MODBO50

[pp5di]

i have dumped my spi flash from modbo50, 512k
i try to use on generic matrix board and not work, freezes on matrix logo
not work, fpga code not reconizes data from flash

[78edu]

Please share your spi flash dump!
What is your ps2 model?
I think, it can be fixed with wiring points.
Try to leave only bios/rom points and other for power, ground, etc.

Probably, but not sure, whole code uploading once console starts.
So, if you see matrix logo - rom patches was loaded in to the ram of the ps2.
Then it doing its work (model detection, reading settings from modchip - with cpld it easier to do after boot then before).

Anyway, loaded elf can be fixed to work with modbo4 or can be dumped.
I need this because it have built in usb prx module and whole code fits in modchip without any data from other sources.
Want to made something like this, but more simple and in a straight way without protection bypass and settings menu.
I hope, this patches and elfs not encrypted and someone (also me) can reverse it.

I want to dump unecrypted elf and patch data from modchip right when it readed by console.
As i wrote, it can be simulated using arduino with slow clock rate.
Modchip just tampering data whan ps2 reads rom chip with bios.
Modchip is a state machine, it can be used alone of console.

[pp5di]

https://github.com/pp5di/ps2-matrix-infinity-modchip-dump i have 79001 Em dom, 14 de fev de 2021 14:59, 78edu <notifications@github.com> escreveu:

…

Please share your spi flash dump! What is your ps2 model? I think, it can be fixed with wiring points. Try to leave only bios/rom points and other for power, ground, etc. Probably, but not sure, whole code uploading once console starts. So, if you see matrix logo - rom patches was loaded in to the ram of the ps2. Please share your spi flash dump! What is your ps2 model? I think, it can be fixed with wiring points. Try to leave only bios/rom points and other for power, ground, etc. Probably, but not sure, whole code is uploading once console starts. So, if you see matrix logo - rom patches was loaded in to the ram of the ps2. Source code of scenix sx28 based modchips and o2mod was released and you can understand how patch is working. I want to dump unecrypted elf and patch data from modchip right when it readed by console. As i wrote, it can be simulated using arduino with slow clock rate. Modchip just tampering data whan ps2 reads rom chip with bios. Modchip is a state machine, it can be used alone of console. I want to dump unecrypted elf and patch data from modchip right when it readed by console. As i wrote, it can be simulated using arduino with slow clock rate. Modchip just tampering data whan ps2 reads rom chip with bios. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AN4SZFJ3UGTQVDREC3PJFSTS7AFRHANCNFSM4XHBVXZA> .

[78edu]

Good dump!
As i noticed: it uses USBADV(maybe there is a driver or code parts from usb advance) and it uses 2 unencrypted ELF files + it structure more complicated then modbo 4.
First big part different in couple decades of bytes, then we have big empty area and new usb logic in it.

Will try elfs in pcsx2, i don't have ps2 for now.

[pp5di]

yes, i tried with hex editor to separate the second .elf and run on the emulator and ps2, but it didn't work Em dom., 14 de fev. de 2021 às 15:16, 78edu <notifications@github.com> escreveu:

…

Good dump! As i noticed: it uses USBADV and it uses 2 unencrypted ELF files + it structure more complicated then modbo 4. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AN4SZFJ5GNWCJ6EANLXPIQ3S7AHQVANCNFSM4XHBVXZA> .

[78edu]

I tried many homebrew in pcsx2 and it didn't work.
Try to patch ps2 bios and run.
I got it work with uLE instead of OSDSYS.
You can find your osdsys offset with my python tool or manually.

[78edu]

Will try Ghidra or IDA with R5900 plugin on whole modbo dump to find RESET code and other ps2 code and separate it from modbo5 data.

[pp5di]

yes, i already used it and had fun with your phyton script, it worked well, congratulations! I actually still dream of a custom bios for ps2, but I would have to find a new compatible and rewritable flash to make the replacement Em dom., 14 de fev. de 2021 às 15:21, 78edu <notifications@github.com> escreveu:

…

I tried many homebrew in pcsx2 and it didn't work. Try to patch ps2 bios and run. I got it work with uLE instead of OSDSYS. You can find your osdsys offset with my python tool or manually. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AN4SZFMFOCABR6J2XG3X7JLS7AIBFANCNFSM4XHBVXZA> .

[78edu]

I used to want to do ram chip instead of flash and couple it with cpld and pc or raspbery pi.
For fast load any data, which can be accessed with EE-rom access.
Like modchip, but with big chunks of data.
Because you can access rom0: as a disk in uLE, why not to try send data like it was in HDpro for 75000 and above.

[pp5di]

I would really like to follow and test it, I have a lot of ps2 here that I can use, without fear of destroying them Em dom., 14 de fev. de 2021 às 15:25, 78edu <notifications@github.com> escreveu:

…

Will try Ghidra or IDA with R5900 plugin. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AN4SZFJDLSIYCGU3VLVLLMDS7AIRLANCNFSM4XHBVXZA> .

[pp5di]

reverse engineering on the matrix chip would also be very nice, inserting .elfs into a larger capacity spi flash and loading from boot I believe you already know, but it was the only DIY for mod chip I found https://www.angelfire.com/clone/magicfriend/ Em dom., 14 de fev. de 2021 às 15:37, 78edu <notifications@github.com> escreveu:

…

I used to want to do ram chip instead of flash and couple it with cpld and pc or raspbery pi. Because you can access rom0: as a disk in uLE, why not to try send data like it was in HDpro for 75000 and above. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AN4SZFJ6YOMJPO5T3IZX4RDS7AKAJANCNFSM4XHBVXZA> .

[pp5di]

I TRIED TO EDIT THE BIOS AND USE ULAUNCHELF OR OPL IN THE PLACE OF OSDSYS AND IT DIDN'T WORK FOR ME Em dom., 14 de fev. de 2021 às 15:37, Fabio Kuntze <beatzeroradio@gmail.com> escreveu:

…

reverse engineering on the matrix chip would also be very nice, inserting .elfs into a larger capacity spi flash and loading from boot I believe you already know, but it was the only DIY for mod chip I found https://www.angelfire.com/clone/magicfriend/ Em dom., 14 de fev. de 2021 às 15:37, 78edu ***@***.***> escreveu: > I used to want to do ram chip instead of flash and couple it with cpld > and pc or raspbery pi. > Because you can access rom0: as a disk in uLE, why not to try send data > like it was in HDpro for 75000 and above. > > — > You are receiving this because you authored the thread. > Reply to this email directly, view it on GitHub > <#1 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AN4SZFJ6YOMJPO5T3IZX4RDS7AKAJANCNFSM4XHBVXZA> > . >

[78edu]

I had same issue too.
I've tried some versions and one old was able to run.
Maybe it was not uLE but lbFn оr wLE.

Some homebrew like myps2 runs well.

[pp5di]

UlELF and OPL works with pcsx2, in System / Run .elf on dvd too, i remember testing a .iso with homebrew and loaded the .elf correctly when modifying the bios, we changed its size and addresses, so I think ... I would have to try to preserve the 4.096k Em seg., 15 de fev. de 2021 às 13:38, 78edu <notifications@github.com> escreveu:

…

I had same issue too. I'll upload working bios, its possible. pcsx2 won't handle homebrew, i don't know why — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AN4SZFL4XKCDUV7XK5LB443S7FEZTANCNFSM4XHBVXZA> .

[78edu]

I've tried small elfs which not larger than osdsys.
Just copy paste without any cleaning after end of new data

[pp5di]

I can try to put some .elf on the modbo50 spi flash, I have an 8mb spi flash here Em seg., 15 de fev. de 2021 às 13:55, 78edu <notifications@github.com> escreveu:

…

I've tried small elfs which not larger than osdsys. Just copy paste without any cleaning after end of new data — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AN4SZFJHN4TQL2GFY3VKYQTS7FGYXANCNFSM4XHBVXZA> .