Syscon Update

= Structure =

Ernie firmware updates are stored in a packet format.

Packet Header
Any update packet has a common header structure.

Packet size varies depending on the hardware revision of Syscon: Renesas 78K0R/Kx3: 0x800 Renesas 78K0R/Kx3-L: 0x400 Renesas RL78/G13: 0x400

0x01
Version packet.

This packet is update header field.

Ernie Version and Hardware Info from a few PUP files:

0x02
Key revision packet.

This packet embeds the encryption key revision used to decrypt the Syscon update packets.


 * Firmware Type 0 is for NEC 78K0R/Kx3-L. It is supported since at least System Software version 0.931.010 (System Software version 0.902 does not support it) til System Software version 1.692.000. It is for some PS Vita prototypes.
 * Firmware Type 1 is for NEC 78K0R/Kx3. It is supported since System Software version 1.000.041. It is for most PS Vita Fat models and for PS TV.
 * Firmware Type 2 is for Renesas RL78/G13. It is supported since System Software version 2.500.071. It is for PS Vita Slim Syscon.

0x03
This packet is special because it is not embedded in Syscon Update SPKGs. It is generated in ARM kernel and sent to Syscon with Syscon command 0x1185.

It is not present on FW 0.931.010.

0x10
Encrypted segment packet.

Segments are concatenated before being AES128CBC encrypted/decrypted.

0x20
Hash packet.

= Ernie Update steps =


 * ARM PS Vita updater arrives at last step: Ernie update.
 * ARM PS Vita updater decrypts Ernie update SPKGs til it finds one whose Hardware Info matches.
 * ARM PS Vita updater sends the encrypted segments directly to Ernie using some command 0x1181.
 * ARM PS Vita updater sends the hash directly to Ernie using some command 0x1184.
 * Ernie decrypts concatenated received segments using AES128CBC.
 * Ernie computes sha1 hash over the decrypted concatenated data and compares with the received hash.
 * Ernie installs the update using the decrypted data.