PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!

Home PS4 News - Latest PlayStation 4 and PS3 News

143w ago - Following up on the previous update, today I am releasing my True Blue USB dongle PS3 ELF dumper which works with any PlayStation 3 Firmware greater than 3.56 to dump the encrypted TB EBOOT / ELF files once they are loaded.

Download: True Blue USB Dongle PS3 ELF Dumper / True Blue USB Dongle PS3 ELF Dumper (Mirror) / True Blue USB Dongle PS3 ELF Dumper (Mirror #2) / True Blue USB Dongle PS3 ELF Dumper (Mirror #3) / True Blue USB Dongle PS3 ELF Dumper (Mirror #4) / True Blue USB Dongle PS3 ELF Dumper (Mirror #5) / True Blue USB Dongle PS3 ELF Dumper (Mirror #6) / True Blue USB Dongle PS3 ELF Dumper Source Code / True Blue USB Dongle PS3 ELF Dumper Source Code (Mirror) / UTEBOOT (DUMPEDBOOT.bin and DUMPEDBOOT1.bin) by arnes_king / Mass Effect 3 BLUS30853 RAMDUMP by gibson25 / TB ELF Dumper v2 (np_trp_prx.rar) / TB ELF Dumper v2 (Mirror) / DUMPEDBOOT PoC by mellss

Tested on:

  • Original 355 -> ok
  • True Blue CFW v2 -> ok
  • ...

There are some bugs (size of dump ...) but it works. It's ELF dumper from memory and it work with True Blue cfw v2 and any 3.55 firmware because it doesn't use lv2 peek/poke.

Warning: It will not brick your ps3. But I am not responsible for any damage.

HOWTO:

  • Enable dev_blind with multiman
  • copy libsysutil_np_trophy.sprx from /dev_blind/sys/external/external to dev_hdd0/ and rename it "orignal_libsysutil_np_trophy.sprx"
  • copy my modified "libsysutil_np_trophy.sprx" to /dev_blind/sys/external/
  • load a True blue game from multiman
  • exit multiman
  • run your game
  • wait few minutes (if you get black screen after 3 minutes reboot ps3)
  • exit game
  • go to ftp
  • in dev_hdd0/ there are your decrypted DUMPEDBOOT.bin
  • copy and rename it with another name.

Howto uninstall patch - Two ways:

  • You could uninstall this patch by replacing modified libsysutil_np_trophy.sprx by orginal libsysutil_np_trophy.sprx
  • Or update in recovery mode

Thanks to: Ps3dev

Brief Guide:

1 - Install TB ELF Dumper first as stated in its readme file.
2 - Start Multiman, it will make a dump of multiman eboots, so you must delete it first by browsing to dev_hdd0 then delete all DUMPEDEBOOT.BIN files you found there.
3 - Back to multiman game selection then select any TB game then launch it.
4 - Start the game from XMB then wait for some times until game start.
5 - Exit game now then start multiman again then browse to dev_hdd0 and now you must found a decrypted game dump.

From PlayStation 3 developer deank (via pastebin.com/avcM5iuU) comes a revision as follows:

Download: TB ELF Dumper v2 (np_trp_prx.rar) / TB ELF Dumper v2 (Mirror)

[Register or Login to view code]

Changed:

  • Doesn't stop dumping when it reaches embedded ELF
  • Dumps 35MB of RAM in one write call (so it takes ~1 second)
  • Dumps are saved in /dev_hdd0/RAMDUMP-##.BIN where ## is from 00 to 99 for 100 sequential dumps
  • Doesn't really require the original sprx, since loading never succeeds anyway
  • Tested: dumps mM, Beyond Good&Evil HD PSN...
  • Rebuilding the original 'elf' takes few minutes if you know what you're doing

Finally, from mellss: I tested shadoxi patch, in ofw 3.55 dex and 3.55 cfw it work fine (but like he said some buggy with size of dump). And also let him time to dump all memory!!! (it take for me around ~10 - 20 min !!!)

Proof Of Concept:


I make a fself EBOOT.bin (4.11 dex) which load reencrypted (flself) shadoxi patch and YES his patch dump my eboot and also some 4.11 dex lib sprx !!! So if someone can run shadoxi or deank patch when a game is running we can get decrypted 4.xx EBOOT.

I think TB team load the decrypted eboot to another offset in memory, that's why some of people get ps3 crash when TB was plugged. But, We can get this new offset by editing shadoxi exploit and print the address of a variable (stack address) to get the new one.


True Blue USB Dongle PS3 ELF Dumper and Source Code Surfaces

True Blue USB Dongle PS3 ELF Dumper and Source Code Surfaces

Follow us on Twitter, Facebook and drop by the PS3 Hacks and PS3 CFW forums for the latest PlayStation 3 scene and PS4 Hacks & JailBreak updates with PlayStation 4 homebrew PS4 Downloads.




#822 - ZerotakerZX - 145w ago
ZerotakerZX's Avatar
Hehe, right. Use DEX you lazy bum.

#821 - lolong - 145w ago
lolong's Avatar
well it is TRUE, DUPLEX CRACKS DRM True Blue, then DUPLEX should know how to make eboot.bin with DRM for CFW 3.55 True Blue.

So, I challenge DUPLEX to mod EBOOT.bin SLEEPING DOGS run and play on CFW 3.55 with dongle True Blue.

#820 - elser1 - 145w ago
elser1's Avatar
holy sig. thats great news for the scene. applause to duplex.

gotta say this has made me so happy. i hope these fools don't sell one more drm infected p.o.s dongle.

i hope its made public how to do it. great news everyone!

#819 - cfwprophet - 145w ago
cfwprophet's Avatar
Siggy12 Convert to a Dex and use the update to make the fresh new released game work. And if there is no update then we need to dump it out of ram with coredump function.

utar oO The Coredump function is a embended system of the debug FW and get handled of liblv2dbg. The send signal call aka send_signal_to_coredump_handler() and the trigger function are always running and CAN NOT be deactivated.

This have nothing to do with any custom syscall. Please download a SDK, Install it and read the documentation about the Core Dump function.

#818 - PS4 News - 145w ago
PS4 News's Avatar
Here is a list of the TB releases for those who need to remove the dongle patched games and overwrite them with the PS3 scene release (Duplex, NRP, etc) fixes as they become available: http://www.ps4news.com/subdomain.php?pagename=nfo&search=_TB_

[Register or Login to view code]


#817 - utar - 145w ago
utar's Avatar
In none technical language I assume you mean that you do a memory dump once the eboot has been decrypted. How does this work with post 3.55 firmware? Wouldn't you need to have level 1 or 2 peek and poke access to trigger the exception and core dump which we don't have?

#816 - Siggy12 - 145w ago
Siggy12's Avatar
All right !!! this is the problem they beat who know to patch the games for 3.55 the problem now is... what we are going to do for new games that don't have a TB PATCH ?

#815 - cfwprophet - 145w ago
cfwprophet's Avatar
Yea sure. Whooohoo super team duplex. Do you guys really think that duplex discovered this the last 2 weeks ? Is it not suspect that they release after TrueBlue was already killed with Cex2Dex release ?

I say it now for the last time: There is NO fself for new games !! TrueBlue use the CoreDump function and a RSX exception to dump the games like i told the scene for over a half year.

I also showed some guys how to use the coredump function and how to trigger a exception but it seems like the average user do not listen or don't understand how to use but still putting teams like trueblue or duplex into heaven.

I go back underground... have fun.

#814 - technodon - 145w ago
technodon's Avatar
Excellent Work, Top Dog! Duplex. i'm still interested to know how true blue actually got fself eboots to run on retail firmware.

#813 - Youkia - 145w ago
Youkia's Avatar
I want to request something for most of the japanime guys and people who LOVE Dragonball Z Please do DragonballZ Ultimate Tenkaichi or BLUS-30823