<Sarayan>
oh damn it's going to be more complicated than I expected
futarisIRCcloud has joined #prjmistral
<Sarayan>
ok, gonna wing it and fixup after
fdalleau`` has quit [Ping timeout: 272 seconds]
fdalleau`` has joined #prjmistral
fdalleau`` has quit [Ping timeout: 256 seconds]
<Sarayan>
hmmm, the mlabs are having a hard time making sense
<Sarayan>
oh, I see, they magicked some stuff
<Sarayan>
and they dropped the local interconnect
<Sarayan>
in fact labs and mlabs are amusingly different
<Sarayan>
oh *DUH*, I'm mixing mlab and m10k
<Sarayan>
no wonder it's different
fdalleau`` has joined #prjmistral
<Lofty>
Sarayan: woops :P
kc8apf_ has joined #prjmistral
kc8apf has quit [*.net *.split]
kc8apf_ is now known as kc8apf
jevinskie[m] has quit [Remote host closed the connection]
emily has quit [Write error: Connection reset by peer]
emily has joined #prjmistral
fdalleau` has joined #prjmistral
fdalleau`` has quit [Ping timeout: 272 seconds]
jevinskie[m] has joined #prjmistral
fdalleau` has quit [Ping timeout: 260 seconds]
<jevinskie[m]>
Womp, womp. The target bitstream of interest has all 0s in the m4k blocks. No secret bootrom :(
<Lofty>
That sucks
<daveshah>
Unless it is a small secret bootrom using LUTs as ROM?
<Sarayan>
Phew, 702014 routes done out of 2263706, it's a start
<Sarayan>
(one route = one wire, its connections, and all the associated firmware bits, turned into a small piece of code instead of a giant table)
<Sarayan>
plus understanding what wires connects to what BEL when appropriate
<chipb>
jevinskie[m]: bootrom for?
<chipb>
oh, for a specific target board.
<chipb>
it wouldn't especially surprise me if your bitstream stores key material in LUTs.
<jevinskie[m]>
Yes a console dev kit
<jevinskie[m]>
Yes another theory is that it decrypts the bootloader in place in some shared SRAM. So next step will be trying to dump the LUTs to search for sboxes or high entropy data that might be a key
<chipb>
what arch is the cpu? is it the console's native or custom?
<chipb>
got a link to info on the board?
<sorear>
watch as it turns out to be something like "xor each byte with 42"
<chipb>
yeah. that's also at the back of my mind. heh.
<chipb>
they probably chain in a counter or xor the address with it at least. :-P
<chipb>
and the cpu's in the soft logic of your cyclone part?
<jevinskie[m]>
Cyclone part is labeled for “shared memory” and we aren’t entirely clear what it does. CPU is in a Sony SoC. There is a coprocessor called tachyon in the SoC that might decrypt the kbooti, that’s the only other theory if the FPGA isn’t doing it
<sorear>
the PSP has a FPGA?
<Lofty>
I think it's the PSP's dev kit by the sounds of it
<Lofty>
I know the PS2 dev kit also used an FPGA as a bridge chip between buses
<jevinskie[m]>
Yes, IIRC another cyclone. Ps3 dev kits and later switched to xilinx
<Lofty>
jevinskie[m]: no, it's a Xilinx chip on the PS2 TOOL
<Lofty>
XC3000 IIRC
<Lofty>
mwk: the Xilinx naming system is wonderful
<mwk>
which one
<Lofty>
You can abbreviate the XC3000 as XC3K and end up with an entirely different chip
<mwk>
the wonderful thing is there are so many of them
<mwk>
... there is no xc3k as far as I know; xc7k on the other hand...