| View previous topic :: View next topic |
| Author |
Message |
ab5000
Joined: 06 May 2008
Posts: 74
|
 Posted: Fri Oct 31, 2008 9:15 pm Post subject: Ideas on dumping TA-088v3/TA-090 preipl |
 |
|
Hi.
Yesterday I've had an idea of how to dump the preipl on these mb.
When the PSP powers up, the preipl gets copied to the scrathpad RAM (0x00010000).
My idea is this: we power up the PSP with a pandora battery without any MS. The preipl doesn't find the ipl and falls into a infinite cycle.
Now we can dump the ram externally using a pc connected to the psp mb. Dumping the RAM is easier than dumping the ROM directly from the CPU.
However, we can't just dump the RAM while the PSP is running. But, if we power down the PSP and IMMEDIATELY power up only the RAM using the pc, the RAM doesn't get cleared and we can read it without any problem (the power down can be also controlled by the pc).
We still need to cut some mb traces to connect the RAM to the pc. But we can use some pc-controlled bridges to connect the traces when psp is running and to disconnect them when we have to access the RAM from the pc.
Bye,
ab5000. |
|
| Back to top |
|
 |
Torch
Joined: 28 May 2008
Posts: 842
|
| Posted: Fri Oct 31, 2008 11:47 pm Post subject: |
|
|
| The scratchpad RAM is on the main CPU die and can't be accessed like the main RAM. It may not even have an external interface on the chip. |
|
| Back to top |
|
|
adrahil
Joined: 16 Mar 2006
Posts: 277
|
| Posted: Sat Nov 01, 2008 2:51 am Post subject: |
|
|
| Uhm, scratchpad ram? You mean the piece of sh*t which noone uses, not even sony? I don't recall seeing any copy to scratchpad, but only to BFC/BFD memory areas which get remapped for the occasion. |
|
| Back to top |
|
|
moonlight
Joined: 26 Oct 2005
Posts: 567
|
| Posted: Sat Nov 01, 2008 4:37 am Post subject: |
|
|
| adrahil wrote: | | Uhm, scratchpad ram? You mean the piece of sh*t which noone uses, not even sony? I don't recall seeing any copy to scratchpad, but only to BFC/BFD memory areas which get remapped for the occasion. |
lol and what do you think 0x80010000 is? :p |
|
| Back to top |
|
|
Torch
Joined: 28 May 2008
Posts: 842
|
| Posted: Sat Nov 01, 2008 4:38 am Post subject: |
|
|
| Seriously though, how DO you go about dumping the pre-IPL without an exploit in a working IPL ?? |
|
| Back to top |
|
|
Torch
Joined: 28 May 2008
Posts: 842
|
| Posted: Sat Nov 01, 2008 5:43 am Post subject: |
|
|
| Torch wrote: | | Seriously though, how DO you go about dumping the pre-IPL without an exploit in a working IPL ?? |
I just went through the 2.70 IPL thread, where you were working on dumping the pre-IPL using 1.50 D: D: D: D:
Doesn't look like its humanly possible on new firmware! |
|
| Back to top |
|
|
ab5000
Joined: 06 May 2008
Posts: 74
|
| Posted: Sat Nov 01, 2008 6:08 am Post subject: |
|
|
| Torch wrote: | | The scratchpad RAM is on the main CPU die and can't be accessed like the main RAM. It may not even have an external interface on the chip. |
Argh. I tought it was in the main RAM and not in the CPU internal RAM. Sorry. |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
