PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!

Home PS4 News - Latest PlayStation 4 and PS3 News

March 20, 2012 // 1:23 am - It's been awhile since the last IDPS update, and today I've created this PS3 IDPS Viewer homebrew application based on research I'm doing and had not planned to release the tool out yet, but if someone needs it here it is (Thanks to J-Martin for the logo).

Download: PS3 IDPS Viewer Homebrew Application / PS3 IDPS Viewer Homebrew Application (USB)

What does this tool?

  • Displays the IDPS
  • Shows Target ID
  • Displays Motherboard revision
  • Save your IDPS in IDPS.bin file

Note: THIS TOOL IS SAFE

When the program starts you will see the typical intro screen, if you choose "Yes" you will see the data from your PS3, if sounds three beeps indicates that it was not possible dump and show the error message, and if all went well sounds a beep and you are able to see the data.

Automatically saves the IDPS in dev_hdd0/IDPS.bin, you must open it with a hex editor and look hexadecimal values, for example (IDPS false, I will not reveal my IDPS):

e.g Notepad

[Register or Login to view code]

Hex Editor
[Register or Login to view code]

The IDPS in this case would be: 00 00 00 01 00 85 00 May 87 47 64 15 A4 F6 4D AA

It has been tested on PS3 FAT, SLIM should work perfectly in also.

Regards

Finally, in related news PlayStation 3 developer naehrwert has recently blogged (nwert.wordpress.com/2011/12/24/individual-infos/) about PS3 Individual Infos, to quote:

One of the PS3′s console specific cryptography works as follows:

At factory time there is a console specific key generated, probably from a private constant value and a console specific seed. Maybe that’s the key used for encrypting bootldr and metldr. Fact is, that metldr stores another console specific keyset (key/iv) to LS offset 0x00000.

That keyset is probably calculated from the first one. At factory time the isolated root keyset (how I call it) is used to encrypt the console’s “Individual Infos”, like eEID. But not the whole eEID is encrypted the same way, special seeds are used to calculate key/iv pairs for the different sections.

And not even that is true for every eEID section, because for e.g. EID0 another step is needed to generate the final section key(set). Each of the isolated modules using such an “Individual Info” has a special section that isoldr uses to generate the derived key(set)s.

But the generation works in a way, that the section data is encrypted with aes-cbc using the isolated root keyset, so it is not possible to calculate the isolated root keyset back from the derived key(set)s, because aes shouldn’t allow a known plaintext attack.

So far I can decrypt some of EID0′s sections, EID1, EID2 and EID4. EID5 encryption should be similar to EID0′s but I lack the generation keys for that one.


PS3 IDPS Viewer Tool Homebrew Application is Released

PS3 IDPS Viewer Tool Homebrew Application is Released

Follow us on Twitter, Facebook and drop by the PS3 Hacks and PS3 CFW forums for the latest PlayStation 3 scene and PS4 Hacks & JailBreak updates with PlayStation 4 homebrew PS4 Downloads.



#35 - PS4 News - October 4, 2013 // 1:12 pm
PS4 News's Avatar
Following up on the previous PS3 IDPS Changer and ChangePSID, today PlayStation 3 developer zecoxao has released an updated PS3 IDPS / PSID Changer alongside Dump_Sbmmio.pkg with details below.

Download: idps_psid_changer.zip / cygwin1.dll / idps_psid_changer.zip (Mirror) / idps_psid_changer.zip (Mirror #2) / Private Key Bruteforcer / dump_sbmmio.pkg / EID Root Key Dumper (Updated) / Dump_EEID / Flash_EEID

To quote: Ok guys, so here's something I have for you. This is an idps/psid changer.

This changes the idps in section 0 or section 6 and the psid in section B (not A sorry, i corrected that on the wiki) PERMANENTLY on flash. so, you know the drill. be VERY careful when using this tool and always take precautions with a flasher.

You're going to need 5 things: root_key, a backup of your nor flash (only nor is supported at the moment but you can easily make it compatible for nand consoles by changing the offsets at merge_section as well as change the name to whatever you wish to call your flash), a back up of eid (you can obtain this with flow rebuilder or using memdump) and, obviously, the idps and the psid you want to use on your console.

As for the final hash in each section, the libeeid creator was kind enough to take care of that, so don't worry about that but PLEASE use valid idps and psid files!!!

Any questions, please ask. and yes, that handles cex2dex too.

[Register or Login to view code]


9th byte list (from wiki): pastie.org/private/lqwgs1qzh1jd14kmbea8a

[Register or Login to view code]

10th byte list (from wiki): pastie.org/private/ftr9f5yw164jhndy3ieoa

[Register or Login to view code]

Notes: if you notice, cechgs appear in almost all possibilities of the 9th byte list, except in the static idps 9th byte.

Banned idps list from "Free IDPS" thread: pastie.org/private/mk0ipzwuo9woejakc45sa

[Register or Login to view code]

Buffer Overflow on Save Games

This comes back from the psp era. usually, you'd insert a disc, load a certain save and it'd load a data that'd have a very long string. at the end or the middle of that string you'd see a binary loader (hbl.bin) that would load the main menu of HBL. In the case of the ps3, before the crypto fail was publically announced, little to nothing was possible in regards to load a binary of a savegame. now, thanks to that and thanks to flatz 's amazing tools, it might be a possibility in the near future

Since there isn't a tool that handles savegame crashes (yet), so far we can only manage ourselves with a DEX/Convert and eth debug to know what happens at the time of the crash/freeze.. in my case, i don't have access to such tools, but there are people who do

So, you can try this for yourselves.. this was made in fifa 09. i turned auto-save off (so it didn't overwrite the crafted save i made), made a savegame profile, and loaded the disc. The result was that it crashed while loading the save.

The only thing i changed was SYS-DATA. i opened it in HxD, and filled my name (zecoxao) with o's until it matched Ronaldo's string entry. that caused the game to crash.

Theoretically, you can most likely load a disc-bind 3.55 and below signed self from a register that returns an address and it'll just load the self (i think) although i didn't try this myself yet, because i can't debug it properly on a superslim. Anyone who wishes to give it a go is welcome to do so.

Printing Things to the Screen

As you all know, neither the sdk nor the psl1ght environment allow you to print things natively to the screen , at least not without using rsx. fortunately, inside the cobra sources of their usb, there is something that enables that, making debug output MUCH easier.

The specified functions are debug_install and debug_printf. debug_install patches the necessary offsets and redirects tty output to the screen, and then debug_printf simply prints the thing you want. this might not sound much but it's a VERY useful feature, specially when you want to debug code and you like to visually see what is happening. also, this could turn things such as memory patching and dumping much easier to look at.

I'd like to compile it myself and test for results but i don't have a working hackable console. so i'd like to ask any of you devs to test it and check if it works or not. as i was told it does seem to work, so i hope that this gets adapted to PSL1GHT very soon.

U$er , i'd like you to be the first person to test this, since you have understood the plugin loading and adapted it for ourselves.

Buffer Overflow on Save Games

This comes back from the psp era. usually, you'd insert a disc, load a certain save and it'd load a data that'd have a very long string. at the end or the middle of that string you'd see a binary loader (hbl.bin) that would load the main menu of HBL.

In the case of the ps3, before the crypto fail was publically announced, little to nothing was possible in regards to load a binary of a savegame. now, thanks to that and thanks to flatz 's amazing tools, it might be a possibility in the near future.

Since there isn't a tool that handles savegame crashes (yet), so far we can only manage ourselves with a DEX/Convert and eth debug to know what happens at the time of the crash/freeze.

In my case, i don't have access to such tools, but there are people who do

So, you can try this for yourselves.. this was made in fifa 09. i turned auto-save off (so it didn't overwrite the crafted save i made), made a savegame profile, and loaded the disc.

The result was that it crashed while loading the save.. the only thing i changed was SYS-DATA. i opened it in HxD, and filled my name (zecoxao) with o's until it matched Ronaldo's string entry. that caused the game to crash.

Theoretically, you can most likely load a disc-bind 3.55 and below signed self from a register that returns an address and it'll just load the self (i think) although i didn't try this myself yet, because i can't debug it properly on a superslim.. anyone who wishes to give it a go is welcome to do so.

From pastie.org/private/p1mxjrd6xbmv3hrphazxsw (the freeze):

[Register or Login to view code]

LR is what matters to us. it's called Link Register and returns the address of what we want to load.

IT'S A TARP! Thanks flatz for the debugging)

FIFA 08 (props to NiceShot for the logs) (via pastie.org/private/9iqksaxgxpo8kdqxc87g):

[Register or Login to view code]


Register control in GPR0 (0x31) (via pastie.org/private/hqi53jdrhltfvdaezn3png):

[Register or Login to view code]

Controlling r0 is pretty much the same as controlling the link register. if we control r1 we can control the rop.

Here are the core dumps for fifa 08 and 09. r0 is controllable in both games (it's probably hitting the stack)

Download: fifacoredumps.tar.7z

It'll take some minutes to upload them, so please wait.

Lv2diag.self bricking consoles?

I told myself i wasn't going to post any more about ps3s but this is really bugging me so... i was hanging out in skype when suddenly vapour barges in and says a self he created with Objective Suites bricked his ps3.

Naturally, for a person who bricked 7 consoles by flashing ways, i thought he was kidding, since nowhere in the world Sony would do such a thing. then i asked hellsing9 to test it somewhere. he tested the self. it bricked. he tested again, bricked again. then i asked greysmoke. he tested the self. it didn't brick.

My question is this: in which consoles can the brick be caused, what causes the brick to be triggered, and most importantly, can we intercept the process of the command of bricking and replace it with something else?

This is the self (3.42 appldr signed): https://dl.dropboxusercontent.com/u/35197530/Lv2diag.self

Needless to say flashers can and MUST be used before doing anything. They can unbrick. E3 flasher can be used as any regular flasher. as for the pinouts, i believe they are available on the wiki (NiceShot has the picture).

From NiceShot: Uhm... you should have the original dump before trying this, I'm not sure if dumping it, byte swapping and flashing it back will solve the problem but it is worth trying, I had a broken e3 flasher clip so I had to map the whole points to use e3 linker but if you have an e3 flasher with e3 clip you can do the job the same way, but there you have the pinout for MSX-001:

https://www.dropbox.com/s/0y96aa8q8cpo2ng/MSX-001%20NOR%20Test%20Points%20TeaM_X_TudO.bmp

Cheers

PS3 IDA Stuff

So, i was bored and i decided to open ida pro and take a look at things. then, someone told me that i could open idb files in ida. so i went to graf's bible and opened a few. fun. anyways, here are some scripts/updates of scripts.

HV Dump script has "new" function names instead of the usual "undocumented_function" crap and export script prints all the function names to the screen (the ones that don't start with sub_) consider this a release of sorts. i'll try to take care of syscall_names.idh tomorrow for the lv2 dump script.

Download: stuff_for_ida.zip
GIT: github.com/zecoxao/ps3ida

Github contains precompiled loaders, plugins, signatures, and the new scripts. i've updated the zip. you should have now two aditional export functions. one for the syscalls, and another for the hvcalls. gonna see if i can take care of syscall_names, idh today.

Edit: taken care of: github.com/zecoxao/ps3ida/blob/master/syscall_names.idh

Kinda piggish but it does the trick

Added some more signatures. had to use a trick. They're on github: github.com/zecoxao/ps3ida/tree/master/sig/ppc

eEID5 Keyseed and Section Keys Found

[Register or Login to view code]

Edit: some corrections: psdevwiki.com/ps3/Keys#KIRK (thanks euss)

KIRK

A68BEDC33418029C1D3CE33B9A321FCCBB9E0F0B

location: in lv2_kernel.self

More KIRK keys

  • github.com/uofw/upspd/wiki/KIRK-13---ECDSA-point-multiplication
  • code.google.com/p/kirk-engine/source/browse/trunk/libkirk/kirk_engine.c
  • wololo.net/talk/viewtopic.php?p=80302#p80302

AES requires a 16 byte multiple message.. i have no idea of what unk_keyseed is.

[Register or Login to view code]

Interesting info on KIRK 0xC, 0xD, 0x10, and 0x11 functions by Proxima

[Register or Login to view code]

Download: ps3_decrypt_tools-master.zip

To quote(from pastie.org/private/hzqhpgaxgdybq3zjudqpva):

[Register or Login to view code]

Finally, from LiquidManZero (via psx-scene.com/forums/f153/new-63886/index28.html#post992654):

Welp. I'm just going to leave these here... Also Rand, I know you're watching.

[Register or Login to view code]

From zecoxao: Euss right next to this (psdevwiki.com/ps3/Seeds#sc_iso_key_seeds) there's a chunk of data, size 0x290, which is loaded twice in two separate functions. i'm guessing that this is some sort of eid1 in disguise? this is on the jig firmware btw.

There is also a third value which i don't recognize (next to be2sc and sc2be keys):

[Register or Login to view code]

Dump_Sbmmio.pkg (linked above)

Dumps sbmmio to any usb port. i need to know what lies at offset 0xC000 in different consoles. so, bring me your dumps (they don't come with personal information AFAIK) or you can just tell me the first 0x14 bytes of offset 0xC000.

You need:

  • usb stick in ps3
  • lv1 peek and poke by graf

That's the southbridge dump. i was using it to know what the hell was wrong with syscon by flatz. Turns out it wasn't the device/distro/linux kernel/firmware version it was the code, and he fixed it.

Now a friend of mine is trying to overflow packets sent to the syscon in order to obtain the syscon content keys.. btw, here is the fixed code:

Download: https://dl.dropboxusercontent.com/u/35197530/zip/syscon.7z

These last days I've been trying to make the syscon command work on linux, only to find out it didn't work as it should. Here are the proper sources (linked above).

More PlayStation 3 News...

#34 - mahidi - May 12, 2013 // 7:24 pm
mahidi's Avatar
DLL files is missing after downloading the dll it still asking me for ssleay32.dll why they couldn't make this program perfectly??

#33 - onik - May 3, 2013 // 7:00 am
onik's Avatar
is there any brick possibilities while reflashing??

#32 - s25s - April 11, 2013 // 1:03 am
s25s's Avatar
great work

we need also update for change (psid) because some of ban in psid

#31 - PS4 News - April 9, 2013 // 12:35 pm
PS4 News's Avatar
Following up on the PS3 IDPS Proj3ct, today PlayStation 3 developer Joris (aka JorisD33) has made available PS3 IDPS Changer version 1.1 followed by v1.3 and IDPSet v0.6 and some updates with details below.

Download: PS3 IDPS Changer v1.1 / PS3 IDPS Changer v1.1 (Mirror) / PS3 IDPS Changer v1.3 / IDPS_Changer.zip (Latest Version) / idpstool.pkg / IDPSet_v0.6.pkg (IDPSTool and IDPSet by Zar to change PS3 IDPS) / IDPSet_v0.62.pkg / IDPSet_v0.75.pkg / IDPSet_v0.76.pkg / IDPSet_v0.77.pkg / IDPSet_0.78.pkg / IDPSet_v0.79.pkg / IDPSet_v0.80.pkg / IDPSet_0.82.pkg / IDPSet_v0.83.pkg / IDPSet_v0.84.pkg / IDPSet_v0.85.pkg / IDPSet_v0.86.pkg by Zarh / EIDROOT.rar by Joonie

From the ReadMe File: What do this application do?

This application will change your IDPS and optionally your MAC address into your flash dump.

How can I use it?

Just put a VALID(!) NOR/NAND dump called dump.bin and your eEID Root Key called eid_root_key.bin into the same directory, run the program and enter your new IDPS.

Your modified dump will be created as dump_patched.bin, you just have to flash it back to your console.

How can I dump my eEID Root Key?

http://www.ps4news.com/ps3-hacks-jailbreak/ps3-eeid-rkdumper-from-gameos-pkg-by-flat-z-is-now-available/

How can I dump my flash?

  • Hardware flasher (E3, Teensy, Progskeet...)
  • Multiman
  • ...



How can I byte-reverse my dump?

Flowrebuilder: FlowRebuilder v.4.2.3.0.exe / FlowRebuilder v.4.2.3.0.exe (Mirror)

4.2.3.0 Changelog:

  • added support to manage NAND preloader dumps
  • message user about the type of dump
  • message the user if bootloader are missing
  • auto-recognize if dump is normal or byte swapped and automanage them

If you byte-reverse your dump before using this application, remember to byte-reverse it back after the procedure.

CHANGELOG 1.0:

  • Initial release

From haz367: proper eid0 section/part conversion so the new idps at least has correct values after it (cex2dex offsets 002F090-2F14F//omac hash)

offset 2F077/2F07F (new idps)

offsets/block: 2F090-2F14F - new values calculated/added to have valid idps change? at least better then only changing IDPS line

offset 303D7/303DF (new idps)

offset 3F040-3F045 (new mac)

tested offline and trashed with my own dumps. not needed but people deserve second change right, only need to brick another PS3 to get new idps. great share for that.

Update: PS3 IDPS Changer v1.3 Changelog: Here is the latest version of this sweet little app. I had troubles using all versions prior and now I have permanently installed new IDPS on over 30 systems. Make sure you have openssl installed via cygwin, enable XP SP2 compatibility on openssl.exe. Then grant admin access to openssl.exe as well as IDPS Changer then drop these files in the cygwin directory to ensure all the needed dll files are present.

Name your eEID Root Key - eid_root_key.bin (obtained via FW 3.55)
Name your NOR/NAND dump - dump.bin

Then place these in the cygwin folder as well with the other stuff we just installed/added

Then simply run the IDPS Changer.exe and follow instructions, this also allows changing of your MAC address. After the app is done simply rename the dump_patched.bin to the following depending on your flash type NAND or NOR.

Nor model = CEX-FLASH.FULL.EID0.NORBIN

Nand model = CEX-FLASH.FULL.EID0.NANDBIN

Once you have named the file copy on to a flash drive and open mM and go to mMOS then open the drive with the newly patched dump. Double click on it and wait for it to install. Once done reboot your system and go back to mM and the settings and look at your new MAC/IDPS on your freshly unbanned PS3.

Update #2: IDPSTool become IDPSet v0.6 is now available (linked above) by Zar from the PS3Gunz French site.

With this new version, you can permanently change your console IDPS (NAND and NOR). You just have to run IDPSet on your CFW (with Eid Root Key and valid IDPS on your USB key).

Finally, Zarh made available IDPSet v0.62 PKG with the following updates and further revisions:

  • added the default paths of FLATZ's eid_root_key dumpers
  • added a check of eid_root_key
  • and now it's display the region matching with the target ID
  • fix name of dumps

IDPSet v0.75 / v0.76 Changelog:

  • Support fw 4.65
  • New UI
  • Remove PSID stuff (it's useless)
  • Remove Save/load to/from file (it's useless)
  • New option: Convert to DEX/CEX only for rebug
  • New option : "Dump eid_root_key" only for cex fw: 4.65, 4.53, 4.50, 4.46, 4.21 to "/dev_usb000/eid_root_key" else "/dev_hdd0/tmp/eid_root_key"

IDPSet v0.77 Changelog:

  • better check on rebug firmware
  • added swap kernel in ros1 too
  • added check if syscall lv2 peek&poke are available

IDPSet v0.78 Changelog:

Indeed, sorry i forgot to tell you v0.78 is out.. I hope this one will be the last update

IDPSet v0.79 Changelog:

Hi, I have updated IDPSet to v0.79: Changelog since last official release of v0.62

  • Add : version nb in TITLE
  • Add : progress bar
  • Add : nouveau UI
  • Removed : all PSID stuff
  • Removed : save/load from/to file
  • Add : "dump eid_root_key" only for 421C, 450C, 446C, 453C, 465C (ty flatz and zecoxao)
  • Add : "Convert to DEX/CEX" only for rebug
  • Add : "Make CEX/DEX dumps" is faster
  • Add : support fw 4.65 (4.66 too btw)

Previous changes from v0.62:

  • Added the default paths of FLATZ's eid_root_key dumpers
  • Added a check of eid_root_key
  • And now it's display the region matching with the target ID
  • Fix name of dumps

The idps.bin and eid_root_key must be in the root of the USB.

Known issue:

Dumps & the root_key file have the attribut "system", i don't know why, and i don't know how to remove it with the ps3 system. But here the cmd to remove it with windows.

[Register or Login to view code]

I've made a batch for the lazy ones: remove_attrib.bat. Just put this file in the root of usb and click on it. it will remove all the attributes.

Thanks to all testers.

PS: If someone know why these files have this fcking "system" attribute or how i can remove it, plz help me

IDPSet v0.80 Changelog:

Thanks to badboy and matsumoto, i have updated to v0.80:

Changelog v0.80:

  • The dumps no longer have the attribute "system"

Changelog v0.82:

I have updated IDPSet to v0.82 thanks to baileyscream and jonnyjaeger

NEW Changelog - version 0.82:

  • Fix: No more freeze when making CEX&DEX dumps with a DEX system

Changelog v0.83 (JAN/3/15):

  • Fix: random freeze

I fixed random freezes described by Tactik-knife. Thanks.

Changelog v0.84 (FEB/21/15):

  • Added: Swap of "software_update_plugin.sprx"

Changelog v0.85 (JUL/26/15):

  • Added: Background image (a PNG is: /USRDIR/BG.PNG)
  • Added: Homebrew is compatible with fw 4.70 and 4.75
  • Added: The dumper for the root key is compatible with fw 4.70C, 4.70D and 4.75

This is just a little update to support new firmware.

Changelog v0.86 (JUL/27/15):

  • fix: no more freeze when you dump your key for firmware under 4.65.

FYI. I wasn't in hurry because you still can do it wit the rebug toolbox (that's also why i didn't ported it to every fw) but just to have something proper, I think I solved this issue with this update, can you try ?

More PlayStation 3 News...

#30 - Brenza - April 6, 2013 // 6:20 am
Brenza's Avatar
sony can read pretty much anything they want. everytime you connect the ps3 to internet (NB: internet, non psn) it automatically uploads the log files

these files contains the all ps3 activity, sony's fw are 175MB of code (compressed) and they could put some checker everywhere in the firmware, if one of these checks finds out that your ps3 is running a non-original firmware sony'll know it.

the only thing we can do is locate these checks and find out a way to bypass all of them

#29 - mmanolos - April 6, 2013 // 12:45 am
mmanolos's Avatar
Thanks for your information, Brenza! Anyway, it sounds too complicated, risky and useless right now as you said.

I was never really interested in playing online, and I think my PS3 was banned when I went online just to use the Youtube app and launched MM after... I was wondering, as the French guys said "CFW consoles connecting to PSN are too easily spotted", if anyone knows exactly what Sony can see and if a PS3 can really be stealthty in the future. How is the CFW online status today? Is it a matter of time to be banned or is there no way to be unnoticed?

#28 - Brenza - April 5, 2013 // 6:53 am
Brenza's Avatar
That's not hard, you just have to:

1) Decrypt the whole eEID from the flash using the per_console_key_1 and the various sub-section keys (eid0, eid1, eid2... these keys can be obtained using the pck1 so you won't have any problem to retrieve them)
2) Replace the IDPS in the decrypted eid0 and eid5
3) Re-encrypt all the stuff and write it back to the flash
4) Perform a remarry (i think you might be able to fix the eid4 and update the bd-key directly via pc but i never tried it)

NB: this practice not so hard and it DOES NOT allow to to play online with CFW, you would get banned again and again... do not try this if you plan to stay on cfw, it's useless!!!

You should also be awared that changing the console's idps will cause lot of troubles with your savegames and throphy decryption / syncronization.

Oh, and unbanning the console won't OBVIOUSLY allow to unban your SEN account.

oh, i forgot it.. it can also be done automatically via Factory Service Mode (currently only on 3.55 and lower as the required sig file hash has been revoked in highter firmwares)

You just need ObjectiveSuites and a valid request_idps file (that we can generate "easily" with the info HERE)

And here's a few personal notes:

1) this practice not so hard and it DOES NOT allow to to play online with CFW, you would get banned again and again... do not try this if you plan to stay on cfw, it's useless!!!
2) you obviously will not be able to unban yous SEN account
3) changing the idps will cause troubles with tour save\trophy files (you should be able to resign them properly using aldo's application)

#27 - PS4 News - April 4, 2013 // 11:07 pm
PS4 News's Avatar
Following up on the PS3 IDPS Viewer, PS3 Request IDPS Generator and PS Unban, today French PlayStation 3 homebrew developers Labuse and Raymanvtwo have shared a video introducing their latest PS3 unbanning IDPS Proj3ct.

To quote, roughly translated:

This process deals with modification in the flash memory of your PS3. So beware of the risk involved. As you will be the one responsible for any damages.

1 - It’s free.
2 - It does not provide for IDPS.
3 - 1 change per member (archiving R_K to control all business)
4 - no requirement to have an ODE or another to benefit from this service.
5 - Do not buy IDPS! , but get it by your own means. It does not provide a repair service or any failure or brick If you do not have access to PSN / SEN after our intervention, you you probably have stolen your IDPS, we test the validity of IDPS before making the change.
6 - You do not store the IDPS valid for use and even less for
resale.
7 - No, not the service sony unbanned person a simple phone call, this is totally false.
8 - No, it is not a simple change with a hex editor, and it does not
change enough to IDPS only on known offsets.

To start here are the essential conditions to be fulfilled before you make the final change of IDPS:

1 - Have their console banned from PSN
2 - console already be hacked (CFW)
3 - have a valid IDPS to provide for replacement

If you do not meet any of these conditions, then it is no need to go further... however if all conditions are met then we will be able to do something for you, but before that take the time to read all the explanations below!

PS3 IDPS FAQ:

What is to Proj3ct IDPS?

To de-ban your console SEN / PSN actually modifying the flash memory of it.

How do I know if it is my PSN account or if my console ID that is banned?

If you get this message to the PSN sign: “Access denied or temporarily suspended for this system,” is that your console ID banned.

To which PS3 models are targeted modification of ID with IDPS Proj3ct?

For all models Fat and Slim CFW (before 3000 series).

Who is this service free of IDPS change?

Everyone has provided to meet the three key points above, nor any ODE Flasher is asked to make the change.

Why Does not provide you IDPS?

Just for 2 reasons: The first is that for the time being we do not yet generate non-original identifiers so they must find true and valid they are rare and valuable, however we work in progress to try to remedy this problem... and the second, CFW consoles connecting to PSN are too easily spotted and can not afford to lose identifiers for a few hours / days of games online.

Why Proj3ct IDPS is not distributed freely?

Because the conversion of the dump is difficult and requires a good knowledge in this field, any approximation leads directly onto a brick your console, but also to avoid unscrupulous pharmacies that will make their business to make money with our work, we hope that it is Free for the community and we will offer you this service. s

Secondly, because this change make public console could seriously undermine all users PS3 OFW, and it is only this reason that motivated the choice of delivery method!




How it’s gonna happen to change definitely IDPS?

1) Visit in [APPLICATION] IDPS PROJ3CT (ps-addict.fr/forum/post96895.html#p96895) to put your formal request for change of IDPS, stating:

PS3 Slim 320 GB / Fat 40 gb, etc. ...
Model: CECH .....
CFW up:
Level of knowledge PS3 (beginner - expert - expert)

2) Wait for an consideration answer of your request.

3) After acceptance of your application to the post in question, you can send your items BUT only in MP to Labuseor Raymanvtwo the following files:

  • Your Root_Key
  • Dump Your conducted with MM
  • Your IDPS (HS recovered on a console, for example)
  • A picture of your system properties in Multiman

Note: you will find the method and tools to recover these different elements in the [TUTORIAL] IDPS PROJ3CT (ps-addict.fr/forum/post96894.html#p96894).

4) We check first the actual validity of your IDPS then proceed to the actual change of the IDPS in your dump. We send it back within 2 to 4 days max MP.

5) You re-flash your PS3 with Multiman to the dump you have recovered.

6) You still have to format your PS3 to erase all traces using a CFW and you can now enter the OFW update, your console is banned from de-SEN / PSN! attention: any use of PSN CFW after the de-banning your console to deliver in the same situation a few hours / days later... and I recall that we do not make one final change by console! Enjoy!

More PlayStation 3 News...

#26 - PS4 News - October 15, 2012 // 3:04 pm
PS4 News's Avatar
Following up on the previous PS3 IDPS update, today PlayStation 3 homebrew developer Rnd (aka RndRandomizer) has released a Request IDPS Generator version 1.0.0.0 with details below.

Download: PS3 Request IDPS Generator v1.0.0.0

From the ReadMe file: REQUEST IDPS Generator - v1.0.0.0 - Rnd

v1.0.0.0:

  • Initial Release

Features:

  • Generate a request_idps file
  • Get PerConsole Data (board ID, cid, ecid, kiban ID, ckp2_data, ckp_management_id)

Usage:

Just get your NAND/NOR dump and drop it in this application.

No more need for re-flashing the whole dump in order to convert EID.

Simply it makes it easier to use it with ObjectiveSuites-SetIdps and you dont have to gether it from Sony's server.

Put request_idps.txt in Temp folder in ObjectiveSuites, to set your request_idps and you are done with flashing the new EID.

I'm not responsible for ANY DAMAGE it may cause! USE AT YOUR OWN RISK!

P.S. If somebody has a script to get the EID with ObjectiveSuites, I would be very kind if you could let me know, I will update the application.

Sincerely,
Rnd

Contact me at RndRandomizer

Finally, from zecoxao: Found it, now we can make our own request_idps files

request_idps.txt (hex) info by Scorpion2k7

name Start offset Size (byte)

per_console_serial 0 8
header 8 96

- Header structure

bytes description
4 number of file (5)
4 lenght of entire file (value-8)
8 unknown (00 03 00 04 00 00 00 00)
(file table)
4 file position 1 (value-8)
4 file lenght 1
8 file id 1
4 file position 2 (value-8)
4 file lenght 2
8 file id 2
...
...

- File info

File 1 - 16 bytes - 00 12 00 02 00 00 00 00 00 00 00 00 00 00 00 00
File 2 - 2144 bytes - EID0
File 3 - 128 bytes - EID2 PBLOCK
File 4 - 48 bytes - EID4
File 5 - 2560 - EID5

Finally, below is a brief guide from Abkarino as follows:

1 - Dump you NAND/NOR flash using a memDump tool or Hardware flasher if you have a higher firmware.
2 - Drag this dump into Request IDPS generator tool to generate the request_idps.txt file.
3 - Set your PC IP Address to: 192.168.0.100 and sub net mask to 255.255.255.0.
4 - Enter a FSM using any dongle/software method you like.
5 - Connect your PS3 to your PC directly using Ethernet cable.
6 - Find the old leaked CEX2DEX conversion tools that contains ObjectiveSuite-SetIDPS.
7 - copy all files from conversion folder into flash drive and put it in the right USB slot in your PS3.
8 - in your PC start copy the generated request_idps.txt into the TEMP folder inside the ObjectiveSuite-SetIDPS folder.
9 - Start ObjectiveSuite.exe then power up your PS3.
10 - Wait for about 1 min and you will see a "PASS" message in ObjectiveSuite.
11 - Now turn off your console.
12 - Flash any 3.55 CFW DEX.
13 - While in FSM remarry your BD Drive using 3.30 DEX PUP + 3.55 Remarry tools from Wiki.
14 - Exit from FSM and now you have a fully functional DEX machine.

From eussNL via IRC: patch SSL, use REQUEST IDPS Generator, lay back bored (since what happens with SetIDPS isn't really a true conversion, because you just write your own EID to the NOR/NAND).

More PlayStation 3 News...