43w ago - This weekend Spanish PlayStation 3 developers at
DemonHades have made available a PS3 eEID0 Dumper for JBM 3.55, MA 3.56 and PlayStation 3 CFW 3.55 alongside a ConfEditor for
TheGrid.
To quote, roughly translated:
eEID0 Dumper by BlackDeath to JBM 3.55, MA 3.56 and CFW 3.55
Hello friends, after the method of filtration
CEX2DEX the team decided to investigate this new field (for some) and not so much for others, that is why we are working to bring you the easiest method to move to Linux without requiring DEX.
Today I present created by the dumper EID0 blackdeath with which we can dump all EID0 or directly CEX first section with only launch a pkg and have connected a USB port on dev_usb000, the instructions are on screen and are easy:
- START: To dump all EID0.
- SQUARE: To dump the first section of EID0 directly (eid0_1st_Section_CEX.bin).
- X (EQUIS): To dump metldr (Encryption) to USB and be prepared to exploit and get the dump of the decrypted metldr in subsequent steps.
If you are in Normal 3.55 cfw release the pkg from video.
BlackDeath says: This latest version now allows you to dump the metldr (encryption) on your console if usais the X button and you will have your ready to dump metldr encryption decryption keys used together with her exploit later.
Tell them to keep working this issue need not linux as the next step is to dump the metldr without having to make so many things in linux but a quick and easy dump.
The eEID0 is necessary for the process dump metldr As you know, and only the first section of eEID0 (That we get directly to this tool) is required for Conversion to a unit DEX / TEST.
No more here I leave the download link, works both on any CFW 3.55 (PEEK | POKE LV2) as in MA:
- http://www.mediafire.com/?eblfgmmwrmjl8sw (Old Version)
- http://www.mediafire.com/?32dca82c31470qa (New Version)
Thanks BlackDeath, Checko, Tito01 and DemonHades
From
checko: WIP: A method to dump metldr and eEID root keys without linux, more easy with some little steps .. maybe
naehrwert can help you. To quote from his Twitter (via twitter.com/naehrwert/status/226682478373531648 and twitter.com/naehrwert/status/226686257005203456):
Isn't installing linux to get your eid root key a bit of an overkill when you could just use netrpc?!
Or you could compile this pastie.org/4295312, sign it with metldr keys and grab the key/iv from shared LS...
ldr.ld
ENTRY(_start)
SECTIONS
{
. = 0x25800;
.text :
{
*(.text)
}
.data :
{
*(.data)
*(.rodata)
}
.bss :
{
bss = .;
*(.bss)
}
} types.h
#ifndef _TYPES_H_
#define _TYPES_H_
typedef char s8;
typedef unsigned char u8;
typedef short s16;
typedef unsigned short u16;
typedef int s32;
typedef unsigned int u32;
typedef long long int s64;
typedef unsigned long long int u64;
#endif
start.S
.text
/* Loader entry. */
.global _start
_start:
/* Setup stack pointer. */
ila sp, 0x3DFA0
/* Well... */
brsl lr, main
_hang:
br _hang
main.c
#include "types.h"
void *_memcpy(void *dst, void *src, u32 len);
void main()
{
//Copy eid root key/iv to shared LS.
_memcpy((u8 *)0x3E000, (u8 *)0x00000, 0x30);
//Hang (the PPU should copy the key/iv from shared LS now).
while(1);
}
void *_memcpy(void *dst, void *src, u32 len)
{
u8 *d = (u8 *)dst;
u8 *s = (u8 *)src;
u32 i;
for(i = 0; i < len; i++)
d[i] = s[i];
return dst;
} ConfEditor PS3 for TheGrid by RacingLocura07
Our partner and developer RacingLocura07 (UsaveME) leaves us on this occasion the conf editor ps3, this application allows you to enable or disable patches, plugins or create flags without using a PC, all from the PS3 itself in a simple and fast
Download: http://www.sendspace.com/file/99llgd
Options:
- Displays a list of flags
- Displays list of patch-dynamic
- Displays a list of plugins
- Allows you to export to the root of the usb, the. Cfg file to test it before storing.
List of flags:
- Matheros (direct or normal)
- dumper-ram
- debug
- dev_flash (dumper / restore)
- sc35/36 +8 (more compatible)
- 100% Fan speed (fan at 100%)
Any questions you have you can reply in this thread, thanks to RacingLocura07, tito1, adriansfc92 as Cheko. Conf editor and this works both as the 3.56 MA JBM 3.55
Finally, in related PS3 homebrew news today
PsyOil has made available a
PS3 PUP Download Archive (GUI) for those interested stating:
On a click of a button a command prompt window will start downloading (from the PS3 Dev Wiki) the PUP to the same directory as the program. Do not delete wget.exe or else the pups will not download!
Its pretty simple, list of firmwares (OFW) on click they download to the directory your placed the two files in.
Now, you're probably wonder why someone would ever need this. I download and delete pups very often, so I made this program to make it a bit easy to find a PUP right away.. Making a CEX/DEX downloader soon.
Update: he has now released the
PUP CEX/SEX Download Archive (GUI) followed by a
PUP SEX/DEX/CEX Download Archive GUI stating the following:
Once again, I suck at GUI programs. I've made a command prompt version of the same program, where you just enter the name of the firmware version exmp “4.10″ and it starts downloading the firmware on command (4.10p for patch pups) Should I just release that or stick to the ghetto lookin’ GUI?
Shortly following he also made available a
PS3 PUP / Dev_Flash Extractor stating, to quote:
Very simple and straight forward, place pup within the same folder as the extractor! Credit to HSReina for df.exe
Also, I've included a simple command prompt app:
Enter "pu.exe PS3UPDAT.PUP PS3UPDAT" to extract the pup.
Enter "df" to extract Dev_flash from the pup
Enjoy
Here is
CEXtoSEX Converter 4.21 as well by
PsyOil with the details below, as follows:
Sony shop PUP, just patched promo_flags/update_flags. anyways, this is just a basic pup that will convert your PS3 into a SHOP Ps3. (not advertising as a jailbreak or a CFW) its just a basic MFW.
Remember after unlocking through security settings, the package installer is NOT for homebrews but only for installing demos. The second PUP is a file that'll convert your SHOP PS3 into a retail PS3. Remember, these still apply! (scei.co.jp/ps3-eula/ps3_eula_en.html)
I just saw this earlier: packetstormsecurity.com/files/121691/sony_ps3_firmware_v4.31-exec.txt
Sony PS3 Firmware 4.31 Code Execution
A local co...
I'm going to try, thank you.
You must create an image in IMG/img or BIN/bin format.
Rebug is really 4.30, but is spoofed to 4.31, you can use your own ps1_emu.self or from another firmware, it's the same for all firmwares.
The "notes.txt" says that this works only with ps1_emu.self up to 4.30 CEX CFW, but I'm on 4.31 Rebug CFW.. Can I use a ps1_emu.self from another firmware?