Talk:Flash: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
m (Dark Mode)
 
(94 intermediate revisions by 18 users not shown)
Line 1: Line 1:
It would be great if the admin could install SyntaxHighlight extension to media wiki
= List of files on NOR Flash (OLD/historic) =
 
'''Note: <span style="color:red!important;">this is the old table that defyboy made<!--// and kept here for crossreference/backup/historic reasons - don't delete!//-->, a more current one with absolute values and for all firmware versions is on the [[Flash|Flash mainpage]]</span>'''
http://www.mediawiki.org/wiki/Extension:ASHighlight
 
on my list of things to do [[User:Admin|Admin]] 21:25, 11 April 2011 (CDT)
 
 
----
=== observations comparing dumps ===
 
 
Encrypted files appear to have a header:
<pre>
From metldr
 
00000840  00 00 0E 8E 99 87 3B C7 15 F2 80 80 9C 30 22 25  ...Ž™‡;Ç.ò€€œ0"%
00000850  00 00 0E 8E 78 A5 61 E0 17 72 6E F7 A7 1B 41 AB  ...Žx¥aà.rn÷§.A«
 
00000840  00 00 0E 8E 99 87 3B C7 15 F2 80 80 9C 30 22 25  ...Ž™‡;Ç.ò€€œ0"%
00000850  00 00 0E 8E 81 2E 00 A9 59 75 01 CC C1 72 D5 50  ...Ž...©Yu.ÌÁrÕP
 
From bootldr
 
00FC0000  00 00 2F 4B 53 92 1C E7 F7 33 41 76 9B 7A 1E D6  ../KS’.ç÷3Av›z.Ö
00FC0010  00 00 2F 4B 78 A5 61 E0 17 72 6E F7 A7 1B 41 AB  ../Kx¥aà.rn÷§.A«
 
00FC0000  00 00 2F 4B CB 9E 15 24 28 B4 4F D2 F9 3F BC 43  ../KËž.$(´OÒù?¼C
00FC0010  00 00 2F 4B 81 2E 00 A9 59 75 01 CC C1 72 D5 50  ../K...©Yu.ÌÁrÕP
</pre>
also to note that these values are found within the eeid region.
 
------------
 
Also noted that near the end of region 1 there seems to be this recurring pattern, it repeats the following 20 bytes 199 times
 
00EFD740                          0A 9E F8 79 2B 99 37 5A          .žøy+™7Z
00EFD750  53 49 92 D7 A5 BD 99 2A 26 2D 39 B8              SI’×¥½™*&-9¸
 
then it has these 15 bytes:
 
00EFE6D0              8C 37 E4 F4 CC CC 59 02 D0 FA B8 A5      Œ7äôÌÌY.Ðú¸¥
00EFE6E0  1E 42 98 DD 54 AF 8D 5E                          .B˜ÝT¯.^
 
Then it repeats the first 20 bytes 199 times, looks like the tried to hide it?
 
same on the other dump but different data
 
00EFD740                          17 D8 FE B6 56 B6 84 F2          .Øþ¶V¶„ò
00EFD750  5E 17 E9 5D B1 80 E1 D2 00 6F 88 26              ^.é]±€áÒ.oˆ&
 
00EFE6D0              E7 BF FF DA E2 2E A3 B8 73 79 76 C8      ç¿ÿÚâ.£¸syvÈ
00EFE6E0  B1 72 B3 E7 B9 33 70 F6                          ±r³ç¹3pö
</pre>
 
----
<pre>
Done some work on decoding region 2 today:
Region 2 seems to = vflash partition table? These might be the first 2 regions?
partition table is 4096 bytes.
Format:
16 bytes 00's
16 bytes magic: 00 00 00 00 0F AC E0 FF 00 00 00 00 DE AD FA CE
8 bytes 0x03
8 bytes 0x02 (number of paritions?)
144 bytes 00's
Partition entries:
8 bytes entry point (entry point * 0x200) relative to 0x00 on flash
8 bytes entry length (entry length * 0x200)
32 bytes 10 70 00 00 01 00 00 01 00 00 00 00 00 00 00 03 10 70 00 00 02 00 00 01 00 00 00 00 00 00 00 03
96 bytes 00's
</pre>
 
----
 
sample of my flash:
http://www.megaupload.com/?d=J5UKO3HX
 
 
----
 
=== norunpack ===
Changed version for Progskeet: http://pastebin.com/HNvCbF7d
 
 
----
 
 
 
=== List of files on NOR Flash ===


The following is a list of files stored in NOR Flash
The following is a list of files stored in NOR Flash
Line 239: Line 152:




=== metldr revision ===
There are are least 8 different metldr revisions (pre 3.60 aka metldr.2), only 3.50+ have the metldr version check.


====metldr+bootldr sizes====
----


{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"
|- bgcolor="#cccccc"
! rowspan="2" | Datecode / Manufacturing date !! colspan="2" | metldr offset !! colspan="2" | bootldr offset !! rowspan="2" | Notes
|-
! 0x81E&nbsp;(NOR)<br />0x4081E&nbsp;(NAND) !! 0x842&nbsp;(NOR)<br />0x40842&nbsp;(NAND) !! 0xFC0002&nbsp;(NOR)<br />0x0&nbsp;(NAND) !! 0xFC0012&nbsp;(NOR)<br />0x12&nbsp;(NAND)
|-
|  || EE 10 || 0E DD || 2A 3F || 2A 3F || <!--//bluemimmo: NAND FAT//--><span style="color:#30C030; background-color:#FFFFFF; ">OK</span>
|-
|  || E8 90 || 0E 85 || 2F 13 || 2F 13 || <!--//Val, Freeplex//--><span style="color:#30C030; background-color:#FFFFFF; ">OK</span>
|-
|  || E8 D0 || 0E 89 || 2E AB || 2E AB || <!--//Abkarino, anger, defyboy//--><span style="color:#30C030; background-color:#FFFFFF; ">OK</span>
<!--//
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F


00000810  00 00 00 00 00 00 00 40 00 00 00 00 00 00 E8 D0  .......@......èÐ
00000820  6D 65 74 6C 64 72 00 00 00 00 00 00 00 00 00 00  metldr..........
00000830  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000840  00 00 0E 89 43 B6 EF 4A E2 0F 74 00 C8 80 9E 53  ...‰C¶ïJâ.t.È€žS
00000850  00 00 0E 89 57 D3 B7 B1 88 EF 91 C6 67 C8 DB 06  ...‰WÓ·±ˆï‘ÆgÈÛ.
//-->
|-
| CECHH (DIA-001) || E8 E0 || 0E 8A || 2E F4 || 2E F4 || <!--//akex: CECHH DIA-001 with Spansion S29GL128N90TFIR2 //--><span style="color:#30C030; background-color:#FFFFFF; ">OK</span>
|-
|  || E9 20 || 0E 8E || 2F 4B || 2F 4B || <!--//ogy, Ir0nman, nice69, Marcocanc//--><span style="color:#30C030; background-color:#FFFFFF; ">OK</span>
|-
| CECH-250.B (JTP-001) with 3.56 from factory - <span style="color:#30C030; background-color:#FFFFFF; ">datecode 1A</span> || E9 60 || 0E 92 || 2F 53 || 2F 53 || <!--//Freemagne, ciariello, aftab//--><span style="color:#30C030; background-color:#FFFFFF; ">OK</span>
|-
| CECH2504A (JTP-001) with <span style="color:#F06060; background-color:#FFFFFF; ">3.56&nbsp;from&nbsp;factory</span> - <span style="color:#F06060; background-color:#FFFFFF; ">datecode&nbsp;1B</span> || E9 60 || 0E 92 || 2F 5B || 2F 5B || <!--//cech-2501a-jtp-001-1b, raymanvtw(RLOD+poweroff when try downgrade to 355):CECH2504A (JTP-001) with 3.56 from factory - datecode 1B //--><span style="color:#F06060; background-color:#FFFFFF; ">(RLOD+)poweroff&nbsp;@&nbsp;downgrade&nbsp;355</span>
|-
| CECHJ (DIA-002) || EA 60 || 0E A2 || 2E E3 || 2E E3 || <!--//cechj 40gb / chipps3ve: DIA-002 with Spansion //--><span style="color:#30C030; background-color:#FFFFFF; ">OK</span>
|-
| CECHC (COK-002) with 1.00&nbsp;from&nbsp;factory || EB F0 || 0E BB || 30 44 || 30 44 || <!--//euss: NAND FAT//--><span style="color:#30C030; background-color:#FFFFFF; ">OK</span>
|-
| CECH2504B (JSD-001), with <span style="color:#F06060; background-color:#FFFFFF; ">3.60&nbsp;from&nbsp;factory</span> - <span style="color:#F06060; background-color:#FFFFFF; ">datecode&nbsp;1B</span><br />CECH3012A (KTE-001), with <span style="color:#F06060; background-color:#FFFFFF; ">3.65&nbsp;from&nbsp;factory</span> - <span style="color:#F06060; background-color:#FFFFFF; ">datecode&nbsp;[N.A.]</span> || F9 20 || 0F 8E || 2F FB || 2F FB || <small>"metldr.2"</small><br /><!--// Nodial2ne:CECH-3012A - Date Code [N.A.] factory 3.65 //--><span style="color:#F06060; background-color:#FFFFFF; ">(RLOD+)poweroff&nbsp;@&nbsp;downgrade&nbsp;355</span>
|-
|}


= NAND reference=
= new metldr.2 =
most of the information on this page if based on NOR dumps, this section is for NAND specifics
Seen on CECH2504B (JSD-001), with 3.60 from factory - datecode 1B


== NAND reference (euss) ==
<pre>
CECHC-04/COK-002 Pal EU launchmodel with OFW 3.15 updated to MFW 3.15 ([[User:Euss|Euss]])
  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
  00000800  00 00 00 01 00 00 00 01 00 00 00 00 00 02 E8 00  ..............è.
  00000810  00 00 00 00 00 00 00 40 00 00 00 00 00 00 F9 20  .......@......ù
  00000820  6D 65 74 6C 64 72 2E 32 00 00 00 00 00 00 00 00  metldr.2........
  00000830  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  00000840  00 00 0F 8E 6E D7 BC D8 1F 11 EA 34 42 5F 9B 9D  ...Žn×¼Ø..ê4B_›.
  00000850  00 00 0F 8E 8C 21 5D 5F D0 B4 50 07 6A DD 21 DF  ...ŽŒ!]_дP.jÝ!ß
  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
  0002F070  00 00 00 01 00 85 00 0B 10 24 39 B7 2C BA A8 5E  .....…...$9·,º¨^
</pre>


=== Bootldr ===
----
<pre>    Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
    00000000  6D 61 73 6B 65 64 20 42 4F 4F 54 4C 44 52 20 20  masked BOOTLDR 
    00000010  30 78 34 30 30 30 30 20 73 69 7A 65 20 20 20 20  0x40000 size            if dumped from GameOS, the first 40000 bytes are masked (cut off) by HV
    00000020  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    00000030  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ</pre>


=== ROS0 ===
= vflash partition table =
[http://www.multiupload.com/LTVVYR2S5G 315-ROS0-coreos-c0000-7c0000.rar (4.81 MB)]
<pre>
<pre>   ROS0 on NAND:
Done some work on decoding region 2 today:
   
Region 2 seems to = vflash partition table? These might be the first 2 regions?
  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
partition table is 4096 bytes.
 
Format:
  000C0000  00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 20  ....... .......  
16 bytes 00's
  000C0010  00 00 00 00 00 E0 00 00 00 00 00 00 00 00 00 00  .....à..........
16 bytes magic: 00 00 00 00 0F AC E0 FF 00 00 00 00 DE AD FA CE
  000C0020  00 00 00 00 00 00 00 00 00 00 00 00 00 6F FF E0  .............oÿà
8 bytes 0x03
  000C0030  00 00 00 01 00 00 00 17 00 00 00 00 00 6F FF E0  .............oÿà
8 bytes 0x02 (number of paritions?)
  000C0040  00 00 00 00 00 00 04 60 00 00 00 00 00 00 44 98  .......`......D˜
144 bytes 00's
  000C0050  61 69 6D 5F 73 70 75 5F 6D 6F 64 75 6C 65 2E 73  aim_spu_module.s
Partition entries:
  000C0060  65 6C 66 00 00 00 00 00 00 00 00 00 00 00 00 00  elf.............
8 bytes entry point (entry point * 0x200) relative to 0x00 on flash
  000C0070  00 00 00 00 00 00 49 00 00 00 00 00 00 01 DA E4  ......I.......Úä
8 bytes entry length (entry length * 0x200)
  000C0080  61 70 70 6C 64 72 00 00 00 00 00 00 00 00 00 00  appldr..........
32 bytes 10 70 00 00 01 00 00 01 00 00 00 00 00 00 00 03 10 70 00 00 02 00 00 01 00 00 00 00 00 00 00 03
  000C0090  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
96 bytes 00's
  000C00A0  00 00 00 00 00 02 24 00 00 00 00 00 00 04 00 00  ......$.........
  000C00B0  63 72 65 73 65 72 76 65 64 5F 30 00 00 00 00 00  creserved_0.....
  000C00C0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C00D0  00 00 00 00 00 06 24 00 00 00 00 00 00 00 22 A0  ......$......."
  000C00E0  64 65 66 61 75 6C 74 2E 73 70 70 00 00 00 00 00  default.spp.....
  000C00F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C0100  00 00 00 00 00 06 46 A0 00 00 00 00 00 07 FC 48  ......F ......üH
  000C0110  65 6D 65 72 5F 69 6E 69 74 2E 73 65 6C 66 00 00  emer_init.self..
  000C0120  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C0130  00 00 00 00 00 0E 43 00 00 00 00 00 00 07 0F 94  ......C........”
  000C0140  65 75 72 75 73 5F 66 77 2E 62 69 6E 00 00 00 00 eurus_fw.bin....
  000C0150  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C0160  00 00 00 00 00 15 52 A0 00 00 00 00 00 06 16 00  ......R ........
  000C0170  68 64 64 5F 63 6F 70 79 2E 73 65 6C 66 00 00 00  hdd_copy.self...
  000C0180  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C0190  00 00 00 00 00 1B 68 A0 00 00 00 00 00 01 2E 44  ......h .......D
  000C01A0  69 73 6F 6C 64 72 00 00 00 00 00 00 00 00 00 00  isoldr..........
  000C01B0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C01C0  00 00 00 00 00 1C 97 00 00 00 00 00 00 03 E8 28  ......—.......è(
  000C01D0  6C 76 30 00 00 00 00 00 00 00 00 00 00 00 00 00  lv0.............
  000C01E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C01F0  00 00 00 00 00 20 7F 40 00 00 00 00 00 12 B1 70 ..... .@......±p
  000C0200  6C 76 31 2E 73 65 6C 66 00 00 00 00 00 00 00 00  lv1.self........
  000C0210  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C0220  00 00 00 00 00 33 30 C0 00 00 00 00 00 01 E5 CC  .....30À......åÌ
  000C0230  6C 76 31 6C 64 72 00 00 00 00 00 00 00 00 00 00  lv1ldr..........
  000C0240  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C0250  00 00 00 00 00 35 16 A0 00 00 00 00 00 01 6D A0  .....5. ......m
  000C0260  6C 76 32 6C 64 72 00 00 00 00 00 00 00 00 00 00  lv2ldr..........
  000C0270  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C0280  00 00 00 00 00 36 84 40 00 00 00 00 00 16 EE B8  .....6„@......î¸
  000C0290  6C 76 32 5F 6B 65 72 6E 65 6C 2E 73 65 6C 66 00  lv2_kernel.self.
  000C02A0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C02B0  00 00 00 00 00 4D 73 00 00 00 00 00 00 00 80 8C  .....Ms.......€Œ
  000C02C0  6D 63 5F 69 73 6F 5F 73 70 75 5F 6D 6F 64 75 6C  mc_iso_spu_modul
  000C02D0  65 2E 73 65 6C 66 00 00 00 00 00 00 00 00 00 00  e.self..........
  000C02E0  00 00 00 00 00 4D F3 A0 00 00 00 00 00 00 88 B8  .....Mó ......ˆ¸
  000C02F0  6D 65 5F 69 73 6F 5F 73 70 75 5F 6D 6F 64 75 6C  me_iso_spu_modul
  000C0300  65 2E 73 65 6C 66 00 00 00 00 00 00 00 00 00 00  e.self..........
  000C0310  00 00 00 00 00 4E 7C 60 00 00 00 00 00 00 5D B0  .....N|`......]°
  000C0320  73 62 5F 69 73 6F 5F 73 70 75 5F 6D 6F 64 75 6C  sb_iso_spu_modul
  000C0330  65 2E 73 65 6C 66 00 00 00 00 00 00 00 00 00 00  e.self..........
  000C0340  00 00 00 00 00 4E DA 20 00 00 00 00 00 01 53 2C  .....NÚ ......S,
  000C0350  73 63 5F 69 73 6F 2E 73 65 6C 66 00 00 00 00 00 sc_iso.self.....
  000C0360  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C0370  00 00 00 00 00 50 2D 60 00 00 00 00 00 00 00 08  .....P-`........
  000C0380  73 64 6B 5F 76 65 72 73 69 6F 6E 00 00 00 00 00  sdk_version.....
  000C0390  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C03A0  00 00 00 00 00 50 2D 80 00 00 00 00 00 00 D7 F0  .....P-€......×ð
  000C03B0  73 70 70 5F 76 65 72 69 66 69 65 72 2E 73 65 6C  spp_verifier.sel
  000C03C0  66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  f...............
  000C03D0  00 00 00 00 00 51 05 80 00 00 00 00 00 00 FA CC  .....Q.€......úÌ
  000C03E0  73 70 75 5F 70 6B 67 5F 72 76 6B 5F 76 65 72 69  spu_pkg_rvk_veri
  000C03F0  66 69 65 72 2E 73 65 6C 66 00 00 00 00 00 00 00  fier.self.......
  000C0400  00 00 00 00 00 52 00 60 00 00 00 00 00 00 5C 94  .....R.`......\”
  000C0410  73 70 75 5F 74 6F 6B 65 6E 5F 70 72 6F 63 65 73  spu_token_proces
  000C0420  73 6F 72 2E 73 65 6C 66 00 00 00 00 00 00 00 00  sor.self........
  000C0430  00 00 00 00 00 52 5D 00 00 00 00 00 00 00 65 D0  .....R].......eÐ
  000C0440  73 70 75 5F 75 74 6F 6B 65 6E 5F 70 72 6F 63 65  spu_utoken_proce
  000C0450  73 73 6F 72 2E 73 65 6C 66 00 00 00 00 00 00 00  ssor.self.......
  000C0460  00 00 00 00 00 52 C2 E0 00 00 00 00 00 00 C0 78  .....RÂà......Àx
  000C0470  73 76 5F 69 73 6F 5F 73 70 75 5F 6D 6F 64 75 6C  sv_iso_spu_modul
  000C0480  65 2E 73 65 6C 66 00 00 00 00 00 00 00 00 00 00  e.self..........
</pre>
</pre>


=== ROS1 ===
 
[http://www.multiupload.com/1Z58MNC34V 315-ROS1-coreos-7c0000-ec0000.rar (4.81 MB)]
----
<pre>  ROS1 on NAND:
 
   
 
  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
=Dumping your flash=
 
There are many ways you can dump your flash you can choose the way that best fits you, there are some persons studing the flash.. If you can help providing a dump (specially if you have a debug console) search for those persons in IRC Efnet #ps3dev
  007C0000  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
==Payload==
  007C0010  00 00 00 00 00 00 00 00 00 00 00 00 00 6F FF E0  .............oÿà
Uncomment '''dump_dev_flash()''' in graf_payloads compile and run the payload
  007C0020  00 00 00 01 00 00 00 17 00 00 00 00 00 6F FF E0  .............oÿà
 
  007C0030  00 00 00 00 00 00 04 60 00 00 00 00 00 04 00 00  .......`........
see [[Graf's_PSGroove_Payload]] for more info
  007C0040  63 72 65 73 65 72 76 65 64 5F 30 00 00 00 00 00  creserved_0.....
 
  007C0050  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
==Linux==
  007C0060  00 00 00 00 00 04 04 60 00 00 00 00 00 00 00 08  .......`........
 
  007C0070  73 64 6B 5F 76 65 72 73 69 6F 6E 00 00 00 00 00  sdk_version.....
Using graf_chokolo kernel with '''/dev/ps3nflasha''' access
  007C0080  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 
  007C0090  00 00 00 00 00 04 04 80 00 00 00 00 00 01 E5 CC  .......€......åÌ
<pre>
  007C00A0  6C 76 31 6C 64 72 00 00 00 00 00 00 00 00 00 00  lv1ldr..........
dd if=/dev/ps3nflasha of=NOR.BIN bs=1024
  007C00B0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C00C0  00 00 00 00 00 05 EA 80 00 00 00 00 00 01 6D A0  ......ê€......m
  007C00D0  6C 76 32 6C 64 72 00 00 00 00 00 00 00 00 00 00  lv2ldr..........
  007C00E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C00F0  00 00 00 00 00 07 58 80 00 00 00 00 00 01 2E 44  ......X€.......D
  007C0100  69 73 6F 6C 64 72 00 00 00 00 00 00 00 00 00 00  isoldr..........
  007C0110  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C0120  00 00 00 00 00 08 87 00 00 00 00 00 00 01 DA E4  ......‡.......Úä
  007C0130  61 70 70 6C 64 72 00 00 00 00 00 00 00 00 00 00  appldr..........
  007C0140  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C0150  00 00 00 00 00 0A 61 E4 00 00 00 00 00 00 FA CC  ......aä......úÌ
  007C0160  73 70 75 5F 70 6B 67 5F 72 76 6B 5F 76 65 72 69  spu_pkg_rvk_veri
  007C0170  66 69 65 72 2E 73 65 6C 66 00 00 00 00 00 00 00  fier.self.......
  007C0180  00 00 00 00 00 0B 5C B0 00 00 00 00 00 00 5C 94  ......\°......\”
  007C0190  73 70 75 5F 74 6F 6B 65 6E 5F 70 72 6F 63 65 73  spu_token_proces
  007C01A0  73 6F 72 2E 73 65 6C 66 00 00 00 00 00 00 00 00  sor.self........
  007C01B0  00 00 00 00 00 0B B9 44 00 00 00 00 00 00 65 D0  ......¹D......eÐ
  007C01C0  73 70 75 5F 75 74 6F 6B 65 6E 5F 70 72 6F 63 65  spu_utoken_proce
  007C01D0  73 73 6F 72 2E 73 65 6C 66 00 00 00 00 00 00 00  ssor.self.......
  007C01E0  00 00 00 00 00 0C 1F 14 00 00 00 00 00 01 53 2C  ..............S,
  007C01F0  73 63 5F 69 73 6F 2E 73 65 6C 66 00 00 00 00 00  sc_iso.self.....
  007C0200  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C0210  00 00 00 00 00 0D 72 40 00 00 00 00 00 00 44 98  [email protected]˜
  007C0220  61 69 6D 5F 73 70 75 5F 6D 6F 64 75 6C 65 2E 73  aim_spu_module.s
  007C0230  65 6C 66 00 00 00 00 00 00 00 00 00 00 00 00 00  elf.............
  007C0240  00 00 00 00 00 0D B6 D8 00 00 00 00 00 00 D7 F0  ......¶Ø......×ð
  007C0250  73 70 70 5F 76 65 72 69 66 69 65 72 2E 73 65 6C  spp_verifier.sel
  007C0260  66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  f...............
  007C0270  00 00 00 00 00 0E 8E C8 00 00 00 00 00 00 80 8C  ......ŽÈ......€Œ
  007C0280  6D 63 5F 69 73 6F 5F 73 70 75 5F 6D 6F 64 75 6C  mc_iso_spu_modul
  007C0290  65 2E 73 65 6C 66 00 00 00 00 00 00 00 00 00 00  e.self..........
  007C02A0  00 00 00 00 00 0F 0F 54 00 00 00 00 00 00 88 B8  .......T......ˆ¸
  007C02B0  6D 65 5F 69 73 6F 5F 73 70 75 5F 6D 6F 64 75 6C  me_iso_spu_modul
  007C02C0  65 2E 73 65 6C 66 00 00 00 00 00 00 00 00 00 00  e.self..........
  007C02D0  00 00 00 00 00 0F 98 0C 00 00 00 00 00 00 C0 78  ......˜.......Àx
  007C02E0  73 76 5F 69 73 6F 5F 73 70 75 5F 6D 6F 64 75 6C  sv_iso_spu_modul
  007C02F0  65 2E 73 65 6C 66 00 00 00 00 00 00 00 00 00 00  e.self..........
  007C0300  00 00 00 00 00 10 58 84 00 00 00 00 00 00 5D B0  ......X„......]°
  007C0310  73 62 5F 69 73 6F 5F 73 70 75 5F 6D 6F 64 75 6C  sb_iso_spu_modul
  007C0320  65 2E 73 65 6C 66 00 00 00 00 00 00 00 00 00 00  e.self..........
  007C0330  00 00 00 00 00 10 B6 34 00 00 00 00 00 00 22 A0  ......¶4......"
  007C0340  64 65 66 61 75 6C 74 2E 73 70 70 00 00 00 00 00  default.spp.....
  007C0350  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C0360  00 00 00 00 00 10 D9 00 00 00 00 00 00 12 B1 70  ......Ù.......±p
  007C0370  6C 76 31 2E 73 65 6C 66 00 00 00 00 00 00 00 00  lv1.self........
  007C0380  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C0390  00 00 00 00 00 23 8A 80 00 00 00 00 00 03 E8 28  .....#Š€......è(
  007C03A0  6C 76 30 00 00 00 00 00 00 00 00 00 00 00 00 00  lv0.............
  007C03B0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C03C0  00 00 00 00 00 27 72 A8 00 00 00 00 00 16 EE B8  .....'r¨......î¸
  007C03D0  6C 76 32 5F 6B 65 72 6E 65 6C 2E 73 65 6C 66 00  lv2_kernel.self.
  007C03E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C03F0  00 00 00 00 00 3E 61 60 00 00 00 00 00 07 0F 94  .....>a`.......”
  007C0400  65 75 72 75 73 5F 66 77 2E 62 69 6E 00 00 00 00  eurus_fw.bin....
  007C0410  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C0420  00 00 00 00 00 45 70 F4 00 00 00 00 00 07 FC 48  .....Epô......üH
  007C0430  65 6D 65 72 5F 69 6E 69 74 2E 73 65 6C 66 00 00  emer_init.self..
  007C0440  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C0450  00 00 00 00 00 4D 6D 3C 00 00 00 00 00 06 16 00  .....Mm<........
  007C0460  68 64 64 5F 63 6F 70 79 2E 73 65 6C 66 00 00 00  hdd_copy.self...
  007C0470  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
</pre>
</pre>


=== Versioning in ROS0 ===
==Hardware==
<pre>  versioning in ROS0 of NAND:
 
   
see [[Hardware flashing]]
  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
 
== Dump NAND/NOR from GameOS ==
  005C2D90  33 31 35 2E 30 30 30 0A 00 00 00 00 00 00 00 00  315.000.........
precompiled : [http://gitbrew.org/~glevand/ps3/pkgs/dump_flash.pkg dump_flash.pkg]  // backup/mirror: [http://www.multiupload.com/Y1G1G7E4J4 dump_flash.pkg (70.48 KB)]<br />
  005C2DA0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
source: [http://www.multiupload.com/Y9VI6SHN0L dump_flash-src.rar (2.33 KB)] <br />
  005C2DB0  53 43 45 00 00 00 00 02 00 01 00 01 00 00 02 30  SCE............0
 
Make sure USB stick is FAT32 with enough free space (16MB per NOR dump, 256MB per NAND dump)
 
'''remarks:'''
 
* NAND dumps are 239MB because HV masks bootldr, see [[Hardware_flashing#Difference_between_hardware_dumps_and_software_dumps | Difference between hardware dumps and software dumps]]
* trying to read beyond 0xEFC0000-0xFFFFFFF on NAND systems (a region filled with FF's on consoles without OtherOS) results in panic
 
= NOR Unpacking // NOR Unpkg =
 
<pre>
/*
   # ../norunpkg norflash.bin norflash
  unpacking asecure_loader (size: 190xxx bytes)...
  unpacking eEID (size: 65536 bytes)...
  unpacking cISD (size: 2048 bytes)...
  unpacking cCSD (size: 2048 bytes)...
  unpacking trvk_prg0 (size: 131072 bytes)...
  unpacking trvk_prg1 (size: 131072 bytes)...
  unpacking trvk_pkg0 (size: 131072 bytes)...
  unpacking trvk_pkg1 (size: 131072 bytes)...
  unpacking ros0 (size: 7340032 bytes)...
  unpacking ros1 (size: 7340032 bytes)...
  unpacking cvtrm (size: 262144 bytes)...
*/
 
// Copyright 2010      Sven Peter
// Licensed under the terms of the GNU GPL, version 2
// http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
// nor modifications by rms.
 
#include "tools.h"
#include "types.h"
 
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/stat.h>
 
#ifdef WIN32
#define MKDIR(x,y) mkdir(x)
#else
#define MKDIR(x,y) mkdir(x,y)
#endif
 
u8 *pkg = NULL;
 
static void unpack_file(u32 i)
{
        u8 *ptr;
        u8 name[33];
        u64 offset;
        u64 size;
 
        ptr = pkg + 0x10 + 0x30 * i;
 
        offset = be64(ptr + 0x00);
        size  = be64(ptr + 0x08);
 
        memset(name, 0, sizeof name);
        strncpy((char *)name, (char *)(ptr + 0x10), 0x20);
 
        printf("unpacking %s (size: %d bytes)...\n", name, size);
        memcpy_to_file((char *)name, pkg + offset, size);
}
 
static void unpack_pkg(void)
{
        u32 n_files;
        u64 size;
        u32 i;
 
        n_files = be32(pkg + 4);
        size = be64(pkg + 8);
 
        for (i = 0; i &lt; n_files; i++)
                unpack_file(i);
}
 
int main(int argc, char *argv[])
{
        if (argc != 3)
                fail("usage: norunpkg filename.nor target");
 
        pkg = mmap_file(argv[1]);
 
        /* kludge for header, i do not do sanity checks at the moment */
        pkg += 1024;
 
        MKDIR(argv[2], 0777);
 
        if (chdir(argv[2]) != 0)
                fail("chdir");
 
        unpack_pkg();
 
        return 0;
}
</pre>
</pre>


=== Versioning in ROS1 ===
Source: http://rms.grafchokolo.com/?p=25
<preversioning in ROS1 of NAND:
 
   
Changed version for Progskeet: http://pastebin.com/HNvCbF7d
  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
= RMS - eEID splitter =
 
<pre>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
void
DumpEidData (FILE * pFile, int iInputSize, int iEidCount,
    char *pFilenamePrefix)
{
  FILE *pOutput;
  char *szFilename;
  char *szBuf;
  int iRes, iSize;
 
  printf ("dumping EID%d from eEID at %p, size %d (%x)..\n",
  iEidCount, pFile, iInputSize, iInputSize);
 
  szBuf = (char *) malloc (iInputSize + 1);
  szFilename = (char *) malloc (strlen (pFilenamePrefix) + 2);
 
  if (szBuf == NULL)
    {
      perror ("malloc");
      exit (1);
    };
 
  iSize = fread (szBuf, iInputSize, 1, pFile);
  sprintf (szFilename, "%s%d", pFilenamePrefix, iEidCount);
  pOutput = fopen (szFilename, "wb");
  iRes = fwrite (szBuf, iInputSize, 1, pOutput);
 
  if (iRes != iSize)
    {
      perror ("fwrite");
      exit (1);
    };
 
  free (szBuf);
}
 
int
main (int argc, char **argv)
{
  FILE *pFile;
  char *pPrefix;
 
  pFile = fopen (argv[1], "rb");
  if (pFile == NULL)
    {
    usage:
      printf ("usage: %s <eEID> <EID name prefix>\n", argv[0]);
      exit (1);
    }
 
   if (argc == 2 && argv[2] != NULL)
    {
      pPrefix = argv[2];
      goto usage;
    }
 
  fseek (pFile, 0x70, SEEK_SET);


  00800480  33 31 35 2E 30 30 30 0A 00 00 00 00 00 00 00 00  315.000.........
  if (pPrefix != NULL)
  00800490  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    {
  008004A0  53 43 45 00 00 00 00 02 00 00 00 01 00 00 01 F0  SCE............ð
      DumpEidData (pFile, 2144, 0, pPrefix);
      DumpEidData (pFile, 672, 1, pPrefix);
      DumpEidData (pFile, 1840, 2, pPrefix);
      DumpEidData (pFile, 256, 3, pPrefix);
      DumpEidData (pFile, 48, 4, pPrefix);
      DumpEidData (pFile, 2560, 5, pPrefix);
    }
  return 0;
}
</pre>
</pre>


=== RVK ===
Source: http://rms.grafchokolo.com/?p=59
<pre>  Revoke in NAND:    
 
         
 
  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
 
----
  00093800  00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 20  ....... .......
 
  00093810  00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00  ...... .........
 
  00093820  00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 40  ...............@
 
  00093830  53 43 45 00 00 00 00 02 00 00 00 02 00 00 00 00  SCE.............
= NAND reference=
  00093840  00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 40  ...............@
'''Note:''' Beyond VTRM/cell_ext_os_area is pretty much greyarea - needs crosschecking
  00093850  6E 27 DA DF 18 19 ED D0 26 30 FD 84 1D 5B 74 BB  n'Úß..íÐ&0ý„.[t»
 
  00093860  43 53 5F 5E 91 5A 82 48 E1 5B 76 C6 59 9F 1B 0D  CS_^‘Z‚Há[vÆYŸ..
== NAND reference (euss) ==
  00093870  3A 5E 73 19 73 59 24 A1 A7 A5 73 28 BC 50 12 93  :^s.sY$¡§¥s(¼P.“
CECHC-04/COK-002 Pal EU launchmodel with OFW 3.15 updated to MFW 3.15 ([[User:Euss|Euss]])
  00093880  10 B7 43 04 B5 01 A5 6C 01 AD 83 86 7B 10 1A 78  .·C.µ.¥l.­ƒ†{..x
  00093890  B5 55 E2 CC 52 4D E2 3D AE 7D F6 1B 37 13 63 34  µUâÌRMâ=®}ö.7.c4
  000938A0  50 58 C8 78 27 F9 30 9F 62 E7 0A CF C4 E2 4B C5  PXÈx'ù0Ÿbç.ÏÄâKÅ
  000938B0  4A FF 31 8A C7 3A A7 0A 91 86 E2 C8 4A 51 F7 7D  Jÿ1ŠÇ:§.‘†âÈJQ÷}
  000938C0  7B BF 28 FE F5 93 FA C3 DF E7 A9 F1 A1 92 C1 6F  {¿(þõ“úÃßç©ñ¡’Áo
  000938D0  F1 D8 94 E9 64 60 6D 36 22 61 2E 51 B5 C9 9F 6F  ñØ”éd`m6"a.QµÉŸo
  000938E0  BD C6 44 00 22 75 DC 2A 55 A5 E5 EC 2A 97 9A 4F  ½ÆD."uÜ*U¥åì*—šO
  000938F0  CA 21 38 F1 AA C8 98 29 4D 6A F7 CD 7B F6 04 B3  Ê!8ñªÈ˜)Mj÷Í{ö.³
  00093900  A0 F3 F8 C1 9B CB 9B 48 AE E9 5C CF A5 24 37 29  óøÁ›Ë›H®é\Ï¥$7)
  00093910  9B 10 02 8C 68 1B 4E AA B4 CF EE 81 3A C6 6E CB  ›..Œh.Nª´Ïî.:ÆnË
  00093920  66 99 F6 F9 55 AB 19 FA 43 70 BC E5 72 C4 56 AD  f™öùU«.úCp¼årÄV­
  00093930  64 AF DD 0B 17 03 4D EA 87 C5 AD BB 2C 7C B2 48  d¯Ý...Mê‡Å­»,|²H
  00093940  9A E9 D1 85 AA 30 87 B8 47 C3 8B C9 BC 42 E2 7D  šéÑ…ª0‡¸GËɼBâ}
  00093950  92 84 D2 03 68 F1 20 54 98 D1 0E 95 4B 54 E5 6E  ’„Ò.hñ T˜Ñ.•KTån
  00093960  1A 6C D6 2F 3E 3F E4 28 4A 0F 9E D4 99 3E E5 D8  .lÖ/>?ä(J.žÔ™>åØ
  00093970  6B 13 7B 19 B4 3A A6 64 56 08 05 D3 FE 1B 68 E1  k.{.´:¦dV..Óþ.há
  00093980  B6 38 2C 0C E1 DF 5F D5 0D EC 6E B6 2A 2F 63 77  ¶8,.áß_Õ.ìn¶*/cw
  00093990  F4 D2 EB 3B 87 DA 83 76 28 E8 9F 50 2C 84 4D 48  ôÒë;‡Úƒv(èŸP,„MH
  000939A0  64 C0 B1 DB C6 AE 81 22 1D 76 9F B9 F8 29 C0 C7  dÀ±ÛÆ®.".vŸ¹ø)ÀÇ
  000939B0  12 06 2A B1 BB 0D 2E 5A 29 BC 56 C6 F5 26 97 0D  ..*±»..Z)¼VÆõ&—.
  000939C0  01 06 CC BC 43 1E 8B 45 C8 20 29 B3 FD EB 30 1D  ..̼C.‹EÈ )³ýë0.
  000939D0  A2 CF 33 2D 09 07 08 6F 4A F3 34 5D DE 63 C0 A8  ¢Ï3-...oJó4]ÞcÀ¨
  000939E0  EE 31 3E 46 11 4F 8D 66 F1 15 74 E2 AC 88 C3 C7  î1>F.O.fñ.t⬈ÃÇ
  000939F0  19 C9 69 0A 9F 36 D7 BC 70 6B 79 32 53 FD 1F 8E  .Éi.Ÿ6×¼pky2Sý.Ž
  00093A00  6D 57 08 C2 CA 78 24 6A 20 3B 5A 98 C2 04 06 95  mW.ÂÊx$j ;Z˜Â..•
  00093A10  C7 E6 53 A5 AB 9C 02 2A 04 40 0B 00 DF 34 13 CF  ÇæS¥«œ.*.@..ß4.Ï
  00093A20  F3 74 FF B6 DB FA 9A A2 FD 4F 72 6B 3E 7E 37 04  ótÿ¶Ûúš¢ýOrk>~7.
  00093A30  00 00 00 03 00 00 00 02 00 01 00 00 00 00 00 00  ................
  00093A40  00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00  ................
  00093A50  8E 27 91 93 C8 6F 17 8A 22 FD C8 E1 76 E8 D8 18  Ž'‘“Èo.Š"ýÈávèØ.
  00093A60  62 8B FE F5 43 81 A8 09 01 C6 99 D6 EF CF 64 90  b‹þõC.¨..Æ™ÖïÏd.
  00093A70  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
</pre>


=== VTRM ===
=== VTRM ===
Line 582: Line 474:
   00EC29E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00EC29E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
     [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
     [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  00EF94B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  00EF94C0  39 17 52 0B 31 70 F5 05 02 5A C6 F8 81 F8 54 96  9.R.1põ..ZÆø.øT–      <-- 0x14 patterned data (table?)
  00EF94D0  2F EF F3 81 39 17 52 0B 31 70 F5 05 02 5A C6 F8  /ïó.9.R.1põ..ZÆø
    [...]
  00EFEFE0  02 5A C6 F8 81 F8 54 96 2F EF F3 81 39 17 52 0B  .ZÆø.øT–/ïó.9.R.
  00EFEFF0  31 70 F5 05 02 5A C6 F8 81 F8 54 96 2F EF F3 81  1põ..ZÆø.øT–/ïó.
  00EFF000  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  00EFF010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    [...]    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  00EFFFE0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  00EFFFF0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
</pre>
=== post VTRM / pre cell_ext_os_area ===
==== 00F00000 data area ====
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
  00F00000  2E B1 47 93 21 AD 45 5C 5B 32 A7 A7 E1 25 04 D0  .±G“!­E\[2§§á%.Ð
  00F00010  24 45 E1 7E 3C 38 AE 4A 1C 25 21 5B 05 2D A9 15  $Eá~<8®J.%![.-©.
    [...]   
  00F00FE0  34 7F 14 93 D2 8D C0 43 06 B7 10 18 BB 28 37 D2  4..“Ò.ÀC.·..»(7Ò
  00F00FF0  5B 11 B4 EB 5F 12 0A 98 BC 2B B4 60 A7 89 6F 84  [.´ë_..˜¼+´`§‰o„
</pre>
===== 00F01000 unreferenced area =====
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
  00F01000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  00F01010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  00F3FFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  00F3FFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 00F40000 data area ====
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
  00F40000  7E 8B 60 EE E4 2A 29 09 8F 5A E9 4E B8 7F 1E E2  ~‹`îä*)..ZéN¸..â
  00F40010  F2 B5 7C C7 03 40 5E EC 87 16 04 A2 26 50 7C C9  òµ|Ç.@^ì‡..¢&P|É
    [...]   
  00F401E0  AC D9 A9 C8 BE B7 0E EE 0C E7 1E 73 45 39 70 80  ¬Ù©È¾·.î.ç.sE9p€
  00F401F0  8C 6F 32 06 08 8B CE 3B 80 DE 68 59 D5 25 DD 5A  Œo2..‹Î;€ÞhYÕ%ÝZ
</pre>
===== 00F40200 unreferenced area =====
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
  00F40200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  00F40210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  00F41FE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  00F41FF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 00F42000 data area ====
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
  00F42000  4A 51 35 DF C9 14 A2 40 71 8D 0F 11 8B 50 42 CE  JQ5ßÉ.¢@q...‹PBÎ
  00F42010  28 92 B5 64 57 B0 1E D2 99 22 38 BC 7A 16 6A 83  (’µdW°.Ò™"8¼z.jƒ
    [...]                                                                        large date filled block region
  0C1657E0  D5 D5 EE 71 0A B2 72 41 05 05 0B 08 3A 8A 78 04  ÕÕîq.²rA....:Šx.
  0C1657F0  E9 2F 40 63 AA 3F 23 22 E9 9D B1 4B 54 11 B4 71  é/@cª?#"é.±KT.´q
</pre>
===== 0C165800 unreferenced area =====
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
  0C165800  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0C165810  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0D6C1FE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0D6C1FF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 0D6C2000 data area ====
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
  0D6C2000  3B BC 95 72 03 FD 48 1E F2 1C 66 65 0A FB FC EC  ;¼•r.ýH.ò.fe.ûüì
  0D6C2010  0D 61 5C A0 8F 8F 68 5B 05 A3 85 57 29 53 53 4B  .a\ ..h[.£…W)SSK
    [...]   
  0D6C9FE0  74 E5 42 98 6E EE E1 41 24 7B B5 FE B5 42 29 C0  tåB˜nîáA${µþµB)À
  0D6C9FF0  25 05 C0 2B EE 87 50 40 21 EC A6 E7 0D 5A 3C 2A  %.À+î‡P@!ì¦ç.Z<*
</pre>
===== 0D6CA000 unreferenced area =====
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
  0D6CA000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0D6CA010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0D6FFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0D6FFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 0D700000 data area ====
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
  0D700000  0E 23 53 34 75 48 81 0F C4 09 16 4C 6C 37 BA E9  .#S4uH..Ä..Ll7ºé
  0D700010  5F 51 D9 9A E2 BE 4C 71 AF 00 4C 96 33 DB D5 49  _QÙšâ¾Lq¯.L–3ÛÕI
    [...]   
  0D7001E0  8D 4C 8D CD FD D2 B5 52 78 6E 48 B0 88 14 43 36  .L.ÍýÒµRxnH°ˆ.C6
  0D7001F0  DA 88 EF 59 73 96 80 13 31 16 E0 CF EB 99 83 2D  ÚˆïYs–€.1.àÏ뙃-
</pre>
===== 0D700200 unreferenced area =====
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
  0D700200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0D700210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0D701FE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0D701FF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 0D702000 data area ====
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
  0D702000  3C E6 76 41 CE A4 82 BD A3 2B 41 26 1E 25 36 D1  <ævAΤ‚½£+A&.%6Ñ
  0D702010  CE B5 51 9C E2 AC A3 DA AB B5 16 13 CA 95 E4 D3  εQœâ¬£Ú«µ..Ê•äÓ
    [...]   
  0D891FE0  C3 CA 0D BB 30 7B D2 9A 6D 13 9C 36 BD E3 64 3A  ÃÊ.»0{Òšm.œ6½ãd:
  0D891FF0  97 FB 9B 9E FE 25 ED 76 FC 77 85 28 C1 CB 37 65  —û›žþ%ívüw…(ÁË7e
</pre>
===== 0D892000 unreferenced area =====
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
  0D892000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0D892010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E6FFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E6FFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 0E700000 data area ====
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
  0E700000  C7 D7 77 CD 69 D9 1A EC E4 3C F8 8F 25 A5 3E A9  Ç×wÍiÙ.ìä<ø.%¥>©
  0E700010  3D EC 43 30 89 1F 98 F1 3F BA F6 AF 9B F5 0E B2  =ìC0‰.˜ñ?ºö¯›õ.²
    [...]   
  0E7001D0  09 BC 15 00 64 27 85 8F 0F BC 40 B1 F1 57 61 60  .¼..d'…..¼@±ñWa`
  0E7001E0  A4 2B A9 75 E9 C3 25 49 EC 6B 82 10 EE E1 62 BD  ¤+©uéÃ%Iìk‚.îáb½
  0E7001F0  B1 A9 C1 69 36 69 14 A5 53 A4 6A 43 0F 37 45 E0  ±©Ái6i.¥S¤jC.7Eà
</pre>
===== 0E700200 unreferenced area =====
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
  0E700200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E700210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E701FE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E701FF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 0E702000 data area ====
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
  0E702000  7F 3A 86 47 F3 47 AF CC 28 F2 A7 A5 28 D1 A6 C2  .:†GóG¯Ì(ò§¥(ѦÂ
  0E702010  13 27 01 0A 33 74 05 FC CE E9 83 B8 72 99 29 09  .'..3t.üÎ郸r™).
    [...]   
  0E75A9E0  5D BF 1A 2E 80 FB 32 50 B2 55 42 34 53 F0 4C 09  ]¿..€û2P²UB4SðL.
  0E75A9F0  92 8B 75 84 D5 0E 3C D7 F2 72 43 B0 C9 A4 66 C8  ’‹u„Õ.<×òrC°É¤fÈ
</pre>
===== 0E75AA00 unreferenced area =====
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
  0E75AA00  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E75AA10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E77FFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E77FFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
</pre>


=== cell_ext_os_area ===
=== cell_ext_os_area ===
[[Flash:cell_ext_os_area]]
<pre>
<pre>
   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
Line 591: Line 645:
   0E780010  00 00 00 01 00 00 00 02 00 00 00 04 FF FF FF FF  ............ÿÿÿÿ
   0E780010  00 00 00 01 00 00 00 02 00 00 00 04 FF FF FF FF  ............ÿÿÿÿ
   0E780020  00 00 00 01 00 27 F8 40 FF FF FF FF FF FF FF FF  .....'ø@ÿÿÿÿÿÿÿÿ
   0E780020  00 00 00 01 00 27 F8 40 FF FF FF FF FF FF FF FF  .....'ø@ÿÿÿÿÿÿÿÿ
  0E780030  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E780040  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ  FF filled block region
  0E7801F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E780200  00 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF  ....ÿÿÿÿÿÿÿÿÿÿÿÿ
  0E780210  00 00 00 03 FF FF FF FF FF FF FF FF FF FF FF FF  ....ÿÿÿÿÿÿÿÿÿÿÿÿ
  0E780220  00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF  ..........ÿÿÿÿÿÿ
  0E780230  00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF  ............ÿÿÿÿ
  0E780240  00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF  ........ÿÿÿÿÿÿÿÿ
  0E780250  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ  FF filled block region
  0E7803E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E7803F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E780400  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  0E780410  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    [...]    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................  00 filled block region
  0E7807E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  0E7807F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
</pre>
</pre>


<pre>
=== OtherOS ===
  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
[[Flash:OtherOS]]
<pre>   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
    
    
  0E7807D0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  0E7807E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  0E7807F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   0E780800  1F 8B 08 08 C1 19 04 48 02 03 7A 49 6D 61 67 65  .‹..Á..H..zImage
   0E780800  1F 8B 08 08 C1 19 04 48 02 03 7A 49 6D 61 67 65  .‹..Á..H..zImage
   0E780810  2E 69 6E 69 74 72 64 2E 70 73 33 2E 62 69 6E 00  .initrd.ps3.bin.
   0E780810  2E 69 6E 69 74 72 64 2E 70 73 33 2E 62 69 6E 00  .initrd.ps3.bin.
Line 609: Line 679:
   0EB80000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0EB80000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0EB80010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0EB80010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ  large FF filled block region
  0EFFFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0EFFFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
=== bootldr ===
[[Flash:bootldr]] @ 0xF000000 - 0xF03FFFF
=== 0xF040000 - 0xFFFFFFF ===
<pre>
  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
  0F040000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0F040010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ  large FF filled block region (no data in it, only FF)
  0FFFFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0FFFFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
== NAND reference (CatisFine) ==
CECHB-02/COK-001 NTSC USA launchmodel with FW 3.55
=== VTRM ===
actual data differs, offsets same as euss
=== post VTRM / pre cell_ext_os_area ===
==== 00F00000 data area ====
actual data differs, offsets same as euss
===== 00F01000 unreferenced area =====
same as euss
==== 00F40000 data area ====
actual data differs, offsets same as euss
===== 00F40200 unreferenced area =====
same as euss
==== 00F42000 data area ====
actual data differs, also length of data differs from euss
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
  00F42000  EF 77 C9 58 60 A7 33 F2 4A F1 5C 44 52 63 F5 C2  ïwÉX`§3òJñ\DRcõÂ
  00F42010  65 0C 0D 08 3D BD 6F 86 C1 30 2D 9F DF 0F 4C BF  e...=½o†Á0-Ÿß.L¿
    [...]                                                                        large date filled block region
  0C1C19E0  A0 7C 08 A8 4F 24 A8 16 3F 70 81 73 0F A2 90 10   |.¨O$¨.?p.s.¢..
  0C1C19F0  C2 19 E6 CD 7D 60 D5 3A BB 6A 1C D3 EA 08 19 79  Â.æÍ}`Õ:»j.Óê..y
</pre>
===== 0C1C1A00 unreferenced area =====
with length of previous data area different, offset obviously differs from euss
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
  0C1C1A00  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0C1C1A10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ  large FF filled block region
  0D701FE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0D701FF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 0D702000 data area ====
with length of previous data area different, offset obviously differs from euss
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
  0D702000  74 0F 26 AA 49 22 3F 48 38 C6 B0 D6 3E 99 0E EF  t.&ªI"?H8Æ°Ö>™.ï
  0D702010  A6 96 C4 EC 63 C4 04 C3 25 44 88 8A AA F2 DB 16  ¦–ÄìcÄ.Ã%DˆŠªòÛ.
    [...]   
  0D74F1E0  E1 96 94 95 CF 6F FD 0C 7F 31 FD AF 2E E4 1A F5  á–”•Ïoý..1ý¯.ä.õ
  0D74F1F0  96 7A 2E AB 89 11 0A 06 4D E6 38 3E FC 71 3A D3  –z.«‰...Mæ8>üq:Ó
</pre>
===== 0D74F200 unreferenced area =====
with length of previous data area different, start offset obviously differs from euss
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
  0D74F200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0D74F210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0D6FFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0D6FFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 0D700000 data area ====
actual data differs, offsets same as euss
===== 0D700200 unreferenced area =====
same as euss
==== 0D702000 data area ====
actual data differs, also length of data differs from euss
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
  0D702000  74 0F 26 AA 49 22 3F 48 38 C6 B0 D6 3E 99 0E EF  t.&ªI"?H8Æ°Ö>™.ï
  0D702010  A6 96 C4 EC 63 C4 04 C3 25 44 88 8A AA F2 DB 16  ¦–ÄìcÄ.Ã%DˆŠªòÛ.
    [...]   
  0D74F1E0  E1 96 94 95 CF 6F FD 0C 7F 31 FD AF 2E E4 1A F5  á–”•Ïoý..1ý¯.ä.õ
  0D74F1F0  96 7A 2E AB 89 11 0A 06 4D E6 38 3E FC 71 3A D3  –z.«‰...Mæ8>üq:Ó
</pre>
===== 0D892000 unreferenced area =====
with length of previous data area different, start offset obviously differs from euss
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
  0D74F200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0D74F210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E6FFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E6FFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 0E700000 data area ====
actual data differs, offsets same as euss
===== 0E700200 unreferenced area =====
same as euss
==== 0E702000 data area ====
actual data differs, also length of data differs from euss
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
  0E702000  E5 6C BF E6 3D E4 09 47 EE 29 87 C4 5A E4 BE E4  ål¿æ=ä.Gî)‡ÄZä¾ä
  0E702010  C5 71 97 6F D2 F1 EF 1D 72 60 3D AF 8C 0A 1A FD  Åq—oÒñï.r`=¯Œ..ý
    [...]   
  0E75B9E0  47 26 0E 11 20 50 FB 0C 1B 34 9E F1 30 DB 26 CE  G&.. Pû..4žñ0Û&Î
  0E75B9F0  0B D5 75 71 55 F4 C6 97 49 B8 06 F5 3F 2C 76 8D  .ÕuqUôÆ—I¸.õ?,v.
</pre>
===== 0E75AA00 unreferenced area =====
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
  0E75BA00  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E75BA10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E77FFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E77FFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
=== cell_ext_os_area ===
No cell_ext_os_area magic present or header, FF filled instead
<pre>
  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
     
  0E780000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ  No cell_ext_os_area magic present
  0E780010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ  no header, FF filled instead
  0E780020  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E780030  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   
  0E780040  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ  FF filled block region same as euss
  0E7801F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
 
  0E780200  00 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF  ....ÿÿÿÿÿÿÿÿÿÿÿÿ
  0E780210  00 00 00 03 FF FF FF FF FF FF FF FF FF FF FF FF  ....ÿÿÿÿÿÿÿÿÿÿÿÿ
  0E780220  00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF  ..........ÿÿÿÿÿÿ  same as euss
  0E780230  00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF  ............ÿÿÿÿ
  0E780240  00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF  ........ÿÿÿÿÿÿÿÿ
 
  0E780250  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ  FF filled block region same as euss
  0E7803E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E7803F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
 
  0E780400  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E780410  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ  FF filled block region instead of 00 filled
  0E7807E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E7807F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
=== OtherOS ===
No Image.initrd.ps3.bin , FF filled instead
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
  0E780800  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E780810  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ  large FF filled block region
  0EFFFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0EFFFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
=== bootldr ===
[[Flash:bootldr]] @ 0xF000000 - 0xF03FFFF
=== 0xF040000 - 0xFFFFFFF ===
same as euss
== NAND reference (DECHA) ==
DECHA-01/COK-001 nonretail model with FW 3.50 and FW 3.60
=== VTRM ===
actual data differs, offsets differ in last section from euss
=== post VTRM / pre cell_ext_os_area ===
==== 00F00000 data area ====
start offset same, length differs from euss
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
  00F00000  1C 4D F8 6C 8E EC DD F4 3F F4 BA 77 B7 41 9F AA  .MølŽìÝô?ôºw·AŸª
  00F00010  57 CA 8D F4 53 60 0D 9C FB 3D C2 C7 26 1B 69 24  WÊ.ôS`.œû=ÂÇ&.i$
    [...]   
  068861E0  FA 79 61 07 C5 34 B1 44 F6 18 37 ED 94 ED 0D 11  úya.Å4±Dö.7í”í..
  068861F0  D4 8F 05 CF 6B C4 18 F8 B9 F0 33 EC 77 A4 70 8A  Ô..ÏkÄ.ø¹ð3ìw¤pŠ
</pre>
===== 06886200 unreferenced area =====
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
  06886200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  06886210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  068863E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  068863F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
Note: the rest of total of datasections differ or the dump is invalid with FF patterned blocks of missing data
=== cell_ext_os_area ===
No cell_ext_os_area magic present or header, FF filled instead
<pre>
  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
     
  0E780000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ  No cell_ext_os_area magic present
  0E780010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ  no header, FF filled instead
  0E780020  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E780030  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   
  0E780040  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ  FF filled block region same as euss
  0E7801F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
 
  0E780200  00 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF  ....ÿÿÿÿÿÿÿÿÿÿÿÿ
  0E780210  00 00 00 03 FF FF FF FF FF FF FF FF FF FF FF FF  ....ÿÿÿÿÿÿÿÿÿÿÿÿ
  0E780220  00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF  ..........ÿÿÿÿÿÿ  same as euss
  0E780230  00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF  ............ÿÿÿÿ
  0E780240  00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF  ........ÿÿÿÿÿÿÿÿ
 
  0E780250  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ  FF filled block region same as euss
  0E7803E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E7803F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
 
  0E780400  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E780410  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ  FF filled block region instead of 00 filled
  0E7807E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E7807F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>


=== OtherOS ===
No Image.initrd.ps3.bin , FF filled instead
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
  0E780800  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0E780810  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
     [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ  large FF filled block region
     [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ  large FF filled block region
   0EFFFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0EFFFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
Line 615: Line 925:
</pre>
</pre>


== NAND reference (bluemimmo) ==
=== bootldr ===
CECHA-06/COK-001 with 3.60 OFW
[[Flash:bootldr]] @ 0xF000000 - 0xF03FFFF
 
=== 0xF040000 - 0xFFFFFFF ===
same as euss
 
 
== NAND reference (COOKIE13) ==
COOKIE-13 preretail model with FW 085.009
 
=== VTRM ===
actual data (looks encrypted, stats <0.40% for all values), structure and length differs, start offset same as euss
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
  00EC0000  CC 04 BF 45 AD D9 69 17 C5 EA 3C EA 46 BD FC 0B  Ì.¿E­Ùi.Åê<êF½ü.
  00EC0010  C0 25 27 6D 3E 26 7B 56 A7 01 41 D7 5D 98 BA BB  À%'m>&{V§.A×]˜º»
    [...]                                                                        large date filled block region
  0EAFFFE0  23 57 03 83 E7 65 AA D7 AB D4 21 DE D2 DF 79 BE  #W.ƒçeª×«Ô!ÞÒßy¾
  0EAFFFF0  B4 AB B6 56 BD 7F 04 56 AC 39 08 C9 BE 2D 97 A6  ´«¶V½..V¬9.ɾ-—¦
</pre>
===== 0EB00000 unreferenced area =====
with length of previous data area different, offset obviously differs from euss
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
  0EB00000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0EB00010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ  large FF filled block region
  0EFFFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0EFFFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
 
=== post VTRM / pre cell_ext_os_area ===
Not present , see above overlapping VTRM section
 
=== cell_ext_os_area ===
No cell_ext_os_area , see above overlapping VTRM section
 
=== OtherOS ===
No Image.initrd.ps3.bin , see above overlapping VTRM section
 
=== bootldr ===
[[Flash:bootldr]] @ 0xF000000 - 0xF03FFFF
 
=== 0xF040000 - 0xFFFFFFF ===
up until 0F1BFFFF FF filled, same as euss
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
  0F040000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0F040010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0F1BFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0F1BFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
 
=== 0F1C0000 data area ===
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
  0F1C0000  5B 59 E1 64 96 F8 D0 B5 C5 03 9E 69 09 93 AC C1  [Yád–øеÅ.ži.“¬Á
  0F1C0010  0B 4D A7 5A A3 D8 CB CA 95 C5 61 CC 1B 51 0B 3F  .M§Z£ØËÊ•ÅaÌ.Q.?
    [...]   
  0F1E51E0  9E F9 C6 9F 5C 09 DC 3D CB 54 AE 14 14 4B AC 9D  žùÆŸ\.Ü=ËT®..K¬.
  0F1E51F0  67 2E 96 A3 3F B9 D8 F8 10 D7 98 C3 C7 80 4B 48  g.–£?¹Øø.טÃÇ€KH
</pre>
=== 0F1E5200 nonreferenced area ===
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
  0F1E5200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0F1E5210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0F2FFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0F2FFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
=== 0F300000 repeative 0x200 data / 0x200 FF blocks ===
then at 0F300000 
[ data of 0x200 length, followed by FF block of 0x200 length ] X repeated until 0x0F30C5FF
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
  0F300000  91 6E E5 2B 97 39 4D 46 57 BA BC 6A E5 CC 41 07  ‘nå+—9MFWº¼jåÌA.
  0F300010  40 22 E9 E9 F7 51 32 23 D7 08 2D 5E 93 BC 9A 3F  @"éé÷Q2#×.-^“¼š?
    [...] 
     
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
       
    [...]   
  0F30C5E0  35 AC AA B1 69 FD BB 22 8C 06 D6 79 E4 67 24 3D  5¬ª±iý»"Œ.Öyäg$=
  0F30C5F0  63 74 39 03 F1 E8 B4 86 07 FF CC BF 54 28 A0 96  ct9.ñè´†.ÿÌ¿T( –
</pre>
=== 0F30C600 FF block ===
followed by a long FF block
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
  0F30C600  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0F30C610  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0F5FFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0F5FFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>


=== Bootldr ===
=== 0F600000 data block ===
<pre>  Bootldr from offset 0x00000000:
followed by large datablock
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
    
    
   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   0F600000  38 E9 F3 B1 7F AF 68 E0 27 AC DC 48 1B 2D 87 BB  8éó±.¯hà'¬ÜH.-‡»
  0F600010  00 C8 1C D8 FE EB E6 01 41 D2 A1 EA DC 2E F6 03  .È.Øþëæ.AÒ¡êÜ.ö.
    [...]   
  0F61D1E0  C1 70 9B E0 9D 1B 4D B3 E4 95 6E 42 8B 25 25 E1  Áp›à..M³ä•nB‹%%á
  0F61D1F0  CB CD 96 88 DA A5 DA F2 42 8F 01 1F D5 E4 E9 D2  ËÍ–ˆÚ¥ÚòB...ÕäéÒ
</pre>
=== 0F61D200 FF block ===
followed by large FF block
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
    
    
   00000000 00 00 2A 3F 04 AD 56 18 64 8D 49 94 23 8F B8 A1 ..*?.­V.d.I”#.¸¡
   0F61D200 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00000010 00 00 2A 3F 93 B7 DF 38 94 92 09 B6 C3 9C D2 AA  ..*?“·ß8”’.¶ÃœÒª
   0F61D210 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  00000020  E8 7D F4 AC 86 AA 28 2F 68 31 AD 61 F5 7C BA 03  è}ô¬†ª(/h1­aõ|º.
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  00000030  38 BA FF 8C D2 CA A8 5A DA 0D F0 2C 7B 69 03 22  8ºÿŒÒʨZÚ.ð,{i."
   0F7001E0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  00000040  E2 EB 0D 9C 6A 12 31 43 FA 3C 5F 5D E3 9F 70 5E  âë.œj.1Cú<_]ãŸp^
   0F7001F0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  00000050  15 18 7F 09 00 C3 65 E4 47 E4 D9 63 46 4B A1 CC  .....ÃeäGäÙcFK¡Ì
  00000060  8A F9 51 8A 6D F0 FA 94 83 F4 C1 23 4F AE 50 AD  ŠùQŠmðú”ƒôÁ#O®P­
  00000070  0F 81 5A 3E 2C 31 AE 6C 81 A1 8D A2 18 7F 35 9F  ..Z>,1®l.¡.¢..5Ÿ
  00000080  99 E5 69 67 A2 E0 F8 14 B8 85 4A 99 41 D9 84 0A  ™åig¢àø.¸…J™AÙ„.
  00000090  11 D5 A1 2A C6 3D 21 9D C3 43 E0 3E 00 17 4C DC  .Õ¡*Æ=!.ÃCà>..LÜ
  000000A0  B1 DD E3 94 00 E0 61 41 65 9A C9 8F C9 18 83 FC  ±Ýã”.àaAešÉ.É.ƒü
  000000B0  CA DA 3E 89 A1 43 CF 4D 0E DB D2 7B 6D 53 6A 53  ÊÚ>‰¡CÏM.ÛÒ{mSjS
  000000C0  3D 43 ED 5C 7F B4 09 E4 22 38 6E 29 E7 3E 07 4B  =Cí\.´.ä"8n)ç>.K
  000000D0  2A FF 98 49 C9 49 FE 26 85 F4 71 15 85 11 75 F3  *ÿ˜IÉIþ&…ôq.….uó
  000000E0  56 79 2A 85 F3 1E 0F E3 21 16 2B 3F B3 25 18 2D  Vy*…ó..ã!.+?³%.-
  000000F0  9D 4E 57 76 1E 59 65 8A 5B BF 41 B7 29 1F 79 0C .NWv.YeŠ[¿A·).y.
  00000100  A3 E7 CF 07 E7 A3 4F DA 67 B2 C9 75 89 83 4F 71  £çÏ.ç£OÚg²Éu‰ƒOq
  00000110  71 88 D6 89 D7 07 C0 2E D8 DA 39 0F 87 5B FE 40  qˆÖ‰×.À.ØÚ9.‡[þ@
  00000120  23 31 EB BF 86 1A A5 0D D5 24 94 DD A2 69 E4 E8  #1뿆.¥.Õ$”Ý¢iäè
  00000130  25 28 2E C7 34 E9 E5 8D 2D F4 AC F5 60 CC 2A CD  %(.Ç4éå.-ô¬õ`Ì*Í
  00000140  06 5D D7 FE C8 59 FC 6D 2B 17 25 A6 2E BE 0F F2  .]×þÈYüm+.%¦.¾.ò
   00000150  46 94 3B 0B C4 76 F6 FB C1 C1 8E 93 42 E9 5B 41 F”;.ÄvöûÁÁŽ“Bé[A
   00000160 69 A8 53 39 C6 09 32 A3 A9 3E AE 71 84 74 EC E0 i¨S9Æ.2£©>®q„tìà
   00000170 97 3B D1 41 D9 59 4B 17 E5 8B D1 2A 57 77 78 8D  —;ÑAÙYK.å‹Ñ*Wwx.
  00000180  02 4A 7F 31 5C 62 30 E5 F3 83 97 27 C4 7B 8D 31  .J.1\b0åóƒ—'Ä{.1
  00000190  E9 53 B6 86 BC 16 AC 15 B9 96 C2 A9 56 AC 13 DF  éS¶†¼.¬.¹–©V¬.ß
  000001A0  E4 05 01 30 7F 65 45 48 66 0E 3D D5 A9 1B 1A 76  ä..0.eEHf.=Õ©..v
  000001B0  15 38 C7 B3 0D A2 83 C2 D9 9F 13 28 F9 50 BF 4C  .8dz.¢ƒÂÙŸ.(ùP¿L
  000001C0  C1 2D 83 E8 9B A9 EF D1 C8 12 96 50 45 DD CC 26  Á-ƒè›©ïÑÈ.–PEÝÌ&
  000001D0  D5 57 C1 DD A0 2E 81 97 F8 B8 60 00 A9 27 2D 68  ÕWÁÝ ..—ø¸`.©'-h
  000001E0  69 FE C8 F5 E2 7D 48 0D 04 65 FF BB A8 BF 41 9F  iþÈõâ}H..eÿ»¨¿AŸ
  000001F0  27 98 56 D1 93 56 62 87 74 89 63 AD 63 B4 A3 AA  '˜VÑ“Vb‡t‰c­c´£ª
  00000200  46 09 AB B5 92 BA BB CF 7C EF 8F 08 F8 FE 96 9A  F.«µ’º»Ï|ï..øþ–š
  00000210  2E 14 C4 67 8C B3 E3 DC DE BC 24 3F D8 17 B0 B6  ..ÄgŒ³ãÜÞ¼$?Ø.°¶
  00000220  1B F7 78 61 DE 90 14 29 46 CB 4E EF 30 0A D3 AA  .÷xaÞ..)FËNï0.Óª
  00000230  BB 78 6B 1D A2 3A E8 27 7B 2D 32 E5 62 C4 45 C0  »xk.¢:è'{-2åbÄEÀ
  00000240  9E 75 6C E3 5C 08 A9 D3 5B 36 38 40 AD BF 5D D4  žulã\.©Ó[68@­¿]Ô
  00000250  9D D1 D9 F0 11 A6 D5 68 C9 97 BA 70 38 25 61 0B  .ÑÙð.¦ÕhÉ—ºp8%a.
  00000260  76 B6 84 0E 90 7C E9 C8 AC 01 F4 E4 2D 0A F4 C7  v¶„..|éȬ.ôä-.ôÇ
  00000270  98 D7 A3 98 8C CC A8 D0 05 2E A5 87 D7 FA 0A 93  ˜×£˜ŒÌ¨Ð..¥‡×ú.“
  00000280  19 91 81 D3 E9 83 E2 5E 31 D5 AD 78 4B A6 04 80  .‘.Óéƒâ^1Õ­xK¦.€
  00000290  94 85 60 AA 09 5E CA 80 E3 FC 40 14 66 9C 47 11  ”…`ª.^Ê€ãü@.fœG.
  000002A0  A7 FF 93 6E 50 EB F6 AE 54 2F 47 43 01 EB 24 4D  §ÿ“nPëö®T/GC.ë$M
  000002B0  4B DC E3 A1 BC B7 B4 9B E0 77 D9 C0 97 CF CE 72  KÜ㡼·´›àwÙÀ—ÏÎr
  000002C0  EF 84 F5 F1 7D 16 21 AC DC B7 2A 01 96 A4 14 47  ï„õñ}.!¬Ü·*.–¤.G
  000002D0  6D E5 1C 30 9D 1A 64 22 3A 7E 0B 28 A5 22 A0 B8  må.0..d":~.(¥" ¸
  000002E0  85 D8 0E 6B 5A 2B 7D 20 2B CF FA A9 B6 78 D0 FD  …Ø.kZ+} +Ïú©¶xÐý
  000002F0  82 9B 3D D7 24 F0 76 05 24 60 1A 8E CC 61 4A 8E  ‚›=×$ðv.$`.ŽÌaJŽ
  00000300  B8 F2 2B 59 AE FF 49 45 71 D0 31 73 8D 32 08 D9  ¸ò+Y®ÿIEqÐ1s.2.Ù
  00000310  8E 2E B8 18 13 49 B9 2F EB B7 D5 B9 55 E7 63 64  Ž.¸..I¹/ë·Õ¹Uçcd
  00000320  F6 CF 8C B0 ED BA A8 81 36 05 3C 48 E3 58 F1 3A  öÏŒ°íº¨.6.<HãXñ:
  00000330  51 39 CD 68 76 8D 08 D7 2B C4 7B 1D D2 4E DC A2  Q9Íhv..×+Ä{.ÒNÜ¢
  00000340  0E 1B C9 30 2B A1 EF 90 D5 35 7B 92 6B 86 D2 59  ..É0+¡ï.Õ5{’k†ÒY
  00000350  10 84 98 4B 9A 65 1A 00 B8 00 0A CA 5C F7 AF 8C  .„˜Kše..¸..Ê\÷¯Œ
  00000360  9C FF FC 0A 70 11 5E 0A 7A 02 26 B7 DE 98 FA F8  œÿü.p.^.z.&·Þ˜úø
  00000370  0D A0 D2 A3 83 95 34 2F 2C 17 6C B4 66 13 CB FB  . Ò£ƒ•4/,.l´f.Ëû
  00000380  A4 9E BC 64 08 41 F6 A0 F7 A1 F7 E1 24 EE 8C E3  ¤ž¼d.Aö ÷¡÷á$îŒã
  00000390  F2 59 19 1C 84 F8 60 45 81 72 88 B4 AE 6A 97 3E  òY..„ø`E.rˆ´®j—>
  000003A0  B8 5B 4A D8 C7 D2 0C AC 3C D9 25 B2 CC D7 D7 B4  ¸[JØÇÒ.¬<Ù%²Ì××´
  000003B0  CC EF C7 81 95 56 98 C5 A2 B3 7F 77 8D 24 51 7C  ÌïÇ.•V˜Å¢³.w.$Q|
  000003C0  78 27 C5 3A 1E 78 EC 84 5B 54 10 8A E3 0A CD E2  x'Å:.xì„[T.Šã.Íâ
  000003D0  2A 2E B2 9A B6 F2 75 8F B5 F0 74 23 6E 71 D8 56  *.²š¶òu.µðt#nqØV
  000003E0  F0 D1 79 73 0D 5D 41 27 E7 68 55 1F 00 52 9E BE  ðÑys.]A'çhU..Rž¾
  000003F0 BF D6 B4 92 C3 26 84 94 5C FE 46 6C BB 46 FA 51  ¿Ö´’Ã&„”\þFl»FúQ
  00000400  56 41 96 13 94 1A 24 02 64 4F B5 C7 36 F2 25 AF  VA–.”.$.dOµÇ6ò%¯
  00000410  8B 1F FD D1 8F 24 80 44 18 4B B9 D6 04 61 E2 EF  ‹.ýÑ.$€D.K¹Ö.aâï
</pre>
</pre>


=== ROS0 ===
=== 0F700200 repeative 0x200 data / 0x200 FF blocks ===
then at 0F700200 
[ data of 0x200 length, followed by FF block of 0x200 length ] X repeated until 0x0F70C7F0
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
  0F700200  4D AB A4 D7 58 35 59 46 E7 1B C4 D8 88 BA 74 C0  M«¤×X5YFç.Ä؈ºtÀ
  0F700210  18 66 C9 2C 8A FD FE D3 25 F6 52 E7 47 FE B5 5F  .fÉ,ŠýþÓ%öRçGþµ_
    [...] 
     
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
       
    [...] 
  0F70C7E0  E2 1A 1B 96 19 1F 75 4B 02 E3 23 68 95 61 47 37  â..–..uK.ã#h•aG7
  0F70C7F0  FC 69 5D 28 D5 5E E0 60 DE F8 C0 FD E6 3F 72 CE  üi](Õ^à`ÞøÀýæ?rÎ
</pre>
=== 0F61D200 FF block ===
followed by large FF block
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
    
    
   000C0020 00 00 00 00 00 00 00 00 00 00 00 00 00 6F FF E0 .............oÿà
   0F70C800 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   000C0030 00 00 00 01 00 00 00 18 00 00 00 00 00 6F FF E0  .............oÿà
   0F70C810 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  000C0040  00 00 00 00 00 00 04 90 00 00 00 00 00 04 00 00  ................
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  000C0050  63 72 65 73 65 72 76 65 64 5F 30 00 00 00 00 00  creserved_0.....
   0FCFFFE0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  000C0060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   0FCFFFF0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  000C0070  00 00 00 00 00 04 04 90 00 00 00 00 00 00 00 08  ................
  000C0080  73 64 6B 5F 76 65 72 73 69 6F 6E 00 00 00 00 00  sdk_version.....
  000C0090  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C00A0  00 00 00 00 00 04 05 00 00 00 00 00 00 01 E7 C8  ..............çÈ
  000C00B0 6C 76 31 6C 64 72 00 00 00 00 00 00 00 00 00 00  lv1ldr..........
  000C00C0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C00D0  00 00 00 00 00 05 ED 00 00 00 00 00 00 01 6F F0  ......í.......oð
  000C00E0  6C 76 32 6C 64 72 00 00 00 00 00 00 00 00 00 00  lv2ldr..........
  000C00F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C0100  00 00 00 00 00 07 5D 00 00 00 00 00 00 01 2F 74  ......]......./t
   000C0110  69 73 6F 6C 64 72 00 00 00 00 00 00 00 00 00 00 isoldr..........
   000C0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
   000C0130 00 00 00 00 00 08 8C 80 00 00 00 00 00 01 E5 D4  ......Œ€......åÔ
  000C0140  61 70 70 6C 64 72 00 00 00 00 00 00 00 00 00 00  appldr..........
  000C0150  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C0160  00 00 00 00 00 0A 72 54 00 00 00 00 00 00 FB 4C  ......rT......ûL
  000C0170  73 70 75 5F 70 6B 67 5F 72 76 6B 5F 76 65 72 69  spu_pkg_rvk_veri
  000C0180  66 69 65 72 2E 73 65 6C 66 00 00 00 00 00 00 00  fier.self.......
  000C0190  00 00 00 00 00 0B 6D A0 00 00 00 00 00 00 5A 94  ......m ......Z”
  000C01A0  73 70 75 5F 74 6F 6B 65 6E 5F 70 72 6F 63 65 73  spu_token_proces
  000C01B0  73 6F 72 2E 73 65 6C 66 00 00 00 00 00 00 00 00  sor.self........
  000C01C0  00 00 00 00 00 0B C8 34 00 00 00 00 00 00 63 D0  ......È4......cÐ
  000C01D0  73 70 75 5F 75 74 6F 6B 65 6E 5F 70 72 6F 63 65  spu_utoken_proce
  000C01E0  73 73 6F 72 2E 73 65 6C 66 00 00 00 00 00 00 00  ssor.self.......
  000C01F0  00 00 00 00 00 0C 2C 04 00 00 00 00 00 01 53 2C  ......,.......S,
  000C0200  73 63 5F 69 73 6F 2E 73 65 6C 66 00 00 00 00 00  sc_iso.self.....
  000C0210  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C0220  00 00 00 00 00 0D 7F 30 00 00 00 00 00 00 42 98  .......0......B˜
  000C0230  61 69 6D 5F 73 70 75 5F 6D 6F 64 75 6C 65 2E 73  aim_spu_module.s
  000C0240  65 6C 66 00 00 00 00 00 00 00 00 00 00 00 00 00  elf.............
  000C0250  00 00 00 00 00 0D C1 C8 00 00 00 00 00 00 D7 F0  ......ÁÈ......×ð
  000C0260  73 70 70 5F 76 65 72 69 66 69 65 72 2E 73 65 6C  spp_verifier.sel
  000C0270  66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  f...............
  000C0280  00 00 00 00 00 0E 99 B8 00 00 00 00 00 00 80 8C  ......™¸......€Œ
  000C0290  6D 63 5F 69 73 6F 5F 73 70 75 5F 6D 6F 64 75 6C  mc_iso_spu_modul
  000C02A0  65 2E 73 65 6C 66 00 00 00 00 00 00 00 00 00 00  e.self..........
  000C02B0  00 00 00 00 00 0F 1A 44 00 00 00 00 00 00 88 B8  .......D......ˆ¸
  000C02C0  6D 65 5F 69 73 6F 5F 73 70 75 5F 6D 6F 64 75 6C  me_iso_spu_modul
  000C02D0  65 2E 73 65 6C 66 00 00 00 00 00 00 00 00 00 00  e.self..........
  000C02E0  00 00 00 00 00 0F A2 FC 00 00 00 00 00 00 C0 78  ......¢ü......Àx
  000C02F0  73 76 5F 69 73 6F 5F 73 70 75 5F 6D 6F 64 75 6C  sv_iso_spu_modul
  000C0300  65 2E 73 65 6C 66 00 00 00 00 00 00 00 00 00 00  e.self..........
  000C0310  00 00 00 00 00 10 63 74 00 00 00 00 00 00 5D B0  ......ct......]°
  000C0320  73 62 5F 69 73 6F 5F 73 70 75 5F 6D 6F 64 75 6C  sb_iso_spu_modul
  000C0330  65 2E 73 65 6C 66 00 00 00 00 00 00 00 00 00 00  e.self..........
  000C0340  00 00 00 00 00 10 C1 24 00 00 00 00 00 00 22 A0  ......Á$......"
  000C0350  64 65 66 61 75 6C 74 2E 73 70 70 00 00 00 00 00  default.spp.....
  000C0360  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C0370  00 00 00 00 00 10 E4 00 00 00 00 00 00 12 80 50  ......ä.......€P
  000C0380  6C 76 31 2E 73 65 6C 66 00 00 00 00 00 00 00 00  lv1.self........
  000C0390  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C03A0  00 00 00 00 00 23 64 80 00 00 00 00 00 03 E6 78  .....#d€......æx
  000C03B0  6C 76 30 00 00 00 00 00 00 00 00 00 00 00 00 00  lv0.............
  000C03C0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C03D0  00 00 00 00 00 27 4A F8 00 00 00 00 00 17 27 58  .....'Jø......'X
  000C03E0  6C 76 32 5F 6B 65 72 6E 65 6C 2E 73 65 6C 66 00  lv2_kernel.self.
  000C03F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C0400  00 00 00 00 00 3E 72 50 00 00 00 00 00 07 0F 94  .....>rP.......”
  000C0410  65 75 72 75 73 5F 66 77 2E 62 69 6E 00 00 00 00  eurus_fw.bin....
  000C0420  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C0430  00 00 00 00 00 45 81 E4 00 00 00 00 00 08 04 18  .....E.ä........
  000C0440  65 6D 65 72 5F 69 6E 69 74 2E 73 65 6C 66 00 00  emer_init.self..
  000C0450 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C0460  00 00 00 00 00 4D 85 FC 00 00 00 00 00 06 0D 78  .....M…ü.......x
  000C0470  68 64 64 5F 63 6F 70 79 2E 73 65 6C 66 00 00 00  hdd_copy.self...
  000C0480  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  000C0490  00 00 00 00 00 53 93 74 00 00 00 00 00 00 12 A8  .....S“t.......¨
  000C04A0  6D 61 6E 75 5F 69 6E 66 6F 5F 73 70 75 5F 6D 6F  manu_info_spu_mo
  000C04B0  64 75 6C 65 2E 73 65 6C 66 00 00 00 00 00 00 00  dule.self.......
</pre>
</pre>


=== ROS1 ===
=== 0F700200 repeative 0x200 00 blocks / 0x200 FF blocks ===
then at 0F700200 
[ 00 block of 0x200 length, followed by FF block of 0x200 length ] X repeated until 0x0FD3FFFF
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
    
    
   007C0010 00 00 00 00 00 00 00 00 00 00 00 00 00 6F FF E0  .............oÿà
   0FD00000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C0020  00 00 00 01 00 00 00 17 00 00 00 00 00 6F FF E0 .............oÿà
   0FD00010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C0030  00 00 00 00 00 00 04 60 00 00 00 00 00 04 00 00  .......`........
   
   007C0040  63 72 65 73 65 72 76 65 64 5F 30 00 00 00 00 00  creserved_0.....
    [...]   FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  007C0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    
  007C0060  00 00 00 00 00 04 04 60 00 00 00 00 00 00 00 08  .......`........
    [...]    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C0070  73 64 6B 5F 76 65 72 73 69 6F 6E 00 00 00 00 00  sdk_version.....
    
   007C0080  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   0FD3FFE0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  007C0090  00 00 00 00 00 04 04 68 00 00 00 00 00 00 FB 4C  .......h......ûL
   0FD3FFF0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  007C00A0  73 70 75 5F 70 6B 67 5F 72 76 6B 5F 76 65 72 69  spu_pkg_rvk_veri
  007C00B0  66 69 65 72 2E 73 65 6C 66 00 00 00 00 00 00 00  fier.self.......
  007C00C0  00 00 00 00 00 04 FF B4 00 00 00 00 00 00 C9 30  ......ÿ´......É0
  007C00D0  73 70 75 5F 74 6F 6B 65 6E 5F 70 72 6F 63 65 73  spu_token_proces
  007C00E0  73 6F 72 2E 73 65 6C 66 00 00 00 00 00 00 00 00  sor.self........
  007C00F0  00 00 00 00 00 05 C8 E4 00 00 00 00 00 00 63 D0  ......Èä......cÐ
  007C0100  73 70 75 5F 75 74 6F 6B 65 6E 5F 70 72 6F 63 65  spu_utoken_proce
  007C0110  73 73 6F 72 2E 73 65 6C 66 00 00 00 00 00 00 00  ssor.self.......
  007C0120  00 00 00 00 00 06 2C B4 00 00 00 00 00 01 D2 D8  ......,´......ÒØ
  007C0130  73 63 5F 69 73 6F 2E 73 65 6C 66 00 00 00 00 00  sc_iso.self.....
  007C0140  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C0150  00 00 00 00 00 07 FF 8C 00 00 00 00 00 00 42 98  ......ÿŒ......B˜
  007C0160  61 69 6D 5F 73 70 75 5F 6D 6F 64 75 6C 65 2E 73  aim_spu_module.s
  007C0170  65 6C 66 00 00 00 00 00 00 00 00 00 00 00 00 00  elf.............
  007C0180  00 00 00 00 00 08 42 24 00 00 00 00 00 00 D7 F0  ......B$......×ð
  007C0190  73 70 70 5F 76 65 72 69 66 69 65 72 2E 73 65 6C  spp_verifier.sel
  007C01A0  66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  f...............
  007C01B0  00 00 00 00 00 09 1A 14 00 00 00 00 00 00 80 8C  ..............€Œ
  007C01C0  6D 63 5F 69 73 6F 5F 73 70 75 5F 6D 6F 64 75 6C  mc_iso_spu_modul
  007C01D0  65 2E 73 65 6C 66 00 00 00 00 00 00 00 00 00 00  e.self..........
  007C01E0  00 00 00 00 00 09 9A A0 00 00 00 00 00 00 88 B8  ......š ......ˆ¸
  007C01F0 6D 65 5F 69 73 6F 5F 73 70 75 5F 6D 6F 64 75 6C  me_iso_spu_modul
   007C0200  65 2E 73 65 6C 66 00 00 00 00 00 00 00 00 00 00  e.self..........
  007C0210  00 00 00 00 00 0A 23 58 00 00 00 00 00 00 C0 78  ......#X......Àx
  007C0220  73 76 5F 69 73 6F 5F 73 70 75 5F 6D 6F 64 75 6C  sv_iso_spu_modul
  007C0230  65 2E 73 65 6C 66 00 00 00 00 00 00 00 00 00 00  e.self..........
  007C0240  00 00 00 00 00 0A E3 D0 00 00 00 00 00 00 5D B0  ......ãÐ......]°
  007C0250  73 62 5F 69 73 6F 5F 73 70 75 5F 6D 6F 64 75 6C  sb_iso_spu_modul
   007C0260  65 2E 73 65 6C 66 00 00 00 00 00 00 00 00 00 00 e.self..........
  007C0270  00 00 00 00 00 0B 41 80 00 00 00 00 00 00 22 A0 ......A€......"
  007C0280  64 65 66 61 75 6C 74 2E 73 70 70 00 00 00 00 00  default.spp.....
   007C0290  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   007C02A0 00 00 00 00 00 0B 64 80 00 00 00 00 00 12 5E F0 ......d€......^ð
   007C02B0 6C 76 31 2E 73 65 6C 66 00 00 00 00 00 00 00 00  lv1.self........
  007C02C0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C02D0  00 00 00 00 00 1D C3 80 00 00 00 00 00 0B 54 E8  ......À......Tè
  007C02E0  6C 76 30 00 00 00 00 00 00 00 00 00 00 00 00 00  lv0.............
  007C02F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C0300  00 00 00 00 00 29 18 80 00 00 00 00 00 00 05 00  .....).€........
  007C0310 6C 76 30 2E 32 00 00 00 00 00 00 00 00 00 00 00  lv0.2...........
  007C0320  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C0330  00 00 00 00 00 29 1D 80 00 00 00 00 00 17 89 58  .....).€......‰X
  007C0340  6C 76 32 5F 6B 65 72 6E 65 6C 2E 73 65 6C 66 00  lv2_kernel.self.
  007C0350  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C0360  00 00 00 00 00 40 A6 D8 00 00 00 00 00 07 0F 94  .....@¦Ø.......”
  007C0370  65 75 72 75 73 5F 66 77 2E 62 69 6E 00 00 00 00  eurus_fw.bin....
  007C0380  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C0390  00 00 00 00 00 47 B6 6C 00 00 00 00 00 07 E2 68  .....G¶l......âh
  007C03A0  65 6D 65 72 5F 69 6E 69 74 2E 73 65 6C 66 00 00  emer_init.self..
  007C03B0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C03C0  00 00 00 00 00 4F 98 D4 00 00 00 00 00 06 18 18  .....O˜Ô........
  007C03D0  68 64 64 5F 63 6F 70 79 2E 73 65 6C 66 00 00 00  hdd_copy.self...
  007C03E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C03F0  00 00 00 00 00 55 B0 EC 00 00 00 00 00 00 12 A8  .....U°ì.......¨
  007C0400  6D 61 6E 75 5F 69 6E 66 6F 5F 73 70 75 5F 6D 6F  manu_info_spu_mo
  007C0410  64 75 6C 65 2E 73 65 6C 66 00 00 00 00 00 00 00  dule.self.......
  007C0420  00 00 00 00 00 55 C3 94 00 00 00 00 00 00 02 E0  .....UÔ.......à
  007C0430  70 72 6F 67 2E 73 72 76 6B 00 00 00 00 00 00 00  prog.srvk.......
  007C0440  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  007C0450  00 00 00 00 00 55 C6 74 00 00 00 00 00 00 02 40  .....UÆt.......@
  007C0460  70 6B 67 2E 73 72 76 6B 00 00 00 00 00 00 00 00  pkg.srvk........
  007C0470  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
</pre>
</pre>


=== Versioning in ROS0 ===
=== 0FD40000 data block ===
followed by large data block
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
    
    
   001004C0 33 35 30 2E 30 30 30 0A 00 00 00 00 00 00 00 00 350.000.........
   0FD40000 65 67 E9 83 90 F8 48 8F 9B 13 17 D6 07 22 F0 D5 egéƒ.øH...Ö."ðÕ
   001004D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
   0FD40010 B0 10 CB 58 73 42 E1 B3 60 40 3E A4 EE C8 DF 7C °.ËXsBá³`@>¤îÈß|
   001004E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    [...]
   001004F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
   0FD64BE0 21 A9 AC 85 21 13 1E C4 89 F1 B5 97 14 13 35 47 !©¬…!..ĉñµ—..5G
   00100500 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
   0FD64BF0 CF C1 94 1F E2 B6 BB E9 A7 5B B0 7E 6B 9A 9C CF ÏÁ”.ⶻé§[°~kšœÏ
   00100510 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
</pre>
   00100520 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
=== 0FD64C00 FF block ===
   00100530 53 43 45 00 00 00 00 02 00 00 00 01 00 00 01 F0 SCE............ð
followed by large FF block
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
   0FD64C00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0FD64C10 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0FD7FFE0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0FD7FFF0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
</pre>


=== Versioning of ROS1 ===
=== 0FD80000 data block ===
followed by large data block
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
    
    
   00800480 33 36 30 2E 30 30 30 0A 53 43 45 00 00 00 00 02 360.000.SCE.....
   0FD80000 A1 A6 19 39 40 F7 D5 66 0C D6 75 51 15 0D B3 CA ¡¦.9@÷Õf.ÖuQ..³Ê
   00800490 00 01 00 01 00 00 01 F0 00 00 00 00 00 00 06 00 .......ð........
  0FD80010  2D 57 87 94 59 5A B8 EE 24 A9 63 FA 58 31 BA 58  -W‡”YZ¸î$©cúX1ºX
   008004A0 00 00 00 00 00 00 F5 4C 00 00 00 00 00 00 00 03 ......õL........
    [...]
   0FDAD1E0 13 9F 31 B5 79 44 0C 26 37 8C 3B B1 20 DB 09 AD .Ÿ1µyD.&7Œ;± Û.­
  0FDAD1F0  D0 7B AD 48 EB 8C 6E 9D BF A9 95 9D 87 E0 64 0B  Ð{­HëŒn.¿©•.‡àd.
</pre>
=== 0FDAD200 FF block ===
followed by large FF block
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
  0FDAD200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0FDAD210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  0FE7FFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0FE7FFF0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
</pre>


=== RVK ===
=== 0FE80000 repeative 0x200 00 blocks / 0x200 FF blocks ===
then at 0FE80000 
[ 00 block of 0x200 length, followed by FF block of 0x200 length ] X repeated until 0x0FEBF5FF
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
    
    
   00093800 00 00 00 00 00 00 10 10 00 00 00 00 00 00 10 10 ................
   0FE80000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
   00093810 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00  ...... .........
   0FE80010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   00093820 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 40 ...............@
   
   00093830 53 43 45 00 00 00 00 02 00 00 00 02 00 00 00 00  SCE.............
    [...]   FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00093840 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 40 ...............@
 
  00093850  F6 93 38 8E C8 46 D5 FF 34 53 9D 12 91 7E C6 96  ö“8ŽÈFÕÿ4S..‘~Æ–
    [...]    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   00093860  BA 4F B8 36 82 1A 4F 40 19 88 B2 C8 56 B3 DA 4B  ºO¸6‚.O@.ˆ²ÈV³ÚK
       
   00093870 62 EB 84 D3 8A 95 F9 DD 6C D7 4C AB 47 8D D1 1A bë„ÓŠ•ùÝl×L«G.Ñ.
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00093880 A6 64 B3 55 21 71 53 8C DD 8C 61 1F B0 7E 5E D2 ¦d³U!qSŒÝŒa.°~^Ò
 
  00093890  DB 1A 07 DA 37 4E 07 92 E7 B2 35 F1 E0 FA F8 13  Û..Ú7N.’ç²5ñàúø.
   0FEBF5E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   000938A0 EC D9 94 1C 72 A0 45 38 79 85 6A 4E 02 CC 55 41 ìÙ”.r E8y…jN.ÌUA
   0FEBF5F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
   000938B0 21 3D F1 48 32 98 6E CB 86 0A 38 6E 33 C6 2E 8D !=ñH2˜nˆ.8n3Æ..
</pre>
  000938C0  1E 51 DC 7E C5 34 E6 5B 27 D4 5B 79 B4 34 0D 59  .QÜ~Å4æ['Ô[y´4.Y
=== 0FEBFE00 FF block ===
  000938D0  49 F9 F0 6E F6 94 25 3D 6A E0 E9 40 69 74 68 B4  Iùðnö”%=jàé@ith´
followed by large FF block until EOF
   000938E0  C5 C6 A3 95 62 E0 69 6E CD 6C CD 48 32 DD 11 8C  ÅÆ£•bàinÍlÍH2Ý.Œ
<pre>  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   000938F0  1A D7 9B 37 8A 6F 33 C7 A1 27 D1 1C A4 24 E7 96  .×›7Šo3Ç¡'Ñ.¤$ç–
    
   00093900 F0 75 BC 3A BE 15 26 CD 83 EA C8 11 F0 50 4D F8 ðu¼:¾.&̓êÈ.ðPMø
   0FEBFE00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  00093910  A0 15 2F 68 6E AE 5F 28 D8 F5 EA 39 A3 00 5E 06  ./hn®_(Øõê9£.^.
   0FEBFE10 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00093920 D6 28 21 B7 36 49 29 27 73 76 D2 37 93 AB AB B2  Ö(!·6I)'svÒ7“««²
    [...
  00093930  1A B3 AD A2 75 64 D3 73 88 4F D3 8E 23 B3 16 4A .³­¢udÓsˆOÓŽ#³.J
   0FFFFFE0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  00093940  BD 4A E2 B3 D0 AE B0 12 AC 91 33 EB AD 75 3E 47  ½Jâ³Ð®°.¬‘3ë­u>G
   0FFFFFF0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  00093950  8F E4 E2 D7 CE 35 90 BB 7A E0 AA 95 8D 88 93 22  .äâ×Î5.»zક.ˆ“"
</pre>
  00093960  7A EB 8D C0 92 E9 74 30 7A 20 61 A6 36 5D 79 BD  zë.À’ét0z a¦6]y½
 
  00093970  11 9E B5 FC 64 F4 DF B6 E6 5E B7 7D 64 76 A7 B9  .žµüdô߶æ^·}dv§¹
== NAND reference (bluemimmo) ==
   00093980 E8 12 6A 60 3B 6F 4F 4D F0 4A 8C 33 28 10 AB 60 è.j`;oOMðJŒ3(.«`
CECHA-06/COK-001 with 3.60 OFW
  00093990  B5 D5 0C EB 2E 89 02 91 B4 77 EE 4B 0A 95 B9 F1  µÕ.ë..‘´wîK.•¹ñ
 
  000939A0  66 CF 5E 0A D4 A8 FA 85 DB 14 9E 54 36 86 B9 A0  fÏ^.Ô¨ú…Û.žT6†¹
=== VTRM ===
   000939B0 F2 82 42 6A 76 8B D1 AD 72 2A 86 8E 10 92 FC 7A ò‚Bjv‹Ñ­r*†Ž.’üz
<pre>
   000939C0 2B A2 A9 55 31 BD F3 F4 95 64 A9 F6 D0 F4 A7 9B +¢©U1½óô•d©öÐô§›
   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   000939D0 35 9E FF C6 C1 98 10 A2 41 47 F9 E1 B0 68 ED DD 5žÿÆÁ˜.¢AGùá°híÝ
    
  000939E0  8E AB E6 E8 A8 0F 1E 2F C3 50 3A 3B FA F4 2E 90  Ž«æè¨../ÃP:;úô..
   00D80000 53 43 45 49 56 54 52 4D 00 00 00 00 00 00 00 A8 SCEIVTRM.......¨
   000939F0 5F 1C 3E 52 FE 76 01 99 0A 99 17 B6 BB 11 39 04 _.>Rþv...¶».9.
   00D80010 00 00 00 00 00 E8 02 00 00 00 00 00 00 00 00 28  .....è.........(
   00093A00 CE 79 FD 50 3A 59 61 24 16 8D 8A 08 DD F7 88 A6  ÎyýP:Ya$..Š.Ý÷ˆ¦
   00D80020 00 00 00 00 56 54 52 4D 00 00 00 00 00 00 00 04 ....VTRM........
   00093A10 32 6F 77 E0 12 22 70 73 2C 1A 44 DE B7 00 D6 50 2owà."ps,.DÞ·.ÖP
   00D80030 DD 8F ED 9A 82 76 B5 2C 2A 99 A2 ED E3 AF B8 4E Ý.íš‚vµ,*™¢í㯸N
   00093A20 AD 22 CE 7F AA 87 65 AA A3 0B D8 7A 84 FE CA 16 ­"Î.ª‡eª£.Øz„þÊ.
   00D80040 F9 F6 0F CE 00 00 00 00 00 00 00 00 00 E8 27 20 ùö.Î.........è'
   00093A30 00 00 00 03 00 00 00 02 00 01 00 60 00 00 00 00  ...........`....
   00D80050 00 00 00 00 00 00 00 60 00 00 00 00 00 00 09 20 .......`.......  
   00093A40 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00  ................
   00D80060 04 00 00 00 02 00 00 05 10 70 00 05 FF 00 00 01  .........p..ÿ...
   00093A50 C4 1E 40 5D 94 83 6F 00 E8 86 36 1C 1E C0 A6 9F Ä.@]”ƒo.è†6..À¦Ÿ
   00D80070 9D 2B 1C B4 04 09 59 5C 7B 6A A6 F6 B4 BB A6 FF .+.´..Y\{j¦ö´»¦ÿ
   00093A60 D0 34 53 63 9E 70 EB 64 43 9F 24 34 28 85 7A 04 Ð4ScžpëdCŸ$4(…z.
   00D80080 CA C2 B0 E9 34 3E 39 3C F4 1D 00 E8 B5 42 89 D7 Ê°é4>9<ô..èµB‰×
   00D80090 C5 12 67 F3 A2 DD 9B 5E AF A1 FE DB 19 27 C9 CB Å.gó¢Ý›^¯¡þÛ.'ÉË
  00D800A0  4F DE D5 CF 7A B2 C2 7B 8C 44 BE 99 54 DB 99 93  OÞÕÏz²Â{ŒD¾™TÛ™“
   00D800B0 00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF ........ÿÿÿÿÿÿÿÿ
  00D800C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  00D800D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  00D800E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  00D800F0  FF FF FF FF FF FF FF FF 00 00 00 00 00 EB E4 8C  ÿÿÿÿÿÿÿÿ.....ëäŒ
   00D80100 00 00 00 00 00 00 00 14 86 1E A7 45 DB 22 16 01 .........§EÛ"..
   00D80110 EF 94 71 06 CD 91 7B 0F 95 D1 36 71 FF FF FF FF ï”q.Í‘{.•Ñ6qÿÿÿÿ
   00D80120 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
</pre>


Line 921: Line 1,195:
   0FFFFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ</pre>
   0FFFFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ</pre>


= EID correctness =
== NAND reference CECHG04/SEM-001(sinsizer) ==
ros0: OFW 4.40<br />
ros1: OFW 4.31<br />
metldr: 0E77 => E7B0<br />
bootldr: 2E8C => 2E900
 
=== post VTRM / pre cell_ext_os_area ===
Same structure as the other till 00F42000
==== 00F42000 data area (size 0xC065600)====
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
00F42000  AB 0E 33 D0 51 66 AA DD DA A0 F1 C3 CC 22 98 61  «.3ÐQfªÝÚ ñÃÌ"˜a
00F42010  25 51 0C 1C FC 9B 56 AA 85 4E B1 C5 CA 73 01 3C  %Q..ü›Vª…N±ÅÊs.<
[...]
0CFA75E0  73 49 FA 50 54 D5 1C B3 5E 84 E3 7E D9 4B BE 11  sIúPTÕ.³^„ã~ÙK¾.
0CFA75F0  99 DB C4 35 64 B5 BA CA 31 0A 0F 9E 58 B6 41 78  ™ÛÄ5dµºÊ1..žX¶Ax
</pre>
===== 0CFA7600 unreferenced area (size 0x398A00) =====
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0CFA7600  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0CFA7610  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0D33FFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D33FFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 00D340000 - 00D34F9FF (0x200 Blocks) ====
0x200 data and unreferenced Blocks.
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0D340000  F8 71 BD A7 B0 58 54 75 98 00 34 AC 55 06 3C 26  øq½§°XTu˜.4¬U.<&
0D340010  25 3A 5A 86 31 4D 36 97 3C E6 83 4E 2B 10 5A 6D  %:Z†1M6—<æƒN+.Zm
[...]
0D3401E0  A7 40 E6 4B 2A B3 16 61 9F D3 99 96 7A 36 5B 26  §@æK*³.aŸÓ™–z6[&
0D3401F0  92 4B C1 03 91 9F 27 1F 16 49 8C 25 7E B9 6B E2  ’KÁ.‘Ÿ'..IŒ%~¹kâ
0D340200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D340210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0D3403E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D3403F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D340400  31 C0 2C 69 BA 50 73 00 AE D6 37 73 13 B9 9B A9  1À,iºPs.®Ö7s.¹›©
0D340410  DF 7C 01 C2 FD 2C E8 0F BB 4D AE BA C9 D0 F6 A9  ß|.Âý,è.»M®ºÉÐö©
.
. each Block (size 0x200)
.
0D34F200 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D34F210 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...] 3 FF Blocks (size 0x600)
0D34F7E0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D34F7F0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D34F800 56 C9 9C 33 15 EA 73 27 08 57 40 B1 85 0A BF 10  VÉœ3.ês'.W@±….¿.
0D34F810 1A 23 30 CC 84 1D 61 A4 7E AB FA 54 3C 86 A3 19  .#0Ì„.a¤~«úT<†£.
[...] 1 Block (size 0x200)
0D34F9E0 7E 62 C6 B5 A4 98 1C 3C 16 C5 4E DF 62 B9 47 E9  ~bƵ¤˜.<.ÅNßb¹Gé
0D34F9F0 23 82 19 D0 2E 36 DF DF D6 CA AA 5D C5 B6 07 DF  #‚.Ð.6ßßÖʪ]Ŷ.ß
</pre>
===== 0D34FA00 unreferenced area (size 0x3B0600) =====
<pre>
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0D34FA00  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D34FA10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0D6FFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D6FFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 0D700000 data area (size 0x200) ====
Also found at 0F700000 (missing cell_ext_os_area header) and 0CF00000 (with cell_ext_os_area header)
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0D700000  4C 21 70 8F DF 1C 65 49 23 E5 2C C1 D4 09 CC 71  L!p.ß.eI#å,ÁÔ.Ìq
0D700010  F1 05 2E 4D 41 FF 88 D9 F2 E3 FE 84 7C F6 A3 3F  ñ..MAÿˆÙòãþ„|ö£?
[...]
0D7001E0  A1 15 A8 02 3B 90 62 F2 A6 F1 9A BF 49 21 20 31  ¡.¨.;.bò¦ñš¿I! 1
0D7001F0  16 5F 29 CD A5 50 B8 79 7D 15 11 94 B6 8C 27 87  ._)Í¥P¸y}..”¶Œ'‡
</pre>
===== 0D700200 unreferenced area (size 0x1E00) =====
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0D700200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D700210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0D701FE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D701FF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 0D702000 data area (size 0x4D200) ====
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0D702000  B4 88 04 F1 A5 9C E7 64 BD 35 0A 91 7E 60 B7 B5  ´ˆ.ñ¥œçd½5.‘~`·µ
0D702010  42 66 0A 14 1E 66 30 B8 CB 0B D3 81 61 F0 CE 99  Bf...f0¸Ë.Ó.aðΙ
[...]
0D74F1E0  43 B5 D3 F8 57 20 D6 7F 75 5C B5 DF 28 81 32 0A  CµÓøW Ö.u\µß(.2.
0D74F1F0  C1 3F E5 FE 1B BF 05 5D DA DC C2 B6 76 05 AD F1  Á?åþ.¿.]Úܶv..ñ
</pre>
===== 0D74F200 unreferenced area (size 0x600) =====
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0D74F200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D74F210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0D74F7E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D74F7F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 0D74F800 data area (size 0x42200) ====
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0D74F800  56 C9 9C 33 15 EA 73 27 08 57 40 B1 85 0A BF 10  VÉœ3.ês'.W@±….¿.
0D74F810  1A 23 30 CC 84 1D 61 A4 7E AB FA 54 3C 86 A3 19  .#0Ì„.a¤~«úT<†£.
[...]
0D7919E0  32 0D A4 EC 6D 5B F8 E3 42 55 E2 FF 69 46 C0 4F  2.¤ìm[øãBUâÿiFÀO
0D7919F0  98 F0 D8 AB 7C 76 D2 09 F3 2F 09 4B CE 99 76 23  ˜ðØ«|vÒ.ó/.KΙv#
</pre>
===== 0D791A00 unreferenced area (size 0x600) =====
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0D791A00  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D791A10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0D791FE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D791FF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 0D792000 data area (size 0x200) ====
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0D792000  8E 24 22 F5 99 B7 B2 FE 1A 02 8D 1D 03 42 ED 56  Ž$"õ™·²þ.....BíV
0D792010  51 E6 C3 A0 AE BA 27 0B E2 29 14 D3 3F 05 AF C1  Qæ஺'.â).Ó?.¯Á
[...]
0D7921E0  99 F5 22 6D CD D3 04 FA 76 34 8D 85 66 5B 7A CD  ™õ"mÍÓ.úv4.…f[zÍ
0D7921F0  69 88 06 85 F2 AD 62 3C 3B 31 A3 CE C2 40 51 C2  iˆ.…ò.b<;1£ÎÂ@QÂ
</pre>
===== 0D792200 unreferenced area (size 0x600) =====
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0D792200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D792210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0D7927E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D7927F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 0D792800 data area (size 0x200) ====
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0D792800  4A BE BF 27 59 AA FF 01 83 06 36 04 E6 AA E2 74  J¾¿'Yªÿ.ƒ.6.æªât
0D792810  8E CF 92 2F CC 40 16 01 FE 66 97 D0 EA B4 B9 04  ŽÏ’/Ì@..þf—Ðê´¹.
[...]
0D7929E0  27 3C 22 2B 61 67 95 58 FF D0 E3 30 11 40 80 9F  '<"+ag•XÿÐã0.@€Ÿ
0D7929F0  5E 19 19 D5 A8 98 E9 28 D9 D9 40 F8 BA 30 72 27  ^..Õ¨˜é(ÙÙ@øº0r'
</pre>
===== 0D792A00 unreferenced area (size 0xBED800) =====
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0D791A00  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D791A10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0E3801E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E3801F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 0D340000 - 0D34F9FF (0x200 Blocks) ====
Maybe backup blocks or bad mapping. Data Blocks are equal to prior data blocks.
Seen in 0D74F800 data area.
 
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0E380200  53 5A F5 55 DE 8E 6A 78 AC 78 DB 9B 3A EF 13 9A  SZõUÞŽjx¬xÛ›:ï.š
0E380210  D7 D2 13 70 B2 05 C9 A0 81 E3 CF B9 41 CF 25 1B  ×Ò.p².É .ãϹAÏ%.
[...]
0E3803E0  41 76 D4 0E 1C 99 C8 11 8B B4 45 12 E1 FD C2 0F  AvÔ..™È.‹´E.áýÂ.
0E3803F0  44 7B C7 0C E9 9A A4 F9 91 94 CD C8 91 F8 47 75  D{Ç.隤ù‘”ÍÈ‘øGu
0E380400  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E380410  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0E3805E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E3805F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E380600  F6 F8 1B 33 21 1F 32 E4 FE 9E 3D 19 21 66 3B A2  öø.3!.2äþž=.!f;¢
0E380610  7F 85 CB 4C 91 8E F7 A1 C2 DC 18 C3 5D 50 C2 D8  .…ËL‘Ž÷¡ÂÜ.Ã]PÂØ
.
. 0x200 Blocks FF and data areas repepeats till 0E38FFFF
.
0E38FFE0  35 3F C1 7E E3 19 83 D8 C8 20 81 71 D8 1D 21 6E  5?Á~ã.ƒØÈ .qØ.!n
0E38FFF0  07 11 D2 3E 19 24 A9 BC 24 4B 46 3D 16 16 0C 65  ..Ò>.$©¼$KF=...e
</pre>
===== 0E390000 unreferenced area (size 0x370000) =====
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0E390000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E390010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0E6FFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E6FFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 0E700000 data area (size 0x200) ====
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0E700000  64 F0 28 49 C5 4F ED 7B AE D7 88 C9 22 64 1E 69  dð(IÅOí{®×ˆÉ"d.i
0E700010  3C 7E 94 3C 35 4D 80 F7 37 AB A7 20 D7 C6 C8 C7  <~”<5M€÷7«§ ×ÆÈÇ
[...]
0E7001E0  39 C5 4C ED 8C C7 CE 08 EE 0B FD E7 69 85 F2 28  9ÅLíŒÇÎ.î.ýçi…ò(
0E7001F0  7C FD F2 9C 7D 2D D3 E1 2A B8 6F 19 FF 25 F8 BC  |ýòœ}-Óá*¸o.ÿ%ø¼
</pre>
===== 0E700200 unreferenced area (size 0x1E00) =====
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0E700200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E700210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0E701FE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E701FF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 0E700000 data area (size 0x59A00) ====
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0E702000  A2 DC 30 17 47 6D E1 53 18 F9 DB D8 9D 87 27 5E  ¢Ü0.GmáS.ùÛØ.‡'^
0E702010  3D C6 C6 E7 D9 DC 86 E5 39 53 D1 7F 7C 12 3A 7E  =ÆÆçÙ܆å9SÑ.|.:~
[...]
0E75B9E0  A2 E6 63 4F CA 80 E0 D0 A1 59 A5 B3 47 8F 73 F1  ¢æcOÊ€àСY¥³G.sñ
0E75B9F0  C6 68 5E A6 57 72 00 CE B7 97 B1 C1 78 2A 26 9A  Æh^¦Wr.η—±Áx*&š
</pre>
===== 0E75BA00 unreferenced area (size 0x24600) =====
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0E75BA00  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E75BA10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0E77FFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E77FFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
 
=== cell_ext_os_area ===
[[Flash:cell_ext_os_area]]
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0E780000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E780010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ      missing header
0E780020  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0E7801F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E780200  00 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF  ....ÿÿÿÿÿÿÿÿÿÿÿÿ
0E780210  00 00 00 03 FF FF FF FF FF FF FF FF FF FF FF FF  ....ÿÿÿÿÿÿÿÿÿÿÿÿ
0E780220  00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF  ..........ÿÿÿÿÿÿ
0E780230  00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF  ............ÿÿÿÿ
0E780240  00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF  ........ÿÿÿÿÿÿÿÿ
0E780250  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0E7807E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E7807F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
 
[https://www.kernel.org/pub/linux/kernel/people/geoff/cell/ps3-linux-docs/BootLinuxAndInstallation.html crosschecking]
 
=== OtherOS ===
[[Flash:OtherOS]]
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0E780800  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E780810  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0EB021E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0EB021F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
 
==== 0EB02200 - 0EB05FFF data area (0x200 Blocks) ====
Maybe backup blocks or bad mapping. Data blocks are equal to prior data blocks.
Seen in 0D702000 data area.
 
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0EB02200  18 FF 37 DF F2 B3 82 82 8C 20 E8 79 05 8B 18 89  .ÿ7ßò³‚‚Œ èy.‹.‰
0EB02210  39 4D B7 8C 3D 5D 0B 7F E3 80 C8 4F E3 FB 99 46  9M·Œ=]..ã€ÈOãû™F
[...]
0EB023E0  EF FB F0 37 9C B9 F8 B1 1B 04 BA 3A 5B C3 F6 6D  ïûð7œ¹ø±..º:[Ãöm
0EB023F0  0D C5 F2 A1 FB 8E 06 A8 43 76 BD 8B 86 23 40 EF  .Åò¡ûŽ.¨Cv½‹†#@ï
0EB02400  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0EB02410  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
.
. 0x200 Blocks FF and data areas repepeats till 0EB05FFF
.
0EB05FE0  75 9A 64 74 57 DA 61 DD 8C 90 AF D4 A9 E6 8B 9B  ušdtWÚaÝŒ.¯Ô©æ‹›
0EB05FF0  10 A5 44 0F 53 F1 67 96 C8 A1 1D 22 48 54 31 25  .¥D.Sñg–È¡."HT1%
</pre>
===== 0EB06000 unreferenced area (size 0x4FA000) =====
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0EB06000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0EB06010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0EFFFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0EFFFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
=== bootldr ===
[[Flash:bootldr]] @ 0xF000000 - 0xF03FFFF
 
=== unreferenced area ===
===== 0F040000 unreferenced area (size 0xB00000) =====
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0FB3FFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0FB3FFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0FB3FFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0FB3FFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
 
==== 0F700000 data area (size 0x200) ====
Seen in 0D700000 data area. Maybe backup block or bad mapping.
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0F700000  4C 21 70 8F DF 1C 65 49 23 E5 2C C1 D4 09 CC 71  L!p.ß.eI#å,ÁÔ.Ìq
0F700010  F1 05 2E 4D 41 FF 88 D9 F2 E3 FE 84 7C F6 A3 3F  ñ..MAÿˆÙòãþ„|ö£?
[...]
0F7001E0  A1 15 A8 02 3B 90 62 F2 A6 F1 9A BF 49 21 20 31  ¡.¨.;.bò¦ñš¿I! 1
0F7001F0  16 5F 29 CD A5 50 B8 79 7D 15 11 94 B6 8C 27 87  ._)Í¥P¸y}..”¶Œ'‡
</pre>
===== F700200 unreferenced area (size 0x1E00) =====
<pre>Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
0F700200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0F700210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0F701FE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0F701FF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
</pre>
==== 0F702000 - F705DFF (0x200 Blocks) ====
As before alternating 0x200 datablocks and ff blocks.
Data seen in prior 0D702000 data area.
 
'''The whole section till the end contains these 0x200 blocks of data and FF. Some bigger FF gaps in between.'''


  [8/31/2011 1:41:13 AM] xxxxxxxxxxxxxx: the information on the PS3 dev wiki was intentionally faulty
  [8/31/2011 1:41:15 AM] qqqqq: Use the creativity or fail to find it.
[...]
  [8/31/2011 1:41:34 AM] xxxxxxxxxxxxxx: so people can't use the 'knowledge'
[...]
  [8/31/2011 1:41:43 AM] qqqqq: xxxxxx, uuuu has done a very good job at fixing what IS wrong. If you saw something wrong, why didn't you ask uuuu about it to fix it?
  [8/31/2011 1:41:55 AM] xxxxxxxxxxxxxx: that's not what guys like rrrrrrr have told me
  [8/31/2011 1:41:58 AM] xxxxxxxxxxxxxx: it's intentionally faulty
  [8/31/2011 1:42:03 AM] qqqqq: Instead you left it  how it was and bitched about it.
  [8/31/2011 1:42:07 AM] xxxxxxxxxxxxxx: to prevent any meaningful extraction of keys
  [8/31/2011 1:42:11 AM] qqqqq: If it was fault again talk to uuuu
  [8/31/2011 1:42:24 AM] xxxxxxxxxxxxxx: no - uuuu could not have even known about it
  [8/31/2011 1:42:28 AM] xxxxxxxxxxxxxx: it was something only a kkkk could know
  [8/31/2011 1:42:45 AM] qqqqq: You'd be surprised what uuuu knows. he really is a walking encyclopedia of the ps3.
  [8/31/2011 1:42:48 AM] xxxxxxxxxxxxxx: that wiki is compromised with purposeful misinformation
  [8/31/2011 1:42:59 AM] xxxxxxxxxxxxxx: and that's what rrrrrrr actually said and thinks
  [8/31/2011 1:43:17 AM] xxxxxxxxxxxxxx: I'm talking about ps3 dev wiki BTW here
  [8/31/2011 1:43:25 AM] qqqqq: if it's providing false info, then why not make a site to provide the right info? *gasps*
  [8/31/2011 1:43:34 AM] xxxxxxxxxxxxxx: well he did make the suggestion
  [8/31/2011 1:43:38 AM] xxxxxxxxxxxxxx: but it didn't go over well with these people
  [8/31/2011 1:43:45 AM] yyyyyyyy: kkkk wasn't the only one with cex-dex shit
  [8/31/2011 1:43:50 AM] yyyyyyyy: hell he's not even the one who wrote it
  [8/31/2011 1:44:01 AM] yyyyyyyy: so you can stfu about that
  [8/31/2011 1:44:09 AM] xxxxxxxxxxxxxx: hell do I know who the fuck wrote CEX-DEX
  [8/31/2011 1:44:27 AM] xxxxxxxxxxxxxx: all I know is that there are a bunch of connivant shits that want a wiki intentionally 'disinfoed' like that
  [8/31/2011 1:44:35 AM] xxxxxxxxxxxxxx: people in the know
  [8/31/2011 1:44:49 AM] yyyyyyyy: and one conniving shit here trying to save his hide
  [8/31/2011 1:44:57 AM] qqqqq: xxxxxx, again as i said. If there was false info (Which uuuu would never do) Why not fix it
  [8/31/2011 1:45:21 AM] xxxxxxxxxxxxxx: go ask rrrrrrr - I dunno
  [8/31/2011 1:45:26 AM] qqqqq: DO you think he purposesly makes changes so that it's wrong? That'd create an even bigger headache if a noob attempted it and bugged us in the chat
  [8/31/2011 1:45:32 AM] xxxxxxxxxxxxxx: the EID/CEX-DEX info was incomplete
  [8/31/2011 1:45:33 AM] xxxxxxxxxxxxxx: faulty




----
----


= Howto find which address line is not connected or bad =
== Hidden value in VTRM (NOR Flash) ==
[[Flash:cvtrm]]
 
* from offset 0xEDD748 count 199 (0xC7) values of a 0x14 byte value (hash1) until you reach 0xEDE6D4, where you'll find another 0x14 byte value (hash2)
* from there, count 520 (321 + 199) values of the same repeated 0x14 byte value until you reach the second offset where you'll find the same hash of the first 199 step count (you can just search for the value to encounter it faster).
* in the area in the middle there's a third 0x14 value (hash3) at offset 0xEE4010 (repeated also twice in each vtrm)
 
maybe these are all sha1 hashes of something?
 
* 0xEE4010 should be an sha1 of root hsec, if syscon sends different hsec the sha1 wont match to VTRM it will lead to an [[RSOD]]. (root hash/ root hsec - srh)
* vtrm table is almost equally build up like PFD files.
 
===Experiments (with above hashes)===
 
* replacing both hash 2 with either hash3 or hash1 doesn't result in RSOD. why? (possibly hash1 and hash3 are fallback hashes?)
* filling hash2 with any other value besides hash1/2/3 in hash2 WILL result in RSOD
* no considerable changes found with experiment. most considerable changes would happen when the guilty is hardware and not software.
* hash_repeated:hmac_sha1(srk,empty data)
* hash_hidden:hmac_sha1(srk,0x58 bytes of empty sector)
* srh is the hash of the signature table (the giant table with the repeated hashes and the hidden one) hashed with srk key
* header hash is just a hmac sha1 of hmac sha1 of vtrm section without header (0x28 bytes) and signature table(again, with srk key, hashed twice)
 
= RAW NAND + bad blocks =
Each page of a block has 2048 bytes of data plus a 64 bytes oob (out of bounds) or spare area. This oob area contains 4*14 bytes ecc data for 4*512 bytes of actual data (of which 10 bytes are the actual ecc plus 4 unknown bytes). It totally unrelated to bad blocks. The remaining 8 bytes of oob contain eg. information of block status (good or bad) and the block mapping (physical block location in nand mapped to logical block location in merged dump).
 
The PS3 has many different ways of doing this depending on the location of bad blocks. That's [[:File:Nand-extract-error2.png|where flowrebuilder fails]], because it doesn't know all the different ways of doing it (if it [[:File:Nand-extract-noerror.png|doesn't fail]] it means it had bad blocks in a way that Flowrebuilder understands).
 
== As requoted from NORpatch ==
https://raw.githubusercontent.com/hjudges/NORway/824bab547698ebac8c69158d15e0c18d866c0a95/norpatch_README.txt
 
<div style="border-width: 1px; border-style:dashed; border-color:#000000; padding: 10px; background-color:#FFFFFF; color:#000000; ">Some additional information on how to use "norpatch" for checking ECC errors of raw NAND dumps...
 
<nowiki>***</nowiki> All credits go to "RPS" who developed/reversed the ECC algo (according to Flow Rebuilder title). <nowiki>***</nowiki>


== Find the pattern ==
The algo was like forever available in Flow Rebuilder, but it was only used to create new ECCs for patched dumps. I actually don't know why there's no "checking" function. I've been using it for over a year now to validate nand dumps, cause it's a handy *additional* verification step. I've been asked many times to release this, but I didn't develop the algo, so I never did. Since the Flow Rebuilder source code is floating around anyway, I figured what the heck. Feel free to complain.. :P
take 16 bytes of an offset that should be unique, e.g. the 0x10 offset which normaly has the DEADBEEF magic header :
  NOR: 0x0000010 00 00 00 00 0F AC E0 FF 00 00 00 00 DE AD BE EF  //  NAND: 0x040010 00 00 00 00 0F AC E0 FF 00 00 00 00 DE AD BE EF
And find all instances in hexeditor <br />
When it says found in 0x10 and 0x10010 you substract them (0x10010 - 0x10 = 0x10000) <br />
So that means there is an error with setting 0x10000 (only one bit set!) low <br />
because the programmer applies 0x10010 but the actual data on the address lines (received by the nor flash) is 0x10 <br />


== Checking again with other unique 16 byte sequence ==
It's important to understand what ECC (Error Correcting Code) is and what it does (and more importantly - what it doesn't do!):
  617365637572655F6C6F616465720000 (asecure_loader in hex)
* A PS3 NAND has a 10 byte ECC for each 512 byte sector.
Same check, found at 0x420 and 0x10420 (0x10420-0x420 = 0x10000)
* The PS3 uses the ECC to detect and correct errors (as everything with Sony it's a propriatary algo, but commonly a 10 byte ECC can correct up to 4 invalid bytes).
* RPS' implementation can only be used to detect errors, not to correct them!


== OK, you've found the pattern, now how do we deduct from that the faulty line? ==
Where ECC fails:
address is 2 bytes. 0x10 in dump with hexeditor is in reality 0x8 on the address bus because we read 2 bytes at once <br />
* Your flasher returned all 0xFF for a sector/page/block instead of correct data. This won't be detected by ECC, as the ECC for 512 * 0xFF = 10 * 0xFF.
so the address is no longer 0x10000 but 0x8000 <br />
* Your flasher swapped pages while dumping, e.g. page 0 is located at the offset of page 1 and vice versa. The ECC will be correct, but the dump is still invalid.
0x8000 (hexadecimal = base 16) = 1000 0000 0000 0000 (binary = base 2) <br />
which means the 16th bit = 1, we start counting at A0, so the 16th is A15 <br />


conclusion : A15 is bad
What do you do when there are ECC errors?
* ECC errors are normal and it does happen that a NAND cell loses its content. Usually the PS3 will correct the error.
* As a rule of thumb you can say that up to 10 errors per dump are a valid range. If you get significantly more than that, you should worry (in case of a bad dump, you'll usually get hundreds of errors - or no errors at all if your dump is just 0xFF's :) ).
* When there're 10 or less errors, check the location of the errors - this requires some calculation: you'll get a block number for the error, which is the physical block in your raw dump. You have to convert this physical block number to a logical offset in your merged dump generated by Flow Rebuilder. When unscrambling dumps, Flow Rebuilder will create a text file called "nand0_phy_mapping.txt" and "nand1_phy_mapping.txt". Open the file that corresponds to the dump you've checked for ECC errors (0=top, 1=bottom). First column is the physical block, second column is the logical block. Locate the physical block number reported by the ECC check, take the corresponding (decimal) logical block number and multiply it with 0x40000 (hex). The result is the offset in your merged dump. Anything from 0x00C0000 to 0x0EBFFFF (ROS 0/1) and from 0x0F00000 to 0xEFFFFFF (VFlash) can usually be ignored. For everything else you should worry.


<!--//
In general:
{| class="wikitable"
* Always make multiple dumps and file compare them!
* ECC checks don't eliminate the need for additional validation!
* Additionally use one or all of the awesome dump validators out there! "norpatch" is not a full-fletched validator!
* I personally use BwE, especially because it will catch the 0xFF ECC issue mentioned before with its repetition check (I guess Swizzy's tool does this as well now).
<br /><br />
-- judges</div>
 
= Flash Samples =
 
== Reference flash dumps ==
* 3.55 kmeaw, 2.80 backup: <span style="text-decoration: line-through;">http://www.megaupload.com/?d=J5UKO3HX</span>
* 3.66 ofw: <span style="text-decoration: line-through;">http://www.mediafire.com/?m7m4mppro66zib5</span>
 
== User flashdumps ==
Here are some samples of NOR Flash for your dissection. These are taken from different consoles (because it is useless to dump different firmware versions as ROS/RVK will be the same crossconsole)
 
{| class="wikitable sortable"
|-
|-
! Sector !! colspan="6" | A22-A16  !! Sector<br />Size<br />(Kbytes<br />/Kwords) !! 8-Bit<br />Address Range !! 16-bit<br />Address Range
! SKU !! bootldr !! metldr !! ROS0 !! ROS1 !! Link !! Note
|-
|-
| SA0 || 0 || 0 || 0 || 0 || 0 || 0 || 128/64 || 0000000-001FFFF || 0000000-000FFFF
! colspan="7" | PS3 Phat:
|-
|-
| SA1 || 0 || 0 || 0 || 0 || 0 || 1 || 128/64 || 0020000-003FFFF || 0010000-001FFFF
| [[CECHAxx|CECHA]] || || || || || ||  
|-
|-
| SA2 || 0 || 0 || 0 || 0 || 1 || 0 || 128/64 || 0040000-005FFFF || 0020000-002FFFF
| [[CECHBxx|CECHB]] || || || || || ||  
|-
|-
| SA3 || 0 || 0 || 0 || 0 || 1 || 1 || 128/64 || 0060000-007FFFF || 0030000-003FFFF
| [[CECHCxx|CECHC]] || || || || || ||  
|-
|-
| SA4 || 0 || 0 || 0 || 1 || 0 || 0 || 128/64 || 0080000-009FFFF || 0040000-004FFFF
| [[CECHExx|CECHE]] || || || || || ||  
|-
|-
| SA5 || 0 || 0 || 0 || 1 || 0 || 1 || 128/64 || 00A0000-00BFFFF || 0050000-005FFFF
| [[CECHGxx|CECHG]] || || || || || ||  
|-
|-
| SA6 || 0 || 0 || 0 || 1 || 1 || 0 || 128/64 || 00C0000-00DFFFF || 0060000-006FFFF
| [[CECHHxx|CECHH]] || || || || || ||  
|-
|-
| SA7 || 0 || 0 || 0 || 1 || 1 || 1 || 128/64 || 00E0000-00FFFFF || 0070000-007FFFF
| [[CECHJxx|CECHJ]] || || || || || ||  
|-
|-
| SA8 || 0 || 0 || 1 || 0 || 0 || 0 || 128/64 || 0100000-011FFFF || 0080000-008FFFF
| [[CECHKxx|CECHK]]|| || || || || ||  
|-
|-
| SA9 || 0 || 0 || 1 || 0 || 0 || 1 || 128/64 || 0120000-013FFFF || 0090000-009FFFF
| [[CECHLxx|CECHL]] || || || || || [http://punkie.xs4all.nl/CECHL03_CFW3.55_bkpps3.bin.zip] || 3.55-Rogero CECHL03
|-
|-
| SA10 || 0 || 0 || 1 || 0 || 1 || 0 || 128/64 || 0140000-015FFFF || 00A0000-00AFFFF
| [[CECHLxx|CECHL]] || || || || || [http://punkie.xs4all.nl/CECHL03_OFW3.56_bkpps3.bin.zip] || 3.56 CECHL03
|-
|-
| SA11 || 0 || 0 || 1 || 0 || 1 || 1 || 128/64 || 0160000-017FFFF || 00B0000-00BFFFF
| [[CECHLxx|CECHL]] || || || || || [http://punkie.xs4all.nl/CECHL03_OFW3.70_bkpps3.bin.zip] || 3.70 CECHL03
|-
|-
| SA12 || 0 || 0 || 1 || 1 || 0 || 0 || 128/64 || 0180000-019FFFF || 00C0000-00CFFFF
| [[CECHMxx|CECHM]] || || || || || ||  
|-
|-
| SA13 || 0 || 0 || 1 || 1 || 0 || 1 || 128/64 || 01A0000-01BFFFF || 00D0000-00DFFFF
| [[CECHPxx|CECHP]] || || || || || ||  
|-
|-
| SA14 || 0 || 0 || 1 || 1 || 1 || 0 || 128/64 || 01C0000-01DFFFF || 00E0000-00EFFFF
| [[CECHQxx|CECHQ]] || || || || || ||  
|-
|-
| SA15 || 0 || 0 || 1 || 1 || 1 || 1 || 128/64 || 01E0000-01FFFFF || 00F0000-00FFFFF
! colspan="7" | PS3 Slim:
|-
|-
| SA16 || 0 || 1 || 0 || 0 || 0 || 0 || 128/64 || 0200000-021FFFF || 0100000-010FFFF
| [[CECH-20xx|CECH-20xx]] || || || 3.65 || 3.55 || [http://dl.dropbox.com/u/964586/CECH-2008A%203.65%20OFW.bin] || 3.65 CECH-2008 A
|-
|-
| SA17 || 0 || 1 || 0 || 0 || 0 || 1 || 128/64 || 0220000-023FFFF || 0110000-011FFFF
| [[CECH-20xx|CECH-20xx]] || || || 3.56 || 3.56 || [http://dl.dropbox.com/u/964586/CECH-2008B%203.56%20OFW.bin] || 3.56 CECH-2008 B
|-
|-
| SA18 || 0 || 1 || 0 || 0 || 1 || 0 || 128/64 || 0240000-025FFFF || 0120000-012FFFF
| [[CECH-20xx|CECH-20xx]] || || || 3.42 || 3.70 || [http://dl.dropbox.com/u/964586/CECH-2008B%203.70%20OFW.bin] || 3.70 CECH-2008 B
|-
|-
| SA19 || 0 || 1 || 0 || 0 || 1 || 1 || 128/64 || 0260000-027FFFF || 0130000-013FFFF
| [[CECH-20xx|CECH-20xx]] || || || 3.72 || 4.00 || [http://dl.dropbox.com/u/964586/CECH-2008B%204.00%20OFW.bin] || 4.00 CECH-2008 B
|-
|-
| SA20 || 0 || 1 || 0 || 1 || 0 || 0 || 128/64 || 0280000-029FFFF || 0140000-014FFFF
| [[CECH-21xx|CECH-21xx]] || || || || || ||  
|-
|-
| SA21 || 0 || 1 || 0 || 1 || 0 || 1 || 128/64 || 02A0000-02BFFFF || 0150000-015FFFF
| [[CECH-25xx|CECH-25xx]] || || || 3.66 || 3.56 || [http://dl.dropbox.com/u/964586/CECH-2508B%203.60%20OFW.bin] || 3.60 CECH-2508 B
|-
|-
| SA22 || 0 || 1 || 0 || 1 || 1 || 0 || 128/64 || 02C0000-02DFFFF || 0160000-016FFFF
| [[CECH-25xx|CECH-25xx]] || || || 3.66 || 3.72 || [http://dl.dropbox.com/u/964586/CECH-2508B%203.72%20OFW.bin] || 3.72 CECH-2508 B
|-
|-
| SA23 || 0 || 1 || 0 || 1 || 1 || 1 || 128/64 || 02E0000-02FFFFF || 0170000-017FFFF
| [[CECH-30xx|CECH-30xx]] || || || || || ||  
|-
|-
| SA24 || 0 || 1 || 1 || 0 || 0 || 0 || 128/64 || 0300000-031FFFF || 0180000-018FFFF
|}
 
= Flash checking / extraction =
 
== Community projects ==
* http://www.ps3hax.net/showthread.php?t=50677
** https://github.com/anaria28/NOR-Dump-Tool
* https://github.com/Swizzy/PS3DumpChecker
* flash_ident.c: http://pastie.org/private/vlrxgaawtbqwggyv4ggwg
 
== Generic Recommendations ==
* The information in this wiki was given [[http://www.gnu.org/licenses/old-licenses/fdl-1.2.txt freely by many volunteers]] ; it would be most fair to release any program based on it, as opensource with the community accordingly (tip: [http://git.ps3dev.net/ public git-repo]).
* Please link to wiki so that others might improve the code and also know on what information it is based as well as other informative pages.
* Feel free to ask questions on the talkpages when having trouble understanding mainpage or when not knowing what to check for.
* Make checkers/extractors bytedirection aware and byteswap when needed
* There are several flash dumptypes that can exist (besides the normal full ones):
** NAND
*** Software dump without any bootldr and with or without masking (old software flashdump and Preloader)
*** Software dump with only one bootldr (Memdump)
*** Hardware dump with both bootldr (normal full dump)
** NOR
*** Software dumps (Preloader)
*** Hardware dumps (normal full dump)
* Do not take shortcuts. Make users aware if any section is not checked (yet)
* Use dynamic sections whenever possible (will make it easier to port from NAND <> NOR, be more robust in checking, make it more future/history proof)
* Check if data-/file-sections are uninterupted (multirepetive 00 or FF)
* Check for known static values
* When values are semistatic, consider checking with wildcard /range masks
* Make the user aware of any anomalies (in red/bold)
* Output generic information (version, console info, minver etc)
* Check for downgradeability
* Check statistics in range with known FW versions (3.55 is considered base on wiki unless documented)
 
= With / Without =
 
* Flash Without EID5 : Boots Fine
* Flash Without EID0 Sections 1 2 3 4 5 7 8 9 and With Sections 0 6 A : Boots Fine
* Flash With only MAC Address on cISD and Header: Boots Fine
 
=Experimental tables=
 
{| class="wikitable"
|+NOR flash
! rowspan="2" | type !! rowspan="2" colspan="4" | Regions !! colspan="3" | Start Offset !! colspan="3" | Length !! Notes
|-
|-
| SA25 || 0 || 1 || 1 || 0 || 0 || 1 || 128/64 || 0320000-033FFFF || 0190000-019FFFF
! Hex !! Blocks !! Bytes !! Hex !! Blocks !! Bytes
|-
|-
| SA26 || 0 || 1 || 1 || 0 || 1 || 0 || 128/64 || 0340000-035FFFF || 01A0000-01AFFFF
| {{generic}} || rowspan="8" | [[Flash:Second_Region|Second<br>Region]] || rowspan="2" | Partition table || colspan="2" | [[Flash:0FACE0FF_DEADFACE|0FACE0FF DEADFACE]] || || ||  ||  ||  ||  ||  
|-
|-
| SA27 || 0 || 1 || 1 || 0 || 1 || 1 || 128/64 || 0360000-037FFFF || 01B0000-01BFFFF
| {{generic}} || colspan="2" | erased bytes || || || || || || ||  
|-
|-
| SA28 || 0 || 1 || 1 || 1 || 0 || 0 || 128/64 || 0380000-039FFFF || 01C0000-01CFFFF
| {{generic}} || region 0 || colspan="2" | missing || || ||| || || ||  
|-
|-
| SA29 || 0 || 1 || 1 || 1 || 0 || 1 || 128/64 || 03A0000-03BFFFF || 01D0000-01DFFFF
| {{generic}} || region 1 || colspan="2" | [[Flash:CELL_EXTNOR_AREA|CELL_EXTNOR_AREA]] || || || || || || ||  
|-
|-
| SA30 || 0 || 1 || 1 || 1 || 1 || 0 || 128/64 || 03C0000-03DFFFF || 01E0000-01EFFFF
| {{generic}} || rowspan="4" | region 2 || colspan="2" | [[Flash:CELL_EXTNOR_AREA#F40000|CRL1]] || || || || ||  ||  ||  
|-
|-
| SA31 || 0 || 1 || 1 || 1 || 1 || 1 || 128/64 || 03E0000-03FFFFF || 01F0000-01FFFFF
| {{generic}} || colspan="2" | [[Flash:CELL_EXTNOR_AREA#F60000|DRL1]] || || || || || || ||  
|-
|-
| SA32 || 1 || 0 || 0 || 0 || 0 || 0 || 128/64 || 0400000-041FFFF || 0200000-020FFFF
| {{generic}} || colspan="2" | [[Flash:CELL_EXTNOR_AREA#F80000|CRL2]] || || || || || || ||  
|-
|-
| SA33 || 1 || 0 || 0 || 0 || 0 || 1 || 128/64 || 0420000-043FFFF || 0210000-021FFFF
| {{generic}} || colspan="2" | [[Flash:CELL_EXTNOR_AREA#FA0000|DRL2]] || || || || || || ||  
|-
|-
| SA34 || 1 || 0 || 0 || 0 || 1 || 0 || 128/64 || 0440000-045FFFF || 0220000-022FFFF
| {{perconsole}} || colspan="4" | [[Flash:bootldr|bootldr]] || || || || || || ||  
|-
|-
| SA35 || 1 || 0 || 0 || 0 || 1 || 1 || 128/64 || 0460000-047FFFF || 0230000-023FFFF
|}
|-
 
| SA36 || 1 || 0 || 0 || 1 || 0 || 0 || 128/64 || 0480000-049FFFF || 0240000-024FFFF
<!-- old tests, hidden
|-
 
| SA37 || 1 || 0 || 0 || 1 || 0 || 1 || 128/64 || 04A0000-04BFFFF || 0250000-025FFFF
{| class="wikitable"
|-
|+NOR flash
| SA38 || 1 || 0 || 0 || 1 || 1 || 0 || 128/64 || 04C0000-04DFFFF || 0260000-026FFFF
! rowspan="2" | type !! rowspan="2" | Region !! rowspan="2" colspan="3" | Name !! colspan="2" | Hexadecimal !! colspan="2" | Blocks !! colspan="2" | Decimal !! rowspan="2" | Notes
|-
| SA39 || 1 || 0 || 0 || 1 || 1 || 1 || 128/64 || 04E0000-04FFFFF || 0270000-027FFFF
|-
| SA40 || 1 || 0 || 1 || 0 || 0 || 0 || 128/64 || 0500000-051FFFF || 0280000-028FFFF
|-
| SA41 || 1 || 0 || 1 || 0 || 0 || 1 || 128/64 || 0520000-053FFFF || 0290000-029FFFF
|-
| SA42 || 1 || 0 || 1 || 0 || 1 || 0 || 128/64 || 0540000-055FFFF || 02A0000-02AFFFF
|-
| SA43 || 1 || 0 || 1 || 0 || 1 || 1 || 128/64 || 0560000-057FFFF || 02B0000-02BFFFF
|-
| SA44 || 1 || 0 || 1 || 1 || 0 || 0 || 128/64 || 0580000-059FFFF || 02C0000-02CFFFF
|-
| SA45 || 1 || 0 || 1 || 1 || 0 || 1 || 128/64 || 05A0000-05BFFFF || 02D0000-02DFFFF
|-
| SA46 || 1 || 0 || 1 || 1 || 1 || 0 || 128/64 || 05C0000-05DFFFF || 02E0000-02EFFFF
|-
| SA47 || 1 || 0 || 1 || 1 || 1 || 1 || 128/64 || 05E0000-05FFFFF || 02F0000-02FFFFF
|-
| SA48 || 1 || 1 || 0 || 0 || 0 || 0 || 128/64 || 0600000-061FFFF || 0300000-030FFFF
|-
| SA49 || 1 || 1 || 0 || 0 || 0 || 1 || 128/64 || 0620000-063FFFF || 0310000-031FFFF
|-
| SA50 || 1 || 1 || 0 || 0 || 1 || 0 || 128/64 || 0640000-065FFFF || 0320000-032FFFF
|-
| SA51 || 1 || 1 || 0 || 0 || 1 || 1 || 128/64 || 0660000-067FFFF || 0330000-033FFFF
|-
| SA52 || 1 || 1 || 0 || 1 || 0 || 0 || 128/64 || 0680000-069FFFF || 0340000-034FFFF
|-
| SA53 || 1 || 1 || 0 || 1 || 0 || 1 || 128/64 || 06A0000-06BFFFF || 0350000-035FFFF
|-
| SA54 || 1 || 1 || 0 || 1 || 1 || 0 || 128/64 || 06C0000-06DFFFF || 0360000-036FFFF
|-
| SA55 || 1 || 1 || 0 || 1 || 1 || 1 || 128/64 || 06E0000-06FFFFF || 0370000-037FFFF
|-
| SA56 || 1 || 1 || 1 || 0 || 0 || 0 || 128/64 || 0700000-071FFFF || 0380000-038FFFF
|-
| SA57 || 1 || 1 || 1 || 0 || 0 || 1 || 128/64 || 0720000-073FFFF || 0390000-039FFFF
|-
| SA58 || 1 || 1 || 1 || 0 || 1 || 0 || 128/64 || 0740000-075FFFF || 03A0000-03AFFFF
|-
| SA59 || 1 || 1 || 1 || 0 || 1 || 1 || 128/64 || 0760000-077FFFF || 03B0000-03BFFFF
|-
| SA60 || 1 || 1 || 1 || 1 || 0 || 0 || 128/64 || 0780000-079FFFF || 03C0000-03CFFFF
|-
| SA61 || 1 || 1 || 1 || 1 || 0 || 1 || 128/64 || 07A0000-07BFFFF || 03D0000-03DFFFF
|-
| SA62 || 1 || 1 || 1 || 1 || 1 || 0 || 128/64 || 07C0000-07DFFFF || 03E0000-03EFFFF
|-
| SA63 || 1 || 1 || 1 || 1 || 1 || 1 || 128/64 || 07E0000-07FFFFF || 03F0000-03FFFFF
|-
| SA64 || 0 || 0 || 0 || 0 || 0 || 0 || 128/64 || 0800000-081FFFF || 0400000-040FFFF
|-
| SA65 || 0 || 0 || 0 || 0 || 0 || 1 || 128/64 || 0820000-083FFFF || 0410000-041FFFF
|-
| SA66 || 0 || 0 || 0 || 0 || 1 || 0 || 128/64 || 0840000-085FFFF || 0420000-042FFFF
|-
| SA67 || 0 || 0 || 0 || 0 || 1 || 1 || 128/64 || 0860000-087FFFF || 0430000-043FFFF
|-
| SA68 || 0 || 0 || 0 || 1 || 0 || 0 || 128/64 || 0880000-089FFFF || 0440000-044FFFF
|-
| SA69 || 0 || 0 || 0 || 1 || 0 || 1 || 128/64 || 08A0000-08BFFFF || 0450000-045FFFF
|-
| SA70 || 0 || 0 || 0 || 1 || 1 || 0 || 128/64 || 08C0000-08DFFFF || 0460000-046FFFF
|-
| SA71 || 0 || 0 || 0 || 1 || 1 || 1 || 128/64 || 08E0000-08FFFFF || 0470000-047FFFF
|-
| SA72 || 0 || 0 || 1 || 0 || 0 || 0 || 128/64 || 0900000-091FFFF || 0480000-048FFFF
|-
| SA73 || 0 || 0 || 1 || 0 || 0 || 1 || 128/64 || 0920000-093FFFF || 0490000-049FFFF
|-
| SA74 || 0 || 0 || 1 || 0 || 1 || 0 || 128/64 || 0940000-095FFFF || 04A0000-04AFFFF
|-
| SA75 || 0 || 0 || 1 || 0 || 1 || 1 || 128/64 || 0960000-097FFFF || 04B0000-04BFFFF
|-
| SA76 || 0 || 0 || 1 || 1 || 0 || 0 || 128/64 || 0980000-099FFFF || 04C0000-04CFFFF
|-
| SA77 || 0 || 0 || 1 || 1 || 0 || 1 || 128/64 || 09A0000-09BFFFF || 04D0000-04DFFFF
|-
| SA78 || 0 || 0 || 1 || 1 || 1 || 0 || 128/64 || 09C0000-09DFFFF || 04E0000-04EFFFF
|-
| SA79 || 0 || 0 || 1 || 1 || 1 || 1 || 128/64 || 09E0000-09FFFFF || 04F0000-04FFFFF
|-
| SA80 || 0 || 1 || 0 || 0 || 0 || 0 || 128/64 || 0A00000-0A1FFFF || 0500000-050FFFF
|-
| SA81 || 0 || 1 || 0 || 0 || 0 || 1 || 128/64 || 0A20000-0A3FFFF || 0510000-051FFFF
|-
| SA82 || 0 || 1 || 0 || 0 || 1 || 0 || 128/64 || 0A40000-0A5FFFF || 0520000-052FFFF
|-
| SA83 || 0 || 1 || 0 || 0 || 1 || 1 || 128/64 || 0A60000-0A7FFFF || 0530000-053FFFF
|-
| SA84 || 0 || 1 || 0 || 1 || 0 || 0 || 128/64 || 0A80000-0A9FFFF || 0540000-054FFFF
|-
| SA85 || 0 || 1 || 0 || 1 || 0 || 1 || 128/64 || 0AA0000-0ABFFFF || 0550000-055FFFF
|-
| SA86 || 0 || 1 || 0 || 1 || 1 || 0 || 128/64 || 0AC0000-0ADFFFF || 0560000-056FFFF
|-
| SA87 || 0 || 1 || 0 || 1 || 1 || 1 || 128/64 || 0AE0000-0AFFFFF || 0570000-057FFFF
|-
| SA88 || 0 || 1 || 1 || 0 || 0 || 0 || 128/64 || 0B00000-0B1FFFF || 0580000-058FFFF
|-
| SA89 || 0 || 1 || 1 || 0 || 0 || 1 || 128/64 || 0B20000-0B3FFFF || 0590000-059FFFF
|-
| SA90 || 0 || 1 || 1 || 0 || 1 || 0 || 128/64 || 0B40000-0B5FFFF || 05A0000-05AFFFF
|-
| SA91 || 0 || 1 || 1 || 0 || 1 || 1 || 128/64 || 0B60000-0B7FFFF || 05B0000-05BFFFF
|-
| SA92 || 0 || 1 || 1 || 1 || 0 || 0 || 128/64 || 0B80000-0B9FFFF || 05C0000-05CFFFF
|-
| SA93 || 0 || 1 || 1 || 1 || 0 || 1 || 128/64 || 0BA0000-0BBFFFF || 05D0000-05DFFFF
|-
| SA94 || 0 || 1 || 1 || 1 || 1 || 0 || 128/64 || 0BC0000-0BDFFFF || 05E0000-05EFFFF
|-
| SA95 || 0 || 1 || 1 || 1 || 1 || 1 || 128/64 || 0BE0000-0BFFFFF || 05F0000-05FFFFF
|-
| SA96 || 1 || 0 || 0 || 0 || 0 || 0 || 128/64 || 0C00000-0C1FFFF || 0600000-060FFFF
|-
|-
| SA97 || 1 || 0 || 0 || 0 || 0 || 1 || 128/64 || 0C20000-0C3FFFF || 0610000-061FFFF
! Start Offset !! Length !! Start Offset !! Length !! Start Offset !! Length
|-
|-
| SA98 || 1 || 0 || 0 || 0 || 1 || 0 || 128/64 || 0C40000-0C5FFFF || 0620000-062FFFF
| {{generic}} || rowspan="6" style="text-align:center" | [[Flash:Second_Region|2]] || colspan="3" | [[Flash:0FACE0FF_DEADFACE|0FACE0FF DEADFACE]] || 0xF00000 || 0x1000 || 0x7800 || || || 4096 bytes ||  
|-
|-
| SA99 || 1 || 0 || 0 || 0 || 1 || 1 || 128/64 || 0C60000-0C7FFFF || 0630000-063FFFF
| {{generic}} || colspan="3" | [[Flash:CELL_EXTNOR_AREA|CELL_EXTNOR_AREA]] || 0xF20000 || 0x20000 || 0x7900 || || || 131072 bytes ||  
|-
|-
| SA100 || 1 || 0 || 0 || 1 || 0 || 0 || 128/64 || 0C80000-0C9FFFF || 0640000-064FFFF
| {{generic}} || colspan="3" | [[Flash:CELL_EXTNOR_AREA#F40000|CRL1]] || 0xF40000 || 0x20000 || 0x7A00 || || || 131072 bytes ||  
|-
|-
| SA101 || 1 || 0 || 0 || 1 || 0 || 1 || 128/64 || 0CA0000-0CBFFFF || 0650000-065FFFF
| {{generic}} || colspan="3" | [[Flash:CELL_EXTNOR_AREA#F60000|DRL1]] || 0xF60000 || 0x20000 || 0x7B00 || || || 131072 bytes ||  
|-
|-
| SA102 || 1 || 0 || 0 || 1 || 1 || 0 || 128/64 || 0CC0000-0CDFFFF || 0660000-066FFFF
| {{generic}} || colspan="3" | [[Flash:CELL_EXTNOR_AREA#F80000|CRL2]] || 0xF80000 || 0x20000 || 0x7C00 || || || 131072 bytes || same as CRL1
|-
|-
| SA103 || 1 || 0 || 0 || 1 || 1 || 1 || 128/64 || 0CE0000-0CFFFFF || 0670000-067FFFF
| {{generic}} || colspan="3" | [[Flash:CELL_EXTNOR_AREA#FA0000|DRL2]] || 0xFA0000 || 0x20000 || 0x7D00 || || || 131072 bytes || same as DRL1
|-
|-
| SA104 || 1 || 0 || 1 || 0 || 0 || 0 || 128/64 || 0D00000-0D1FFFF || 0680000-068FFFF
| {{perconsole}} || rowspan="1" style="text-align:center" | <small>[[Flash:Lv0ldr_Region|lv0ldr]]</small> || colspan="3" | [[Flash:bootldr|bootldr]] || 0xFC0000 || 0x40000 || 0x7E00 || || || 262144 bytes ||  
|-
| SA105 || 1 || 0 || 1 || 0 || 0 || 1 || 128/64 || 0D20000-0D3FFFF || 0690000-069FFFF
|-
| SA106 || 1 || 0 || 1 || 0 || 1 || 0 || 128/64 || 0D40000-0D5FFFF || 06A0000-06AFFFF
|-
| SA107 || 1 || 0 || 1 || 0 || 1 || 1 || 128/64 || 0D60000-0D7FFFF || 06B0000-06BFFFF
|-
| SA108 || 1 || 0 || 1 || 1 || 0 || 0 || 128/64 || 0D80000-0D9FFFF || 06C0000-06CFFFF
|-
| SA109 || 1 || 0 || 1 || 1 || 0 || 1 || 128/64 || 0DA0000-0DBFFFF || 06D0000-06DFFFF
|-
| SA110 || 1 || 0 || 1 || 1 || 1 || 0 || 128/64 || 0DC0000-0DDFFFF || 06E0000-06EFFFF
|-
| SA111 || 1 || 0 || 1 || 1 || 1 || 1 || 128/64 || 0DE0000-0DFFFFF || 06F0000-06FFFFF
|-
| SA112 || 1 || 1 || 0 || 0 || 0 || 0 || 128/64 || 0E00000-0E1FFFF || 0700000-070FFFF
|-
| SA113 || 1 || 1 || 0 || 0 || 0 || 1 || 128/64 || 0E20000-0E3FFFF || 0710000-071FFFF
|-
| SA114 || 1 || 1 || 0 || 0 || 1 || 0 || 128/64 || 0E40000-0E5FFFF || 0720000-072FFFF
|-
| SA115 || 1 || 1 || 0 || 0 || 1 || 1 || 128/64 || 0E60000-0E7FFFF || 0730000-073FFFF
|-
| SA116 || 1 || 1 || 0 || 1 || 0 || 0 || 128/64 || 0E80000-0E9FFFF || 0740000-074FFFF
|-
| SA117 || 1 || 1 || 0 || 1 || 0 || 1 || 128/64 || 0EA0000-0EBFFFF || 0750000-075FFFF
|-
| SA118 || 1 || 1 || 0 || 1 || 1 || 0 || 128/64 || 0EC0000-0EDFFFF || 0760000-076FFFF
|-
| SA119 || 1 || 1 || 0 || 1 || 1 || 1 || 128/64 || 0EE0000-0EFFFFF || 0770000-077FFFF
|-
| SA120 || 1 || 1 || 1 || 0 || 0 || 0 || 128/64 || 0F00000-0F1FFFF || 0780000-078FFFF
|-
| SA121 || 1 || 1 || 1 || 0 || 0 || 1 || 128/64 || 0F20000-0F3FFFF || 0790000-079FFFF
|-
| SA122 || 1 || 1 || 1 || 0 || 1 || 0 || 128/64 || 0F40000-0F5FFFF || 07A0000-07AFFFF
|-
| SA123 || 1 || 1 || 1 || 0 || 1 || 1 || 128/64 || 0F60000-0F7FFFF || 07B0000-07BFFFF
|-
| SA124 || 1 || 1 || 1 || 1 || 0 || 0 || 128/64 || 0F80000-0F9FFFF || 07C0000-07CFFFF
|-
| SA125 || 1 || 1 || 1 || 1 || 0 || 1 || 128/64 || 0FA0000-0FBFFFF || 07D0000-07DFFFF
|-
| SA126 || 1 || 1 || 1 || 1 || 1 || 0 || 128/64 || 0FC0000-0FDFFFF || 07E0000-07EFFFF
|-
| SA127 || 1 || 1 || 1 || 1 || 1 || 1 || 128/64 || 0FE0000-0FFFFFF || 07F0000-07FFFFF
|-
|-
|}
|}
//-->
 
-->
 
= Erasing blocks =
The PS3 erases blocks in chunks of 0x40000 bytes, this is a sample of how the blocks are erased in a ros area (with offsets relatives to the start of the ros area):
Erase block 0 begins 0x0
Erase block 1 begins 0x40000
Erase block 2 begins 0x80000
Erase block 3 begins 0xC0000
Erase block 4 begins 0x100000
Erase block 5 begins 0x140000
Erase block 6 begins 0x180000
Erase block 7 begins 0x1C0000
Erase block 8 begins 0x200000
Erase block 9 begins 0x240000
Erase block 10 begins 0x280000
Erase block 11 begins 0x2C0000
Erase block 12 begins 0x300000
Erase block 13 begins 0x340000
Erase block 14 begins 0x380000
Erase block 15 begins 0x3C0000
Erase block 16 begins 0x400000
Erase block 17 begins 0x440000
Erase block 18 begins 0x480000
Erase block 19 begins 0x4C0000
Erase block 20 begins 0x500000
Erase block 21 begins 0x540000
Erase block 22 begins 0x580000
Erase block 23 begins 0x5C0000
Erase block 24 begins 0x600000
Erase block 25 begins 0x640000
Erase block 26 begins 0x680000
Erase block 27 begins 0x6C0000

Latest revision as of 04:43, 1 July 2023

List of files on NOR Flash (OLD/historic)[edit source]

Note: this is the old table that defyboy made, a more current one with absolute values and for all firmware versions is on the Flash mainpage

The following is a list of files stored in NOR Flash

Name TOC Start Offset End Offset Size Notes
Offset Index Relative Absolute Relative Absolute
asecure_loader 0x400 0 0x400 0x810 0x2E800 0x2F010 0x2E800  (190,464 bytes) aka metldr
eEID 0x400 1 0x2EC00 0x2F010 0x3EC00 0x3F010 0x10000  (65,636 bytes) (IDPS @ offset 0x0002F070 absolute / 0x00000070 inside eEID )
cISD 0x400 2 0x3EC00 0x3F010 0x3F400 0x3F810 0x800  (2,048 bytes)
cCSD 0x400 3 0x3F400 0x3F810 0x3FC00 0x40010 0x800  (2,048 bytes)
trvk_prg0 0x400 4 0x3FC00 0x40010 0x5FC00 0x60010 0x20000  (131,072 bytes)
trvk_prg1 0x400 5 0x5FC00 0x60010 0x7FC00 0x80010 0x20000  (131,072 bytes)
trvk_pkg0 0x400 6 0x7FC00 0x80010 0x9FC00 0xA0010 0x20000  (131,072 bytes)
trvk_pkg1 0x400 7 0x9FC00 0xA0010 0xBFC00 0xC0010 0x20000  (131,072 bytes)
ros0 0x400 8 0xBFC00 0xC0010 0x7BFC00 0x7C0010 0x700000  (7,340,032 bytes) Contains CoreOS files
ros1 0x400 9 0x7BFC00 0x7C0010 0xEBFC00 0xEC0010 0x700000  (7,340,032 bytes) Contains CoreOS files
cvtrm 0x400 10 0xEBFC00 0xEC0010 0xEFFC00 0xF00010 0x40000  (262,144 bytes)
CELL_EXTNOR_AREA 0xF20000 0xFA0040 0x80040  (524,352 bytes)
bootldr 0xFC0000 0xFEEAF0 0x2EAF0  (191,216 bytes) End @ FEF170, FEF570, FEF5F0, FEF600 in some dumps




new metldr.2[edit source]

Seen on CECH2504B (JSD-001), with 3.60 from factory - datecode 1B

  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
  00000800  00 00 00 01 00 00 00 01 00 00 00 00 00 02 E8 00  ..............è.
  00000810  00 00 00 00 00 00 00 40 00 00 00 00 00 00 F9 20  .......@......ù 
  00000820  6D 65 74 6C 64 72 2E 32 00 00 00 00 00 00 00 00  metldr.2........
  00000830  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  00000840  00 00 0F 8E 6E D7 BC D8 1F 11 EA 34 42 5F 9B 9D  ...Žn×¼Ø..ê4B_›.
  00000850  00 00 0F 8E 8C 21 5D 5F D0 B4 50 07 6A DD 21 DF  ...ŽŒ!]_дP.jÝ!ß
 
  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
  0002F070  00 00 00 01 00 85 00 0B 10 24 39 B7 2C BA A8 5E  .....…...$9·,º¨^

vflash partition table[edit source]

Done some work on decoding region 2 today:
Region 2 seems to = vflash partition table? These might be the first 2 regions?
partition table is 4096 bytes.
Format:
16 bytes 00's
16 bytes magic: 00 00 00 00 0F AC E0 FF 00 00 00 00 DE AD FA CE
8 bytes 0x03
8 bytes 0x02 (number of paritions?)
144 bytes 00's
Partition entries:
8 bytes entry point (entry point * 0x200) relative to 0x00 on flash
8 bytes entry length (entry length * 0x200)
32 bytes 10 70 00 00 01 00 00 01 00 00 00 00 00 00 00 03 10 70 00 00 02 00 00 01 00 00 00 00 00 00 00 03
96 bytes 00's




Dumping your flash[edit source]

There are many ways you can dump your flash you can choose the way that best fits you, there are some persons studing the flash.. If you can help providing a dump (specially if you have a debug console) search for those persons in IRC Efnet #ps3dev

Payload[edit source]

Uncomment dump_dev_flash() in graf_payloads compile and run the payload

see Graf's_PSGroove_Payload for more info

Linux[edit source]

Using graf_chokolo kernel with /dev/ps3nflasha access

dd if=/dev/ps3nflasha of=NOR.BIN bs=1024

Hardware[edit source]

see Hardware flashing

Dump NAND/NOR from GameOS[edit source]

precompiled : dump_flash.pkg // backup/mirror: dump_flash.pkg (70.48 KB)
source: dump_flash-src.rar (2.33 KB)

Make sure USB stick is FAT32 with enough free space (16MB per NOR dump, 256MB per NAND dump)

remarks:

NOR Unpacking // NOR Unpkg[edit source]

/*
  # ../norunpkg norflash.bin norflash
  unpacking asecure_loader (size: 190xxx bytes)...
  unpacking eEID (size: 65536 bytes)...
  unpacking cISD (size: 2048 bytes)...
  unpacking cCSD (size: 2048 bytes)...
  unpacking trvk_prg0 (size: 131072 bytes)...
  unpacking trvk_prg1 (size: 131072 bytes)...
  unpacking trvk_pkg0 (size: 131072 bytes)...
  unpacking trvk_pkg1 (size: 131072 bytes)...
  unpacking ros0 (size: 7340032 bytes)...
  unpacking ros1 (size: 7340032 bytes)...
  unpacking cvtrm (size: 262144 bytes)...
*/

// Copyright 2010       Sven Peter
// Licensed under the terms of the GNU GPL, version 2
// http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
// nor modifications by rms.

#include "tools.h"
#include "types.h"

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/stat.h>

#ifdef WIN32
#define MKDIR(x,y) mkdir(x)
#else
#define MKDIR(x,y) mkdir(x,y)
#endif

u8 *pkg = NULL;

static void unpack_file(u32 i)
{
        u8 *ptr;
        u8 name[33];
        u64 offset;
        u64 size;

        ptr = pkg + 0x10 + 0x30 * i;

        offset = be64(ptr + 0x00);
        size   = be64(ptr + 0x08);

        memset(name, 0, sizeof name);
        strncpy((char *)name, (char *)(ptr + 0x10), 0x20);

        printf("unpacking %s (size: %d bytes)...\n", name, size);
        memcpy_to_file((char *)name, pkg + offset, size);
}

static void unpack_pkg(void)
{
        u32 n_files;
        u64 size;
        u32 i;

        n_files = be32(pkg + 4);
        size = be64(pkg + 8);

        for (i = 0; i < n_files; i++)
                unpack_file(i);
}

int main(int argc, char *argv[])
{
        if (argc != 3)
                fail("usage: norunpkg filename.nor target");

        pkg = mmap_file(argv[1]);

        /* kludge for header, i do not do sanity checks at the moment */
        pkg += 1024;

        MKDIR(argv[2], 0777);

        if (chdir(argv[2]) != 0)
                fail("chdir");

        unpack_pkg();

        return 0;
}

Source: http://rms.grafchokolo.com/?p=25

Changed version for Progskeet: http://pastebin.com/HNvCbF7d

RMS - eEID splitter[edit source]

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void
DumpEidData (FILE * pFile, int iInputSize, int iEidCount,
	     char *pFilenamePrefix)
{
  FILE *pOutput;
  char *szFilename;
  char *szBuf;
  int iRes, iSize;

  printf ("dumping EID%d from eEID at %p, size %d (%x)..\n",
	  iEidCount, pFile, iInputSize, iInputSize);

  szBuf = (char *) malloc (iInputSize + 1);
  szFilename = (char *) malloc (strlen (pFilenamePrefix) + 2);

  if (szBuf == NULL)
    {
      perror ("malloc");
      exit (1);
    };

  iSize = fread (szBuf, iInputSize, 1, pFile);
  sprintf (szFilename, "%s%d", pFilenamePrefix, iEidCount);
  pOutput = fopen (szFilename, "wb");
  iRes = fwrite (szBuf, iInputSize, 1, pOutput);

  if (iRes != iSize)
    {
      perror ("fwrite");
      exit (1);
    };

  free (szBuf);
}

int
main (int argc, char **argv)
{
  FILE *pFile;
  char *pPrefix;

  pFile = fopen (argv[1], "rb");
  if (pFile == NULL)
    {
    usage:
      printf ("usage: %s <eEID> <EID name prefix>\n", argv[0]);
      exit (1);
    }

  if (argc == 2 && argv[2] != NULL)
    {
      pPrefix = argv[2];
      goto usage;
    }

  fseek (pFile, 0x70, SEEK_SET);

  if (pPrefix != NULL)
    {
      DumpEidData (pFile, 2144, 0, pPrefix);
      DumpEidData (pFile, 672, 1, pPrefix);
      DumpEidData (pFile, 1840, 2, pPrefix);
      DumpEidData (pFile, 256, 3, pPrefix);
      DumpEidData (pFile, 48, 4, pPrefix);
      DumpEidData (pFile, 2560, 5, pPrefix);
    }
  return 0;
}

Source: http://rms.grafchokolo.com/?p=59




NAND reference[edit source]

Note: Beyond VTRM/cell_ext_os_area is pretty much greyarea - needs crosschecking

NAND reference (euss)[edit source]

CECHC-04/COK-002 Pal EU launchmodel with OFW 3.15 updated to MFW 3.15 (Euss)

VTRM[edit source]

   VTRM in NAND: 
    
   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
     
   00EC0000  53 43 45 49 56 54 52 4D 00 00 00 00 00 00 00 A8  SCEIVTRM.......¨
   00EC0010  00 00 00 00 00 E8 02 00 00 00 00 00 00 00 00 28  .....è.........(
   00EC0020  00 00 00 00 56 54 52 4D 00 00 00 00 00 00 00 04  ....VTRM........     <-- 'VTRM' magic header
   00EC0030  FE 6D 0B C4 FA D5 CE DB 93 86 FC A1 32 3B 71 47  þm.ÄúÕÎÛ“†ü¡2;qG     <-- same value as 00EC0410
   00EC0040  3B A5 C6 F9 C0 00 B6 70 00 00 00 00 00 E8 27 80  ;¥ÆùÀ.¶p.....è'€     <-- first part same value as 00EC0410
   00EC0050  00 00 00 00 00 00 00 60 00 00 00 00 00 00 09 20  .......`....... 
   00EC0060  04 00 00 00 02 00 00 05 10 70 00 05 FF 00 00 01  .........p..ÿ...
   00EC0070  0C 1C 05 9C AA B5 97 A5 9C D6 46 2D EA 22 46 BE  ...œªµ—¥œÖF-ê"F¾
   00EC0080  D1 84 A9 1E 34 5F E7 90 55 49 11 82 51 9D 4A 3F  Ñ„©.4_ç.UI.‚Q.J?
   00EC0090  EF 43 19 E8 4F 6A 5B FF DA 31 E9 F0 76 C8 B2 6B  ïC.èOj[ÿÚ1éðvȲk
   00EC00A0  0B A7 47 8E BE 42 28 9F 2B 88 73 0B A5 B6 F2 1D  .§GŽ¾B(Ÿ+ˆs.¥¶ò.
   00EC00B0  00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF  ........ÿÿÿÿÿÿÿÿ
   00EC00C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00EC00D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00EC00E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00EC00F0  FF FF FF FF FF FF FF FF 00 00 00 00 00 EB E4 8C  ÿÿÿÿÿÿÿÿ.....ëäŒ
   00EC0100  00 00 00 00 00 00 00 14 39 17 52 0B 31 70 F5 05  ........9.R.1põ.
   00EC0110  02 5A C6 F8 81 F8 54 96 2F EF F3 81 FF FF FF FF  .ZÆø.øT–/ïó.ÿÿÿÿ
   00EC0120  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00EC03F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00EC0400  00 00 00 00 56 54 52 4D 00 00 00 00 00 00 00 04  ....VTRM........
   00EC0410  FE 6D 0B C4 FA D5 CE DB 93 86 FC A1 32 3B 71 47  þm.ÄúÕÎÛ“†ü¡2;qG     <-- same value as 00EC0030
   00EC0420  3B A5 C6 F9 C0 00 B6 70 00 00 00 00 00 00 04 90  ;¥ÆùÀ.¶p........     <-- first part same value as 00EC0040
   00EC0430  00 00 00 00 00 00 09 20 00 00 00 00 00 00 00 03  ....... ........     <-- pattern exception
   00EC0440  00 00 00 00 00 00 09 20 00 00 00 00 00 00 09 20  ....... .......      <-- repetive pattern until 00EC0440 with some exceptions
    [...]    00 00 00 00 00 00 09 20 00 00 00 00 00 00 09 20  ....... .......      <-- repetive pattern until 00EC0440 with some exceptions
   00EC1930  00 00 00 00 00 00 00 01 00 00 00 00 00 00 09 20  ...............      <-- pattern exception
    [...]    00 00 00 00 00 00 09 20 00 00 00 00 00 00 09 20  ....... .......      <-- repetive pattern until 00EC0440 with some exceptions
   00EC21F0  00 00 00 00 00 00 00 02 00 00 00 00 00 00 09 20  ...............      <-- pattern exception
    [...]    00 00 00 00 00 00 09 20 00 00 00 00 00 00 09 20  ....... .......      <-- repetive pattern until 00EC0440 with some exceptions
   00EC24F0  00 00 00 00 00 00 09 20 00 00 00 00 00 00 00 00  ....... ........
    [...]    00 00 00 00 00 00 09 20 00 00 00 00 00 00 09 20  ....... .......      <-- repetive pattern until 00EC0440 with some exceptions
   00EC28B0  00 00 00 00 00 00 09 20 00 00 00 00 00 00 09 20  ....... .......      <-- repetive pattern until 00EC0440 with some exceptions
   00EC28C0  00 00 00 00 00 00 09 20 10 70 00 00 02 00 00 01  ....... .p......
   00EC28D0  10 70 00 00 39 00 00 01 22 66 39 B3 0E 7A 1C E7  .p..9..."f9³.z.ç
   00EC28E0  68 85 F9 94 A8 30 BE C4 0B 85 D0 92 1E C0 8F 28  h…ù”¨0¾Ä.…Ð’.À.(
   00EC28F0  7F 70 ED 15 D6 22 06 24 D9 08 64 0B C0 D7 97 29  .pí.Ö".$Ù.d.À×—)
   00EC2900  BE A1 FE 91 D1 F2 D4 88 25 EF 24 86 E0 A3 CB 98  ¾¡þ‘ÑòÔˆ%ï$†à£Ë˜
   00EC2910  AF 17 6F B1 64 A0 56 E5 00 00 00 00 00 00 00 01  ¯.o±d Vå........
   00EC2920  00 00 00 00 00 00 09 20 10 70 00 00 02 00 00 01  ....... .p......
   00EC2930  10 70 00 00 03 00 00 02 F9 D9 6A 84 0C F2 D8 E7  .p......ùÙj„.òØç
   00EC2940  D4 44 5C 3C DF D5 DF 0F B8 DC 3E 81 9A A4 71 8F  ÔD\<ßÕß.¸Ü>.š¤q.
   00EC2950  0A A8 8B 90 1B 2C A1 D1 66 84 AA EE 65 D1 46 9A  .¨‹..,¡Ñf„ªîeÑFš
   00EC2960  D7 38 83 F2 78 47 D1 8E E5 FA EB 39 CF 26 E8 25  ×8ƒòxGÑŽåúë9Ï&è%
   00EC2970  85 DE 3B C6 0B C3 45 D5 00 00 00 00 00 00 00 00  …Þ;Æ.ÃEÕ........
   00EC2980  00 00 00 00 00 00 09 20 04 00 00 00 02 00 00 05  ....... ........
   00EC2990  10 70 00 05 FF 00 00 01 0C 1C 05 9C AA B5 97 A5  .p..ÿ......œªµ—¥
   00EC29A0  9C D6 46 2D EA 22 46 BE D1 84 A9 1E 34 5F E7 90  œÖF-ê"F¾Ñ„©.4_ç.
   00EC29B0  55 49 11 82 51 9D 4A 3F EF 43 19 E8 4F 6A 5B FF  UI.‚Q.J?ïC.èOj[ÿ
   00EC29C0  DA 31 E9 F0 76 C8 B2 6B 0B A7 47 8E BE 42 28 9F  Ú1éðvȲk.§GŽ¾B(Ÿ
   00EC29D0  2B 88 73 0B A5 B6 F2 1D 00 00 00 00 00 00 00 00  +ˆs.¥¶ò.........
   00EC29E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00EF94B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00EF94C0  39 17 52 0B 31 70 F5 05 02 5A C6 F8 81 F8 54 96  9.R.1põ..ZÆø.øT–      <-- 0x14 patterned data (table?)
   00EF94D0  2F EF F3 81 39 17 52 0B 31 70 F5 05 02 5A C6 F8  /ïó.9.R.1põ..ZÆø
    [...]
   00EFEFE0  02 5A C6 F8 81 F8 54 96 2F EF F3 81 39 17 52 0B  .ZÆø.øT–/ïó.9.R.
   00EFEFF0  31 70 F5 05 02 5A C6 F8 81 F8 54 96 2F EF F3 81  1põ..ZÆø.øT–/ïó.
   00EFF000  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   00EFF010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    [...]    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   00EFFFE0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   00EFFFF0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

post VTRM / pre cell_ext_os_area[edit source]

00F00000 data area[edit source]

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
     
   00F00000  2E B1 47 93 21 AD 45 5C 5B 32 A7 A7 E1 25 04 D0  .±G“!­E\[2§§á%.Ð
   00F00010  24 45 E1 7E 3C 38 AE 4A 1C 25 21 5B 05 2D A9 15  $Eá~<8®J.%![.-©.
    [...]    
   00F00FE0  34 7F 14 93 D2 8D C0 43 06 B7 10 18 BB 28 37 D2  4..“Ò.ÀC.·..»(7Ò
   00F00FF0  5B 11 B4 EB 5F 12 0A 98 BC 2B B4 60 A7 89 6F 84  [.´ë_..˜¼+´`§‰o„
00F01000 unreferenced area[edit source]
   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
     
   00F01000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00F01010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ 
   00F3FFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00F3FFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

00F40000 data area[edit source]

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
     
   00F40000  7E 8B 60 EE E4 2A 29 09 8F 5A E9 4E B8 7F 1E E2  ~‹`îä*)..ZéN¸..â
   00F40010  F2 B5 7C C7 03 40 5E EC 87 16 04 A2 26 50 7C C9  òµ|Ç.@^ì‡..¢&P|É
    [...]    
   00F401E0  AC D9 A9 C8 BE B7 0E EE 0C E7 1E 73 45 39 70 80  ¬Ù©È¾·.î.ç.sE9p€
   00F401F0  8C 6F 32 06 08 8B CE 3B 80 DE 68 59 D5 25 DD 5A  Œo2..‹Î;€ÞhYÕ%ÝZ
00F40200 unreferenced area[edit source]
   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
    
   00F40200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00F40210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00F41FE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00F41FF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

00F42000 data area[edit source]

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
    
   00F42000  4A 51 35 DF C9 14 A2 40 71 8D 0F 11 8B 50 42 CE  JQ5ßÉ.¢@q...‹PBÎ
   00F42010  28 92 B5 64 57 B0 1E D2 99 22 38 BC 7A 16 6A 83  (’µdW°.Ò™"8¼z.jƒ
    [...]                                                                        large date filled block region 
   0C1657E0  D5 D5 EE 71 0A B2 72 41 05 05 0B 08 3A 8A 78 04  ÕÕîq.²rA....:Šx.
   0C1657F0  E9 2F 40 63 AA 3F 23 22 E9 9D B1 4B 54 11 B4 71  é/@cª?#"é.±KT.´q
0C165800 unreferenced area[edit source]
   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
    
   0C165800  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0C165810  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0D6C1FE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0D6C1FF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0D6C2000 data area[edit source]

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
    
   0D6C2000  3B BC 95 72 03 FD 48 1E F2 1C 66 65 0A FB FC EC  ;¼•r.ýH.ò.fe.ûüì
   0D6C2010  0D 61 5C A0 8F 8F 68 5B 05 A3 85 57 29 53 53 4B  .a\ ..h[.£…W)SSK
    [...]    
   0D6C9FE0  74 E5 42 98 6E EE E1 41 24 7B B5 FE B5 42 29 C0  tåB˜nîáA${µþµB)À
   0D6C9FF0  25 05 C0 2B EE 87 50 40 21 EC A6 E7 0D 5A 3C 2A  %.À+î‡P@!ì¦ç.Z<*
0D6CA000 unreferenced area[edit source]
   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
    
   0D6CA000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0D6CA010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0D6FFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0D6FFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0D700000 data area[edit source]

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
    
   0D700000  0E 23 53 34 75 48 81 0F C4 09 16 4C 6C 37 BA E9  .#S4uH..Ä..Ll7ºé
   0D700010  5F 51 D9 9A E2 BE 4C 71 AF 00 4C 96 33 DB D5 49  _QÙšâ¾Lq¯.L–3ÛÕI
    [...]    
   0D7001E0  8D 4C 8D CD FD D2 B5 52 78 6E 48 B0 88 14 43 36  .L.ÍýÒµRxnH°ˆ.C6
   0D7001F0  DA 88 EF 59 73 96 80 13 31 16 E0 CF EB 99 83 2D  ÚˆïYs–€.1.àÏ뙃-
0D700200 unreferenced area[edit source]
   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
   
   0D700200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0D700210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0D701FE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0D701FF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0D702000 data area[edit source]

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
    
   0D702000  3C E6 76 41 CE A4 82 BD A3 2B 41 26 1E 25 36 D1  <ævAΤ‚½£+A&.%6Ñ
   0D702010  CE B5 51 9C E2 AC A3 DA AB B5 16 13 CA 95 E4 D3  εQœâ¬£Ú«µ..Ê•äÓ
    [...]    
   0D891FE0  C3 CA 0D BB 30 7B D2 9A 6D 13 9C 36 BD E3 64 3A  ÃÊ.»0{Òšm.œ6½ãd:
   0D891FF0  97 FB 9B 9E FE 25 ED 76 FC 77 85 28 C1 CB 37 65  —û›žþ%ívüw…(ÁË7e
0D892000 unreferenced area[edit source]
   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
   
   0D892000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0D892010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E6FFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E6FFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0E700000 data area[edit source]

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
    
   0E700000  C7 D7 77 CD 69 D9 1A EC E4 3C F8 8F 25 A5 3E A9  Ç×wÍiÙ.ìä<ø.%¥>©
   0E700010  3D EC 43 30 89 1F 98 F1 3F BA F6 AF 9B F5 0E B2  =ìC0‰.˜ñ?ºö¯›õ.²
    [...]    
   0E7001D0  09 BC 15 00 64 27 85 8F 0F BC 40 B1 F1 57 61 60  .¼..d'…..¼@±ñWa`
   0E7001E0  A4 2B A9 75 E9 C3 25 49 EC 6B 82 10 EE E1 62 BD  ¤+©uéÃ%Iìk‚.îáb½
   0E7001F0  B1 A9 C1 69 36 69 14 A5 53 A4 6A 43 0F 37 45 E0  ±©Ái6i.¥S¤jC.7Eà
0E700200 unreferenced area[edit source]
   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
   
   0E700200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E700210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E701FE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E701FF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0E702000 data area[edit source]

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
    
   0E702000  7F 3A 86 47 F3 47 AF CC 28 F2 A7 A5 28 D1 A6 C2  .:†GóG¯Ì(ò§¥(ѦÂ
   0E702010  13 27 01 0A 33 74 05 FC CE E9 83 B8 72 99 29 09  .'..3t.üÎ郸r™).
    [...]    
   0E75A9E0  5D BF 1A 2E 80 FB 32 50 B2 55 42 34 53 F0 4C 09  ]¿..€û2P²UB4SðL.
   0E75A9F0  92 8B 75 84 D5 0E 3C D7 F2 72 43 B0 C9 A4 66 C8  ’‹u„Õ.<×òrC°É¤fÈ
0E75AA00 unreferenced area[edit source]
   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
   
   0E75AA00  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E75AA10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E77FFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E77FFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

cell_ext_os_area[edit source]

Flash:cell_ext_os_area

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
      
   0E780000  63 65 6C 6C 5F 65 78 74 5F 6F 73 5F 61 72 65 61  cell_ext_os_area
   0E780010  00 00 00 01 00 00 00 02 00 00 00 04 FF FF FF FF  ............ÿÿÿÿ
   0E780020  00 00 00 01 00 27 F8 40 FF FF FF FF FF FF FF FF  .....'ø@ÿÿÿÿÿÿÿÿ
   0E780030  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E780040  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   FF filled block region
   0E7801F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E780200  00 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF  ....ÿÿÿÿÿÿÿÿÿÿÿÿ
   0E780210  00 00 00 03 FF FF FF FF FF FF FF FF FF FF FF FF  ....ÿÿÿÿÿÿÿÿÿÿÿÿ
   0E780220  00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF  ..........ÿÿÿÿÿÿ
   0E780230  00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF  ............ÿÿÿÿ
   0E780240  00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF  ........ÿÿÿÿÿÿÿÿ
   0E780250  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   FF filled block region
   0E7803E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E7803F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E780400  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   0E780410  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    [...]    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................   00 filled block region
   0E7807E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   0E7807F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

OtherOS[edit source]

Flash:OtherOS

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0E780800  1F 8B 08 08 C1 19 04 48 02 03 7A 49 6D 61 67 65  .‹..Á..H..zImage
   0E780810  2E 69 6E 69 74 72 64 2E 70 73 33 2E 62 69 6E 00  .initrd.ps3.bin.
    [...]                                                                        large data area
   0EA00030  FF FE FC FF ED CF FF 07 DE FD A4 A3 A8 88 54 00  ÿþüÿíÏÿ.Þý¤£¨ˆT.
   0EA00040  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    [...]    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................   large 00 filled block region
   0EB7FFE0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   0EB7FFF0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   0EB80000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0EB80010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   large FF filled block region
   0EFFFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0EFFFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

bootldr[edit source]

Flash:bootldr @ 0xF000000 - 0xF03FFFF

0xF040000 - 0xFFFFFFF[edit source]

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
    
   0F040000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0F040010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   large FF filled block region (no data in it, only FF)
   0FFFFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0FFFFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

NAND reference (CatisFine)[edit source]

CECHB-02/COK-001 NTSC USA launchmodel with FW 3.55

VTRM[edit source]

actual data differs, offsets same as euss

post VTRM / pre cell_ext_os_area[edit source]

00F00000 data area[edit source]

actual data differs, offsets same as euss

00F01000 unreferenced area[edit source]

same as euss

00F40000 data area[edit source]

actual data differs, offsets same as euss

00F40200 unreferenced area[edit source]

same as euss

00F42000 data area[edit source]

actual data differs, also length of data differs from euss

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
   
   00F42000  EF 77 C9 58 60 A7 33 F2 4A F1 5C 44 52 63 F5 C2  ïwÉX`§3òJñ\DRcõÂ
   00F42010  65 0C 0D 08 3D BD 6F 86 C1 30 2D 9F DF 0F 4C BF  e...=½o†Á0-Ÿß.L¿
    [...]                                                                        large date filled block region 
   0C1C19E0  A0 7C 08 A8 4F 24 A8 16 3F 70 81 73 0F A2 90 10   |.¨O$¨.?p.s.¢..
   0C1C19F0  C2 19 E6 CD 7D 60 D5 3A BB 6A 1C D3 EA 08 19 79  Â.æÍ}`Õ:»j.Óê..y
0C1C1A00 unreferenced area[edit source]

with length of previous data area different, offset obviously differs from euss

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
   0C1C1A00  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0C1C1A10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   large FF filled block region
   0D701FE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0D701FF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0D702000 data area[edit source]

with length of previous data area different, offset obviously differs from euss

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
    
   0D702000  74 0F 26 AA 49 22 3F 48 38 C6 B0 D6 3E 99 0E EF  t.&ªI"?H8Æ°Ö>™.ï
   0D702010  A6 96 C4 EC 63 C4 04 C3 25 44 88 8A AA F2 DB 16  ¦–ÄìcÄ.Ã%DˆŠªòÛ.
    [...]    
   0D74F1E0  E1 96 94 95 CF 6F FD 0C 7F 31 FD AF 2E E4 1A F5  á–”•Ïoý..1ý¯.ä.õ
   0D74F1F0  96 7A 2E AB 89 11 0A 06 4D E6 38 3E FC 71 3A D3  –z.«‰...Mæ8>üq:Ó
0D74F200 unreferenced area[edit source]

with length of previous data area different, start offset obviously differs from euss

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
    
   0D74F200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0D74F210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0D6FFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0D6FFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0D700000 data area[edit source]

actual data differs, offsets same as euss

0D700200 unreferenced area[edit source]

same as euss

0D702000 data area[edit source]

actual data differs, also length of data differs from euss

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
    
   0D702000  74 0F 26 AA 49 22 3F 48 38 C6 B0 D6 3E 99 0E EF  t.&ªI"?H8Æ°Ö>™.ï
   0D702010  A6 96 C4 EC 63 C4 04 C3 25 44 88 8A AA F2 DB 16  ¦–ÄìcÄ.Ã%DˆŠªòÛ.
    [...]    
   0D74F1E0  E1 96 94 95 CF 6F FD 0C 7F 31 FD AF 2E E4 1A F5  á–”•Ïoý..1ý¯.ä.õ
   0D74F1F0  96 7A 2E AB 89 11 0A 06 4D E6 38 3E FC 71 3A D3  –z.«‰...Mæ8>üq:Ó
0D892000 unreferenced area[edit source]

with length of previous data area different, start offset obviously differs from euss

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
   
   0D74F200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0D74F210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E6FFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E6FFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0E700000 data area[edit source]

actual data differs, offsets same as euss

0E700200 unreferenced area[edit source]

same as euss

0E702000 data area[edit source]

actual data differs, also length of data differs from euss

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
    
   0E702000  E5 6C BF E6 3D E4 09 47 EE 29 87 C4 5A E4 BE E4  ål¿æ=ä.Gî)‡ÄZä¾ä
   0E702010  C5 71 97 6F D2 F1 EF 1D 72 60 3D AF 8C 0A 1A FD  Åq—oÒñï.r`=¯Œ..ý
    [...]    
   0E75B9E0  47 26 0E 11 20 50 FB 0C 1B 34 9E F1 30 DB 26 CE  G&.. Pû..4žñ0Û&Î
   0E75B9F0  0B D5 75 71 55 F4 C6 97 49 B8 06 F5 3F 2C 76 8D  .ÕuqUôÆ—I¸.õ?,v.
0E75AA00 unreferenced area[edit source]
   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
   
   0E75BA00  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E75BA10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E77FFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E77FFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

cell_ext_os_area[edit source]

No cell_ext_os_area magic present or header, FF filled instead

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
      
   0E780000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   No cell_ext_os_area magic present
   0E780010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   no header, FF filled instead
   0E780020  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E780030  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    
   0E780040  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   FF filled block region same as euss
   0E7801F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   
   0E780200  00 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF  ....ÿÿÿÿÿÿÿÿÿÿÿÿ
   0E780210  00 00 00 03 FF FF FF FF FF FF FF FF FF FF FF FF  ....ÿÿÿÿÿÿÿÿÿÿÿÿ
   0E780220  00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF  ..........ÿÿÿÿÿÿ   same as euss
   0E780230  00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF  ............ÿÿÿÿ
   0E780240  00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF  ........ÿÿÿÿÿÿÿÿ
   
   0E780250  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   FF filled block region same as euss
   0E7803E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E7803F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   
   0E780400  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E780410  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   FF filled block region instead of 00 filled
   0E7807E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E7807F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

OtherOS[edit source]

No Image.initrd.ps3.bin , FF filled instead

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0E780800  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E780810  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   large FF filled block region
   0EFFFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0EFFFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

bootldr[edit source]

Flash:bootldr @ 0xF000000 - 0xF03FFFF

0xF040000 - 0xFFFFFFF[edit source]

same as euss


NAND reference (DECHA)[edit source]

DECHA-01/COK-001 nonretail model with FW 3.50 and FW 3.60

VTRM[edit source]

actual data differs, offsets differ in last section from euss

post VTRM / pre cell_ext_os_area[edit source]

00F00000 data area[edit source]

start offset same, length differs from euss

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
     
   00F00000  1C 4D F8 6C 8E EC DD F4 3F F4 BA 77 B7 41 9F AA  .MølŽìÝô?ôºw·AŸª
   00F00010  57 CA 8D F4 53 60 0D 9C FB 3D C2 C7 26 1B 69 24  WÊ.ôS`.œû=ÂÇ&.i$
    [...]    
   068861E0  FA 79 61 07 C5 34 B1 44 F6 18 37 ED 94 ED 0D 11  úya.Å4±Dö.7í”í..
   068861F0  D4 8F 05 CF 6B C4 18 F8 B9 F0 33 EC 77 A4 70 8A  Ô..ÏkÄ.ø¹ð3ìw¤pŠ
06886200 unreferenced area[edit source]
   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 
     
   06886200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   06886210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ 
   068863E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   068863F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

Note: the rest of total of datasections differ or the dump is invalid with FF patterned blocks of missing data

cell_ext_os_area[edit source]

No cell_ext_os_area magic present or header, FF filled instead

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
      
   0E780000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   No cell_ext_os_area magic present
   0E780010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   no header, FF filled instead
   0E780020  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E780030  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    
   0E780040  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   FF filled block region same as euss
   0E7801F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   
   0E780200  00 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF  ....ÿÿÿÿÿÿÿÿÿÿÿÿ
   0E780210  00 00 00 03 FF FF FF FF FF FF FF FF FF FF FF FF  ....ÿÿÿÿÿÿÿÿÿÿÿÿ
   0E780220  00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF  ..........ÿÿÿÿÿÿ   same as euss
   0E780230  00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF  ............ÿÿÿÿ
   0E780240  00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF  ........ÿÿÿÿÿÿÿÿ
   
   0E780250  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   FF filled block region same as euss
   0E7803E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E7803F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   
   0E780400  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E780410  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   FF filled block region instead of 00 filled
   0E7807E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E7807F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

OtherOS[edit source]

No Image.initrd.ps3.bin , FF filled instead

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0E780800  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0E780810  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   large FF filled block region
   0EFFFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0EFFFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

bootldr[edit source]

Flash:bootldr @ 0xF000000 - 0xF03FFFF

0xF040000 - 0xFFFFFFF[edit source]

same as euss


NAND reference (COOKIE13)[edit source]

COOKIE-13 preretail model with FW 085.009

VTRM[edit source]

actual data (looks encrypted, stats <0.40% for all values), structure and length differs, start offset same as euss

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   00EC0000  CC 04 BF 45 AD D9 69 17 C5 EA 3C EA 46 BD FC 0B  Ì.¿E­Ùi.Åê<êF½ü.
   00EC0010  C0 25 27 6D 3E 26 7B 56 A7 01 41 D7 5D 98 BA BB  À%'m>&{V§.A×]˜º»
    [...]                                                                        large date filled block region 
   0EAFFFE0  23 57 03 83 E7 65 AA D7 AB D4 21 DE D2 DF 79 BE  #W.ƒçeª×«Ô!ÞÒßy¾
   0EAFFFF0  B4 AB B6 56 BD 7F 04 56 AC 39 08 C9 BE 2D 97 A6  ´«¶V½..V¬9.ɾ-—¦
0EB00000 unreferenced area[edit source]

with length of previous data area different, offset obviously differs from euss

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0EB00000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0EB00010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   large FF filled block region
   0EFFFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0EFFFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

post VTRM / pre cell_ext_os_area[edit source]

Not present , see above overlapping VTRM section

cell_ext_os_area[edit source]

No cell_ext_os_area , see above overlapping VTRM section

OtherOS[edit source]

No Image.initrd.ps3.bin , see above overlapping VTRM section

bootldr[edit source]

Flash:bootldr @ 0xF000000 - 0xF03FFFF

0xF040000 - 0xFFFFFFF[edit source]

up until 0F1BFFFF FF filled, same as euss

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0F040000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0F040010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0F1BFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0F1BFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0F1C0000 data area[edit source]

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0F1C0000  5B 59 E1 64 96 F8 D0 B5 C5 03 9E 69 09 93 AC C1  [Yád–øеÅ.ži.“¬Á
   0F1C0010  0B 4D A7 5A A3 D8 CB CA 95 C5 61 CC 1B 51 0B 3F  .M§Z£ØËÊ•ÅaÌ.Q.?
    [...]    
   0F1E51E0  9E F9 C6 9F 5C 09 DC 3D CB 54 AE 14 14 4B AC 9D  žùÆŸ\.Ü=ËT®..K¬.
   0F1E51F0  67 2E 96 A3 3F B9 D8 F8 10 D7 98 C3 C7 80 4B 48  g.–£?¹Øø.טÃÇ€KH

0F1E5200 nonreferenced area[edit source]

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0F1E5200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0F1E5210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0F2FFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0F2FFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0F300000 repeative 0x200 data / 0x200 FF blocks[edit source]

then at 0F300000 [ data of 0x200 length, followed by FF block of 0x200 length ] X repeated until 0x0F30C5FF

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0F300000  91 6E E5 2B 97 39 4D 46 57 BA BC 6A E5 CC 41 07  ‘nå+—9MFWº¼jåÌA.
   0F300010  40 22 E9 E9 F7 51 32 23 D7 08 2D 5E 93 BC 9A 3F  @"éé÷Q2#×.-^“¼š?
    [...]  
       
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
        
    [...]    
   0F30C5E0  35 AC AA B1 69 FD BB 22 8C 06 D6 79 E4 67 24 3D  5¬ª±iý»"Œ.Öyäg$=
   0F30C5F0  63 74 39 03 F1 E8 B4 86 07 FF CC BF 54 28 A0 96  ct9.ñè´†.ÿÌ¿T( –

0F30C600 FF block[edit source]

followed by a long FF block

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0F30C600  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0F30C610  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0F5FFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0F5FFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0F600000 data block[edit source]

followed by large datablock

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0F600000  38 E9 F3 B1 7F AF 68 E0 27 AC DC 48 1B 2D 87 BB  8éó±.¯hà'¬ÜH.-‡»
   0F600010  00 C8 1C D8 FE EB E6 01 41 D2 A1 EA DC 2E F6 03  .È.Øþëæ.AÒ¡êÜ.ö.
    [...]    
   0F61D1E0  C1 70 9B E0 9D 1B 4D B3 E4 95 6E 42 8B 25 25 E1  Áp›à..M³ä•nB‹%%á
   0F61D1F0  CB CD 96 88 DA A5 DA F2 42 8F 01 1F D5 E4 E9 D2  ËÍ–ˆÚ¥ÚòB...ÕäéÒ

0F61D200 FF block[edit source]

followed by large FF block

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0F61D200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0F61D210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0F7001E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0F7001F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0F700200 repeative 0x200 data / 0x200 FF blocks[edit source]

then at 0F700200 [ data of 0x200 length, followed by FF block of 0x200 length ] X repeated until 0x0F70C7F0

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0F700200  4D AB A4 D7 58 35 59 46 E7 1B C4 D8 88 BA 74 C0  M«¤×X5YFç.Ä؈ºtÀ
   0F700210  18 66 C9 2C 8A FD FE D3 25 F6 52 E7 47 FE B5 5F  .fÉ,ŠýþÓ%öRçGþµ_
    [...]  
       
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
        
    [...]   
   0F70C7E0  E2 1A 1B 96 19 1F 75 4B 02 E3 23 68 95 61 47 37  â..–..uK.ã#h•aG7
   0F70C7F0  FC 69 5D 28 D5 5E E0 60 DE F8 C0 FD E6 3F 72 CE  üi](Õ^à`ÞøÀýæ?rÎ

0F61D200 FF block[edit source]

followed by large FF block

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0F70C800  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0F70C810  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0FCFFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0FCFFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0F700200 repeative 0x200 00 blocks / 0x200 FF blocks[edit source]

then at 0F700200 [ 00 block of 0x200 length, followed by FF block of 0x200 length ] X repeated until 0x0FD3FFFF

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0FD00000  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   0FD00010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   
    [...]    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   
   0FD3FFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0FD3FFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0FD40000 data block[edit source]

followed by large data block

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0FD40000  65 67 E9 83 90 F8 48 8F 9B 13 17 D6 07 22 F0 D5  egéƒ.øH.›..Ö."ðÕ
   0FD40010  B0 10 CB 58 73 42 E1 B3 60 40 3E A4 EE C8 DF 7C  °.ËXsBá³`@>¤îÈß|
    [...] 
   0FD64BE0  21 A9 AC 85 21 13 1E C4 89 F1 B5 97 14 13 35 47  !©¬…!..ĉñµ—..5G
   0FD64BF0  CF C1 94 1F E2 B6 BB E9 A7 5B B0 7E 6B 9A 9C CF  ÏÁ”.ⶻé§[°~kšœÏ

0FD64C00 FF block[edit source]

followed by large FF block

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0FD64C00  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0FD64C10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0FD7FFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0FD7FFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0FD80000 data block[edit source]

followed by large data block

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0FD80000  A1 A6 19 39 40 F7 D5 66 0C D6 75 51 15 0D B3 CA  ¡¦.9@÷Õf.ÖuQ..³Ê
   0FD80010  2D 57 87 94 59 5A B8 EE 24 A9 63 FA 58 31 BA 58  -W‡”YZ¸î$©cúX1ºX
    [...] 
   0FDAD1E0  13 9F 31 B5 79 44 0C 26 37 8C 3B B1 20 DB 09 AD  .Ÿ1µyD.&7Œ;± Û.­
   0FDAD1F0  D0 7B AD 48 EB 8C 6E 9D BF A9 95 9D 87 E0 64 0B  Ð{­HëŒn.¿©•.‡àd.

0FDAD200 FF block[edit source]

followed by large FF block

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0FDAD200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0FDAD210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0FE7FFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0FE7FFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0FE80000 repeative 0x200 00 blocks / 0x200 FF blocks[edit source]

then at 0FE80000 [ 00 block of 0x200 length, followed by FF block of 0x200 length ] X repeated until 0x0FEBF5FF

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0FE80000  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   0FE80010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   
    [...]    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   
   0FEBF5E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   0FEBF5F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

0FEBFE00 FF block[edit source]

followed by large FF block until EOF

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   0FEBFE00  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0FEBFE10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
    [...]  
   0FFFFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0FFFFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

NAND reference (bluemimmo)[edit source]

CECHA-06/COK-001 with 3.60 OFW

VTRM[edit source]

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
   
   00D80000  53 43 45 49 56 54 52 4D 00 00 00 00 00 00 00 A8  SCEIVTRM.......¨
   00D80010  00 00 00 00 00 E8 02 00 00 00 00 00 00 00 00 28  .....è.........(
   00D80020  00 00 00 00 56 54 52 4D 00 00 00 00 00 00 00 04  ....VTRM........
   00D80030  DD 8F ED 9A 82 76 B5 2C 2A 99 A2 ED E3 AF B8 4E  Ý.íš‚vµ,*™¢í㯸N
   00D80040  F9 F6 0F CE 00 00 00 00 00 00 00 00 00 E8 27 20  ùö.Î.........è' 
   00D80050  00 00 00 00 00 00 00 60 00 00 00 00 00 00 09 20  .......`....... 
   00D80060  04 00 00 00 02 00 00 05 10 70 00 05 FF 00 00 01  .........p..ÿ...
   00D80070  9D 2B 1C B4 04 09 59 5C 7B 6A A6 F6 B4 BB A6 FF  .+.´..Y\{j¦ö´»¦ÿ
   00D80080  CA C2 B0 E9 34 3E 39 3C F4 1D 00 E8 B5 42 89 D7  Ê°é4>9<ô..èµB‰×
   00D80090  C5 12 67 F3 A2 DD 9B 5E AF A1 FE DB 19 27 C9 CB  Å.gó¢Ý›^¯¡þÛ.'ÉË
   00D800A0  4F DE D5 CF 7A B2 C2 7B 8C 44 BE 99 54 DB 99 93  OÞÕÏz²Â{ŒD¾™TÛ™“
   00D800B0  00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF  ........ÿÿÿÿÿÿÿÿ
   00D800C0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00D800D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00D800E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   00D800F0  FF FF FF FF FF FF FF FF 00 00 00 00 00 EB E4 8C  ÿÿÿÿÿÿÿÿ.....ëäŒ
   00D80100  00 00 00 00 00 00 00 14 86 1E A7 45 DB 22 16 01  ........†.§EÛ"..
   00D80110  EF 94 71 06 CD 91 7B 0F 95 D1 36 71 FF FF FF FF  ï”q.Í‘{.•Ñ6qÿÿÿÿ
   00D80120  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

cell_ext_os_area[edit source]

   Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
      
   0E780000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   note: no cell_ext_os_area, 0CC00000-0FFFFFFF region filled with big blocks of FF
   0E780010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ    because firmware version 3.60 has no otheros.
    [...]    FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ   large FF filled block region
   0FFFFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
   0FFFFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

NAND reference CECHG04/SEM-001(sinsizer)[edit source]

ros0: OFW 4.40
ros1: OFW 4.31
metldr: 0E77 => E7B0
bootldr: 2E8C => 2E900

post VTRM / pre cell_ext_os_area[edit source]

Same structure as the other till 00F42000

00F42000 data area (size 0xC065600)[edit source]

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00F42000  AB 0E 33 D0 51 66 AA DD DA A0 F1 C3 CC 22 98 61  «.3ÐQfªÝÚ ñÃÌ"˜a
00F42010  25 51 0C 1C FC 9B 56 AA 85 4E B1 C5 CA 73 01 3C  %Q..ü›Vª…N±ÅÊs.<
[...]
0CFA75E0  73 49 FA 50 54 D5 1C B3 5E 84 E3 7E D9 4B BE 11  sIúPTÕ.³^„ã~ÙK¾.
0CFA75F0  99 DB C4 35 64 B5 BA CA 31 0A 0F 9E 58 B6 41 78  ™ÛÄ5dµºÊ1..žX¶Ax
0CFA7600 unreferenced area (size 0x398A00)[edit source]
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0CFA7600  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0CFA7610  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0D33FFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D33FFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

00D340000 - 00D34F9FF (0x200 Blocks)[edit source]

0x200 data and unreferenced Blocks.

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0D340000  F8 71 BD A7 B0 58 54 75 98 00 34 AC 55 06 3C 26  øq½§°XTu˜.4¬U.<&
0D340010  25 3A 5A 86 31 4D 36 97 3C E6 83 4E 2B 10 5A 6D  %:Z†1M6—<æƒN+.Zm
[...]
0D3401E0  A7 40 E6 4B 2A B3 16 61 9F D3 99 96 7A 36 5B 26  §@æK*³.aŸÓ™–z6[&
0D3401F0  92 4B C1 03 91 9F 27 1F 16 49 8C 25 7E B9 6B E2  ’KÁ.‘Ÿ'..IŒ%~¹kâ
0D340200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D340210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0D3403E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D3403F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D340400  31 C0 2C 69 BA 50 73 00 AE D6 37 73 13 B9 9B A9  1À,iºPs.®Ö7s.¹›©
0D340410  DF 7C 01 C2 FD 2C E8 0F BB 4D AE BA C9 D0 F6 A9  ß|.Âý,è.»M®ºÉÐö©
.
. each Block (size 0x200)
.
0D34F200 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D34F210 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...] 3 FF Blocks (size 0x600)
0D34F7E0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D34F7F0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D34F800 56 C9 9C 33 15 EA 73 27 08 57 40 B1 85 0A BF 10  VÉœ3.ês'.W@±….¿.
0D34F810 1A 23 30 CC 84 1D 61 A4 7E AB FA 54 3C 86 A3 19  .#0Ì„.a¤~«úT<†£.
[...] 1 Block (size 0x200)
0D34F9E0 7E 62 C6 B5 A4 98 1C 3C 16 C5 4E DF 62 B9 47 E9  ~bƵ¤˜.<.ÅNßb¹Gé
0D34F9F0 23 82 19 D0 2E 36 DF DF D6 CA AA 5D C5 B6 07 DF  #‚.Ð.6ßßÖʪ]Ŷ.ß
0D34FA00 unreferenced area (size 0x3B0600)[edit source]
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0D34FA00  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D34FA10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0D6FFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D6FFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0D700000 data area (size 0x200)[edit source]

Also found at 0F700000 (missing cell_ext_os_area header) and 0CF00000 (with cell_ext_os_area header)

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0D700000  4C 21 70 8F DF 1C 65 49 23 E5 2C C1 D4 09 CC 71  L!p.ß.eI#å,ÁÔ.Ìq
0D700010  F1 05 2E 4D 41 FF 88 D9 F2 E3 FE 84 7C F6 A3 3F  ñ..MAÿˆÙòãþ„|ö£?
[...]
0D7001E0  A1 15 A8 02 3B 90 62 F2 A6 F1 9A BF 49 21 20 31  ¡.¨.;.bò¦ñš¿I! 1
0D7001F0  16 5F 29 CD A5 50 B8 79 7D 15 11 94 B6 8C 27 87  ._)Í¥P¸y}..”¶Œ'‡
0D700200 unreferenced area (size 0x1E00)[edit source]
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0D700200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D700210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0D701FE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D701FF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0D702000 data area (size 0x4D200)[edit source]

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0D702000  B4 88 04 F1 A5 9C E7 64 BD 35 0A 91 7E 60 B7 B5  ´ˆ.ñ¥œçd½5.‘~`·µ
0D702010  42 66 0A 14 1E 66 30 B8 CB 0B D3 81 61 F0 CE 99  Bf...f0¸Ë.Ó.aðΙ
[...]
0D74F1E0  43 B5 D3 F8 57 20 D6 7F 75 5C B5 DF 28 81 32 0A  CµÓøW Ö.u\µß(.2.
0D74F1F0  C1 3F E5 FE 1B BF 05 5D DA DC C2 B6 76 05 AD F1  Á?åþ.¿.]Úܶv..ñ
0D74F200 unreferenced area (size 0x600)[edit source]
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0D74F200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D74F210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0D74F7E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D74F7F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0D74F800 data area (size 0x42200)[edit source]

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0D74F800  56 C9 9C 33 15 EA 73 27 08 57 40 B1 85 0A BF 10  VÉœ3.ês'.W@±….¿.
0D74F810  1A 23 30 CC 84 1D 61 A4 7E AB FA 54 3C 86 A3 19  .#0Ì„.a¤~«úT<†£.
[...]
0D7919E0  32 0D A4 EC 6D 5B F8 E3 42 55 E2 FF 69 46 C0 4F  2.¤ìm[øãBUâÿiFÀO
0D7919F0  98 F0 D8 AB 7C 76 D2 09 F3 2F 09 4B CE 99 76 23  ˜ðØ«|vÒ.ó/.KΙv#
0D791A00 unreferenced area (size 0x600)[edit source]
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0D791A00  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D791A10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0D791FE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D791FF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0D792000 data area (size 0x200)[edit source]

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0D792000  8E 24 22 F5 99 B7 B2 FE 1A 02 8D 1D 03 42 ED 56  Ž$"õ™·²þ.....BíV
0D792010  51 E6 C3 A0 AE BA 27 0B E2 29 14 D3 3F 05 AF C1  Qæ஺'.â).Ó?.¯Á
[...]
0D7921E0  99 F5 22 6D CD D3 04 FA 76 34 8D 85 66 5B 7A CD  ™õ"mÍÓ.úv4.…f[zÍ
0D7921F0  69 88 06 85 F2 AD 62 3C 3B 31 A3 CE C2 40 51 C2  iˆ.…ò.b<;1£ÎÂ@QÂ
0D792200 unreferenced area (size 0x600)[edit source]
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0D792200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D792210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0D7927E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D7927F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0D792800 data area (size 0x200)[edit source]

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0D792800  4A BE BF 27 59 AA FF 01 83 06 36 04 E6 AA E2 74  J¾¿'Yªÿ.ƒ.6.æªât
0D792810  8E CF 92 2F CC 40 16 01 FE 66 97 D0 EA B4 B9 04  ŽÏ’/Ì@..þf—Ðê´¹.
[...]
0D7929E0  27 3C 22 2B 61 67 95 58 FF D0 E3 30 11 40 80 9F  '<"+ag•XÿÐã0.@€Ÿ
0D7929F0  5E 19 19 D5 A8 98 E9 28 D9 D9 40 F8 BA 30 72 27  ^..Õ¨˜é(ÙÙ@øº0r'
0D792A00 unreferenced area (size 0xBED800)[edit source]
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0D791A00  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0D791A10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0E3801E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E3801F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0D340000 - 0D34F9FF (0x200 Blocks)[edit source]

Maybe backup blocks or bad mapping. Data Blocks are equal to prior data blocks. Seen in 0D74F800 data area.

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0E380200  53 5A F5 55 DE 8E 6A 78 AC 78 DB 9B 3A EF 13 9A  SZõUÞŽjx¬xÛ›:ï.š
0E380210  D7 D2 13 70 B2 05 C9 A0 81 E3 CF B9 41 CF 25 1B  ×Ò.p².É .ãϹAÏ%.
[...]
0E3803E0  41 76 D4 0E 1C 99 C8 11 8B B4 45 12 E1 FD C2 0F  AvÔ..™È.‹´E.áýÂ.
0E3803F0  44 7B C7 0C E9 9A A4 F9 91 94 CD C8 91 F8 47 75  D{Ç.隤ù‘”ÍÈ‘øGu
0E380400  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E380410  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0E3805E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E3805F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E380600  F6 F8 1B 33 21 1F 32 E4 FE 9E 3D 19 21 66 3B A2  öø.3!.2äþž=.!f;¢
0E380610  7F 85 CB 4C 91 8E F7 A1 C2 DC 18 C3 5D 50 C2 D8  .…ËL‘Ž÷¡ÂÜ.Ã]PÂØ
.
. 0x200 Blocks FF and data areas repepeats till 0E38FFFF
.
0E38FFE0  35 3F C1 7E E3 19 83 D8 C8 20 81 71 D8 1D 21 6E  5?Á~ã.ƒØÈ .qØ.!n
0E38FFF0  07 11 D2 3E 19 24 A9 BC 24 4B 46 3D 16 16 0C 65  ..Ò>.$©¼$KF=...e
0E390000 unreferenced area (size 0x370000)[edit source]
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0E390000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E390010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0E6FFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E6FFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0E700000 data area (size 0x200)[edit source]

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0E700000  64 F0 28 49 C5 4F ED 7B AE D7 88 C9 22 64 1E 69  dð(IÅOí{®×ˆÉ"d.i
0E700010  3C 7E 94 3C 35 4D 80 F7 37 AB A7 20 D7 C6 C8 C7  <~”<5M€÷7«§ ×ÆÈÇ
[...]
0E7001E0  39 C5 4C ED 8C C7 CE 08 EE 0B FD E7 69 85 F2 28  9ÅLíŒÇÎ.î.ýçi…ò(
0E7001F0  7C FD F2 9C 7D 2D D3 E1 2A B8 6F 19 FF 25 F8 BC  |ýòœ}-Óá*¸o.ÿ%ø¼
0E700200 unreferenced area (size 0x1E00)[edit source]
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0E700200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E700210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0E701FE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E701FF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0E700000 data area (size 0x59A00)[edit source]

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0E702000  A2 DC 30 17 47 6D E1 53 18 F9 DB D8 9D 87 27 5E  ¢Ü0.GmáS.ùÛØ.‡'^
0E702010  3D C6 C6 E7 D9 DC 86 E5 39 53 D1 7F 7C 12 3A 7E  =ÆÆçÙ܆å9SÑ.|.:~
[...]
0E75B9E0  A2 E6 63 4F CA 80 E0 D0 A1 59 A5 B3 47 8F 73 F1  ¢æcOÊ€àСY¥³G.sñ
0E75B9F0  C6 68 5E A6 57 72 00 CE B7 97 B1 C1 78 2A 26 9A  Æh^¦Wr.η—±Áx*&š
0E75BA00 unreferenced area (size 0x24600)[edit source]
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0E75BA00  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E75BA10  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0E77FFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E77FFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

cell_ext_os_area[edit source]

Flash:cell_ext_os_area

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0E780000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E780010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ      missing header
0E780020  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0E7801F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E780200  00 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF  ....ÿÿÿÿÿÿÿÿÿÿÿÿ
0E780210  00 00 00 03 FF FF FF FF FF FF FF FF FF FF FF FF  ....ÿÿÿÿÿÿÿÿÿÿÿÿ
0E780220  00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF  ..........ÿÿÿÿÿÿ
0E780230  00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF  ............ÿÿÿÿ
0E780240  00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF  ........ÿÿÿÿÿÿÿÿ
0E780250  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0E7807E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E7807F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

crosschecking

OtherOS[edit source]

Flash:OtherOS

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0E780800  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0E780810  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0EB021E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0EB021F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0EB02200 - 0EB05FFF data area (0x200 Blocks)[edit source]

Maybe backup blocks or bad mapping. Data blocks are equal to prior data blocks. Seen in 0D702000 data area.

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0EB02200  18 FF 37 DF F2 B3 82 82 8C 20 E8 79 05 8B 18 89  .ÿ7ßò³‚‚Œ èy.‹.‰
0EB02210  39 4D B7 8C 3D 5D 0B 7F E3 80 C8 4F E3 FB 99 46  9M·Œ=]..ã€ÈOãû™F
[...]
0EB023E0  EF FB F0 37 9C B9 F8 B1 1B 04 BA 3A 5B C3 F6 6D  ïûð7œ¹ø±..º:[Ãöm
0EB023F0  0D C5 F2 A1 FB 8E 06 A8 43 76 BD 8B 86 23 40 EF  .Åò¡ûŽ.¨Cv½‹†#@ï
0EB02400  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0EB02410  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
.
. 0x200 Blocks FF and data areas repepeats till 0EB05FFF
.
0EB05FE0  75 9A 64 74 57 DA 61 DD 8C 90 AF D4 A9 E6 8B 9B  ušdtWÚaÝŒ.¯Ô©æ‹›
0EB05FF0  10 A5 44 0F 53 F1 67 96 C8 A1 1D 22 48 54 31 25  .¥D.Sñg–È¡."HT1%
0EB06000 unreferenced area (size 0x4FA000)[edit source]
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0EB06000  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0EB06010  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0EFFFFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0EFFFFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

bootldr[edit source]

Flash:bootldr @ 0xF000000 - 0xF03FFFF

unreferenced area[edit source]

0F040000 unreferenced area (size 0xB00000)[edit source]
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0FB3FFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0FB3FFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0FB3FFE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0FB3FFF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0F700000 data area (size 0x200)[edit source]

Seen in 0D700000 data area. Maybe backup block or bad mapping.

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0F700000  4C 21 70 8F DF 1C 65 49 23 E5 2C C1 D4 09 CC 71  L!p.ß.eI#å,ÁÔ.Ìq
0F700010  F1 05 2E 4D 41 FF 88 D9 F2 E3 FE 84 7C F6 A3 3F  ñ..MAÿˆÙòãþ„|ö£?
[...]
0F7001E0  A1 15 A8 02 3B 90 62 F2 A6 F1 9A BF 49 21 20 31  ¡.¨.;.bò¦ñš¿I! 1
0F7001F0  16 5F 29 CD A5 50 B8 79 7D 15 11 94 B6 8C 27 87  ._)Í¥P¸y}..”¶Œ'‡
F700200 unreferenced area (size 0x1E00)[edit source]
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0F700200  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0F700210  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
[...]
0F701FE0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0F701FF0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

0F702000 - F705DFF (0x200 Blocks)[edit source]

As before alternating 0x200 datablocks and ff blocks. Data seen in prior 0D702000 data area.

The whole section till the end contains these 0x200 blocks of data and FF. Some bigger FF gaps in between.



Hidden value in VTRM (NOR Flash)[edit source]

Flash:cvtrm

  • from offset 0xEDD748 count 199 (0xC7) values of a 0x14 byte value (hash1) until you reach 0xEDE6D4, where you'll find another 0x14 byte value (hash2)
  • from there, count 520 (321 + 199) values of the same repeated 0x14 byte value until you reach the second offset where you'll find the same hash of the first 199 step count (you can just search for the value to encounter it faster).
  • in the area in the middle there's a third 0x14 value (hash3) at offset 0xEE4010 (repeated also twice in each vtrm)

maybe these are all sha1 hashes of something?

  • 0xEE4010 should be an sha1 of root hsec, if syscon sends different hsec the sha1 wont match to VTRM it will lead to an RSOD. (root hash/ root hsec - srh)
  • vtrm table is almost equally build up like PFD files.

Experiments (with above hashes)[edit source]

  • replacing both hash 2 with either hash3 or hash1 doesn't result in RSOD. why? (possibly hash1 and hash3 are fallback hashes?)
  • filling hash2 with any other value besides hash1/2/3 in hash2 WILL result in RSOD
  • no considerable changes found with experiment. most considerable changes would happen when the guilty is hardware and not software.
  • hash_repeated:hmac_sha1(srk,empty data)
  • hash_hidden:hmac_sha1(srk,0x58 bytes of empty sector)
  • srh is the hash of the signature table (the giant table with the repeated hashes and the hidden one) hashed with srk key
  • header hash is just a hmac sha1 of hmac sha1 of vtrm section without header (0x28 bytes) and signature table(again, with srk key, hashed twice)

RAW NAND + bad blocks[edit source]

Each page of a block has 2048 bytes of data plus a 64 bytes oob (out of bounds) or spare area. This oob area contains 4*14 bytes ecc data for 4*512 bytes of actual data (of which 10 bytes are the actual ecc plus 4 unknown bytes). It totally unrelated to bad blocks. The remaining 8 bytes of oob contain eg. information of block status (good or bad) and the block mapping (physical block location in nand mapped to logical block location in merged dump).

The PS3 has many different ways of doing this depending on the location of bad blocks. That's where flowrebuilder fails, because it doesn't know all the different ways of doing it (if it doesn't fail it means it had bad blocks in a way that Flowrebuilder understands).

As requoted from NORpatch[edit source]

https://raw.githubusercontent.com/hjudges/NORway/824bab547698ebac8c69158d15e0c18d866c0a95/norpatch_README.txt

Some additional information on how to use "norpatch" for checking ECC errors of raw NAND dumps...

*** All credits go to "RPS" who developed/reversed the ECC algo (according to Flow Rebuilder title). ***

The algo was like forever available in Flow Rebuilder, but it was only used to create new ECCs for patched dumps. I actually don't know why there's no "checking" function. I've been using it for over a year now to validate nand dumps, cause it's a handy *additional* verification step. I've been asked many times to release this, but I didn't develop the algo, so I never did. Since the Flow Rebuilder source code is floating around anyway, I figured what the heck. Feel free to complain.. :P

It's important to understand what ECC (Error Correcting Code) is and what it does (and more importantly - what it doesn't do!):

  • A PS3 NAND has a 10 byte ECC for each 512 byte sector.
  • The PS3 uses the ECC to detect and correct errors (as everything with Sony it's a propriatary algo, but commonly a 10 byte ECC can correct up to 4 invalid bytes).
  • RPS' implementation can only be used to detect errors, not to correct them!

Where ECC fails:

  • Your flasher returned all 0xFF for a sector/page/block instead of correct data. This won't be detected by ECC, as the ECC for 512 * 0xFF = 10 * 0xFF.
  • Your flasher swapped pages while dumping, e.g. page 0 is located at the offset of page 1 and vice versa. The ECC will be correct, but the dump is still invalid.

What do you do when there are ECC errors?

  • ECC errors are normal and it does happen that a NAND cell loses its content. Usually the PS3 will correct the error.
  • As a rule of thumb you can say that up to 10 errors per dump are a valid range. If you get significantly more than that, you should worry (in case of a bad dump, you'll usually get hundreds of errors - or no errors at all if your dump is just 0xFF's :) ).
  • When there're 10 or less errors, check the location of the errors - this requires some calculation: you'll get a block number for the error, which is the physical block in your raw dump. You have to convert this physical block number to a logical offset in your merged dump generated by Flow Rebuilder. When unscrambling dumps, Flow Rebuilder will create a text file called "nand0_phy_mapping.txt" and "nand1_phy_mapping.txt". Open the file that corresponds to the dump you've checked for ECC errors (0=top, 1=bottom). First column is the physical block, second column is the logical block. Locate the physical block number reported by the ECC check, take the corresponding (decimal) logical block number and multiply it with 0x40000 (hex). The result is the offset in your merged dump. Anything from 0x00C0000 to 0x0EBFFFF (ROS 0/1) and from 0x0F00000 to 0xEFFFFFF (VFlash) can usually be ignored. For everything else you should worry.

In general:

  • Always make multiple dumps and file compare them!
  • ECC checks don't eliminate the need for additional validation!
  • Additionally use one or all of the awesome dump validators out there! "norpatch" is not a full-fletched validator!
  • I personally use BwE, especially because it will catch the 0xFF ECC issue mentioned before with its repetition check (I guess Swizzy's tool does this as well now).



-- judges

Flash Samples[edit source]

Reference flash dumps[edit source]

User flashdumps[edit source]

Here are some samples of NOR Flash for your dissection. These are taken from different consoles (because it is useless to dump different firmware versions as ROS/RVK will be the same crossconsole)

SKU bootldr metldr ROS0 ROS1 Link Note
PS3 Phat:
CECHA
CECHB
CECHC
CECHE
CECHG
CECHH
CECHJ
CECHK
CECHL [1] 3.55-Rogero CECHL03
CECHL [2] 3.56 CECHL03
CECHL [3] 3.70 CECHL03
CECHM
CECHP
CECHQ
PS3 Slim:
CECH-20xx 3.65 3.55 [4] 3.65 CECH-2008 A
CECH-20xx 3.56 3.56 [5] 3.56 CECH-2008 B
CECH-20xx 3.42 3.70 [6] 3.70 CECH-2008 B
CECH-20xx 3.72 4.00 [7] 4.00 CECH-2008 B
CECH-21xx
CECH-25xx 3.66 3.56 [8] 3.60 CECH-2508 B
CECH-25xx 3.66 3.72 [9] 3.72 CECH-2508 B
CECH-30xx

Flash checking / extraction[edit source]

Community projects[edit source]

Generic Recommendations[edit source]

  • The information in this wiki was given [freely by many volunteers] ; it would be most fair to release any program based on it, as opensource with the community accordingly (tip: public git-repo).
  • Please link to wiki so that others might improve the code and also know on what information it is based as well as other informative pages.
  • Feel free to ask questions on the talkpages when having trouble understanding mainpage or when not knowing what to check for.
  • Make checkers/extractors bytedirection aware and byteswap when needed
  • There are several flash dumptypes that can exist (besides the normal full ones):
    • NAND
      • Software dump without any bootldr and with or without masking (old software flashdump and Preloader)
      • Software dump with only one bootldr (Memdump)
      • Hardware dump with both bootldr (normal full dump)
    • NOR
      • Software dumps (Preloader)
      • Hardware dumps (normal full dump)
  • Do not take shortcuts. Make users aware if any section is not checked (yet)
  • Use dynamic sections whenever possible (will make it easier to port from NAND <> NOR, be more robust in checking, make it more future/history proof)
  • Check if data-/file-sections are uninterupted (multirepetive 00 or FF)
  • Check for known static values
  • When values are semistatic, consider checking with wildcard /range masks
  • Make the user aware of any anomalies (in red/bold)
  • Output generic information (version, console info, minver etc)
  • Check for downgradeability
  • Check statistics in range with known FW versions (3.55 is considered base on wiki unless documented)

With / Without[edit source]

  • Flash Without EID5 : Boots Fine
  • Flash Without EID0 Sections 1 2 3 4 5 7 8 9 and With Sections 0 6 A : Boots Fine
  • Flash With only MAC Address on cISD and Header: Boots Fine

Experimental tables[edit source]

NOR flash
type Regions Start Offset Length Notes
Hex Blocks Bytes Hex Blocks Bytes
gen Second
Region
Partition table 0FACE0FF DEADFACE
gen erased bytes
gen region 0 missing
gen region 1 CELL_EXTNOR_AREA
gen region 2 CRL1
gen DRL1
gen CRL2
gen DRL2
pc bootldr


Erasing blocks[edit source]

The PS3 erases blocks in chunks of 0x40000 bytes, this is a sample of how the blocks are erased in a ros area (with offsets relatives to the start of the ros area):

Erase block 0 begins 0x0
Erase block 1 begins 0x40000
Erase block 2 begins 0x80000
Erase block 3 begins 0xC0000
Erase block 4 begins 0x100000
Erase block 5 begins 0x140000
Erase block 6 begins 0x180000
Erase block 7 begins 0x1C0000
Erase block 8 begins 0x200000
Erase block 9 begins 0x240000
Erase block 10 begins 0x280000
Erase block 11 begins 0x2C0000
Erase block 12 begins 0x300000
Erase block 13 begins 0x340000
Erase block 14 begins 0x380000
Erase block 15 begins 0x3C0000
Erase block 16 begins 0x400000
Erase block 17 begins 0x440000
Erase block 18 begins 0x480000
Erase block 19 begins 0x4C0000
Erase block 20 begins 0x500000
Erase block 21 begins 0x540000
Erase block 22 begins 0x580000
Erase block 23 begins 0x5C0000
Erase block 24 begins 0x600000
Erase block 25 begins 0x640000
Erase block 26 begins 0x680000
Erase block 27 begins 0x6C0000