Welcome, Guest!

Here are some external resources you may find helpful
  • Hello, Guest.

    With the recent attacks against members, and lack of care towards their mental health we have started a fundraiser to help fund the life saving charity the Samaritans. Without their support and efforts many people we know wouldn't be alive.

    If you're able to help, you can donate via our fundraiser on GoFundMe Link

    Thank you.

Sony PS2 Tool DTL-T15000 Drive Images and Investigation

hermesconrad

2020 Donator
2020 Donator
2019 Donator
Registered
Joined
Jul 12, 2019
Messages
142
Reaction score
119
Points
43
Location
Australia
AG User Name
hermesconrad
AG Join Date
11/july/2019
I know that it is possible to somehow connect to devkit telnet session, but I don't know details.
These commands set are much better to be run from dsnet toolset from your PC. If you already flashed t10000-300.bin, previous flash content was erased.
T10k has telnet installed, you just need to create a non root user, t15k is locked down, only telnet client is installed
 

AKuHAK

Registered
Registered
Joined
Jun 29, 2019
Messages
39
Reaction score
23
Points
8
AG User Name
AKuHAK
AG Join Date
25.07.2012
i dumped the flash, copied the files to mega under the flash_dumps folder
you have t10000-rel280.bin from ps2sdk 2.8, didn't touch that before, thanks for sharing
also WS rom is different from WS rom from T10k: PS20100TD20000117-rd351.pa.bin
whats the command to show the current flash version?
I will try to create command set for showing all hardware revisions.
 

AKuHAK

Registered
Registered
Joined
Jun 29, 2019
Messages
39
Reaction score
23
Points
8
AG User Name
AKuHAK
AG Join Date
25.07.2012
To all. The above code should be run from any service account (like "ez", "pz", "z", etc) from the devkit terminal.
Bash:
cd /usr/local/sony/diag/
chkrev/showrev.sh
romrev.sh
mpubid.sh
eerev
gsrev
ioprev.sh
spu2rev.sh
pcicrev.sh
macaddr.sh
This should show all hardware revisions on the screen.
 

slycooper124

Registered
Registered
Joined
Jul 30, 2019
Messages
335
Reaction score
52
Points
28
Location
Ohio
AG User Name
slycooper124
AG Join Date
June 2019
Ok, thanks. Will this work through telnet?
 

AKuHAK

Registered
Registered
Joined
Jun 29, 2019
Messages
39
Reaction score
23
Points
8
AG User Name
AKuHAK
AG Join Date
25.07.2012
You need root permissions for doing this. In fact, I don't know, maybe you can run su before for entering the admin session. I also not completely sure if the PATH will be correct, I guess that chkrev/showrev.sh will setup PATH for you. Just try and tell.
 

HI_RICKY

2020 Donator
2020 Donator
2019 Donator
Registered
Joined
Mar 21, 2019
Messages
358
Reaction score
234
Points
43
Location
Hong Kong
AG User Name
HI_Ricky
AG Join Date
Jun 7, 2007
just z login , than Ctrl C , you will get admin there :)
 

slycooper124

Registered
Registered
Joined
Jul 30, 2019
Messages
335
Reaction score
52
Points
28
Location
Ohio
AG User Name
slycooper124
AG Join Date
June 2019
Do I need to directly connect to the tool to get admin access. I dont think i can do it over telnet.
 

slycooper124

Registered
Registered
Joined
Jul 30, 2019
Messages
335
Reaction score
52
Points
28
Location
Ohio
AG User Name
slycooper124
AG Join Date
June 2019
can i run the user command through telnet or do i need to be directly connected to the tool?
 

slycooper124

Registered
Registered
Joined
Jul 30, 2019
Messages
335
Reaction score
52
Points
28
Location
Ohio
AG User Name
slycooper124
AG Join Date
June 2019
Your command says there are too many argumemts.20200818_154714.jpg
 

AKuHAK

Registered
Registered
Joined
Jun 29, 2019
Messages
39
Reaction score
23
Points
8
AG User Name
AKuHAK
AG Join Date
25.07.2012
Your command says there are too many argumemts.
This command is more for setting PATH correctly it can fail.
You can run the rest of commands after that.
Code:
romrev.sh
mpubid.sh
eerev
gsrev
ioprev.sh
spu2rev.sh
pcicrev.sh
macaddr.sh
 

slycooper124

Registered
Registered
Joined
Jul 30, 2019
Messages
335
Reaction score
52
Points
28
Location
Ohio
AG User Name
slycooper124
AG Join Date
June 2019
Do I just type it in like that or do i need to put show rev before hand
 

AKuHAK

Registered
Registered
Joined
Jun 29, 2019
Messages
39
Reaction score
23
Points
8
AG User Name
AKuHAK
AG Join Date
25.07.2012
Do I just type it in like that or do i need to put show rev before hand
it is better to run chkrev/showrev.sh before doing these commands. This command also sets up all environment variables.
 

slycooper124

Registered
Registered
Joined
Jul 30, 2019
Messages
335
Reaction score
52
Points
28
Location
Ohio
AG User Name
slycooper124
AG Join Date
June 2019
Ok I did that and it said that there was too many arguments. I'll try again tonight
 

Attachments

  • 20200818_154714.jpg
    20200818_154714.jpg
    4.2 MB · Views: 0

slycooper124

Registered
Registered
Joined
Jul 30, 2019
Messages
335
Reaction score
52
Points
28
Location
Ohio
AG User Name
slycooper124
AG Join Date
June 2019
i tried doing just cd chkrev/showrev.sh and it still gave me an error with arguments.
 

AKuHAK

Registered
Registered
Joined
Jun 29, 2019
Messages
39
Reaction score
23
Points
8
AG User Name
AKuHAK
AG Join Date
25.07.2012
Just ignore the error and continue entering commands.
 

slycooper124

Registered
Registered
Joined
Jul 30, 2019
Messages
335
Reaction score
52
Points
28
Location
Ohio
AG User Name
slycooper124
AG Join Date
June 2019
Ok so do cd showrev/ for every other command
 

wisi

Registered
Registered
Joined
Jun 7, 2019
Messages
11
Reaction score
24
Points
3
AG User Name
wisi
AG Join Date
Apr 16, 2016
Thanks to AKuHAK, and a program I made to combine the file's fragments, I was able to extract FPGA0526_master_pfm.exo from partition 6 (0,1...,5<-) of the SBC HDD from the first post.

Then it turned-out that R-Studio can extract it too, but I didn't think of checking that before writing the program (so now the prog is useless). :D

FPGA0526_master_pfm.exo Contains the logic configurations of the 4 Performance Analyzer Xilinx XC2V1000 FPGAs. The file is basically a Motorola SREC file.
The data looks uncompressed and not encrypted. And there is a lot of info about reversing Xilinx bitsteams, so in theory it should be possible it to be reversed back to logic/netlist. Although what it does and can do is quite clear from the manuals of the Performance Analyzer.
On the HDD there is a program to write this image to the FPGAs(or external memory that stores the logic config). AFAIK the connection is done through the SBC's parallel port.

The FPGA on the Backplane seems separate and is not stored in this file.
 

hermesconrad

2020 Donator
2020 Donator
2019 Donator
Registered
Joined
Jul 12, 2019
Messages
142
Reaction score
119
Points
43
Location
Australia
AG User Name
hermesconrad
AG Join Date
11/july/2019
Thanks to AKuHAK, and a program I made to combine the file's fragments, I was able to extract FPGA0526_master_pfm.exo from partition 6 (0,1...,5<-) of the SBC HDD from the first post.

Then it turned-out that R-Studio can extract it too, but I didn't think of checking that before writing the program (so now the prog is useless). :D

FPGA0526_master_pfm.exo Contains the logic configurations of the 4 Performance Analyzer Xilinx XC2V1000 FPGAs. The file is basically a Motorola SREC file.
The data looks uncompressed and not encrypted. And there is a lot of info about reversing Xilinx bitsteams, so in theory it should be possible it to be reversed back to logic/netlist. Although what it does and can do is quite clear from the manuals of the Performance Analyzer.
On the HDD there is a program to write this image to the FPGAs(or external memory that stores the logic config). AFAIK the connection is done through the SBC's parallel port.

The FPGA on the Backplane seems separate and is not stored in this file.
Super impressive wisi, did you find the bitstream for thr backplane fpga as well? If not it might be possible to manually extract it from flash, it's been a while since I've played in the fpga space but from my understanding they are effectively bootstrapped from flash on startup,coupd be wrong though it's been a long time
 

wisi

Registered
Registered
Joined
Jun 7, 2019
Messages
11
Reaction score
24
Points
3
AG User Name
wisi
AG Join Date
Apr 16, 2016
No. I have no idea if the backplane FPGA ever got updated (never seen other FPGA bitstreams on the TOOL HDDs.
Yes, AFAIK, most FPGA's load it from an external serial EEPROM/Flash.
But you will need a programmer to read it. And there is no knowing if it will be compressed or encrypted.
That one might actually be more interesting, as I have speculations that the backplane has extended monitoring/diagnostic capabilities.

There is also the SAM device, for which some TOOLs have a driver on the HDD, but nobody really knows what it does.

Back when I showed interest in pictures of the PCBs, that was mainly because of the MIF board with the SPEED chip: The NetHDD of PA TOOLs seems to be encrypted. I have a speculation that even a normal SPEED chip can do on-the-fly encryption, if configured somehow, but I have no idea how. The PSX DVR has a similar feature, but it uses a later, extended version of the SPEED chip (includes a Flash interface and a command interface that connects the IOP to the DVRP).
So if we have pictures from the MIF board, we could at least see what chips are used, and if the old SPEED chip is used, or some extended version of it and if there is an additional chip doing the encryption.
 
Top