HDCP removal without debug firmware

[Kurenai]

There are other HDCP related threads, but I think we need a research/dev one, so here we go.

Why remove HDCP? It will let people capture HDMI with their capture cards or use old displays without HDCP support.

Debug consoles have an option to disable it, so I decrypted and diff'd every file on 3.41-rebug with 3.41-retail.

3.41 rebug vhs.self looks like it writes debug settings to PS3SETTINGS.SFT
Even if we write this file on retail FW, it probably wont read it. All of the strings aren't present in 3.41 retail FW.

3.41 rebug vhs.self has a string "avset_ctrlhdcpenc" which leads me to believe that's the function that sets HDCP on and off
Is this function present on retail? I need to learn PPC ASM.

sysconf_plugin.rco has a xmb page named "page_tool_hdcp_setting"
looks like it calls "event:native:/OnPushMlistToolConfig" with some params
going to try replacing "page_console_whats_new" with "page_tool_hdcp_setting" (same length) in memory and see what happens
EDIT: I replaced the file on the flash but ps3 locked up when I hit confirm on "Display [What's New]
looks like OnPushMlistToolConfig is still present in 3.55-retail, though

console_qa seems to be the root of the "* Debug" menu in category_sysconf.xml

There's a setting in xRegistry.sys called /setting/display/0/hdcp but it doesn't seem to do anything on retail FW.

Here's a screenshot of the option in debug firmware: http://jerem73.files.wordpress.com/2...pg?w=480&h=272

List of settings in PS3SETTINGS.SFT
env
ieee802.11
gameSound
gameResolution
hdcp <------------------------------------
nickname
buttonAssign
howToSetupIp
dhcpHostName
ipAddress
netmask
enable
device
etherMode
authName
authKey
defaultRoute
dnsFlag
primaryDns
secondaryDns
httpProxyFlag
httpProxyServer
httpProxyPort
mtu
upnpFlag
version
fakeFreeSpace
fakeLimitSize
updateServerUrl
wolDex
dispHddSpace
powerOnReset
fakeSavedataOwner
matEnable
debugGameType
debugBootPath
debugDirName
appHomeBootPath
disable15Timeout
fakeOtherRegion
dispMsgDialogUtilErrorcode
adhocSsidPrefix
emulationType
gameBgmPlayback
dummyBgmPlayer
debug
debugDrmError
debugDrmClock
titleId
npAdClockDiff
gameUpdateImposeTest
dummyInGameXMB
adServerURL
adCatalogVersion
adEnableNotification