Page 78 of 87 FirstFirst ... 2868777879 ... LastLast
Results 771 to 780 of 863

Thread: Rumor: PS3 JailBreak 2 v3.55 Dongle Plays v3.60+ Game Backups?

  1. #771
    cfwprophet Guest
    Anyway the damn E3 bricked my slim and i got a new slim right today. It's on 4.0 FW and i need to solder down the progskeet and downgrade it. After that i can start to work again. Maybe i know how they get hands on elf's of new games. Already have talked to some respected dev's in IRC and most off them even don't know about that trick.

  2. #772
    HeyManHRU Guest
    will activate one of several effects at random intervals, such as erasing the internal PS3 HDD.
    This scares me, not only will the PS3 HDD get formatted there might be some other effects for not using their dongle, who knows it might even update the PS3 to the latest firmware, or worse. Anyways for anyone with the clone do not attempt to update to 2.6 as of yet (just another remainder for those with any clones).

  3. #773
    Octopus Guest

    TrueBlue lv2_kernel.bin Reverse Engineering

    Hello, everybody! At the last time there was a lot noob news about loading TB lv2_kernel in IDA and what it really does, so I really wanted take a look at this by myself

    This thing is really small, and took a few minutes for rce the "salt" of it. I spend more time writing some scripts for it

    This is my clean idb
    (I dont share my idb with comments, because its mostly Russian comments )

    How you can see it uses some ofbusctaion, unconditionally branches, complex of instructions mtctr and bctrl.
    When you will start reversing sub_80000000007F1114, the first thing what you will see that there is some condition of execution sub_80000000007F0F10.

    Let's look this function, allocating a buffers already a good sign) You look subfunctions and see some crypt) sub_80000000007F0B1C is Tiny Encryption Algorithm
        void decrypt (uint32_t* v, uint32_t* k) {
        uint32_t v0=v[0], v1=v[1], sum=0xC6EF3720, i;       /* set up */
        uint32_t delta=0x9e3779b9;                          /* a key schedule constant */
        uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3];        /* cache key */
        for (i=0; i<32; i++) {                              /* basic cycle start */
            v1 -= ((v0<<4) + k2) ^ (v0 + sum) ^ ((v0>>5) + k3);
            v0 -= ((v1<<4) + k0) ^ (v1 + sum) ^ ((v1>>5) + k1);
            sum -= delta;                                   
        }                                                   /* end cycle */
        v[0]=v0; v[1]=v1;
    r4 - is a key. Tracing it, and wuala decryption key at the adress 800000000035E104. Look next. I think it don't needs comments)
    Closely look what happens between last two. Do you see it?))
    mtctr     r30
    There where magic happens) It jumps inside decrypted code) After this code executed its free a buffer, look back at sub_80000000007F1114, memcpy original code with mounting dev_flash, and jumps to lv2_kernel.self.

    TB made really similar to malware. Now we know that lv2_kernel is Payload Loader, we know where is a key, we know where is Payload)

    I don't have TrueBlue so at this point its all what I can done

    Today I take a look at lv2_kernel's from section 0 of dongle and from TB CFW v2. The first one do the same what lv2_kernel.bin, but for 3.41. Never heard about TB work with 3.41 so they took away this feature. But payload is there, you can see it in updates.

    In TB CFW v2 they change decryption key. The new key is 0x10 from 800000000035E104 xored with 67 EE E4 B3 6D DE EC 0E 70 08 8E F6 D2 D4 97 CC. TB CFW v2 is not much more secured

    At adress 800000000035E100 you can see something what Graf_Chokolo called kthread. Im not 100% sure it gets overwritten or not, but I know what can be there, also I know some part of decrypted code, algo is TEA (64 rounds = 32 cycles), so I can made dictionary and bruteforce it. Not really interested in it because with dongle its in few dozen easier.

    Coming back to TB Updater, you can grab there section numbers and offsets. For example in 2.4 update: 0 - 0x0; A - 0x21F00; C - 0x32F00; E - 0x47700; 10 - 0x58700; 6 - 0x6CF00; 0xF00 and 0x11F00 not written.

    Don't set addresses in others updates, just copypast

    2.1: 0.
    2.2: 0, 4, 2, C, A, 6. 0xF00 0x11F00 0x21F00 0x32F00 0x44F00
    2.3: 0, 4, 2, C, A, 6. 0xF00 0x11F00 0x21F00 0x32F00 0x45700
    2.5: 10, E, 6. 0x12000 0x2D800

    My Twitter:
    Greetings to my friend and great dev flatz:

  4. #774
    Join Date
    Apr 2005

    True Blue PS3 JB2 v2.6 and v2.51 Updates are Released

    Today the True Blue PS3 JB2 v2.6 followed by v2.51 (ReActPSN / Cinavia Remover / Rebug Spoofer bug fix) updates have been released.

    Download: TrueBlue Update v2.6 / TrueBlue Update v2.6 (Mirror) / TrueBlue Update v2.51 / TrueBlue Update v2.51 (Mirror)

    24 - 4 2012

    It has come to our attention that a small number of users may be affected by freezing at boot if using 2.6 dongle fw where they have modified their console cfw's files by installing programs such as ReactPSN, Cineavi protection remover or other such programs. The 2.6 dongle fw functions perfectly where the user has NOT carried out modifications to the console cfw. The console cfw should not be modified when running TB 2.51 cfw or 2.6 cfw, as this will cause incompatibilities which can lead to freezing at boot reported by a few users this evening on the forums.

    In order to provide a feature rich experience for users we will add support for some popular programs/applications in TB CFW 2.61 which will be released within the coming days. We thank all TB users for their continued support and patience whilst we develop feature updates and firmwares.

    Anyone who has modified their TB CFW and is experiencing freezing, may simply revert to 2.51 TB FW using the special fw file attached here and reinstall the 3.55 CFW DG on their console. This will compeletly fix any freezing issues. We kindly remind TB users not to modify the TB console CFW 3.55 unless we explicitly state in the accompanying notes included with upcoming TB 2.61 fw that the program/application is supported.

    How to update:

    1. Make sure your PS3 is running the True Blue "3.55-Dongle-DG" CFW (custom firmware)
    2. Copy TrueBlueUpdate-2.51.pkg from this archive to a USB flash drive
    3. Boot your PS3 _WITHOUT_ True Blue inserted, and then insert the USB flash drive
    4. Navigate to (Game) -> (Install Package Files), and then select TrueBlueUpdate-2.51.pkg
    5. The True Blue updater will be installed onto your PS3 HDD
    6. Navigate to (Game) and load "True Blue Update v2.51"
    7. The updater will start, and will then prompt you to insert the True Blue dongle. Insert it only at this point, and continue. Your dongle will then be updated
    8. After the update procedure has completed your PS3 will reset, and you will then be able to enjoy your updated dongle
    9. You may delete the True Blue Updater from your HDD after the update is complete

    True Blue dongle firmware v2.6 has been released. Changes include:

    Change log: - v2.6
    • Added PS3 firmware version spoofer
    • Game compatibility fixes

    Change log: - v2.51
    • Added compatibility for revised True Blue hardware

    ReActPSN on True Blue CFW v2, Update 2.61 (no previous PSN activation, no VSH mod) via from PatrickBatman:

    REACTPSN 2.0 or 2.2 install for true blue CFW v2 update 2.61 (No previous PSN purchase required the file)

    I havent tried to install reactPSN straight from 2.61 (you may need the VSH file route which is hazardous as you have to modify dev_blind)

    1. Install TB CFW v2 and 2.51 or lower update if havent already.

    2. Put your USB Thumb or USB HDD back into your PC or MAC.

    3. Download both reActPSN v2.0 or 2.20 and Rebug Spoofer 4.00

    4. Now extract reactPSN v2.0.rar (or 2.20) and drag reactPSN v2.0 pkg to the root of your USB Thumb stick or USB HDD, do the same for REbug Spoofer.pkg

    5. On the root of your USB Thumb Stick create a folder called exdata. Whenever you get new rap and edat files drag them into this very folder (Every Time) usb:exdata/rap files. Always leave previous rap and edat files in exdata for when you reuse reActPSN v2.0 for newer games downloaded.

    6. Now install the reActPSN v2.0 pkg and Rebug Spoofer like any other pkg from usb in furthest PS3 right USB port (but dont run the programs created yet)

    7. Turn off PS3 and make sure that the True Blue Dongle is removed, Turn on PS3.

    8. Run rebug Spoofer and spoof your ps3 (install files and activate spoofer, will reboot each time) check system info in XMB to make sure version is 4.00

    9. Run ReActPSN and hold R1 (Some people say Hold Circle instead) during the restart process should only take about 20 seconds. (Holding R1 will make a ReActPSN folder on the base of your usb drive with 2 folders in it "BK0001" and "pubPSN"). Any content you purchased prior to this hack will be backed up in pubPSN folder in the form of rap and edat files (These are the very files needed for us all to activate any shared psn, dlc or psone classic games, THAT YOU OWN. If you had no previous content BK0001 wont be created).

    10. Check to see if reactPSN folder was created on USB HD/STICK if not you didnt hold down R1 or USB HD is not in PS3 right port (cant use HUB at this point)

    12. Copy the exdata folder contents in pubPSN to the exdata folder you created on the root of your USB drive.

    13. Create a new user account on the PS3 called aa

    14. Run reActPSN again *do not push anything this time (it will rename user "aa" to reActPSN v2.0 xrif xedat).

    15. When it's finished your PS3 console will automatically restart again (If not restart PS3 manually).

    16. You'll notice aa has been renamed to something reActPSN v2.0 xrif xedat. Thats it done.

    17. Everytime you want to install new PSN , PSone games or DLC content, just go into reActPSN v2.0 ACCOUNT and rename it to aa (You can do multiple games, dlc, etc at one time, if you have rap and edat files, usb HD needs to be in PS3 right port when doing step 17, 18 & 19)

    18. Download, extract rap and edat files (that came with dlc.pkg etc) to exdata folder on the root of your USB Thumb stick or USB HDD

    19. Run reActPSN v2.0 (app) again, then install psn game, dlc, or psone classic pkg(s) after reboot.

    20. Make sure to keep all previously activated rap and edat files in the exdata folder on Root of USB Thumb stick or HDD for everytime you use reActPSN v2.0 and also for archival purposes.

    21. Plug in true blue dongle, start PS3, ReactPSN will now work for 2.51 and lower TB update Continue for 2.61 update.

    22. Open rebug spoofer (app), and hit L1 + X that un spoofs (console reboots) it then go back to it and hit L1 + O that uninstalls the files (console reboots again)

    23. Then update to 2.61. system info should read true blue 4.11, 2.61 (or something like that)

    24. Run reactPSN (app) again, play game ("reactPSN" USB HD can now be plugged into hub if need be)

    credits to: ps3iso, piratan and myself

    Finally, from zadow:

    trueupdate 2.6 disassemply:

  5. #775
    Bartholomy Guest
    2.6 is a spoofer 4.11 version, but no PSN access, obviously

  6. #776
    bitsbubba Guest
    payload spoofing doesn't work with a pre-patch vsh.self, it's possible they'll have to figure how to apply reAct patches through payload

  7. #777
    Bartholomy Guest
    Yep, it's what i guess will be part of 2.61

  8. #778
    TheDevil Guest

    True Blue PS3 JB2 v2.61 Update Released

    True Blue PS3 JB2 v2.61 update released:

    Download: TrueBlue Update v2.61 / TrueBlue Update v2.61 (Mirror) / TrueBlue Update v2.61 (Mirror #2) / TrueBlue Update v2.61 (Mirror #3) / TrueBlue Update v2.61 (Mirror #4)

    26 - 4 – 2012

    True Blue dongle firmware v2.61 has been released. Changes include:
    • Added PS3 firmware version spoofer
    • Game compatibility fixes

    Note: remember if you are on 2.51 or 2.6 already you will need to first reinstall the old v2 CFW v2.5 first and then install the 2.61 patch on top of that (as explained in the patch readme.txt)

    Payload True Blue 2.61 EBOOT Offset by franzes80:

    I am pleased to issue you the payload of true blue (the last version 2.61). I do not know if it was already 'been discovered by someone, but from what I've seen no one has posted something genere. To whom is developer release download of my discovery I'm a programmer (no faker). I want to help the scene ps3. This file is the result of my study. The software used is IDA PRO.
    SHA1: 7CEA46601B717912D6A434CA2C164E0A9B890825 // 
    MD5: 1114BC3061581FC592A3797B340FD545 // 
    CRC32: B66F50FD // 
    CRC16: B685
    Release also forgot EBOOT.BIN @ offset:
    Offset(h) Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
    00008768 00000000 E4 C7 60 B6 E3 77 C2 89 B3 71 1D 06 EE 4C DF F7 `w‰q..L
    00066F58 0005E7F0 99 0A 4C 65 2A CE DE D6 0D C8 D2 73 FC B3 85 E2 ™.Le*.s…
    Thank you. My study is in FPGA inside true blue:

    True Blue Payload v2.61

    Payload (2.61) located in unself'ed eboot.bin @ offset (via
      Offset(h)  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
      00008768   00000000  E4 C7 60 B6 E3 77 C2 89 B3 71 1D 06 EE 4C DF F7  `w‰q..L
      00066F58   0005E7F0  99 0A 4C 65 2A CE DE D6 0D C8 D2 73 FC B3 85 E2  ™.Le*.s…
    payload_2.61.bin (378 KB)
    SHA1: 7CEA46601B717912D6A434CA2C164E0A9B890825 // 
    MD5: 1114BC3061581FC592A3797B340FD545 // 
    CRC32: B66F50FD // 
    CRC16: B685
    IDA DB: TrueBlueUpdate-2.61.idc (203 KB)

  9. #779
    pr0p0sitionJOE Guest
    This is where we need some kind of co-op with TB team and hotz. If reactpsn compatibility would be implemented in new TBCFW or dongle update, this would give us much more working space for fixing additional content.

    My team sucessfully fixed several TB games DLCs with use of reactpsn. I hate use of reactpsn to play games. Fully fixed games are the way it should be. Some users don't have act.dat file for never loggin onto PSN and they are forced to use rebug. Rebug is not possible anymore with TB 2.5.

    Even better option for us would be if TB team implements "peek and poke" in their CFW so we can fully fix games with help of reactpsn or ps3tools. Then the need for edited VSH.self for TB CFWv2 becomes unnecessary. If this is problematic for TB CFW stability or whatever, then some kind of "switch mode" should be available to enter "peek and poke mode" so we can do our thing and return to "normal payload mode" with DLC content fully fixed. Time to expand views.

    Further more, releasing fixed update patches for TB games is necessary for all DLC content to work properly or to work at all. Releasing games with base content only if not enough anymore. Some games expand or get upgraded with DLC content. That's it from me.

  10. #780
    Join Date
    Apr 2005

    True Blue Patch Viewer

    Below is a True Blue Patch Viewer from Corwin75 via French site ( for those interested. Rough translation (from

    It aims to list all Eboot.bin compatible with the True Blue Dongle and to make available patches created by the various Team direct download. It also incorporates the latest update of True Blue Dongle.

    Our goal is to keep it updated constantly so that each new release of patch is integrated into the app. Here are the features:
    • 4 downloads allowed then a wait of an hour to re-download
    • Update the constant soft output of each new patch
    • Download the latest update for the dongle True Blue
    • Description and display screen of the patch
    • Direct download link

    If you have any ideas or advice on improving the software contact us.

    Finally, Guillaume17 has made available a True Blue Patch Downloader here ( and a version with the '4 downloads per hour limit restriction' removed is also available here:

    Also <GEEK> has made available a partial decompiled source code of the application here:

    Cipher Text
    Decrypted URL
    Cipher Text
    Decrypted URL

Page 78 of 87 FirstFirst ... 2868777879 ... LastLast

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts