PS2 Sony PS2 Tool DTL-T15000 Drive Images and Investigation

hermesconrad · Aug 15, 2020

Gday All,

This thread will serve as an investigation log for the DTL-T15000.

I've recently gotten my hands on the kit and considering the scarcity of information around it i figure it would be worth opening a dialog for myself and others to contribute to.

To start us off, you can find drive dumps from my kit in the below mega folder:

File folder on MEGA

mega.nz

I have included both drive images and the r-studio recovery files to make life a little easier, i have also extracted a few packages of interest.

Points of interest:
diagversion: 4.1
diagrevision: 13

Both drives were Sony rebranded "Maxtor 4 D040H2" 40gb hard drives

The image has redhat linux 6.2 running dsnet 2.2.14.-5.0

The username and password "z" as used with the DTL-T10000 wont work for this image.

instead the username and password is "pz", this will drop you into the diag shell.

PC card in this unit is a PCI-815VE - http://lorezan.free.fr/ps2/PCI-815VE-MAL.pdf

Useful Links Below

wisi · Aug 16, 2020

If you ever take it apart, would be good to make some photos of all boards.

hermesconrad · Aug 16, 2020

wisi said:
If you ever take it apart, would be good to make some photos of all boards.

I will at some point in the mean time there are some photos of each board on the lorezan site I linked earlier

AKuHAK · Aug 17, 2020

Before you try to flash ROM from 3.0.3 PS2SDK, it highly useful to backup your flash content before.
Dumping 2 Flash chip (dev1 and dev2) content (from PC on the same network with ds tool set):

Bash:

./dsidb
dsidb R> ow 0xBF801400 0x1E000000
dsidb R> ow 0xBF80100C 0x183F4F
dsidb R> bsave dev1_IDs 0xBE1F0000 0x00000080
dsidb R> bsave dev1_log.txt 0xBE1F0080 0x000000E0
dsidb R> bsave dev2_1.bin 0xBFC00000 0x00200000
dsidb R> bsave dev2_2.bin 0xBFE00000 0x00200000

dev2_1.bin and dev2_2.bin will be your Flash ROM content, one for WS mode, one for TOOL mode. These 2 dumps will be swapped according to the WS switch position.

dev1_IDs and dev1_log.txt will contain useful information about your specific TOOL revision like i.Link ID, MPU Board ID, etc.

Known account and password list, never see pz account before:

diag	acct	password
BP2DIAG	q	q
MPU4DIAG	w	w
MIFDIAG	e	e
DIFDIAG	d	d
SETDIAG	s	s
AGING	a	a
FINDIAG	z	z
SBCDIAG	x	x
VIFDIAG	c	c
ILINKSERV	i	i
SBCAGING	v	v
SBCAGING12	v12	v12
FLASH	r	r
IOPSELECT	p	p
DVDDIAG	f	f
HDDUNIT	h	h
ETHER	n	n
HDDAGING	ha	ha
DVDEMDIAG	em	em
EMFINDIAG	ez	ez
HDDSERVICE	hs	hs
HDDCLR	h0	h0
MODEMHDD	mh	mh
MODEM	m	m
MODEMAGING	ma	ma

It is also useful to provide diag version (from TOOL terminal):

Code:

diagrevision
diagversion

For example the latest diagrevision-diagversion I saw: 4.1-8
This information can be taken from HDD dump of course, but the terminal output is a faster way.
The more modern version you have, the less buggy will be your TOOL.

P.S.
I am still working on preparing diag update packages for TOOL, but it is harder then I thought. I was also working on some kind of PS2Ident for TOOL, at least some information can be retrieved but recognizing all the commands for each peripheral is a pain.

hermesconrad · Aug 17, 2020

AKuHAK said:
Before you try to flash ROM from 3.0.3 PS2SDK, it highly useful to backup your flash content before.
Dumping 2 Flash chip (dev1 and dev2) content (from PC on the same network with ds tool set):

Bash:

./dsidb dsidb R> ow 0xBF801400 0x1E000000 dsidb R> ow 0xBF80100C 0x183F4F dsidb R> bsave dev1_IDs 0xBE1F0000 0x00000080 dsidb R> bsave dev1_log.txt 0xBE1F0080 0x000000E0 dsidb R> bsave dev2_1.bin 0xBFC00000 0x00200000 dsidb R> bsave dev2_2.bin 0xBFE00000 0x00200000

dev2_1.bin and dev2_2.bin will be your Flash ROM content, one for WS mode, one for TOOL mode. These 2 dumps will be swapped according to the WS switch position.

dev1_IDs and dev1_log.txt will contain useful information about your specific TOOL revision like i.Link ID, MPU Board ID, etc.

Known account and password list, never see pz account before:

diag acct password
BP2DIAG q q
MPU4DIAG w w
MIFDIAG e e
DIFDIAG d d
SETDIAG s s
AGING a a
FINDIAG z z
SBCDIAG x x
VIFDIAG c c
ILINKSERV i i
SBCAGING v v
SBCAGING12 v12 v12
FLASH r r
IOPSELECT p p
DVDDIAG f f
HDDUNIT h h
ETHER n n
HDDAGING ha ha
DVDEMDIAG em em
EMFINDIAG ez ez
HDDSERVICE hs hs
HDDCLR h0 h0
MODEMHDD mh mh
MODEM m m
MODEMAGING ma ma

It is also useful to provide diag version (from TOOL terminal):

Code:

diagrevision diagversion

For example the latest diagrevision-diagversion I saw: 4.1-8
This information can be taken from HDD dump of course, but the terminal output is a faster way.
The more modern version you have, the less buggy will be your TOOL.

P.S.
I am still working on preparing diag update packages for TOOL, but it is harder then I thought. I was also working on some kind of PS2Ident for TOOL, at least some information can be retrieved but recognizing all the commands for each peripheral is a pain.

this is extremely helpful thankyou, i'll try dump those details shortly. i'm currently battling redhat trying to install some basic packages to make my life a little easier, looks like they cut the distro down even more than the redhat install on my DTL-T10000.

Incase its useful, i've packaged up the dsnet folders (/usr/local/sce and /usr/local/sony) https://mega.nz/file/3PoEgKBR#o1xEw9MBzqa4yGtfifD8frJ7lfUHK7MZ8gFvjWkrMFE

i'll make a link to the inital post as well.

ill get back with the other details in the next day, its almost 2am here atm

hermesconrad · Aug 17, 2020

mega folder with some recovered rpm files https://mega.nz/folder/jTYCCCJJ#G1e-3wG_cxrMHGvbf-y0Ug
i.e. ps2tooldiag-4.1-13.i386.rpm and ps2toolpa-4.1-13.i386.rpm

link on first post

AKuHAK · Aug 18, 2020

hermesconrad said:
i.e. ps2tooldiag-4.1-13.i386.rpm and ps2toolpa-4.1-13.i386.rpm

Thank you! Could you also dump these packages:

Code:

gstool-3.1.0-1
ps2tooldsetup-4.1-13
ps2toolmodem-2.2-1
PStoolInit-1.0-8
PStoolSetup-1.4-1
powctrld-ps2dev-1.2-4
apache-ps-1.0-2
initscripts-5.00-2

wisi · Aug 18, 2020

What program did you use to recover the RPMs? They are broken BTW, AFAIK.
Can it scan for all deleted files? I once used some such programs on Linux, but I don't have a Linux PC to run them on now, so if possible, can you run some program to recover all deleted files from all ext2 partitions if you have the means to?

hermesconrad · Aug 18, 2020

wisi said:
What program did you use to recover the RPMs? They are broken BTW, AFAIK.
Can it scan for all deleted files? I once used some such programs on Linux, but I don't have a Linux PC to run them on now, so if possible, can you run some program to recover all deleted files from all ext2 partitions if you have the means to?

I Used r-studio, these rpms were deleted files recovered by the software, the tar file they were in was partially intact and it didn't complain on extraction but beyond that I didn't test thr rpms thenself, they appeared in a few other places, I'll try upload all varients. I'll see if I can package the full extracted dump, might be easier

AKuHAK · Aug 18, 2020

hermesconrad said:
I'll try upload all varients. I'll see if I can package the full extracted dump, might be easier

Oh, I thought you used rpm which were recovered from the devkit terminal (from the installed system). Those recovered files can be broken. Safer to recreate rpm packages from the installed system, however, I don't know how to perform this on the ancient RedHat with ancient rpm.

hermesconrad · Aug 18, 2020

AKuHAK said:
Oh, I thought you used rpm which were recovered from the devkit terminal (from the installed system). Those recovered files can be broken. Safer to recreate rpm packages from the installed system, however, I don't know how to perform this on the ancient RedHat with ancient rpm.

i'll try recover them like that, these came from the recovered files themselves. will have a play and see what i can retrieve. unfortunately im short on time during the week, the weekend im free (in lockdown again lol)

hermesconrad · Aug 18, 2020

AKuHAK said:
Before you try to flash ROM from 3.0.3 PS2SDK, it highly useful to backup your flash content before.
Dumping 2 Flash chip (dev1 and dev2) content (from PC on the same network with ds tool set):

Bash:

./dsidb dsidb R> ow 0xBF801400 0x1E000000 dsidb R> ow 0xBF80100C 0x183F4F dsidb R> bsave dev1_IDs 0xBE1F0000 0x00000080 dsidb R> bsave dev1_log.txt 0xBE1F0080 0x000000E0 dsidb R> bsave dev2_1.bin 0xBFC00000 0x00200000 dsidb R> bsave dev2_2.bin 0xBFE00000 0x00200000

dev2_1.bin and dev2_2.bin will be your Flash ROM content, one for WS mode, one for TOOL mode. These 2 dumps will be swapped according to the WS switch position.

dev1_IDs and dev1_log.txt will contain useful information about your specific TOOL revision like i.Link ID, MPU Board ID, etc.

Known account and password list, never see pz account before:

diag acct password
BP2DIAG q q
MPU4DIAG w w
MIFDIAG e e
DIFDIAG d d
SETDIAG s s
AGING a a
FINDIAG z z
SBCDIAG x x
VIFDIAG c c
ILINKSERV i i
SBCAGING v v
SBCAGING12 v12 v12
FLASH r r
IOPSELECT p p
DVDDIAG f f
HDDUNIT h h
ETHER n n
HDDAGING ha ha
DVDEMDIAG em em
EMFINDIAG ez ez
HDDSERVICE hs hs
HDDCLR h0 h0
MODEMHDD mh mh
MODEM m m
MODEMAGING ma ma

It is also useful to provide diag version (from TOOL terminal):

Code:

diagrevision diagversion

For example the latest diagrevision-diagversion I saw: 4.1-8
This information can be taken from HDD dump of course, but the terminal output is a faster way.
The more modern version you have, the less buggy will be your TOOL.

P.S.
I am still working on preparing diag update packages for TOOL, but it is harder then I thought. I was also working on some kind of PS2Ident for TOOL, at least some information can be retrieved but recognizing all the commands for each peripheral is a pain.

i dumped the flash, copied the files to mega under the flash_dumps folder

also

diagversion: 4.1
diagrevision: 13

hermesconrad · Aug 18, 2020

AKuHAK said:
Thank you! Could you also dump these packages:

Code:

gstool-3.1.0-1 ps2tooldsetup-4.1-13 ps2toolmodem-2.2-1 PStoolInit-1.0-8 PStoolSetup-1.4-1 powctrld-ps2dev-1.2-4 apache-ps-1.0-2 initscripts-5.00-2

Generating new rpms might be difficult i think the best approach would be if i tar them up as in this guide https://unix.stackexchange.com/questions/140778/how-to-build-an-rpm-package-from-the-installed-files

but ill experiment and see what i can do, probably wont be till the weekend though

slycooper124 · Aug 18, 2020

Should I try this with my 10k

AKuHAK · Aug 18, 2020

slycooper124 said:
Should I try this with my 10k

Bash:

./dsidb
dsidb R> ow 0xBF801400 0x1E000000
dsidb R> ow 0xBF80100C 0x183F4F
dsidb R> bsave dev1_IDs 0xBE1F0000 0x00000080
dsidb R> bsave dev1_log.txt 0xBE1F0080 0x000000E0
dsidb R> bsave dev2_1.bin 0xBFC00000 0x00200000
dsidb R> bsave dev2_2.bin 0xBFE00000 0x00200000

You can try this command set, but it is useful to run it from local pc connected to tool, not from the tool itself. But of course it is also possible to run it on the tool, but you need to transfer these files somehow from tool into the world after dump is complete.

slycooper124 · Aug 18, 2020

Ok, so probably through dsnet. Its too bad that you can't just ftp to the system, it would make it so much easier.

hermesconrad · Aug 18, 2020

slycooper124 said:
Ok, so probably through dsnet. Its too bad that you can't just ftp to the system, it would make it so much easier.

The tool has an ftp client on it, you can ftp the files from the tool bsck to your machine if you can't get dsnet working on your machine, dsnet worked fine for me under Ubuntu 18 so you should be fine

AKuHAK · Aug 18, 2020

slycooper124 said:
Ok, so probably through dsnet. Its too bad that you can't just ftp to the system, it would make it so much easier.

I know that it is possible to somehow connect to devkit telnet session, but I don't know details.
These commands set are much better to be run from dsnet toolset from your PC. If you already flashed t10000-300.bin, previous flash content was erased.

slycooper124 · Aug 18, 2020

Currently I'm running Ubuntu 16.04 so ill see how it goes. It didnt work for me typing it so ill try opening the post in Ubuntu and just copy the commands.

slycooper124 · Aug 18, 2020

whats the command to show the current flash version?

PS2 Sony PS2 Tool DTL-T15000 Drive Images and Investigation

Donator

Member

Donator

Active member

Donator

Donator

Active member

Member

Donator

Active member

Donator

Donator

Donator

Well-known member

Active member

Well-known member

Donator

Active member

Well-known member

Well-known member