The XDR configuration is sent to the Cell BE processor via syscon's packet during booting, however you can query it at any moment.
To fetch it you need to send a packet to the system controller with service id = 0x12 and payload consisting of two zero bytes, an answer have a size of 0x84 bytes (status and data).
It contains some register values which are used during initialization of memory interface controller at startup.

Sample[edit | edit source]

Here are example outputs from Slim consoles (only data):

0000h: 02 02 10 20 08 00 00 01 80 00 FF C0 32 00 06 11  ... ........2... 
0010h: 01 70 7C FE 50 20 00 00 00 E0 62 84 05 5A D6 B0  .p|.P ....b..Z.. 
0020h: 5D 70 71 80 02 10 00 00 0A 96 3D 60 E1 C0 C8 00  ]pq.......=`.... 
0030h: 00 00 00 00 00 00 00 00 ED D6 12 29 59 4B A6 B4  ...........)YK.. 
0040h: 53 49 AC B6 88 C4 62 20 00 00 00 00 00 40 00 00  SI....b .....@.. 
0050h: 08 54 0C 54 14 9F 18 9F 00 58 00 80 00 01 FC 01  .T.T.....X...... 
0060h: 00 06 00 0F FC 0A 00 06 00 0F 37 00 00 10 23 28  ..........7...#( 
0070h: 20 00 80 FF FF FF FF FF FF FF FF FF FF FF FF FF   ...............

0000h: 01 04 20 20 08 00 00 01 80 00 FF C0 32 00 06 11  ..  ........2... 
0010h: 01 70 7C FE 60 40 00 00 00 E0 62 84 05 5A D6 B0  .p|.`@....b..Z.. 
0020h: 5D 70 71 80 02 10 00 00 0A 96 3D 60 E1 C0 C8 00  ]pq.......=`.... 
0030h: 00 00 00 00 00 00 00 00 ED D6 12 29 59 4B A6 B4  ...........)YK.. 
0040h: 53 49 AC B6 88 C4 62 20 00 00 00 00 00 40 00 00  SI....b .....@.. 
0050h: 08 54 0C 54 14 C6 18 C6 00 58 00 80 00 01 FC 01  .T.T.....X...... 
0060h: 00 06 00 0F FC 0A 00 06 00 0F 37 00 00 10 23 28  ..........7...#( 
0070h: 2D 00 80 FF FF FF FF FF FF FF FF FF FF FF FF FF  -...............

Reverse engineering

General

Bluedisk EID0 reDRM · Boot Order · Boot Memory Type · Bugs & Vulnerabilities · Dumping Bootldr · Dumping Metldr · Files on the PS3 · KaKaRoTo_Kind_of_´Jailbreak´ · PS3Cobra Payload Reverse Engineering · PS3UserCheat · QA Flagging · ReDRM / Piracy dongles · Revoke List · RSOD Fix‎ · rtcalarm.dat · Whitelisting · VTRM

Hypervisor

Hypervisor Reverse Engineering · Repository Nodes

Services

Appliance Information Manager · AV Manager · Dispatcher Manager · Factory Data Manager · Indi Info Manager · SB Manager · SC Manager · Secure LPAR Loader · Secure Profile Loader · Secure RTC Manager · Security Policy Manager · Storage Manager · Update Manager · Updater Frontend · USB Dongle Authenticator · User Token Manager · Virtual TRM Manager

Plugin
Interfaces

ap_plugin · audioplayer_plugin · audiop_plugin_dummy · audiop_plugin_mini · auth_plugin · autodownload_plugin · autoupdateconf_plugin · avc_plugin · avc_util · avc2_game_plugin · avc2_game_video_plugin · avc2_text_plugin · bdp_disccheck_plugin · bdp_plugin · bdp_storage_plugin · campaign_plugin · category_setting_plugin · comboplay_plugin · custom_render_plugin · data_copy_plugin · deviceconf_plugin · dlna_plugin · download_plugin · dtcpip_util · edy_plugin · esehttp · eseibrd · eseidle · eselock · eula_cddb_plugin · eula_hcopy_plugin · eula_net_plugin · explore_plugin · explore_plugin_ft · explore_plugin_game · explore_plugin_np · filecopy_plugin · friendim_plugin · friendml_plugin · friendtrophy_plugin · game_ext_plugin · game_indicator_plugin · game_plugin · gamedata_plugin · gamelib_plugin · gameupdate_plugin · hknw_plugin · idle_plugin · impose_plugin · kensaku_plugin · msgdialog_plugin · mtpinitiator_plugin · musicbrowser_plugin · nas_plugin · netconf_plugin · newstore_plugin · np_eula_plugin · np_matching_plugin · np_multisignin_plugin · np_sns_plugin · npsignin_plugin · np_trophy_ingame · np_trophy_plugin · osk · oskfullkeypanel · oskpanel · pesm_plugin · photo_network_sharing_plugin · photolist_plugin · photoviewer_plugin · playlist_plugin · poweroff_plugin · premo_plugin · premo_game_plugin · print_plugin · profile_plugin · ps3_savedata_plugin · ps3_savedata_plugin_game · ps3_savedata_plugin_psp · rec_plugin · regcam_plugin · remotedownload_plugin · sacd_plugin · scenefolder_plugin · screenshot_plugin · software_update_plugin · soundvisualizer_plugin · strviewer_plugin · sysconf_plugin · system_plugin · thumthum_plugin · upload_util · user_info_plugin · user_plugin · videodownloader_plugin · videoeditor_plugin · videoplayer_util · videoplayer_plugin · vmc_savedata_plugin · wboard_plugin · webbrowser_plugin · webbrowser_service · webrender_plugin · xai_plugin · xmb_ingame · xmb_plugin

Emulation

PS1 Emulation · PS2 Emulation · PSP Emulation

Extended
features

Printer support · Remote Play · String Viewer · Web Browser · XMB In-game background music · PS3 and PSVita Cross Functions · Widgets · Life with PlayStation · PlayView · XMB Manuals

Online

Consoleban · Environments · Online Connections · PSN · PSN Handshake Signup · X-I-5-Ticket

Hardware

SC Communication · SC EEPROM · Remarry Syscon · Syscon Thermal Configs · Syscon SPI

CELL

Cell Configuration Ring · CELL Reset Exploit · CellBE Hardware Implementation Registers · Unlocking the 8th SPE · SPU Isolated Modules Reverse Engineering · SPU LS Overflow Exploit

RAM

XDR Configuration · Rambus Registers

ENCDEC Device Reverse Engineering

HDD

HDD Encryption

Bluray disc · Basic Bluray disc authentication procedure · BD Drive Reverse Engineering · Disc Identification/Serialization Data · ODE · Remarry Bluray Drive

Tools

IDA pro disassembler and debugger · CCAPI · 0x000EAEB0 · Ps3.xml · Nids.txt · Nids all.txt · Unknown nids.txt · Fnids.idh

Strings

files

emer_init · aim spu module‎ · lv1‎ · hdd_copy · eurus_fw · lv0 · factory data mngr

dumps

lv2 dump (Rebug 4.46) · lv1 dump (Rebug 4.46) · bootldr dump (2.70) · Network Loading of lv1ldr and above executables

Reference

Archaic · Drk_notes · Canaries

Keys & Seeds

Keys · Per Console Keys · Fail Keys · Seeds · ECDSA binaries · AES binaries · DES binaries · Cryptography Tricks

@@ Line 1: / Line 1: @@
-The XDR RAM configuration is sent to the Cell BE processor via syscon's packet during booting, however you can query it at any moment.<br>
+The XDR configuration is sent to the Cell BE processor via syscon's packet during booting, however you can query it at any moment.<br>
-To fetch it you need to send a packet to the system controller with service id = 0x12 and payload consisting of two zero bytes, an answer have a size of 0x80 bytes.<br>
+To fetch it you need to send a packet to the system controller with service id = 0x12 and payload consisting of two zero bytes, an answer have a size of 0x84 bytes (status and data).<br>
+It contains some register values which are used during initialization of memory interface controller at startup.<br>
 = Sample =
-Here are example outputs from Slim consoles:
+Here are example outputs from Slim consoles (only data):
 <pre>
-x0000: 00 00 00 00 02 02 10 20 08 00 00 01 80 00 FF C0  ....... ........
+h: 02 02 10 20 08 00 00 01 80 00 FF C0 32 00 06 11  ... ........2...
-x0010: 32 00 06 11 01 70 7C FE 50 20 00 00 00 E0 62 84  2....p|.P ....b.
+h: 01 70 7C FE 50 20 00 00 00 E0 62 84 05 5A D6 B0  .p|.P ....b..Z..
-x0020: 05 5A D6 B0 5D 70 71 80 02 10 00 00 0A 96 3D 60  .Z..]pq.......=`
+h: 5D 70 71 80 02 10 00 00 0A 96 3D 60 E1 C0 C8 00  ]pq.......=`....
-x0030: E1 C0 C8 00 00 00 00 00 00 00 00 00 ED D6 12 29  ...............)
+h: 00 00 00 00 00 00 00 00 ED D6 12 29 59 4B A6 B4  ...........)YK..
-x0040: 59 4B A6 B4 53 49 AC B6 88 C4 62 20 00 00 00 00  YK..SI....b ....
+h: 53 49 AC B6 88 C4 62 20 00 00 00 00 00 40 00 00  SI....b .....@..
-x0050: 00 40 00 00 08 54 0C 54 14 9F 18 9F 00 58 00 80  .@...T.T.....X..
+h: 08 54 0C 54 14 9F 18 9F 00 58 00 80 00 01 FC 01  .T.T.....X......
-x0060: 00 01 FC 01 00 06 00 0F FC 0A 00 06 00 0F 37 00  ..............7.
+h: 00 06 00 0F FC 0A 00 06 00 0F 37 00 00 10 23 28  ..........7...#(
-x0070: 00 10 23 28 20 00 80 FF FF FF FF FF FF FF FF FF  ..#( ...........
+h: 20 00 80 FF FF FF FF FF FF FF FF FF FF FF FF FF   ...............
 </pre>
 <pre>
-x0000: 00 00 00 00 01 04 20 20 08 00 00 01 80 00 FF C0  ......  ........
+h: 01 04 20 20 08 00 00 01 80 00 FF C0 32 00 06 11  ..  ........2...
-x0010: 32 00 06 11 01 70 7C FE 60 40 00 00 00 E0 62 84  2....p|.`@....b.
+h: 01 70 7C FE 60 40 00 00 00 E0 62 84 05 5A D6 B0  .p|.`@....b..Z..
-x0020: 05 5A D6 B0 5D 70 71 80 02 10 00 00 0A 96 3D 60  .Z..]pq.......=`
+h: 5D 70 71 80 02 10 00 00 0A 96 3D 60 E1 C0 C8 00  ]pq.......=`....
-x0030: E1 C0 C8 00 00 00 00 00 00 00 00 00 ED D6 12 29  ...............)
+h: 00 00 00 00 00 00 00 00 ED D6 12 29 59 4B A6 B4  ...........)YK..
-x0040: 59 4B A6 B4 53 49 AC B6 88 C4 62 20 00 00 00 00  YK..SI....b ....
+h: 53 49 AC B6 88 C4 62 20 00 00 00 00 00 40 00 00  SI....b .....@..
-x0050: 00 40 00 00 08 54 0C 54 14 C6 18 C6 00 58 00 80  .@...T.T.....X..
+h: 08 54 0C 54 14 C6 18 C6 00 58 00 80 00 01 FC 01  .T.T.....X......
-x0060: 00 01 FC 01 00 06 00 0F FC 0A 00 06 00 0F 37 00  ..............7.
+h: 00 06 00 0F FC 0A 00 06 00 0F 37 00 00 10 23 28  ..........7...#(
-x0070: 00 10 23 28 2D 00 80 FF FF FF FF FF FF FF FF FF  ..#(-...........
+h: 2D 00 80 FF FF FF FF FF FF FF FF FF FF FF FF FF  -...............
 </pre>
 {{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>

XDR Configuration: Difference between revisions

Latest revision as of 06:39, 12 May 2014

Sample[edit | edit source]

Navigation menu

XDR Configuration: Difference between revisions

Latest revision as of 06:39, 12 May 2014

Sample[edit | edit source]

Navigation menu

Search