- Joined
- Jul 12, 2019
- Messages
- 192
T10k has telnet installed, you just need to create a non root user, t15k is locked down, only telnet client is installed
-
Welcome Back Guest,
There's currently a few rebranding bugs, one being emails aren't working, we're aware of this and will work on this as we have time. If you need a password reset, please contact us on Discord links in the navbar.
PS2 Sony PS2 Tool DTL-T15000 Drive Images and Investigation
- Thread starter hermesconrad
- Start date
you have t10000-rel280.bin from ps2sdk 2.8, didn't touch that before, thanks for sharing
also WS rom is different from WS rom from T10k: PS20100TD20000117-rd351.pa.bin
I will try to create command set for showing all hardware revisions.
- Joined
- Jul 30, 2019
- Messages
- 501
Thanks.
To all. The above code should be run from any service account (like "ez", "pz", "z", etc) from the devkit terminal.
This should show all hardware revisions on the screen.
Bash:
cd /usr/local/sony/diag/
chkrev/showrev.sh
romrev.sh
mpubid.sh
eerev
gsrev
ioprev.sh
spu2rev.sh
pcicrev.sh
macaddr.sh- Joined
- Jul 30, 2019
- Messages
- 501
Ok, thanks. Will this work through telnet?
You need root permissions for doing this. In fact, I don't know, maybe you can run
su before for entering the admin session. I also not completely sure if the PATH will be correct, I guess that chkrev/showrev.sh will setup PATH for you. Just try and tell.
- Joined
- Jul 30, 2019
- Messages
- 501
Do I need to directly connect to the tool to get admin access. I dont think i can do it over telnet.
- Joined
- Jul 30, 2019
- Messages
- 501
can i run the user command through telnet or do i need to be directly connected to the tool?
- Joined
- Jul 30, 2019
- Messages
- 501
Your command says there are too many argumemts.
This command is more for setting PATH correctly it can fail.
You can run the rest of commands after that.
Code:
romrev.sh
mpubid.sh
eerev
gsrev
ioprev.sh
spu2rev.sh
pcicrev.sh
macaddr.sh- Joined
- Jul 30, 2019
- Messages
- 501
Do I just type it in like that or do i need to put show rev before hand
it is better to run chkrev/showrev.sh before doing these commands. This command also sets up all environment variables.
- Joined
- Jul 30, 2019
- Messages
- 501
- Joined
- Jul 30, 2019
- Messages
- 501
i tried doing just cd chkrev/showrev.sh and it still gave me an error with arguments.
- Joined
- Jul 30, 2019
- Messages
- 501
Ok so do cd showrev/ for every other command
- Joined
- Jun 7, 2019
- Messages
- 11
Thanks to AKuHAK, and a program I made to combine the file's fragments, I was able to extract FPGA0526_master_pfm.exo from partition 6 (0,1...,5<-) of the SBC HDD from the first post.
Then it turned-out that R-Studio can extract it too, but I didn't think of checking that before writing the program (so now the prog is useless).
FPGA0526_master_pfm.exo Contains the logic configurations of the 4 Performance Analyzer Xilinx XC2V1000 FPGAs. The file is basically a Motorola SREC file.
The data looks uncompressed and not encrypted. And there is a lot of info about reversing Xilinx bitsteams, so in theory it should be possible it to be reversed back to logic/netlist. Although what it does and can do is quite clear from the manuals of the Performance Analyzer.
On the HDD there is a program to write this image to the FPGAs(or external memory that stores the logic config). AFAIK the connection is done through the SBC's parallel port.
The FPGA on the Backplane seems separate and is not stored in this file.
FPGA0526_master_pfm
MediaFire is a simple to use free service that lets you put all your photos, documents, music, and video in a single place so you can access them anywhere and share them everywhere.
www.mediafire.com
Then it turned-out that R-Studio can extract it too, but I didn't think of checking that before writing the program (so now the prog is useless).
FPGA0526_master_pfm.exo Contains the logic configurations of the 4 Performance Analyzer Xilinx XC2V1000 FPGAs. The file is basically a Motorola SREC file.
The data looks uncompressed and not encrypted. And there is a lot of info about reversing Xilinx bitsteams, so in theory it should be possible it to be reversed back to logic/netlist. Although what it does and can do is quite clear from the manuals of the Performance Analyzer.
On the HDD there is a program to write this image to the FPGAs(or external memory that stores the logic config). AFAIK the connection is done through the SBC's parallel port.
The FPGA on the Backplane seems separate and is not stored in this file.
- Joined
- Jul 12, 2019
- Messages
- 192
Super impressive wisi, did you find the bitstream for thr backplane fpga as well? If not it might be possible to manually extract it from flash, it's been a while since I've played in the fpga space but from my understanding they are effectively bootstrapped from flash on startup,coupd be wrong though it's been a long timeThanks to AKuHAK, and a program I made to combine the file's fragments, I was able to extract FPGA0526_master_pfm.exo from partition 6 (0,1...,5<-) of the SBC HDD from the first post.
FPGA0526_master_pfm
MediaFire is a simple to use free service that lets you put all your photos, documents, music, and video in a single place so you can access them anywhere and share them everywhere.www.mediafire.com
Then it turned-out that R-Studio can extract it too, but I didn't think of checking that before writing the program (so now the prog is useless).
FPGA0526_master_pfm.exo Contains the logic configurations of the 4 Performance Analyzer Xilinx XC2V1000 FPGAs. The file is basically a Motorola SREC file.
The data looks uncompressed and not encrypted. And there is a lot of info about reversing Xilinx bitsteams, so in theory it should be possible it to be reversed back to logic/netlist. Although what it does and can do is quite clear from the manuals of the Performance Analyzer.
On the HDD there is a program to write this image to the FPGAs(or external memory that stores the logic config). AFAIK the connection is done through the SBC's parallel port.
The FPGA on the Backplane seems separate and is not stored in this file.
- Joined
- Jun 7, 2019
- Messages
- 11
No. I have no idea if the backplane FPGA ever got updated (never seen other FPGA bitstreams on the TOOL HDDs.
Yes, AFAIK, most FPGA's load it from an external serial EEPROM/Flash.
But you will need a programmer to read it. And there is no knowing if it will be compressed or encrypted.
That one might actually be more interesting, as I have speculations that the backplane has extended monitoring/diagnostic capabilities.
There is also the SAM device, for which some TOOLs have a driver on the HDD, but nobody really knows what it does.
Back when I showed interest in pictures of the PCBs, that was mainly because of the MIF board with the SPEED chip: The NetHDD of PA TOOLs seems to be encrypted. I have a speculation that even a normal SPEED chip can do on-the-fly encryption, if configured somehow, but I have no idea how. The PSX DVR has a similar feature, but it uses a later, extended version of the SPEED chip (includes a Flash interface and a command interface that connects the IOP to the DVRP).
So if we have pictures from the MIF board, we could at least see what chips are used, and if the old SPEED chip is used, or some extended version of it and if there is an additional chip doing the encryption.
Yes, AFAIK, most FPGA's load it from an external serial EEPROM/Flash.
But you will need a programmer to read it. And there is no knowing if it will be compressed or encrypted.
That one might actually be more interesting, as I have speculations that the backplane has extended monitoring/diagnostic capabilities.
There is also the SAM device, for which some TOOLs have a driver on the HDD, but nobody really knows what it does.
Back when I showed interest in pictures of the PCBs, that was mainly because of the MIF board with the SPEED chip: The NetHDD of PA TOOLs seems to be encrypted. I have a speculation that even a normal SPEED chip can do on-the-fly encryption, if configured somehow, but I have no idea how. The PSX DVR has a similar feature, but it uses a later, extended version of the SPEED chip (includes a Flash interface and a command interface that connects the IOP to the DVRP).
So if we have pictures from the MIF board, we could at least see what chips are used, and if the old SPEED chip is used, or some extended version of it and if there is an additional chip doing the encryption.