PS2 Sony PS2 Tool DTL-T15000 Drive Images and Investigation

[hermesconrad]

I know that it is possible to somehow connect to devkit telnet session, but I don't know details.
These commands set are much better to be run from dsnet toolset from your PC. If you already flashed t10000-300.bin, previous flash content was erased.

T10k has telnet installed, you just need to create a non root user, t15k is locked down, only telnet client is installed

 

[AKuHAK]

i dumped the flash, copied the files to mega under the flash_dumps folder

you have t10000-rel280.bin from ps2sdk 2.8, didn't touch that before, thanks for sharing
also WS rom is different from WS rom from T10k: PS20100TD20000117-rd351.pa.bin

whats the command to show the current flash version?

I will try to create command set for showing all hardware revisions.

 

[slycooper124]

Thanks.

 

[AKuHAK]

To all. The above code should be run from any service account (like "ez", "pz", "z", etc) from the devkit terminal.

cd /usr/local/sony/diag/
chkrev/showrev.sh
romrev.sh
mpubid.sh
eerev
gsrev
ioprev.sh
spu2rev.sh
pcicrev.sh
macaddr.sh

This should show all hardware revisions on the screen.

 

[slycooper124]

Ok, thanks. Will this work through telnet?

 

[AKuHAK]

You need root permissions for doing this. In fact, I don't know, maybe you can run su before for entering the admin session. I also not completely sure if the PATH will be correct, I guess that chkrev/showrev.sh will setup PATH for you. Just try and tell.

 

[HI_RICKY]

just z login , than Ctrl C , you will get admin there

 

[slycooper124]

Do I need to directly connect to the tool to get admin access. I dont think i can do it over telnet.

 

[slycooper124]

can i run the user command through telnet or do i need to be directly connected to the tool?

 

[slycooper124]

Your command says there are too many argumemts.

 

[AKuHAK]

Your command says there are too many argumemts.

This command is more for setting PATH correctly it can fail.
You can run the rest of commands after that.

romrev.sh
mpubid.sh
eerev
gsrev
ioprev.sh
spu2rev.sh
pcicrev.sh
macaddr.sh

 

[slycooper124]

Do I just type it in like that or do i need to put show rev before hand

 

[AKuHAK]

Do I just type it in like that or do i need to put show rev before hand

it is better to run chkrev/showrev.sh before doing these commands. This command also sets up all environment variables.

 

[slycooper124]

Ok I did that and it said that there was too many arguments. I'll try again tonight

 

[slycooper124]

i tried doing just cd chkrev/showrev.sh and it still gave me an error with arguments.

 

[AKuHAK]

Just ignore the error and continue entering commands.

 

[slycooper124]

Ok so do cd showrev/ for every other command

 

[wisi]

Thanks to AKuHAK, and a program I made to combine the file's fragments, I was able to extract FPGA0526_master_pfm.exo from partition 6 (0,1...,5<-) of the SBC HDD from the first post.

FPGA0526_master_pfm

MediaFire is a simple to use free service that lets you put all your photos, documents, music, and video in a single place so you can access them anywhere and share them everywhere.

www.mediafire.com

Then it turned-out that R-Studio can extract it too, but I didn't think of checking that before writing the program (so now the prog is useless).

FPGA0526_master_pfm.exo Contains the logic configurations of the 4 Performance Analyzer Xilinx XC2V1000 FPGAs. The file is basically a Motorola SREC file.
The data looks uncompressed and not encrypted. And there is a lot of info about reversing Xilinx bitsteams, so in theory it should be possible it to be reversed back to logic/netlist. Although what it does and can do is quite clear from the manuals of the Performance Analyzer.
On the HDD there is a program to write this image to the FPGAs(or external memory that stores the logic config). AFAIK the connection is done through the SBC's parallel port.

The FPGA on the Backplane seems separate and is not stored in this file.

 

[hermesconrad]

Thanks to AKuHAK, and a program I made to combine the file's fragments, I was able to extract FPGA0526_master_pfm.exo from partition 6 (0,1...,5<-) of the SBC HDD from the first post.

FPGA0526_master_pfm

MediaFire is a simple to use free service that lets you put all your photos, documents, music, and video in a single place so you can access them anywhere and share them everywhere.

www.mediafire.com

Then it turned-out that R-Studio can extract it too, but I didn't think of checking that before writing the program (so now the prog is useless).

FPGA0526_master_pfm.exo Contains the logic configurations of the 4 Performance Analyzer Xilinx XC2V1000 FPGAs. The file is basically a Motorola SREC file.
The data looks uncompressed and not encrypted. And there is a lot of info about reversing Xilinx bitsteams, so in theory it should be possible it to be reversed back to logic/netlist. Although what it does and can do is quite clear from the manuals of the Performance Analyzer.
On the HDD there is a program to write this image to the FPGAs(or external memory that stores the logic config). AFAIK the connection is done through the SBC's parallel port.

The FPGA on the Backplane seems separate and is not stored in this file.

Super impressive wisi, did you find the bitstream for thr backplane fpga as well? If not it might be possible to manually extract it from flash, it's been a while since I've played in the fpga space but from my understanding they are effectively bootstrapped from flash on startup,coupd be wrong though it's been a long time

 

[wisi]

No. I have no idea if the backplane FPGA ever got updated (never seen other FPGA bitstreams on the TOOL HDDs.
Yes, AFAIK, most FPGA's load it from an external serial EEPROM/Flash.
But you will need a programmer to read it. And there is no knowing if it will be compressed or encrypted.
That one might actually be more interesting, as I have speculations that the backplane has extended monitoring/diagnostic capabilities.

There is also the SAM device, for which some TOOLs have a driver on the HDD, but nobody really knows what it does.

Back when I showed interest in pictures of the PCBs, that was mainly because of the MIF board with the SPEED chip: The NetHDD of PA TOOLs seems to be encrypted. I have a speculation that even a normal SPEED chip can do on-the-fly encryption, if configured somehow, but I have no idea how. The PSX DVR has a similar feature, but it uses a later, extended version of the SPEED chip (includes a Flash interface and a command interface that connects the IOP to the DVRP).
So if we have pictures from the MIF board, we could at least see what chips are used, and if the old SPEED chip is used, or some extended version of it and if there is an additional chip doing the encryption.