Latest PS3 News Forum Updates

**PS3 News** · 05-10-2012

The True Blue PS3 JB2 v2.62 update is now available with the changes outlined below, as follows:

Download: http://www.truebluejb2.com/downloads/TrueBlueUpdate-2.62.zip / http://ex-scene.com/jb2_2.6/TrueBlueUpdate-2.62.zip (Mirror)

10 - 5 – 2012

True Blue dongle firmware v2.62 has been released.

Changes include:

Fixed a major game compatibility issue which will allow the release of several popular, previously incompatible titles
Improved system stability

Recently, EBOOT patches have slowed due to a compatibility issue which prevented recent games from running on 3.55 CFW. This issue has been resolved as of this firmware release, thus we strongly recommend that everyone update their True Blue dongles as soon as possible in anticipation of the upcoming batch of releases.

In related news, Corwin75 has updated True Blue Patch Viewer to V2.0.3 followed by V2.0.5 with the changes outlined below.

Download: True Blue Patch Viewer to V2.0.3

Rough translation from games-hack.fr/index.php?threads/6561/:

About True Blue Patch Viewer V2.0.3:

Here is a brief explanation on how to use the True Blue Patch Viewer 2.0.3:

Download the True Blue Patch Viewer and then start (If you just want to download the patch on your PC tutorial is not for you)
Connect your PS3 CFW then link to your PC Connection Sharing
Then launch your FTP server then connect to Anonymous
Then choose "PS3" from the drop down
On the True Blue patch viewer enter the IP of your PS3 as: 192.168.x.xx
Then choose if you want to transfer to your external hard drive or internal

Features 2.0.3:

Download limit removed
Download the True Blue CFW
Choice ranking order of the patches
Ability to search a patch directly from the software
Send and extraction patches directly on the PS3 in the game folder (Compatible with internal & external hard drive) BETA
Simplified extraction when extracting on PC
Visualization of the region of the patch when selected
Automatic Update
Server Status

Features 2.0.5:

Fixes a minor issue.

Download: True Blue Patch Viewer to V2.0.5

True Blue Payload v2.62

Download: True Blue Payload v2.62

Payload (2.62)

located in unself'ed eboot.bin @ offset:

Code:

  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
  00000000  E0 AE 1B 14 9D 24 05 8A D0 BB 65 D8 7F CC 1C 24  à®...$.ŠÐ»eØ.Ì.$
    ...
  0005E7F0  99 0A 4C 65 2A CE DE D6 0D C8 D2 73 FC B3 85 E2  ™.Le*ÎÞÖ.ÈÒsü³…â

payload_2.62.bin (378 KB): http://www.ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.62/payload_2.62.bin

Code:

SHA1: C5D37456FD5E59CFB648C82BBBE3FD95875E7C49 // 
MD5: 870C58F2CEC6BDB0ACF43EDD459ECD1C // 
CRC32: 35B2B2CA // 
CRC16: E3DE

**PS3 News** · 05-21-2012

Today True Blue has issued another warning about a TB PS3 dongle clone, as follows:

21 - 5 – 2012

A new clone has appeared (item.taobao.com/item.htm?id=13491601183) using a very similar external housing to that of True Blue. However, after removing the clone PCB from its exterior casing it becomes evident that there are a number of major differences:

Actel used is A3P125 instead of larger A3P250 used on True Blue.
Clone uses a cheap MCU and cheap dip type crystal in addition to cheaper Actel instead of full Actel integration in the original True Blue design
Clone has a tact switch which the original does not require, and switch can only be accessed by pulling PCB out of the case
Actel logic on clone is based on partial guess work of the original and will not function correctly in future updates
PCB circuit design is highly congested, with numerous visual differences evident, such as programming pads for the MCU and addiional resistors/caps

Please refer to the pictures shown below, to compare the original and clone.

A new software update will be made publicly available in the next few days which will allow users to differentiate original from clone by performing a firmware update.

**PS3 News** · 05-24-2012

Today True Blue PS3 JB2 v2.7 Firmware has been released for those with the dongle, with details below as follows:

Download: http://truebluejb2.com/downloads/TrueBlueUpdate-2.7.zip / http://ex-scene.com/jb2_2.7/TrueBlueUpdate-2.7.zip (Mirror) / TrueBlue Update v2.7 (Mirror #2) / TrueBlue Update v2.7 (Mirror #3)

24 - 5 – 2012

True Blue dongle firmware v2.7 has been released.

Changes include:

True Blue dongle authenticity status displayed on PS3 XMB system information screen
Fixed yet another important game compatibility issue affecting recent 4.xx games

The authenticity status display can be used to determine if your True Blue dongle is either authentic or a clone.

For further details, see the information page. How do I know if I have a TB clone?

Q: How can I verify that my True Blue is authentic and not a clone?

A: Install True Blue dongle firmware v2.7 or later.

Then in the PS3 XMB, navigate to Settings -> System Settings -> System Information. Next to the "System Software" version will be information relating to your True Blue dongle. If your dongle is authentic then it will display something like "True Blue v2.7" (this will vary depending on the version of the dongle firmware you have installed).

If your dongle is a clone then it will display "True Blue CLONE" as shown in the following image:

True Blue Payload v2.7

Download: True Blue Payload v2.7

Payload (2.7)

located in unself'ed eboot.bin @ offset:

Code:

  Offset(h)  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
  000087c8   00000000  E0 AE 1B 14 9D 24 05 8A D0 BB 65 D8 7F CC 1C 24  à®...$.ŠÐ»eØ.Ì.$
    ...
  00067fc8   0005F7F0  D9 5A C0 45 E8 78 E6 C6 16 0A 98 10 1B CA 52 3B  ÙZÀEèxæÆ..˜..ÊR;

TB_payload_27.bin (382 KB): http://www.ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.7/TB_payload_27.bin

Code:

SHA1: 107A4E37471D58E79B6F8A884FF09DD3A5F83DD0 // 
MD5: 495970F92139F966BF78E43509BB7C38 // 
CRC32: FBA0FCEB // 
CRC16: AD81

**PS3 News** · 05-30-2012

Below is an update on the True Blue PS3 JB2 Dongle new security packaging, as follows:

30 - 5 – 2012

New packaging for True Blue incorporating security measures and an updated picture identification reference for clones

Due to the recent emergence of clones we are introducing a new packaging system and a security sticker on the dongle itself to help ensure customers receive original True Blue dongles.

Firstly, a new blister pack with a label over the blister will be introduced, as shown below. This provides several measures for the user to identify if the True Blue device received is likely to be original.

Note the unique security patterns in silver which are difficult to counterfeit, due to the colour variations on the background colours, materials used and complexity of the pattern itself. If the label appears to be stretched or appears to have been used before, then careful attention should be paid to the security sticker on the dongle itself.

The security sticker adhered to the dongle itself (shown below), partially covering the cap will provide the user with an indication of whether or not the dongle has been tampered with before delivery. Therefore, if the portion of the sticker covering the dongle cap has been broken, then it is possible that the dongle may have been tampered with. If this is the case, please use the TrueBlue 2.7 firmware as a means to check the authenticity of the dongle.

If the word clone appears in the PS3 XMB where the TrueBlue 2.7 version number is stated, then you should contact your reseller for assistance. Security stickers are designed with a number of security considerations in mind and are very difficult to reproduce exactly. This will aid retailers and end users in determining whether the product received is an original.

Some original True Blue dongles are in the supply chain yet to be sold, which do not have the new packaging. If you receive a True Blue dongle without the new packaging, then simply use the True Blue 2.7 firmware to identify whether or not it is an original. Details can be found on the information page and inside the 2.7 firmware download package on the downloads page.

Finally, we are updating the picture references for users to identify whether their PCB is an original True Blue or a CLONE. We have released several revisions of the True Blue PCB’s which are shown below. The recent CLONE posing as True Blue in a similar casing is also shown below and referenced as CLONE. If you have received one of these clones instead of the original True Blue you ordered, then you should contact the retailer who you purchased it from for a refund.

**PS3 News** · 06-02-2012

Today PlayStation 3 developer Naehrwert has blogged (nwert.wordpress.com/2012/06/02/reversing-tb-part-1-the-vm/) on reversing the TB (True Blue JB2 PS3 Dongle) Part 1: The VM with details below, to quote:

Thanks to oct0xor (twitter.com/#!/oct0xor) we could get our hands on the decrypted TB payload (stage 2). Of course the first thing to do is to fire it up in IDA, our favourite tool of the trade. The entry code of the payload looks like this:

Code:

01	1337C0DE00000000 _start:
02	1337C0DE00000000
03	1337C0DE00000000 .set var_58, -0x58
04	1337C0DE00000000 .set arg_10,  0x10
05	1337C0DE00000000
06	1337C0DE00000000         mflr      r0
07	1337C0DE00000004         bl        loc_1337C0DE00000008
08	1337C0DE00000008 1337C0DE00000008 loc_1337C0DE00000008:
09	1337C0DE00000008         mflr      r3
10	1337C0DE0000000C         lis       r4, 0 # 8
11	1337C0DE00000010         addi      r4, r4, 8 # 8
12	1337C0DE00000014         subf.     r3, r4, r3
13	1337C0DE00000018         beq       skip_reloc
14	1337C0DE0000001C         li        r6, 0
15	1337C0DE00000020         oris      r6, r6, 0x1337
16	1337C0DE00000024         ori       r6, r6, 0xC0DE
17	1337C0DE00000028         lis       r4, 1 # 0xA848
18	1337C0DE0000002C         addi      r4, r4, -0x57B8 # 0xA848
19	1337C0DE00000030         lis       r5, 1 # 0x10D18
20	1337C0DE00000034         addi      r5, r5, 0xD18 # 0x10D18
21	1337C0DE00000038         subf.     r5, r4, r5
22	1337C0DE0000003C         beq       skip_reloc
23	1337C0DE00000040         srdi.     r5, r5, 3
24	1337C0DE00000044         mtctr     r5
25	1337C0DE00000048         add       r4, r4, r3
26	1337C0DE0000004C
27	1337C0DE0000004C reloc_loop:
28	1337C0DE0000004C         ld        r5, 0(r4)
29	1337C0DE00000050         srdi      r7, r5, 32
30	1337C0DE00000054         cmpw      r7, r6
31	1337C0DE00000058         bne       skip_rewrite
32	1337C0DE0000005C         clrldi    r5, r5, 32
33	1337C0DE00000060         add       r5, r5, r3
34	1337C0DE00000064         std       r5, 0(r4)
35	1337C0DE00000068
36	1337C0DE00000068 skip_rewrite:
37	1337C0DE00000068         addi      r4, r4, 8
38	1337C0DE0000006C         bdnz      reloc_loop
39	1337C0DE00000070
40	1337C0DE00000070 skip_reloc:
41	1337C0DE00000070         std       r0, arg_10(r1)
42	1337C0DE00000074         stdu      r1, -0x80(r1)
43	1337C0DE00000078         std       r2, 0x80+var_58(r1)
44	1337C0DE0000007C         lis       r4, 1 # 0x17E40
45	1337C0DE00000080         addi      r4, r4, 0x7E40 # 0x17E40
46	1337C0DE00000084         add       r2, r4, r3
47	1337C0DE00000088         bl        payload_main

In the first loop it will relocate itself using 0x1337C0DE as an identifier for the upper 32 bits and rewrite that to the actual base. The disassembly above was already loaded using 0x1337C0DE00000000 as base. While scrolling through the data section at the end of the payload one quickly figures out that the RTOC is 0x1337C0DE00017E40.

As I was analyzing the code I found a sub that was basically just a really big switch with random looking case values. Once I reversed the sub at 0x1337C0DE00002578 and some of the following ones and analyzed their usage in the switch sub, I knew that I was looking at a fricking virtual machine.

Code:

1	1337C0DE00002578 vm_push_word_0:
2	1337C0DE00002578         ld        r11, off_1337C0DE00010128 # stack_ptr
3	1337C0DE0000257C         ld        r9, 0(r11)
4	1337C0DE00002580         addi      r0, r9, 4
5	1337C0DE00002584         std       r0, 0(r11)
6	1337C0DE00002588         stw       r3, 4(r9)
7	1337C0DE0000258C         blr

Paranoid TB developers even used XOR-tables to obfuscate the VM instructions and data. The virtual machine is mostly stack based but the instructions let you work using registers too. The next thing to do is to reverse all the instructions and write a disassembler and emulator. Here (pastie.org/4015202) is some code to unscramble the embeded vm binary for further investigation. I’m going to write more about this topic in the future.

Code:

/*! XOR table 1. */
u8 xor_table_1[0x100] = //16*16
{
	0x62, 0xC5, 0xEE, 0xFC, 0xC8, 0x2E, 0x59, 0xF3, 0x1D, 0x32, 0x20, 0xED, 0xD8, 0xA3, 0xD2, 0xB8, 
	0x7D, 0x16, 0x11, 0x6A, 0x41, 0x94, 0x25, 0x1E, 0x80, 0x21, 0xE9, 0xE7, 0x0A, 0xB3, 0x39, 0xF0, 
	0xBA, 0x97, 0xC3, 0xCF, 0x36, 0x5A, 0xA6, 0xC9, 0x9D, 0xD5, 0x0B, 0x98, 0x28, 0x78, 0xAC, 0x97, 
	0x12, 0x6D, 0x3E, 0xF6, 0xBA, 0x45, 0x0D, 0xE1, 0xC1, 0xAF, 0x58, 0x04, 0xCE, 0xBE, 0x20, 0xE3, 
	0x62, 0xEE, 0x36, 0x7E, 0xA7, 0x59, 0x57, 0xCF, 0x2F, 0x40, 0xDB, 0xD4, 0x84, 0x57, 0xFF, 0x17, 
	0xA6, 0x52, 0x10, 0x14, 0x76, 0x5F, 0x16, 0xF0, 0xBE, 0x8D, 0xCD, 0xAB, 0x7B, 0x09, 0xD1, 0x9A, 
	0x1F, 0x53, 0xEA, 0xF6, 0x67, 0x23, 0xE2, 0x1D, 0x4E, 0x74, 0x78, 0xD2, 0x5B, 0x86, 0x12, 0x02, 
	0x62, 0x4F, 0xC0, 0xD0, 0xC3, 0xF2, 0x61, 0x33, 0xFB, 0x22, 0x21, 0x6A, 0x46, 0xB2, 0x5B, 0x0C, 
	0xCC, 0xFB, 0x77, 0x1F, 0x89, 0x51, 0x1C, 0x11, 0x9C, 0xA5, 0xFA, 0x3C, 0x4A, 0x5B, 0x7D, 0x5E, 
	0x28, 0x05, 0xB4, 0xBA, 0x04, 0x76, 0x51, 0x13, 0x57, 0xEA, 0x8E, 0xEB, 0x95, 0x84, 0xAC, 0x5B, 
	0x6B, 0xC8, 0x5F, 0x2B, 0x55, 0xBE, 0x74, 0xB0, 0x35, 0xEF, 0x46, 0x8A, 0x88, 0x2C, 0xDB, 0xE5, 
	0x8D, 0x7D, 0x08, 0x19, 0xFB, 0x19, 0x75, 0x91, 0x95, 0x17, 0x5E, 0xA8, 0x3D, 0x49, 0xE7, 0xFB, 
	0xA3, 0x50, 0x7C, 0xE2, 0x38, 0xAB, 0x21, 0x0A, 0x2D, 0x4B, 0x98, 0x73, 0x30, 0x94, 0x75, 0x7F, 
	0x4A, 0x17, 0x1F, 0xA6, 0x49, 0x1A, 0x72, 0x1D, 0xA6, 0xB6, 0x37, 0xD0, 0x63, 0xB5, 0x81, 0x50, 
	0x81, 0xD2, 0xE9, 0x74, 0xDA, 0x94, 0x15, 0xA7, 0x34, 0x55, 0x00, 0xB2, 0xE8, 0xFB, 0x45, 0xC5, 
	0xC0, 0x06, 0x52, 0xCB, 0x10, 0xE8, 0x14, 0x9D, 0xC7, 0x3B, 0xC8, 0xDA, 0x22, 0x52, 0x3B, 0x0F
};

/*! XOR table 2. */
u8 xor_table_2[0x100] = //16*16
{
	0xB8, 0x47, 0xF9, 0xFA, 0x2C, 0xE2, 0xA5, 0x8C, 0x50, 0x11, 0xB7, 0x72, 0xC5, 0xEC, 0x05, 0xA4, 
	0x0F, 0xEF, 0x35, 0x32, 0x5C, 0xC2, 0x6A, 0x3B, 0xAC, 0x8C, 0x9F, 0x94, 0xE5, 0x6C, 0x4E, 0x97, 
	0x8D, 0x39, 0xC3, 0x84, 0x9F, 0x26, 0x8D, 0xF7, 0xD7, 0x6B, 0x92, 0x17, 0x10, 0xF3, 0xBA, 0x4D, 
	0x6B, 0x27, 0x37, 0x11, 0x1A, 0xE3, 0xB6, 0xC5, 0xE7, 0x52, 0x6A, 0xA2, 0xEF, 0x84, 0x6F, 0x52, 
	0xA6, 0x49, 0xE0, 0x65, 0x82, 0xA8, 0x6F, 0xAC, 0xB7, 0xA5, 0xFD, 0x4C, 0x5F, 0x3F, 0x57, 0xC8, 
	0xA2, 0xCC, 0x19, 0xC0, 0x0F, 0x4F, 0x4E, 0x94, 0x46, 0xDF, 0x54, 0xE6, 0x63, 0xA5, 0xD2, 0x4C, 
	0xED, 0x61, 0x1F, 0x1D, 0x6B, 0x07, 0x3F, 0xE8, 0x5A, 0xF3, 0xF7, 0xB8, 0x94, 0x7C, 0x8F, 0x85, 
	0x5D, 0xE2, 0x28, 0x8B, 0x3D, 0xF5, 0xF1, 0x48, 0x32, 0x3F, 0x30, 0xBA, 0x32, 0x63, 0x11, 0xFE, 
	0xE8, 0x52, 0x14, 0x8E, 0x68, 0xBC, 0x38, 0xE2, 0x3F, 0xF2, 0x9A, 0x3E, 0xF0, 0xE2, 0x1B, 0x3A, 
	0x99, 0x5B, 0xB6, 0x62, 0x61, 0xD8, 0x17, 0xD5, 0xBD, 0x63, 0x10, 0x6F, 0xF6, 0xB7, 0xA4, 0xD3, 
	0x39, 0x5C, 0xA5, 0x63, 0xFB, 0xE8, 0xEE, 0x9E, 0x4B, 0x05, 0x11, 0x43, 0x95, 0xFE, 0xC1, 0xF6, 
	0x5E, 0x46, 0xD8, 0x7A, 0x51, 0xC6, 0xCD, 0x77, 0x80, 0x0C, 0x9D, 0xAF, 0x6B, 0x59, 0xAD, 0xAE, 
	0x39, 0x3C, 0xD4, 0x2C, 0x95, 0x2A, 0x4D, 0x50, 0x75, 0xB0, 0xB1, 0x7F, 0x79, 0x9C, 0x10, 0x5E, 
	0x33, 0x7A, 0x1A, 0x05, 0x0F, 0xF5, 0x49, 0xC2, 0xA6, 0x4C, 0x1E, 0x82, 0x23, 0xB8, 0xA8, 0x3D, 
	0x2D, 0xFB, 0xE2, 0xB0, 0x37, 0x45, 0x30, 0xFF, 0x3F, 0xD4, 0x2D, 0x81, 0x10, 0x0A, 0xCB, 0x51, 
	0x9C, 0xAF, 0xC2, 0x68, 0x65, 0x53, 0x44, 0x61, 0x14, 0xE1, 0xF4, 0x5A, 0xD2, 0xC8, 0x25, 0xDD
};

//Unscramble the vm binary.
{
	int i;
	for(i = 0x9AC; i < 0x3824; i++)
		*(vmbin + i) ^= xor_table_1[i & 0xFF];
	
	for(i = 0x382C; i < 0x3A08; i++)
		*(vmbin + i) ^= xor_table_2[i & 0xFF];
}

From shad__ on IRC for TB DRM dongle users: EBOOT.BIN

[shad__] if it can help, you can play tb eboot without tb plugged in. Just, patch sys_sm_shutdown call in TB update pkg and unplugg Tb dongle then press x to exit.It will exit without reset lv1 and lv2.
[shad__] POC: http://www.mediafire.com/?z42clbkhjju1khy
[shad__] Now you can share your dongle with your friends
[shad__] was ~chatzilla@55.219.73.86.rev.sfr.net * New Now Know How

Also this weekend Team E3DIY claim that they have also managed to run all PlayStation 3 games on 3.55 PS3 CFW (similar to TB/JB2) but they will likely peddle another dongle to do it unfortunately instead of a free PS3 scene solution.

Finally from oct0xor (via twitter.com/#!/oct0xor):

ps3usercheat skip r4=%x,r5=%x main_EBOOT.BIN main_vsh.self

I can decrypt TrueBlue Stage 2, Cobra EBOOT.BIN, ps3usercheat cheatlist.dat and lv2 stage 1 and 2, right on PC. pic.twitter.com/b2awqYLv

You really can call me "DongleBreaker" now

Thanks to flat_z who was with me all along.

**userix** · 06-03-2012

Can I flash back to kmeaw 3.55 after flashing tb cfw 3.55 or is it a one way street ordeal?

**RobertoSlip** · 06-03-2012

should be transparent, this would greatly facilitate..

**jabberosx** · 06-04-2012

This is good news. But at the same time ANOTHER frikking dongle is down right shameful. I mean whats the frikking point. arrgghhhhhh I know make more money by pirating from pirates. knowing still doesn't help.

**PS3 News** · 06-07-2012

Below is an update from wololo (via wololo.net/2012/06/06/ps3-more-dongles-info-decrypted-by-oct0xor/) dubbed PS3 - More dongles info decrypted by oct0xor (covered a few posts above), as follows:

PS3 hacker oct0xor, who was already behind the base work that led to initial reverse engineering of the True Blue dongle, just twitted that he can decrypt True Blue’s stage2, as well as critical information from other clone dongles.

I can decrypt TrueBlue Stage 2, Cobra EBOOT.BIN, ps3usercheat cheatlist.dat and lv2 stage 1 and 2, right on PC.

You really can call me “DongleBreaker” now

Thanks to flat_z who was with me all along.

As I said earlier, the people behind True Blue are not amateurs in the hacking scene and could definitely leverage that type of information. Hackers like oct0xor are not fighting against “we don’t know about it until it’s too late” Sony, but against people who regularly check all scene websites, and take action.

I have no doubt that the next True Blue firmwares will change their encryption scheme, and if not, another “magical” dongle will pop up in the months to come, from another random company (the same people who made true blue, of course), with a completely different security system.

That is, unless PS3 hackers completely reverse engineer the system behind the True Blue dongle, in a way that Sony can finally understand how True Blue are able to patch 3.6+ games so easily, and hoping that future games will be protected against the True Blue patches. That would calm down piracy on the PS3, and people who don’t get it will claim that this could kill the PS3 scene.

**technodon** · 06-12-2012

following up on shad__'s excellent work on the modified true blue eboot, i repacked it as a installable pkg and also modified the text so it now reads remove the dongle and press x to return to the xmb. download link here: http://www.putlocker.com/file/6B780406C00FD776

Latest PS3 News Forum Updates

True Blue PS3 JB2 v2.62 Update is Now Available

True Blue Issues Another Warning About TB PS3 Dongle Clone

True Blue PS3 JB2 v2.7 Dongle Firmware Released

True Blue PS3 JB2 Dongle New Security Packaging is Detailed

Reversing TB (True Blue JB2 PS3 Dongle) Part 1: The VM by Naehrwert

PS3 - More dongles info decrypted by oct0xor

Tags for this Thread