Some very significant NID’s

July 25th, 2008 silverspring

Here are 2 very important nids found:

  • 0x4F46EEDE sceSysregGetFuseId
  • 0x8F4F4E96 sceSysregGetFuseConfig

These 2 functions serve quite significant purposes.

And some other not so significant ones:

  • 0xBF91FBDA sceSysregMsifQueryConnectIntr
  • 0x36A75390 sceSysregMsifAcquireConnectIntr

Edit:

Due to some interest with regard to the above two functions I listed, here is some more info:

view plain
C:
  1. u64 sceSysregGetFuseId();
  2. u32 sceSysregGetFuseConfig();

These are hardcoded values located in the CPU IC – TACHYON (presumably on an OTP PROM on the die).

The FuseID is a completely unique 48-bit internal ID and as such is referenced quite a bit. Most notably being used as the seed for the idstorage encryption on slim PSP’s as well as the lflash encryption on 3.00+ firmwares. It is probably also widely used for other purposes as well since it is the only one true internal serial number.

The FuseConfig holds hardcoded configuration data for the TACHYON IC. For example, when the PSP is shutdown (or put to sleep) the config data is used to control the TACHYON voltages to power the devices off.

Posted in NID's | 4 Comments »

More NID’s

July 21st, 2008 silverspring

From sceCtrl_driver lib:

  • 0x5E77BC8A sceCtrlGetButtonIntercept
  • 0x7CA723DC sceCtrlSetButtonIntercept

These ctrl functions are already in pspsdk – under pspctrl_kernel.h (though with unknown names – labelled Get/Set Button Mask):

view plain
C:
  1. void sceCtrlSetButtonIntercept(unsigned int mask, unsigned type);
  2. int sceCtrlGetButtonIntercept(unsigned int mask);

From SysMemForKernel lib:

  • 0xA262FEF0 sceKernelGetAllowReplaceUmd
  • 0xCBB05241 sceKernelSetAllowReplaceUmd

From sceUSB_Stor_Ms_driver lib:

  • 0xABE9F2C7 sceUsbstorMsGetApInfo
  • 0x576E7F6F sceUsbstorMsSetProductInfo

Posted in NID's | No Comments »

New NAND Flash device support added

July 19th, 2008 silverspring

Support for new nand IC’s from ST Micro (upto 128MB) have been added to the nand driver in newer firmwares. Previously only Samsung (retail PSP) and Toshiba (devkit PSP) nands were supported.

view plain
C:
  1. const struct {
  2.     u8 id[2]; // [manufacturer ID, device ID]
  3.     u8 type[2];
  4.     u16 bytesPerPage;
  5.     u16 pagesPerBlock;
  6.     u32 blocksPerDevice;
  7.  
  8. } nandIdTable[] = {
  9.  
  10.     // Toshiba 3.3V NAND Flash family
  11.     { {0×98, 0xE6}, {3, 1}, 512, 16, 1024  }, // 8MB
  12.     { {0×98, 0×73}, {3, 1}, 512, 32, 1024  }, // 16MB
  13.     { {0×98, 0×75}, {3, 1}, 512, 32, 2048  }, // 32MB
  14.     { {0×98, 0×76}, {3, 1}, 512, 32, 4096  }, // 64MB
  15.     { {0×98, 0×79}, {3, 1}, 512, 32, 8192  }, // 128MB
  16.  
  17.     // Samsung 3.3V NAND Flash family
  18.     { {0xEC, 0xE6}, {3, 2}, 512, 16, 1024  }, // 8MB
  19.     { {0xEC, 0×73}, {3, 2}, 512, 32, 1024  }, // 16MB
  20.     { {0xEC, 0×75}, {3, 2}, 512, 32, 2048  }, // 32MB (default TA-079/081 PSP NAND)
  21.     { {0xEC, 0×76}, {3, 2}, 512, 32, 4096  }, // 64MB
  22.     { {0xEC, 0×79}, {3, 2}, 512, 32, 8192  }, // 128MB
  23.     { {0xEC, 0×71}, {3, 2}, 512, 32, 16384 }, // 256MB
  24.     { {0xEC, 0xDC}, {3, 2}, 512, 32, 32768 }, // 512MB
  25.  
  26.     // Samsung 1.8V NAND Flash family
  27.     { {0xEC, 0×39}, {1, 2}, 512, 16, 1024  }, // 8MB
  28.     { {0xEC, 0×33}, {1, 2}, 512, 32, 1024  }, // 16MB
  29.     { {0xEC, 0×35}, {1, 2}, 512, 32, 2048  }, // 32MB (default TA-082/086 PSP NAND)
  30.     { {0xEC, 0×36}, {1, 2}, 512, 32, 4096  }, // 64MB (default TA-085/088 PSP NAND)
  31.     { {0xEC, 0×78}, {1, 2}, 512, 32, 8192  }, // 128MB
  32.    
  33.     // ST Micro 1.8V NAND Flash family
  34.     { {0×20, 0×35}, {1, 2}, 512, 32, 2048  }, // 32MB
  35.     { {0×20, 0×36}, {1, 2}, 512, 32, 4096  }, // 64MB
  36.     { {0×20, 0×39}, {1, 2}, 512, 32, 8192  }, // 128MB
  37. };

Posted in Misc | No Comments »