The (New) PSP Tech Docs – Article01

This is just the first draft just to give you an idea of what these “tech docs” are going to be like. It’s on the PSP Boot Sequence.

And to quote before:

“It will be fairly technical but it is aimed at the general psp user and explained in a way that everyone can understand while at the same time trying to be as detailed as possible. Though I will assume that the reader has a general knowledge of terms like ‘Nand’, ‘IPL’, ‘Idstorage’, etc.

Hopefully, this will be useful for not only general users wanting to gain a better understanding of the PSP, but also devs looking for some detailed reference material.”

http://silverspring.lan.st/NPSPTD_01.txt

EDIT: First drafts of Articles 02 & 03 will be posted soon. Topic will be “2.60+ IPL Encryption” & “3.00+ Nand Encryption” respectively. Future articles I’m planning to write will include Idstorage Keys, the KIRK crypto engine, and that “other secret” crypto engine.

Posted in Tech Docs | 5 Comments »

The PSP Slim could’ve been a gamer’s dream handheld…

Cracked a few very interesting nids the other day. More proof that the HDD wasnt just a rumour.

• 0xc68f1573 sceSysconCtrlGSensor
• 0x3ab3aeef sceSysconReadGSensorReg
• 0x07a0c260 sceSysconWriteGSensorReg
• 0x72eda9af sceSysconGetGSensorVersion
• 0x58531e69 sceSysconSetGSensorCallback

The G-Sensor is already used on Sony’s Vaio laptop and also their HDD based Walkman’s. To quote Sony:

The innovative G-Sensor system automatically and instantly reacts to changes in gravity and velocity by releasing the recording head. This helps protect the hard disk surface, preventing crashes and loss of data, ultimately improving long term reliability.

These new nids along with the new HDD nids cracked just last week provides pretty conclusive proof that the PSP Slim does in fact natively support a HDD.

• 0x8b95c17f sceSysregAtahddIoEnable
• 0xccf911c0 sceSysregAtahddIoDisable
• 0xa23bc2c4 sceSysregAtahddResetEnable
• 0xf5ea8570 sceSysregAtahddResetDisable
• 0x8ce2f97a sceSysregAtahddClkSelect
• 0xb59db832 sceSysregAtahddClkEnable
• 0x9155812C sceSysregAtahddClkDisable
• 0xe45bed6a sceSysregAtahddBusClockEnable
• 0x681b35c4 sceSysregAtahddBusClockDisable
• 0xa975f224 sceSysconCtrlHddPower
• 0x051186F3 sceSysconGetHddPowerCtrl
• 0xF9FDAFA5 sceSysconGetHddPowerStatus
• 0x04EEFD03 sceSysconSetHddPowerCallback

This along with the (also missing) Bluetooth features (sceSysconCtrlBtPower etc.) could’ve made the PSP Slim a very attractive handheld indeed. What you are left with instead is a slightly ‘slimmer’, ‘lighter’ model with very ordinary additions (TV out, USB charge, UMD cache, larger flash space etc).

So why did Sony decide in the end to skimp on these features (Im sure there’s a few more features still hidden – there’s still about 20 more syscon nids that havent been cracked yet). Well the two main factors are a) battery life (the slim battery is already at a lower capacity than the fat) and b) cost (the slim was released at the same price as the current fat).

So even though these are dream features to have on a PSP (and in fact these features are still supported natively on a HW level – just need to connect the HDD and write the drivers for it) could you justify the sacrifice in battery life and increase in purchase price to have these features?

Posted in NID's | 6 Comments »

Finally…

0xb4560c45 sceSysregPllGetOutSelect
0xdca57573 sceSysregPllSetOutSelect

I’ve been trying to crack these 2 nids for awhile. These are used to get/set the PLL index that multiplies with the base frequency to change the PLL freq (to change cpu & bus freq). The index is as follows:

Although the index is from 0-15, sceSysregPllSetOutSelect limits it to 0-5 only. The default is 3 (ie. 0.666666…). So default PLL freq is (multiplier*BASE_FREQ) * pll_table[index] = 9*37 * 0.66666 = 222MHz. To set to 333MHz just call sceSysregPllSetOutSelect(5) (which will also make the cpu freq 333MHz).

EDIT: For completeness, here’s what I had originally written about it: http://lan.st/showthread.php?t=854

Posted in NID's | No Comments »

The (New) PSP Technical Docs

Because there is a general lack of detailed PSP System documentation available (YAPSPD is excellent and is the definitve PSP HW docs http://hitmen.c02.at/files/yapspd/psp_doc/frames.html, but unfortunately is no longer updated), I’ll be writing up some technical articles for the general public. Topics will vary but will generally be detailed low level information that isnt publically available anywhere else.

It will be fairly technical but it is aimed at the general psp user and explained in a way that everyone can understand while at the same time trying to be as detailed as possible. Though I will assume that the reader has a general knowledge of terms like ‘Nand’, ‘IPL’, ‘Idstorage’, etc.

Hopefully, this will be useful for not only general users wanting to gain a better understanding of the PSP, but also devs looking for some detailed reference material.

Posted in Tech Docs | 1 Comment »

Idstorage Keys (0×0004-0×0008) – Generating hash

The idstorage area stores low level info on the PSP. Keys 4-8 are used for config data for various components (the battery, clock generator, LCD, etc.) and are in a different format to all the other keys.

Here is the code to generate the hash for these particular keys:

Note: this is a PC app (though you could run it on the PSP as well if you wanted).

Posted in Code Snippets | No Comments »