| View previous topic :: View next topic |
| Author |
Message |
jimparis
Joined: 10 Jun 2005 Posts: 1179 Location: Boston
|
Posted: Wed Nov 08, 2006 5:02 pm Post subject: Retrieve firmware version and nickname over USB storage |
|
|
When in USB mass storage mode ("USB Connection"), the PSP supports several vendor-specific SCSI command blocks. On recent PSP firmware (2.00+?) this includes the ability to retrieve the firmware version and nickname. This is mostly just a curiosity but could be useful, for example, to someone writing a media manager or auto-installer application for the PSP.
The supported SCSI command blocks are:
- 0xFA 0x00 0xA0 0x4d 0x47 0x66 0x6d 0x74 0x01 0x00
Formats the memory stick.
- 0xFB 0x00 0xB4 0x00 0x00 0x00 0x00 0x01 0x01 0x00
Returns a fixed block of data. My guess is that it's a bitmask describing which other commands are supported.
- 0xFB 0x00 0xB5 0x00 0x00 0x00 0x00 0x00 0x01 0x00
Returns the data retrieved by sceUsbstorGetString(3,buf,0x80).
- 0xFC 0x00 0x90 0x50 0x53 0x50 0x69 0x00 0x00 0x00
Returns the PSP firmware revision. Not supported on 1.50.
- 0xFC 0x00 0x91 0x50 0x53 0x50 0x69 0x00 0x00 0x00
Returns the PSP user's nickname. Not supported on 1.50.
I wrote a program to send these commands (except "format") via sg. The output is shown below for a 2.82 PSP:
| Code: |
Opened /dev/sdb
Command: SCSI Inquiry
[0000] 12 00 00 00 FF 00 ......
Response: 56 bytes
[0000] 00 80 00 01 33 00 00 00 53 6F 6E 79 20 20 20 20 ....3...Sony....
[0010] 50 53 50 20 20 20 20 20 20 20 20 20 20 20 20 20 PSP.............
[0020] 31 2E 30 30 4D 45 4D 4F 52 59 53 54 49 43 4B 2D 1.00MEMORYSTICK.
[0030] 4D 47 03 01 00 20 20 20 MG......
Command: Sony 0xFB 0xB4 (unknown)
[0000] FB 00 B4 00 00 00 00 01 01 00 ..........
Response: 64 bytes
[0000] 00 00 04 01 01 FF FF FF FF FF FF FF FF FF FF FF ................
[0010] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
[0020] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
[0030] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
Command: Sony 0xFB 0xB5 (USB string 3)
[0000] FB 00 B5 00 00 00 00 00 01 00 ..........
Response: 128 bytes
[0000] 50 00 53 00 50 00 00 00 00 00 00 00 00 00 00 00 P.S.P...........
[0010] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[0020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[0030] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[0050] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[0060] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[0070] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Command: Sony 0xFC 0x90 (firmware revision)
[0000] FC 00 90 50 53 50 69 00 00 00 ...PSPi...
Response: 128 bytes
[0000] 32 2E 38 32 00 00 00 00 00 00 00 00 00 00 00 00 2.82............
[0010] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[0020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[0030] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[0050] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[0060] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[0070] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Command: Sony 0xFC 0x91 (nickname)
[0000] FC 00 91 50 53 50 69 00 00 00 ...PSPi...
Response: 128 bytes
[0000] 6A 69 6D 70 00 00 00 00 00 00 00 00 00 00 00 00 jimp............
[0010] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[0020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[0030] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[0050] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[0060] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[0070] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
The code is available at http://psp.jim.sh/pspi/. The README there also contains output from a 1.50 PSP. |
|
| Back to top |
|
 |
jockyw2001
Joined: 29 Sep 2005 Posts: 339
|
Posted: Wed Nov 08, 2006 10:39 pm Post subject: |
|
|
| Interesting. Who knows, maybe there exist other vendor-specific SCSI cmds to flash firmware .. |
|
| Back to top |
|
 |
TeamOverload

Joined: 20 Apr 2006 Posts: 41 Location: CT
|
Posted: Sun Nov 12, 2006 8:15 am Post subject: |
|
|
That's pretty awesome. Nice find :) _________________ [img]http://img115.imageshack.us/img115/1130/teamoverloadanimationsig7wp.gif[img] |
|
| Back to top |
|
 |
jockyw2001
Joined: 29 Sep 2005 Posts: 339
|
Posted: Mon Nov 13, 2006 3:33 am Post subject: |
|
|
| Jim, how did you find these scsi cmds? Could there be more, since vendor-specific cmds are in the range 0xc0-0xff ? |
|
| Back to top |
|
 |
jimparis
Joined: 10 Jun 2005 Posts: 1179 Location: Boston
|
Posted: Mon Nov 13, 2006 3:58 am Post subject: |
|
|
| I disassembled usbstorms.prx, I think from 2.71. Those were the only ones I saw in there. |
|
| Back to top |
|
 |
|