Welcome, Guest!

Here are some links you may find helpful

PS2 Sony PS2 Tool DTL-T15000 Drive Images and Investigation

hermesconrad

Donator
Original poster
Staff member
Donator
Community Contributor
Moderator
Registered
Jul 12, 2019
Donations
£14.47
192
181
43
AGName
hermesconrad
AG Join Date
11/july/2019
No. I have no idea if the backplane FPGA ever got updated (never seen other FPGA bitstreams on the TOOL HDDs.
Yes, AFAIK, most FPGA's load it from an external serial EEPROM/Flash.
But you will need a programmer to read it. And there is no knowing if it will be compressed or encrypted.
That one might actually be more interesting, as I have speculations that the backplane has extended monitoring/diagnostic capabilities.

There is also the SAM device, for which some TOOLs have a driver on the HDD, but nobody really knows what it does.

Back when I showed interest in pictures of the PCBs, that was mainly because of the MIF board with the SPEED chip: The NetHDD of PA TOOLs seems to be encrypted. I have a speculation that even a normal SPEED chip can do on-the-fly encryption, if configured somehow, but I have no idea how. The PSX DVR has a similar feature, but it uses a later, extended version of the SPEED chip (includes a Flash interface and a command interface that connects the IOP to the DVRP).
So if we have pictures from the MIF board, we could at least see what chips are used, and if the old SPEED chip is used, or some extended version of it and if there is an additional chip doing the encryption.
OK sure, makes sense why you would want photos, I'll need to find time to pull it apart fully but when I do I'll get proper scans of both sides of the pcbs. Yeh I noticed the Sam driver havnt had a chance to investigate it. I havnt seen it on my other tools.

I won't be able to touch the 15k till the weekend. Have you got any public wikis or documentation about the pa itself I can have a look at?
 

hermesconrad

Donator
Original poster
Staff member
Donator
Community Contributor
Moderator
Registered
Jul 12, 2019
Donations
£14.47
192
181
43
AGName
hermesconrad
AG Join Date
11/july/2019
Here are my findings. From your commands.
It's complaining that it can't find those files, either they don't exist on your drive or the path your executing from is wrong, ls the directory and see if you can find those files
 
  • Like
Reactions: AKuHAK

AKuHAK

Active member
Registered
Jun 29, 2019
39
24
8
AGName
AKuHAK
AG Join Date
25.07.2012
Here are my findings. From your commands.
I see, you are logged under "root", all commands can fail cause of that. It seems that first command fail too. Can you login as "z" before? I will try to adopt commands for root account.
 

slycooper124

Well-known member
Registered
Jul 30, 2019
495
117
43
AGName
slycooper124
AG Join Date
June 2019
I see, you are logged under "root", all commands can fail cause of that. It seems that first command fail too. Can you login as "z" before? I will try to adopt commands for root account.
That is the weird thing when I log into the z account thats what comes up. So if the root account is the name then I dont know where to go.
 

Attachments

  • 20200820_123756.jpg
    20200820_123756.jpg
    3.1 MB · Views: 0
  • Like
Reactions: AKuHAK

AKuHAK

Active member
Registered
Jun 29, 2019
39
24
8
AGName
AKuHAK
AG Join Date
25.07.2012
Thanks to AKuHAK, and a program I made to combine the file's fragments, I was able to extract FPGA0526_master_pfm.exo from partition 6 (0,1...,5<-) of the SBC HDD from the first post.

Then it turned-out that R-Studio can extract it too, but I didn't think of checking that before writing the program (so now the prog is useless). :D

FPGA0526_master_pfm.exo Contains the logic configurations of the 4 Performance Analyzer Xilinx XC2V1000 FPGAs. The file is basically a Motorola SREC file.
The data looks uncompressed and not encrypted. And there is a lot of info about reversing Xilinx bitsteams, so in theory it should be possible it to be reversed back to logic/netlist. Although what it does and can do is quite clear from the manuals of the Performance Analyzer.
On the HDD there is a program to write this image to the FPGAs(or external memory that stores the logic config). AFAIK the connection is done through the SBC's parallel port.

The FPGA on the Backplane seems separate and is not stored in this file.
Thanks to @wisi and @water111 one more FPGA flash firmware was extracted from another T15k.
0507.exo
BTW numbers in filename PROBABLY correspond to the firmware release date:
0507.exo - 7 May 2003
FPGA0526_master_pfm.exo - 26 May 2003
Also, exist fpga1.0-1.exo which is newer but we were not able to recover it. it comes with pafpga-1.0-1.src.rpm package which we also cannot recover.
 
Last edited:
  • Like
Reactions: wisi and shuji

Jackhead

Well-known member
Registered
May 31, 2019
248
434
63
AGName
Jackhead
AG Join Date
April 3, 2008
did you guys managed to run something over the performance analyzer? On PS1 DTL-H2700 was pretty easy using the sdk. I wonder if the tool can also to performance test in ps1 mode (code).
But im not sure what sdk used for it or i dont have it.. On my T15k the net hdd was gone i recovered it with a image from unclejun. But i did no further research as booting up and run a game from disc.
 

jollyroger

Active member
Registered
Jun 5, 2019
40
45
18
AGName
jollyroger
AG Join Date
XenForo says Oct 18, 2008, but actually I originally register in 1998...
I used my 15k quite a bit a few years back, got plenty of performance information for super old work I did, and even took some snapshots of other games running (e.g. Gran Turismo 3) to see how they decided to use the DMA channels... good times...
 

slycooper124

Well-known member
Registered
Jul 30, 2019
495
117
43
AGName
slycooper124
AG Join Date
June 2019
Maybe you can explain to the rest of us, how it works and how to use it.
 

hermesconrad

Donator
Original poster
Staff member
Donator
Community Contributor
Moderator
Registered
Jul 12, 2019
Donations
£14.47
192
181
43
AGName
hermesconrad
AG Join Date
11/july/2019
Thanks to @wisi and @water111 one more FPGA flash firmware was extracted from another T15k.
0507.exo
BTW numbers in filename correspond to the firmware release date:
0507.exo - 7 May 2003
FPGA0526_master_pfm.exo - 26 May 2003
Also, exist fpga1.0-1.exo which is newer but we were not able to recover it. it comes with pafpga-1.0-1.src.rpm package which we also cannot recover.
Fantastic work, this is really great
 

hermesconrad

Donator
Original poster
Staff member
Donator
Community Contributor
Moderator
Registered
Jul 12, 2019
Donations
£14.47
192
181
43
AGName
hermesconrad
AG Join Date
11/july/2019
I ran a small test, captured about 3 or 4 seconds of tekken 5(retail)

Looks like capture and analyse steps are separate, I don't see a way yet to stream into the analyzer directly once establishing a connection.

See the screenshot below, I'll get some better samples when I jump back on and have a better play with the software

Havnt messed around with ps1 code
 

Attachments

  • unknown-9.png
    unknown-9.png
    215.9 KB · Views: 0

hermesconrad

Donator
Original poster
Staff member
Donator
Community Contributor
Moderator
Registered
Jul 12, 2019
Donations
£14.47
192
181
43
AGName
hermesconrad
AG Join Date
11/july/2019
To all. The above code should be run from any service account (like "ez", "pz", "z", etc) from the devkit terminal.
Bash:
cd /usr/local/sony/diag/
chkrev/showrev.sh
romrev.sh
mpubid.sh
eerev
gsrev
ioprev.sh
spu2rev.sh
pcicrev.sh
macaddr.sh
This should show all hardware revisions on the screen.


Finally got around to running these:

chkrev/showrev.sh hung for a while returned a pretty empty result, it could only return the GS rev which was ES4.91, ill upload the error in the next post

romrev: 20030604
mpubid: 61
eerev: 20
gsrev: B
ofprev: 1f
spu2rev: 7
pcicrev: 31
macaddr: NOADDR
 
  • Like
Reactions: AKuHAK

hermesconrad

Donator
Original poster
Staff member
Donator
Community Contributor
Moderator
Registered
Jul 12, 2019
Donations
£14.47
192
181
43
AGName
hermesconrad
AG Join Date
11/july/2019
Showrev.sh result from previous post
 

Attachments

  • 20200822_145326.jpg
    20200822_145326.jpg
    3.3 MB · Views: 0
  • Like
Reactions: AKuHAK

hermesconrad

Donator
Original poster
Staff member
Donator
Community Contributor
Moderator
Registered
Jul 12, 2019
Donations
£14.47
192
181
43
AGName
hermesconrad
AG Join Date
11/july/2019
Looks like all it was trying to do was open diag.conf anyway which has the following in it
 

Attachments

  • 20200822_150331.jpg
    20200822_150331.jpg
    1.2 MB · Views: 0

slycooper124

Well-known member
Registered
Jul 30, 2019
495
117
43
AGName
slycooper124
AG Join Date
June 2019
I got the same error, can you show me how to run the others, they keep saying that the file doesn't exist.
 

Attachments

  • 20200819_231706.jpg
    20200819_231706.jpg
    3.4 MB · Views: 0
  • 20200819_230824.jpg
    20200819_230824.jpg
    3.2 MB · Views: 0

hermesconrad

Donator
Original poster
Staff member
Donator
Community Contributor
Moderator
Registered
Jul 12, 2019
Donations
£14.47
192
181
43
AGName
hermesconrad
AG Join Date
11/july/2019
started going through the 3.3 sdk, didn't realise how much content was here for the PA. The video tutorials on the on the PaCon and probe tools are incredibly valuable
 

Jackhead

Well-known member
Registered
May 31, 2019
248
434
63
AGName
Jackhead
AG Join Date
April 3, 2008
started going through the 3.3 sdk, didn't realise how much content was here for the PA. The video tutorials on the on the PaCon and probe tools are incredibly valuable
Can you share the sdk? Like to do also some research.
 

Obsidian

NZ PS2 Collector
Donator
Registered
Jun 4, 2019
42
13
8
ps2apps.com
AGName
PS2Guy
AG Join Date
Jan 19, 2011
Gday All,

This thread will serve as an investigation log for the DTL-T15000.

I've recently gotten my hands on the kit and considering the scarcity of information around it i figure it would be worth opening a dialog for myself and others to contribute to.

To start us off, you can find drive dumps from my kit below:
Drive 1:
Drive 2 (Appears blank):
Both drives were Sony rebranded "Maxtor 4 D040H2" 40gb hard drives

The image has redhat linux 6.2 running dsnet 2.2.14.-5.0

The username and password "z" as used with the DTL-T10000 wont work for this image.

instead the username and password is "pz", this will drop you into the diag shell.

PC card in this unit is a PCI-815VE - http://lorezan.free.fr/ps2/PCI-815VE-MAL.pdf

I've created a mega folder with a bunch of files extracted from this kit: https://mega.nz/folder/jTYCCCJJ#G1e-3wG_cxrMHGvbf-y0Ug

diagversion: 4.1
diagrevision: 13

Useful Links Below

Most of the links are dead in this.
Any chances of uploading them somewhere else?

I have a server hosting PS2 file if you're interested.
 

Make a donation