Sponsored Links

Sponsored Links

Details and Payloads for Dumping PS3 Per Console Keys Surface


Sponsored Links
174w ago - PlayStation 3 developers have been busy recently working on payloads for dumping the PS3 per console keys, as once the per_console_key_0 is obtained with full EID decryption dongles and burned BR-D's may be a thing of the past.

Below are details from sphinxkoma and the PS3 Wiki (ps3devwiki.com/index.php?title=Talk:Per_Console_Keys) on dumping the per_console_key_1 via Kaz... it's only a matter of time for per_console_key_0 which unlocks everything we need.

To quote: PS3 Per Console Keys

EID crypto is very complicated, it is done so on purpose. first of all EID0 isn't decrypted with one key, and one algorithm alone. it is decrypted in several parts which use different algos and keys. the keys are all derivations of a per console key (per_console_key_1) which is stored inside metldr and copied by it to sector 0 and never leaves isolation. that same key is a derivation of the per console key (per_console_key_0) used to encrypt metldr and the bl in the first place as well.

isoldr clears that key from sector 0 before jumping to the isolated module. but before doing so it encrypts it with another keyset and stores it in a buffer so that the isolated module can use the new crafted key. since the operation is AES, if you know that keyset you can decrypt the crafted key and get the eid root key without pwning a loader or metldr through an isolated module.

that is not like you really need it because you can already use the crafted key to decrypt some of eid0, but not all of it. and the crafted key also uses the first elf section to be built as in your isolated module will have a small section which only contains a key. and that key is used as another layer by isoldr to encrypt the buffer with it. so basically you have 2 encryption layers over the root key. the final key then decrypts a specific part of the EID.

eid crypto is actually done smart. that is because most of it originally comes from the cell bootrom, as in they reuse the same algo used for metldr binaries and bl in the eid crypto, including some of the keys and the steps. and you cannot decrypt all of the eid sections unless you gathered every single keys and steps. and there are a lot then you still have to figure out wtf it is you decrypted because eid is actually full of keys.

1. payloader3 create new possible source of or precompiled:

payloader3-341.pkg: http://www.multiupload.com/JKKZG58NOR
payloader3-315.pkg: http://www.multiupload.com/MB7NE5AJYC

2. Install payloader3 pkg on the ps3

3. export in the terminal set
a. export PS3LOAD = tcp: ipaddress.of.ps3
b. start socat (socat tcp-recv: 18194 stdout)

4. payloader3 pkg start on ps3

5. It is quite likely to see is not the picture (black screen) but you will hear a distinct sound (like C64) Now things are different feasible:

a. X 4eck then starts with ps3load ethdebug
b. then you will want to circle back to the xmb and invites ethdebug (for Debuging pkg files)

6. Use your ps3load the mode used to send your ps3 dump_eid_root_key.self (ps3load dump_eid_root_key.self) Now you should see debug Terminal in your debugging and then hopefully you'll find the PCK .. (theoretically)

The per console key is used to derive other keys, some of which Sony can't change as this appears to be the bottom of their encryption chain. It's also important to note that this method is intended for dumping per_console_key_1 and per_console_key_n while per_console_key_0 is currently still required.

However to speculate, in future PS3 CFW updates users may need to be on a Custom Firmware to begin with (or downgrade to one first) and then run a .PKG to get their per console encryption key, followed by using it in a PS3 MFW Builder and installing the resulting modified PS3 Firmware on their PlayStation 3 console.

From ps3devwiki.com/index.php?title=Per_Console_Keys#per_console_root_key_0:

  • metldr is decrypted with this key
  • bootldr is decrypted with this key
  • might be obtained with per_console_root_key_1? (largely speculative, not nec. true - need more looked into, only based on the behavior of the other derivatives known to be obtained through AES)

Finally, from the PlayStation 3 Wiki (ps3devwiki.com/index.php?title=Per_Console_Keys and ps3devwiki.com/index.php?title=Boot_Order#Chain_of_Trust for the PS3 boot order) pages:

Per Console Keys

per_console_root_key_0

  • metldr is decrypted with this key
  • bootldr is decrypted with this key
  • might be obtained with per_console_root_key_1? (largely speculative, not nec. true - need more looked into, only based on the behavior of the other derivatives known to be obtained through AES)

per_console_root_key_1 / EID_root_key

  • derived from per_console_key_0
  • stored inside metldr
  • copied to sector 0 by metldr
  • cleared by isoldr
  • Used to decrypt part of the EID
  • Used to derive further keys
  • can be obtained with a modified isoldr that dumps it
  • can be obtained with a derivation of this key going backwards

obtaining it

launch the patched isoldr with your prefered method

Option 1 - dumper kernel module

  • modify glevands spp_verifier_direct to dump the mbox to wherever_you_want and then (use the payload below as an example)
  • the example code on how to dump the mbox can be found on the Option 2 - dumper payload below

[Register or Login to view code]

Option 2 - dumper payload

http://pastie.org/pastes/2101977

[Register or Login to view code]



Comments

  • What this selfs do is dump your ISOLATED SPU LS through your mbox, so you only need a way to cach this info with PPU code in lv2 enviroment aka a dongle payload or linux kernel
  • This has been tested and proven to work on 3.55 MFW
  • In the dump the remaining dump is the metldr clear code. metldr clears itself and all the registers an jumps to isoldr.
  • Overwriting that code lets you dump your key + metldr
  • Consider that per_console_key_1 and per_console_key_n are in fact still in need decryption.
  • per_console_key_0 particularly needs to be dumped once revived from per_console_key_1.

per_console_root_key_2 / EID0_key

  • this key can be obtained through AES from EID_root_key
  • EID can be partially decrypted by setting this key in anergistics and fireing aim_spu_module.self
  • Load aim_spu_module.self + EID0 + EID0_key in anegistics = decrypted EID0
  • This code is to decrypt your EID0 on your PC http://pastie.org/2000330

    [Register or Login to view code]

  • The prerequisites are:
  • dump your EID0 from your ps3 and save it in the same folder as EID0
  • dump your EID0_key from your ps3 and put it on the code above where the key is needed
  • load all of them in anergistic
  • EID0_key could also be obtained with EID_root_key directly in the following manners:
  • knowing the algorithm (located in isoldr)and applying it to the EID_root_key
  • letting isoldr apply that algorithm directly in anergistic
  • the process is exactly as the one above (modifing anergistic to feed isoldr with EID_root_key

obtaining it


per_console_root_key_n

  • these are further derivations of the per_console_key_1/EID_root_key

Documentation

  • polarssl.org/trac/browser/trunk/library/aes.c

From VenomousX: How to obtain this EID_root_key?

  • Patch isoldr to dump the local storage of sector 0
  • Load the patched isoldr
  • Dump the local storage
  • You will find eid_root_key
  • Use it to decrypt the eid0.

How to load back the isoldr:

  • Use glevand's tools, spp_verifier_direct to be specific: "spp_verifier_direct is a kernel module which shows you how to run isolated SPE modules on OtherOS++ Linux by using metldr directly.
  • It decrypts default.spp profile.
  • Once you get the eid rootkey, load aim_spu_module.self with eid0 and the eid root key within anergistics it will decrypt it.
  • You can modify it easily to run other SPE modules.
  • Has been done and tested on 3.41 and 3.55 (not by myself)

So yes, you can obtain the eid rootkey and partially decrypt the eid0, but the problem if you want to modify the eid0 (say... to get a DEX idps to convert CEX=>DEX (which doesnt have much got use for end-users, only devs)) then you'd need to re-encrypt the EID0, which you can't. Not with those keys at least.

Oh, and while PS3 rootkeys are per console, and usually FW independent. However I dont know about 3.6+ because I didn't test it on it. But it might be true that 3.6+ eid rootkey have changed since $ony changed a load of keys with 3.6+. So using the 3.55 eid_root_key on 3.6+ to decrypt anything probably wont work.

Sony PlayStation 3 hacker moogie301 states the following on this via Twitter: "There are 3 per console keys. it tells you how to obtain 2 (per console key 1 and per console key n) not THE root key. It will not lead to a new CFW, it is fun for devs, you can decrypt a lot of eid and reverse it.. it is not newb friendly at all."

PlayStation 3 hacker defyboy has also added the following: "I don't think this is a step closer to discovering the per-console root key. The EID root key is generated at factory and incorporated into metldr. metldr is encrypted with your per-console root key and stored on flash. Please note that while it is speculated that the EID root key is a derivative of the root key, that does not mean that it can be used to calculate the root key. Infact, being able to do so is idiotically counter-intuitive of the purpose of having two separate keys.

The per-console root key is likely burnt into the CPU via One Time Programming over the JTAG port, of which is disabled after programming. There is a hardware decryption routine that uses this key called Runtime Secure Boot, you cannot access or invoke this routine because it only runs when you load an encrypted image into an isolated SPU.

This is IBM's design, not sony's. This was designed to be a very secure multi-purpose processor and it was designed by a company that designs security and military systems for governments and large organizations, not a company that mostly makes consumer grade TV's and DVD Players. It was Sony's implementation of the secure chain of trust that failed but I don't see IBM's part failing anytime soon.

This paper explains everything: http://www.ibm.com/developerworks/power/library/pa-cellsecurity/

Anyway, Sony cannot change metldr or bootldr on current hardware so they no longer have control of those, we only need to dump bootldr to get the lv0 key, this is the highest level sony can change. If we get the lv0 key we can generate a private key where we will be able to decrypt/re-encrypt the entire chain of firmware for current/future firmware."

The Per Console Key in the Cell decrypts bootldr, which is encrypted with the PCK. Bootldr decrypted is the same in EVERY console to date (except possibly the 3K series). When bootldr decrypts lv0, bootldr will be as if it were nowhere to be found. Then you go from there to the Chain of Trust.

Below is Gitbrew's feedback on the PS3 Per Console Key and future developments from them, as follows:

what do you think about the new method of getting the per_console_key?

Durandal: Glevand and many others have been working feverishly to develop methods of obtaining this key. It's nice to see it's paid off. I'm looking forward to a day when the PS3 is as open a development as the PSP.

Snowy: One step closer, sooner or later ibm is going to finally send a cease and desist. We'll put that right up next to dasmoovers sign.

Do you have anyone working on an easy to use tool for the key? we are already used to gitbrew pkgs

Durandal: If we weren't, we'd have to quit gitbrew and join PS360...

Snowy: I'm pretty sure anything related to the rootkey, we might leave out just so that people actually learn how to get their own keys. As a sort of accomplishment type thing, but eventually there will be simple pkg files released to do it.

What next projects are we going to see from gitbrew regarding the ps3 scene? can we see some sort of "one day one announcement", like you did a couple of weeks ago?

Durandal: Well RSX is taken care of, NPDRM is getting very close to being irrelevant, and I've heard there's almost usable versions of psl1ght floating around. I guess the next really big thing you'll see is the release of the gitSkeet flasher.

We teamed up with progskeet and rebug to create a special edition of the progskeet2 that will have solderless clips and the kind of support and documentation only gitbrew is capable of providing. It also gives us an opportunity to branch out into the actual hardware exploitation as well. As far as having announcement a day weeks, expect to see more of them in the not so distant future.

What is your thought on the recent discoveries on the ps3 scene?

The new jb2 dongle AKA true blue.

Durandal: I'm always very wary of dongles. Usually they're just a ploy to make a buck, and these days it doesn't take long for someone to reverse what the software they're trying to hide does. Expect to see the same happen here. If we want to deter others from trying to peddle their software in a dongle form, we should make a point of reversing a dongle's functionality
and implementing it in a package. I'm sure that group paid a lot of money to get all those dongles made, and they'd hate to see that money go to waste.

Snowy: Yet again as durandal said, dongles are dongles, regardless someone is going to take a crack at them and release a free version of it. Cobra hasn't even been touched by most of the developers, and those who have touched it don't really care for piracy. I would like to thank dean for taking the first step in making psx backups working though, a small step but none the less towards the proper direction for the scene.

Finally, FiniteElement via ps3devwiki.com/index.php?title=Special:Contributions/FiniteElement states the following hint for those interested, to quote: "(you have all you need already just read carefully (compare option2 code with the kernel module code))

He also updated the PS3 SPU Isolated Modules Reverse Engineering page with the changes documented here: ps3devwiki.com/index.php?title=SPU_Isolated_Modules_Reverse_Engineering&diff=prev&oldid=6328





Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter, Facebook and drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene and PlayStation 4 scene updates and fresh homebrew PS3 Downloads. Enjoy!
Sponsored Links
Sponsored Links

Comments 862 Comments - Go to Forum Thread »

• Please Register at PS4News.com or Login to make comments on Site News articles.
 
#782 - PS4 News - 144w ago
PS4 News's Avatar
Today True Blue PS3 JB2 v2.7 Firmware has been released for those with the dongle, with details below as follows:

Download: TrueBlue Update v2.7 / TrueBlue Update v2.7 (Mirror) / TrueBlue Update v2.7 (Mirror #2) / TrueBlue Update v2.7 (Mirror #3)

24 - 5 – 2012

True Blue dongle firmware v2.7 has been released.

Changes include:

  • True Blue dongle authenticity status displayed on PS3 XMB system information screen
  • Fixed yet another important game compatibility issue affecting recent 4.xx games

The authenticity status display can be used to determine if your True Blue dongle is either authentic or a clone.

For further details, see the information page. How do I know if I have a TB clone?

Q: How can I verify that my True Blue is authentic and not a clone?

A: Install True Blue dongle firmware v2.7 or later.

Then in the PS3 XMB, navigate to Settings -> System Settings -> System Information. Next to the "System Software" version will be information relating to your True Blue dongle. If your dongle is authentic then it will display something like "True Blue v2.7" (this will vary depending on the version of the dongle firmware you have installed).

If your dongle is a clone then it will display "True Blue CLONE" as shown in the following image:

s3nint3!
True Blue Payload v2.7

Download: True Blue Payload v2.7

Payload (2.7)

located in unself'ed eboot.bin @ offset:

[Register or Login to view code]


TB_payload_27.bin (382 KB): http://www.ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.7/TB_payload_27.bin

[Register or Login to view code]


#781 - PS4 News - 145w ago
PS4 News's Avatar
Today True Blue has issued another warning about a TB PS3 dongle clone, as follows:

21 - 5 - 2012

A new clone has appeared (item.taobao.com/item.htm?id=13491601183) using a very similar external housing to that of True Blue. However, after removing the clone PCB from its exterior casing it becomes evident that there are a number of major differences:

  • Actel used is A3P125 instead of larger A3P250 used on True Blue.
  • Clone uses a cheap MCU and cheap dip type crystal in addition to cheaper Actel instead of full Actel integration in the original True Blue design
  • Clone has a tact switch which the original does not require, and switch can only be accessed by pulling PCB out of the case
  • Actel logic on clone is based on partial guess work of the original and will not function correctly in future updates
  • PCB circuit design is highly congested, with numerous visual differences evident, such as programming pads for the MCU and addiional resistors/caps

Please refer to the pictures shown below, to compare the original and clone.

A new software update will be made publicly available in the next few days which will allow users to differentiate original from clone by performing a firmware update.

#780 - PS4 News - 146w ago
PS4 News's Avatar
The True Blue PS3 JB2 v2.62 update is now available with the changes outlined below, as follows:

Download: True Blue PS3 JB2 v2.62 Update / True Blue PS3 JB2 v2.62 Update (Mirror)

10 - 5 – 2012

True Blue dongle firmware v2.62 has been released.

Changes include:

  • Fixed a major game compatibility issue which will allow the release of several popular, previously incompatible titles
  • Improved system stability

Recently, EBOOT patches have slowed due to a compatibility issue which prevented recent games from running on 3.55 CFW. This issue has been resolved as of this firmware release, thus we strongly recommend that everyone update their True Blue dongles as soon as possible in anticipation of the upcoming batch of releases.

In related news, Corwin75 has updated True Blue Patch Viewer to V2.0.3 followed by V2.0.5 with the changes outlined below.

Download: True Blue Patch Viewer to V2.0.3

Rough translation from games-hack.fr/index.php?threads/6561/:

About True Blue Patch Viewer V2.0.3:

Here is a brief explanation on how to use the True Blue Patch Viewer 2.0.3:

  • Download the True Blue Patch Viewer and then start (If you just want to download the patch on your PC tutorial is not for you)
  • Connect your PS3 CFW then link to your PC Connection Sharing
  • Then launch your FTP server then connect to Anonymous
  • Then choose "PS3" from the drop down
  • On the True Blue patch viewer enter the IP of your PS3 as: 192.168.x.xx
  • Then choose if you want to transfer to your external hard drive or internal

Features 2.0.3:

  • Download limit removed
  • Download the True Blue CFW
  • Choice ranking order of the patches
  • Ability to search a patch directly from the software
  • Send and extraction patches directly on the PS3 in the game folder (Compatible with internal & external hard drive) BETA
  • Simplified extraction when extracting on PC
  • Visualization of the region of the patch when selected
  • Automatic Update
  • Server Status

Features 2.0.5:

  • Fixes a minor issue.

Download: True Blue Patch Viewer to V2.0.5

True Blue Payload v2.62

Download: True Blue Payload v2.62

Payload (2.62)

located in unself'ed eboot.bin @ offset:

[Register or Login to view code]


payload_2.62.bin (378 KB): http://www.ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.62/payload_2.62.bin

[Register or Login to view code]


#779 - PS4 News - 147w ago
PS4 News's Avatar
Below is a True Blue Patch Viewer from Corwin75 via French site (games-hack.fr/index.php?threads/release-true-blue-patch-viewer.6580/) for those interested. Rough translation (from ps-addict.fr/forum/True-Blue-Patch-Viewer-File-Downloader-t6296.html):

It aims to list all Eboot.bin compatible with the True Blue Dongle and to make available patches created by the various Team direct download. It also incorporates the latest update of True Blue Dongle.

Our goal is to keep it updated constantly so that each new release of patch is integrated into the app. Here are the features:

  • 4 downloads allowed then a wait of an hour to re-download
  • Update the constant soft output of each new patch
  • Download the latest update for the dongle True Blue
  • Description and display screen of the patch
  • Direct download link

If you have any ideas or advice on improving the software contact us.

Finally, Guillaume17 has made available a True Blue Patch Downloader here (http://www.mediafire.com/?319bdf61pqovar6) and a version with the '4 downloads per hour limit restriction' removed is also available here: http://www.mediafire.com/?m13fm2qeo38p3f3

Also has made available a partial decompiled source code of the application here: http://pastebin.com/uJTdMY04

patch.xml

[Register or Login to view code]


DF.xml

[Register or Login to view code]



[Register or Login to view code]


#778 - pr0p0sitionJOE - 148w ago
pr0p0sitionJOE's Avatar
This is where we need some kind of co-op with TB team and hotz. If reactpsn compatibility would be implemented in new TBCFW or dongle update, this would give us much more working space for fixing additional content.

My team sucessfully fixed several TB games DLCs with use of reactpsn. I hate use of reactpsn to play games. Fully fixed games are the way it should be. Some users don't have act.dat file for never loggin onto PSN and they are forced to use rebug. Rebug is not possible anymore with TB 2.5.

Even better option for us would be if TB team implements "peek and poke" in their CFW so we can fully fix games with help of reactpsn or ps3tools. Then the need for edited VSH.self for TB CFWv2 becomes unnecessary. If this is problematic for TB CFW stability or whatever, then some kind of "switch mode" should be available to enter "peek and poke mode" so we can do our thing and return to "normal payload mode" with DLC content fully fixed. Time to expand views.

Further more, releasing fixed update patches for TB games is necessary for all DLC content to work properly or to work at all. Releasing games with base content only if not enough anymore. Some games expand or get upgraded with DLC content. That's it from me.

#777 - TheDevil - 148w ago
TheDevil's Avatar
True Blue PS3 JB2 v2.61 update released:

Download: TrueBlue Update v2.61 / TrueBlue Update v2.61 (Mirror) / TrueBlue Update v2.61 (Mirror #2) / TrueBlue Update v2.61 (Mirror #3) / TrueBlue Update v2.61 (Mirror #4)

26 - 4 – 2012

True Blue dongle firmware v2.61 has been released. Changes include:

  • Added PS3 firmware version spoofer
  • Game compatibility fixes

Note: remember if you are on 2.51 or 2.6 already you will need to first reinstall the old v2 CFW v2.5 first and then install the 2.61 patch on top of that (as explained in the patch readme.txt)

Payload True Blue 2.61 EBOOT Offset by franzes80: https://www.dropbox.com/s/uucp2iejjffgpsf/payload_2.61.bin

I am pleased to issue you the payload of true blue (the last version 2.61). I do not know if it was already 'been discovered by someone, but from what I've seen no one has posted something genere. To whom is developer release download of my discovery I'm a programmer (no faker). I want to help the scene ps3. This file is the result of my study. The software used is IDA PRO.

[Register or Login to view code]


Release also forgot EBOOT.BIN @ offset:

[Register or Login to view code]


Thank you. My study is in FPGA inside true blue:

s3nint3!
True Blue Payload v2.61

Payload (2.61) located in unself'ed eboot.bin @ offset (via ps3devwiki.com/wiki/ReDRM_/_Piracy_dongles):

[Register or Login to view code]


payload_2.61.bin (378 KB)
Download: http://www.ps4news.com/forums/attachment.php?attachmentid=32852

[Register or Login to view code]


IDA DB: TrueBlueUpdate-2.61.idc (203 KB)
Download: http://www.ps4news.com/forums/attachment.php?attachmentid=32854

#776 - Bartholomy - 148w ago
Bartholomy's Avatar
Yep, it's what i guess will be part of 2.61

#775 - bitsbubba - 148w ago
bitsbubba's Avatar
payload spoofing doesn't work with a pre-patch vsh.self, it's possible they'll have to figure how to apply reAct patches through payload

#774 - Bartholomy - 149w ago
Bartholomy's Avatar
2.6 is a spoofer 4.11 version, but no PSN access, obviously

#773 - PS4 News - 149w ago
PS4 News's Avatar
Today the True Blue PS3 JB2 v2.6 followed by v2.51 (ReActPSN / Cinavia Remover / Rebug Spoofer bug fix) updates have been released.

Download: TrueBlue Update v2.6 / TrueBlue Update v2.6 (Mirror) / TrueBlue Update v2.51 / TrueBlue Update v2.51 (Mirror)

24 - 4 - 2012

It has come to our attention that a small number of users may be affected by freezing at boot if using 2.6 dongle fw where they have modified their console cfw's files by installing programs such as ReactPSN, Cineavi protection remover or other such programs. The 2.6 dongle fw functions perfectly where the user has NOT carried out modifications to the console cfw. The console cfw should not be modified when running TB 2.51 cfw or 2.6 cfw, as this will cause incompatibilities which can lead to freezing at boot reported by a few users this evening on the forums.

In order to provide a feature rich experience for users we will add support for some popular programs/applications in TB CFW 2.61 which will be released within the coming days. We thank all TB users for their continued support and patience whilst we develop feature updates and firmwares.

Anyone who has modified their TB CFW and is experiencing freezing, may simply revert to 2.51 TB FW using the special fw file attached here and reinstall the 3.55 CFW DG on their console. This will compeletly fix any freezing issues. We kindly remind TB users not to modify the TB console CFW 3.55 unless we explicitly state in the accompanying notes included with upcoming TB 2.61 fw that the program/application is supported.

How to update:

1. Make sure your PS3 is running the True Blue "3.55-Dongle-DG" CFW (custom firmware)
2. Copy TrueBlueUpdate-2.51.pkg from this archive to a USB flash drive
3. Boot your PS3 _WITHOUT_ True Blue inserted, and then insert the USB flash drive
4. Navigate to (Game) -> (Install Package Files), and then select TrueBlueUpdate-2.51.pkg
5. The True Blue updater will be installed onto your PS3 HDD
6. Navigate to (Game) and load "True Blue Update v2.51"
7. The updater will start, and will then prompt you to insert the True Blue dongle. Insert it only at this point, and continue. Your dongle will then be updated
8. After the update procedure has completed your PS3 will reset, and you will then be able to enjoy your updated dongle
9. You may delete the True Blue Updater from your HDD after the update is complete

True Blue dongle firmware v2.6 has been released. Changes include:

Change log: - v2.6

  • Added PS3 firmware version spoofer
  • Game compatibility fixes

Change log: - v2.51

  • Added compatibility for revised True Blue hardware

ReActPSN on True Blue CFW v2, Update 2.61 (no previous PSN activation, no VSH mod) via ps3crunch.net/forum/threads/3353-reactPSN?p=38306#post38306 from PatrickBatman:

REACTPSN 2.0 or 2.2 install for true blue CFW v2 update 2.61 (No previous PSN purchase required the act.date file)

I havent tried to install reactPSN straight from 2.61 (you may need the VSH file route which is hazardous as you have to modify dev_blind)

1. Install TB CFW v2 and 2.51 or lower update if havent already.

2. Put your USB Thumb or USB HDD back into your PC or MAC.

3. Download both reActPSN v2.0 or 2.20 and Rebug Spoofer 4.00

4. Now extract reactPSN v2.0.rar (or 2.20) and drag reactPSN v2.0 pkg to the root of your USB Thumb stick or USB HDD, do the same for REbug Spoofer.pkg

5. On the root of your USB Thumb Stick create a folder called exdata. Whenever you get new rap and edat files drag them into this very folder (Every Time) usb:exdata/rap files. Always leave previous rap and edat files in exdata for when you reuse reActPSN v2.0 for newer games downloaded.

6. Now install the reActPSN v2.0 pkg and Rebug Spoofer like any other pkg from usb in furthest PS3 right USB port (but dont run the programs created yet)

7. Turn off PS3 and make sure that the True Blue Dongle is removed, Turn on PS3.

8. Run rebug Spoofer and spoof your ps3 (install files and activate spoofer, will reboot each time) check system info in XMB to make sure version is 4.00

9. Run ReActPSN and hold R1 (Some people say Hold Circle instead) during the restart process should only take about 20 seconds. (Holding R1 will make a ReActPSN folder on the base of your usb drive with 2 folders in it "BK0001" and "pubPSN"). Any content you purchased prior to this hack will be backed up in pubPSN folder in the form of rap and edat files (These are the very files needed for us all to activate any shared psn, dlc or psone classic games, THAT YOU OWN. If you had no previous content BK0001 wont be created).

10. Check to see if reactPSN folder was created on USB HD/STICK if not you didnt hold down R1 or USB HD is not in PS3 right port (cant use HUB at this point)

12. Copy the exdata folder contents in pubPSN to the exdata folder you created on the root of your USB drive.

13. Create a new user account on the PS3 called aa

14. Run reActPSN again *do not push anything this time (it will rename user "aa" to reActPSN v2.0 xrif xedat).

15. When it's finished your PS3 console will automatically restart again (If not restart PS3 manually).

16. You'll notice aa has been renamed to something reActPSN v2.0 xrif xedat. Thats it done.

17. Everytime you want to install new PSN , PSone games or DLC content, just go into reActPSN v2.0 ACCOUNT and rename it to aa (You can do multiple games, dlc, etc at one time, if you have rap and edat files, usb HD needs to be in PS3 right port when doing step 17, 18 & 19)

18. Download, extract rap and edat files (that came with dlc.pkg etc) to exdata folder on the root of your USB Thumb stick or USB HDD

19. Run reActPSN v2.0 (app) again, then install psn game, dlc, or psone classic pkg(s) after reboot.

20. Make sure to keep all previously activated rap and edat files in the exdata folder on Root of USB Thumb stick or HDD for everytime you use reActPSN v2.0 and also for archival purposes.

21. Plug in true blue dongle, start PS3, ReactPSN will now work for 2.51 and lower TB update Continue for 2.61 update.

22. Open rebug spoofer (app), and hit L1 + X that un spoofs (console reboots) it then go back to it and hit L1 + O that uninstalls the files (console reboots again)

23. Then update to 2.61. system info should read true blue 4.11, 2.61 (or something like that)

24. Run reactPSN (app) again, play game ("reactPSN" USB HD can now be plugged into hub if need be)

credits to: ps3iso, piratan and myself

Finally, from zadow:

true2_6_pipe_dump: http://tinypaste.com/af160163
trueupdate 2.6 disassemply: http://tinypaste.com/781ccc23

 

Sponsored Links

Sponsored Links







Advertising - Affiliates - Contact Us - PS4 Downloads - PS4 Forums - Privacy Statement - Site Rules - Top - © 2015 PlayStation 4 News