Sponsored Links

Sponsored Links

JaicraB on Cobra USB JIG Protection RTOC Trick for PS3


Sponsored Links
163w ago - Today Spanish PlayStation 3 developer JaicraB has explained the Cobra USB JIG protection RTOC trick implemented for the PS3 against cloning the device.

To quote, roughly translated: Flynn sent me this text explaining this protective carrying the Cobra, I hope it will open the eyes of those interested in reversing the dumps.

EXPLAIN RTOC COBRA TRICK

The JIG Cobra has several protective measures to ensure that your code could not be used correctly even if your code could be dumped.

This trick RTOC in the registry is the first used for this purpose in addition to hinder analysis.
Registration is initially RTOC stored in the battery to keep the RTOC of lv2 and power it back later:


At this point we have to explain that the OFFSET DELTA. DELTA OFFSET is a method used in the x86 in its original moments in the creation of computer viruses, to calculate the memory address in which we are in the sea of ​​bytes in RAM.

In the original time a computer virus when I did not know where he was pulled into an executable,
depending on the executable it could be an initial site or another, for it was invented DELTA OFFSET.

DELTA OFFSET can be used in any system, the procedure is:

  • Using the record that indicates the current execution address (or the next depending on the system)
  • Reducing the size of the previous code we use the value obtained from the registry.

Knowing this, and taking for example the x86 processor where the EIP register can not be read directly invented the trick make a call to a "subfunction" which is simply the following line to the call:


X86 call instruction saves the top of the stack the address of the next instruction to itself. Thus using pop draw from the top of the stack this value, and stored in eax for example, and having the memory address where we only subtract the above would be missing and we have the exact calculation.

The PowerPC can use this trick using the BL instruction is equivalent (LINK BRANCH), which jumps to a "subfunction" but before you save LR in the record the following address to BL.


At this point we see the trick used for the creation of the RTOC of charges at this time. If you look both r0 and RTOC are passed to 0:


Subsequently, given the value 0x11DE0 to RTOC:


A r0 is given the value 0x920:


R0 is subtracted from the value of RTOC:


Unlike the PowerPC x86 LR register can be read directly with mflr instruction, we put in RTOC the value obtained by the delta offset:


To calculate the delta offset subtract final instructions executed before the delta offset, which were 4, or 16 bytes:


Finally we add the value of r0 at the end of the delta offset RTOC, storing the result in the RTOC and this already takes RTOC suitable for this hook:


It takes having the RTOC stored in the stack 3 arguments that the hook received:


You call the function of the charges where the first argument will check for command 0x8202 (a special command to the usual):


After making the necessary steps as charged, the battery recovers the original RTOC, like the arguments the hook received, it executes the original instruction that was overwritten in the syscall entry 379 (in this case) to have our hook, and call the original syscall lv2:


Upon returning to retrieve the original LR from the stack and returns to the prompt





Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!

Comments 703 Comments - Go to Forum Thread »

• Please Register at PS3News.com or Login to make comments on Site News articles. Thanks!

PS3 News's Avatar
#673 - PS3 News - 25w ago
26 - 2 - 2014: Cobra ODE News - Information

We are now close to release of the 2.0 firmware for the V3, V4 and V4 QSV versions of Cobra. We expect to release the 2.0 firmware this weekend. The release includes support for 4.55 OFW on 4k consoles and all functionality previously announced for fw 2.0

Furthermore, we are now shipping the 5.10B QSV Cobra which is more compact and runs on accelerated hardware giving faster performance. The Cobra 2.0 firmware will be released for 5.10B next week.

All future firmware updates will be released in parallel on V3, V4 / V4 QSV and V5 / V5 QSV hardware.

Photos of the new V5.10B hardware pack, will be published tomorrow.

Update: Cobra ODE MCU v2.0 Released

The Cobra Team as promised has released a new update for users with Cobra ODE version MCU 2.0. The new update is for users with problems with the console and 4k with ofw 4.55. In waiting for an official guide below is the changelog and downloading:

Changelog: COBRA ODE 2.0

  • FPGA 1: Increase AES encryption module performance to 220% faster than previous release
  • FPGA 3: Fix disc dumping corruption and increase disc dumping performance by 100%
  • Added support for manager.type=browser configuration option to autogenerate browser
  • Added support for software-emulation Pass-Through mode
  • Added support for bypass.4.55=1 configuration option to bypass the 4.55 superslim security
  • Added support for game.pt=1 configuration option to force software-emulation Pass-Through
  • Added support for updating PS3 firmware without needing to switch to PT mode
  • Added support for eject.add_menu=1 configuration option to add a menu to return to manager when game iso is loaded
  • Added support for eject.delay option to specify delay in milliseconds before reinsertion of disc after it has been ejected on QSB systems
  • Added support for manager.on_eject=0 configuration option
  • Added support for mcu.underclock configuration option
  • Added support for leds.disable configuration option to disable specific LED colors
  • Various stability fixes

COBRA ODE BOOTLOADER 1.3

  • Fix support for flashing FPGA images
  • Add support for flashing 2.0 firmware

COBRA MANAGER 1.6

  • Add disc dumping capabilities
  • Add support for Passthrough Mode

Download: Cobra ODE Manager v 1.6 / Cobra ODE Bootloader 1.3 / Cobra ODE Database (28-02-2014) / Cobra ODE MCU 2.0




Warning: Downloading and use is at your own risk without an official guide. Only users with console 2k and 3k users can update while the console 4k users must wait.

redvaleyard's Avatar
#672 - redvaleyard - 26w ago
I got a Cobra Usb dongle last week on the strength of it being apparently plug in and play and non-invasive procedure for the console. I've found it isn't easy.

As a total novice I need a step by step idiot proof guide how to hack the ps3 so I can actually use it. I've so far installed all the drivers and latest 6.0 firmware on the dongle and come to a grinding halt.

I've downloaded all the files and followed the user manual but am stuck. In various forums I've read about installing flashing devices but I thought using the Cobra you don't.

I need to open the console. I need massive and simple help on what to do. I'm on a PS3 original 60gb uk pal with latest OFW 4.55 installed. Any help gratefully received.

Remember I'm a complete novice and need simple untechnical "do this", "do that" instructions. Thanks in advance.

PS3 News's Avatar
#671 - PS3 News - 27w ago
12 - 2 - 2014: Cobra ODE News - Update

From Cobra manufacturer Max Louarn: We have successfully tested a performance update for 4.20 and 4.30 which rectifies freezing issues reported by some users. We have also implemented a fix for BMD-061 drive control boards on 2k consoles and auto eject on 2k.

Please follow the instructions in the README.TXT carefully.


From PS3 scene profiteer Gary Wayne Bowser (aka GaryOPA):

Don't worry Cobra's solution will be a lot better then E3's half-ass encrypted bootdisc swap-disc.

Cobra's mainboard can do 'encryption on the fly' so if there needs to be a bootdisc with special headers before the iso is loaded, then they will be able to without the need of using an actual Blu-ray.

From magneto: Information update: Only super slim models are affected. The 4.55 update has a specific protection against ODEs. We are lucky to have found a way to bypass this new protection, as Sony have historically only released fixes that cannot be bypassed. We also have a working solution that we're working on, but it is very similar to what E3 has. We are aware that the current 4.55 fix is not user friendly and we are trying to find an alternative solution.

We are trying to make the disc swap solution much more convenient for users before we release it. Some of you should learn to be patient. The team is working around the clock to fix the issue for you, be considerate. Running an IRD-built iso that is the same as the bootdisc you have in the drive should work. Those who reported that some game is working for them, can you confirm that it is a different game than the bootdisc you are using ?

If it isn't, can you upload the iso or specify how it was generated (with IRD or not, which version of genps3iso you used) and specify which bootdisc you used with it and if it works with other bootdiscs ? We expect to have an update available in the coming week.

We have a fix for we are currently testing for those who get the 80010017 error. It will be released with the 2.0 update.

Update: 15 - 2 - 2014: Cobra ODE News - Information

Cobra 2.0 release imminent - features explained (Including initial support for 4.55):

Cobra Team have been hard at work 24/7 preparing the next firmware release for our users. The incoming Cobra 2.0 is once again a massive update and packed with innovative new features.

After the massive features (PS1, PS2, BD/DVD movies and IRD 9 support) added in the recent Cobra 1.90 update, we're back with yet more cool features in 2.0 which will be released in the coming week:

2.0 will pack these features:

  • Initial support for OFW 4.55 (Please read further information in news paragraph below)
  • Auto-generate browser from the MCU, no more need for genps3extra
  • Dumping of original games using the BD drive is now possible through the Cobra Manager
  • Added support for XMB enabled Pass-Through mode, meaning user no longer has to use slide switch to swap modes and in addition playback of burned PS1 discs when used in combination with the game.disc_type=ps1 configuration option
  • Increased AES encryption module performance by over 100%, now there is no lag in playback of IRD generated ISO's
  • Added support for updating PS3 firmware without needing to switch to PT mode
  • Eject now possible on 4k systems, without need for user to open console cover
  • Added support for "eject.delay" option to specify delay in milliseconds before reinsertion of disc after it has been ejected on QSB systems (default value of 1000ms)
  • Added support for "leds.disable" configuration option to disable specific LED colors

We have been working on a solution for OFW update 4.55, which will fix the added anti ODE measures. The current approach will be more streamlined than solutions currently offered by other teams, however it is not as convenient as using the ODE on pre 4.55 OFW's. Our R&D focus is now concentrating on other possible solutions to bypassing the 4.55 checks.

The current working solution for OFW 4.55 will be released in the coming week. We advise users to use this update if they have accidentally updated to 4.55. Others who have not yet updated may want to consider keeping their consoles on 4.53 or lower until a better solution is available to benefit from the user convenience of the ODE on these firmwares.

We can now also confirm that only 4k Super Slim series consoles are affected by the 4.55 update. Those who have 3k / 2k5 Slim or earlier consoles are safe to update to 4.55.

Cobra MCU 2.0 Changelog:

  • Added support for manager.type=browser configuration option -> Auto-generate browser from the MCU, no more need for genps3extra
  • Fix DISC.ISO dumping corruption -> Dumping of original games using the BD drive is now possible through the Cobra Manager
  • Added support for XMB enabled Pass-Through mode -> Allow access to the boot disc from the manager or browser and enable PT without touching the PT/EMU switch -> Allow playback of burned PS1 discs when used in combination with the game.disc_type=ps1 configuration option
  • Added support for game.pt=1 configuration option to force software-emulation Pass-Through
  • Increase AES encryption module performance by over 100% -> Playback of IRD generated ISO will not lag anymore
  • Added support for updating PS3 firmware without needing to switch to PT mode -> Still not recommended to update to 4.55 for super slim users
  • Added support for eject.add_menu=1 configuration option to add a menu to return to manager when game iso is loaded -> useful for 4k which don't have Remove Disc option in XMB
  • Added support for "eject.delay" option to specify delay in milliseconds before reinsertion of disc after it has been ejected on QSB systems (default value of 1000ms)
  • Added support for "mcu.underclock" configuration option -> Allows underclocking the MCU to further limit power consumption
  • Added support for "leds.disable" configuration option to disable specific LED colors -> Feature requested by forum user DarkKitarist because LED light was brightening up his room at night -> 1=blue, 2=red, 4=green, can be added to disable more than one color, leds.disable=6 disables red and green, leds.disable=7 disables all led colors -> Disabling a color can affect LED color in combined situations, for example, disabling green will show a purple color if you select a DVD or BD movie (normally white)
  • Fix freezing on 4.20 and 4.30 boards

To all the impatient people who can't appreciate the work we're doing and the burnouts we're having from preparing this next release to you: thank you for your encouraging words and for bringing up our motivation in working more than 24h per day for your enjoyment and for fixing your mistake of updating before receiving the green light from the team.

For the others, here is an update on the status of the 2.0 release: The release is almost ready, we are doing QA and trying to get rid of some bugs The changes in the 2.0 firmware are massive with a lot of new features that everyone will appreciate. We do not want to rush this release and have it fail for half our users so we must test it properly. A couple more days of work and if no new bugs are found, the release will be ready. In the meantime, please be patient.

Finally, below are some new PCB Cobra ODE pictures with include Version 5.10B. The new PCB boards are shorter than previous models.

From magneto: The new v5 boards are being shipped now, they are much smaller than previous boards. As SDeath said, you can compare the size with the clipon PCB. They will run cooler so should not have overheating issues, and will be much faster for game loading and for IRD games.

I believe they will also work with the CECHL BMD-21 drives, but I cannot confirm that at the moment.

No, burning and using the swap disc is only needed if you have 4.55 firmware and a 4k model and that mode will only be enabled if you enable the appropriate option in cobra.cfg, otherwise, it will work as before.

It will be one disc for all your games. You will need to burn a bluray disc to play games on 4.55, if you are on 4.55, you can play online. What the other user asked for was if he stayed on 4.53, he can't use online, and wanted to know if he could use his ODE on 4.53 without burning discs.

Yes, 2.0 is universal, you can use it on any model, any firmware version. There is no need for duct tape, that is only for E3. For Cobra, you don't need it, but you need to solder one wire and the installation manual was updated with instructions on how and where to solder it.

StevenTj's Avatar
#670 - StevenTj - 28w ago
Use sen enabler for it

addicts93's Avatar
#669 - addicts93 - 28w ago
can i use mmCM spoof with the Rogero's 4.50 cfw ?

Sponsored Links

Sponsored Links
Sponsored Links

Sponsored Links







Affiliates - Contact Us - PS3 Downloads - Privacy Statement - Site Rules - Top - © 2014 PlayStation 3 News