Updater: Difference between revisions

From Vita Development Wiki
Jump to navigation Jump to search
(Swapped Module <-> Library, see revision 1.1 under "Revision History" of "Vita SDK specifications" (https://wiki.henkaku.xyz/vita/File:Vita_SDK_specifications.pdf))
 
(105 intermediate revisions by 7 users not shown)
Line 1: Line 1:
Various components in user, kernel, and secure kernel work together to update the system. All the relevant libraries are documented in this one page because they work close together.
Various components in user, kernel, and secure kernel work together to update the system. All the relevant libraries are documented in this one page because they work close together.


== SceCuiSetUpper ==
= Update Process =
=== Module ===
This is a user application that is found inside the update [[PUP]]. It has not been seen used outside of development units but is included in retail updates. It does not change often between firmware updater versions.


==== Known NIDs ====
The PS Vita updater is composed of various parts:
{| class="wikitable"
* SceCuiSetUpper
|-
* ScePsp2Swu
! Version
* SceSblSsUpdateMgr
! Name
* update_service_sm
! World
! Privilege
! NID
|-
| 2.12
| SceCuiSetUpper
| Non-secure
| User (vsh)
| 0x8802DAE9
|}


=== Library ===
== Initiator ==
This module does not export any libraries.


The first part is the initiator of the update. The responsibility of the initiator is to copy the update file (<code>PSP2UPDAT.PUP</code>) to the <code>ud0</code> [[Partitions|partition]] and extract <code>psp2swu.self</code> from the update file to <code>ud0:PSP2UPDATE/psp2swu.self</code>. Then it signals the [[Syscon|syscon]] to start in update mode, where <code>psp2swu.self</code> is loaded instead of the usual shell.
The initiator that most people use is likely the update option in [[SceSettings]]. Another is the update option in [[SceSafeMode]]. Another option is <code>SceCuiSetUpper</code>, which is extracted from the update [[PUP]]. <code>SceCuiSetUpper</code> is likely used in development units as it can load the update data from <code>host0</code>, which only exists on development units. This file, however, can be found in retail update packages. <code>SceCuiSetUpper</code> also sets a flag to start updater in CUI mode.


== ScePsp2Swu ==
== ScePsp2Swu ==
=== Module ===
This is a user application that is found inside the update [[PUP]].


==== Known NIDs ====
Once the system restarts into update mode, the updater runs. Normally, it runs in GUI mode which is the green screen with the progress bar. If a flag is set by the initiator, the updater will run in CUI mode, which is a text interface that provides more verbose information about the update process.
{| class="wikitable"
|-
! Version
! Name
! World
! Privilege
! NID
|-
| 1.69
| ScePsp2Swu
| Non-secure
| User (vsh)
| 0xF8D9C101
|}


=== Library ===
The updater first makes calls to <code>SceSblSsUpdateMgr</code> to verify the PUP header. For more information, check out [[PUP]]. Next, the updater will spawn a thread that calls into the kernel to decrypt, verify, and flash each package file according to the information found in the package header. For more information, check out [[PUP#Packages]].
This module does not export any libraries.
 
== SceSblUpdateMgr ==
=== Module ===
This module exists only in the non-secure kernel. The non-secure world SELF can be found in <code>bootfs:update_mgr.skprx</code>.


==== Known NIDs ====
== SceSblSsUpdateMgr ==
{| class="wikitable"
|-
! Version
! Name
! World
! Privilege
! NID
|-
| 1.69
| SceSblUpdateMgr
| Non-secure
| Kernel
| 0xBA91FE90
|}


=== Library ===
This is a kernel module that actually does the work and performs the update. It verifies the [[PUP]] headers as well as the [[PUP#Packages|package]] headers then flashes the decrypted images directly to the [[eMMC]] with block writes.
This module only exports libraries to both kernel and user.


==== Known NIDs ====
= Update Package Decryption Code =
{| class="wikitable"
|-
! Version
! Name
! World
! Visibility
! NID
|-
| 1.69
| SceSblUpdateMgrForKernel
| Non-secure
| Kernel
| 0xC4466E48
|-
| 1.69
| SceSblUpdateMgrForDriver
| Non-secure
| Kernel
| 0xE04CD3D
|-
| 1.69
| SceSblSsUpdateMgr
| Non-secure
| User
| 0x31406C49
|}


== Update Process ==
The following code snippet will decrypt and update a directory of package files on FW 1.69 (the kernel functions called are specific to FW 1.69 prototypes). It is an attempted reproduction of the main code in <code>ScePsp2Swu</code>. The requirements are that you patch the application to be running in [[Vsh]] context (or specifically patch the [[AuthorityId|Authority ID]] to allow access to the kernel update functions). You also need an ability to read and write to the kernel from within your application. Finally, the updater will always attempt to flash the decrypted contents. If the flash failed because of model checks or whatever, it will return an error but the data will still be successfully decrypted and outputted. If it succeeds, note that you have now updated your PS Vita.
The Vita updater is composed of various parts.
=== Initiator ===
The first part is the initiator of the update. The responsibility of the initiator is to copy the update file (<code>PSP2UPDAT.PUP</code>) to the <code>ud0</code> [[Partitions|partition]] and extract <code>psp2swu.self</code> from the update file to <code>ud0:PSP2UPDATE/psp2swu.self</code>. Then it signals the [[Syscon|syscon]] to start in update mode, where <code>psp2swu.self</code> is loaded instead of the usual shell.


The initiator that most people use is likely the update option in [[SceSettings]]. Another is the update option in [[SceSafeMode]]. Another option is <code>SceCuiSetUpper</code>, which is extracted from the update [[PUP]]. <code>SceCuiSetUpper</code> is likely used in development units as it can load the update data from <code>host0</code>, which only exists on development units. This file, however, can be found in retail update packages. <code>SceCuiSetUpper</code> also sets a flag to start updater in CUI mode.
<source lang="C">
 
int update_spackage(int package_type, unsigned char *buf, int buflen, int code2, int *pRequestId) {
=== ScePsp2Swu ===
     int args[11];
Once the system restarts into update mode, the updater runs. Normally, it runs in GUI mode which is the green screen with the progress bar. If a flag is set by the initiator, the updater will run in CUI mode, which is a text interface that provides more verbose information about the update process.
 
The updater first makes calls to <code>SceSblSsUpdateMgr</code> to verify the PUP header. For more information, check out [[PUP]]. Next, the updater will spawn a thread that calls into the kernel to decrypt, verify, and flash each package file according to the information found in the package header. For more information, check out [[PUP#Packages]].
 
=== SceSblSsUpdateMgr ===
This is a kernel module that actually does the work and performs the update. It verifies the [[PUP]] headers as well as the [[PUP#Packages|package]] headers and then flashes the decrypted images directly to the [[eMMC]] with block writes.
 
== Update Package Decryption ==
The following code snippet will decrypt and update a directory of package files on 1.69 (the kernel functions called are specific to 1.69 NIDs). It is an attempted reproduction of the main code in <code>ScePsp2Swu</code>. The requirements are that you patch the application to be running in [[Vsh]] context (or specifically patch the [[Authentication ID|authentication id]] to allow access to the kernel update functions). You also need an ability to read and write to the kernel from within your application. Finally, the updater will always attempt to flash the decrypted contents. If the flash failed because of model checks or whatever, it will return an error but the data will still be successfully decrypted and outputted. If it succeeds, note that you have now updated your Vita. This code has not been tested to attempt a downgrade and therefore is provided only for reference.
<source lang="c">
int start_decryption1(int code1, unsigned char * buf, int buflen, int code2, int * phandle) {
     int argst[11];
     int res;
     int res;
   
     memset(args, 0, 0x2C);
     memset(argst,0,0x2c);
     args[0] = 0x2C;
     argst[0]=0x2c;
     args[1] = code1;
     argst[1]=code1;
     args[2] = (int) buf;
     argst[2]=(int)buf;
     args[3] = buflen;
     argst[3]=buflen;
     args[4] = code2;
     argst[4]=code2;
     sceClibPrintf("Calling update_spackage with package_type = 0x%x buf = 0x%x buflen = 0x%x code2 = 0x%x \n", package_type, (int)buf, buflen, code2);
     sceClibPrintf("Calling type 1 decryption with code1 = 0x%x buf = 0x%x buflen = 0x%x code2 = 0x%x  
     res = sceSblUsUpdateSpackageForUser(package_type, args, pRequestId);
", code1, (int) buf, buflen, code2);
     res=callKernelFunction(SceSblSsUpdateMgr_0x6E8DDAC4,code1,argst,phandle,0  );
     return res;
     return res;
}
}


int start_decryption2(int code1, unsigned char * buf, int buflen, int code2, int * phandle) {
int inspect_spackage(int package_type, unsigned char *buf, int buflen, int code2, int *pRequestId) {
     int argst[11];
     int args[11];
     int res;
     int res;
   
     memset(args, 0, 0x2C);
     memset(argst,0,0x2c);
     args[0] = 0x2C;
     argst[0]=0x2c;
     args[1] = package_type;
     argst[1]=code1;
     args[2] = (int) buf;
     argst[2]=(int)buf;
     args[3] = buflen;
     argst[3]=buflen;
     args[4] = code2;
     argst[4]=code2;
     sceClibPrintf("Calling inspect_spackage with package_type = 0x%x buf = 0x%x buflen = 0x%x code2 = 0x%x\n", package_type, (int)buf, buflen, code2);
     sceClibPrintf("Calling type 2 decryption with code1 = 0x%x buf = 0x%x buflen = 0x%x code2 = 0x%x
     res = sceSblUsInspectSpackageForUser(package_type, args, pRequestId);
", code1, (int) buf, buflen, code2);
     res=callKernelFunction(SceSblSsUpdateMgr_0x1A39F6EE,code1,argst,phandle,0  );
     return res;
     return res;
}
}


int start_decryption3(int code1, unsigned char * buf, int buflen, int code2, int * phandle) {
int extract_spackage(int package_type, unsigned char *buf, int buflen, int code2, int *pRequestId) {
     int argst[11];
     int args[11];
     int res;
     int res;
   
     memset(args, 0, 0x2C);
     memset(argst,0,0x2c);
     args[0] = 0x2C;
     argst[0]=0x2c;
     args[1] = package_type;
     argst[1]=code1;
     args[2] = (int) buf;
     argst[2]=(int)buf;
     args[3] = buflen;
     argst[3]=buflen;
     args[4] = code2;
     argst[4]=code2;
     sceClibPrintf("Calling extract_spackage with package_type = 0x%x buf = 0x%x buflen = 0x%x code2 = 0x%x\n", package_type, (int)buf, buflen, code2);
     sceClibPrintf("Calling type 3 decryption with code1 = 0x%x buf = 0x%x buflen = 0x%x code2 = 0x%x
     res = sceSblUsExtractSpackageForUser(package_type, args, pRequestId);
", code1, (int) buf, buflen, code2);
     res=callKernelFunction(SceSblSsUpdateMgr_0xC1792A1C,code1,argst,phandle,0  );
     return res;
     return res;
}
}


int check_decryption_status(int code,int handle,int * out1, int * out2, int * out3, int * out4) {
int get_status(int node_type, int requestId, int *out1, int *out2, int *out3, int *out4) {
     int argst[11];
     int args[11];
     int res;  
     int res;
   
     memset(args, 0, 0x2C);
     memset(argst,0,0x2c);
     args[0] = 0x2C;
     argst[0]=0x2c;
     args[7] = (int) out1;
     argst[7]=(int)out1;
     args[8] = (int) out2;
     argst[8]=(int)out2;
     args[9] = (int) out3;
     argst[9]=(int)out3;
     args[10] = (int) out4;     
     argst[10]=(int)out4;     
     sceClibPrintf("Calling get_status with node_type = 0x%x requestId = 0x%x\n", node_type, requestId);
     sceClibPrintf("Calling status with code = 0x%x handle = 0x%x
     res = sceSblUsGetStatusForUser(node_type, requestId, args);
", code, handle);
     res=callKernelFunction(SceSblSsUpdateMgr_0xF403143E,code,handle,argst,0);
     return res;
     return res;
}
}
int get_final_size(unsigned char * buf) {
 
     int * poffs;
unsigned int get_final_size(unsigned char *buf) {
     int * psize;
     int *poffs;
     int *psize;
     poffs = (int *) (buf+0x10);
     poffs = (int *) (buf+0x10);
     psize = (int *) (buf+(*poffs)+0x20);
     psize = (int *) (buf+(*poffs)+0x20);
     return *psize;
     return *psize;
}  
}
int get_type(unsigned char * buf) {
 
     int * poffs;
int get_package_type(unsigned char *buf) {
     int * psize;
     int *poffs;
     if ( *(int *)buf == 0x00454353 )
     int *psize;
    {
     if (*(int *)buf == 0x00454353) { // "SCE\0"
         poffs = (int *) (buf+0x10);
         poffs = (int *) (buf+0x10);
         psize = (int *) (buf+(*poffs)+4);
         psize = (int *) (buf+(*poffs)+4);
Line 197: Line 103:
     }
     }
     else
     else
    {
         return -1;
         return -1;
    }
}
 
unsigned char * get_data_offset(unsigned char * buf) {
unsigned char *get_data_offset(unsigned char *buf) {
     int * poffs;
     int *poffs;
     poffs = (int *) (buf+0x10);
     poffs = (int *) (buf+0x10);
     return (buf+(*poffs)+0x80);
     return buf + *poffs + 0x80;
   
}
}


int complete_decryption(int code, int handle, unsigned char * buf, int maxlen) {
int get_extract_spackage(int node_type, int requestId, unsigned char *buf, int maxlen) {
     int argst[11];
     int args[11];
     int res;     
     int res;     
     unsigned char * payload;
     unsigned char *payload;
     int size;
     int size;
   
     memset(args, 0, 0x2C);
     memset(argst,0,0x2c);
     args[0] = 0x2C;
     argst[0]=0x2c;
     args[1] = node_type;
     argst[1]=code;
     args[5] = (int) buf;
     argst[5]=(int)buf;
     args[6] = maxlen;
     argst[6]=maxlen;
     sceClibPrintf("Calling get_extract_spackage with node_type = 0x%x requestId = 0x%x buf = 0x%x maxlen = 0x%x\n", node_type, requestId, (int)buf, maxlen);
     sceClibPrintf("Calling complete decryption with code = 0x%x handle = 0x%x buf = 0x%x maxlen = 0x%x
     res = sceSblUsGetExtractSpackageForUser(node_type, requestId, args);
", code, handle, (int) buf, maxlen);
     res=callKernelFunction(SceSblSsUpdateMgr_0x4897AD56,code,handle,argst,0);
     return res;
     return res;
}
}
          
          
int
int do_decrypt_spackage_file(const char *inpath, const char *outpath, const char *errpath, unsigned int us_buf_size) {
do_decrypt_file (const char *inpath, const char *outpath, const char *errpath, unsigned int size)
{
     int fd;
     int fd;
     int res;
     int res;
     int memid;
     int memid;
     int read;
     unsigned int read_size;
     int maxlen=0x810000;
     unsigned int maxlen = 0x810000;
     int argst[0x2c/4];
     int args[0x2C/4];
     int id;
     int id;
     int type;
     int node_type;
     int code;
     int code;
     unsigned char * src, *outbuf;
     unsigned char *us_buf_addr, *outbuf;
     unsigned int handle, p1,p2,p3,p4;
     unsigned int requestId, p1, p2, p3, p4;
     res=callKernelFunction(SceSblSsUpdateMgr_0x4C06F41C,size,&src,0,0);
     res = sceSblUsAllocateBufferForUser(us_buf_size, &us_buf_addr);
     sceClibPrintf("Allocation returned 0x%x addr 0x%x
     sceClibPrintf("Allocation returned 0x%x addr 0x%x\n", res, (int)us_buf_addr);
", res, (int)src);
     if (res) {
     if(res) {
         sceClibPrintf("Cannot allocate buffer. (us_buf_size 0x%x) fail.\n", us_buf_size);
         sceClibPrintf("Cannot allocate memory. (size 0x%x) fail.
", size);
         return 0;
         return 0;
     }
     }
    //sceClibPrintf("Loading Firmware pkg file from host0:");
     fd = sceIoOpen(inpath, 1, 0);
     fd= sceIoOpen(inpath,1,0);
     read_size = 0;
     read = 0;
     while ((read_size = sceIoRead(fd, us_buf_addr, us_buf_size - read_size)) > 0);
     while ((read = sceIoRead(fd,src,size-read)) > 0);
     sceIoClose(fd);
     sceIoClose(fd);
     code = get_type(src);
     package_type = get_package_type(us_buf_addr);
     switch (code) {
     switch (package_type) {
         case -1:
         case -1:
             sceClibPrintf("Not an encrypted file.
             sceClibPrintf("Not an encrypted file.\n");
");
             goto ERROR;
             goto ERROR;
         case 3:
         case 3:
         case 4:
         case 4:
         case 0x1B:
         case 0x1B:
             type = 3;
             node_type = 3;
             res=start_decryption3(code,src,size,9,&handle);
             res = extract_spackage(package_type, us_buf_addr, us_buf_size, 9, &requestId);
             break;
             break;
         case 0:
         case 0:
Line 271: Line 167:
         case 0xE:
         case 0xE:
         case 0x1A:
         case 0x1A:
             sceClibPrintf("Warning, code %x is unsupported!
             sceClibPrintf("Warning, package_type %x is unsupported!\n", package_type);
", code);
         default:
         default:
             type = 2;
             node_type = 2;
             res=start_decryption2(code,src,size,9,&handle);
             res = inspect_spackage(package_type, us_buf_addr, us_buf_size, 9, &requestId);
             break;
             break;
     }
     }
     if(res) {
     if (res) {
         sceClibPrintf("start_decryption failed. (0x%x)
         sceClibPrintf("xxx_spackage failed. (0x%x)\n", res);
", res);
         goto ERROR;
         goto ERROR;
     }
     }
     for(;;) {
     for (;;) {
         res=check_decryption_status(type,handle,&p1,&p2,&p3,&p4);
         res = get_status(node_type, requestId, &p1, &p2, &p3, &p4);
         if(res) {
         if (res) {
             sceClibPrintf("check_decryption_status failed. (0x%x)
             sceClibPrintf("get_status failed. (0x%x)\n", res);
", res);
             goto ERROR;
             goto ERROR;
         }
         }
         if(p3 == 5) {
         if (p3 == 5)
             break;
             break;
         } else {
         else
             sceKernelDelayThread(0x7A120);
             sceKernelDelayThread(500000);
        }
     }
     }
     sceClibPrintf("p1= 0x%x p2 = 0x%x p3 = 0x%x p4 = 0x%x
     sceClibPrintf("p1= 0x%x p2 = 0x%x p3 = 0x%x p4 = 0x%x\n", p1, p2, p3, p4);
", p1,p2,p3,p4);
     if (p2 == 0) {
     if(p2 == 0) {
         sceClibPrintf("Starting to write %s\n", outpath);
         sceClibPrintf("Starting to write %s
         fd = sceIoOpen(outpath, 0x603, 0x186);
", outpath);
         read_size = get_final_size(us_buf_addr);
         fd= sceIoOpen(outpath,0x603,0x186);
         while ((read_size -= sceIoWrite(fd, get_data_offset(us_buf_addr), read_size)) > 0);
         read = get_final_size(src);
         while ((read -= sceIoWrite(fd,get_data_offset(src),read)) > 0);
         sceIoClose(fd);
         sceIoClose(fd);
     } else {
     } else {
         sceClibPrintf("Error decrypting. Writing results to %s
         sceClibPrintf("Error decrypting. Writing results to %s\n", errpath);
", errpath);
         fd = sceIoOpen(errpath, 0x603, 0x186);
         fd= sceIoOpen(errpath,0x603,0x186);
         read_size = get_final_size(us_buf_addr);
         read = get_final_size(src);
         while ((read_size -= sceIoWrite(fd, get_data_offset(us_buf_addr), read_size)) > 0);
         while ((read -= sceIoWrite(fd,get_data_offset(src),read)) > 0);
         sceIoClose(fd);
         sceIoClose(fd);
         goto ERROR;
         goto ERROR;
     }
     }
 
     res = get_extract_spackage(node_type, requestId, us_buf_addr, maxlen);
     res=complete_decryption(type,handle,src,maxlen);
     if (res) {
     if(res) {
         sceClibPrintf("get_extract_spackage failed. (0x%x)\n", res);
         sceClibPrintf("complete_decryption failed. (0x%x)
", res);
         goto ERROR;
         goto ERROR;
     }
     }
 
     res = sceSblUsReleaseBufferForUser(us_buf_addr);
     res=callKernelFunction(SceSblSsUpdateMgr_0xBD677F5A,src,0,0,0);
     return 1;
     return 1;
ERROR:
ERROR:
     res=callKernelFunction(SceSblSsUpdateMgr_0xBD677F5A,src,0,0,0);
     res = sceSblUsReleaseBufferForUser(us_buf_addr);
     return 0;
     return 0;
}
}


void
void do_decrypt_spackage_dir(const char *path) {
do_decrypt_dir (const char *path)
{
     int fd;
     int fd;
     SceIoDirent dir;
     SceIoDirent dir;
Line 337: Line 221:
     char output[256];
     char output[256];
     char errput[256];
     char errput[256];
 
     if ((fd = sceIoDopen(path)) < 0) {
     if ((fd = sceIoDopen(path)) < 0)
         sceClibPrintf("Error opening spackage directory.\n");
    {
         sceClibPrintf("Error opening pkg dir.
");
         return;
         return;
     }
     }
 
     while (sceIoDread(fd, &dir) > 0) {
     while (sceIoDread(fd, &dir) > 0)
    {
         sprintf(input, "%s/%s", path, dir.d_name);
         sprintf(input, "%s/%s", path, dir.d_name);
         sprintf(output, "%s/%s.dec", path, dir.d_name);
         sprintf(output, "%s/%s.dec", path, dir.d_name);
         sprintf(errput, "%s/%s.err", path, dir.d_name);
         sprintf(errput, "%s/%s.err", path, dir.d_name);
         sceClibPrintf("Decrypting %s (size 0x%x)
         sceClibPrintf("Decrypting %s (size 0x%x)\n", input, (unsigned int)dir.d_stat.st_size);
", input, (unsigned int)dir.d_stat.st_size);
         if (do_decrypt_spackage_file(input, output, errput, (unsigned int)dir.d_stat.st_size))
         if (do_decrypt_file(input, output, errput, (unsigned int)dir.d_stat.st_size))
             sceClibPrintf("Decrypted to %s\n", output);
             sceClibPrintf("Decrypted to %s
", output);
         else
         else
             sceClibPrintf("Failed to decrypt %s
             sceClibPrintf("Failed to decrypt %s\n", dir.d_name);
", dir.d_name);
     }
     }
     sceIoDclose(fd);
     sceIoDclose(fd);
}
}
</source>
</source>


== Bootloader ==
= Bootloader =
 
The SLSK bootloaders are re-encrypted with per-console keys during the update process. <code>second_loader.enp</code> and <code>second_loader.enc</code> are transformed into <code>second_loader.enp_</code> and <code>second_loader.enp</code> respectively by cMeP before flashing to eMMC (and the same thing is done to <code>secure_kernel</code>).
 
= Some useful notes =
 
[[SceSblUpdateMgr#sceSblUsUpdateSpackageForUser|sceSblUsUpdateSpackageForUser]] does the bulk of the work decrypting and flashing all the update parts. There appears to be two ways to skip the version checks (but not revokion checks).
 
<s>First way is to patch the imported function <code>SceQafMgrForDriver_8C423C18(void);</code> to return 1. Alternatively, patch [[KBL Param]] offset 0x2C+3 and set bit 0x2. This will bypass ALL version checks, including the peripherals which might be dangerous.</s>
 
Update: do not do this. It does brick as expected.
 
<s>Second way is to patch <code>SceVshBridge</code> export of <code>vshSblAimgrIsCEX</code> (takes no arguments) to return 0. Alternatively patch <code>ScePsp2Swu</code>'s import of that function.</s>
 
Update: this does not work because the export is used by other functions and fails earlier checks. This flag is set by psp2swu.self to indicate bypassing of version checks on the bootloader and system partitions. All other components will be updated if at higher version. This is what DevKits do by default. You can also patch the flags directly. In <code>sceSblUsUpdateSpackageForUser</code>, <code>sceSblUsInspectSpackageForUser</code>, and <code>sceSblUsExtractSpackageForUser</code> (in order: flash, dry run, decrypt only) you can patch the flags argument directly and set <code>0x8</code> to indicate skipping version check on bootloader and system partitions. The flags argument found in R1 (second argument) as a user memory pointer offset 0x10.
 
Authority ID for psp2swu.self is either <code>2800800000000002</code> or <code>2800800000000003</code>.
 
Minimal FW update version for a PS Vita is checked at two layers at least:
* From Idstorage SMI leaf. Two AES encryption layers and one RSA. Highest minimal FW version is 3.65.
* From UpdateMgr embedded list. Constant and depending on hardware. Highest minimal FW version is 3.50.


There's evidence that the bootloaders are re-encrypted with probably per-console keys during the update process. <code>second_loader.enp</code> and <code>second_loader.enc</code> are transformed into <code>second_loader.enp_</code> and <code>second_loader.enp</code> respectively by F00D before flashing (and the same thing is done to <code>secure_kernel</code>).


[[Category:Applications]]
[[Category:Applications]]
[[Category:Kernel]]
[[Category:Kernel]]

Latest revision as of 06:42, 22 January 2023

Various components in user, kernel, and secure kernel work together to update the system. All the relevant libraries are documented in this one page because they work close together.

Update Process

The PS Vita updater is composed of various parts:

  • SceCuiSetUpper
  • ScePsp2Swu
  • SceSblSsUpdateMgr
  • update_service_sm

Initiator

The first part is the initiator of the update. The responsibility of the initiator is to copy the update file (PSP2UPDAT.PUP) to the ud0 partition and extract psp2swu.self from the update file to ud0:PSP2UPDATE/psp2swu.self. Then it signals the syscon to start in update mode, where psp2swu.self is loaded instead of the usual shell.

The initiator that most people use is likely the update option in SceSettings. Another is the update option in SceSafeMode. Another option is SceCuiSetUpper, which is extracted from the update PUP. SceCuiSetUpper is likely used in development units as it can load the update data from host0, which only exists on development units. This file, however, can be found in retail update packages. SceCuiSetUpper also sets a flag to start updater in CUI mode.

ScePsp2Swu

Once the system restarts into update mode, the updater runs. Normally, it runs in GUI mode which is the green screen with the progress bar. If a flag is set by the initiator, the updater will run in CUI mode, which is a text interface that provides more verbose information about the update process.

The updater first makes calls to SceSblSsUpdateMgr to verify the PUP header. For more information, check out PUP. Next, the updater will spawn a thread that calls into the kernel to decrypt, verify, and flash each package file according to the information found in the package header. For more information, check out PUP#Packages.

SceSblSsUpdateMgr

This is a kernel module that actually does the work and performs the update. It verifies the PUP headers as well as the package headers then flashes the decrypted images directly to the eMMC with block writes.

Update Package Decryption Code

The following code snippet will decrypt and update a directory of package files on FW 1.69 (the kernel functions called are specific to FW 1.69 prototypes). It is an attempted reproduction of the main code in ScePsp2Swu. The requirements are that you patch the application to be running in Vsh context (or specifically patch the Authority ID to allow access to the kernel update functions). You also need an ability to read and write to the kernel from within your application. Finally, the updater will always attempt to flash the decrypted contents. If the flash failed because of model checks or whatever, it will return an error but the data will still be successfully decrypted and outputted. If it succeeds, note that you have now updated your PS Vita.

int update_spackage(int package_type, unsigned char *buf, int buflen, int code2, int *pRequestId) {
    int args[11];
    int res;
    memset(args, 0, 0x2C);
    args[0] = 0x2C;
    args[1] = code1;
    args[2] = (int) buf;
    args[3] = buflen;
    args[4] = code2;
    sceClibPrintf("Calling update_spackage with package_type = 0x%x buf = 0x%x buflen = 0x%x code2 = 0x%x \n", package_type, (int)buf, buflen, code2);
    res = sceSblUsUpdateSpackageForUser(package_type, args, pRequestId);
    return res;
}

int inspect_spackage(int package_type, unsigned char *buf, int buflen, int code2, int *pRequestId) {
    int args[11];
    int res;
    memset(args, 0, 0x2C);
    args[0] = 0x2C;
    args[1] = package_type;
    args[2] = (int) buf;
    args[3] = buflen;
    args[4] = code2;
    sceClibPrintf("Calling inspect_spackage with package_type = 0x%x buf = 0x%x buflen = 0x%x code2 = 0x%x\n", package_type, (int)buf, buflen, code2);
    res = sceSblUsInspectSpackageForUser(package_type, args, pRequestId);
    return res;
}

int extract_spackage(int package_type, unsigned char *buf, int buflen, int code2, int *pRequestId) {
    int args[11];
    int res;
    memset(args, 0, 0x2C);
    args[0] = 0x2C;
    args[1] = package_type;
    args[2] = (int) buf;
    args[3] = buflen;
    args[4] = code2;
    sceClibPrintf("Calling extract_spackage with package_type = 0x%x buf = 0x%x buflen = 0x%x code2 = 0x%x\n", package_type, (int)buf, buflen, code2);
    res = sceSblUsExtractSpackageForUser(package_type, args, pRequestId);
    return res;
}

int get_status(int node_type, int requestId, int *out1, int *out2, int *out3, int *out4) {
    int args[11];
    int res;
    memset(args, 0, 0x2C);
    args[0] = 0x2C;
    args[7] = (int) out1;
    args[8] = (int) out2;
    args[9] = (int) out3;
    args[10] = (int) out4;    
    sceClibPrintf("Calling get_status with node_type = 0x%x requestId = 0x%x\n", node_type, requestId);
    res = sceSblUsGetStatusForUser(node_type, requestId, args);
    return res;
}

unsigned int get_final_size(unsigned char *buf) {
    int *poffs;
    int *psize;
    poffs = (int *) (buf+0x10);
    psize = (int *) (buf+(*poffs)+0x20);
    return *psize;
}

int get_package_type(unsigned char *buf) {
    int *poffs;
    int *psize;
    if (*(int *)buf == 0x00454353) { // "SCE\0"
        poffs = (int *) (buf+0x10);
        psize = (int *) (buf+(*poffs)+4);
        return *psize;
    }
    else
        return -1;
}

unsigned char *get_data_offset(unsigned char *buf) {
    int *poffs;
    poffs = (int *) (buf+0x10);
    return buf + *poffs + 0x80;
}

int get_extract_spackage(int node_type, int requestId, unsigned char *buf, int maxlen) {
    int args[11];
    int res;    
    unsigned char *payload;
    int size;
    memset(args, 0, 0x2C);
    args[0] = 0x2C;
    args[1] = node_type;
    args[5] = (int) buf;
    args[6] = maxlen;
    sceClibPrintf("Calling get_extract_spackage with node_type = 0x%x requestId = 0x%x buf = 0x%x maxlen = 0x%x\n", node_type, requestId, (int)buf, maxlen);
    res = sceSblUsGetExtractSpackageForUser(node_type, requestId, args);
    return res;
}
        
int do_decrypt_spackage_file(const char *inpath, const char *outpath, const char *errpath, unsigned int us_buf_size) {
    int fd;
    int res;
    int memid;
    unsigned int read_size;
    unsigned int maxlen = 0x810000;
    int args[0x2C/4];
    int id;
    int node_type;
    int code;
    unsigned char *us_buf_addr, *outbuf;
    unsigned int requestId, p1, p2, p3, p4;
    res = sceSblUsAllocateBufferForUser(us_buf_size, &us_buf_addr);
    sceClibPrintf("Allocation returned 0x%x addr 0x%x\n", res, (int)us_buf_addr);
    if (res) {
        sceClibPrintf("Cannot allocate buffer. (us_buf_size 0x%x) fail.\n", us_buf_size);
        return 0;
    }
    fd = sceIoOpen(inpath, 1, 0);
    read_size = 0;
    while ((read_size = sceIoRead(fd, us_buf_addr, us_buf_size - read_size)) > 0);
    sceIoClose(fd);
    package_type = get_package_type(us_buf_addr);
    switch (package_type) {
        case -1:
            sceClibPrintf("Not an encrypted file.\n");
            goto ERROR;
        case 3:
        case 4:
        case 0x1B:
            node_type = 3;
            res = extract_spackage(package_type, us_buf_addr, us_buf_size, 9, &requestId);
            break;
        case 0:
        case 2:
        case 5:
        case 6:
        case 7:
        case 0xE:
        case 0x1A:
            sceClibPrintf("Warning, package_type %x is unsupported!\n", package_type);
        default:
            node_type = 2;
            res = inspect_spackage(package_type, us_buf_addr, us_buf_size, 9, &requestId);
            break;
    }
    if (res) {
        sceClibPrintf("xxx_spackage failed. (0x%x)\n", res);
        goto ERROR;
    }
    for (;;) {
        res = get_status(node_type, requestId, &p1, &p2, &p3, &p4);
        if (res) {
            sceClibPrintf("get_status failed. (0x%x)\n", res);
            goto ERROR;
        }
        if (p3 == 5)
            break;
        else
            sceKernelDelayThread(500000);
    }
    sceClibPrintf("p1= 0x%x p2 = 0x%x p3 = 0x%x p4 = 0x%x\n", p1, p2, p3, p4);
    if (p2 == 0) {
        sceClibPrintf("Starting to write %s\n", outpath);
        fd = sceIoOpen(outpath, 0x603, 0x186);
        read_size = get_final_size(us_buf_addr);
        while ((read_size -= sceIoWrite(fd, get_data_offset(us_buf_addr), read_size)) > 0);
        sceIoClose(fd);
    } else {
        sceClibPrintf("Error decrypting. Writing results to %s\n", errpath);
        fd = sceIoOpen(errpath, 0x603, 0x186);
        read_size = get_final_size(us_buf_addr);
        while ((read_size -= sceIoWrite(fd, get_data_offset(us_buf_addr), read_size)) > 0);
        sceIoClose(fd);
        goto ERROR;
    }
    res = get_extract_spackage(node_type, requestId, us_buf_addr, maxlen);
    if (res) {
        sceClibPrintf("get_extract_spackage failed. (0x%x)\n", res);
        goto ERROR;
    }
    res = sceSblUsReleaseBufferForUser(us_buf_addr);
    return 1;
ERROR:
    res = sceSblUsReleaseBufferForUser(us_buf_addr);
    return 0;
}

void do_decrypt_spackage_dir(const char *path) {
    int fd;
    SceIoDirent dir;
    char input[256];
    char output[256];
    char errput[256];
    if ((fd = sceIoDopen(path)) < 0) {
        sceClibPrintf("Error opening spackage directory.\n");
        return;
    }
    while (sceIoDread(fd, &dir) > 0) {
        sprintf(input, "%s/%s", path, dir.d_name);
        sprintf(output, "%s/%s.dec", path, dir.d_name);
        sprintf(errput, "%s/%s.err", path, dir.d_name);
        sceClibPrintf("Decrypting %s (size 0x%x)\n", input, (unsigned int)dir.d_stat.st_size);
        if (do_decrypt_spackage_file(input, output, errput, (unsigned int)dir.d_stat.st_size))
            sceClibPrintf("Decrypted to %s\n", output);
        else
            sceClibPrintf("Failed to decrypt %s\n", dir.d_name);
    }
    sceIoDclose(fd);
}

Bootloader

The SLSK bootloaders are re-encrypted with per-console keys during the update process. second_loader.enp and second_loader.enc are transformed into second_loader.enp_ and second_loader.enp respectively by cMeP before flashing to eMMC (and the same thing is done to secure_kernel).

Some useful notes

sceSblUsUpdateSpackageForUser does the bulk of the work decrypting and flashing all the update parts. There appears to be two ways to skip the version checks (but not revokion checks).

First way is to patch the imported function SceQafMgrForDriver_8C423C18(void); to return 1. Alternatively, patch KBL Param offset 0x2C+3 and set bit 0x2. This will bypass ALL version checks, including the peripherals which might be dangerous.

Update: do not do this. It does brick as expected.

Second way is to patch SceVshBridge export of vshSblAimgrIsCEX (takes no arguments) to return 0. Alternatively patch ScePsp2Swu's import of that function.

Update: this does not work because the export is used by other functions and fails earlier checks. This flag is set by psp2swu.self to indicate bypassing of version checks on the bootloader and system partitions. All other components will be updated if at higher version. This is what DevKits do by default. You can also patch the flags directly. In sceSblUsUpdateSpackageForUser, sceSblUsInspectSpackageForUser, and sceSblUsExtractSpackageForUser (in order: flash, dry run, decrypt only) you can patch the flags argument directly and set 0x8 to indicate skipping version check on bootloader and system partitions. The flags argument found in R1 (second argument) as a user memory pointer offset 0x10.

Authority ID for psp2swu.self is either 2800800000000002 or 2800800000000003.

Minimal FW update version for a PS Vita is checked at two layers at least:

  • From Idstorage SMI leaf. Two AES encryption layers and one RSA. Highest minimal FW version is 3.65.
  • From UpdateMgr embedded list. Constant and depending on hardware. Highest minimal FW version is 3.50.