├── LICENSE
├── README.md
├── env.bat
├── payloads
├── emmc-dump
│ ├── Makefile
│ ├── linker.x
│ └── source
│ │ ├── include
│ │ ├── brom1k.h
│ │ ├── brom1k_linker.x
│ │ ├── bromcem.h
│ │ └── bromcem_linker.x
│ │ ├── rpcp.c
│ │ └── rpcp.h
├── keydumper
│ ├── Makefile
│ ├── linker.x
│ └── source
│ │ ├── rpcp.c
│ │ └── rpcp.h
├── keyglitch
│ ├── Makefile
│ ├── linker.x
│ └── source
│ │ ├── rpcp.c
│ │ └── rpcp.h
└── stage1
│ └── sd
│ ├── Makefile
│ ├── cfg_4v2.x
│ ├── stage1.s
│ ├── stage1_4v2.bin
│ └── stage1_4v2.elf
├── pcb
└── generic
│ ├── fab
│ ├── try2-B_Cu.gbr
│ ├── try2-B_Mask.gbr
│ ├── try2-B_Paste.gbr
│ ├── try2-B_Silkscreen.gbr
│ ├── try2-Edge_Cuts.gbr
│ ├── try2-F_Cu.gbr
│ ├── try2-F_Mask.gbr
│ ├── try2-F_Paste.gbr
│ ├── try2-F_Silkscreen.gbr
│ ├── try2-NPTH-drl_map.gbr
│ ├── try2-NPTH.drl
│ ├── try2-PTH-drl_map.gbr
│ ├── try2-PTH.drl
│ ├── try2-fab.zip
│ └── try2-job.gbrjob
│ ├── fp-info-cache
│ ├── try2-backups
│ └── try2-2023-12-09_155253.zip
│ ├── try2.kicad_pcb
│ ├── try2.kicad_prl
│ ├── try2.kicad_pro
│ └── try2.kicad_sch
├── pics
├── laview-cutoff.png
├── laview-uptoread.png
└── sdboot_sram.png
├── sdboot.py
├── sdwire.py
├── tools
├── mkfake.c
└── snvs.py
└── wiring
├── n_mos.png
├── wires-pch1k.png
├── wires-vte-back.png
├── wires-vte-front.png
└── wiring.png
/LICENSE:
--------------------------------------------------------------------------------
1 | MIT License
2 |
3 | Copyright (c) 2023 Sebastian Kubala
4 |
5 | Permission is hereby granted, free of charge, to any person obtaining a copy
6 | of this software and associated documentation files (the "Software"), to deal
7 | in the Software without restriction, including without limitation the rights
8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 |
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 |
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # psp2sdboot
2 | This repo contains guides, payloads, schematics and scripts for use with PSP2's "SD boot mode". -o ``` where:
75 | - *code_blob* is bob's glitch build - ```payloads/bob/bob_glitch.bin```
76 | - *output* will be the SD card image
77 | The prepared SD card must then be inserted in the target's GC slot.
78 | width_max= width_step=20```
91 | - repeat at least 5 times
92 | - note the *width* at which *dat0* __always__ cuts off, this is the "threshold"
93 | 3. If the "threshold" is below 200, it might indicate a faulty circuit, slow mosfet, or a very isolated/clean setup. width= width_max= width_step=20 offset=100 offset_max=10000 offset_mult=10 offset_step=40```
104 | - *offset** parameters should initially be broad, with further loops being more precise (eg *offset_mult=1*)
105 | - if the threshold is below 500, *width_step*=10 might be a better choice
106 | - if the starting *width* (threshold - (2 x *width_step*)) is observed to cut off dat0, the starting *width* should be decreased by *width_step*-sized decrements
107 | - ultimately it depends on luck, it might take hours or even days to find a working *offset* and *width* pair
108 | - in case of success, a ```got sd boot: off=[] width=``` message will be displayed and the script will stop
109 | ```
118 | - exec: ```exec ```, where arg2_data is a buffer passed as arg2
119 | - extended exec: ```exece ```, up to 8 args total
120 | ### Key extraction
121 | Provided is a basic keydumper - ```payloads/keydumper``` - it can be used to get the SLSK enc/dec key partials, SNVS enc/dec keys, and the SMI encryption keys.
122 | - If you do not have SoC TX wired, you can dump the key buffer from 0x1f850000 to a file using ```bob file_dump```.
123 | ### Storage R/W
124 | The provided eMMC dumper - ```payloads/emmc-dump``` - contains code to read/write eMMC as well as the SD card. It can be used for larger data handling, eMMC dump/unbrick, crypto research and more.
2 | #include
3 | #include
4 | #include
5 | #include
6 |
7 | #define BLOCK_SIZE 0x200
8 | #define MAX_PAYLOAD_BLOCKS 0xDE
9 | #define ADDCONT_SIZE 0x20000 // additional payloads/whatever
10 | #define ALIGN_SECTOR(s) ((s + (BLOCK_SIZE - 1)) & -BLOCK_SIZE) // align (arg) to BLOCK_SIZE
11 | #define MBR_SL_OFFSZ 0x30
12 | #define DEFAULT_OUTPUT "fake.bin"
13 | #define DEFAULT_STAGE2_DEST 0x40000
14 | #define STAGE1_STAGE2_PARAMBUF 0x34 // hardcoded offset,dest,size for stage2
15 | #define STAGE1_EXTRAS_PARAMARR 0x90 // variable-length array of offset,dest,size for additional files
16 |
17 | uint32_t getSz(const char* src) {
18 | FILE* fp = fopen(src, "rb");
19 | if (fp == NULL)
20 | return 0;
21 | fseek(fp, 0L, SEEK_END);
22 | uint32_t sz = ftell(fp);
23 | fclose(fp);
24 | return sz;
25 | }
26 |
27 | int injectBytes(const char* file, uint32_t offset, const void* data, uint32_t size) {
28 | printf("INJECT 0x%X to %s @ 0x%X\n", size, file, offset);
29 | FILE* fp = fopen(file, "rb+");
30 | if (fp == NULL) {
31 | printf("could not open %s for read/write!\n", file);
32 | return -1;
33 | }
34 | fseek(fp, offset, SEEK_SET);
35 | fwrite(data, 1, size, fp);
36 | fclose(fp);
37 | return 0;
38 | }
39 |
40 | int appendBytes(const char* file, const void* data, uint32_t size) {
41 | printf("APPEND 0x%X to %s at 0x%X\n", size, file, getSz(file));
42 | FILE* fp = fopen(file, "ab");
43 | if (fp == NULL) {
44 | printf("could not open %s for append!\n", file);
45 | return -1;
46 | }
47 | fwrite(data, 1, size, fp);
48 | fclose(fp);
49 | return 0;
50 | }
51 |
52 | int readBytes(const char* file, uint32_t offset, void* data, uint32_t size) {
53 | printf("READ 0x%X from %s @ 0x%X\n", size, file, offset);
54 | FILE* fp = fopen(file, "rb");
55 | if (fp == NULL) {
56 | printf("could not open %s for read!\n", file);
57 | return -1;
58 | }
59 | fseek(fp, offset, SEEK_SET);
60 | fread(data, 1, size, fp);
61 | fclose(fp);
62 | return 0;
63 | }
64 |
65 | int copyFile(const char* src, const char* dst, uint32_t size) {
66 | if (!size)
67 | size = getSz(src);
68 | printf("COPY %s to %s [0x%X]\n", src, dst, size);
69 | void *data = malloc(size);
70 | if (!data) {
71 | printf("could not alloc 0x%X!\n", size);
72 | return -1;
73 | }
74 | FILE* src_fp = fopen(src, "rb");
75 | if (src_fp == NULL) {
76 | printf("could not open %s for read!\n", src);
77 | return -1;
78 | }
79 | fread(data, 1, size, src_fp);
80 | fclose(src_fp);
81 | FILE* dst_fp = fopen(dst, "wb");
82 | if (dst_fp == NULL) {
83 | printf("could not open %s for write!\n", dst);
84 | return -1;
85 | }
86 | fwrite(data, 1, size, dst_fp);
87 | fclose(dst_fp);
88 | free(data);
89 | return 0;
90 | }
91 |
92 | int main(int argc, char* argv[]) {
93 | if (argc < 2) {
94 | printf("Usage: %s [PAYLOAD] <-o OUTPUT> <-ia BASE|-ir BASE> <-a FILE> <-s FILE DEST>\n", argv[0]);
95 | printf(" [PAYLOAD] - payload path\n");
96 | printf(" -o OUTPUT - output path\n");
97 | printf(" -ir BASE - replace existing\n");
98 | printf(" -ia BASE - append after base, inject header\n");
99 | printf(" -a FILE - append file\n");
100 | printf(" -s FILE - append file and set its params in stage1\n");
101 | printf("Before adding/injecting/appending, each file is padded to 0x%X\n\n", ADDCONT_SIZE);
102 | return -1;
103 | }
104 |
105 | // parse args
106 | char *output = DEFAULT_OUTPUT;
107 | char *base = NULL;
108 | char *appends[16];
109 | uint32_t appends_dest[16];
110 | memset(appends, 0, sizeof(appends));
111 | memset(appends_dest, 0, sizeof(appends_dest));
112 | int append_count = 0;
113 | int replace = 0;
114 | for (int i = 2; i < argc; i++) {
115 | if (!strcmp(argv[i], "-o")) {
116 | if (i + 1 < argc) {
117 | output = argv[i + 1];
118 | i++;
119 | }
120 | } else if (!strcmp(argv[i], "-ir")) {
121 | if (i + 1 < argc) {
122 | base = argv[i + 1];
123 | replace = 1;
124 | i++;
125 | }
126 | } else if (!strcmp(argv[i], "-ia")) {
127 | if (i + 1 < argc) {
128 | base = argv[i + 1];
129 | i++;
130 | }
131 | } else if (!strcmp(argv[i], "-a")) {
132 | if (i + 1 < argc) {
133 | appends[append_count] = argv[i + 1];
134 | append_count++;
135 | i++;
136 | }
137 | } else if (!strcmp(argv[i], "-s")) {
138 | if (i + 1 < argc) {
139 | appends[append_count] = argv[i + 1];
140 | // check if there is a dest offset given, should start with 0x
141 | if (i + 2 < argc) {
142 | if (argv[i + 2][0] == '0' && argv[i + 2][1] == 'x') {
143 | appends_dest[append_count] = strtol(argv[i + 2], NULL, 16);
144 | i++;
145 | }
146 | }
147 | if (!appends_dest[append_count])
148 | appends_dest[append_count] = DEFAULT_STAGE2_DEST;
149 | append_count++;
150 | i++;
151 | }
152 | }
153 | }
154 |
155 | if (!argv[1]) {
156 | printf("no input set!\n");
157 | return -1;
158 | }
159 |
160 | uint32_t code_sz = getSz(argv[1]);
161 | if (!code_sz || (code_sz > (MAX_PAYLOAD_BLOCKS * BLOCK_SIZE))) {
162 | printf("invalid payload size!\n");
163 | return -1;
164 | }
165 |
166 | uint32_t payload_loc[2]; // [0] = offset, [1] = size [in blocks]
167 | payload_loc[0] = 1;
168 | // payload_loc[0] = -1; // crash
169 | payload_loc[1] = MAX_PAYLOAD_BLOCKS;
170 | // payload_loc[1] = (ALIGN_SECTOR(code_sz) / BLOCK_SIZE);
171 |
172 | if (base) {
173 | uint32_t base_sz = getSz(base);
174 | if (!base_sz) {
175 | printf("invalid base size!\n");
176 | return -1;
177 | }
178 | base_sz = ALIGN_SECTOR(base_sz);
179 | if (copyFile(base, output, base_sz))
180 | return -1;
181 | if (replace) {
182 | if (readBytes(output, 0x30, payload_loc, 8))
183 | return -1;
184 | if ((payload_loc[0] > (base_sz / BLOCK_SIZE)) || ((payload_loc[0] + payload_loc[1]) > (base_sz / BLOCK_SIZE))) {
185 | printf("invalid payload location!\n");
186 | return -1;
187 | }
188 | } else
189 | payload_loc[0] = (base_sz / BLOCK_SIZE);
190 | }
191 |
192 | void* full_va = malloc(ADDCONT_SIZE);
193 | if (!full_va) {
194 | printf("could not alloc 0x%X!\n", ADDCONT_SIZE);
195 | return -1;
196 | }
197 |
198 | // create/replace the payload
199 | int ret = 0;
200 | memset(full_va, 0, ADDCONT_SIZE);
201 | memcpy(full_va + 0x30, payload_loc, 8);
202 | if (readBytes(argv[1], 0, full_va + BLOCK_SIZE, code_sz))
203 | return -1;
204 | if (base) {
205 | if (injectBytes(output, 0x30, payload_loc, 8))
206 | return -1;
207 | if (replace)
208 | ret = injectBytes(output, payload_loc[0] * BLOCK_SIZE, full_va + BLOCK_SIZE, (payload_loc[1] * BLOCK_SIZE));
209 | else
210 | ret = appendBytes(output, full_va + BLOCK_SIZE, (payload_loc[1] * BLOCK_SIZE));
211 | } else
212 | ret = appendBytes(output, full_va, ADDCONT_SIZE);
213 | if (ret)
214 | return -1;
215 |
216 | // append additional files
217 | uint32_t s1load_params[3]; // img_offset (blocks), memory_dest, size (blocks)
218 | for (int i = 0; i < append_count; i++) {
219 | memset(full_va, 0, ADDCONT_SIZE);
220 | uint32_t sz = getSz(appends[i]);
221 | if (!sz) {
222 | printf("invalid append %s size!\n", appends[i]);
223 | return -1;
224 | }
225 | if (sz > ADDCONT_SIZE) {
226 | printf("append %s too big!\n", appends[i]);
227 | return -1;
228 | }
229 | if (readBytes(appends[i], 0, full_va, sz))
230 | return -1;
231 | if (appends_dest[i]) {
232 | if (getSz(output) % BLOCK_SIZE) {
233 | printf("cannot append stage2 to non-block-aligned image!\n");
234 | return -1;
235 | }
236 | s1load_params[0] = getSz(output) / BLOCK_SIZE;
237 | s1load_params[1] = appends_dest[i];
238 | s1load_params[2] = (ALIGN_SECTOR(sz) / BLOCK_SIZE);
239 | if (s1load_params[1] == DEFAULT_STAGE2_DEST) {
240 | if (injectBytes(output, (payload_loc[0] * BLOCK_SIZE) + STAGE1_STAGE2_PARAMBUF, s1load_params, 0xC))
241 | return -1;
242 | } else {
243 | // find the first free entry in the array
244 | uint32_t tmp[6];
245 | memcpy(tmp, s1load_params, 0xC);
246 | for (int x = 0; x < 0x10; x++) {
247 | if (readBytes(output, (payload_loc[0] * BLOCK_SIZE) + STAGE1_EXTRAS_PARAMARR + (x * 0xC), &tmp[3], 0xC))
248 | return -1;
249 | if (tmp[3] == 0xFFFFFFFF) {
250 | if (injectBytes(output, (payload_loc[0] * BLOCK_SIZE) + STAGE1_EXTRAS_PARAMARR + (x * 0xC), tmp, 2 * 0xC))
251 | return -1;
252 | break;
253 | }
254 | }
255 | }
256 | }
257 | if (appendBytes(output, full_va, ADDCONT_SIZE))
258 | return -1;
259 | }
260 |
261 | free(full_va);
262 |
263 | printf("all done!\n");
264 | }
--------------------------------------------------------------------------------
/tools/snvs.py:
--------------------------------------------------------------------------------
1 | from Crypto.Cipher import AES
2 | from Crypto.Hash import CMAC
3 | import sys
4 |
5 | def xor(data, tweak):
6 | return bytes([a ^ b for a, b in zip(data, tweak)])
7 |
8 | def aes_xts_sector(sector, key, idx, encrypt):
9 | cipher = AES.new(key[:16], AES.MODE_ECB)
10 | tweak_cipher = AES.new(key[16:], AES.MODE_ECB)
11 |
12 | output_blocks = []
13 |
14 | tweak = tweak_cipher.encrypt(idx.to_bytes(16, byteorder='little'))
15 | if encrypt == True:
16 | output_blocks.append(xor(cipher.encrypt(xor(sector[0:16], tweak)), tweak))
17 | else:
18 | output_blocks.append(xor(cipher.decrypt(xor(sector[0:16], tweak)), tweak))
19 |
20 | tweak = int.from_bytes(tweak, byteorder='little')
21 | tweak = ((tweak << 1) & (2**128 - 1)) ^ (135 if tweak >> 127 else 0)
22 | tweak = tweak.to_bytes(16, byteorder='little')
23 | if encrypt == True:
24 | output_blocks.append(xor(cipher.encrypt(xor(sector[16:32], tweak)), tweak))
25 | else:
26 | output_blocks.append(xor(cipher.decrypt(xor(sector[16:32], tweak)), tweak))
27 |
28 | return b''.join(output_blocks)
29 |
30 |
31 | if __name__ == "__main__":
32 | if len(sys.argv) != 6:
33 | print("usage: " + sys.argv[0] + " [encrypt/decrypt/cmac] ")
34 | else:
35 | mode = sys.argv[1]
36 | key = bytes.fromhex(sys.argv[2])
37 | sector_idx = int(sys.argv[3], 16)
38 | with open(sys.argv[4], 'rb') as f:
39 | input = f.read()
40 |
41 | if mode == "cmac":
42 | cmac = bytearray.fromhex(CMAC.new(key[:16], ciphermod=AES).update(bytes(bytearray(input[(sector_idx * 0x20):((sector_idx * 0x20) + 0x10)]) + bytearray(0x30))).hexdigest())
43 | output = bytearray(input)
44 | for i in range(0x10):
45 | output[(sector_idx * 0x20) + 0x10 + i] = cmac[i]
46 | with open(sys.argv[5], 'wb') as f:
47 | f.write(output)
48 | else:
49 | output_sectors = []
50 |
51 | for i in range(sector_idx * 0x20, len(input), 0x20):
52 | output_sectors.append(aes_xts_sector(input[i:(i + 0x20)], key, sector_idx + (i // 0x10), mode == "encrypt"))
53 |
54 | output = b''.join(output_sectors)
55 |
56 | with open(sys.argv[5], 'wb') as f:
57 | f.write(output)
58 |
--------------------------------------------------------------------------------
/wiring/n_mos.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SKGleba/psp2sdboot/9a9173bc28723fe1de72f6bb5811087be0cd50f1/wiring/n_mos.png
--------------------------------------------------------------------------------
/wiring/wires-pch1k.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SKGleba/psp2sdboot/9a9173bc28723fe1de72f6bb5811087be0cd50f1/wiring/wires-pch1k.png
--------------------------------------------------------------------------------
/wiring/wires-vte-back.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SKGleba/psp2sdboot/9a9173bc28723fe1de72f6bb5811087be0cd50f1/wiring/wires-vte-back.png
--------------------------------------------------------------------------------
/wiring/wires-vte-front.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SKGleba/psp2sdboot/9a9173bc28723fe1de72f6bb5811087be0cd50f1/wiring/wires-vte-front.png
--------------------------------------------------------------------------------
/wiring/wiring.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SKGleba/psp2sdboot/9a9173bc28723fe1de72f6bb5811087be0cd50f1/wiring/wiring.png
--------------------------------------------------------------------------------