Modbo 4.0 v1.99 Dump

Discussion in 'Sony Programming and Development' started by root670, Oct 24, 2015.

  1. root670

    root670 Robust Member

    Joined:
    Apr 4, 2010
    Messages:
    205
    Likes Received:
    17
    I've dumped the SPI flash from a Modbo 4.0 chip with the infamous v1.99 firmware (It still says "Infinity v1.93" in the header, which is expected since it's a modification of v1.93). It's encrypted just like the regular Matrix firmware, but it's longer and contains different bytes in a few areas. Because there are some sections that are near identical with the exception of a few changed bytes, it must be encrypted with a sort of stream cipher rather than a block cipher. Also, there's a chunk of unencrypted code at the end that is used to communicate with the chip at 0xFF00. There's similar code in the official Matrix update tool, but this chip is supposedly non-upgradable so I'm not sure when it would be used. Communication begins by pulling the DVD controller (0x1F801800 on the PS1-based updaters) and then writing "M" to the BOOTROM address (0xBFC00000 on PS1, x1FC00000 on PS2).

    Hopefully someone will find this useful, or at least interesting. I've included the firmware files for v1.28, v1.30, v1.82, and v1.93 that I extracted from their respective updater ELFs for comparison to v1.99. The firmware is only 64KB, but the Modbo 4.0 dump is 512KB with the same 64KB chunk repeated 8 times.

    Maybe someone can dump a Modbo 5 chip? I wonder if it's encrypted with the same method as this chip used.

    Edit: The flash had to be removed from the chip so I figured I sactifice the main CPLD as well to find any helpful markings. The bottom of the chip reads "1432M6-1" and then "02 G03" in a circle inscribed on the bottom. On the PCB it reads "M5-4.0/9A A.0" where the chip was sitting.
     

    Attached Files:

    Last edited: Oct 24, 2015
  2. GillBert

    GillBert Spirited Member

    Joined:
    Jul 27, 2012
    Messages:
    101
    Likes Received:
    39
    I also had made a dump of a SPI flash from a genuine MI 1.93 (I can't remember if the chip was an orange or green dot, dunno if it does matter anway). It was useful for me once when I managed to recover a fault chip after a bad flash (the MI recovery flash feature didn't work for some reason). Mine is 128KB of size while yours is 64KB, do you know why? I compared them with HxD editor and there are some few differences between the two.

    I'm wondering if would be possible to hack it a little, just for fun. Maybe changing the Matrix splash logo or something?
     

    Attached Files:

    Last edited: Oct 25, 2015
  3. root670

    root670 Robust Member

    Joined:
    Apr 4, 2010
    Messages:
    205
    Likes Received:
    17
    Yours is in 64KB chunks as well, but it's repeated twice. The differences are probably the settings saved in the configuration menu. There's also 4 bytes at 0xFFFC that might be a checksum.

    Would using a BIOS dumper while the chip is enabled allow for the kernel patches to be dumped as well? That might reveal the changes present in the v1.99 firmware.
     

Share This Page