forums.ps2dev.org Forum Index forums.ps2dev.org
Homebrew PS2, PSP & PS3 Development Discussions
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

help ! about R4000 Disassembler

 
Post new topic   Reply to topic    forums.ps2dev.org Forum Index -> PSP Development
View previous topic :: View next topic  
Author Message
0okm0000



Joined: 13 Jan 2006
Posts: 116
PostPosted: Fri Jun 02, 2006 2:51 pm    Post subject: help ! about R4000 Disassembler Reply with quote
i hope to find a way to direct access PSP NAND Flash
when i use Hardware Registers to direct access NAND Flash
i just can Read NAND Flash ID
but can not output other Command DATA
Code:
   LockFlash(0);
   *((int*)0xbd101008)=0x90; //Read ID CMD
   *((int*)0xbd10100c)=0x00;
   printf("0x%.8X\n", *((int*)0xbd101300));
   printf("0x%.8X\n", *((int*)0xbd101300));
   printf("0x%.8X\n", *((int*)0xbd101300));
   printf("0x%.8X\n", *((int*)0xbd101300));
   UnlockFlash();

so i hope to reverse engineering sceNandLock(), sceNandUnlock(), sceNandReadId() from emc_sm.prx
but i can't understand R4000 Assembler
please help ^^
Code:
//FW1.50 emc_sm.prx
...
// is this mean *((int*)0xbd104104)=0x90 ?
     704:  24030090  addiu      v1,zero,0x90 <- Read ID CMD ?
     708:  3c01bd10  lui        at,0xbd10
     70c:  ac231008  sw         v1,4104(at)

// *((int*)0xbd104108)=??
     710:  00003021  addu       a2,zero,32
     714:  3c01bd10  lui        at,0xbd10
     718:  ac20100c  sw         zero,4108(at)

// ??
     71c:  18a0000b  blez       zero,a1,11

// t0=*((int*)0xbd104864) ??
     720:  24030001  addiu      v1,zero,0x01
     724:  3c08bd10  lui        t0,0xbd10
     728:  8d081300  lw         t0,4864(t0)

     72c:  00863821  addu       a3,a2,32
     730:  24c60001  addiu      a2,a2,1
     734:  00c5182a  slt        v1,a1,32
     738:  10800002  beq        zero,a0,2
     73c:  310200ff  andi       v0,t0,255
     740:  a0e20000  sb         v0,0(a3)
     744:  1460fff7  bne        zero,v1,-9
     748:  24030001  addiu      v1,zero,1
     74c:  00001021  addu       v0,zero,32
     750:  3c01bd10  lui        at,0xbd10
     754:  03e00008  jr         zero,zero,32
...

_________________
PSP hardware hack
http://0okm.blogspot.com/
Back to top
View user's profile Send private message Visit poster's website
magiK



Joined: 09 Apr 2006
Posts: 22
PostPosted: Sat Jun 03, 2006 3:08 am    Post subject: Reply with quote
Your disassembler's output is not very friendly :)

Code:

     704:  24030090  addiu      v1,zero,0x90       v1 = 0x90
     708:  3c01bd10  lui        at,0xbd10          at = 0xbd100000
     70c:  ac231008  sw         v1,4104(at)        *((int*)at+0x1008) = v1
...
     714:  3c01bd10  lui        at,0xbd10          at = 0xbd100000
     718:  ac20100c  sw         zero,4108(at)      *((int*)at+0x100C) = 0



The rest is a loop (size and buf are the parameters passed to sceNandReadId):
Code:

for(i=0;i<size;i++)
    buf[i] = *((int*)0xbd101300);



sceNandLock calls sceNandSetWriteProtect(0 or 1, depending on writeFlag) and sceSysregEmcsmBusClockEnable. sceNandUnlock calls sceNandSetWriteProtect(1) and sceSysregEmcsmBusClockDisable.

sceNandSetWriteProtect(0) reads the value from 0xBD101004, sets bit 8 to 1 (OR 0x80), writes that back to the same address and then loops reading until the bit is set. sceNandSetWriteProtect(1) reads the value, clears bit 8 and writes back. I hope I got it right :)
Back to top
View user's profile Send private message Yahoo Messenger MSN Messenger
0okm0000



Joined: 13 Jan 2006
Posts: 116
PostPosted: Sat Jun 03, 2006 3:15 am    Post subject: Reply with quote
magiK wrote:
Your disassembler's output is not very friendly :)

Code:

     704:  24030090  addiu      v1,zero,0x90       v1 = 0x90
     708:  3c01bd10  lui        at,0xbd10          at = 0xbd100000
     70c:  ac231008  sw         v1,4104(at)        *((int*)at+0x1008) = v1
...
     714:  3c01bd10  lui        at,0xbd10          at = 0xbd100000
     718:  ac20100c  sw         zero,4108(at)      *((int*)at+0x100C) = 0



The rest is a loop (size and buf are the parameters passed to sceNandReadId):
Code:

for(i=0;i<size;i++)
    buf[i] = *((int*)0xbd101300);



sceNandLock calls sceNandSetWriteProtect(0 or 1, depending on writeFlag) and sceSysregEmcsmBusClockEnable. sceNandUnlock calls sceNandSetWriteProtect(1) and sceSysregEmcsmBusClockDisable.

sceNandSetWriteProtect(0) reads the value from 0xBD101004, sets bit 8 to 1 (OR 0x80), writes that back to the same address and then loops reading until the bit is set. sceNandSetWriteProtect(1) reads the value, clears bit 8 and writes back. I hope I got it right :)

^O^ Thank You
_________________
PSP hardware hack
http://0okm.blogspot.com/
Back to top
View user's profile Send private message Visit poster's website
groepaz



Joined: 01 Sep 2005
Posts: 305
PostPosted: Sat Jun 03, 2006 4:42 am    Post subject: Reply with quote
dont forget to post what you find out so i can add it to my docs :=)
_________________
http://www.hitmen-console.org
http://hitmen.c02.at/files/yapspd/
Back to top
View user's profile Send private message Visit poster's website
0okm0000



Joined: 13 Jan 2006
Posts: 116
PostPosted: Sat Jun 03, 2006 2:08 pm    Post subject: Reply with quote
groepaz wrote:
dont forget to post what you find out so i can add it to my docs :=)

NAND Flash Hardware Registers

0xbd101000
0xbd101004
0xbd101008
0xbd10100c

0xbd101014

0xbd101020
0xbd101024
0xbd101028

0xbd101038

0xbd101200

0xbd101300
_________________
PSP hardware hack
http://0okm.blogspot.com/
Back to top
View user's profile Send private message Visit poster's website
groepaz



Joined: 01 Sep 2005
Posts: 305
PostPosted: Sat Jun 03, 2006 2:18 pm    Post subject: Reply with quote
here is what i already identified a while ago btw: http://hitmen.c02.at/files/yapspd/psp_doc/chap8.html#sec8.6

i would guess that 0xbd101200 is data(write) ... mmh
_________________
http://www.hitmen-console.org
http://hitmen.c02.at/files/yapspd/
Back to top
View user's profile Send private message Visit poster's website
Display posts from previous:   
Post new topic   Reply to topic    forums.ps2dev.org Forum Index -> PSP Development All times are GMT + 10 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


Powered by phpBB © 2001, 2005 phpBB Group