notes_on_fc1307A_sce.md

FC1307A notes for SCE security

The firmware, stored in the SPI flash connected to FC1307A, is 8051 architecture.
It is unencrypted and unsigned, with checksums.

When loading the firmware in Ghidra as a raw 8051 binary, truncate the flash to 0x10000 bytes.

In firmware 3.72 of the FC1307A, the ATA command dispatch table is at 0x9482, laid out as the following:

struct dispatch_elm
{
void *m_cb; /* NOTE: 2 byte pointer */
char m_key;
} __attribute__((packed));

When m_cb is NULL, the pointer to the default case is instead stored in the position of m_key and the array terminates.

Recommendation is to replace the ATA command 0xC0 with 0x8E in the table, since 0xC0 isn't used in the context for which the command 0x8E is intended for.

void ata_cmd_return_null_empty_sector(void)
{  
  FUN_CODE_8062();
  2e.6 = 0;
  DAT_EXTMEM_200b |= 0x10;
  memset(DAT_EXTMEM_4000, 0, 512);
  DAT_SFR_aa = 0;
  if (28.2 != '\0')
    FUN_CODE_2728();
  FUN_CODE_26e7();
  DAT_EXTMEM_200b &= 0xef;
}

More info / tools

https://www.psdevwiki.com/ps2/Hard_Drive
https://zenn.dev/mctek/articles/306d1afc153c0b
https://github.com/amnemonic/fc1307-tools (includes tools for dumping and programing SPI over ATA)
https://gist.github.com/uyjulian/738b778a4e2a81b257fad1469dcb2d8c (pin description)

Implementations

https://github.com/pcm720/fc1307-tools/tree/sce-security
https://github.com/DanielFergisz/FC1307A-PSX-DVR

TODO

• Add faster crystal or other clock source 50Mhz/82Mhz/104Mhz/200Mhz for UHS-1 speeds ** https://github.com/pcm720/fc1307-tools/blob/sce-security/docs/overclocking.md
• SDUC
• ATAPI

Hi, if you wait a week, I will send you the finished software because I have already done it ;)

Hi, thanks, but someone has already done it

This is my solution, I wanted to publish it when I finish working on PSX2:

https://github.com/DanielFergisz/FC1307A-PSX-DVR