User talk:Zecoxao: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
m (Moving data)
Line 28: Line 28:
* Using a DIY JigPin would facilitate the task, but we still need more info about the hardware and software interface used by ObjectiveSuite to handle this.
* Using a DIY JigPin would facilitate the task, but we still need more info about the hardware and software interface used by ObjectiveSuite to handle this.
* This would probably work on ps4 too (provided that the diag pin and the JTAG pins still exist)
* This would probably work on ps4 too (provided that the diag pin and the JTAG pins still exist)
= Alternative (Through EEPROM, many thanks to ZeroTolerance for the info) =
* some useful links:
http://dangerousprototypes.com/docs/Bus_Pirate_101_tutorial (bus pirate) <br>
https://www.saleae.com/downloads (logic analyzer)
* Analyzer settings:
http://pastie.org/private/khwaczthr5j2td9jmdfihq
* Bus pirate settings:
http://pastie.org/private/mqycmj8ynxj5mdzttrgpca
* More info:
http://pastie.org/private/f7siriweadsnrpq6dilq
* Read command:
0xA8 0xXX 0xXX (XX XX is block id)
* Write command:
0xA4 0xXX 0xXX (XX XX is block id)
* Check Status command:
0xA9 0x00 0x00 0x00
* Some proof
https://mega.co.nz/#!hssQHZhI!bNMS3MgWx21iUrfLGBSoB2bA3Mfe3DVL23y_SENzDUw<br>
https://mega.co.nz/#!wl8wSCKK!ZZkgeKd8hdRCMRpA2oWrrV5lirjupF_4k9boJkBpBfM
you need https://www.saleae.com/downloads
* https://mega.co.nz/#!UltlyCTL!TAooXpYEWU3DmYlnHbY1FX4IX8WwdZlLeSOXh9mh3nM
* https://mega.co.nz/#!MwEXmQwI!iWQ6Z6-5GhnX0-9r1FBPw9cpOBfKJCna-0dT2GSUj9E
dump of eeprom with above data

Revision as of 01:35, 14 February 2015

The Last Piece of the Puzzle

How

  • By enabling diagnostic mode on the ps3, we can enable the use of JTAG again (it's temporarily disabled when diag mode isn't set)
  • It is possible to dump the syscon firmware using this method (in unencrypted state)
  • The JTAG registers/TAP-controllers need to be bruteforced / reverse engineered
  • The leaked service manuals present information about the pins connected to the JigPin
  • The ObjectiveSuite contains an object (DIAGSERVICE) used to diagnose the ps3 using JTAG
  • Using a DIY JigPin would facilitate the task, but we still need more info about the hardware and software interface used by ObjectiveSuite to handle this.
  • This would probably work on ps4 too (provided that the diag pin and the JTAG pins still exist)
Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=User_talk:Zecoxao&oldid=33957"