igor242
-
Content Count
85 -
Joined
-
Last visited
-
Days Won
4
Posts posted by igor242
-
-
After Testing with some bricked Slim consoles ( from updating to CFW4.21 ) with different friends and testers around the world,
I can confirm that Bricked consoles can be recovered back to CFW3.55 even if you didn't have a NOR Dump/Backup .
Requirements are:
1- a Hardware Flasher so you can read/write to the PS3 NOR flash
2- A Dongle with PSgrade payload (any old jailbreak dongle + PSGrade hex will do) used to Enter Factory Service Mode (FSM)
3- Rogero CEX3.55 v3.7 PUP
Recovery Procedure :
1- Dump the current NOR Flash of the bricked PS3 at least 3 times using a hardware flasher (Progskeet / E3 / TEENSY++)
2- Verify that it is properly dumped and you have a valid dump ready to be patched with the downgrade patches.
3- Patch the dump using Rogero PS3 NOR Auto Patcher or any other Program available.
3- Flash the Patched Dump back into the PS3 NOR using the Hardware flasher.
4- From this point you can continue as a normal Downgrade Procedure by entering Factory Service Mode using the dongle and Flashing Rogero CEX-3.55 v3.7 from the USB stick.
more info and details will be added to this post gradually as needed....
Source: http://www.tortuga-cove.com/forums/viewtopic.php?t=3654&p=9275#p9275
-
for all owners of PS3 consoles downgraded from 3.55+ using hardware flashers and Rogero_CFW_v3.x
To "Dehash the PS3" (Reset the syscon) and have the PS3 back to normal safer mode like any original ( non Downgraded ) PS3, here are the steps :
1- After completing the downgrade process and having Rogero CFW 3.x up and running, make sure you have the Blu-Ray drive attached or the QA Toggle package won't work.
2- Download the Rebug QA_Toggle package from here ---> toggle_qa.pkg
3- Put the "toggle_qa.pkg" on USB and Install it on the PS3.
4- Run the "Rebug Toggle QA" from XMB, the screen will go Black and you will see HDD Led activity then if all went fine you will hear one Beep and the PS3 will Restart back to XMB.
5- If you want to make sure QA flag was set, go to "Network Settings" then apply the following key combo (all at the same time):
L1 + L2 + L3 (press left stick) + R1 + R2 + dpad_down
You should see Edy Viewer, Debug Settings, and Install Package Files if done correctly.
6- Now that you have QA flag set, Turn Off your PS3 and Turn it back on but into "Recovery Menu"
This Step is very important, it have to be from "Recovery Menu" and not a normal Update from XMB or the PS3 will Brick.
Here is how to access it:
a. Turn off Playstation®3.
b. Turn it on and keep Holding The power button down; The system will turn on and turn off once again.
c. Once the System has been shutdown, Turn it on again and keep Holding The power button down (you will hear 1 beep first, keep holding) until you hear 2 consecutive beeps
d. When you hear the 2 beeps take finger off power button.
e. You will be prompted to plug in your controller via usb and then hit the PS button
f. The Recovery menu will pop up.
g. Last Option #6 is what you must use "System Update"
Alternatively you can simply use CondorStrike's Updater package to enter Recovery Menu directly from XMB without going through the boot sequences. --> Condor Updater v2.0
7- Now you must have any 3.55 OFW or CFW with original (non Patched) LV1 in your "USB:\PS3\UPDATE\PS3UPDAT.PUP", here's a link to 3.55-Kmeaw --> kmeaw355.PUP
8- Select the last option of the Recovery Menu --> System Update, then when prompted press and hold "Start+Select" for 5 seconds to start the update.
Once finished the PS3 will restart into XMB with the Syscon hashes reset back to 3.55 in both "ros0" and "ros1" and your PS3 is back like any original/non Downgraded PS3 that can use any CEX/DEX Fw without having to worry about disabling LV1 checks.
Source(Tortuga-Cove): http://www.tortuga-cove.com/forums/viewtopic.php?f=127&t=3638
-
.----==[22-10-2012]=======================================================----.
[_ As this was a group effort, we wouldn't normally have lost a word about it |
|ever, but as we're done with PS3 now anyways, we think it doesn't matter |
|anymore. Congratulations to the guy that leaked stuff, you, sir, are a 1337 |
|haxx0r, jk, you're an asshole. _]
| |
| Try this bytes... |
| - [erk=CA7A24EC38BDB45B98CCD7D363EA2AF0C326E65081E0630CB9AB2D215865878A] |
| - [riv=F9205F46F6021697E670F13DFA726212] |
| - [pub=A8FD6DB24532D094EFA08CB41C9A72287D905C6B27B42BE4AB925AAF4AFFF34D |
| 41EEB54DD128700D] |
| - [priv=001AD976FCDE86F5B8FF3E63EF3A7F94E861975BA3] |
| - [ctype=33] |
| ...and be amazed. |
| |
[_ People should know that crooked personalities are widespread in this so |
|called 'scene'. Some people try to achive something for fun together and make|
|the wrong decision to trust others and share their results with them, but ofc|
|there got to be the attention seeking fame wh*** that has to leak stuff to |
|feel a little bit better about him-/herself. _]
[_ Now the catch is that it works like this in every 'scene', just that in |
|others it usually doesn't come to light. _]
[_ The only sad thing is, that the others who worked on this won't get the |
|attention they deserve because they probably want to remain anonymous (also |
|they don't care about E-fame <3). _]
| |
[_ PS: This is neither about drama nor E-fame nor 'OMG WE HAZ BEEN FIRST', we |
|just thought you should know that we're disappointed in certain people. You |
|can be sure that if it wouldn't have been for this leak, this key would never|
|have seen the light of day, only the fear of our work being used by others to|
|make money out of it has forced us to release this now. _]
'----===========================================[- The Three Musketeers]==----'
-
The spanish developer BlaKCat release today a new version of his All In One (Nandpro/xebuild/build.py…) glitch/Jtag app : AutoGG, now in version 0.8
Here is the full changelog
- Dash 16197.
- Xebuild 1.05
- DashLaunch 3.03
- New way USB-Flasher to get Nand and Cpukey without LAN.
- Patched NandXell with new option to get Nand Data and Keys to USB. Lan Xell Debug Log without Com Monitor.
Credits
Xell Relodaded&LibXenon Team.
Xebuild Team.
c0z – DashLaunch
-
Following the recent efforts from psjailbreak.ru devs and other scene sites to allow CFW users to get Online again, 'drizzt' has decided to update 'fuckPsn' too!
Here's the full changelog and installation instructions for v1.0:
****Psn 1.0 by drizzt@ibeglab.org
Prerequisites
CA27.cer, dev_blind.pkg, ****Psn-v0.9.exe from here
OpenPS3FTP v1.3 or later, you can download 1.5 from here
ChangeLog
v1.0: Fix spoofing (Thanks flys out to BigFAN from psjailbreak.ru and Asure from ps3hax for the informations.)
v0.9: Add support for 4.21 spoofing
v0.8: Re-add support for firmwares older than 3.55
v0.7: Add support for 4.11 spoofing
v0.6: Use an empty consoleid. Warning: be sure to get my 0.6 version
v0.5: Add support for firmwares older than 3.55
v0.4: Don't use PS3DNS anymore
Installation
1. Install dev_blind.pkg and OpenPS3FTP on your PS3 (using FTP, external USB or what else)
2. Launch dev_blind and make it mount the flash
3. Open OpenPS3FTP
4. Connect via FTP to PS3 (using username root and password openbox)
5. Go to /dev_blind/data/cert
6. Rename CA27.cer to CA27.cer.bak
7. Put my CA27.cer as /dev_blind/data/cert/CA27.cer
8. Set the PS3's PRIMARY and SECONDARY DNS server to your PC's IP address
9. Reboot your PS3
10. Start ****Psn
11. Enjoy with PSN
Warnings
If you have followed the OLD guide you need to rename the original CA27.cer to CA27.cer.bak and (my) CA24.cer to CA27.cer and you have to restore the old CA24.cer, by renaming CA24.cer.bak to CA24.cer
This is needed since some games use the original CA24.cer
If you lost original cert, you can take it here
FAQs
Q: ****PSN does not start or prints "Address already in use" as error
A: Close anything that is using port 80 or 443, try also to close skype and to disable ICS if you are using it.
-
RndRandomizer AKA RnD release of this nice tool
check it out.REQUEST IDPS Generator – v1.0.0.0 – Rnd
v1.0.0.0:
-Initial Release
Features:
*Generate a request_idps file
*Get PerConsole Data (board ID, cid, ecid, kiban ID, ckp2_data, ckp_management_id)
Usage:
Just get your NAND/NOR dump and drop it in this application.
No more need for re-flashing the whole dump in order to convert EID.
Simply it makes it easier to use it with ObjectiveSuites-SetIdps and you dont have to gether it from Sony’s server.
Put request_idps.txt in Temp folder in ObjectiveSuites, to set your request_idps and you are done with flashing the new EID.
I’m not responsible for ANY DAMAGE it may cause!
USE AT YOUR OWN RISK!
P.S. If somebody has a script to get the EID with ObjectiveSuites, I would be very kind if you could let me know,
I will update the application.
Sincerely,
Ron
-
For german Kmeaw/Rebug/TB users
IcEmAn2012 has released a nice XMB MOD, compatible with all Custom Firmwares.
As its name suggests, XMB CFW MOD by IcEmAn2012, is a Custom Firmware MOD with many changes to the PS3 XMB, aimed mainly for german Kmeaw/Rebug/TB users.
Keep in mind that if you have the regular XMBM+, you'll need to remove it first before install this one.
Here are the Features for this one:
- Modded XMB Categories: Bilder | Hip-Hop | HD Video | Homebrew | Games | PlayStation | PlayStation Network | Install by raxxus
- Package Installer is under Install Categorie divided in 7 system folder:
- PS3 Hard Disk (intern) | Install Homebrew (Tools) | Install XMB BOOT PKG | Install PSN Content | Install PS1 PSN Content | Install PKG Patches/Updates | Install PKG Content by raxxus
- Package Installer have been translated by IcEmAn
- Debug settings have been translated by raxxus
- app/home/PS3_GAME/ –> Launch Game (Discless) by raxxus
- PlayStation PSN Category for PS1 games (installed pkg's are also displayed in the Games category) by raxxus
- Internet Browser is under PSN Category by raxxus
- Install Category modified for IcE-rX Media Manager (XMBM+) by raxxus
- HD Video Category integrated for TV Channel THX RazorX / by IcEmAn
- Network settings Info/Gamedata-utility Info and Memory Card-utility Info by IcEmAn
- Category for homebrew apps / tools (to be published by the folder "BCET00001")
- PS3 XMB Slim Theme THX FJTR / by IcEmAn
- animimated IcEmAn Boot Logo by Cr4zY95
- PS3 CFW GameBOOT by Cr4zY95
- Boot Sound by RazorX
- Kamo Wave Line by Glowball1
It's for german Kmeaw/Rebug/TB... user
And, here are its installation instructions:
1. Install any CFW (3.55) you like
2. Install XMB_CFW_MOD_v2.pkg
3. Activate dev_blind
4. Copy the content of: hdd0/game/XMBCFWMOD/USRDIR/dev_flash to "FLASH"
5. Copy the content of: hdd0/game/XMBCFWMOD/USRDIR/dev_hdd0 to "internal hard drive" by using a file manager (multiMAN) or FTP
6. Disable dev_blind and start the console again
Notes:
If an incorrect use of the flash memory, a brick-risk for the console! Under the category CB (PlayStation Category) can no longer be installed (CB is now 1p). UPDATE_2.2_(IcE-rX_Media_Manager) can now be installed on all CFW's, but not the normal XMBM + (must be cleared before).
-
It can play small homebrew apps
It isn't a full working PS3 emulator yet, but it's a really big step in the PS3 scene.
Breaking news today about the Playstation 3 emulator for PC.
Emulator rpcs3 is now more functional than ever before as it has now the ability of running small homebrew titles.
We still need to wait a lot to get a FULLY WORKING PS3 emulator, but this is a really big step in the PS3 scene, so enjoy!
About rpcs3 SVN r43:
rpcs3 SVN r43 is compiled. rpcs3 is an open source PlayStation 3 (PS3) emulator for the Microsoft Windows. Current versions can run only small homebrew for PS3. Developers are planning to make it to emulate PS3 on its speed in the near future.
rpcs3 purpose:
- Make PS3 developers easily test their apps and homebrews on PC without crashing their PS3 or moving their apps from PC to PS3.
- Just playing PS3 games on your PC and have fun! ( In the future )
r43 - rpcs3:
- Emulated more PPU / SPU instructions.
- Fixed some PPU syscalls.
- Fixed issue 4.
- Improved CompilerELF.
-
MAGIC333X has updated his KLicence Brute-force Tool, here is a quote of the changes:
Hi all!
I’ve just released version 1.1 of my tool.
Changes:
Version 1.1 (October 7, 2012)
- Keys stored as hex-strings in keydata file will now be found
- Added option to select search mode (see USAGE for directions)
- Flushing output of progress updates to allow for better integration
- Performance increase (~40%)
Hi,
Just released version 1.2 of my KLicence Brute-force Tool.
Changes:
Version 1.2 (October 7, 2012)
- Removed restriction on hex-string search mode
- (BugFix) Found hex-string is now displayed, instead of data at address
-
http://www.maxconsole.com/maxconsole/contents/RKLS00000014849/icon_xl.jpg
Aldo keeps updating his tools for the PS3
Aldostools has updated his 'Collection' of PS3 Tools, which now includes 20+ of them.
PS3 Tools Collection by famous PS3 developer aldostools, is a collection of applications for Windows with lots of functions for your PS3 games & console.
In the last few months, he has been actively developing the tools included on it, adding for example, new versions of BruteForce/SCETool
Decrypter, mmDM 02.02.00, PS3 Keys 1.2, PS3 Cheats Editor 2.1.0.2, PKG ContentID 1.6.0.3, etc.
Here's the full list off apps included:
PKG ContentID, ps3gen patcher, PS3 Game Integrity, PARAM.SFO editor, PS3 File Splitter, PS3RIP, PS3_DISC.SFB edit, PS3 PSARC GUI, BruteForce/SCETool Decrypter, PS3 Cheats Editor, PS3 Game Integrity, mmDM, mmTM_GUI, Create PS3_EXTRA, TXT to Links.xml, PS3 NET Server GUI, PS3 Keys, netmon and renam.
NOTES: Zip archive includes self-extracting RAR archive. All these tools are Win32 and require the VB5 runtime DLL.
-
Following up on his NoRSX PS3 v0.1.9 (96b8a31) update, today PlayStation 3 developer deroad has released an application dubbed Install Package Homebrew for PS3 CFW users with details below.
To quote: Hi everyone, since I'm working on PSChannel (I don't know when it will be finished), I had to build a few features for it (I will not tell which they are). so I written this simple homebrew to install one or more PKG without using the XMB option. this app is useful if you, for some reason, can't use that option.. it will create on the XMB a new icon that will allow you to install that pkg.
How to use it:
Place in the main directory of your USB a pkg (it can handle up to 100 pkgs, and the max size for each of them is 4GB).. then plug in the usb on the ps3 and run the app.
It will search the usb from /dev_usb000 to /dev_usb009, once found it will start it copy and create the right files to allows you to install it from the XMB without the option.
THIS APP WILL RESTART THE PS3 ONCE FINISHED. I hope that this app can be useful (maybe also someday).
-
The multiplatform DLNA-compliant UPnP Media Server.
More features for us to enjoy
SubJunk is back with another update, adding new features and updating both FFmpeg and Mplayer...
Universal Media Server gets updated to version 1.5.2.
Universal Media Server (UMS) by SubJunk, is a DLNA-compliant UPnP Media Server based on PS3 Media Server by shagrath. It is actually an evolution of the "SubJunk Build" of PS3MS.
Well, just a few weeks after v1.5.0, he's back with another version, this time adding "Video quality settings" for FFmpeg and AviSynth (and more...)
Here's the full changelog for v1.5.1:
General:
* FFmpeg and FFmpeg/AviSynth engines now use the "Video quality settings" from the "Common transcode settings" page
* Many improvements to the layout of settings
* Updated FFmpeg to 8bdba0b (20120914)
* Updated MPlayer and MEncoder for Windows to SB38, which:
- Enables more CPU optimisations (runs faster)
- Improves audio sync
- Tries to fix very occasional freezing issue
Languages:
* Updated all languages
Upgrade Notes:
For versions prior to 1.5.0:
It is recommended to delete your UMS.conf file prior to installing this version. For Windows users it is in ProgramData/UMS/.
For all versions:
It is recommended (but usually not necessary) to uninstall the older version before installing the new one.
Download Links for v1.5.1:
Universal Media Server - Windows
Universal Media Server - Linux
Soon after the above v1.5.1 release, UMS got updated to v1.5.2 with even new features and some fixes:
Changelog:
General:
- Temporarily rolled back MPlayer/MEncoder to SB37, which fixes DVD support
- Updated FFmpeg to SB2, which fixes seeking bugs
Plugin Installer:
- Added Description column
- Added "run as administrator" reminder for Windows 7 and Vista users
- Installation progress window is centered
- Disabled manual row-editing
- Customised the column widths so all text is visible
Languages:
- Removed deprecated part of Russian translation
Source(PS3Crunch)
-
Yet another neat update by RazorX.
This new version features a complete redesign, including the app themes, adds more movie links and PS3 xil!
The PS3Ultimate TV App by RazorX allows you to watch TV from your PlayStation 3.
Just a few days have passed since the release of v1.08, and he's already back with another update, this time featuring a more cleaner interface, PS3 xil for custom channels and more!
Here's the full changelog for v1.09:
Updated PS3Ultimate TV to v1.09:
With 1.09 Ive updated most of the app from the themes to the movie links and movies. I've also added a links section to tidy the main section up. Ive also added new content including ps3 xil for those who want to use it to add custom channels and tidy up the ps3's main XMB or if your CFW has removed them, then they should be available again. Ive also changed the update to a direct link but most of my time and effort has been focused on the movies section.
I decided to release this update a little sooner than I was going to, so remember I'm working on this everyday, so keep checking for updates but remember it can be a slow process and I'm working alone. So please be patient and if you have just installed this update remember to also download and install a theme so everything is up to date.
PS3Ultimate TV v1.09 Update.rar
-
patch_registory.tcl for MFW Builder brings alpha sort for games in the XMB!
cfwprpht has released a small TCL patch for PS3MFW Builder which allows alphabetic ordering of your games...
As you may know, the PS3 Modified Firmware Builder allows you to add more functionalities and patches to the CFW 3.55.
Now, 'cfwprpht' has released a TCL patch which allows you to sort your XMB homebrew and games sections alphabetically.
Also, more patches are coming from him, so stay tuned...
- Description: Patch Alphabetical sort Order
- Option –patch-alpha-sort: Alphabetical sort Order for Games in the XMB
- Type –patch-alpha-sort: boolean
More patches to that tcl are incoming. I will add the --patch-rape-sfo function which for now is a dirty patch and will rape the sfo's for neogeo and pcengine (X0+X4) so we can use it as our own sfo's and put some app's in own made XMB segments. For that i also will clean the network category to use it as homebrew category and merge net cat with psn cat together. So that next patch will be a big one.
-
Deank has updated multiMAN for CEX consoles, implementing the software CPU/GPU Temperature Sensor by 3141card.
It looks like PS3 Dev '3141card' has released a software CPU/GPU Temp Sensor (see its Tech here) as a standalone PKG. Obviously, this one allows you to view the internal temperatures of your PS3.
Now, Deank picked the code up and has implemented it into the new multiMAN v04.06.02 for CEX.
Here's the changelog for this version:
04.06.02
* Added option in "Settings" - "Show Temperature Data" in Clock area (Disable/Enable/Auto) (thanks to Mysis and 3141card_)
The new options:
- Auto: will cycle the two temps along with time
- Enable: Will display everything like the bottom image below
-
Nathan_r32_69 has released PUP decrypter and unpacker app for Windows. PUAD GUI brings various features such as:
- Unpacks PUP file
- Decrypts/Unpacks CORE_OS
- Decrypts/Unpacks Dev_flash
- Decrypts SELF files of CORE_OS
- Decrypts SELF files of Dev_flash
- Unpacks RCO file contents
- Decrypts index.dat
-
==========
04.06.00
* multiMAN celebrates 2 years. CONGRATULATIONS!
* Added support for 4.21CFW (CEX) (syscalls 6-10 required):
- "Standard" BD-Emulator option (sc36) (Hermes not supported yet)
- Direct Disc Access (LV1&LV2 patched for Storage Manager access)
- Raw access to optical media (PS1 backups & Showtime access to BD/DVD/CDs)
- BD-Movie Region Changer
- BD-Mirror for INT/EXT games
! Not fully tested with Red Power's 4.21CFW (Hermes payload used and syscall 1021 required)
-
Another great update has been publicized by aldostools. This time he released a new app, called PS3 Keys 1.0, and updated the BruteForce/SCETool Decrypter tool to version 2.0.2. All Downloads are available on his website aldostools.org
Today I updated the BruteForce 2.0.2 package again…
but this time the update is not related to any of the tools, but related to the ps3 keys (both .ps3 and scetool’s keys file).
Here is the background:
Yesterday I decided to recheck the .ps3 keys and realized that it was a bit difficult to edit/fix the keys using just an hex editor.
So I created this tool to review the keys and edit them with a little more ease.
I used the .ps3, datakeys and ps3devwiki Keys article for a three-way comparison.
And found some mistakes in scetool’s datakeys file and some missing keys in “.ps3″ and others keys were wrong.
Not to talk about all the mistakes in the ps3devwiki already discussed here some days ago.
So I did the best that I could do and fixed the files included in the updated archive of BruteForce 2.0.2
It would be great if some of the experts here could double check if all the keys that I updated are correct now or if there are still more mistakes…
-
My bug list so far:
-Trying to load another skin and rebooting freezes on a black screen and you have no choice to reinstall everything.
-Can't have 1 directory for different things eg:
USB0:/Games/ - For Xbox 360 games
USB0:/Games/ - For Xbox originals
Also, anyway to change the start screen? No offence but its ugly as fuck.
Your first error is caused by the fact that no compatible skins are out for it yet. your changing to incompatible skins.
The second error isnt right either, when you set the path to usb0:Games set scan type to automatic and it will pick up all launchable content in that folder.
-
Another lv2 Exploit has been published, this time from german dev KDSBest. He claims he did not get it to work on firmware 4.21, so he did it on 4.20. If you don’t know what lv2 is, you can read it up on the ps3devwiki.
Since @naehrwert posted an lv2 exploit I will do so too . The stack pointer points to lv2 and if we do a syscall, the syscall saves register to the stack HAHA. Btw. It just crashes the console for now, since I totaly overwrite dump the lv2 or some memory addresses I don’t know. Feel free to try around, adjust the address of the stackpointer and so on. If you managed to get the panic payload executed. Tell me!!! ^^
//compile: ppu-gcc kds2.c -o kds2.elf
//or: ppu-lv2-gcc kds2.c -o kds2.elf
register unsigned long long payloadHolder2 asm (“r21″);
register unsigned long long payloadHolder asm (“r20″);
register unsigned long long stackpointer asm (“r1″);
register unsigned long long counter asm (“r25″);
register unsigned long long bufferStackpointer asm (“r26″);
int __volatile__ main(int argc, const char* argv[])
{
// backup Stack pointer
bufferStackpointer = stackpointer;
payloadHolder = 0x3960024F3960024FUL;
payloadHolder2 = 0x4400000244000002UL;
// Incrementer
counter = 0×00;
// Play with that address till the panic is executed, I lack of time todo so
// add always 2 or 4 to it, i would try 4 or 8… bla bla you will get the idea
stackpointer = 0x8000000000000100UL;
doItAgain:
// KDSBest Payload
// Prepare for our Syscall
asm(“li %r0, 0×0″);
asm(“li %r3, 0×6″);
asm(“li %r4, 0×1″);
// li r11, 0x24F -> PANIC
asm(“mr %r22, %r20″);
asm(“mr %r23, %r20″);
asm(“mr %r24, %r20″);
asm(“mr %r27, %r20″);
asm(“mr %r28, %r20″);
asm(“mr %r29, %r20″);
asm(“mr %r30, %r20″);
asm(“mr %r31, %r20″);
// Stack Pointer = Build Address of LV2
stackpointer += counter;
// Syscall 0xA9
asm(“li %r11, 0xA9″);
asm(“scâ€);
counter += 0×04;
// We write sc
asm(“mr %r22, %r21″);
asm(“mr %r23, %r21″);
asm(“mr %r24, %r21″);
asm(“mr %r27, %r21″);
asm(“mr %r28, %r21″);
asm(“mr %r29, %r21″);
asm(“mr %r30, %r21″);
asm(“mr %r31, %r21″);
// Stack Pointer = Build Address of LV2
stackpointer += counter;
// Syscall 0xA9
asm(“li %r11, 0xA9″);
asm(“scâ€);
counter += 0×04;
if(counter < 0×1000000)
goto doItAgain;
stackpointer = bufferStackpointer;
return 0;
}
I didn’t managed to make it work on 4.21 so I just did on 4.20
-
Following up on his PS3 SCETool update and PS3 Dump_Rootkey code, today Sony PlayStation 3 hacker Naehrwert has posted some details on exploiting the PlayStation 3 lv2_kernel and has made available a sample 3.41 implementation below.
To quote from his blog: Exploiting (?) lv2
A long while ago KaKaRoTo pointed me to a stack overflow he found while reversing lv2_kernel. But there are two problems:
1. The vulnerability is in a protected syscall (the SELF calling it got to have the 0x40... control flags set). So you'd first need to find a suitable usermode exploit (don't ask us), that gives you code execution with the right privileges.
2. The payload data is copied to lv2 heap first and the function will do a free call on it before the payload has any chance to get executed. This might not sound like a problem but it looks like lv2′s heap implementation will overwrite the free'ed space with 0xABADCAFE and thus destroy the payload.
Here (pastie.org/4755699) is my sample implementation for 3.41 lv2_kernel (although the vulnerability should be present in all versions of lv2 up to the latest firmware), maybe someone of you will find a way to overcome problem (2.) and can get something nice out of it because right now it's only good to crash lv2.
The footer signature is still not checked upon npdrm self files execution as of 4.21./*
* lv2 sys_mount stack overflow
* Original finder: KaKaRoTo (thank you for pointing it out!)
* Note: all offsets/values/addrs in this source are 3.41 specific
*/
#include <stdio.h>
#include <ppu-types.h>
#include <ppu-lv2.h>
/*
unk2, unk3 is what we're going to use here.
lv2 will handle unk2, unk3 like this:
char *strlist[FIXED_SIZE]; //On stack.
for(i = 0; i < unk3; i++)
strlist = strdup_from_uspace(*unk2++);
*/
static s64 sys_mount(const char *dev /*r3*/, const char *fs /*r4*/, const char *path /*r5*/,
u64 unk0 /*r6*/, u64 wp /*r7*/, u64 unk1 /*r8*/, const char **unk2 /*r9*/, u64 unk3 /*r10*/)
{
lv2syscall8(837, (u64)dev, (u64)fs, (u64)path,
(u64)unk0, (u64)wp, (u64)unk1, (u64)unk2, (u64)unk3);
return_to_user_prog(s64);
}
//For testing.
static void patch_access_check()
{
//check_access @ 0x80000000000505D0
//li r3, 1 ; blr
lv2syscall2(7, 0x80000000000505D0ULL, 0x386000014E800020ULL);
printf("[*] DEBUG: access check patched.\n");
}
int main(int argc, const char **argv)
{
//Problem: The mount syscall needs the 0x40 ctrl flag (root) to be set.
//Solution: Find a usermode exploit in a SELF that has them set.
//Patch the ctrl flags check for testing.
patch_access_check();
//Nop.
char nop[] = "X";
//Payload.
char payload[] =
{
//Insert valid PPC code here (without 0x00 bytes)
//and hope lv2 heap 0x27 is executable and 0x04 aligned.
0x38, 0xE0, 0x7E, 0xF0, //li r7, 0x7EF0
0x38, 0xE7, 0x01, 0x10, //addi r7, r7, 0x110
0x78, 0xE7, 0x83, 0xE4, //sldi r7, r7, 16
0x78, 0xE7, 0x07, 0xC6, //sldi r7, r7, 32
0x60, 0xE7, 0x91, 0x34, //ori r7, r7, 0x9134
0x7C, 0xE9, 0x03, 0xA6, //mtctr r7 ; 0x8000000000009134 (sys_sm_shutdown)
0x38, 0x60, 0x02, 0x10, //li r3, 0x210
0x38, 0x63, 0xFF, 0xF0, //addi r3, r3, -0x10 ; 0x200 (reboot)
0x7C, 0x84, 0x22, 0x78, //xor r4, r4, r4 ; 0
0x7C, 0xA5, 0x2A, 0x78, //xor r5, r5, r5 ; 0
0x7C, 0xC6, 0x32, 0x78, //xor r6, r6, r6 ; 0
0x4E, 0x80, 0x04, 0x20, //bctr
//End of payload.
0x00
};
//List containing the entries.
//stack frame size is 0x1C0
//strlist = framptr + 0xE0
//remaining stack frame size is 0xE0 (28 * 8)
#define LIST_LENGTH (28 + 2 + 1)
const char *list[list_LENGTH] =
{
//-0xE0
//Overwrite stack with nop entries (0xE0 bytes).
nop, nop, nop, nop, nop, nop, nop, nop, //0x40
nop, nop, nop, nop, nop, nop, nop, nop, //0x80
nop, nop, nop, nop, nop, nop, nop, nop, //0xC0
nop, nop, nop, nop,
//0x00
//Fill 0x10 bytes to reach saved r0.
nop, nop,
//+0x10
//Overwrite saved r0 with a pointer to our payload.
payload
};
//Doit!
printf("[*] Taking the plunge...\n");
s64 res = sys_mount("FOO", "BAR", "XXX", 0, 0, 0, list, LIST_LENGTH);
printf("[*] Error: sys_mount returned (res = 0x%016lX).\n", (u64)res);
return 0;
}
Because kakaroto says something that doesn't make it true. Basically he found a check in 3.55 that was not even called and assumed they used it in 3.60+.
Of course they do whitelist npdrm now so even if the footer isn't checked you cannot run your own npdrm selfs signed with keyset lower than 0x0D making the whole debate rather pointless. Aditional checks are now performed on the actual file format as well such as the segment counter flag that needs to be set to 0x01 except for the very last segment.
-
Developer RazorX is back again with yet another update to his PS3Ultimate TV App. Added in this update is HFS HTTP File Server. This will allow you to copy files and stream video to your PS3. Also added are some new channels for you to enjoy! Take a look below for further details.
Update #5:
Added new channels
Added HFS (more info below)
Added/updated movies
Removed icons from this and future updates to prevent overwriting theme
Added "standard theme" so icons can be restored to normal
HFS Info:
HFS aka HFS HTTP File Server will give you the ability to copy files to
your ps3 and stream videos directly to your ps3 it also can be used for much more than this but this is what i use it for also with the modification
i have made you will be able to upload videos you have on your ps3 to
your pc.
i have set everything up for you it should be a simple matter of loading
HFS up and adding your files to it you will also need to create a Upload folder on your pc and drag it over onto HFS and right click the folder
and set it up as a upload directory so you can upload pictures and with
my mod videos from your ps3 to your pc.
ive set the HFS website up as localhost if this doesnt work change
localhost to your pc's ip address for example change localhost to 192.168.0.2 and everything should work perfectly to make it easier
for you to change the ip address ive set it up so it reads the website address from the root of your ps3's hdd so please put the hfs.xml
in the root of your ps3's hdd so basically it should be put in /dev_hdd0/
this will allow you to easily remember were it is if you need to change
the ip address.
here are the files:
HFS
HFS XML File
PS3Ultimate TV Video Bypass
the PS3Ultimate TV Video Bypass contains the dev_flash~vsh~resource~explore~xmb.zip which you install using multiman this will allow you to upload your videos from your ps3 to your pc.
-
Epic update guys. TEAM FSD never fails to impress
.gif)
-
1
-
-
andoma aka Andreas Öman has released the latest update to his test version of Showtime 4.0, this version is 4.1.99, here is a quote of the last few changes:
4.1.99
Add support for setting custom movie titles directly from the item popup menu
Fixes #1213
4.1.98
Add an action in settings->general to clear the entire metadb item table.
Safeguarded with a popup as it is a non-revocable action.
Fixes #1218
4.1.95
ps3: When seeking using L2/R2, rescale seek delta based on duration of feature
In principle this make it so that the user can always seek from begining
to end in ~2 seconds regardless of how long the currently playing media is.
showtime-4.1.99-gd3b4c40.pkg.rar
Rogero CEX-4.21 CFW v1.09 Free for All
in Homebrew
Posted
Download
Mirror
MD5: e777351e788a7eb4007a2280abca7fbd
Size : 192 MB (201,329,483 bytes)
Guys with FAT consoles Please stop Updating to v1.09 until I get some FAT consoles myself and do more testings.
For details about Updating from CFW4.21 v1.00 to CFW4.21 v1.09 please read the Update Guide below
For details about Recovering from v1.00 Brick please check this thread
----> Brick-Recovery Procedure from CFW4.21 back to CFW3.55
v1.09 Details and Changes
- Compatibility problem with some Slim models (CECH-25xx) is now fully fixed.
- XMB Icons problem from in-game PS button is now fixed.
- Loading games from App_home Icon is now fixed.
- Many other fixes from version 1.00 for a better performance and added stability.
- It was tested by hundreds of testers on all PS3 models (FAT & Slim) and no problems were encountered.
- It can run games signed with Keys up to version 4.21 without any Eboot/Sprx patching needed
- Games can be loaded from Disc Icon (with Original game in BD) and from app_home (Disc-less, but not all games).
- Current 3.55 homebrew applications can't be loaded on this CFW, applications must be re-signed properly for FW4.21.
ATTENTION:
1- This CFW doesn't have LV1 checks disabled and can't be installed on Downgraded PS3 consoles unless you have Dehashed/Reset Syscon Properly (if you're not sure about your PS3, Dehash it anyway to avoid any risk) Link ----> Dehashing Tutorial
2- Always make a NOR/Nand dump using multiMAN or memdump before installing any CFW to have a recovery backup in case of any bricks.
Having a valid NOR/Nand dump is an essential step before upgrading, because you will always have a way to recover (using hardware flashers) when you have a valid dump.
** A Hardware Flasher alone without a valid dump cannot fix your bricked PS3 **
3- The QA flag must be always Enabled on your PS3 for safer upgrading/downgrading operations. Link ----> toggle_qa.pkg
4- Always use the Recovery Menu while installing this CFW to avoid possible bricks (XMB update works, but Recovery Menu is safer).
6- Please Check the MD5 of the downloaded PUP file before installing any CFW to avoid possible bricks.
7- DO NOT HAVE DISC IN PS3 WHEN UPDATING FIRMWARES..As the PS3 will take the UPDATE from the DISC First.
8- You need to already be on 3.55 to install this. Installing from any firmware other than 3.55 will simply not work
- Downgrading back to 3.55 is always possible using the following steps :
- Download the 4.25 downgrader PUP ---> 4.25 Downgrader Size 176MB (184,595,263 bytes) MD5: 49d80e07fc1f5ca1b0840e02e94635db
- Rename the downloaded file to "PS3UPDAT.PUP" and put it on your USB in: "USBPS3UPDATEPS3UPDAT.PUP"
- While on Rogero CFW4.21, go to System Update from XMB and install the 4.25 downgrader CFW.
- Once installed, now put "Rogero CEX-3.55 CFW V3.7" on your USB in: "USBPS3UPDATEPS3UPDAT.PUP" ---> Rogero CEX-3.55 CFW V3.7.PUP
- Start the PS3 into Recovery Menu and install "Rogero CEX-3.55 CFW V3.7" (from Recovery Menu, this is important)
- Once the install is finished, you're now back on Rogero CFW3.55 v3.7 (from here it's better to dehash again before installing any other OFW/CFW 3.55)
- Updating from CFW4.21 v1.00 to the CFW4.21 v1.09 should be done using the following steps :
1- Proper Way ( CFW4.21 v1.00 --> CFW3.55 --> CFW4.21 v1.09 )
---- Downgrade back to ver3.55 using the guide above.
---- Once on Rogero CEX3.55 v3.7 you can update again from Recovery Menu into the new CFW4.21 v1.09
2- Alternative Way ( CFW4.21 v1.00 --> Recovery Menu --> CFW4.21 v1.09 )
---- You can try updating from CFW4.21 v1.00 to CFW4.21 v1.09 from Recovery Mode first.
---- If it didn't work, then you'll have to use the first Proper Way ( CFW4.21 v1.00 --> CFW3.55 --> CFW4.21 v1.09 )
Credits to eussNL and the PS3DevWiki for the valuable and always up-to-date source of information.
Credits to Deank for his continuous efforts on Multiman and many other PS3 tools/fixes.
Source(Tortuga-Cove)