Results 1 to 7 of 7

Thread: PS3 Firmware Module Dump

  1. #1
    HanSooloo Guest

    PS3 Firmware Module Dump

    Hello again kids

    Not too soon after having a good bit of creative discussion with our new team add "subdub" and regular "naturesbane", I decided to look into the firmware dumps that had been floating around in The Matrix

    Thanks to inspiration by subdub and naturesbane, I decided to do some "de-mangling" of the data. So, the rest is pretty much applying the newly found SCE file format template to the file and extracting the byte stream into a new file.

    Here is what comes out as a result of this analysis (the hex in the file name is the address at which the SCE\0 magic is found):

    Bytes   Date         Extracted Module Name       
    3568    May  9 01:04 fw_module_0X00A00420.self
    5280    May  9 01:04 fw_module_0X014242C0.self
    3424    May  9 01:04 fw_module_0X01E63A60.self
    4592    May  9 01:04 fw_module_0X02C266C8.self
    5856    May  9 01:04 fw_module_0X039F2D98.self
    5952    May  9 01:04 fw_module_0X047CE434.self
    2688    May  9 01:04 fw_module_0X055B8B20.self
    4464    May  9 01:04 fw_module_0X063B4B08.self
    5472    May  9 01:04 fw_module_0X076497A8.self
    6368    May  9 01:05 fw_module_0X0A0DCF48.self
    4896    May  9 01:05 fw_module_0X0CB916D8.self
    5088    May  9 01:05 fw_module_0X0F9E774C.self
    Now, I have to say though: to get the modules out, I had to choose an arbitrary file alignment value, which happened to be 16. Every file looks to be around 5KB. Coincidence: who knows? Bogus data: maybe? But maybe they are _just_ about the right size to get executed in the Local Store of the SPUs (remember, 256KB only) . . .

    The source code for the "$CE Extract" program is coming soon. subdub and I started coding around the same time, and his is probably a simpler implementation. But I will post the code as soon as I clean it up a bit. It still has some left over bits from "Scan Hdd"

    Again, credit goes to the ones who deserve it: subdub and naturesbane... keep up the good work

    Just to make sure before people get their hopes up, this does _not_ mean that we know what the PS3 is doing with these files. It just means that we know that they exist. So, smart people out there can figure the contents out :-)

    And last but not least, all of this would not have been possible without Courier's initial work on the firmware chips :-)

  2. #2
    lacion Guest
    good job there han. would be great to see the code for that.

    it seens odd thought that all of the modules are the same size. you think is posible that those are not the full modules? its seems odd that their the same size.

  3. #3
    HanSooloo Guest
    Just a quick update on the firmware anlaysis project:

    It seems like the interleaving of the firmware and the way addressing of the NAND chips is not that straightforward. We have been hypothesizing in the Dev forum about different methods that could have been used when programming the chips.

    Now, we are at a point where we can take the 2 binary dumps and put them through different algorithms to see if the joined files make any more sense than what they do now.

    More to be added later ....

  4. #4
    courier Guest
    well han very very good sound !!!!!

  5. #5
    HanSooloo Guest

    Cool Firmware Table of Contents Revealed

    Well, it seems like it has been more than 2 weeks since we paid any attention to the lovely PS3's frmware area. So, I though it would be a good idea to go into June with some exciting news (other than the fact that it's nice and warm, and having ice cream sounds like fun ).

    After days of hair pulling and crossed eyes staring at a laptop LCD panel side by side with an LCD monitor (more screen real estate helps, trust me!), I started seeing some patterns (as in TheMatrix).

    Essentially, with the help of the Dev community, I was able to figure out the way the 2 NAND chips' data dumps come together. This was done by little bit of byte swapping, some NAND Out-of-Band data discarding for good measure, and some magical data interleaving between the 2 dumps (think 2 to the power of 3 to the power of 2).

    At the end of the day data got aligned pretty nicely and the discarded data (NAND OOB) seemed like it did not contain any "valuable/valid" data. This is good, since it tells us our method is working. I would be very sad if I saw the text "isoldr.self" in the discard file; bad PS3

    What do we have as a result of this?
    • Some magical way to unlock the firmware images? No, at least not yet!
    • A better understanding of what types of programs are stored in the firmware: definitely YES.
    • The fact that when you upgrade your firmware, your OLD one still sits in the NAND chips (idle, waiting to be "recalled"?) Maybe our PS3 is smart enough to know when a upgrade goes bad, and can revert back to the previous version.
    But enough teasing, and let's share the love in the form of "a 1st in the PS3 scene: Firmware Flash Table of Contents with Module Names and Their Address and Lengths"

  6. #6
    courier Guest
    woowwwww woooooww great work HanSooloo!

  7. #7
    HackITandC Guest
    Excellent work, thanks very much friend!. Appreciate all your work!!

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts