PSPx форум

PSPx форум (https://www.pspx.ru/forum/index.php)
-   PSP хакинг и девелопмент (https://www.pspx.ru/forum/forumdisplay.php?f=195)
-   -   Pandora (unbricker/downgrader) для PSP-200X TA-088v3 (https://www.pspx.ru/forum/showthread.php?t=92433)

lenovo3000 09.08.2011 22:22

Compared the read sectors from both cards (Kingston_4GB and Patriot_4GB) using the same adapter. You can see the difference in a few places. However, the MSID is the same. This sequence is found in the read out EEPROM.
http://i51.tinypic.com/214e41z.png
http://i53.tinypic.com/kbyhd5.png

But I just want to modify the few sectors I need in the dump eeprom. To do this, you should read all dump, modify and re-upload eeprom. Best in full at one time to avoid any mistakes.

Yoti 10.08.2011 00:47

lenovo3000,
before upload it back you must change msid. But i don't found it in dump. May be you be lucky than me =)

Stop! I looked into EEPROM dump, not controller one. I don't have any adapter's controller dumps. So, adapter's EEPROM has no MSID in it. We must dump controller's firmware.

lenovo3000 10.08.2011 10:03

MSID that is sitting in the same controller? It's a shame. :dash: And it is glad that something will come of it ..... :cray: And do you have measured the frequency of MCLK can a memory card? And, so back to my original concept of the acquisition of the data packet and its substitution in the proper place.

https://www.oss-formats.org/en/memor...licensee_e.pdf
Some information to read and write cards that are noticed in the SDK for PSP.

Gregorio 10.08.2011 16:31

lenovo3000, It is interesting to change msid in the controler of original MS PRO DUO. The rest does not make sense.

а если по русски, то твоя идея крайне сложно реализуется.. идея уже приходила в голову такая, но проще залить msid в нанд китайской карты. надо искать более красивое решение. это моё мнение, я могу и ошибаться.

lenovo3000 10.08.2011 20:05

sorry for the translation by google .
I mean that in my situation, buying a separate card with NAND is bordered on the miraculous.Capture adapter will execute faster data packet with MSID.Even if it seems irrational.For me, finding a way to change the MSID in the chip card controller, seems rather unlikely.This data is subject to some production contracts. As well as descr1ptions of the displays to version 200x and 300x (but i have both descr1ptions).
For me, as the person programming the AVR, and more recently learning ARM7 programming, execution of an adapter according to my idea does not appear from space.But if I learned from you how often talks (frequency -MCLK) of the PSP memory card that would be great. I do not have an oscilloscope, so I would not ask for that information.

frostegater 10.08.2011 21:33

lenovo3000, please write in English..

lenovo3000 12.08.2011 19:29

Memory Stick can work with these frequencies:
MCLK = 1.5 6 15 20 30 40 MHZ .Does anyone have an oscilloscope to see how it is actually?Please.With what frequency supports the PSP memory card?
1.5 6 MHz - AVR but 15 -30 MHz only for ARM7 .I do not think that the higher frequency was used.
Anyway...
Program Write_IPL_TO_MS write the contents (IPL) to a certain sector in NAND.It can read and save sector to a file to disk in the computer?
I think I can do this "MSID changers" on AVR/ARM7
sooner than we will know how the adapter can change the MSID in the controller's memory card.
Card Mode (of MCLK) is certainly hidden in the first reading of the card. The so-called initiating sequence.

Yoti 13.08.2011 16:02

Цитата:

Сообщение от lenovo3000 (Сообщение 975467)
Program Write_IPL_TO_MS write the contents (IPL) to a certain sector in NAND.It can read and save sector to a file to disk in the computer?

MSID_Dumper (w/ some modifications), IPL Dumper may read the IPL.

lenovo3000 13.08.2011 18:06

Цитата:

Сообщение от Yoti (Сообщение 975574)
MSID_Dumper (w/ some modifications), IPL Dumper may read the IPL.

But , program in the directory
" Write_IPL_TO_MS " ,
it can read from card sector and save to a file to disk in PC?

Gregorio 13.08.2011 23:46

Цитата:

Сообщение от lenovo3000 (Сообщение 975584)
But , program in the directory
" Write_IPL_TO_MS " ,
it can read from card sector and save to a file to disk in PC?

Yes, you can read and save card sector to a file to disk in pc. but only available to the sector. sector card for msid you not read and can not record

Yoti 14.08.2011 10:08

gregorio,
разве эта хренотень ещё и читать умеет?

lenovo3000 14.08.2011 12:25

Цитата:

Сообщение от Yoti (Сообщение 975663)
gregorio,
разве эта хренотень ещё и читать умеет?

Why do I get the impression that what I did not write it, and it does not understand? :dash:

Record attr0.bin sectors in the file is nothing but a response for a
sequence of initiating a memory card?
And Serial Number not present in NAND , right ? Is present in firmware controler of MemoryStick? :unknw:
Is he important?
Just need to replace an offset without changing the card serial number?
Is if possible to read the IPL of the PSP 300x (ta-090) is similar it will be useful to unbrick the console in this series?
I find something...
See :
Код:

#ifndef MSPRO_DEF_H
#define MSPRO_DEF_H

//#define MSP_TEST
#define MSP_USE_PARALLEL_MODE

typedef kal_uint32                                        MSP_STATUS;

//registers address definition
#define MSC_CFG                (MSDC_ADRS+0x60)
#define MSC_CMD        (MSDC_ADRS+0x64)
#define MSC_ACMD        (MSDC_ADRS+0x68)
#define MSC_STA        (MSDC_ADRS+0x6c)

// masks for MSC_CFG(16)
#define MSC_CFG_SIEN                        0x0001
#define MSC_CFG_BUSYCNT                0x000e
#define MSC_CFG_PRED                        0x4000
#define MSC_CFG_PMODE                0x8000

//masks for MSC_CMD
#define MSC_CMD_DATASIZE        0x03ff
#define MSC_CMD_PID                        0xf000

//masks for MSC_ACMD
#define MSC_ACMD_ACEN                0x0001
#define MSC_ADATASIZE                0x07ff
#define MSC_APID                                0xf000

// masks for MSC_STA
#define MSC_STA_RDY                        0x0001
#define MSC_STA_SIF                        0x0002
#define MSC_STA_TOER                        0x0004
#define MSC_STA_CRCERR                0x0008
#define MSC_STA_HSRDY                0x0010
#define MSC_STA_CED                        0x1000
#define MSC_STA_ERR                        0x2000
#define MSC_STA_BREQ                        0x4000
#define MSC_STA_CMDNK                0x8000

// TPC CMDs
#define TPC_READ_LONG_DATA                0x2
#define TPC_READ_SHORT_DATA                0x3
#define TPC_READ_REG                    0x4
#define TPC_GET_INT                    0x7
#define TPC_WRITE_LONG_DATA                0xd
#define TPC_WRITE_SHORT_DATA            0xc
#define TPC_WRITE_REG                  0xb
#define TPC_SET_R_W_REG_ADRS            0x8
#define TPC_SET_CMD                    0xe
#define TPC_EX_SET_CMD                                0x9

// CMDs for SET_CMD
//    Memory Access CMD                 
#define CMD_READ_DATA                                0x20
#define CMD_WRITE_DATA                                0x21
#define CMD_READ_INFO                                0x22
#define CMD_WRITE_INFO                                0x23
#define CMD_READ_ATRB                                0x24
#define CMD_STOP                                                0x25
#define CMD_ERASE                                                0x26
#define CMD_CHG_CLASS                                0x27

//  Function CMD             
#define CMD_FORMAT                                        0x10
#define CMD_SLEEP                                                0x11


// MS registers address
// status registers
#define MSP_INT_REG                        0x01
#define MSP_STA_REG                        0x02
#define MSP_TYPE_REG                        0x04
#define MSP_CATEGORY_REG        0x06
#define MSP_CLASS_REG                0x07
// parameter registers
#define MSP_SYS_REG                        0x10
#define MSP_DATCNT1_REG                0x11
#define MSP_DATCNT0_REG                0x12
#define MSP_ADRS3_REG                0x13
#define MSP_ADRS2_REG                0x14
#define MSP_ADRS1_REG                0x15
#define MSP_ADRS0_REG                0x16
#define MSP_TPCPARA_REG                0x17
#define MSP_CMDPARA_REG                0x18

// masks for register
// mask for INT
#define INT_CMDNK                        0x01
#define INT_BREQ                        0x20
#define INT_ERR                                0x40
#define INT_CED                                0x80
// mask for status register
#define STA_WP                        0x01
#define STA_SL                        0x02
#define STA_PRS0                0x10
#define STA_PRS1                0x20
#define STA_PRS2                0x40
#define STA_PRS3                0x80

#define MSP_TYPE_REG_DEFAULT                0x01
#define MSP_CTGY_REG_DEFAULT                0x00
#define MSP_CLASS_REG_DEFAULT                0x00

// mask for system parameter
#define SYS_SRAC                                                0x80        // for serial or parallel

// CMD parameter
#define CMD_AC_SECTOR        0x00
#define CMD_AC_FILE                0x01

// definition of the constants
#define MSP_LONGDATA_SIZE                                512

#define MSP_INT_TIMEOUT                                        120        // x10ms

// macros
#define MS_IS_TIMEOUT        (*(volatile kal_uint16*)MSC_STA & MSC_STA_TOER)
#define MS_IS_CMDRDY                (*(volatile kal_uint16*)MSC_STA & MSC_STA_RDY)
#define MS_IS_INT                        (*(volatile kal_uint16*)MSC_STA & MSC_STA_SIF)
#define MS_IS_CRCERR                (*(volatile kal_uint16*)MSC_STA & MSC_STA_CRCERR)
#define MSDC_IS_SIF                (*(volatile kal_uint16*)MSDC_INTR & MSDC_INT_MSIFIRQ)
#define IS_IN_PACKET(tpc)                !(tpc & 0x80)
/* Get low byte value from word value */
#define LOBYTE(w)              ((unsigned char)(w))

/* Get high byte value from word value */
#define HIBYTE(w)              ((unsigned char)(((unsigned short)(w) >> 8) & 0xFF))

// error definition
#define MSP_NOERROR                                0
#define MSP_ERR_TIMEOUT                        1                // CMD busy time out(not INT timeout)
#define MSP_ERR_CRCERR                        2                // DATA crc error
#define MSP_ERR_CMDFAIL                        3                // CMD not accept
#define MSP_ERR_EXECUTE                        4                // During CMD execution
#define MSP_ERRORS                                5                // Unknown error
#define MSP_ERR_UC                                6                // Uncorrectable errors
#define MSP_ERR_INT                                7                // Int register err bit set
#define MSP_ERR_STABUSY                        8                // media busy or flash busy
#define MSP_ERR_WRITEFAIL                9
#define MSP_ERR_ERASEFAIL                10       
#define MSP_ERR_WP                                11                // write protect error
#define MSP_ERR_WAIT                                12                // wait uintil ready, timeout and crc fail
#define MSP_ERR_READBOOTBLK        13
#define MSP_ERR_LPTABLE                        14
#define MSP_ERR_INTERR                        15                // INT register which err bit is set
#define MSP_ERR_INIT                                16                // initail MS Pro failed
#define MSP_ERR_INVALIDPAR                17                // invalid data count or invalid start address
#define MSP_ERR_NOT_MSP                        18                // not memory stick pro card
#define MSP_ERR_SIG                                19
#define MSP_ERR_WRITE_PROTECT        20
#define MSP_ERR_NOBREQ                        21                // No BREQ after READ_DATA or WRITE_DATA set cmd.
#define MSP_ERR_SWITCH_MODE        22                // Select parallel or serial mode fail
#define MSP_ERR_SI_CONFIM                23                // system confirm fail
#define MSP_ERR_FAT                                24


#define MSP_LASTPAGE                                50                // reach the last page
#define MSP_POWER_ON()                \
{\
        MSDC_SET_BIT32(MSDC_CFG,MSDC_CFG_VDDPD);\
        if(kal_query_systemInit()==KAL_TRUE)\
                GPTI_BusyWait(50);\
        else\
                kal_sleep_task(11);\
}

#define MSP_POWER_OFF()                \
{\
        MSDC_CLR_BIT32(MSDC_CFG,MSDC_CFG_VDDPD);\
        if(kal_query_systemInit()==KAL_TRUE)\
                GPTI_BusyWait(500);\
        else\
                kal_sleep_task(110);\
}       


typedef enum {
        TYPE_MS_CARD = 0,               
        TYPE_MSPRO_CARD       
}ms_type_enum;

typedef enum {
        DIRECTION_IN = 0,               
        DIRECTION_OUT               
}ms_direction_enum;

typedef enum {
        MSP_READ = 0,               
        MSP_WRITE=1               
}msp_direction_enum;
typedef enum {
        MSP_PARALLEL = 0x00,               
        MSP_SERIAL                = 0x80
}msp_mode_enum;

typedef enum {
        MSP_QUICK = 0x00,               
        MSP_FULL                = 0x01
}msp_format_enum;

typedef enum {
        SHORT_DATA_24 = 0,               
        SHORT_DATA_56                ,                       
        SHORT_DATA_120        ,                       
        SHORT_DATA_248                       
}ms_ShortData_enum;

typedef enum {
        SYS_INFO_ID                = 0x10,
        MODEL_NAME_ID        = 0x15,
        MBR_VALUE_ID        = 0x20,
        PBR_16_ID                = 0x21,
        PBR_32_ID                = 0x22,
        FILE_VALUE1_ID = 0x25,
        FILE_VALUE2_ID = 0x26,
        ID_DEVICE_ID  = 0x30,       
        VENDER1_ID          = 0x11,               
        VENDER2_ID          = 0x12       
}mspro_DIEntry_ID_enum;

typedef enum {
        SYS_INFO_COUNT                = 96,
        MODEL_NAME_COUNT        = 48,
        MBR_VALUE_COUNT        = 16,
        PBR_16_COUNT                = 64,
        PBR_32_COUNT                = 96,
        FILE_VALUE1_COUNT = 32,
        FILE_VALUE2_COUNT = 32,
        ID_DEVICE_COUNT  = 16       
}mspro_DIEntry_Count_enum;

typedef struct{
        mspro_DIEntry_ID_enum id;
        mspro_DIEntry_Count_enum count;
        kal_uint32 adrs;
}mspro_di_confirm_count_struct;
               

typedef struct{
        kal_uint32        adrs;
        kal_uint32        size;
        kal_uint8        id;
        kal_uint8  rev[3];
}msp_DIEntry_struct;

typedef struct{       
        kal_uint8        mType;                                // Is MS card or MS PRO
        kal_uint8        mCategory;                        // category register
        kal_uint8        mClass;                                // class register
        kal_uint8          is_wp;                                // write protect?
        kal_bool                is_failed;                        // errors happpend during parallel mode
        kal_uint8        mSIClass;                        // Memory Stick class of system information
        kal_uint8        mSIDevType;                        // Memory Stick device type of system information
        kal_uint8        mSISubClass;                // Memory Stick sub-Class of system information
       
        // attribute information
        kal_uint16        signature;                        // 0xA5C3
        kal_uint16        version;                                //0x10xx
        kal_uint8        di_count;                        // device information entry count 1~12
  // device information
        kal_uint16  block_size;      // unit: sector => cluster
        kal_uint16  total_block        ;    // unit: block
        kal_uint16  user_block;      // unit: block
        kal_uint16  page_size;        // unit: sector
        kal_uint16  unit_size;        // unit: bytes => 512

        msp_mode_enum        mode;
}MSP_HANDLE;

typedef void (* MSP_CallBack)(void);

MSP_STATUS MSP_CMD_ReadWriteData(kal_uint32 adrs, kal_uint16 count, kal_uint32* buffer, kal_uint16* sectors,msp_direction_enum IsWrite);
MSP_STATUS MSP_CMD_ReadWriteInfo(kal_uint32 adrs, kal_uint16 count, kal_uint32* buffer, kal_uint16* bytes,kal_uint8 IsWrite);
MSP_STATUS MSP_CMD_Erase(kal_uint32 adrs, kal_uint16 count,MSP_CallBack callback);
MSP_STATUS MSP_CMD_Format(msp_format_enum type, MSP_CallBack callback);
MSP_STATUS MSP_CMD_Stop(void);
MSP_STATUS MSP_CMD_Sleep(void);
MSP_STATUS MSP_CMD_ReadAtrb(kal_uint32 adrs, kal_uint16 count, kal_uint32* buffer, kal_uint16* sectors);
MSP_STATUS MSP_Initialize(void);
MSP_STATUS MSP_WaitCmdRdyOrTo(void);
void MSP_Test(void);

extern MSP_HANDLE        gMSP;
extern FS_Driver FS_MspDrvAll;
extern FS_Driver FS_MsDrv;
extern FS_Driver FS_MspDrv;

#endif // end of MSPRO_DEF_H

From http://mobile-phone-mtk-project.goog...I/drv/include/

Gregorio 14.08.2011 14:51

Yoti, я не про эту хренотень) я вообще про доступный софт для чтения/записи ipl

Yoti 14.08.2011 23:19

lenovo3000,
what IPL you means? There are: nand ipl, ms ipl. You may dump your nand (or only nand ipl) or ms ipl via homebrew.

newborndark 15.08.2011 08:34

Anyone can explain what does this line actually do on PRX's at offset 000000D0?

Leaked from Sony - SCE-1783 for_CS

Files attached - SCE-5281 for_CS

Yoti 15.08.2011 14:31

Some kind of build number.

newborndark 15.08.2011 19:42

what does it mean? just being curious, does it have something to do with like code from MS or something like that that uses from MS to prx to be able to boot those encrypted prx files and boot from jig?

Yoti 15.08.2011 20:03

newborndark,
just a build number. Greater number = newer card. May be it used while decode but it's not important.

ventola 17.08.2011 15:53

подскажите этот Hynix HY27UV08BG5M 4gb подойдет под тритон+?

Yoti 17.08.2011 15:56

ventola,
воруй@убивайпаяй@проверяй


Текущее время: 06:49. Часовой пояс GMT +3.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2025, vBulletin Solutions, Inc. Перевод: zCarot
PSPx Forum - Сообщество фанатов игровых консолей.