PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!

Home PS4 News - Latest PlayStation 4 and PS3 News

October 22, 2011 // 11:55 pm - Following up on the initial PS3 JailBreak 2 news comes various PS3 CFW JailBreak 2 and JB2 Updater details today including the examination of an EBOOT.BIN from the Driver: San Francisco Blu-ray Disc in comparison to one from an official PS3 Game (BLES00891) Disc with developments on reverse-engineering the PS3 JB2 file dumps and more below.

To begin, whyudie states the following on the PS3 CFW JailBreak 2 and JB2 Updater for PlayStation 3: I just wanted to share this CFW. This CFW is intended more specifically for Jailbreak 2 dongle only. Most likely will not run well without that dongle. Perhaps some developers out there could investigate this CFW, and develop it even better.

If anyone out there want to install this CFW on your PS3. Do it at your own risk!!

JailBreak 2 Dongle Features

  • Can play backup games that require firmware 3.60 + (Direct boot just like the original games)
  • Only burned BD Disc format with some patches will work. For now, there's no info how to make a backup iso to work with this CFW.
  • Can play backup games from the HDD. PS3 games with FW 3.55 or lower (via internal or external hdd)
  • Only works on the PS3 with official/custom firmware 3.55, not the downgrade PS3.

Download: http://www.filesonic.com/file/2688912531/Jailbreak2.CFW.zip
Mirror: http://www17.hipfile.com/files/0/qs9pqv38gr6cjw/Jailbreak2.CFW.zip
Mirror: http://www.multiupload.com/64F4BUREL1
Mirror: http://www.multiupload.com/O7SP26A83E
Password: whyudie

And this is PKG files to upgrade dongle Jailbreak 2:

Download: http://www.filesonic.com/file/2689038911/JB2.Dongle.Updater.zip
Mirror: http://www11.hipfile.com/files/1/l3m50jw7p6gqng/JB2.Dongle.Updater.zip
Mirror: http://www.multiupload.com/9YPQX47G7F
Password: whyudie

What's your source? Have you make a dump from JB2 Dongle?

From my local game store. I live in Indonesia. And I bought the dongle. And get the bonus cd and the CFW files is from that cd. And that CFW must be installed first on PS3, and upgrade the dongle with that pkg files.

Driver: San Francisco EBOOT from Blu-ray Disc courtesy of lindwurm:
http://www.fileserve.com/file/hStSPgF
http://www.multiupload.com/CDXUJVO9HD (Mirrors)
http://www.multiupload.com/4ZD2W888S4 (Mirrors)

Driver: San Francisco EBOOT (BLES00891) from original PS3 game disc courtesy of elser1:
Download: http://www.mediafire.com/?vlrd968e9jvq3f0

Driver: San Francisco EBOOT (Untested, Generated by SiLENTGame)
Download: http://www.multiupload.com/67QYYP0YVX

UPLAY SELF (Untested, Patched by SiLENTGame)
Download: http://www.multiupload.com/S5WQK2U03F

FIFA 12 EBOOT from Blu-ray Disc courtesy of lindwurm:
http://www.megaupload.com/?d=RKFXL08A

Sniper Ghost EBOOT from Blu-ray Disc courtesy of lindwurm:
http://www.megaupload.com/?d=DVTJ2G79

Sakunchai also states the following on examination of the PS3 JB2 dump: I find 1 point not same in original FW in lv2_kernel.self
Download: http://www.mediafire.com/?2enon1x5xsujt7o

Also below are some related PlayStation 3 JB2 files from 3muk and ireggae among others and a preliminary PS3 JB2 RE examination, as follows:

Here is the files changed in the FMW including CORE_OS_PACKAGE.pkg, dev_flash_010.tar.aa.2010_11_27_051337 and dev_flash_016.tar.aa.2010_11_27_051337:
http://www.mediafire.com/download.php?urz4ij6xsq43074

PS3 .PKG File from the dongle, unpacked with an .ELF of the EBOOT included:
http://www.mediafire.com/download.php?2tb21hw4ab901lv
http://www.filesonic.com/file/2691997244/NPXS00020.rar (Mirror)

PS3 JB2 Reverse Engineering

Below is a preliminary synopsis from moogie via Twitter and ps3devwiki.com/index.php?title=PS3JB2_Reverse_Engineering and ps3devwiki.com/index.php?title=Talk:Keys#sv_iso_spu_module_1.02-3.55:

JB2's dongle updater pkg, its EBOOT.BIN is just an FSELF (fake signed), the Driver: SF eboot fix is also an FSELF, FSELF's are mean't for debug consoles, easier to fself your game, then to actually sign it, you can patch retail FW to run FSELF's, either through the fw, or you can modify PL3, or even, resign the EBOOT.BIN, its nothing special, from the looks of it, they don't have any keys, just debug EBOOT.BIN's.

You don't need that dongle either, just resign the EBOOT.BIN or patch the FW to run FSELF's, their MFW could have these patches, or maybe, their dongle deliver's the patches. I do not know for sure, maybe their dongle does something else entirely, but I know its an FSELF, and you can make that run, without their dongle.

Dongle is DRM to make sure you have the dongle, the firmware 'special' functionality will not work without it. Contentdisc's contain fself'ed eboot.bin's.

Those JB2 eboot.bin stuff, actually isn't debug fself's, but readself says it is its their DRM. Can't be decrypted without their stuff. They have their own keys, which they are signing the EBOOT.BIN's with, I think they are debug eboot's resigned with their stuff.

SELF header

[Register or Login to view code]

Control info

[Register or Login to view code]

Section header

[Register or Login to view code]

Encrypted Metadata

[Register or Login to view code]

ELF header

[Register or Login to view code]

FW Info

PS3 System Software

[Register or Login to view code]

Remarks: needs JB2 dongle as DRM

[Register or Login to view code]

Firmware Changes compared to OFW 3.55:
Download: http://www.multiupload.com/LAIIB6IMX0

EULA.xml

[Register or Login to view code]

Version.txt

[Register or Login to view code]

CORE_OS_PACKAGE.pkg

lv1.self

Just one patch:

[Register or Login to view code]

This is in lv1_map_htab to allow for RW mapping of all RAM. So who knows how many other lv1 patches are done at runtime.

lv2_kernel.self
dev_flash_010.tar.aa.2010_11_27_051337
\dev_flash\vsh\module\nas_plugin.sprx

[Register or Login to view code]

"standard pkg patches"

dev_flash_016.tar.aa.2010_11_27_051337
\dev_flash\vsh\resource\explore\xmb\category_game.xml
\dev_flash\vsh\resource\explore\xmb\category_video.xml

Description

Dongle is DRM to make sure you have the dongle, the firmware 'special' functionality will not work without it. Contentdisc's contain fself'ed eboot.bin's

Debunking

  • It does not play 3.6x+/3.7x+ original content (it does not have the keys for it).
  • It can only play such content which is re-encrypted/resigned with their donglekeys.
  • Such content will be limited to those already decryptable and debug eboot.bin's.
  • Content for 3.55 and lower still work (after all, its just a MFW 3.55)
  • Needs the MFW (and cannot work on OFW's, that is why there is 'no power/eject trick')
  • If you are using special firmwares now, they will not be compatible with this one. e.g.
  • Incompatible with: OtherOS++, Cobra, pre 3.50 etc.

Hardware Dongle

Below are some pictures of the PS3 JailBreak 2 (JB2) aka True Blue dongole disassembled using an Actel ProASIC3 A3P250 - FPGA, a 24.000 MHz Crystal and a AMS1117 2.851049 Low Dropout Linear Regulator.

Components

Actel ProASIC3 A3P250 - FPGA

[Register or Login to view code]

File: VQ100.png (below)
128-bit AES
1,024 bits of user flash memory
Datasheets and usermanuals: http://www.actel.com/products/pa3/docs.aspx#ds
Familyroot: http://www.actel.com/products/pa3/

Pinout A3P250 VQ100

[Register or Login to view code]

24.000 MHz Crystal

CLK for Actel

AMS1117 2.851049 - Low Dropout Linear Regulator

Datasheet: http://www.sltdigital.com/product/product_pdf/AMS1117.pdf / http://home1.cyber-labo.co.jp/board/goods/pdf/AMS1117.pdf

File: AMS1117 - SOT-223.png (below)

A 47 (unreferenced 5pin IC) - 5-pin SOT5 A 47 pinout

[Register or Login to view code]

Winbond 25X16AVS1G (SPI Flash 16Mbit) - 8-pin TSSOP Winbond 25X16A SOIC-8 pinout

[Register or Login to view code]

datasheet: W25X16A.pdf
[Register or Login to view code]

Sony PlayStation 3 hacker Mathieulh has also made some comments via IRC today on how the PS3 JailBreak 2 works with a follow-up HERE for those interested.

From PatrickBatman on the PS3 JB2 device, to quote:

It seems the ps3jb2 loads masterdiscs with fself, with the algo provided and the right keyyou can decrypt said masterdiscs images right on pc and grab the fself files.

[Register or Login to view code]

That's the algo for masterdiscs, ps3gen.dll has the static keys for masterdiscs. You can also get it from sv_iso the sdk tool that generates masterdisc images.

Then you take the decrypted fself and resign it for 3.55 with makeself then swap eboot. I think it should be somewhere in the PS3_Generator_Tools-312.zip in the 3.60 SDK but I'm not finding it, but that's where the master disc stuff is.

Finally, upon examination several users including DanyL, TheLostDeathKnight and bubbleboy have stated that the JB2 doesn't use a new PlayStation 3 exploit nor contain PS3 3.6+ keys, and that the dongle is only used as identification for activating the patch.

For those curious, patching the appldr keys has been done but not made public back with the PS3 3.56 keys so it isn't unfamiliar to most PlayStation 3 developers but unfortunately it is patchable by Sony. A brief outline of the process involved is below, as follows:

Obtain PS3 Debug EBOOT file from Sony's Developer Network via Debug console by one of the following methods:

  • Boot up your PS3 to the XMB, make sure in debug settings that NP environment is set to “sp-int” or “prod-qa”, sign into PSN (with sp-int or prod-qa credentials, you can use the quick sign-up), and launch the game. If your in luck, it will say an update is available – download it!
  • To get the URL you have a few options. You could either sniff out the connection with something like Wireshark - that takes a bit more setup. Other times the URL is actually passed right to dtccons - so make sure you have the debugging windows open. Or, you could use any number of the PS3 Proxy applications to grab the link.
  • Those who know their PS3 Game's Title ID and are seeking PS3 Game Update Packages can now use this simple guide to grab them while they last.

  • Patch Retail PS3 Firmware to run a Debug EBOOT file
  • Dump and burn the PS3 3.60+ games to BD-DVD with the included Debug EBOOT file
  • Add the DRM to the PS3 MFW / CFW that JB2 uses and validate it via the dongle

The above process will likely continue to work until Sony locks down the PS3 Debug EBOOT files.

PS3 JB2 Keys

The encryption keys for PS3 Debug Discs utilized by the PS3 JB2 method can be found below.

Download: PS3 Keys / GIT

[Register or Login to view code]



PS3 CFW JailBreak 2 and JB2 Updater RE for PlayStation 3 Details

PS3 CFW JailBreak 2 and JB2 Updater RE for PlayStation 3 Details

PS3 CFW JailBreak 2 and JB2 Updater RE for PlayStation 3 Details

Follow us on Twitter, Facebook and drop by the PS3 Hacks and PS3 CFW forums for the latest PlayStation 3 scene and PS4 Hacks & JailBreak updates with PlayStation 4 homebrew PS4 Downloads.



#812 - Youkia - August 15, 2012 // 6:54 am
Youkia's Avatar
I want to request something for most of the japanime guys and people who LOVE Dragonball Z Please do DragonballZ Ultimate Tenkaichi or BLUS-30823

#811 - lolong - August 15, 2012 // 6:50 am
lolong's Avatar
TB is TAKING TOO LONG, for releasing their NEW GAMES EBOOT and NEW PATCH for their dongle. This is a stupid method, WHY ?

Because DUPLEX get the first to CRACK new GAMES such as DARKSIDERS2 and SLEEPING DOGS.

Honesty, I hate with TB, they should work together to make new games with mod eboot so it can play it with their dongle.

NOW it's too late, DUPLEX beats DONGLE!

#810 - Neo Cyrus - August 15, 2012 // 6:38 am
Neo Cyrus's Avatar
I thought this would have happened a lot sooner... oh well, better late than never.

#809 - PS4 News - August 15, 2012 // 6:35 am
PS4 News's Avatar
Currently the ones that get re-released with the DRM removed, whether this will change only time will tell... at the moment there are 2 games released above and most likely a slew more incoming from various scene release groups.

#808 - tickford - August 15, 2012 // 6:31 am
tickford's Avatar
Does this mean if your ps3 is on kmeaw cfw 3.55 you can play ALL the TB cracked games, or only the ones that get cracked (eg max payne 3)?

#807 - stingray1059 - August 15, 2012 // 6:24 am
stingray1059's Avatar
i'm glad i sold my dongle.

i hope all unfixed trueblue games will be patched tomorrow. like ghost recon FS, dragons dogma, mass effect 3 and tales of graces f.

#806 - master32820 - August 15, 2012 // 6:10 am
master32820's Avatar
I have a TB but i'm happy that duplex fcked them up

I got a question though! can we go back from TB CFW 2 to normal kmeaw 3.55 just they way we went to tb cfw 2?

#805 - spark32 - August 15, 2012 // 5:43 am
spark32's Avatar
This is awesome! Now all I need to wait for is a fixed eboot for Jak and Daxter collection, Twisted Metal, and Mass Effect 3.

#804 - PS4 News - August 15, 2012 // 5:16 am
PS4 News's Avatar
Not long after the release of the PS3 3.60 Keys comes the first of several PlayStation 3 releases with the TrueBlue PS3 USB dongle DRM-infected protection now removed by scene group DUPLEX!

Download: DUPLEX PS3 Releases - Ongoing thread, add new game releases here guys!

Below is the release information, from their Max Payne 3 Eboot Patch READNFO PS3 DUPLEX PS3 NFO as follows:

Release Name: Max.Payne.3.Eboot.Patch.READNFO.PS3-DUPLEX
Date: August 2012
Languages: English
Platform: PS3 CFW 3.55
Genre: Action

[Register or Login to view code]

Max Payne 3 TB Eboot Patch *CRACKED*

Release Info:

When we first read about the TrueBlue USB Dongle we were excited about it. Finally having a way to play FW 3.60+ games on CFW 3.55 again. What a great asset to the scene everyone thought .. until people found out that this USB Dongle was solely made for cashing in! Its only purpose was to check on the DRM the TrueBlue Team added to their 3.55 Eboots. What a shame!

DUPLEX to the rescue! Finally bury your TB dongle because we removed their unnecessary DRM and their Patches will now work on Cfw 3.55 without any dongle or special TB CFW.

Notes:

Copy the files inside the rars into your games usrdir and replace existing ones Tested on Kmeaw CFW 3.55 with Max.Payne.3.PROPER.PS3-DUPLEX more to come ...

Enjoy This Fine DUPLEX Release

From anonymous also comes another Max Payne 3 Update v1.05 [FW 4.0] Patched for CFW 3.40+ workaround as follows:

Max Payne 3 BLES / BLUS Test EBOOT and Param.sfo:

Download: http://www.mirrorcreator.com/files/RQWCQLZ7/max_payne3_patched_eboots.rar_links

  • Max Payne 3 BLES / BLUS Test EBOOT and param.sfo
  • The rar has an embedded readme with the pkg links
  • Its probably best if they have the common.sdat from the duplex release, though I am not positive.
  • They need to backup files, preferable that person has spoofing
  • Game update sfo's, don’t replace the Game sfo!!!!

From CaptainCPS-X: Here you have the PKG files for easy install of this awesome “Anonymous” collaboration! (thanks to hellsing9 to for providing with the files) This is really cool since maybe more 4.0 FW games will be patched in the future by this Anonymous person! Thanks!

US Patch [BLUS-30557]

FIX_340_UP1004-BLUS30557_00-MP3PATCH00000003-A0104-V0100-PE.pkg (51 MB)

Europe Patch [ BLES-00942 ]

FIX_340_EP1004-BLES00942_00-MP3PATCH00000004-A0105-V0100-PE.pkg (51 MB)

Installation instructions:

1- Download your specific PKG (US / EU)
2- Install normally from XMB.
3- Replace the original “common.sdat” from your untouched backup with DUPLEX’s one (duplex-mp3ebootpatch.part1.rar / duplex-mp3ebootpatch.part2.rar).
4- Load with multiMAN normally.

Enjoy! SeeYa!

In related PS3 news today, pr0p0sitionJOE has released several new PlayStation 3 fixes both HERE and HERE for those interested.

Update: A second PlayStation 3 scene group named NRP has also followed suit and released Kidou Senshi Gundam Extreme VS EBOOT PATCH READNFO JPN PS3 NRP. Below are the details from the PS3 NFO to the release as well:

Release Name: Kidou_Senshi_Gundam_-_Extreme_VS_EBOOT_PATCH_READNFO_JPN_PS3-NRP

NoRePack Presents. It's NoT a repack !

FiLENaME ------ nrp-exvsp
PlaTForM ------ PS3 CFW 3.55
Region ------ Japan
Language ------ Japanese
Supplier ------ Team NoRePack
rlz.Date ------ 2o12-o8-15
Serial ------ BLJS10131

Finally, a hero comes to kick the fcking TB'sass, cheers! And now we want to support dear DUPLEX with this release. Gundam stands on the ground without any dongle or special TB CFW. Works with our release: Kidou_Senshi_Gundam_-_Extreme_VS_JPN_REPACK_JB_PS3-NRP

Let's be the witness of the ruin of TB dynasty. Love & Peace! Enjoy! iF u LOvE or HATe THiS GAmE, BuY iT ;]

Other related PS3 releases from today:

  • Neverdead.Eboot.Patch.DirFix.PS3-DUPLEX
  • Tiger.Woods.PGA.Tour.13.Eboot.Patch.PS3-DUPLEX
  • Dirt.Showdown.Eboot.Patch.PS3-DUPLEX
  • Devil.May.Cry.HD.Collection.Eboot.Patch.PS3-DUPLEX
  • Sniper.Elite.V2.Eboot.Patch.PS3-DUPLEX
  • Syndicate.Eboot.Patch.PS3-DUPLEX
  • Twisted.Metal.Eboot.Patch.PS3-DUPLEX
  • Snipers.Invisible.Silent.Deadly.Eboot.Patch.PS3-DUPLEX
  • Puss.in.Boots.Eboot.Patch.PS3-DUPLEX
  • Assassins.Creed.Revelations.Eboot.Patch.PS3-DUPLEX
  • Kidou_Senshi_Gundam_-_Extreme_VS_EBOOT_PATCH_READNFO_JPN_PS3-NRP
  • Max.Payne.3.Eboot.Patch.READNFO.PS3-DUPLEX
  • Kidou_Senshi_Gundam_UC_EBOOT_PATCH_JPN_PS3-NRP

Here is a list of the TB releases for those who need to remove the dongle patched games and overwrite them with the PS3 scene release (Duplex, NRP, etc) fixes as they become available.

In related PS3 hacking news SGuerrini97 made available a CoreDump BLES00025 NBA2K7 (Password: BySGuerrini97) stating: Here is the Core Dump + Original self of NBA 2K7 (BLES00025). I made the dump from the original disk, i think that i can dump ALL the originals games.

Also below harryoke has outlined how he did a PS3 full core dump, as follows:

Download: PS3 Core Dump / PS3 Core Dump (Mirror)

Hello there my friends... as you may or may not know i have been looking into the possibility to get a full core dump from my ps3... a few hours ago i was sent a pm from ANON ... here it is....

Hey mate, yeh cfwprophet told something about the ram dump too. you can make a core dump on a dex. here is a quote from him:

'I say it now for the last time: There is NO fself for new games !! TrueBlue use the CoreDump function and a RSX exception to dump the games like i told the scene for over a half year.'

'Take MultiMan 04.02 which is a Retail NPDRM >> enable core dump function >> start MultiMan >> exit to XMB and be surprised'

'The Coredump function is a embended system of the debug FW and get handled of liblv2dbg. The send signal call aka send_signal_to_coredump_handler() and the trigger function are always running and CAN NOT be deactivated.'

He also said that you will get one 250MB file. there you have to search the decrypted file(s). it would be pretty sure that they use this method, because newer games wouldnt have debug eboots or fselfs.

If you open a tb eboot with a hex editor, you will see near at the end , that they stand right after the codes some passages with 'liblv2'. if you open a original eboot , you cant find passages with 'liblv2'. like cfwprophet said, the core dump get handled of 'liblv2dbg' and you can find 'liblv2' passages in tb eboots. so they use coredump pretty sure.

But the problem is to trigger a crash or so. i really dont know. i'm not a dev and dont have an idea. i just wanted to tell you this infos because i saw your post about coredump.

Here you can read more infos: ps3devwiki.com/files/documents/-SONY%20PS3%20SDK%20Documentation/360.01/cell/en/pdf/debug_support/Core_Dump-Overview_e.pdf

And here about liblv2dbg: ps3devwiki.com/files/documents/-SONY%20PS3%20SDK%20Documentation/RTL2.3.0/debug_support/liblv2dbg-Overview_e.pdf

Well i now have a few core dumps ...some were 250mb and a 500mb dump which i have uploaded including the log file...it is in rar format & compressed to 45mb

Hopefully this will lead us to the magic decrypted eboots that we all want. i hope someone with a bit more knowledge than me can use this info.

Just done a quick search of dump for USRDIR found this at address 002530E0

[Register or Login to view code]


And at 05D87600
[code]
00 00 00 3C 00 00 03 86 2F 64 65 76 5F 62 64 76 64 2F 50 53 33 5F 47 41 4D 45 2F 55 53 52 44 49 52 2F 45 42 4F 4F 54 2E 42 49 4E 00 33 B0 37 60 33 B0 37 F0 33 B0 38 70 33 B0 38 F0 33 B0 39 80 33 B0 3A 10 33 B0 3A 90 33 B0 22 B0 33 B2 A5 80
...

#803 - Daveyshamble501 - August 12, 2012 // 1:50 pm
Daveyshamble501's Avatar
The video explains how to open the dongle by grabbing the plastic lip behind the usb connector with pliers an pulling towards you, Thus exposing the plastic casing... Check out the video.

How to take apart your True Blue dongle to see if you have a real or a fake one. Real easy guide to make sure is worth it. Fake dongles have a green pcb with medium size LEDs at the bottom, we're as a Real TB has a blue pcb with tiny LEDs an a actel chip (like the one in the video, if yours resembles that then its real.)