forums.ps2dev.org

ToSHiC · Joined: 16 Feb 2007 Posts: 5

Someone on this forum said that sony mips chips have to support EJTAG. It supports several chips on one connector. There are 2 chip: cpu and media engine, and each of them have JTAG lines. if anyone have motherboard without chips - try to find 5 or 6 lines, that connects both chips and MAYBE some connection pads on the board.
The second idea is about bootstrap. If we write some small loader, that can load firmware from smartmedia, it'll be unbrickable psp :) this loader may be in bootstrap stage 2 or it can be in flash0 as an original firware.

sorry for my english

harleyg · Joined: 05 Oct 2005 Posts: 123

Why not just hook NAND traces up to a smartmedia card if you want an unbrickable psp.

ToSHiC · Joined: 16 Feb 2007 Posts: 5

because it's not software solution. with custom bootstrap you don't need to break wires on the board.

by the way, may be this functionality is implemented in standart bootstrap. just imagine: sony technical support get bricked psp, insert into SM slot 32MB card with image of flash0 and boot psp with pressed select button, for example. something like PS BIOS recovery mode, while it read BIOS image from floppy if CRC error detected ni CMOS.

adrahil · Joined: 16 Mar 2006 Posts: 277

hmmmm..... no :)
Won't be practical enough. Get a UP ;) Moreover the PSP bootstrap is WAY more complex than you can imagine.

danzel · Joined: 04 Nov 2005 Posts: 182

Someone should make thorough documentation of how the PSP bootstraps.
*HINT*HINT* adrahil :P lol.

gbj1 · Joined: 08 Feb 2007 Posts: 45

It has more code for decryption prxes than actually booting and initilizing the hardware. Also, during booting, the device drivers had not yet loaded, so the bios can't access MS at that time.
_________________
guo.bojun@gmail.com

ToSHiC · Joined: 16 Feb 2007 Posts: 5

but there is no need to accesss files on MS throught some file system. just direct copy of first 32M of MS to internal flash. it can be simply done using DMA, for example. i think, it's something about 200-300 bytes of code:)

gbj1 · Joined: 08 Feb 2007 Posts: 45

Good idea, mark with a special flag so it won't conflict with the MS file system. But up till now, I can't find a way to read/write MS through raw DMA access.
_________________
guo.bojun@gmail.com

adrahil · Joined: 16 Mar 2006 Posts: 277

It's not that simple.... There is not a "MSREAD" or "NANDWRITE" hardware register which would do the job easily. Moreover, one can't use a fully custom FW as the psp HAS to boot on an encrypted FW (don't try to understand, just believe it). Unencrypted ELFs are loaded thanks to a bug in loadexec (correct me if i'm wrong), and this is how a "custom" firmware like OE is loaded. So, forget the fully custom FW for now. :)
Also, the psp bios, the reset vector, is not known and won't be for a good while. Moreover, if it is known, it will probably be unmodifiable (read only). And, finally, to destroy your hopes, it uses assymetric encryption thanks to KIRK. So, if one gets decryption keys, we won't be able to encrypt anyway.

To conclude, the only viable solution would be to replace KIRK by some other chip, something like a FPGA which would just return positive at any check given.

ToSHiC · Joined: 16 Feb 2007 Posts: 5

what is the KIRK?
in 1.50 firmware, as i know, IPL wasn't encoded. but in 2.xx firmware it's encoded, and it's mean, that sony can update boot code in CPU. and it's possible to downgrade TA082 motherboards to 1.50, it mean that bootstrap can load decoded IPL. and i've seen on some site, that c+d team has decoded new version of IPL. if smbd cuts off decoding part of IPL and writes decoded prx files on flash.. may be, it'll be first real custom FW :)

adrahil · Joined: 16 Mar 2006 Posts: 277

Helpless.... Read more stuff, it will do you good :)