PS2 Julian's various PS2 projects (Worklog)

uyjulian said:
The difference in the ROMs between Sys246 and Sys256:
rom0 only has changes in EXTINFO, KERNEL, RDRAM, RESET, and ROMDIR (probably to handle clock speed and/or RAM size. Haven't diffed yet)

Sys148 and Sys256 have same KERNEL, RDRAM binary
Sys246, Sys147, and Sys148 have same RESET binary
Click to expand...
Also it seems some system256 don't hold model name on EEPROM. a mistake? something intentional? making place for something else?
 
Last edited:
A few things I found while diffing 3.1.0 cdvdstm (same code as 3.0.0 cdvdstm) with XOSD cdvdstm (which reports version as 3009p)

sceSifDmaStat is wrapped to disable interrupts while in non-interrupt state
Instead of sceCdGetDiskType(), use sceCdSC(0xFFFFFFDA, &scres)

Not sure why they didn't decide to implement the first change in 3.1.0 cdvdstm.
 
Random ideas for RDRAM-less operation:

* If can't boot to OSD and load MC update due to malfunctioning RDRAM, need custom ROM to load from another source without using RDRAM
* Can't perform RWX operations with RDRAM when not initialized
* Can't use DMA where source/destination is RDRAM. Notably includes SIF DMA
* Can perform RWX operations with IOP RAM/peripherals, VU0 code/data, VU1 code/data
* Can't perform X operations with SPR, but can RW
* As long as DMA from/to RDRAM is not used, GS can be used
 
SecrDiskBootFile doesn't appear to bounds check. If it is possible to control what transforms the input of scmd 0x8D into the output of scmd 0x8E, it should be possible to overwrite $ra and gain code execution on the IOP.
 
Last edited:
I diffed cdvdfsv between 3.0.0 and 3.1.0
* Calls to sceSifDmaStat have been wrapped in interrupt-disabled state
* sceCdReadChain can be interrupted with sceCdBreak
* If buffer length for CDDA read is above 24, 4 bytes after the buffer will be sent in a separate DMA transfer (sceSifSetDma)
 
It seems like, for Sony BRAVIA TVs, they stopped using the XMB (and instead went exclusively towards bottom bar or panel menu) after KDL-32EX700 (2010 model, at least for US and Japan regions).
The DMX/DMeX support seems to have disappeared after KDL-40XBR9 (2009 model, at least for US)
 
Last edited:
Some oddities with IOP modules from XOSD:

* Missing .symtab and .strtab sections
* For sections in program headers, the distance of sh_addr/sh_offset between entries don't agree. (Since LOADCORE loads and places the program header and not each section individually, calculate offsets with sh_offset instead)
* sh_addralign is over 16 (seen examples of it being set to 128)
 
NBGI S256 appears to use 64MB RDRAM (2x Samsung K4R881869E-GCT9) and 4MB EDORAM (2x ISSI IS41LV16100B-50TL).
NBGI S148 appears to use 64MB RDRAM (2x Samsung K4R881869E-GCT9) and 4MB EDORAM (2x ISSI IS41LV16100C-50TLI).
 
A note about sce_cdvd_lsn

The syntax is:

cdromX:sce_cdvd_lsnYYY_sizeZZZ

where X is the layer (0 or 1), Y is the wanted LSN (base 10), and Z is the wanted size.
The max length (after the colon) is 128 bytes, but the check is flawed (doesn't take the _sizeZZZ portion into account)
 
It appears that for SCMD 0x17 (sceCdRM), it is possible to do a out of bounds read (a unsigned byte is used for the offset).
The auto adjust flag setting can be accessed in the region accessible.

I checked this exists on mechacon firmware 50000 and 61200.
 
You must log in or register to reply here.

Similar threads

Back
Top