PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!

Home PS4 News - Latest PlayStation 4 and PS3 News

July 8, 2011 // 4:59 pm - Today Spanish PlayStation 3 developer JaicraB has explained the Cobra USB JIG protection RTOC trick implemented for the PS3 against cloning the device.

To quote, roughly translated: Flynn sent me this text explaining this protective carrying the Cobra, I hope it will open the eyes of those interested in reversing the dumps.


The JIG Cobra has several protective measures to ensure that your code could not be used correctly even if your code could be dumped.

This trick RTOC in the registry is the first used for this purpose in addition to hinder analysis.
Registration is initially RTOC stored in the battery to keep the RTOC of lv2 and power it back later:

[Register or Login to view code]

At this point we have to explain that the OFFSET DELTA. DELTA OFFSET is a method used in the x86 in its original moments in the creation of computer viruses, to calculate the memory address in which we are in the sea of ​​bytes in RAM.

In the original time a computer virus when I did not know where he was pulled into an executable,
depending on the executable it could be an initial site or another, for it was invented DELTA OFFSET.

DELTA OFFSET can be used in any system, the procedure is:

  • Using the record that indicates the current execution address (or the next depending on the system)
  • Reducing the size of the previous code we use the value obtained from the registry.

Knowing this, and taking for example the x86 processor where the EIP register can not be read directly invented the trick make a call to a "subfunction" which is simply the following line to the call:

[Register or Login to view code]

X86 call instruction saves the top of the stack the address of the next instruction to itself. Thus using pop draw from the top of the stack this value, and stored in eax for example, and having the memory address where we only subtract the above would be missing and we have the exact calculation.

The PowerPC can use this trick using the BL instruction is equivalent (LINK BRANCH), which jumps to a "subfunction" but before you save LR in the record the following address to BL.

[Register or Login to view code]

At this point we see the trick used for the creation of the RTOC of charges at this time. If you look both r0 and RTOC are passed to 0:

[Register or Login to view code]

Subsequently, given the value 0x11DE0 to RTOC:

[Register or Login to view code]

A r0 is given the value 0x920:

[Register or Login to view code]

R0 is subtracted from the value of RTOC:

[Register or Login to view code]

Unlike the PowerPC x86 LR register can be read directly with mflr instruction, we put in RTOC the value obtained by the delta offset:

[Register or Login to view code]

To calculate the delta offset subtract final instructions executed before the delta offset, which were 4, or 16 bytes:

[Register or Login to view code]

Finally we add the value of r0 at the end of the delta offset RTOC, storing the result in the RTOC and this already takes RTOC suitable for this hook:

[Register or Login to view code]

It takes having the RTOC stored in the stack 3 arguments that the hook received:

[Register or Login to view code]

You call the function of the charges where the first argument will check for command 0x8202 (a special command to the usual):

[Register or Login to view code]

After making the necessary steps as charged, the battery recovers the original RTOC, like the arguments the hook received, it executes the original instruction that was overwritten in the syscall entry 379 (in this case) to have our hook, and call the original syscall lv2:

[Register or Login to view code]

Upon returning to retrieve the original LR from the stack and returns to the prompt

[Register or Login to view code]

JaicraB on Cobra USB JIG Protection RTOC Trick for PS3

PlayStation Follow us on Twitter, Facebook and join us at our new site WWW.PSXHAX.COM!

#427 - Lanceris5 - January 2, 2013 // 9:49 pm
Lanceris5's Avatar
Can somebody help me with my ps3 rebug 4.21, with broken bdrom? The problem is that when i take a game from ext HDD with multiMAN, the game goes blank, and the multiMAN quits to XMB, but when i take the app_home , the ps3 goes blank again and do nothing...

#426 - wilson74 - December 31, 2012 // 9:29 pm
wilson74's Avatar
Cobra said around a month a go they would have new firmware! Where is it?

#425 - amareladex - December 31, 2012 // 7:58 pm
amareladex's Avatar
i have downloaded this update... and i have choice to install pkg up cex... and its saying that i have not installed totally multiman... ( graphics trobles etc)

whats wrong.. whats missing me? i'm on rogero cex 4.30 v2.03 with update... i'm dump for real ... plz anyone can tell me whats missing me??? thanks

#424 - PS4 News - December 29, 2012 // 9:04 am
PS4 News's Avatar
Today deank has updated to multiMAN v04.17.05 with the changes below, as follows:

Download: multiMAN v04.17.05 Update (20121229) (7.8 MB) / multiMAN v04.17.05 Update (20121229) (Mirror)

multiMAN 04.17.05 update is available online.

  • Added [ ] installable packages in the WEB column
  • Fixed access to AVCHD/Blu-ray Movie Discs and DVD Video Discs
  • When moving files on the same drive mmOS won't check for available free space
  • Improved background scanning/verifying of USB games
  • Added support for AVCHD HDD movies to lastGAME


  • multiMAN CEX/DEX/STEALTH update versions
  • lastGAME 04.01 with support for AVCHD HDD
  • installPKG and installPKG [Singstar Replacement]

#423 - PS4 News - December 26, 2012 // 8:04 am
PS4 News's Avatar
Today deank has updated to multiMAN v04.17.04 with the changes below, as follows:

Download: multiMAN v04.17.04 Update CEX (20121226) (1.76 MB) / multiMAN v04.17.04 Update CEX (20121226) (Mirror) / multiMAN v04.17.04 Update CEX (20121226) (Mirror #2) / multiMAN v04.17.04 Bare CEX (20121226) (only 3.8 MB) / multiMAN v04.17.04 Bare CEX (20121226) (Mirror) / multiMAN v04.17.04 Bare CEX (20121226) (Mirror #2) / multiMan v04.17.04 LangVi (VietNamese) by taminhluan

multiMAN 04.17.04 update is available online (cex/dex/stealth)

  • Visual improvements
  • Added SD/MS/CF entries in Retro
  • Fade-in for game backgrounds
  • Some other improvements related to copying/scanning/verifying/etc
  • multiMAN "minimal"/"bare" version available (read below)

Few weeks ago some people requested a 'minimalistic' version of multiMAN. For them I created this package (linked above).

This is a skinned down version (BARE). It can be installed on any PS3 without the need of a previous mM installation. It is like a "base" but the differences are:

  • Simple theme (2MB) (no theme music)
  • No GUI translations (English only)
  • No user fonts (only system fonts will be used)
  • No PS1/PS2/PSP names/IDs database (no game names will be displayed)
  • AIOMOD not included (old BD-Mirror method for USB games will be used on 4.21+CFWs)

Do not use it unless you're the one who asked for it. BARE can be installed on any firmware for normal users who don't really need any of the listed above features. Of course NONE of these features are present in other BUMs so everyone should be happy.

It can be installed on top of your current mM if you wish to test it (you will not notice much difference, because you already have the fonts/translations/aiomod/themes installed).

This bare version is suitable for:

  • English speaking users
  • All 3.41/3.55 (non Cobra/TB) firmwares
  • All 4.21+ firmwares (disc may be required when booting bd-mirror USB games if AIOMOD.BIN is not present)
  • Weeners who complain all the time that 130MB is too much for a stupid PS3 homebrew like mM

I hope you like the new mM logo fade in/out and the boot sound (you can delete or replace USRDIR/sys/BOOT.MP3 if you wish) and the nice way game posters (PIC1.PNG) fade-in while browsing the list.

If you wish you can update online (start mM while holding L2+R2 and update). Let me know if this is fixed. Thanks for the report!

Update: Here is the updated version of lastGAME 4.01 application:

Download: lastGAME41.pkg (285.53 KB)

  • If used with latest mM it supports loading of the last AVCHD HDD video
  • Improved support for 4.30CFW

Here are some screenshots from the "WEB" column of mM. It was only used for downloading themes, but now I extended its functions a bit. Here is how it looks:

When you click an entry, mM will download the package in /dev_hdd0/PKG so you can install it later.

#422 - Djmatrix32 - December 26, 2012 // 12:59 am
Djmatrix32's Avatar
It's all good and I figured as much just wanted to make sure.

#421 - hilongo - December 26, 2012 // 12:19 am
hilongo's Avatar
Sad to tell you this, but Nope .... That Retro column if for emulators of much older consoles (Like FCEU to play old NES roms)

#420 - Djmatrix32 - December 25, 2012 // 11:24 pm
Djmatrix32's Avatar
So under the Retro multiman are you able to play PS1 and PS2 back ups? I have a 80gb BC model and I was wondering if I could play my Ps2 back ups from multiman.

#419 - PS4 News - December 24, 2012 // 11:25 am
PS4 News's Avatar
Today deank has updated multiMAN once again to version 04.17.03 (20121224) with the changes below.

Download: multiMAN v04.17.03 Update (20121224) (5.56 MB - Includes regular and stealth updates + IPF + IPF[Singstar Replacement]) / multiMAN v04.17.03 Update (20121224) (Mirror) / multiMAN v04.17.03 Update (20121224) (Mirror #2) / multiMAN v04.17.03 Update (20121224) (Mirror #3) / InstallPKG [SingStar Replacement].pkg / InstallPKG.pkg

multiMAN 04.17.03 is available online now (cex/dex/stealth):

  • mM is now even faster
  • Installing PKG files from /dev_hdd0 now doesn't require copying and losing time and space (takes less than a second)
  • Added progress bar when copying non-split files from USB in installPKG application
  • Fixed problem with split games in stealthMAN
  • InstallPKG [Singstar Replacement] available (updated)

#418 - PS4 News - December 20, 2012 // 5:16 pm
PS4 News's Avatar
MultiMAN v04.17.00 is now available from deank with both speed optimizations and reduced PS3 RAM usage. Be aware the Stealth version (StealthMAN) isn't completely safe as Sony (or other users) can still see when you 'Install Package Files' (as pictured below) at the moment.

Download: multiMAN v04.17.00 Base (20121220) (111.88 MB) / multiMAN v04.17.00 Base (20121220) (Mirror) / multiMAN v04.17.00 Base (20121220) (Mirror #2) / multiMAN v04.17.00 Base (20121220) (Mirror #3) / multiMAN v04.17.00 Base (20121220) (Mirror #4) / multiMAN v04.17.00 Base (20121220) (Mirror #5) / multiMAN v04.17.00 Base (20121220) (Mirror #6) / multiMAN v04.17.00 Base (20121220) (PKG)



  • multiMAN ver 04.17.00 BASE CEX (20121220).pkg
  • multiMAN ver 04.17.00 BASE DEX (20121220).pkg
  • multiMAN ver 04.17.00 BASE CEX STEALTH (20121220).rar
  • Latest versions of mmRAS and mmRAS_server by aldostools
  • Latest version of installPKG (with support for /dev_hdd0/PKGTMP)
  • Showtime, bdRESET, stDISC, gameDATA, lastGAME as usual

Here are the changes from 04.16.02/03/04/05/06 to the latest:

  • Improved overall speed of all functions and GUI
  • Data Test/Verify functions now take fraction of the time compared to previous versions
  • Improved 'Verifying data' of USB games by a factor of 50
  • Improved scan before copying a game/folder
  • Improved loading folders in mmOS
  • Improved just a bit deleting games/folders
  • Greatly improved loading content when browsing PS3 HDD/USB drives in game modes
  • Loading Retro ROM/Video/Photo and ISO folders while browsing PS3 HDD/USB is now about 15 times faster
  • Added "Friendly" name option in "Settings"/"Network Servers" for /net_host parties
  • Fixed over-scrolling when browsing through large number of entries
  • Increased max number of entries in game modes by 50% to 3072 (from 2048)
  • Improved speed when copying games/files from/to USB HDDs
  • Improved speed when copying games from PS3 Game Discs
  • Improved speed when copying/browsing folders via FTP (LIST/MLSD)
  • Added support for up to 99 pkg files in the [* Install Package Files] queue
  • [* Install Package Files] function will scan /dev_hdd0/PKGTMP and will MOVE the queued pkg files from this folder (saving HDD space by not copying to temp location)
  • mmOS will now honor the "Verify USB Games" setting when starting games from icons/shortcuts/game-folder
  • Scanning for active USB storage devices is now performed in the background and will speed up loading games on 4.xxCFW
  • Verifying games in now performed in the background (when possible) to avoid delays when loading games

While on the 'improvement' track I decided to remove and completely rewrite another major function in mM - copying folders/games. Currently the memory used by the new function is down to 6MB (from 12MB - used to be 32MB in the beginning). While at it I added the double progress bar so you can monitor the progress for each file and the overall progress.

I used LittleBigPlanet game as a test/reference when I started improving things last week and finally got about 15-30% speed increase.

8343MB (240 files):

Before the optimizations:

  • HDD->USB = 13:20min (800 seconds) (~10.4MB/s)
  • USB->HDD = 11:30min (690 seconds) (~12.1MB/s)

After the optimizations:

  • HDD->USB = 10:30min (630 seconds) (~13.3MB/s) (about 28% faster)
  • USB->HDD = 08:30min (510 seconds) (~16.4MB/s) (about 35% faster)

Of course with games with less files the transfer speed hits the limit of the internal HDD (~30MB/s) or the external USB (~20MB/s) like for example copying GT5 (14056MB in 19 files):

  • HDD->USB = 15:05min (905 seconds) (~15.5MB/s)
  • USB->HDD = 11:58min (718 seconds) (~19.6MB/s)

Copying from PS3 Game Disc is at ~8.4MB/s (which is the max. read rate of the ps3 bd-drive). It may not look THAT much faster, but probably with larger games the saved time will be a lot more. 5 or 15 mins saved is still something.

p.s. To those who wonder about the latest speed improvements - you may remember my posts during the year: "Saved 5MB or RAM here... 20MB or RAM there... another 15MB RAM saved..." so finally I found time to utilize the resources I managed to free. Now I had to rewrite a lot of functions from scratch and optimize them as much as I can. The result is more speed and stability.

Here is how I do it in installPKG and mM: Method of calling to install "/dev_hdd0/PKG/TestFile.pkg":

[Register or Login to view code]

The example doesn't include "copying" the PKG to a temp location if using USB HDD. This one just moves the file from one location on the internal hdd to the game_pkg folder. It is very simple (just 20-30 lines or so) and doesn't need explanation - it only creates d0.pdb and the ICON_FILE.
u64 is_size(char *path)
struct CellFsStat s;
if(cellFsStat(path, &s)==CELL_FS_SUCCEEDED)
return s.st_size;
return 0;

int exist(char *path)
struct stat p_stat;
return (stat(path, &p_stat)>=0);

void array_to_file(char *_path, unsigned char* _buf, int _size)
FILE *flistW;
flistW = fopen(_path, "wb");
fwrite( _buf, _size, 1, flistW);

u8 bubble_pkg( char* _path, char* _file)
char task_path[512];
char temp_path1[512];
char temp_path2[512];

cellFsMkdir((char*)"/dev_hdd0/vsh/game_pkg", S_IRWXO | S_IRWXU | S_IRWXG | S_IFDIR | CELL_FS_S_IFDIR | 0777);

for(u8 n=0;n