Retrieve firmware version and nickname over USB storage

[jimparis]

When in USB mass storage mode ("USB Connection"), the PSP supports several vendor-specific SCSI command blocks. On recent PSP firmware (2.00+?) this includes the ability to retrieve the firmware version and nickname. This is mostly just a curiosity but could be useful, for example, to someone writing a media manager or auto-installer application for the PSP.

The supported SCSI command blocks are:

• 0xFA 0x00 0xA0 0x4d 0x47 0x66 0x6d 0x74 0x01 0x00
  Formats the memory stick.
• 0xFB 0x00 0xB4 0x00 0x00 0x00 0x00 0x01 0x01 0x00
  Returns a fixed block of data. My guess is that it's a bitmask describing which other commands are supported.
• 0xFB 0x00 0xB5 0x00 0x00 0x00 0x00 0x00 0x01 0x00
  Returns the data retrieved by sceUsbstorGetString(3,buf,0x80).
• 0xFC 0x00 0x90 0x50 0x53 0x50 0x69 0x00 0x00 0x00
  Returns the PSP firmware revision. Not supported on 1.50.
• 0xFC 0x00 0x91 0x50 0x53 0x50 0x69 0x00 0x00 0x00
  Returns the PSP user's nickname. Not supported on 1.50.

I wrote a program to send these commands (except "format") via sg. The output is shown below for a 2.82 PSP:

Code: Select all

Opened /dev/sdb
Command: SCSI Inquiry
  [0000]  12 00 00 00 FF 00                                 ......
Response: 56 bytes
  [0000]  00 80 00 01 33 00 00 00  53 6F 6E 79 20 20 20 20  ....3...Sony....
  [0010]  50 53 50 20 20 20 20 20  20 20 20 20 20 20 20 20  PSP.............
  [0020]  31 2E 30 30 4D 45 4D 4F  52 59 53 54 49 43 4B 2D  1.00MEMORYSTICK.
  [0030]  4D 47 03 01 00 20 20 20                           MG......

Command: Sony 0xFB 0xB4 (unknown)
  [0000]  FB 00 B4 00 00 00 00 01  01 00                    ..........
Response: 64 bytes
  [0000]  00 00 04 01 01 FF FF FF  FF FF FF FF FF FF FF FF  ................
  [0010]  FF FF FF FF FF FF FF FF  FF FF FF FF FF FF FF FF  ................
  [0020]  FF FF FF FF FF FF FF FF  FF FF FF FF FF FF FF FF  ................
  [0030]  FF FF FF FF FF FF FF FF  FF FF FF FF FF FF FF FF  ................

Command: Sony 0xFB 0xB5 (USB string 3)
  [0000]  FB 00 B5 00 00 00 00 00  01 00                    ..........
Response: 128 bytes
  [0000]  50 00 53 00 50 00 00 00  00 00 00 00 00 00 00 00  P.S.P...........
  [0010]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
  [0020]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
  [0030]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
  [0040]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
  [0050]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
  [0060]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
  [0070]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................

Command: Sony 0xFC 0x90 (firmware revision)
  [0000]  FC 00 90 50 53 50 69 00  00 00                    ...PSPi...
Response: 128 bytes
  [0000]  32 2E 38 32 00 00 00 00  00 00 00 00 00 00 00 00  2.82............
  [0010]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
  [0020]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
  [0030]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
  [0040]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
  [0050]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
  [0060]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
  [0070]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................

Command: Sony 0xFC 0x91 (nickname)
  [0000]  FC 00 91 50 53 50 69 00  00 00                    ...PSPi...
Response: 128 bytes
  [0000]  6A 69 6D 70 00 00 00 00  00 00 00 00 00 00 00 00  jimp............
  [0010]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
  [0020]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
  [0030]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
  [0040]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
  [0050]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
  [0060]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
  [0070]  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................

The code is available at http://psp.jim.sh/pspi/. The README there also contains output from a 1.50 PSP.

[jockyw2001]

Interesting. Who knows, maybe there exist other vendor-specific SCSI cmds to flash firmware ..

[TeamOverload]

That's pretty awesome. Nice find :)

[jockyw2001]

Jim, how did you find these scsi cmds? Could there be more, since vendor-specific cmds are in the range 0xc0-0xff ?

[jimparis]

I disassembled usbstorms.prx, I think from 2.71. Those were the only ones I saw in there.