Hardware/SEEPROM

Photo courtesy of Flylogic

The Hollywood package contains a 93C56 (or similar) SPI EEPROM, organized as 128 16-byte words. It is accessed by twiddling some of the Starlet GPIO lines. Most of the data here is written once at the factory and never changed, but some fields are updated fairly frequently.

               struct {
                       u32 ms_id;             // 0x00
                       u32 ca_id;             // 0x04
                       u32 ng_key_id;         // 0x08
                       u8 ng_sig[60];         // 0x0C
                       struct {               // 0x48
                               union {
                                      struct {
                                             u8 boot2version;
                                             u8 unknown1;
                                             u8 unknown2;
                                             u8 pad;
                                             u32 update_tag;
                                      };
                                      u16 data[4];
                               };
                               u16 checksum; // sum of all data[] elements?
                       } counters[2];
                       u32 nand_generation;   // 0x5C not the same as SFFS generation
                       u8 pad0[20];           // 0x60
                       u8 korean_key[16];     // 0x74
                       u8 pad1[116];          // 0x84
                       u16 prng_seed[2];      // 0xF8 u32 with lo word stored first, incremented every time IOS starts, 
                       u8 pad2[4];            // 0xFC
               };

^[check]