| View previous topic :: View next topic |
| Author |
Message |
crazyc
Joined: 17 Jun 2005
Posts: 410
|
 Posted: Thu Jan 10, 2008 8:02 am Post subject: |
 |
|
| adrahil wrote: | | Damn, sony are so lazy :) |
Cheap, if you ask me. They couldn't do the right thing and use SD. Instead they had to eat their own dogfood to save a few pennies, even though it tastes like crap. BTW, before anyone gets any ideas about a MSIO usb host controller, i've only found one device which actually uses MSIO, and it's a wlan adapter. |
|
| Back to top |
|
 |
cloudhunter
Joined: 17 Aug 2006
Posts: 86
|
| Posted: Thu Jan 10, 2008 5:24 pm Post subject: |
|
|
| crazyc wrote: | | adrahil wrote: | | Damn, sony are so lazy :) |
Cheap, if you ask me. They couldn't do the right thing and use SD. Instead they had to eat their own dogfood to save a few pennies, even though it tastes like crap. |
Nah... You know Sony :) Rather than go for the most supported memory, you have to use the chance to sell your own Memory Stick Duo's ;)
That Wifi stick seems interesting - so there is a chance that the memory stick could be used to connect an external device.
Cloudy
_________________
:) |
|
| Back to top |
|
|
adrahil
Joined: 16 Mar 2006
Posts: 277
|
| Posted: Fri Jan 11, 2008 12:22 am Post subject: |
|
|
| Their choice is not to save money :) Why do you think there is a fatty mgr.prx around up from 1.0? :) Well, their scheme uses MagicGate (memory-stick binding) for various content.... It's more of a security question, as the SD controllers are trivial to use and do not posess any such scheme. |
|
| Back to top |
|
|
KickinAezz
Joined: 03 Jun 2007
Posts: 328
|
| Posted: Fri Jan 11, 2008 9:42 am Post subject: |
|
|
Donot want to ask but,
Is the possibility of 54g being investigated?
Like others said, it would be homebrew's best and greatest hack! Not to mention massive speed improvement. :D
_________________
Intrigued by PSP system Since December 2006.
Use it more for Development than for Gaming. |
|
| Back to top |
|
|
adrahil
Joined: 16 Mar 2006
Posts: 277
|
| Posted: Fri Jan 11, 2008 3:57 pm Post subject: |
|
|
| Well, I'm now investigating how the data moves around, right now :) (I guess DMA, otherwise we're locked at 3Kb/s at the maximum) The problem is that we need to modify the marvell firmware which is included (magpie or voyager) in order to achieve G... And for this, it's needed to know more about how the chip works, etc. |
|
| Back to top |
|
|
KickinAezz
Joined: 03 Jun 2007
Posts: 328
|
| Posted: Sat Jan 19, 2008 11:48 pm Post subject: |
|
|
Any updates?
_________________
Intrigued by PSP system Since December 2006.
Use it more for Development than for Gaming. |
|
| Back to top |
|
|
KickinAezz
Joined: 03 Jun 2007
Posts: 328
|
| Posted: Mon Jan 21, 2008 12:16 am Post subject: |
|
|
From Marvel docs:
HwSpec->FwCapabilityInformation returns
0x1000e59f.
Does it(firmware) mean it supports 802.11g based on bit 9?
_________________
Intrigued by PSP system Since December 2006.
Use it more for Development than for Gaming. |
|
| Back to top |
|
|
adrahil
Joined: 16 Mar 2006
Posts: 277
|
| Posted: Mon Jan 21, 2008 12:48 am Post subject: |
|
|
| It is possible ;) But the problem is that sony have remapped some of the bits at their willing... The documentation is for the official marvell firmware. Sony only use a custom subset of it, based on some sloppy implementation. (I am talking about magpie/voyager) |
|
| Back to top |
|
|
KickinAezz
Joined: 03 Jun 2007
Posts: 328
|
| Posted: Mon Jan 21, 2008 12:55 am Post subject: |
|
|
| adrahil wrote: | | It is possible ;) But the problem is that sony have remapped some of the bits at their willing... The documentation is for the official marvell firmware. Sony only use a custom subset of it, based on some sloppy implementation. (I am talking about magpie/voyager) |
I would be ecstatically jubiliant if you confirm you are still working on this project of Utopian scale :D
_________________
Intrigued by PSP system Since December 2006.
Use it more for Development than for Gaming. |
|
| Back to top |
|
|
jimparis
Joined: 10 Jun 2005
Posts: 1179
Location: Boston
|
| Posted: Mon Jan 21, 2008 12:18 pm Post subject: |
|
|
| 0x1000e59f & (1 << 9) is of course 0, so the answer is "no" unless they've moved bits around like adrahil says.. |
|
| Back to top |
|
|
KickinAezz
Joined: 03 Jun 2007
Posts: 328
|
| Posted: Mon Jan 21, 2008 1:38 pm Post subject: |
|
|
| jimparis wrote: | | 0x1000e59f & (1 << 9) is of course 0, so the answer is "no" unless they've moved bits around like adrahil says.. |
Yeah.
_________________
Intrigued by PSP system Since December 2006.
Use it more for Development than for Gaming. |
|
| Back to top |
|
|
KickinAezz
Joined: 03 Jun 2007
Posts: 328
|
| Posted: Sun Jan 27, 2008 5:46 am Post subject: |
|
|
Any progress updates on 54g/ Magpie Voyager hacks?
**Eyes wide open w/excitement**
_________________
Intrigued by PSP system Since December 2006.
Use it more for Development than for Gaming. |
|
| Back to top |
|
|
crazyc
Joined: 17 Jun 2005
Posts: 410
|
| Posted: Sun Jan 27, 2008 6:59 am Post subject: |
|
|
| KickinAezz wrote: | Any progress updates on 54g/ Magpie Voyager hacks?
**Eyes wide open w/excitement** |
I personally don't believe this will be possible. There's documentation showing the RF chip supports OFDM, but nothing for the MAC. Even if it does, it's probable the firmware was written specifically for the PSP and may lack support for 802.11g. |
|
| Back to top |
|
|
crazyc
Joined: 17 Jun 2005
Posts: 410
|
| Posted: Thu Jan 31, 2008 3:16 pm Post subject: |
|
|
| Like the 88w8388 described at OLPC, the 88w8381 in the fat psp has a built in ROM mapped at 0xfff00000, but it's only 32KB rather then 128KB. If anyone is interested in dumping it, I can post the details. |
|
| Back to top |
|
|
KickinAezz
Joined: 03 Jun 2007
Posts: 328
|
| Posted: Fri Feb 01, 2008 5:50 am Post subject: |
|
|
| crazyc wrote: | | Like the 88w8388 described at OLPC, the 88w8381 in the fat psp has a built in ROM mapped at 0xfff00000, but it's only 32KB rather then 128KB. If anyone is interested in dumping it, I can post the details. |
I am willing to.
What is 88w388 and OLPC?
_________________
Intrigued by PSP system Since December 2006.
Use it more for Development than for Gaming. |
|
| Back to top |
|
|
crazyc
Joined: 17 Jun 2005
Posts: 410
|
| Posted: Sat Feb 02, 2008 8:02 am Post subject: |
|
|
| KickinAezz wrote: | | I am willing to. |
You misunderstand, I know it works. I just want to know if anyone else is working on reverse engineering the wlan interface and chip wants to dump the builtin ROM. |
|
| Back to top |
|
|
KickinAezz
Joined: 03 Jun 2007
Posts: 328
|
| Posted: Sat Feb 02, 2008 8:04 am Post subject: |
|
|
| crazyc wrote: | | KickinAezz wrote: | | I am willing to. |
You misunderstand, I know it works. I just want to know if anyone else is working on reverse engineering the wlan interface and chip wants to dump the builtin ROM. |
I will try checking the dump myself. Could you post those details?
I think PSP is hacked sufficiently enough. Only thing left is this.
I have previous experiencing playing with NVRAM variables in routers :D
_________________
Intrigued by PSP system Since December 2006.
Use it more for Development than for Gaming. |
|
| Back to top |
|
|
crazyc
Joined: 17 Jun 2005
Posts: 410
|
| Posted: Sun Feb 03, 2008 7:34 am Post subject: |
|
|
| KickinAezz wrote: | I will try checking the dump myself. Could you post those details?
I think PSP is hacked sufficiently enough. Only thing left is this.
I have previous experiencing playing with NVRAM variables in routers :D |
Actually, the AVC hasn't been figured out yet ether, but that is even harder. Anyway, if you want to know.
1) in psplink (1.5 kernel only) with the wlan switch off do | Code: | pokew 0x88196474 0x46c06841
pokew 0x8818df48 0x46c046c0 |
(hopefully these address will be the same)
2) switch on the wlan and do | Code: | thsusp @SceWlanMac
thsusp @SceWlanHal |
3) run this program | Code: | #include <pspkernel.h>
#include <pspdebug.h>
PSP_MODULE_INFO("wlan_test", 0x1000, 1, 1);
PSP_MAIN_THREAD_ATTR(0);
/* IO_MEM_STICK_CMD = EX_SET_CMD | 0x7
* buf[0] = 0xb4 read, 0xb3 write
* buf[1] = size >> 8
* buf[2] = size
* buf[3] = address >> 24
* buf[4] = address >> 16
* buf[5] = address >> 8
* buf[6] = address
* buf[7] = 0
* address is offset + 0xc0000000 in arm address space, read only
* except 0x100 which is a special case
*/
// HW registers
#define IO_MEM_STICK_CMD *((volatile int*)(0xBD300030))
#define IO_MEM_STICK_DATA *((volatile int*)(0xBD300034))
#define IO_MEM_STICK_STATUS *((volatile int*)(0xBD300038))
#define IO_MEM_STICK_SYS *((volatile int*)(0xBD30003C))
// STATUS bit
#define MS_FIFO_RW 0x4000
#define MS_RDY 0x1000
#define MS_TIME_OUT 0x0100
#define MS_CRC_ERROR 0x0200
// MS command code
#define READ_PAGE_DATA 0x2000
#define READ_REG 0x4000
#define READ_IO_DATA 0x5000
#define GET_INT 0x7000
#define SET_RW_REG_ADRS 0x8000
#define EX_SET_CMD 0x9000
#define WRITE_IO_DATA 0xA000
#define WRITE_REG 0xB000
#define WRITE_PAGE_DATA 0xD000
#define SET_CMD 0xE000
// MS status bit
#define INT_REG_CED 0x80
#define INT_REG_ERR 0x40
#define INT_REG_BREQ 0x20
#define INT_REG_CMDNK 0x01
#define swap_binh(out, in) __asm__( "wsbh %0, %1\n" \
"rotr %0, %0, 16\n" \
:"=r"(out):"r"(in));
typedef struct {
uint16_t CmdCode;
uint16_t Size;
uint16_t SeqNum;
uint16_t Result;
uint16_t Action;
uint16_t Offset;
uint32_t Value;
} libertas_mac_reg;
static int ms_get_reg_int(void)
{
int ret, dummy, status;
IO_MEM_STICK_CMD = GET_INT | 0x1;
do{
status = IO_MEM_STICK_STATUS;
if(status & MS_TIME_OUT)
{
#if SHOW_ERR_MSG
Kprintf("err:get_reg_int timeout\n");
#endif
return -1;
}
}while(!(status & MS_FIFO_RW));
ret = IO_MEM_STICK_DATA;
dummy = IO_MEM_STICK_DATA;
do{
status = IO_MEM_STICK_STATUS;
if(status & MS_TIME_OUT)
{
#if SHOW_ERR_MSG
Kprintf("err:get_reg_int timeout\n");
#endif
return -1;
}
}while(!(status & MS_RDY));
return ret & 0xff;
}
int buf[4];
int bigbuf[(32*1024)/4];
void busy_wait(int mask)
{
int i;
while(!(IO_MEM_STICK_STATUS & mask)) sceKernelDelayThread(1000);
}
int main()
{
int count, i;
libertas_mac_reg *reg = (libertas_mac_reg *)&buf;
reg->CmdCode = 0x19;
reg->Size = sizeof(libertas_mac_reg);
reg->SeqNum = 0;
reg->Result = 0;
reg->Action = 0;
reg->Offset = 0;
reg->Value = 0xfff00000;
for(count = 0; count < ((32*1024)/4); count++)
{
printf("%d\n", count);
busy_wait(0x1000);
IO_MEM_STICK_CMD = EX_SET_CMD | 7;
busy_wait(0x4000);
IO_MEM_STICK_DATA = 0xb4 | ((sizeof(libertas_mac_reg) >> 8) << 8) | ((sizeof(libertas_mac_reg) & 0xff) << 16); //0x001000b4
busy_wait(0x4000);
IO_MEM_STICK_DATA = 0x100;
busy_wait(0x2000);
//while(!(ms_get_reg_int() & 0x20));
IO_MEM_STICK_CMD = WRITE_IO_DATA | sizeof(libertas_mac_reg);
busy_wait(0x4000);
swap_binh(IO_MEM_STICK_DATA, buf[0]); //0x19001000
busy_wait(0x4000);
swap_binh(IO_MEM_STICK_DATA, buf[1]); //0
busy_wait(0x4000);
IO_MEM_STICK_DATA = __builtin_allegrex_wsbw(buf[2]); //0
busy_wait(0x4000);
IO_MEM_STICK_DATA = __builtin_allegrex_wsbw(buf[3]); //0
busy_wait(0x2000);
while(!(ms_get_reg_int() & INT_REG_CED)) sceKernelDelayThread(1000);
IO_MEM_STICK_CMD = EX_SET_CMD | 7;
busy_wait(0x4000);
IO_MEM_STICK_DATA = 0xb3 | ((sizeof(libertas_mac_reg) >> 8) << 8) | ((sizeof(libertas_mac_reg) & 0xff) << 16); //0x001000b3
busy_wait(0x4000);
IO_MEM_STICK_DATA = 0x100;
busy_wait(0x2000);
//while(!(ms_get_reg_int() & 0x20));
IO_MEM_STICK_CMD = READ_IO_DATA | sizeof(libertas_mac_reg);
busy_wait(0x4000);
i = IO_MEM_STICK_DATA;
busy_wait(0x4000);
i = IO_MEM_STICK_DATA;
busy_wait(0x4000);
i = IO_MEM_STICK_DATA;
busy_wait(0x4000);
bigbuf[count] = __builtin_allegrex_wsbw(IO_MEM_STICK_DATA);
reg->Value+=4;
}
sceKernelSleepThread();
return 0;
} |
4) in psplink do | Code: | | savemem 0x890DF4C 0x8000 wlan_builtin_rom |
|
|
| Back to top |
|
|
KickinAezz
Joined: 03 Jun 2007
Posts: 328
|
| Posted: Sun Feb 03, 2008 10:06 am Post subject: |
|
|
Will try ASAP.
_________________
Intrigued by PSP system Since December 2006.
Use it more for Development than for Gaming.
Last edited by KickinAezz on Sun Feb 10, 2008 1:26 am; edited 1 time in total |
|
| Back to top |
|
|
KickinAezz
Joined: 03 Jun 2007
Posts: 328
|
| Posted: Sun Feb 10, 2008 1:18 am Post subject: |
|
|
The builtin rom seems to be a Plain module? No NVRAM vars or anything.
Any people could probably do/find something incredible out of this:
Prxtool disassembly Output
THERE IS NO COPYRIGHT LINE in the module, Can I post the binary here?
_________________
Intrigued by PSP system Since December 2006.
Use it more for Development than for Gaming. |
|
| Back to top |
|
|
crazyc
Joined: 17 Jun 2005
Posts: 410
|
| Posted: Sun Feb 10, 2008 3:58 am Post subject: |
|
|
| KickinAezz wrote: | | THERE IS NO COPYRIGHT LINE in the module, Can I post the binary here? |
Huh? What about "Copyright (c) 1996-2001 Express Logic Inc. * ThreadX THUMB/ARM9 Version G4.0.4.0 *". It's not a Marvell copyright but nonetheless... | Quote: | | Prxtool disassembly Output |
prxtool is only for psp prx's. Not only is the WLAN ROM not a prx, it's not even MIPS.
BTW, the mac hardware registers strongly suggest no 802.11g support. |
|
| Back to top |
|
|
KickinAezz
Joined: 03 Jun 2007
Posts: 328
|
| Posted: Sun Feb 10, 2008 4:37 am Post subject: |
|
|
| crazyc wrote: | | KickinAezz wrote: | | THERE IS NO COPYRIGHT LINE in the module, Can I post the binary here? |
Huh? What about "Copyright (c) 1996-2001 Express Logic Inc. * ThreadX THUMB/ARM9 Version G4.0.4.0 *". It's not a Marvell copyright but nonetheless... | Quote: | | Prxtool disassembly Output |
prxtool is only for psp prx's. Not only is the WLAN ROM not a prx, it's not even MIPS.
|
Oops I tried it from PBP which might have overwritten everything from 0x8900000.
Result: It dumped itself xD
_________________
Intrigued by PSP system Since December 2006.
Use it more for Development than for Gaming. |
|
| Back to top |
|
|
KickinAezz
Joined: 03 Jun 2007
Posts: 328
|
| Posted: Sun Feb 10, 2008 6:58 am Post subject: |
|
|
crazyc,
Could you post the makefile?
I tried 2 ways to run it.
1: as a prx. I get a blank 32k.
2: As a pbp. What I get is NOT even close to your's and I donot see any Copyright line.
I highly hope to have a chance to look at my own psp's wlan rom.
EDIT: I do it from CFW 3.90 under 1.50 kernel, could it be a problem?
_________________
Intrigued by PSP system Since December 2006.
Use it more for Development than for Gaming. |
|
| Back to top |
|
|
KickinAezz
Joined: 03 Jun 2007
Posts: 328
|
| Posted: Thu Feb 14, 2008 6:37 am Post subject: |
|
|
| KickinAezz wrote: | crazyc,
Could you post the makefile?
I tried 2 ways to run it.
1: as a prx. I get a blank 32k.
2: As a pbp. What I get is NOT even close to your's and I donot see any Copyright line.
I highly hope to have a chance to look at my own psp's wlan rom.
EDIT: I do it from CFW 3.90 under 1.50 kernel, could it be a problem? |
Post unnoticed?
_________________
Intrigued by PSP system Since December 2006.
Use it more for Development than for Gaming. |
|
| Back to top |
|
|
crazyc
Joined: 17 Jun 2005
Posts: 410
|
| Posted: Fri Feb 15, 2008 3:09 am Post subject: |
|
|
| KickinAezz wrote: | | KickinAezz wrote: | crazyc,
Could you post the makefile?
I tried 2 ways to run it.
1: as a prx. I get a blank 32k.
2: As a pbp. What I get is NOT even close to your's and I donot see any Copyright line.
I highly hope to have a chance to look at my own psp's wlan rom.
EDIT: I do it from CFW 3.90 under 1.50 kernel, could it be a problem? |
Post unnoticed? |
Missed this. The instructions assumed that the bigbuf variable would be in the same place when anyone else complied it. That isn't true of course. Do
| Code: | | psp-objdump -t wlan_test |grep bigbuf |
to the unstripped binary to get the savemem address. |
|
| Back to top |
|
|
KickinAezz
Joined: 03 Jun 2007
Posts: 328
|
| Posted: Fri Feb 15, 2008 7:43 am Post subject: |
|
|
| crazyc wrote: | Missed this. The instructions assumed that the bigbuf variable would be in the same place when anyone else complied it. That isn't true of course. Do
| Code: | | psp-objdump -t wlan_test |grep bigbuf |
to the unstripped binary to get the savemem address. |
Still no Success.
Steps:
1) With WLAN off, I do %prepinit which does:
| Code: | pokew 0x88196474 0x46c06841
pokew 0x8818df48 0x46c046c0
|
2) I wait a few seconds. Turn on WLAN switch and do %preppost which does:
| Code: | thsusp @SceWlanMac
thsusp @SceWlanHal |
3) Then wait a few seconds. Then type ./wlanromdump/wlanromdump.elf
4) Then I double checke the address given by printf("%p",&bigbuf); and
psp-objdump -t wlanromdump.elf |grep bigbuf
Both give me 0x891590c.
5)When I do | Code: | | savemem 0x891590c 0x8000 wlanrom |
I get a text file with all 00's; an empty 32 kb.
I tried:
1) Disabling optimization "-o0" flag
2) Trying again and again.
Any ideas?
--
Could you try the elf in the below package and see it still works for you? If it does, I have done something wrong.
http://www.sendspace.com/file/w7iqi3
-
Is your PM box full?
_________________
Intrigued by PSP system Since December 2006.
Use it more for Development than for Gaming. |
|
| Back to top |
|
|
crazyc
Joined: 17 Jun 2005
Posts: 410
|
| Posted: Sun Feb 17, 2008 1:04 am Post subject: |
|
|
| KickinAezz wrote: |
Any ideas?
|
Do | Code: | | modinfo @sceWlan_Driver |
in psplink and post what it prints. |
|
| Back to top |
|
|
KickinAezz
Joined: 03 Jun 2007
Posts: 328
|
| Posted: Sun Feb 17, 2008 9:47 am Post subject: |
|
|
| crazyc wrote: | | KickinAezz wrote: |
Any ideas?
|
Do | Code: | | modinfo @sceWlan_Driver |
in psplink and post what it prints. |
| Code: | UID: 0x029B5539 Attr: 1006 - Name: sceWlan_Driver
Entry: 0x881875C8 - GP: 0x881B9CE0 - TextAddr: 0x88187500
TextSize: 0x00013C9C - DataSize: 0x00016B40 BssSize: 0x00000093
Segment 0: Addr 0x88187500 - Size 0x00013CA8
Segment 1: Addr 0x8819B1B0 - Size 0x00016B40 |
_________________
Intrigued by PSP system Since December 2006.
Use it more for Development than for Gaming. |
|
| Back to top |
|
|
crazyc
Joined: 17 Jun 2005
Posts: 410
|
| Posted: Sun Feb 17, 2008 1:01 pm Post subject: |
|
|
| KickinAezz wrote: | Steps:
1) With WLAN off, I do %prepinit which does:
| Code: | pokew 0x88196474 0x46c06841
pokew 0x8818df48 0x46c046c0 |
|
Change these to | Code: | pokew 0x8819B1B0+0x89C4 0x46c06841
pokew 0x8819B1B0+0x498 0x46c046c0 |
I hoped that the kernel would load the same with all versions of 1.5 compatibility mode, but i guess not. |
|
| Back to top |
|
|
KickinAezz
Joined: 03 Jun 2007
Posts: 328
|
| Posted: Sun Feb 17, 2008 11:27 pm Post subject: |
|
|
| crazyc wrote: | | KickinAezz wrote: | Steps:
1) With WLAN off, I do %prepinit which does:
| Code: | pokew 0x88196474 0x46c06841
pokew 0x8818df48 0x46c046c0 |
|
Change these to | Code: | pokew 0x8819B1B0+0x89C4 0x46c06841
pokew 0x8819B1B0+0x498 0x46c046c0 |
I hoped that the kernel would load the same with all versions of 1.5 compatibility mode, but i guess not. |
I do see the Express Logic line, but it isn't at the end of the file; it's @ offsett 0x530a [in the middle of the file], Is it normal, or did I get get the partial rom
You said MAC registers strongly suggest no 54g compatibility, But I donot see any plain text?
OK, I see it "Marvell 88W8300 802.11b PC Card Version 1.1" My unlucky PSP :(
--
However, there's hope for others with Marvell 88w8010 :D
| Quote: |
The 88W8010 is an upgraded (802.11g) version of 88W8000 (which only supports 802.11b). So this chip is fine. The one in question is 88W8380. If it is based on 88W8300, then it only supports 802.11b. But if it is based on 88W8310, then it is 802.11g capable (54Mbps, about five times faster than 11Mbps of 802.11b). The 88W8310 chip also support 802.11i and 802.11e, which is AES (WPA) and QoS (quality of service). Maybe someone has more info on the 88W8380 chip. If it is based on 88W8310 (not 88W8300), then the PSP actually supports 802.11g, but not activated.
|
_________________
Intrigued by PSP system Since December 2006.
Use it more for Development than for Gaming. |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
