Talk:IDPS: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
Line 84: Line 84:
| &nbsp;<code>00 00 00 01 00 84 00 0C 10 22 CE B2 EB 40 D9 EB</code>&nbsp; || {{TID84}} || {{HWID0C}} ||
| &nbsp;<code>00 00 00 01 00 84 00 0C 10 22 CE B2 EB 40 D9 EB</code>&nbsp; || {{TID84}} || {{HWID0C}} ||
|-
|-
 
| &nbsp;<code>00 00 00 01 00 89 00 0D 14 00 93 75 A9 00 4C 96</code>&nbsp; || {{TID89}} || {{HWID0D}} ||
|-
|}
|}
*Speculation:
*Speculation:
Line 108: Line 109:
|-
|-
| &nbsp;<code>00 00 00 01 00 8D 00 0C xx xx xx xx xx xx xx xx</code>&nbsp; || {{TID8D}} || {{HWID0C}} || -
| &nbsp;<code>00 00 00 01 00 8D 00 0C xx xx xx xx xx xx xx xx</code>&nbsp; || {{TID8D}} || {{HWID0C}} || -
|-
| &nbsp;<code>00 00 00 01 00 8E 00 0C xx xx xx xx xx xx xx xx</code>&nbsp; || {{TID8E}} || {{HWID0D}} || -
|-
|-
| &nbsp;<code>00 00 00 01 00 8F 00 0E xx xx xx xx xx xx xx xx</code>&nbsp; || {{TID8F}} || {{HWID0E}} || -
| &nbsp;<code>00 00 00 01 00 8F 00 0E xx xx xx xx xx xx xx xx</code>&nbsp; || {{TID8F}} || {{HWID0E}} || -

Revision as of 15:15, 23 January 2013


IDPS Examples

IDPS 6th
byte		 Target ID 8th
byte		 PS3 Model Notes
 00 00 00 01 00 81 00 01 03 FF FF FF 18 43 C1 4D  0x81  TOOL  Reference Tool or  SD  System Debugger / DECR 0x01 DECR-1000(A/J) / DEH-Z1010 (TMU-520) Static Dummy IDPS
 00 00 00 01 00 84 00 01 04 00 F3 44 AC 4F 8D 2F  0x84  CEX  Retail or  SHOP  Kiosk - USA / CECH 0x01 CECHA (COK-001)
 00 00 00 01 00 84 00 01 10 19 15 0C 45 9F 1C 2A  0x84  CEX  Retail or  SHOP  Kiosk - USA / CECH 0x01 CECHA (COK-001)
 00 00 00 01 00 8A 00 01 10 00 52 BC C7 11 6D B2  0x8A  CEX  Retail or  SHOP  Kiosk - South Asia / CECH 0x01 CECHA (COK-001)
 00 00 00 01 00 84 00 01 10 1B 23 A2 EA C6 4D D0  0x84  CEX  Retail or  SHOP  Kiosk - USA / CECH 0x01 CECHA (COK-001)
 00 00 00 01 00 84 00 02 10 01 15 ED DE D8 06 8B  0x84  CEX  Retail or  SHOP  Kiosk - USA / CECH 0x02 CECHB (COK-001)
 00 00 00 01 00 85 00 03 10 11 62 95 56 FF DB FD  0x85  CEX  Retail or  SHOP  Kiosk - Europe / CECH 0x03 CECHC (COK-002)
 00 00 00 01 00 85 00 03 10 00 3D F9 65 97 B6 EA  0x85  CEX  Retail or  SHOP  Kiosk - Europe / CECH 0x03 CECHC (COK-002)
 00 00 00 01 00 A0 00 04 04 00 04 1B 13 AB 46 25  0xA0  ARC  Arcade / GECR 0x04 GECR-1100 (COK-002) (COK-002 without Bluetooth/Wifi)
 00 00 00 01 00 87 00 05 F4 01 E9 4F 17 DB D9 5D  0x87  CEX  Retail or  SHOP  Kiosk - United Kingdom / CECH 0x05 CECHG (SEM-001)
 00 00 00 01 00 85 00 05 04 00 33 A3 44 9D 57 2B  0x85  CEX  Retail or  SHOP  Kiosk - Europe / CECH 0x05 CECHG (SEM-001)
 00 00 00 01 00 85 00 05 10 01 5F 01 12 FF 56 4F  0x85  CEX  Retail or  SHOP  Kiosk - Europe / CECH 0x05 CECHG (SEM-001)
 00 00 00 01 00 85 00 05 14 02 F7 06 9F 10 B6 22  0x85  CEX  Retail or  SHOP  Kiosk - Europe / CECH 0x05 CECHG (SEM-001)
 00 00 00 01 00 87 00 05 10 02 3A 2D 53 AF 66 28  0x87  CEX  Retail or  SHOP  Kiosk - United Kingdom / CECH 0x05 CECHG (SEM-001)
 00 00 00 01 00 84 00 05 F4 00 41 86 55 9B D3 52  0x84  CEX  Retail or  SHOP  Kiosk - USA / CECH 0x05 CECHG (SEM-001)
 00 00 00 01 00 8C 00 05 10 00 D1 F3 55 2D DA BC  0x8C  CEX  Retail or  SHOP  Kiosk - Russia / CECH 0x05 CECHG (SEM-001)
 00 00 00 01 00 85 00 05 14 0E F0 DF DC DD 5E 56  0x85  CEX  Retail or  SHOP  Kiosk - Europe / CECH 0x05 CECHG (SEM-001)
 00 00 00 01 00 87 00 05 10 0A EE 67 DD 75 86 DA  0x87  CEX  Retail or  SHOP  Kiosk - United Kingdom / CECH 0x05 CECHG (SEM-001) (original label stated CECHC model!)
 00 00 00 01 00 87 00 07 10 00 A3 15 8F 61 36 85  0x87  CEX  Retail or  SHOP  Kiosk - United Kingdom / CECH 0x07 CECHJ/CECHK (DIA-002)
 00 00 00 01 00 89 00 08 14 01 01 06 1B 91 1C 5C  0x89  CEX  Retail or  SHOP  Kiosk - Australia & New Zealand / CECH 0x08 CECHL/CECHM/CECHP/CECHQ (VER-001)
 00 00 00 01 00 84 00 08 14 0B 80 7A 2E 4F AA C7  0x84  CEX  Retail or  SHOP  Kiosk - USA / CECH 0x08 CECHL/CECHM/CECHP/CECHQ (VER-001)
 00 00 00 01 00 87 00 08 14 01 B7 A7 1F C8 3A EA  0x87  CEX  Retail or  SHOP  Kiosk - United Kingdom / CECH 0x08 CECHL/CECHM/CECHP/CECHQ (VER-001)
 00 00 00 01 00 85 00 08 10 05 52 88 E8 AF 75 0D  0x85  CEX  Retail or  SHOP  Kiosk - Europe / CECH 0x08 CECHL/CECHM/CECHP/CECHQ (VER-001)
 00 00 00 01 00 85 00 08 F4 01 AA 02 51 EE 33 7B  0x85  CEX  Retail or  SHOP  Kiosk - Europe / CECH 0x08 CECHL/CECHM/CECHP/CECHQ (VER-001)
 00 00 00 01 00 A0 00 08 04 00 13 69 BC E4 78 80  0xA0  ARC  Arcade / GECR 0x08 GECR-1500 (VER-001) (VER-001 without Bluetooth/Wifi)
 00 00 00 01 00 85 00 09 10 0A 27 3E 8E 1D DF 65  0x85  CEX  Retail or  SHOP  Kiosk - Europe / CECH 0x09 CECH20xx (DYN-001)
 00 00 00 01 00 85 00 09 10 1B 69 BD CA CC BE 85  0x85  CEX  Retail or  SHOP  Kiosk - Europe / CECH 0x09 CECH20xx (DYN-001)
 00 00 00 01 00 84 00 09 10 1C B0 13 5F 2C 17 AF  0x84  CEX  Retail or  SHOP  Kiosk - USA / CECH 0x09 CECH20xx (DYN-001)
 00 00 00 01 00 85 00 0A 14 05 67 A0 79 37 DC 17  0x85  CEX  Retail or  SHOP  Kiosk - Europe / CECH 0x0A CECH21xx (SUR-001)
 00 00 00 01 00 87 00 0B 14 0C 84 81 81 33 FA 68  0x87  CEX  Retail or  SHOP  Kiosk - United Kingdom / CECH 0x0B CECH25xx (JTP-001/JSD-001)
 00 00 00 01 00 85 00 0B 10 18 EC 96 E4 A8 BE EF  0x85  CEX  Retail or  SHOP  Kiosk - Europe / CECH 0x0B CECH25xx (JTP-001/JSD-001)
 00 00 00 01 00 89 00 0B 14 00 EF DD CA 25 52 66  0x89  CEX  Retail or  SHOP  Kiosk - Australia & New Zealand / CECH 0x0B CECH25xx (JTP-001/JSD-001)
 00 00 00 01 00 89 00 0B 14 05 18 95 D3 EE D0 76  0x89  CEX  Retail or  SHOP  Kiosk - Australia & New Zealand / CECH 0x0B CECH25xx (JTP-001/JSD-001)
 00 00 00 01 00 87 00 0B 14 0E 71 DF 87 E5 A2 4D  0x87  CEX  Retail or  SHOP  Kiosk - United Kingdom / CECH 0x0B CECH25xx (JTP-001/JSD-001)
 00 00 00 01 00 8C 00 0C 14 0E 7D FA F1 5F 9F 3F  0x8C  CEX  Retail or  SHOP  Kiosk - Russia / CECH 0x0C CECH30xx (KTE-001)
 00 00 00 01 00 87 00 0C 14 06 C3 90 35 41 45 18  0x87  CEX  Retail or  SHOP  Kiosk - United Kingdom / CECH 0x0C CECH30xx (KTE-001)
 00 00 00 01 00 84 00 0C 10 19 15 0C 45 9F 1C 2A  0x84  CEX  Retail or  SHOP  Kiosk - USA / CECH 0x0C CECH30xx (KTE-001) used by PS-Unban
 00 00 00 01 00 84 00 0C 10 11 21 52 A6 EB 62 10  0x84  CEX  Retail or  SHOP  Kiosk - USA / CECH 0x0C CECH30xx (KTE-001) used by PS-Unban
 00 00 00 01 00 84 00 0C 10 22 CE B2 EB 40 D9 EB  0x84  CEX  Retail or  SHOP  Kiosk - USA / CECH 0x0C CECH30xx (KTE-001)
 00 00 00 01 00 89 00 0D 14 00 93 75 A9 00 4C 96  0x89  CEX  Retail or  SHOP  Kiosk - Australia & New Zealand / CECH 0x0D CECH40xx (MPX-001/MSX-001)
  • Speculation:
    • 9th byte: 0x00, or 0x10, or 0xF0 + 0x00 or 0x04 (or 0x00 + 0x03 in the "Dummy IDPS")
    • 10th byte: 0x00, or 0x10 + ???
IDPS 6th
byte		 Target ID 8th
byte		 PS3 Model Notes
 00 00 00 01 00 80 00 01 xx xx xx xx xx xx xx xx  0x80  NOT IN USE  0x01 DECHAS00A/J (COK-001) -
 00 00 00 01 00 82 00 01 xx xx xx xx xx xx xx xx  0x82  DEX   AV TEST   DTCP-IP  Debug / AV Tool / DTCP-IP Debugger / DECH / DECHS 0x01 DECHA00A/J (COK-001) -
 00 00 00 01 00 8A 00 01 xx xx xx xx xx xx xx xx  0x8A  CEX  Retail or  SHOP  Kiosk - South Asia / CECH 0x01 CECHA (COK-001) -
 00 00 00 01 00 8B 00 01 xx xx xx xx xx xx xx xx  0x8B  CEX  Retail or  SHOP  Kiosk - Taiwan / CECH 0x01 CECHA (COK-001) -
 00 00 00 01 00 83 00 01 xx xx xx xx xx xx xx xx  0x83  CEX  Retail or  SHOP  Kiosk - Japan / CECH 0x01 CECHA (COK-001) -
 00 00 00 01 00 86 00 04 xx xx xx xx xx xx xx xx  0x86  CEX  Retail or  SHOP  Kiosk - Korea / CECH 0x04 CECHE (COK-002/COK-002W) -
 00 00 00 01 00 88 00 04 xx xx xx xx xx xx xx xx  0x88  CEX  Retail or  SHOP  Kiosk - Mexico / CECH 0x04 CECHE (COK-002/COK-002W) -
 00 00 00 01 00 8D 00 0C xx xx xx xx xx xx xx xx  0x8D  CEX  Retail or  SHOP  Kiosk - China / CECH 0x0C CECH30xx (KTE-001) -
 00 00 00 01 00 8F 00 0E xx xx xx xx xx xx xx xx  0x8F  CEX  Retail or  SHOP  Kiosk - Brazil / CECH 0x0E non existant -

IDPS rms blogtext

You’re probably wondering: “What the hell is this sequence of bytes?”. This is the IDPS, a sequence of bytes which determine console type. This structure is relatively undocumented until now, anyway. The IDPS is contained in EID0. EID0 is on the console internal flash as the file eEID and has multiple sections. I had made a splitter application to make your life easier a long time ago. Now, EID is decrypted by metldr, and is passed over to the isolated loader, which may pass it to a self. We can see this in graf_chokolo’s original payload. The IDPS is also used in various other parts of the system which could be of interest to you, but I will not discuss those right now. The IDPS itself, isn’t decrypted.

The IDPS contains your target ID, motherboard? and BD? revision. The IDPS shown at the beginning of this article is the dummy IDPS, the one that’s used when your IDPS fails to be decrypted. That IDPS belongs to a DECR-1000A. The one below belongs to a European PS3, and the one below that belongs to a Australian/NZ PS3.

Source: http://rmscrypt.wordpress.com/2011/05/16/idps-what-the-hell-is-that-thing/

Note: The Reference Tool IDPS from above is static. aim_iso uses it. Retail/3.55 doesn't have it.

Change HWID

Theory: If you give a slim console a fat IDPS, would that console have 3.15 OtherOS functionality?

I would say it would, because most likely the check is done in firmware to either en/disable that option. However, it would still require a console that can be downgraded to that version (only CECH-20../DYN-001, because CECH-21../SUR-001 use different drivers for RSX). So classic OtherOS on a CellBE 45nm/RSX 40nm would be impossible (ofcourse you can use OtherOS++).

[Homebrew-App] PS3 Model Detection

http://www.ps3hax.net/2011/01/homebrew-app-ps3-model-detection/ 

Dumping PS3 Model Data:

- PS3 System Target ID:     0x85	(Retail - Europe)
- PS3 Motherboard Revision: 0x0B	(JTP-001 Motherboard, Revision 1)
- PS3 BD-Laser Revision:    0x04	(KES-400, SACD supported)

Probable Model: CECH-2504A

Raw Model Data:

  Byte 0:		0x00
  Byte 1:		0x01
  Byte 2:		0x00
  Byte 3:		0x85
  Byte 4:		0x00
  Byte 5:		0x0B
  Byte 6:		0x00
  Byte 7:		0x04

footnotes:

  • '7th byte of IDPS' is not Bluray Drive (it was misunderstood at that time). You can see it in the example where it names incorrectly a CECH-25xx as Super Audio CD compatible with a KES-400 laserslide (which in real life has either KES-460A or KES-470A without daughterboard (swap can be done without remarry).
  • also, it named bytes 0-2 "Byte 0", byte 3 "Byte 1", byte 4 "Byte 2", byte 5 "Byte 3", byte 6 "Byte 4", byte 7 "Byte 5", byte 8 "Byte 6", byte 9 "Byte 7" etc.

[Homebrew-App] IDPS Viewer

http://www.tortuga-cove.com/hacking/31-ps3/8396-released-idps-viewer

  • Displays the IDPS
  • Shows Target ID
  • Displays Motherboard revision
  • Save IDPS (16 bytes from EID) in dev_hdd0/IDPS.bin file
Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=Talk:IDPS&oldid=18864"