PS3 NAND Dump Extractor released!

[einzwei]

Like I said earlier - I use those dumps released here. Also I use a windows version of program.

Here is what i do:
D:\>ps3nandex.exe samsungk9f1g08uoa_b_usb.bin samsungk9f1g08uoa_a.bin zzzout
and here is the output:
Tool by mainman, assisted by PS3News.com Developers
Start Interleaving
Interleaving done.
Start Loader function
nandfs_header FILES: num files 19 - unknown e0ff6f00
Press any key to continueFile: creserved_0 size: 262144 offset 0x000003a0
File: sdk_version size: 8 offset 0x000403a0
File: lv1ldr size: 146228 offset 0x00040400
File: lv2ldr size: 113204 offset 0x00063f80
File: isoldr size: 82292 offset 0x0007fa00
File: appldr size: 129368 offset 0x00093b80
File: default.spp size: 7456 offset 0x000b34d8
File: lv0 size: 291608 offset 0x000b5200
File: lv1.self size: 1449416 offset 0x000fc580
File: lv2_kernel.self size: 1546016 offset 0x0025e348
File: spu_pkg_rvk_verifier.self size: 107548 offset 0x003d7a68
File: spu_token_processor.self size: 46940 offset 0x003f1e84
File: sc_iso.self size: 142776 offset 0x003fd5e0
File: aim_spu_module.self size: 39528 offset 0x00420398
File: spp_verifier.self size: 61388 offset 0x00429e00
File: mc_iso_spu_module.self size: 61520 offset 0x00438dcc
File: me_iso_spu_module.self size: 71932 offset 0x00447e1c
File: sv_iso_spu_module.self size: 101560 offset 0x00459718
File: sb_iso_spu_module.self size: 52888 offset 0x004723d0

SDK Version: 150.000
+ (0x009403c0) dumped :creserved_0
+ (0x009803c0) dumped :sdk_version
+ (0x00980420) dumped :lv1ldr
+ (0x009a3fa0) dumped :lv2ldr
+ (0x009bfa20) dumped :isoldr
+ (0x009d3ba0) dumped :appldr
+ (0x009f34f8) dumped :default.spp
+ (0x009f5220) dumped :lv0
+ (0x00a3c5a0) dumped :lv1.self
+ (0x00b9e368) dumped :lv2_kernel.self
+ (0x00d17a88) dumped :spu_pkg_rvk_verifier.self
+ (0x00d31ea4) dumped :spu_token_processor.self
+ (0x00d3d600) dumped :sc_iso.self
+ (0x00d603b8) dumped :aim_spu_module.self
+ (0x00d69e20) dumped :spp_verifier.self
+ (0x00d78dec) dumped :mc_iso_spu_module.self
+ (0x00d87e3c) dumped :me_iso_spu_module.self
+ (0x00d99738) dumped :sv_iso_spu_module.self
+ (0x00db23f0) dumped :sb_iso_spu_module.self

[DaDemon]

Hey all, I've been looking into some things going on with my Ps3 lately and have found some weird crashes happening on my ps3. Don't worry not here to complain.

I'm here to offer my Playstation up for running code and such. I've been on the IRC channels for a few months and have talked to some of the scene members and such and have been talking and am currently with a group just running different things on the playstation trying to find some little things that make the playstation tick.

If anyone has anything they want me to try out just let me know because I'm doing stuff by my self currently trying to learn as much as i can and if anyone wants me to try something out let me know.

[einzwei]

Ha ha, I see now :^) There is a comment in source file:
"until now, the correct file extracted are:

+ (0x009403c0) dumped :creserved_0

+ (0x009803c0) dumped :sdk_version

+ (0x00980420) dumped :lv1ldr

+ (0x009a3fa0) dumped :lv2ldr


maybe "+ (0x009bfa20) dumped :isoldr" is 'trunked'


others are not valid because they aren't stored sequencially

from my hardcoded FILESDATA_OFFSET.

To guess where they are now we need more forensics work."

So, we have to figure out correct offsets ourselves! That's an interesting thing to accomplish! Besides, there is a chance to understand something about why there are some files at (seemingly) correct places and why there are others

[einzwei]

at offset 03F80010 in merged NAND file I found this: 000000000FACE0FF00000000DEADBEEF ---- FACE0FF and DEADBEEF constants.

What is it? is it some mark leaved by owner of dumped PS3? (securing identifiable personal data presumably?) or is it some constants leaved by $ony developers?

Please, clear this question in order not to give a false leads to people who makes research

[gladiac]

at offset 03F80010 in merged NAND file I found this: 000000000FACE0FF00000000DEADBEEF ---- FACE0FF and DEADBEEF constants.

What is it? is it some mark leaved by owner of dumped PS3? (securing identifiable personal data presumably?) or is it some constants leaved by $ony developers?

Please, clear this question in order not to give a false leads to people who makes research

lol, very nice find . I think it looks the same on my machine as an your's (but it does not look bad to me) -> That is what I did:

gladiac@savvy:~/Downloads/ps3nandex/PS3_NAND_Dump_Extractor$ ./nandextract ../nand_dump/samsungk9f1g08uoa_b_usb.bin ../nand_dump/samsungk9f1g08uoa_a.bin out
Tool by mainman, assisted by PS3News.com Developers
Start Interleaving
Output file is present on filesystem.. skipping interleave
Interleaving done.
Start Loader function
nandfs_header FILES: num files 19 - unknown e0ff6f00
Press any key to continue
File: creserved_0 size: 262144 offset 0x000003a0
File: sdk_version size: 8 offset 0x000403a0
File: lv1ldr size: 146228 offset 0x00040400
File: lv2ldr size: 113204 offset 0x00063f80
File: isoldr size: 82292 offset 0x0007fa00
File: appldr size: 129368 offset 0x00093b80
File: default.spp size: 7456 offset 0x000b34d8
File: lv0 size: 291608 offset 0x000b5200
File: lv1.self size: 1449416 offset 0x000fc580
File: lv2_kernel.self size: 1546016 offset 0x0025e348
File: spu_pkg_rvk_verifier.self size: 107548 offset 0x003d7a68
File: spu_token_processor.self size: 46940 offset 0x003f1e84
File: sc_iso.self size: 142776 offset 0x003fd5e0
File: aim_spu_module.self size: 39528 offset 0x00420398
File: spp_verifier.self size: 61388 offset 0x00429e00
File: mc_iso_spu_module.self size: 61520 offset 0x00438dcc
File: me_iso_spu_module.self size: 71932 offset 0x00447e1c
File: sv_iso_spu_module.self size: 101560 offset 0x00459718
File: sb_iso_spu_module.self size: 52888 offset 0x004723d0

SDK Version: 150.000
+ (0x009403c0) dumped :creserved_0
+ (0x009803c0) dumped :sdk_version
+ (0x00980420) dumped :lv1ldr
+ (0x009a3fa0) dumped :lv2ldr
+ (0x009bfa20) dumped :isoldr
+ (0x009d3ba0) dumped :appldr
+ (0x009f34f8) dumped :default.spp
+ (0x009f5220) dumped :lv0
+ (0x00a3c5a0) dumped :lv1.self
+ (0x00b9e368) dumped :lv2_kernel.self
+ (0x00d17a88) dumped :spu_pkg_rvk_verifier.self
+ (0x00d31ea4) dumped :spu_token_processor.self
+ (0x00d3d600) dumped :sc_iso.self
+ (0x00d603b8) dumped :aim_spu_module.self
+ (0x00d69e20) dumped :spp_verifier.self
+ (0x00d78dec) dumped :mc_iso_spu_module.self
+ (0x00d87e3c) dumped :me_iso_spu_module.self
+ (0x00d99738) dumped :sv_iso_spu_module.self
+ (0x00db23f0) dumped :sb_iso_spu_module.self

And this is what I got:

gladiac@savvy:~/Downloads/ps3nandex/PS3_NAND_Dump_Extractor/PS3Nand-150.000$ ls -la
total 4704
drwxr-xr-x 2 gladiac gladiac    4096 2008-01-01 14:34 .
drwxr-xr-x 3 gladiac gladiac    4096 2008-01-01 14:34 ..
-rw-r--r-- 1 gladiac gladiac   39528 2008-01-01 14:34 aim_spu_module.self
-rw-r--r-- 1 gladiac gladiac  129368 2008-01-01 14:34 appldr
-rw-r--r-- 1 gladiac gladiac  262144 2008-01-01 14:34 creserved_0
-rw-r--r-- 1 gladiac gladiac    7456 2008-01-01 14:34 default.spp
-rw-r--r-- 1 gladiac gladiac   82292 2008-01-01 14:34 isoldr
-rw-r--r-- 1 gladiac gladiac  291608 2008-01-01 14:34 lv0
-rw-r--r-- 1 gladiac gladiac  146228 2008-01-01 14:34 lv1ldr
-rw-r--r-- 1 gladiac gladiac 1449416 2008-01-01 14:34 lv1.self
-rw-r--r-- 1 gladiac gladiac 1546016 2008-01-01 14:34 lv2_kernel.self
-rw-r--r-- 1 gladiac gladiac  113204 2008-01-01 14:34 lv2ldr
-rw-r--r-- 1 gladiac gladiac   61520 2008-01-01 14:34 mc_iso_spu_module.self
-rw-r--r-- 1 gladiac gladiac   71932 2008-01-01 14:34 me_iso_spu_module.self
-rw-r--r-- 1 gladiac gladiac   52888 2008-01-01 14:34 sb_iso_spu_module.self
-rw-r--r-- 1 gladiac gladiac  142776 2008-01-01 14:34 sc_iso.self
-rw-r--r-- 1 gladiac gladiac       8 2008-01-01 14:34 sdk_version
-rw-r--r-- 1 gladiac gladiac   61388 2008-01-01 14:34 spp_verifier.self
-rw-r--r-- 1 gladiac gladiac  107548 2008-01-01 14:34 spu_pkg_rvk_verifier.self
-rw-r--r-- 1 gladiac gladiac   46940 2008-01-01 14:34 spu_token_processor.self
-rw-r--r-- 1 gladiac gladiac  101560 2008-01-01 14:34 sv_iso_spu_module.self

creserved_0 (filled up with FF)
isoldr (SCE in header)
lv1ldr (SCE in header)
lv1.self (filled up with FF until 0x83A40 followed by 00 until 0xC3A40 again followed by FF until 0x103A60 followed by crap)
lv2ldr (SCE in header)
sdk_version (has the version information of the dump)

All the .self files seem to be encrypted or something. So far, this looks good to me, but I'm not a professional so I can also be wrong.

cheers

[einzwei]

lol, very nice find . I think it looks the same on my machine as an your's (but it does not look bad to me) -> That is what I did:

What do you mean by that? Have you dumped your own NAND? or did you download it from the internet?

[CJPC]

at offset 03F80010 in merged NAND file I found this: 000000000FACE0FF00000000DEADBEEF ---- FACE0FF and DEADBEEF constants.

What is it? is it some mark leaved by owner of dumped PS3? (securing identifiable personal data presumably?) or is it some constants leaved by $ony developers?

Please, clear this question in order not to give a false leads to people who makes research

Its a marker, not put there by us, but by Sony. It was there in our original dumps, we think its some sort of flag to mark the start of the data below it. However at the moment it is just a hypothesis.

Also, yes some of those files are encrypted (even more than a SELF), makes it a bit more secure!

[ggparallel]

Its a marker, not put there by us, but by Sony. It was there in our original dumps, we think its some sort of flag to mark the start of the data below it. However at the moment it is just a hypothesis.

Also, yes some of those files are encrypted (even more than a SELF), makes it a bit more secure!

It's also a fixed position in different dumps , and few after you have the FS descriptor and the files ( relocated ). As CJPC told files are encrypted on NAND so don't expect to find ( apart few parts ) clear text or a lot of strings.

My iphotesys , ad speculation , is that PS3 search for that fixed address during the boot process , it is still not clear to me if the code loaded during the ringbus configuration on cell resides on NAND or on another chip ( the toshiba thing. ) and at which stage this fixed address is used.