So, about BD drive authentication :-)
The most importnat HV process is 6. It contains Update Manager and Storage Manager e.g.
Update manager flashes e.g. new CORE OS, BD firmware or SYSCON firmware. Storage Manager sets ATA keys, authenticates HDD and BD drives.
Storage Manager
———————
I looked at VSH closer in the last week. And found out that VSH uses the following Storage Manager services: 0×5004 – to authenticate PS3 discs, 0×5007 – to authenticate PS3 discs.
Bothe these services can be used by GameOS through VUART 10 and Dispatcher Manager (is also in a HV process), I already implemented a driver for VUART 10 and DM on Linux and uploaded it, so guys who has my latest Linux version could use it on Linux :-) And get access to PS3 discs and PS2 discs but i didn’t have time to test it.
Both these services accept one parameter: 32 bit integer.
Look at the funtion stor_mgr_packetid_0x5004 in my IDA database for HV 3.15. Everything is still the same on 3.41 and 3.55, so my HV 3.15 bible is the key to HV 3.41 and 3.55. They changed almost nothing in new HV versions :-) And look also at function stor_mgr_packetid_0x5007. I could write down a simple Linux program which uses my DM driver to communicate with Storage Manager and show you how it works :-) It’s very easy. I will upload it maybe next week.
To authenticate PS2 discs, VSH uses parameter 0×52 and service 0×5004. To authenticate PS3 discs, VSH uses parameter 0×53 and service 0×5007. But i didn’t test it on my own unfortunately.
PS3′s BD support different profiles for different media, e.g. for PS3 discs, for DVD, for PS2 discs. And storage manager can tell BD drive which profile it should use.
All the communication between Storage Manager and BD drive goes through ATAPI/SCSI interface.
To read the current profile of BD drive, the Storage Manager uses
the storage device command 0×11, look at storage_device_RBD_do_device_command in my HV 3.15 IDA database (lv1_storage_Send_device_command) and ATAPI_GetConfiguration. But
HV procs do not use HV calls, they use HV syscall, and Storage Manager sends ATAPI commands to BD drive through device file /dev/rbd0.
With lv1_storage_Send_device_command(0×11) you could read the current BD profile.
Also very interesting ATAPI commands used by Storage Manager are Report Key/Send Key commands. Look at functions HW_report_key and HW_send_key in my HV proc 6 IDA database. HW_report_key function is e.g. used by Storage Manager to read BD drive policy. Storage Manager checks the policy of BD drive.
Storage Manager uses sv_iso_spu_module.self isolated module to authenticate BD drive. sv_iso_spu_module.self gives Storage Manager data which is sent to BD drive and back.