Game card is a standard MMC card. Pinout is different, however it complies with MMC card.
Card initialization
Card initialization consists of two steps:
- Standard MMC initialization.
- Custom CMD56 initialization.
CMD56 is a command that is used to transfer vendor specific data from host to card and back to host.
Second step is crucial and is required to be done before host tries to read any data from the card for example with CMD17.
Standard MMC initialization
This step is performed by SceSdif.
Part1: Card identification (SD, MMC, SDIO)
- 40 00 00 00 00 95 - CMD0 - GO_IDLE_STATE
- 48 00 00 01 AA 87 - CMD8 - SEND_IF_COND
- 45 00 00 00 00 5B - CMD5 - IO_SEND_OP_COND
- 77 00 00 00 00 65 - CMD55 - APP_CMD
Part2: Card initialization
- 40 00 00 00 00 95 - CMD0 - GO_IDLE_STATE
- 41 40 FF 80 00 0B - CMD1 - SEND_OP_COND
- 42 00 00 00 00 4D - CMD2 - ALL_SEND_CID
- 43 00 01 00 00 7F - CMD3 - SET_RELATIVE_ADDR
- 49 00 01 00 00 F1 - CMD9 - SEND_CSD
- 47 00 01 00 00 DD - CMD7 - SELECT_CARD
- 46 03 AF 01 00 43 - CMD6 - SWITCH (ERASE_GROUP_DEF)
- 48 00 00 00 00 C3 - CMD8 - SEND_EXT_CSD
- 50 00 00 02 00 15 - CMD16 - SET_BLOCKLEN
- 46 03 B9 01 00 2F - CMD6 - SWITCH (HS_TIMING)
- 46 03 B7 01 00 2D - CMD6 - SWITCH (BUS_WIDTH 4)
Custom CMD56 initialization
This step is performed by SceSblGcAuthMgr.
SceSblGcAuthMgr uses SceSblSsSmComm API to send F00D Commands to call Kirk services 1B-20.
Game card can be accessed with device index 1
Initialization consists of 20 packets total.
There are 10 request and 10 response packets.
Each packet is sent or received with CMD56.
packet 1
Offset |
Size |
Value |
Description
|
0x0 |
0x20 |
- |
key0
|
0x20 |
0x4 |
0x31 |
response code
|
0x24 |
0x4 |
0x03 |
additional data size
|
0x28 |
0x4 |
0x13 |
response size
|
0x2C |
0x1 |
0xC4 |
command ?
|
0x2D |
0x1 |
0x00 |
unknown
|
0x2E |
0x1 |
0x03 |
additional data size
|
packet 2
packet 3
packet 4
packet 5
packet 6
packet 7
packet 8
packet 9
packet 10
packet 11
packet 12
packet 13
packet 14
packet 15
packet 16
packet 17
packet 18
packet 19
packet 20