Hardware/SEEPROM

Photo courtesy of Flylogic

The Hollywood package contains a 93C56 (or similar) SPI EEPROM, organized as 128 16-byte words. It is accessed by twiddling some of the Starlet GPIO lines. Most of the data here is written once at the factory and never changed, but some fields are updated fairly frequently.

               struct {
                       u32 ms_id;             // 0x00
                       u32 ca_id;             // 0x04
                       u32 ng_key_id;         // 0x08
                       u8 ng_sig[60];         // 0x0C
                       struct {               // 0x48
                               union {
                                      struct {
                                             u8 boot2version;
                                             u8 unknown1;
                                             u8 unknown2;
                                             u8 pad;
                                             u32 update_tag;
                                      } __attribute__((packed));
                                      u16 data[4];
                               };
                               u16 checksum; // sum of data[] elements?
                       } boot2_counters[2];
                       struct {
                               union {
                                      u32 nand_gen; // matches offset 0x8 in nand SFFS blocks
                                      u16 data[2];
                               } __attribute__((packed));
                               u16 checksum; // sum of data[] elements?
                       } nand_counters[3]; // current slot rotates on each write
                       u8 pad0[6];            // 0x6E
                       u8 korean_key[16];     // 0x74
                       u8 pad1[116];          // 0x84
                       u16 prng_seed[2];      // 0xF8 u32 with lo word stored first, incremented every time IOS starts.
                                              // Used with the PRNG key to setup IOS's PRNG (syscalls 73/74 etc.)
                       u8 pad2[4];            // 0xFC
               };

^[check]