Appliance Information Manager: Difference between revisions
mNo edit summary |
|||
(15 intermediate revisions by 5 users not shown) | |||
Line 1: | Line 1: | ||
[[AIM_Manager|AIM Manager]] is a [[Hypervisor_Reverse_Engineering#Process_socket_services|Process socket service]] supported by the hypervisor (lv1).<br> | [[AIM_Manager|AIM Manager]] ([[Appliance Info Manager|Appliance Info Manager]]) is a [[Hypervisor_Reverse_Engineering#Process_socket_services|Process socket service]] supported by the hypervisor (lv1).<br> | ||
It is used to retrieve the device type, device id, open psid and the pscode from the [[Flash#EID0_-_Section_0|EID0]] data that is passed in.<br> | It is used to retrieve the device type, device id, open psid and the pscode from the [[Flash#EID0_-_Section_0|EID0]] data that is passed in.<br> | ||
Line 6: | Line 6: | ||
and requires 0x40 Root [[Control_Flags|Control Flags]] in [[SELF_File_Format_and_Decryption#Control_Information|SCE Header]]. | and requires 0x40 Root [[Control_Flags|Control Flags]] in [[SELF_File_Format_and_Decryption#Control_Information|SCE Header]]. | ||
internally loaded@ | internally loaded@ss_server2.fself | ||
Function Id : 0x19000 | Function Id : 0x19000 | ||
Port: 0x24 | Port: 0x24 | ||
Line 18: | Line 18: | ||
! Packet ID | ! Packet ID | ||
! Description | ! Description | ||
! Lv1 Parameter Usage | |||
! Lv2Syscall Parameter | |||
! notes | |||
|- | |- | ||
| 0x19002 | | 0x19002 | ||
| Get Device Type | | Get Device Type | ||
| | |||
| uint8_t out[0x10] | |||
| | |||
|- | |- | ||
| 0x19003 | | 0x19003 | ||
| Get Device ID | | Get Device ID | ||
| | |||
| uint8_t out[0x10] | |||
| | |||
|- | |- | ||
| 0x19004 | | 0x19004 | ||
| Get PS Code | | Get PS Code | ||
| | |||
| uint8_t out[0x8] | |||
| | |||
|- | |- | ||
| 0x19005 | | 0x19005 | ||
| Get Open PS ID | | Get Open PS ID | ||
| | |||
| uint8_t out[0x10] | |||
| | |||
|- | |- | ||
| 0x19006 | | 0x19006 | ||
| Unknown | | Unknown | ||
| | |||
| void | |||
| | |||
|} | |} | ||
Line 42: | Line 60: | ||
</pre> | </pre> | ||
< | {{Boxcode|content=<syntaxhighlight lang="c"> | ||
struct ss_aim_get_device_type | struct ss_aim_get_device_type | ||
{ | { | ||
u8 field0[16]; | u8 field0[16]; | ||
}; | }; | ||
</ | </syntaxhighlight>}} | ||
<br><br><br><br><br> | |||
calling from GameOS: int cellSsAimGetDeviceType(out:uint8[0x10]) | calling from GameOS: int cellSsAimGetDeviceType(out:uint8[0x10]) | ||
Line 59: | Line 77: | ||
</pre> | </pre> | ||
< | {{Boxcode|content=<syntaxhighlight lang="c"> | ||
struct ss_aim_get_device_id | struct ss_aim_get_device_id | ||
{ | { | ||
u8 | u8 idps[16]; // see [[idps]] | ||
}; | }; | ||
</ | </syntaxhighlight>}} | ||
<br><br><br><br><br> | |||
calling from GameOS: int cellSsAimGetDeviceId(out:uint8[0x10]) | calling from GameOS: int cellSsAimGetDeviceId(out:uint8[0x10]) | ||
Line 74: | Line 92: | ||
0x00 0x01 0x00 0x85 0x00 0x07 0x00 0x04 | 0x00 0x01 0x00 0x85 0x00 0x07 0x00 0x04 | ||
< | Last two Bytes get calculated simply by using 9th and 10th Byte of [[IDPS]] right shifted by 0xA. | ||
{{Boxcode|content=<syntaxhighlight lang="c"> | |||
struct ss_aim_get_ps_code | struct ss_aim_get_ps_code | ||
{ | { | ||
u8 field0[8]; | u8 field0[8]; | ||
}; | }; | ||
</ | </syntaxhighlight>}} | ||
<br><br><br><br><br> | |||
calling from GameOS: int cellSsAimGetPsCode(out:uint8[8]) | calling from GameOS: int cellSsAimGetPsCode(out:uint8[8]) | ||
== 0x19005 - Get Open PS ID == | == 0x19005 - Get Open PS ID == | ||
< | {{Boxcode|content=<syntaxhighlight lang="c"> | ||
struct ss_aim_get_open_ps_id | struct ss_aim_get_open_ps_id | ||
{ | { | ||
u8 field0[16]; | u8 field0[16]; | ||
}; | }; | ||
</ | </syntaxhighlight>}} | ||
<br><br><br><br><br> | |||
calling from GameOS: int cellSsAimGetOpenPsId(out:uint8[0x10]) | calling from GameOS: int cellSsAimGetOpenPsId(out:uint8[0x10]) | ||
Line 103: | Line 123: | ||
note: this packet id doesnt need another parameter | note: this packet id doesnt need another parameter | ||
= Reverse Engineering in Lv1 = | |||
Function Id : 0x19000 | |||
Port: 0x24 | |||
Process: 5 | |||
If you want to check out about it or get more things documented<br> | |||
consider looking at for example: | |||
* coolstuff\hvdump315_reversing\proc_5\code_seg.idb | |||
* coolstuff\hvdump341_reversing\proc_5\code_seg.idb | |||
* coolstuff\hvdump355_reversing\proc_5\code_seg.idb | |||
= Reverse Engineering isolated module = | |||
a crossreference to [[SPU_Isolated_Modules_Reverse_Engineering#aim_spu_module]] | a crossreference to [[SPU_Isolated_Modules_Reverse_Engineering#aim_spu_module]] | ||
== Debug messages == | |||
{| class="wikitable" | {| class="wikitable" | ||
! colspan="2" | Address !! rowspan="2" | Message | ! colspan="2" | Address !! rowspan="2" | Message | ||
Line 125: | Line 158: | ||
== Data == | |||
{| class="wikitable" | {| class="wikitable" | ||
! colspan="2" | Address !! rowspan="2" | Message | ! colspan="2" | Address !! rowspan="2" | Message | ||
Line 141: | Line 174: | ||
== Functions == | |||
{| class="wikitable" | {| class="wikitable" | ||
! colspan="2" | Address !! rowspan="2" | Name !! rowspan="2" | Parameters !! rowspan="2" | Info | ! colspan="2" | Address !! rowspan="2" | Name !! rowspan="2" | Parameters !! rowspan="2" | Info | ||
Line 179: | Line 212: | ||
== Disasm == | |||
The complete disassembly is available at [http://pastebin.com/7vArGweJ]. | The complete disassembly is available at [http://pastebin.com/7vArGweJ]. | ||
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude> |
Revision as of 20:33, 16 May 2018
AIM Manager (Appliance Info Manager) is a Process socket service supported by the hypervisor (lv1).
It is used to retrieve the device type, device id, open psid and the pscode from the EID0 data that is passed in.
Responsible is the isolated SPU module aim_spu_module.self from CoreOS / Flash.
This service accessable from GameOS via Syscall: 867 (0x363)
and requires 0x40 Root Control Flags in SCE Header.
internally loaded@ss_server2.fself Function Id : 0x19000 Port: 0x24
0x19000 - AIM
Packet ID | Description | Lv1 Parameter Usage | Lv2Syscall Parameter | notes |
---|---|---|---|---|
0x19002 | Get Device Type | uint8_t out[0x10] | ||
0x19003 | Get Device ID | uint8_t out[0x10] | ||
0x19004 | Get PS Code | uint8_t out[0x8] | ||
0x19005 | Get Open PS ID | uint8_t out[0x10] | ||
0x19006 | Unknown | void |
0x19002 - Get Device Type
- returns your consoles Target Id value:
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x85
Code Sample
calling from GameOS: int cellSsAimGetDeviceType(out:uint8[0x10])
0x19003 - Get Device ID
- returns your consoles IDPS
0x00 0x00 0x00 0x01 0x00 0x89 0x00 0x0B 0x14 0x00 0xEF 0xDD 0xCA 0x25 0x52 0x66 .....‰....ïÝÊ%Rf
Code Sample
calling from GameOS: int cellSsAimGetDeviceId(out:uint8[0x10])
0x19004 - Get PS Code
on my CECHJ04 it returns:
0x00 0x01 0x00 0x85 0x00 0x07 0x00 0x04
Last two Bytes get calculated simply by using 9th and 10th Byte of IDPS right shifted by 0xA.
Code Sample
calling from GameOS: int cellSsAimGetPsCode(out:uint8[8])
0x19005 - Get Open PS ID
Code Sample
calling from GameOS: int cellSsAimGetOpenPsId(out:uint8[0x10])
0x19006 -
- usage found in bdp_BDVD for example...with 1 param (=0)
- seems to be handled by lv2_kernel, not aim itself.
- looks up for qa-flag (if flagged, sets token seed to an lv2 internal buffer), fself flag & device_id
calling from GameOS: int syscall(867,0x19006) note: this packet id doesnt need another parameter
Reverse Engineering in Lv1
Function Id : 0x19000 Port: 0x24 Process: 5
If you want to check out about it or get more things documented
consider looking at for example:
- coolstuff\hvdump315_reversing\proc_5\code_seg.idb
- coolstuff\hvdump341_reversing\proc_5\code_seg.idb
- coolstuff\hvdump355_reversing\proc_5\code_seg.idb
Reverse Engineering isolated module
a crossreference to SPU_Isolated_Modules_Reverse_Engineering#aim_spu_module
Debug messages
Address | Message | |
---|---|---|
? 3.41 ? | 355 CEX | |
0x36f0 | 0x3570 | "(spu)start aim spu module!\n" |
0x3710 | 0x3590 | "(spu) PU DMA area start address is not align 16byte\n" |
0x3750 | 0x35d0 | "(spu) PU EID area start address is not align 16byte\n" |
0x3790 | 0x3610 | "(spu) PU DMA area size is not equall to AIM_DMA_SIZE\n" |
This messages are DMAed to the ppu if a debug output address is specified.
Data
Address | Message | |
---|---|---|
? 3.41 ? | 355 CEX | |
0x37e0 | - | Reference tool fallback IDPS |
0x37f0 - ... | 0x3650 - ... | Start of AIM keys Keys#aim_keys |
0x3ac0 | 0x3870 | AES sbox (16*16 bytes) |
0x3c70 | 0x3a20 | AES inverse sbox (16*16 bytes) |
Functions
Address | Name | Parameters | Info | |
---|---|---|---|---|
3.41 CEX/DEX | 355 CEX | |||
0x9e0 | stop_func | unknown | Stops the module execution with various stop codes. | |
0xa18 | main_func | unknown | Main routine. | |
0xf18 | response | unknown | Sends response to ppu over DMA. | |
0x1158 | process_eid | unknown | Decrypts EID0. | |
0x1438 | prepare_print | unknown | Prepares debug output. | |
0x1440 | debug_print | unknown | As the name already states... (this outputs over DMA) | |
0x17f0 | - | - | AES 1 Part of aes implementation. | |
0x1c48 | aes_encrypt_ecb | - | AES 2 Part of aes implementation. | |
0x1df0 | cellCryptoSpuAesCbcCfb128Decrypt | - | AES 3 Probably part of aes implementation. | |
0x20f0 | aes_omac1 | - | AES 4 Probably part of aes implementation. | |
0x2300 | aes_set_key_dec | - | AES 5 Probably part of aes implementation. | |
0x2418 | aes_decrypt_ecb | - | AES 6 Part of aes implementation. | |
0x2608 | aes_decrypt_ecb_aligned | - | AES 7 Part of aes implementation. | |
0x30c0 | do_dma | ls_addr:$4, dma_effective_addr:$5, size:$6, tag_id:$7, unk0:$8, unk1:$9 | Used to dma data in and out of the isolated module's LS. | |
0x3168 | write_tag_mask_bit | mask_bit:$4 | Used to set a specific bit in MFC_WrTagMask. |
Disasm
The complete disassembly is available at [1].