PS2 Sony PS2 Tool DTL-T15000 Drive Images and Investigation

[slycooper124]

Just ignore the error and continue entering commands.

Here are my findings. From your commands.

 

[hermesconrad]

No. I have no idea if the backplane FPGA ever got updated (never seen other FPGA bitstreams on the TOOL HDDs.
Yes, AFAIK, most FPGA's load it from an external serial EEPROM/Flash.
But you will need a programmer to read it. And there is no knowing if it will be compressed or encrypted.
That one might actually be more interesting, as I have speculations that the backplane has extended monitoring/diagnostic capabilities.

There is also the SAM device, for which some TOOLs have a driver on the HDD, but nobody really knows what it does.

Back when I showed interest in pictures of the PCBs, that was mainly because of the MIF board with the SPEED chip: The NetHDD of PA TOOLs seems to be encrypted. I have a speculation that even a normal SPEED chip can do on-the-fly encryption, if configured somehow, but I have no idea how. The PSX DVR has a similar feature, but it uses a later, extended version of the SPEED chip (includes a Flash interface and a command interface that connects the IOP to the DVRP).
So if we have pictures from the MIF board, we could at least see what chips are used, and if the old SPEED chip is used, or some extended version of it and if there is an additional chip doing the encryption.

OK sure, makes sense why you would want photos, I'll need to find time to pull it apart fully but when I do I'll get proper scans of both sides of the pcbs. Yeh I noticed the Sam driver havnt had a chance to investigate it. I havnt seen it on my other tools.

I won't be able to touch the 15k till the weekend. Have you got any public wikis or documentation about the pa itself I can have a look at?

 

[hermesconrad]

Here are my findings. From your commands.

It's complaining that it can't find those files, either they don't exist on your drive or the path your executing from is wrong, ls the directory and see if you can find those files

 

[AKuHAK]

Here are my findings. From your commands.

I see, you are logged under "root", all commands can fail cause of that. It seems that first command fail too. Can you login as "z" before? I will try to adopt commands for root account.

 

[slycooper124]

I see, you are logged under "root", all commands can fail cause of that. It seems that first command fail too. Can you login as "z" before? I will try to adopt commands for root account.

That is the weird thing when I log into the z account thats what comes up. So if the root account is the name then I dont know where to go.

 

[slycooper124]

so am I doing something wrong?

 

[AKuHAK]

Thanks to AKuHAK, and a program I made to combine the file's fragments, I was able to extract FPGA0526_master_pfm.exo from partition 6 (0,1...,5<-) of the SBC HDD from the first post.

FPGA0526_master_pfm

MediaFire is a simple to use free service that lets you put all your photos, documents, music, and video in a single place so you can access them anywhere and share them everywhere.

www.mediafire.com

Then it turned-out that R-Studio can extract it too, but I didn't think of checking that before writing the program (so now the prog is useless).

FPGA0526_master_pfm.exo Contains the logic configurations of the 4 Performance Analyzer Xilinx XC2V1000 FPGAs. The file is basically a Motorola SREC file.
The data looks uncompressed and not encrypted. And there is a lot of info about reversing Xilinx bitsteams, so in theory it should be possible it to be reversed back to logic/netlist. Although what it does and can do is quite clear from the manuals of the Performance Analyzer.
On the HDD there is a program to write this image to the FPGAs(or external memory that stores the logic config). AFAIK the connection is done through the SBC's parallel port.

The FPGA on the Backplane seems separate and is not stored in this file.

Thanks to @wisi and @water111 one more FPGA flash firmware was extracted from another T15k.

water111__0507.zip

Посмотреть и скачать с Яндекс Диска

yadi.sk

0507.exo
BTW numbers in filename PROBABLY correspond to the firmware release date:
0507.exo - 7 May 2003
FPGA0526_master_pfm.exo - 26 May 2003
Also, exist fpga1.0-1.exo which is newer but we were not able to recover it. it comes with pafpga-1.0-1.src.rpm package which we also cannot recover.

 

[Jackhead]

did you guys managed to run something over the performance analyzer? On PS1 DTL-H2700 was pretty easy using the sdk. I wonder if the tool can also to performance test in ps1 mode (code).
But im not sure what sdk used for it or i dont have it.. On my T15k the net hdd was gone i recovered it with a image from unclejun. But i did no further research as booting up and run a game from disc.

 

[jollyroger]

I used my 15k quite a bit a few years back, got plenty of performance information for super old work I did, and even took some snapshots of other games running (e.g. Gran Turismo 3) to see how they decided to use the DMA channels... good times...

 

[slycooper124]

Maybe you can explain to the rest of us, how it works and how to use it.

 

[hermesconrad]

Thanks to @wisi and @water111 one more FPGA flash firmware was extracted from another T15k.

water111__0507.zip

Посмотреть и скачать с Яндекс Диска

yadi.sk

0507.exo
BTW numbers in filename correspond to the firmware release date:
0507.exo - 7 May 2003
FPGA0526_master_pfm.exo - 26 May 2003
Also, exist fpga1.0-1.exo which is newer but we were not able to recover it. it comes with pafpga-1.0-1.src.rpm package which we also cannot recover.

Fantastic work, this is really great

 

[hermesconrad]

I ran a small test, captured about 3 or 4 seconds of tekken 5(retail)

Looks like capture and analyse steps are separate, I don't see a way yet to stream into the analyzer directly once establishing a connection.

See the screenshot below, I'll get some better samples when I jump back on and have a better play with the software

Havnt messed around with ps1 code

 

[hermesconrad]

To all. The above code should be run from any service account (like "ez", "pz", "z", etc) from the devkit terminal.

cd /usr/local/sony/diag/
chkrev/showrev.sh
romrev.sh
mpubid.sh
eerev
gsrev
ioprev.sh
spu2rev.sh
pcicrev.sh
macaddr.sh

This should show all hardware revisions on the screen.

Finally got around to running these:

chkrev/showrev.sh hung for a while returned a pretty empty result, it could only return the GS rev which was ES4.91, ill upload the error in the next post

romrev: 20030604
mpubid: 61
eerev: 20
gsrev: B
ofprev: 1f
spu2rev: 7
pcicrev: 31
macaddr: NOADDR

 

[hermesconrad]

Showrev.sh result from previous post

 

[hermesconrad]

Looks like all it was trying to do was open diag.conf anyway which has the following in it

 

[slycooper124]

I got the same error, can you show me how to run the others, they keep saying that the file doesn't exist.

 

[hermesconrad]

started going through the 3.3 sdk, didn't realise how much content was here for the PA. The video tutorials on the on the PaCon and probe tools are incredibly valuable

 

[Jackhead]

started going through the 3.3 sdk, didn't realise how much content was here for the PA. The video tutorials on the on the PaCon and probe tools are incredibly valuable

Can you share the sdk? Like to do also some research.

 

[uyjulian]

I think zecoxao is interested in devkit FPGA dumps…

 

[Obsidian]

Gday All,

This thread will serve as an investigation log for the DTL-T15000.

I've recently gotten my hands on the kit and considering the scarcity of information around it i figure it would be worth opening a dialog for myself and others to contribute to.

To start us off, you can find drive dumps from my kit below:
Drive 1:

• Image: https://mega.nz/file/zKpkGQAC#8W_OJ_3qGTQ_ntJZ2KELuDQ0AsJy1YwJnripRsPvcgs
• R-Studio SCN: https://mega.nz/file/2KBSEI6K#DftvKad6ATPMdH6pW0BbH8UCb2uKlW-WSOYYDkuQ3ys

Drive 2 (Appears blank):

• Image: https://mega.nz/file/GSolxb6Y#CFoltdjfNafBiyyT3ei8hUsQULQu1LEWJtZT6pnfebw
• R-Studio SCN: https://mega.nz/file/jHhijSrR#nD5p2wECxyFFvX-QJo6avyedJIfu9s0Ji8OJCHybNUw

Both drives were Sony rebranded "Maxtor 4 D040H2" 40gb hard drives

The image has redhat linux 6.2 running dsnet 2.2.14.-5.0

The username and password "z" as used with the DTL-T10000 wont work for this image.

instead the username and password is "pz", this will drop you into the diag shell.

PC card in this unit is a PCI-815VE - http://lorezan.free.fr/ps2/PCI-815VE-MAL.pdf

I've created a mega folder with a bunch of files extracted from this kit: https://mega.nz/folder/jTYCCCJJ#G1e-3wG_cxrMHGvbf-y0Ug

diagversion: 4.1
diagrevision: 13

Useful Links Below

• https://www.psx-place.com/threads/retail-debugging-startup-card.14027/
• http://lorezan.free.fr/ps2

Most of the links are dead in this.
Any chances of uploading them somewhere else?

I have a server hosting PS2 file if you're interested.