PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!

Home PS4 News - Latest PlayStation 4 and PS3 News

165w ago - Following up on the previous True Blue (TB) PS3 JailBreak 2 (JB2) DRM-infected dongle news comes a WIP update from Shadoxi on dumping and decrypting the TB and Cobra payloads below, as follows:

Download: TB / Cobra Payloads (2.84 MB) / TB / Cobra Payloads (2.84 MB - Mirror) / TB / Cobra Payloads (2.84 MB - Mirror) / PS3 True Blue MFW (172.19 MB)

I have figured out where the payload is located of the TB and Cobra dongles. You can find it at offset @360000 in lv2_kernel and 7f0000 in PS3 memory. According to the PS3 Developer Wiki (ps3devwiki.com/index.php/ReDRM_/_Piracy_dongles) the LV2 dump payload at 0x7f0000 has also been decrypted @ LV2 dump 0x7f0000 (pastebin.com/3VG76HQs)

Drag and drop payload in IDA and load it in Binary file mode, Processor type PPC.Press "C" to convert in ASM code.

First of all you need to edit the header of lv2_kernel.self (from CFW TrueBlue) at offset 0x1D, replace 36 1A 00 by 4C FC F0. And decrypt it with unself tool from fail0verflow. Open lv2_kernel.elf with IDA Pro (in binary file mode), go to offset 360000 and press "C" to convert to asm code.

TrueBlue use some HVCALL:

  • lv1_insert_htab_entry
  • lv1_undocumented_function_114
  • lv1_undocumented_function_115
  • lv1_allocate_device_dma_region
  • lv1_map_device_dma_region
  • lv1_net_start_tx_dma
  • lv1_net_control
  • lv1_panic (shutdown ps3 when TB is unplugged)

This payload do some HVCALL:

  • lv1_insert_htab_entry (map lv1)
  • lv1_allocate_device_dma_region (?)
  • lv1_map_device_dma_region (?)
  • lv1_net_start_tx_dma (?)
  • lv1_net_control (?)
  • lv1_panic (shutdown ps3 when TrueBlue dongle is unplugged)
  • lv1_undocumented_function_114 (map lv1)
  • lv1_undocumented_function_115 (unmap lv1)

We needed to dump lv2 and lv1 memory when the dongle is plugged in, so I created a modified TB CFW with peek and poke syscall. It works fine !

Finally, from the MFW_TrueBLue.zip ReadMe file: Warning this mfw can brick your dongle !!!

  • First install PS3PEEKTEST.pkg
  • Install MFW TrueBlue firmware in recovery mode
  • Start ps3peektest

If Peek Result is equal to 10 and true blue light is green -> work.


True Blue (TB) and Cobra PS3 JB2 DRM Dongle Payloads WIP

Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter, Facebook and drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene and PlayStation 4 scene updates and fresh homebrew PS3 Downloads. Enjoy!


  • Sponsored Links




#852 - StanSmith - 138w ago
StanSmith's Avatar
So I used this and dumped 2 files from Ghost Recon FS. Now what?

They aren't near the size of the eboot.bin so what are they good for?

#851 - Brenza - 138w ago
Brenza's Avatar
You shouldn't have released it... now they'll fix the exploit! >.>

#850 - violato135 - 138w ago
violato135's Avatar
Can I NOT use a dongle and jailbreak a ps3 without it???

#849 - imajei - 138w ago
imajei's Avatar
I don't have a dongle so can someone with a tb upload a decrypted ghost recon eboot i have an idea please

thats a pretty please i'm bored and need something to do thanx to the good ol community lol.

do i need a tb dongle to do this?

#848 - fantopoulos - 139w ago
fantopoulos's Avatar
i have a true blue will do my best to get a dump for you to proceed where we were stuck for a long time but no it seems like we are going uphill again thanks shadoxi for starting this elf dumper , amazing work cheers triple thumbs up

#847 - Asure - 139w ago
Asure's Avatar
shadoxi we can figure out the original ELF size using SCEtool to get this info right? (find start of elf64 header, + size = end of elf)

Example

[Register or Login to view code]


Then we know the section headers start at 0x17EC228

Last section STRTAB:

[Register or Login to view code]


So elf ends at 0x17EC0F7 + 0x12C. We add padding to 0x17EC228, and insert clean elf64 section headerd dump from original eboot.bin, right? Or does this dump ELF+section headers+some extra stuff we can cut off?

Anybody care to post a dumped elf (raw, with this tool) so i can look at it?

#846 - shadoxi - 139w ago
shadoxi's Avatar
Following up on the previous update, today I am releasing my True Blue USB dongle PS3 ELF dumper which works with any PlayStation 3 Firmware greater than 3.56 to dump the encrypted TB EBOOT / ELF files once they are loaded.

Download: True Blue USB Dongle PS3 ELF Dumper / True Blue USB Dongle PS3 ELF Dumper (Mirror) / True Blue USB Dongle PS3 ELF Dumper (Mirror #2) / True Blue USB Dongle PS3 ELF Dumper (Mirror #3) / True Blue USB Dongle PS3 ELF Dumper (Mirror #4) / True Blue USB Dongle PS3 ELF Dumper (Mirror #5) / True Blue USB Dongle PS3 ELF Dumper (Mirror #6) / True Blue USB Dongle PS3 ELF Dumper Source Code / True Blue USB Dongle PS3 ELF Dumper Source Code (Mirror) / UTEBOOT (DUMPEDBOOT.bin and DUMPEDBOOT1.bin) by arnes_king / Mass Effect 3 BLUS30853 RAMDUMP by gibson25 / TB ELF Dumper v2 (np_trp_prx.rar) / TB ELF Dumper v2 (Mirror) / DUMPEDBOOT PoC by mellss

Tested on:

  • Original 355 -> ok
  • True Blue CFW v2 -> ok
  • ...

There are some bugs (size of dump ...) but it works. It's ELF dumper from memory and it work with True Blue cfw v2 and any 3.55 firmware because it doesn't use lv2 peek/poke.

Warning: It will not brick your ps3. But I am not responsible for any damage.

HOWTO:

  • Enable dev_blind with multiman
  • copy libsysutil_np_trophy.sprx from /dev_blind/sys/external/external to dev_hdd0/ and rename it "orignal_libsysutil_np_trophy.sprx"
  • copy my modified "libsysutil_np_trophy.sprx" to /dev_blind/sys/external/
  • load a True blue game from multiman
  • exit multiman
  • run your game
  • wait few minutes (if you get black screen after 3 minutes reboot ps3)
  • exit game
  • go to ftp
  • in dev_hdd0/ there are your decrypted DUMPEDBOOT.bin
  • copy and rename it with another name.

Howto uninstall patch - Two ways:

  • You could uninstall this patch by replacing modified libsysutil_np_trophy.sprx by orginal libsysutil_np_trophy.sprx
  • Or update in recovery mode

Thanks to: Ps3dev

Brief Guide:

1 - Install TB ELF Dumper first as stated in its readme file.
2 - Start Multiman, it will make a dump of multiman eboots, so you must delete it first by browsing to dev_hdd0 then delete all DUMPEDEBOOT.BIN files you found there.
3 - Back to multiman game selection then select any TB game then launch it.
4 - Start the game from XMB then wait for some times until game start.
5 - Exit game now then start multiman again then browse to dev_hdd0 and now you must found a decrypted game dump.

From PlayStation 3 developer deank (via pastebin.com/avcM5iuU) comes a revision as follows:

Download: TB ELF Dumper v2 (np_trp_prx.rar) / TB ELF Dumper v2 (Mirror)
[code]
// Author: Shadoxi
// Modified:

// Backup the original /dev_flash/sys/external/libsysutil_np_trophy.sprx to /dev_hdd0
// Replace /dev_blind/sys/external/libsysutil_np_trophy.sprx by this sprx


#include
#include

#include
#include

#include
#include
#include
#include

SYS_MODULE_INFO (sceNpTrophyhook, 0, 1, 0 );
SYS_MODULE_START( _start );
SYS_MODULE_STOP ( _stop );

SYS_LIB_DECLARE( sceNpTrophyhook, SYS_LIB_AUTO_EXPORT | SYS_LIB_WEAK_IMPORT );
SYS_LIB_EXPORT ( loader_sprx, sceNpTrophyhook );

int _start(void);
int _stop(void);
void DumpELF_Payload(void);
void loader_sprx(const char* PATH_PRX);

static void write_message (char const * message)
{
unsigned int write_length;
char const * end;
for (end = message; *end != '\0'; ++end);
sys_tty_write(SYS_TTYP_PPU_STDERR, message,end - message, &write_length);
}

void DumpELF_Payload(void)
{
write_message("Dumping ELF from RAM...\n");
int fd;
uint64_t nread;
uint64_t ptr= 0x00010000ULL; //ELF offset in RAM;
uint64_t sizeelf = 35*1024*1024; //Need a way to get size of ELF

char dump_path[30]="/dev_hdd0/RAMDUMP-00.BIN";
for(uint8_t i=0; i

#845 - niwakun - 139w ago
niwakun's Avatar
the thing here is that they didn't tell anything about the dongle itself, maybe they already pawned the dongle's security chip (ATMEL that is) and they didn't tell it publicly so once TB released something new (security or algo or something), DUPLEX, N0DRM or whatever can do the same to piss off the TB makers again and again.

As always, if TB makers decided to do it all over again with new hardware to support their new security system, a lot of existing TB users will be pissed off for sure.

#844 - Tidusnake666 - 139w ago
Tidusnake666's Avatar
It seems to me so. They'll pull out new TB CFW v3, new dongle payload, change DRM algo so all new games will still require TB.

They won't quit the scene so easily.

#843 - roeykarou - 139w ago
roeykarou's Avatar
friends, i don't understand. is it the END for TB, or they going to upgrade the cracking (lets say, i don't know to play a 4.2V games) and come back again to the scene?

i'm very confused on what happened to them and why they are very quiet...

 











Advertising - Affiliates - Contact Us - PS4 Downloads - PS4 Forums - Privacy Statement - Site Rules - Top - © 2015 PlayStation 4 News