Editing Talk:Communication Processor

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 8: Line 8:
update.bin = v1.0.4c2_TMU510_u.bin - first 32 bytes (IV + Hash)
update.bin = v1.0.4c2_TMU510_u.bin - first 32 bytes (IV + Hash)


{{keyboard|content=<syntaxhighlight lang="bash">openssl enc -aes-256-cbc -d -K E8ED2B817207B70C5DF9090507AF2A8982967620D692B92A59231638402DF13F -iv 737973317347595DFB853B7B4A28105D -in update.bin -out update.tar.gz</syntaxhighlight>}}
{{keyboard|content=openssl enc -aes-256-cbc -d -K E8ED2B817207B70C5DF9090507AF2A8982967620D692B92A59231638402DF13F -iv 737973317347595DFB853B7B4A28105D -in update.bin -out update.tar.gz
}}
<br />
<br />
<br />
Output:
Output:
<pre>
<pre>
Line 27: Line 31:
Thanks,
Thanks,


{{keyboard|content=<syntaxhighlight lang="bash">openssl enc -aes-256-cbc -d -K E8ED2B817207B70C5DF9090507AF2A8982967620D692B92A59231638402DF13F -iv FB306DA62E530EB13FB9D0EF8615060A -in reftool_cp_133.bin -out reftool_cp_133.tar.gz</syntaxhighlight>}}
{{keyboard|content=openssl enc -aes-256-cbc -d -K E8ED2B817207B70C5DF9090507AF2A8982967620D692B92A59231638402DF13F -iv FB306DA62E530EB13FB9D0EF8615060A -in reftool_cp_133.bin -out reftool_cp_133.tar.gz
}}


works. (I should learn reading ;))
works. (I should learn reading ;))
Line 34: Line 39:


== Extra Information ==
== Extra Information ==
I would like to add that it's much easier to interact with the System Controller from the Communication Processor shell considering that Syscon on Reference tool does not require any authentication or encryption of the packets sent to it and you do get real time replies, Syscon on those units also allow many more commands than on consumer systems (even after using AUTH1/AUTH2), this can be rather useful should you want syscon to jump to your code (Syscon is powered by an ARM7TDMI (ARMv4) CPU) by performing a packet overflow.
I would like to add that it's much easier to interact with the System Controller from the Communication Processor shell considering that Syscon on Reference tool does not require any authentication or encryption of the packets sent to it and you do get real time replies, Syscon on those units also allow many more commands than on consumer systems (even after using AUTH1/AUTH2), this can be rather useful should you want syscon to jump to your code (Syscon is powered by an ARM7TDMI (ARMv4) CPU running eCos) by performing a packet overflow.


* Because Syscon's firmware is fully overwritten on a DECR-1000, it is trivial to downgrade its firmware if you are connected to the CP's Shell. (There is actually a script on the CP rom that does just this, all you have to do is to comment the version check) (patched update_syscon.pl: [[http://pastebin.com/ZMxvTxwL]])
* Because Syscon's firmware is fully overwritten on a DECR-1000, it is trivial to downgrade its firmware if you are connected to the CP's Shell. (There is actually a script on the CP rom that does just this, all you have to do is to comment the version check) (patched update_syscon.pl: [[http://pastebin.com/ZMxvTxwL]])
* [http://www.sony.net/Products/Linux/Others/DECR-1000.html partial Source Code]
::Package:
::    DECR-1000-linux-2.4.tar.gz
::    hhl-target-anacron-2.3-mvl3.0.0.2.src.rpm
::    hhl-target-bash-2.05a-mvl3.0.0.1.src.rpm
::    hhl-target-binutils-2.12.1-mvl3.0.0.14.3.src.rpm
::    hhl-target-dhcpcd-1.3.22pl2-devtool.1.src.rpm
::    hhl-target-diff-2.7-mvl3.0.0.3.src.rpm
::    hhl-target-e2fsprogs-1.22-mvl3.0.0.2.src.rpm
::    hhl-target-fileutils-4.1-mvl3.0.0.2.src.rpm
::    hhl-target-findutils-4.1.7-mvl3.0.0.2.src.rpm
::    hhl-target-gawk-3.1.0-mvl3.0.0.2.src.rpm
::    hhl-target-gcc-3.2.1-mvl3.0.0.5.20.src.rpm
::    hhl-target-glib-1.2.10-mvl3.0.0.7.src.rpm
::    hhl-target-glibc-2.2.5-mvl3.0.0.15.14.src.rpm
::    hhl-target-grep-2.4.2-mvl3.0.0.1.src.rpm
::    hhl-target-gzip-1.2.4-mvl3.0.0.2.src.rpm
::    hhl-target-hardhatutils-1.14-mvl3.0.0.10.src.rpm
::    hhl-target-hostname-2.09-mvl3.0.0.1.src.rpm
::    hhl-target-ifupdown-0.6.4-mvl3.0.0.2.src.rpm
::    hhl-target-iptables-1.2.2-mvl3.0.0.1.src.rpm
::    hhl-target-iputils-20020124-mvl3.0.0.1.1.src.rpm
::    hhl-target-less-358-mvl3.0.0.1.src.rpm
::    hhl-target-logrotate-3.5.7-mvl3.0.0.1.src.rpm
::    hhl-target-memstat-0.2-mvl3.0.0.2.src.rpm
::    hhl-target-minicom-1.83.0-mvl3.0.0.1.src.rpm
::    hhl-target-modutils-2.4.16-mvl3.0.0.4.src.rpm
::    hhl-target-nano-1.0.3-mvl3.0.0.1.src.rpm
::    hhl-target-net-tools-1.60-mvl3.0.0.2.src.rpm
::    hhl-target-netbase-4.06-mvl3.0.0.1.src.rpm
::    hhl-target-pam-0.72-mvl3.0.0.4.src.rpm
::    hhl-target-perl-5.6.1-mvl3.0.0.5.src.rpm
::    hhl-target-procps-2.0.7-mvl3.0.0.3.src.rpm
::    hhl-target-psmisc-20.1-mvl3.0.0.2.src.rpm
::    hhl-target-rsync-2.3.2-mvl3.0.0.4.src.rpm
::    hhl-target-sed-3.02-mvl3.0.0.2.src.rpm
::    hhl-target-shellutils-2.0.11-mvl3.0.0.3.src.rpm
::    hhl-target-sysklogd-1.3.31-mvl3.0.0.3.src.rpm
::    hhl-target-sysutils-1.3.8.1-mvl3.0.0.3.src.rpm
::    hhl-target-sysvinit-2.78-mvl3.0.0.11.src.rpm
::    hhl-target-tar-1.13.19-mvl3.0.0.3.src.rpm
::    hhl-target-textutils-2.0-mvl3.0.0.2.src.rpm
::    hhl-target-util-linux-2.11h-mvl3.0.0.4.src.rpm
::    hhl-target-which-2.12-mvl3.0.0.2.src.rpm
::    hhl-target-xfsprogs-2.2.2-mvl3.0.0.1.src.rpm
::    mips_fp_le-lrzsz-0.12.20-devtool.1.src.rpm


The Communication Processor can also talk to the southbridge.
The Communication Processor can also talk to the southbridge.
== CP Revisions ==
<pre>
/*
TCP-510  Rev. 1:  0x10
TCP-510  Rev. 2:  0x11
TCP-520  Rev. 1:  0x20
TCP-520  Rev. 2:  0x21
TCP-520  Rev. 3:  0x22
*/
static int get_cp_revision(void)
{
unsigned int rev = (unsigned int)(*((volatile unsigned long long *) 0xFF1FE000) >> 32);
return (((rev >> 2) & 0x3f) | ((rev >> 4) & 0x40));
}
</pre>
== PS2/PSP/PS3/VITA/PS4 CP ==
<pre>
PS2
DTL-T10000(H) / DTL-T15000 "MPU-401"
x86 PCI SBC (PCI-586VE-S / PCI-815VE)
PSP
DTP-T1000 "MPU-220"
Sony CXD9823 (Toshiba TX4937)
PS3
DECR-1000 "MPU-230"
Sony CXD9802 (Toshiba TX4937)
PSVITA
PDEL-1000 "?"
Renesas µPD77630A (EMMA Mobile1-S)
PS4
DUH-D7000 "?"
Marvell 88R6B2D-AD (Armada SP?)
</pre>
=== VITA CP Documents ===
See --> [https://psdevwiki.com/vita/index.php?title=Communication_Processor Vita Dev Wiki#Communication Processor]
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page: