forums.ps2dev.org

[CrazyT]

Hi, i just downloaded http://my.malloc.us/silverspring/files/2007/10/ipl-decrypt-sample.rar wich is an example of how they decrypt the ipl.
I was wondering if it would be possible to watch/log the calls of such hardware functions with the help of breakpoints.
Because it is not a normal call to such a function you can not simply say: "stop at offset xy"
The reason i ask is some idea about this crypto chip.
Cos nobody knows what code it uses to crypt/decrypt stuff ... why not just generate a file that stores the encrypted and decrypted buffer.
That way emulators might be possible in future ...
(of course only if the buffer that needs to get decrypted does not change every time)

[Dariusc123456]

Im not 100% sure, but does PSPLink do that? I dont use the darn thing (for it wont even do anything).
_________________
PSHN - Playstation Hacking Network
PSX/PS1 - HACK - Game Shark
PS2 - HACK - Swap
PSP - HACK - Pandora
PS3 - ?

[CrazyT]

PSPLink has an option for breakpoints, but the problem is that the actual function is called by the chip.
All you change is a register/memory part, so i wonder if it is somehow possible to break on the change of a special register/memory part.
For better understanding thats some part they use to decrypt stuff:

PspKirkRegs *const crypt = KIRK_HW_REGISTER_ADDR;
crypt->command = 1;
crypt->src_addr = MAKE_PHYS_ADDR(src);
crypt->dst_addr = MAKE_PHYS_ADDR(dst);
crypt->proc_phase = 1;
while((crypt->status & 0x11) == 0);

See?
There is no function call like for example "decrypt()" at all.
Question is, how the chip knows when it should process the command.(maybe just checks the field proc_phase?)

[m0skit0]

[jimparis]

It's a hardware crypto engine. There's no crypto code executing on the MIPS CPU while it's waiting for the Kirk to come up with a result, so there's nothing that a CPU breakpoint could possibly see.

[m0skit0]

Yes, if you see my EDIT, I finally understood that ;)
_________________