 0x20, 0x01, 0x00, 0x07, 0x00, 0x00, 0x80, 0x28, 0x00, 0x00, 0x00, 0x00<br>|| Start message with 0x00. Will print as much as packet length.
Line 136: Line 95:
|-
|-
| Panic || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,<br>0x00, 0x04, 0x00, 0x04,<br>0x11, 0x00, 0x00, 0x03|| Shuts down, beeps, and kills power LED until power button pressed, or power removed.
| Panic || || 0x13, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x80, 0x21, 0x00, 0x00, 0x00, 0x00,<br>0x00, 0x04, 0x00, 0x04,<br>0x11, 0x00, 0x00, 0x03|| Shuts down, beeps, and kills power LED until power button pressed, or power removed.
|-
| Set Wake Up Source to Restart after Shutdown (Patch) || || 0x13, 0x01, 0x13, 0x12, 0x00, 0x00, 0x80, 0x39, 0x00, 0x00, 0x00, 0x01, 0x00, 0x08, 0x00, 0x08, 0x12, 0x00, 0x00, 0x00, 0x80, 0x00, 0x02, 0x74 || Sets Wake Up Source to Wake Up after Shutdown
|-
| Shutdown Some Syscon Services Responsible for Patch  || || 0x13, 0x01, 0x00, 0x00, 0x00, 0x00, 0x80, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x04, 0x11, 0x00, 0x00, 0x09 || Shutdown Some Syscon Services Responsible for Patch
|-
|}
|}


Line 283: Line 237:
You are now authenticated with syscon, and can use privileged commands. Just use the session_key calculated from the AUTH2 reply to encrypt/decrypt responses.
You are now authenticated with syscon, and can use privileged commands. Just use the session_key calculated from the AUTH2 reply to encrypt/decrypt responses.


= Some Samples from DYN-001 Syscon SPI SC Comms =
* https://mega.nz/#!2w00VAjK!u10PD2b0G-MqwUZTBD4Nv_by36QNn8P-jVIUxq0pLDM (dead link)
<pre>
00 70 0B 93 FF DC CF 43 97 68 49 06 71 32 27 C1
E8 9F D1 73 DA 4D FA A2 7C 6F 24 F7 BD 95 37 EC
F9 17 5B BB DB 32 E8 82 55 3F 51 23 F1 71 E6 88
</pre>


{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)