PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!

Home PS4 News - Latest PlayStation 4 and PS3 News

July 8, 2011 // 4:59 pm - Today Spanish PlayStation 3 developer JaicraB has explained the Cobra USB JIG protection RTOC trick implemented for the PS3 against cloning the device.

To quote, roughly translated: Flynn sent me this text explaining this protective carrying the Cobra, I hope it will open the eyes of those interested in reversing the dumps.

EXPLAIN RTOC COBRA TRICK

The JIG Cobra has several protective measures to ensure that your code could not be used correctly even if your code could be dumped.

This trick RTOC in the registry is the first used for this purpose in addition to hinder analysis.
Registration is initially RTOC stored in the battery to keep the RTOC of lv2 and power it back later:

[Register or Login to view code]


At this point we have to explain that the OFFSET DELTA. DELTA OFFSET is a method used in the x86 in its original moments in the creation of computer viruses, to calculate the memory address in which we are in the sea of ​​bytes in RAM.

In the original time a computer virus when I did not know where he was pulled into an executable,
depending on the executable it could be an initial site or another, for it was invented DELTA OFFSET.

DELTA OFFSET can be used in any system, the procedure is:

  • Using the record that indicates the current execution address (or the next depending on the system)
  • Reducing the size of the previous code we use the value obtained from the registry.

Knowing this, and taking for example the x86 processor where the EIP register can not be read directly invented the trick make a call to a "subfunction" which is simply the following line to the call:

[Register or Login to view code]


X86 call instruction saves the top of the stack the address of the next instruction to itself. Thus using pop draw from the top of the stack this value, and stored in eax for example, and having the memory address where we only subtract the above would be missing and we have the exact calculation.

The PowerPC can use this trick using the BL instruction is equivalent (LINK BRANCH), which jumps to a "subfunction" but before you save LR in the record the following address to BL.

[Register or Login to view code]


At this point we see the trick used for the creation of the RTOC of charges at this time. If you look both r0 and RTOC are passed to 0:

[Register or Login to view code]


Subsequently, given the value 0x11DE0 to RTOC:

[Register or Login to view code]


A r0 is given the value 0x920:

[Register or Login to view code]


R0 is subtracted from the value of RTOC:

[Register or Login to view code]


Unlike the PowerPC x86 LR register can be read directly with mflr instruction, we put in RTOC the value obtained by the delta offset:

[Register or Login to view code]


To calculate the delta offset subtract final instructions executed before the delta offset, which were 4, or 16 bytes:

[Register or Login to view code]


Finally we add the value of r0 at the end of the delta offset RTOC, storing the result in the RTOC and this already takes RTOC suitable for this hook:

[Register or Login to view code]


It takes having the RTOC stored in the stack 3 arguments that the hook received:

[Register or Login to view code]


You call the function of the charges where the first argument will check for command 0x8202 (a special command to the usual):

[Register or Login to view code]


After making the necessary steps as charged, the battery recovers the original RTOC, like the arguments the hook received, it executes the original instruction that was overwritten in the syscall entry 379 (in this case) to have our hook, and call the original syscall lv2:

[Register or Login to view code]


Upon returning to retrieve the original LR from the stack and returns to the prompt

[Register or Login to view code]



JaicraB on Cobra USB JIG Protection RTOC Trick for PS3

Follow us on Twitter, Facebook and drop by the PS3 Hacks and PS3 CFW forums for the latest PlayStation 3 scene and PS4 Hacks & JailBreak updates with PlayStation 4 homebrew.



#226 - rommy667 - July 26, 2012 // 6:06 pm
rommy667's Avatar
Hi all, i'm having trouble getting win 7 to "see" it how do i get win 7 to update it?

#225 - windrider42 - July 25, 2012 // 4:19 am
windrider42's Avatar
I don't believe it works for homebrew created into ISO. Have you actually tried a PS3 Game created into an ISO image.

I use genps3iso_v2.0 to create it on my pc.

#224 - hammerino - July 24, 2012 // 7:52 pm
hammerino's Avatar
Hi Guys,

i am following the scene for a while now and I am very glad I found this forum. It helped me a lot. Thanks so far...

I am facing an issue with my cobra usb dongle. I am trying to get a ps3 iso running via nethost and it just don't work. I even created a ps3 iso with the PS3 and transferred it to the nethost. But it won't start. I always get an error message, that this operation is not allowed. See attached error message. I am an absolute noob and am not able to find out the root cause. Maybe it is an easy issue. Please help.

Thanks in advance
hammerino

#223 - PS4 News - July 2, 2012 // 8:52 am
PS4 News's Avatar
MultiMAN mmCM v4.04.03 is now released adding a PS3 Blu-ray Region Changer for movies with the complete changes outlined below, as follows:

Download: mmCM v04.04.03 Base (20120702) (26.29 MB) / mmCM v04.04.03 Full (20120702) (260.77 MB)

Changelog 04.04.02 / 04.04.03:

  • Changed folder "Paste" behavior in mmOS - when overwriting existing folder the destination will not be deleted before pasting
  • Added 3 key combos in mmOS (for full list please refer to "navigation.txt"):
    - SELECT+(CROSS hold) - Select All
    - SELECT+(L2/R2) - Scroll to top/bottom of folder/file list
  • Extended "FTP Server" options in "Settings": Disable / Enable (1 min. TO)...(9 min. TO) / (No timeout) to set ftp connection timeouts
  • Added 4.20 to "Fimware Version" option in "Settings" (Cobra 3.55CFW)
  • Changed function "Game Updates" (different server; function will not work in older versions)
  • Changed function "Download Game Covers" (different server; function will not work in older versions)
  • Added option "Blu-ray Movie Disc Region" in "Settings" to change current PS3 region/targetid for movie compatibility (for non-Cobra/TB 3.55CFW)
  • Added support for ICON1.PAM in themes

Notes:

  • The 'game updates' / 'game covers' servers have changed, so those that don't update will not have this function!
  • The Blu-ray movie region changer will currently NOT work on True Blue dongles or those still using v3.41 CFW.
  • This new 'region changer' feature does NOT work on DVD movies, only Blu-ray discs!

MultiMAN PS3 Debug / Test / DEX and Newer Build Updates

Update: Below are some additional multiMAN CEX and DEX update builds from deank:

Download: multiMAN v04.04.03 BASE (20120720) / multiMAN v04.04.03 BASE DEX (20120720) / multiMAN v04.04.03 BASE (20120721) / multiMAN v04.04.03 BASE DEX (20120721) / multiMAN v04.04.03 BASE DEX (20120721) (15.61MB) / multiMAN v04.04.03 BASE DEX (20120721) (14.88MB - included in both package above; can be used on DEX 3.55-4.11; can load backups on 3.55 DEX with peek&poke) / multiMAN v04.04.03 BASE CEX DEX (20120722) (33.55MB - Included cygwin DLL files in "norunpack" folder, included in both package above in "multiMAN folder; DEX version can be used on DEX 3.55-4.11; can load backups on 3.55DEX with peek&poke)

Note: Do not use older (20120721) versions of MM if going to flash NOR EID0 (you will get an error / nor flash won't be changed). Use 20120722 link.

Finally from naehrwert (via twitter.com/#!/naehrwert):

spp parser: http://pastie.org/4187167

btw. cobra's software will mount your dev_flash writeable at some point and modify files in it I don't think they told you about this..

http://pastie.org/4155189

#222 - PS4 News - June 27, 2012 // 9:11 am
PS4 News's Avatar
MultiMAN mmCM v4.04.02 is now released with the changes outlined below, as follows:

Download: mmCM v04.04.02 Base (20120627) (26.26 MB)

Changelog 04.04.02:

  • Changed folder "Paste" behavior in mmOS - when overwriting existing folder the destination will not be deleted before pasting
  • Added 3 key combos in mmOS (for full list please refer to "navigation.txt"):
    - SELECT+(CROSS hold) - Select All
    - SELECT+(L2/R2) - Scroll to top/bottom of folder/file list
  • Extended "FTP Server" options in "Settings": Disable / Enable (1 min. TO)...(9 min. TO) / (No timeout) to set ftp connection timeouts
  • Added 4.20 to "Firmware Version" option in "Settings"

#221 - PS4 News - June 23, 2012 // 9:25 am
PS4 News's Avatar
A new version of multiMAN mmCM v4.04.01 is released with the changes outlined below, as follows:

Download: mmCM v04.04.01 Base (20120622) (25.60 MB)

Changelog:

  • Added support for desktop shortcuts to games: Name of the game, Icon of the game used for the shortcut created to game's EBOOT.BIN
  • Added background image for game folders (PIC1.PNG used if present)
  • Added "Open Location" in context menu [O] for shortcuts
  • Added path information when deleting games from internal/external HDD
  • Added feature to keep desktop icons when shortcuts are renamed
  • Added support for multiple shortcuts to files/folders with the same name (Windows alike - adding (1), (2)... (64) to the shortcut name)
  • Added support for REBUG 3.55.2 and OFW/MFW 3.41 to the "BD-Mirror" option for (BSG) game backups in internal HDD
  • Updated bdRESET to version 2.2 (to reset BD-Mirror state for internal HDD)

From deank: It only adds support for these firmwares for the “BD-Mirror” option which now allows to play some games from internal HDD, whereas it was impossible before.

#220 - sardine fish - June 20, 2012 // 3:42 pm
sardine fish's Avatar
Thanks wind rider i will test it out tomorrow as i am reformatting my hard disk.

#219 - windrider42 - June 20, 2012 // 1:44 pm
windrider42's Avatar
Yes, install the mmCM v04.03.00 Full, then install the mmCM 4.04 base as its the update. It will say already installed, click yes to overwrite.

#218 - sardine fish - June 20, 2012 // 9:11 am
sardine fish's Avatar
Hi wind rider, thanks for your reply where can i get the full 4.03 file to install? Yes i install with usb to the ps3.

Hi HRU, did not see your post thanks i will try it again.

hey man is it after installing the file you given then i install the new 4.04?

#217 - HeyManHRU - June 20, 2012 // 6:59 am
HeyManHRU's Avatar
Link for 4.03 mmCM full - http://www.ps4news.com/forums/ps3-hacks-jailbreak/cobra-usb-ps3-dongle-runs-blu-ray-ps1-isos-psp-minis-118726-20.html#post417227