GeoHot Releases dePKG - PS3 Firmware Package Decrypter

[talruum]

is it possible to depkg firmware 3.50 or 3.55 and use it with JaicraB USB Firmware Loader v0.3?

if yes, we can keep 3.41 jailbreak firmware and use updated firmware with USb.

if no, i think I have to wait a little time

Don't think so. As I read the slides/see the videos from failoverflow, the keys for lv1/lv2/apploader are different. So, no apploader keys yet (to decompress self's). Correct me if I'm wrong.

And, we don't know how to bypass the chain of trust yet.

We need to change the loaders, or bypass them. Just setting up 3.55 apploader on 3.41 doesn't work too, 'cause 3.55 requires every loader from 3.55 and so on.

We still need more info to come public

[rumblpak]

Well the patches are the changes to the firmware that we currently make to do the jailbreak for starters as well as any custom firmware changes that we would like such as a chain loader (changes to the bootloader) etc.

I'm basing that on the fact that I know how to program and taking code and piecing it together into a code abomination isn't exactly hard, what is difficult is making the code clean and bug free.

While I agree with you that about 80% of the people on the forums are sitting here going "yeah but will it play GT5," I am not one of them. Writing code such that it works like current ppf patches where you have a main pup as in the update file and then a list of changes in a file like a ppf is not difficult.

Where the difficultly comes in is when people want to add themes and features (not present already) to the firmware. IMO these should be installed separate from a main update file, ESPECIALLY for the dumbasses out there that will go "hur an update for my ps3 slim that will make it play ps2 games dur OMFG I SHOULD INSTALL THIS."

[talruum]

Hey fellows! Happy new year 2011 will be better to all of us!

Long time I don't play with C code... drinking an Erdinger here, and some other there, remembered old times coding this simple tool to extract files from CORE_OS_PACKAGE.pkg (after decoded with geohot tool, of course).

It's not hardcoded, so you can use it on every firmware version that's out. Attached the source code and a x86_64 dynamic compiled at CentOS 5.4.

Maybe the code is wrong, but until now, I assume that's ok. Let's play

Cheers!

[root@localhost 3.41-debug]# ./coreos_extract CORE_OS_PACKAGE.pkg.dec 
Number of files: 23
Extracting filename: creserved_0 with size: 262144 at position 1120
Extracting filename: sdk_version with size: 8 at position 263264
Extracting filename: lv1ldr with size: 125256 at position 263296
Extracting filename: lv2ldr with size: 94192 at position 388608
Extracting filename: isoldr with size: 77940 at position 482816
Extracting filename: appldr with size: 123476 at position 560768
Extracting filename: spu_pkg_rvk_verifier.self with size: 64204 at position 684244
Extracting filename: spu_token_processor.self with size: 23700 at position 748448
Extracting filename: spu_utoken_processor.self with size: 26064 at position 772148
Extracting filename: sc_iso.self with size: 86828 at position 798212
Extracting filename: aim_spu_module.self with size: 17560 at position 885040
Extracting filename: spp_verifier.self with size: 55280 at position 902600
Extracting filename: mc_iso_spu_module.self with size: 32908 at position 957880
Extracting filename: me_iso_spu_module.self with size: 35000 at position 990788
Extracting filename: sv_iso_spu_module.self with size: 49272 at position 1025788
Extracting filename: sb_iso_spu_module.self with size: 23984 at position 1075060
Extracting filename: default.spp with size: 8864 at position 1099044
Extracting filename: lv1.self with size: 1211888 at position 1107968
Extracting filename: lv0 with size: 255608 at position 2319872
Extracting filename: lv2_kernel.self with size: 1561552 at position 2575480
Extracting filename: eurus_fw.bin with size: 462740 at position 4137032
Extracting filename: emer_init.self with size: 511416 at position 4599772
Extracting filename: hdd_copy.self with size: 396648 at position 5111188
Done!
[root@localhost 3.41-debug]#

[zeromx]

The famous hacker waninkoko released a program called FwTool to encrypt PS3 Firmware package files.

From his twitter account: https://twitter.com/hackinblack/status/21002370037063680

FwTool source code pushed. Based on 'depkg' by geohot but with the ability to encrypt packages. Still needs some work. https://github.com/waninkoko/fwpkg

[PS3 News]

Added to the first post, and +Rep talruum and zeromx!

Also, from http://netkas.org/?p=584:

Guide: extracting dev_flash from firmware update.

With recent release of geohot’s depkg its now easy for everyone to extract content of dev_flash and dev_flash3 from ps3 update pup file.

get files first - ps3 pup unpacker, depkg

extract and compile depkg.c (linux/osx/windows+cygwin):

gcc ./depkg.c -o depkg -lz -lssl

then extract PS3UPDAT.PUP with pup unpacker, find File_7.tar in extracted folder, untar it to new folder, you will get a lot of pkgs there and dev_flash files.

enter dir with extracted files, copy compiled depkg to it and run this bash script:

for i in `ls dev_flash*`; do ./depkg $i $i.tar ; tar -xvf ./$i.tar ; rm $i.tar; done

after it you will get content of dev_flash and dev_flash3 of firmware you choosed.

[talruum]

I'm playing right now with CORE_OS.

The only files that differ from debug to retail are:

• default.spp
• lv1.self
• lv2_kernel.self

So, the loaders are identical (maybe the keys to decrypt everything too).

And the code from Waninkoko is still buggy I guess. When you crypt again, the filesize isn't the same. Try by yourselves to decrypt -> encrypt -> decrypt -> encrypt, and you'll see that you cannot do it. I'll look at the code to see...

Btw, revived my ps3 with 2.20hybrid + infectus from oldddd days. Let's try to bring it to 3.41 alltime debug/test

[evilsperm]

Waninkoko's fwpkg encrypter/decrypter compiled:

Someone might want to explain on how to repack the CoreOS after extraction.

Anyway I'm going out for a bit to party have fun everyone Happy New Year!

[Luckluka]

Repack PUPs using gPUP (found on this forums)

And a word of warning: Do not flash any customized firmware that you create

I tried to do a 3.41/3.50 hybrid, replaces CORE_OS_PACKAGE.pkg of 3.50 with the 3.41 one, repacked it and flashed it through service mode...

Guess what...: YLOD

[BwE]

When the console displays the yellow light, its indicating a hardware problem. If there was a software issue youd have the red screen error or you would have a flashing red light.

I thought you of all people would know this. You simply had bad luck.

Edit: I'd love to try your pup

[TheBlack]

Don't think so. As I read the slides/see the videos from failoverflow, the keys for lv1/lv2/apploader are different. So, no apploader keys yet (to decompress self's). Correct me if I'm wrong.

And, we don't know how to bypass the chain of trust yet.

We need to change the loaders, or bypass them. Just setting up 3.55 apploader on 3.41 doesn't work too, 'cause 3.55 requires every loader from 3.55 and so on.

We still need more info to come public

thank you for the explanation.