JTag Port on PS3 Blu-ray Drive Board Located and Mapped


236w ago - Developers at DemonHades have located and mapped the JTag Port on a PS3 Blu-ray drive board today.

To quote, roughly translated: I found the JTag port for the Blu-ray Reader on the PlayStation 3. Last night after finishing the research meeting I went looking for information about BD integrated reader.

In and looking at the information that I found on the back of the plate reader I saw that there is no connector terminals, these terminals belong to a connector which connects 'something' via terminals and through the Internet I found the points used in a JTag, including the TDO, TDI, TMS etc.

Originally developed for printed circuit boards, it is currently used for test of submodules of integrated circuits, and is also useful as a mechanism for debugging embedded applications, as it provides a backdoor to within the system.

When used as a debugging tool, an in-circuit emulator that uses JTag as the transport mechanism allows the programmer to access the debugging module that is integrated into the CPU. The debug module enables the programmer to correct their errors and code logic of their systems.

There are consumer products that have a JTag port integrated, so that the connections are often available on the PCB as part of the prototype phase of the product. These connections can provide a simple way to reverse-engineer.

As you can see we have a door strike to try to get the firmware, decrypted data, and all that is able to control the Blu-ray reader.

The data from this integrated JTag will CXD5063GG-1. CXD5063GG-1 = ASIC / CPU - Video Decryption Device Sony Computer Entertainment Inc., CXD5063GG-1, 2005 SCEI, 120,748 0608HAL.







Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!

Comments 50 Comments - Go to Forum Thread »

• Please Register at PS3News.com or Login to make comments on Site News articles. Thanks!

xhugox's Avatar
#50 - xhugox - 234w ago
I like the idea of attacking a part which has been announced to be blocked by Sony already.
Because if we are able to bypass this block, the signals we put in are most likely not checked by any software.

Why should they double check?

DemonHades's Avatar
#49 - DemonHades - 234w ago
hi guys i find new information mcu CXD5063-GG-1,tonight i find new information show details for best study,special mention at AD5620 (is how a mx25).

OUT (Pin 1): Analog Output. In normal filtering, this is the output of an internal operational amplifier and is capable of swinging essentially to any voltage between the power supply rails (that is, between V+ and V C). This output is designed to drive a nominal load of 5k and 50pF. For lowest signal distortion it should be loaded as lightly as possible. The output can drive lower resistances than 5k, but distortion may increase, and the output current will limit at approximately 10mA. Capacitances higher than 50pF should be isolated by a series resistor of 500Ω to preserve AC stability. In the Mute state (F code 0000 or RST = 0), the output operates as in normal filtering but the gain from the IN pin becomes zero and the output noise is reduced. In the shutdown state (EN = 1 or EN open circuited), most of the circuitry in the CXD5063GG-1 shuts off and the OUT pin assumes a high impedance state.

The AD5620/AD5640/AD5660 on-chip precision output amplifier allows rail-to-rail output swing to be achieved. For remote sensing applications, the output amplifiers inverting input is available to the user. The AD5620/AD5640/AD5660 use a versatile 3-wire serial interface that operates at clock rates up to 30 MHz and is compatible with standard SPIŽ, QSPI™, MICROWIRE™, and DSP interface standards.

4.4.2 Group B inspection. Group B inspection shall be conducted in accordance with the conditions specified for subgroup testing in tables VIb (JAN, JANTX, and JANTXV) of MIL-PRF-19500 and paragraphs 4.4.2.1 herein. Electrical measurements (end-points) shall be in accordance with table I, group A, subgroup 2 herein.

Note 13: Machine Model ESD test is covered by specification EIAJ IC-121-1981. A 200 pF cap is charged to the specific voltage, then discharged directly into the IC with no external series resistor (resistance of discharge path must be under 50Ω.
AVX Paignton is the Divisional Headquarters for the Tantalum division which has manufacturing locations in Paignton in the UK, Biddeford in Maine, USA, Juarez in Mexico, Lanskroun in the Czech Republic and El Salvador. The Division takes its name from the raw material used to make its main products, Tantalum Capacitors.

1saludo and regards

hosmy's Avatar
#48 - hosmy - 235w ago
Yop it was already dumped and as to same time the ps3 devs recognized that the bd fw is also present in the ps3 fw the guy who dumped the spansion stated that the encryption of the BD-FW will also be SHA256bit and he stoped his work.

No offence meant but some times it will be better to not let your enemy know that your behind his backplate.

Xbox hackers got the dvdkeys thru power cable, this tells me we need to try while drive is running and not using a programmer. Has anyone connected bdrom to pc via IDE?

Just my 0.02$

PS3 News's Avatar
#47 - PS3 News - 235w ago
It would be a nice little community project because a lot of us useless folks want to help in some way.
Ya, we're drifting from the JTag topic for this thread... but to answer: If you know someone who wishes to start up a project like this and can code then we could support it sure, however the PS3 Devs on IRC are not interested in such a project so it would require other people to do it.

semitope's Avatar
#46 - semitope - 235w ago
Thats all well and good but where is the important information of just how quickly the keys could be guessed (with a well coded app) on each machine and what machine specs got him to that 2 mill keys/sec. Also is it really going to go sequentially like that? So that at the end of those 50-3970923kaokfhsaieuyr0098347-2 years is when the key would be found or could someone get lucky and end up with the key in even 1 month?

It would be a nice little community project because a lot of us useless folks want to help in some way.













Affiliates - Contact Us - PS3 Downloads - Privacy Statement - Site Rules - Top - © 2014 PlayStation 3 News