Install Debug Firmware on a Retail PS3 system

[PS3 News]

Ya, that was answered earlier... specifically, port 1000 is open but you can't connect to it.

http://www.ps3news.com/PlayStation3/...il-ps3-system/

Currently a few of the PS3 Devs are waiting on a guy to cave and pass along something that will (hopefully) make it feasible... however, it's primarily "theory" until then so I wouldn't hold my breath.

[young blade]

Originally Posted by PS3News port 1000 is open but you can't connect to it.

sorry for the noob question but what is this port 1000 for??

[PS3 News]

Quite simply it's for linking the PS3 to other equipment in order to analyze data. Check here for more on what mrbeans was talking about: http://www.snsys.com/ps3/prodg.asp

[coder24]

hopefully you guys can get it to work. I might be able to help as i do own a ps3 test

[PS3 News]

Originally Posted by coder24 hopefully you guys can get it to work. I might be able to help as i do own a ps3 test

Nice to hear, if you have any experience feel free to message CJPC on IRC EFnet #ps3news. After a brief chat, he will invite you into the Dev room to mingle with the others.

[Takavach]

First, begin to update the retail PS3 with DEV 2.15 f/w. Next, turn off the PS3 without pressing the PS button on the controller and unplug the HDD. Insert another HDD (of same size) and begin the install of f/w 2.35. Do not press the PS button. Then, wire up the debug HDD to pc and with a Hex Editor replace '2.15' with '2.35' and save. (Maybe when the f/w is copied to the HDD it is decrypted??) Now, switch the HDDs in the PS3 and resume the installation.

I cannot test this myself as i don't have two HDDs and my PS3 is running 2.35 f/w. But, perhaps someone would bewilling to try this method and see if there are any results...

Kindly translated and edited by Wicked Insanity

[mrbeans]

Ahh, I've never bothered to check what port it connected through. I suspect there is no app running listening to port 1000, and something just opened up to port in the firewall or a lv2 equiv of inetd (which attempts to spawn a missing self.) Pure speculation of course.

I'm going to assume it didn't open up the system configuration webpage found on the full devkits (and possibly the testkits)?

Thanks for the info.

[CJPC]

Originally Posted by mrbeans Ahh, I've never bothered to check what port it connected through. I suspect there is no app running listening to port 1000, and something just opened up to port in the firewall or a lv2 equiv of inetd (which attempts to spawn a missing self.) Pure speculation of course. I'm going to assume it didn't open up the system configuration webpage found on the full devkits (and possibly the testkits)? Thanks for the info.

Your 100% on. We believe that is the exact problem as well.

In regards to the system config page, it is only on the devkits (read TOOL's), since the TEST's lack the Communication sub-board! So, no, it did not open it (because the HW just isn't there)

[mrbeans]

Ah I have no experience with TESTs.

I'd say that it would be interesting to use something like the warhawk exploit to place our own elf to be connected with port 1000, however I'm extremely confident that the hybrid installs will still want it to be a real self... Although copying the real elf from a true debug firmware via this method may actually be signed enough to run and make the targetmanager work.

I suppose none of the older write anywhere exploits would let you write to the needed dir. Could be interesting to try... Maybe something with the infectus...

[Herogen]

The last post about the warhawk-exploit brings me to an idea.... as far as i remember this exploit allowed us to install the warhawk beta by faking it as the installation of f@h.... how about trying to create pkg's of the missing files that won't install on the hybrids and them installing them using the f@h-method? is anybody with a full-debug-console able to gather these files and build a package from that?

what are your opinions about that?

PS: i downloaded the PUP-unpacker, but since i use osx and the lack of the malloc.h i cant recompile it. does anybody have a binary for osx?