Welcome, Guest!

Here are some external resources you may find helpful
  • Hello, Guest.

    With the recent attacks against members, and lack of care towards their mental health we have started a fundraiser to help fund the life saving charity the Samaritans. Without their support and efforts many people we know wouldn't be alive.

    If you're able to help, you can donate via our fundraiser on GoFundMe Link

    Thank you.

Sony PS2 Tool DTL-T15000 Drive Images and Investigation

hermesconrad

2020 Donator
2020 Donator
2019 Donator
Registered
Joined
Jul 12, 2019
Messages
142
Reaction score
119
Points
43
Location
Australia
AG User Name
hermesconrad
AG Join Date
11/july/2019
No. I have no idea if the backplane FPGA ever got updated (never seen other FPGA bitstreams on the TOOL HDDs.
Yes, AFAIK, most FPGA's load it from an external serial EEPROM/Flash.
But you will need a programmer to read it. And there is no knowing if it will be compressed or encrypted.
That one might actually be more interesting, as I have speculations that the backplane has extended monitoring/diagnostic capabilities.

There is also the SAM device, for which some TOOLs have a driver on the HDD, but nobody really knows what it does.

Back when I showed interest in pictures of the PCBs, that was mainly because of the MIF board with the SPEED chip: The NetHDD of PA TOOLs seems to be encrypted. I have a speculation that even a normal SPEED chip can do on-the-fly encryption, if configured somehow, but I have no idea how. The PSX DVR has a similar feature, but it uses a later, extended version of the SPEED chip (includes a Flash interface and a command interface that connects the IOP to the DVRP).
So if we have pictures from the MIF board, we could at least see what chips are used, and if the old SPEED chip is used, or some extended version of it and if there is an additional chip doing the encryption.
OK sure, makes sense why you would want photos, I'll need to find time to pull it apart fully but when I do I'll get proper scans of both sides of the pcbs. Yeh I noticed the Sam driver havnt had a chance to investigate it. I havnt seen it on my other tools.

I won't be able to touch the 15k till the weekend. Have you got any public wikis or documentation about the pa itself I can have a look at?
 

hermesconrad

2020 Donator
2020 Donator
2019 Donator
Registered
Joined
Jul 12, 2019
Messages
142
Reaction score
119
Points
43
Location
Australia
AG User Name
hermesconrad
AG Join Date
11/july/2019
Here are my findings. From your commands.
It's complaining that it can't find those files, either they don't exist on your drive or the path your executing from is wrong, ls the directory and see if you can find those files
 

AKuHAK

Registered
Registered
Joined
Jun 29, 2019
Messages
39
Reaction score
23
Points
8
AG User Name
AKuHAK
AG Join Date
25.07.2012
Here are my findings. From your commands.
I see, you are logged under "root", all commands can fail cause of that. It seems that first command fail too. Can you login as "z" before? I will try to adopt commands for root account.
 

slycooper124

Registered
Registered
Joined
Jul 30, 2019
Messages
335
Reaction score
52
Points
28
Location
Ohio
AG User Name
slycooper124
AG Join Date
June 2019
I see, you are logged under "root", all commands can fail cause of that. It seems that first command fail too. Can you login as "z" before? I will try to adopt commands for root account.
That is the weird thing when I log into the z account thats what comes up. So if the root account is the name then I dont know where to go.
 

Attachments

  • 20200820_123756.jpg
    20200820_123756.jpg
    3.1 MB · Views: 0

slycooper124

Registered
Registered
Joined
Jul 30, 2019
Messages
335
Reaction score
52
Points
28
Location
Ohio
AG User Name
slycooper124
AG Join Date
June 2019
so am I doing something wrong?
 

AKuHAK

Registered
Registered
Joined
Jun 29, 2019
Messages
39
Reaction score
23
Points
8
AG User Name
AKuHAK
AG Join Date
25.07.2012
Thanks to AKuHAK, and a program I made to combine the file's fragments, I was able to extract FPGA0526_master_pfm.exo from partition 6 (0,1...,5<-) of the SBC HDD from the first post.

Then it turned-out that R-Studio can extract it too, but I didn't think of checking that before writing the program (so now the prog is useless). :D

FPGA0526_master_pfm.exo Contains the logic configurations of the 4 Performance Analyzer Xilinx XC2V1000 FPGAs. The file is basically a Motorola SREC file.
The data looks uncompressed and not encrypted. And there is a lot of info about reversing Xilinx bitsteams, so in theory it should be possible it to be reversed back to logic/netlist. Although what it does and can do is quite clear from the manuals of the Performance Analyzer.
On the HDD there is a program to write this image to the FPGAs(or external memory that stores the logic config). AFAIK the connection is done through the SBC's parallel port.

The FPGA on the Backplane seems separate and is not stored in this file.
Thanks to @wisi and @water111 one more FPGA flash firmware was extracted from another T15k.
0507.exo
BTW numbers in filename PROBABLY correspond to the firmware release date:
0507.exo - 7 May 2003
FPGA0526_master_pfm.exo - 26 May 2003
Also, exist fpga1.0-1.exo which is newer but we were not able to recover it. it comes with pafpga-1.0-1.src.rpm package which we also cannot recover.
 
Last edited:

Jackhead

Registered
Registered
Joined
May 31, 2019
Messages
179
Reaction score
349
Points
63
Location
Germany
AG User Name
Jackhead
AG Join Date
April 3, 2008
did you guys managed to run something over the performance analyzer? On PS1 DTL-H2700 was pretty easy using the sdk. I wonder if the tool can also to performance test in ps1 mode (code).
But im not sure what sdk used for it or i dont have it.. On my T15k the net hdd was gone i recovered it with a image from unclejun. But i did no further research as booting up and run a game from disc.
 

jollyroger

Registered
Registered
Joined
Jun 5, 2019
Messages
41
Reaction score
43
Points
18
AG User Name
jollyroger
AG Join Date
XenForo says Oct 18, 2008, but actually I originally register in 1998...
I used my 15k quite a bit a few years back, got plenty of performance information for super old work I did, and even took some snapshots of other games running (e.g. Gran Turismo 3) to see how they decided to use the DMA channels... good times...
 

slycooper124

Registered
Registered
Joined
Jul 30, 2019
Messages
335
Reaction score
52
Points
28
Location
Ohio
AG User Name
slycooper124
AG Join Date
June 2019
Maybe you can explain to the rest of us, how it works and how to use it.
 

hermesconrad

2020 Donator
2020 Donator
2019 Donator
Registered
Joined
Jul 12, 2019
Messages
142
Reaction score
119
Points
43
Location
Australia
AG User Name
hermesconrad
AG Join Date
11/july/2019
Thanks to @wisi and @water111 one more FPGA flash firmware was extracted from another T15k.
0507.exo
BTW numbers in filename correspond to the firmware release date:
0507.exo - 7 May 2003
FPGA0526_master_pfm.exo - 26 May 2003
Also, exist fpga1.0-1.exo which is newer but we were not able to recover it. it comes with pafpga-1.0-1.src.rpm package which we also cannot recover.
Fantastic work, this is really great
 

hermesconrad

2020 Donator
2020 Donator
2019 Donator
Registered
Joined
Jul 12, 2019
Messages
142
Reaction score
119
Points
43
Location
Australia
AG User Name
hermesconrad
AG Join Date
11/july/2019
I ran a small test, captured about 3 or 4 seconds of tekken 5(retail)

Looks like capture and analyse steps are separate, I don't see a way yet to stream into the analyzer directly once establishing a connection.

See the screenshot below, I'll get some better samples when I jump back on and have a better play with the software

Havnt messed around with ps1 code
 

Attachments

  • unknown-9.png
    unknown-9.png
    215.9 KB · Views: 0

hermesconrad

2020 Donator
2020 Donator
2019 Donator
Registered
Joined
Jul 12, 2019
Messages
142
Reaction score
119
Points
43
Location
Australia
AG User Name
hermesconrad
AG Join Date
11/july/2019
To all. The above code should be run from any service account (like "ez", "pz", "z", etc) from the devkit terminal.
Bash:
cd /usr/local/sony/diag/
chkrev/showrev.sh
romrev.sh
mpubid.sh
eerev
gsrev
ioprev.sh
spu2rev.sh
pcicrev.sh
macaddr.sh
This should show all hardware revisions on the screen.


Finally got around to running these:

chkrev/showrev.sh hung for a while returned a pretty empty result, it could only return the GS rev which was ES4.91, ill upload the error in the next post

romrev: 20030604
mpubid: 61
eerev: 20
gsrev: B
ofprev: 1f
spu2rev: 7
pcicrev: 31
macaddr: NOADDR
 

hermesconrad

2020 Donator
2020 Donator
2019 Donator
Registered
Joined
Jul 12, 2019
Messages
142
Reaction score
119
Points
43
Location
Australia
AG User Name
hermesconrad
AG Join Date
11/july/2019
Showrev.sh result from previous post
 

Attachments

  • 20200822_145326.jpg
    20200822_145326.jpg
    3.3 MB · Views: 0

hermesconrad

2020 Donator
2020 Donator
2019 Donator
Registered
Joined
Jul 12, 2019
Messages
142
Reaction score
119
Points
43
Location
Australia
AG User Name
hermesconrad
AG Join Date
11/july/2019
Looks like all it was trying to do was open diag.conf anyway which has the following in it
 

Attachments

  • 20200822_150331.jpg
    20200822_150331.jpg
    1.2 MB · Views: 0

slycooper124

Registered
Registered
Joined
Jul 30, 2019
Messages
335
Reaction score
52
Points
28
Location
Ohio
AG User Name
slycooper124
AG Join Date
June 2019
I got the same error, can you show me how to run the others, they keep saying that the file doesn't exist.
 

Attachments

  • 20200819_231706.jpg
    20200819_231706.jpg
    3.4 MB · Views: 0
  • 20200819_230824.jpg
    20200819_230824.jpg
    3.2 MB · Views: 0

hermesconrad

2020 Donator
2020 Donator
2019 Donator
Registered
Joined
Jul 12, 2019
Messages
142
Reaction score
119
Points
43
Location
Australia
AG User Name
hermesconrad
AG Join Date
11/july/2019
started going through the 3.3 sdk, didn't realise how much content was here for the PA. The video tutorials on the on the PaCon and probe tools are incredibly valuable
 

Jackhead

Registered
Registered
Joined
May 31, 2019
Messages
179
Reaction score
349
Points
63
Location
Germany
AG User Name
Jackhead
AG Join Date
April 3, 2008
started going through the 3.3 sdk, didn't realise how much content was here for the PA. The video tutorials on the on the PaCon and probe tools are incredibly valuable
Can you share the sdk? Like to do also some research.
 

uyjulian

Registered
Registered
Joined
May 30, 2019
Messages
96
Reaction score
31
Points
18
I think zecoxao is interested in devkit FPGA dumps…
 
Top