Sponsored Links

Sponsored Links

JaicraB on Cobra USB JIG Protection RTOC Trick for PS3


Sponsored Links
176w ago - Today Spanish PlayStation 3 developer JaicraB has explained the Cobra USB JIG protection RTOC trick implemented for the PS3 against cloning the device.

To quote, roughly translated: Flynn sent me this text explaining this protective carrying the Cobra, I hope it will open the eyes of those interested in reversing the dumps.

EXPLAIN RTOC COBRA TRICK

The JIG Cobra has several protective measures to ensure that your code could not be used correctly even if your code could be dumped.

This trick RTOC in the registry is the first used for this purpose in addition to hinder analysis.
Registration is initially RTOC stored in the battery to keep the RTOC of lv2 and power it back later:

[Register or Login to view code]


At this point we have to explain that the OFFSET DELTA. DELTA OFFSET is a method used in the x86 in its original moments in the creation of computer viruses, to calculate the memory address in which we are in the sea of ​​bytes in RAM.

In the original time a computer virus when I did not know where he was pulled into an executable,
depending on the executable it could be an initial site or another, for it was invented DELTA OFFSET.

DELTA OFFSET can be used in any system, the procedure is:

  • Using the record that indicates the current execution address (or the next depending on the system)
  • Reducing the size of the previous code we use the value obtained from the registry.

Knowing this, and taking for example the x86 processor where the EIP register can not be read directly invented the trick make a call to a "subfunction" which is simply the following line to the call:

[Register or Login to view code]


X86 call instruction saves the top of the stack the address of the next instruction to itself. Thus using pop draw from the top of the stack this value, and stored in eax for example, and having the memory address where we only subtract the above would be missing and we have the exact calculation.

The PowerPC can use this trick using the BL instruction is equivalent (LINK BRANCH), which jumps to a "subfunction" but before you save LR in the record the following address to BL.

[Register or Login to view code]


At this point we see the trick used for the creation of the RTOC of charges at this time. If you look both r0 and RTOC are passed to 0:

[Register or Login to view code]


Subsequently, given the value 0x11DE0 to RTOC:

[Register or Login to view code]


A r0 is given the value 0x920:

[Register or Login to view code]


R0 is subtracted from the value of RTOC:

[Register or Login to view code]


Unlike the PowerPC x86 LR register can be read directly with mflr instruction, we put in RTOC the value obtained by the delta offset:

[Register or Login to view code]


To calculate the delta offset subtract final instructions executed before the delta offset, which were 4, or 16 bytes:

[Register or Login to view code]


Finally we add the value of r0 at the end of the delta offset RTOC, storing the result in the RTOC and this already takes RTOC suitable for this hook:

[Register or Login to view code]


It takes having the RTOC stored in the stack 3 arguments that the hook received:

[Register or Login to view code]


You call the function of the charges where the first argument will check for command 0x8202 (a special command to the usual):

[Register or Login to view code]


After making the necessary steps as charged, the battery recovers the original RTOC, like the arguments the hook received, it executes the original instruction that was overwritten in the syscall entry 379 (in this case) to have our hook, and call the original syscall lv2:

[Register or Login to view code]


Upon returning to retrieve the original LR from the stack and returns to the prompt

[Register or Login to view code]





Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!

Comments 981 Comments - Go to Forum Thread »

• Please Register at PS3News.com or Login to make comments on Site News articles. Thanks!

dyceast's Avatar
#556 - dyceast - 74w ago
I have read over this a couple of times, and still dont understand the question lol

So after you use psntool for its needs, you then delete multiman? before playing the game?

RCFProd's Avatar
#555 - RCFProd - 74w ago
My issue is quite complicated but I'm hoping someone will help me out. PSN tool v1.0 works for me as long as the Multiman app is on my xmb.

However when I delete Multiman from my xmb (So I can still start it from install package files or /app_home/ if necessary), the PSN tool suddenly doesn't work anymore in this way:

  • Launch PSN Tool
  • Spoofing MAC Address is no problem, PS3 restarts and shows a different MAC address.
  • Launch Multiman, choose a game from external hdd, PS3 goes back to xmb.
  • Launch PSN tool again and spoof Console ID, press [R1] and then [L1] to remove syscalls and check hdd status.
  • Now exiting PSN Tool will make you successfully go back to xmb and launch your game IF you have the separate Multiman app on your XMB.

However having MultiMAN only as install package files and /app_home/ results in the ps3 booting up in recovery mode saying 'ps3 system software cannot be run correctly'.

darksoulnoob's Avatar
#554 - darksoulnoob - 75w ago
Hello, I have multiman 4.19 and was after the next one or latest etc. The simplest usb update please if possible..

Also if I can clarify, just the file I need to update on a usb stick if possible (sometimes there are many files). So the most stable version for my needs please, thank you

I have 80gig fat cfw rebug with the 4.41 rebug spoofer

thank you

i now have this software: [Register or Login to view links]

be very careful to click the right thing and get a zip file not an exe!!!

PS3 News's Avatar
#553 - PS3 News - 75w ago
Below are some Cobra ODE videos and updates from PS3 scene profiteers Max Louarn and Gary Wayne Bowser (aka GaryOPA), as follows:

The wait is over!

After a few months of additional research and development we are proud to announce that the Cobra ODE has been greatly enhanced, making the experience both easier and richer than before. In essence we spent the additional time from time of announcement and to ensure that we can deliver a far superior product.

We have also added homebrew support as well as refinements to the hardware providing a much improved, quicker and easier installation method for 2K5, 3K and 4K users...

Cobra ODE users can now run ISO's and homebrew apps from any PS3***, including previously "unbreakable" 2k5, 3k and 4k models! We have now removed the external UI commander since it is no longer necessary. Now you can browse and launch all homebrew apps/games and PS3 ISO's from the XMB.

Once again, yes, by using with the Cobra ODE you can browse and launch homebrew apps/games and PS3 ISO's from the XMB via the Cobra ODE manager...

The device is easy to install, use and upgrade too!

Simply, Cobra ODE has re-invented the scene, breaking down the barriers once thought to be impenetrable...

The device offers PS3 ISO's, homebrew apps and games, even on the latest 2k5, 3K and 4K systems and is fast and powerful enough to provide plenty of room for expansion of features in the future.....

Production will now commence and stocks will follow to resellers shortly....

Check out the features and PS3 models supported below:

The following consoles are supported:

FAT:

  • CECHA (PATA)
  • CECHB (PATA)
  • CECHC (PATA)
  • CECHE (PATA)
  • CECHG (PATA)
  • CECHH (PATA)
  • CECHK (PATA)
  • CECHL (SATA) (most consoles)***

SLIM:

  • CECH2XXX (SATA)
  • CECH21XX (SATA)
  • CECH25XX (SATA)
  • CECH3XXX (SATA)

SUPER SLIM:

  • CECH4XXX (SATA)

***FAT consoles (SATA) CECHL, CECHM, CECHP and CECHQ with drive controller BMD-21 will be supported in a future hardware iteration.

Feature list:

  • Supports virtually all PS3's including previously "unbreakable" 2k5,3k and 4k systems!
  • Homebrew now possible on previously "unbreakable" 2k5,3k and 4k systems!
  • Play games on SEN in pass-through or emulation modes**!
  • On screen selection of games through Cobra ODE manager in XMB
  • Emulation or pass-through modes
  • Advanced Smart Fusion AES encryption and decryption engine on board
  • Fully updatable high speed FPGA's and high speed secure MCU on board
  • Updatable via USB storage
  • Expansion ports for future proofing
  • Simple and easy to use
  • High quality components used throughout
  • Built at a high tech facility
  • Solderless installation on FAT*** and SLIM (2xxx and 21xx) series
  • Easy installation on 25xx,3xxx and 4xxx series Slim and Super Slim series consoles with QSB (quick solder board)
  • Easy setup for PATA or SATA consoles
  • Advanced software onboard and frequent free updates
  • BD Movie support to follow (In a future update)
  • PS1 and PS2 ISO support to follow (on BC consoles in a future update)
  • PS3 BD game disc dumping on all PS3 consoles is supported and can be enabled through third party managers (dumping throughput will be improved in future updates)

**We cannot guarantee the longetivity of this feature owing to the use of homebrew app to achieve it.










How homebrew works (theory):

[eussNL-] you sign with 3.55 keys as on wiki and use discs as storage media - SELF checks are different when mounted on disc than when inside packages or on local harddrive.... same old crap as always
[eussNL-] see Hyper Visor wiki page

To anyone who is wondering, the homebrews work on the Cobra ODE because the whitelist is skipped from appldr if the self is discbinded.

Mathieulh: twitter.com/Mathieulh/statuses/349079051807371264

This also means the self has to run from a 'genuine' PS3 GAME disc.

Mathieulh: twitter.com/Mathieulh/statuses/349079141938786304

Official Cobra-ODE Supported Consoles

CONSOLES SUPPORTED:

FAT:

  • CECHA (PATA)
  • CECHB (PATA)
  • CECHC (PATA)
  • CECHE (PATA)
  • CECHG (PATA)
  • CECHH (PATA)
  • CECHK (PATA)
  • CECHL (SATA) (most consoles)***

SLIM:

  • CECH2XXX (SATA)
  • CECH21XX (SATA)
  • CECH25XX (SATA)
  • CECH3XXX (SATA)

SUPER SLIM:

  • CECH4XXX (SATA)

***FAT consoles (SATA) CECHL, CECHM, CECHP and CECHQ with drive controller BMD-21 will be supported in a future hardware iteration.

Official Cobra-ODE FAQ

FAQ

Let's start with the questions/statements that we've seen:

Q - [opium2k] The manager looks really ugly!

A - Thanks for the feedback However, the manager has been designed with simplicity and ease of use in mind. We have avoided excessive eye candy in favour of simplicity. Cobra ODE manager can however be modified and replaced by any other homebrew app/manager so long as the communication protocol matches our specs, allowing listing and selection of games.

We will provide at time of release a public domain library which will aid integration into any manager and allow listing and selecting games.

Q - [pinfloydviste] Was that manager the prototype and will be different from the final version ?

A - The final manager will have slightly different graphics, but the overall look and feel will remain the same.

Q - [Falcon80] What other homebrew can run using the COBRA ODE ?

A - Homebrew apps which don't use CFW-specific syscalls should be supported.

Q - [Shrek] Can it disable cinavia ?

A - This is not possible without modification of the system files, which our product does not do.

Q - [Hakuoro] Is the process reversible on 4k models? Can I leave the console the way it was before the ODE installation?

A - 4K consoles require desoldering 4 resistors and soldering of a Quick Solder Board. It would be possible to remove the QSB and resolder the resistors, but would require some care.

In saying that, the Cobra ODE clip on PCB has a switch to select Emulation mode or Passthrough mode. In passthrough mode the ODE hardware is completely bypassed, so this will more than likely be what you are looking for.

Q - [barelynotlegal] Does it look like the blue light is lit [in the video] ?

A - The blue LED is indeed lit. The blue LED will be lit when a valid ISO is detected on the USB storage media. If you disconnect the USB storage, the blue LED will turn off. This is also the reason why when the console is turned off the blue LED is still lit, since the ODE hardware is connected.

Q - [Shady Guy Jose] How do I find out if my CECHL model has a BMD-021 dive ?

A - You need to remove the shielding of your drive and look at the drive PCB to determine model number: (BMD-021 or BMD-031) will be written on the PCB. Please refer to the ps3devwiki for more information: ps3devwiki.com/wiki/Bluray_Drive

Q - [alzaabi] How to play games from the internal HDD? Will the COBRA ODE support external NTFS HDD ?

A - You cannot run games from the internal PS3 HDD. The COBRA ODE does not have access the the PS3's internal HDD. You can connect an external Hard drive or a usb flash drive to the COBRA ODE and it will support both FAT32 as well as NTFS drives.

Here are our answers to the questions/statements/misinformation from the forums:

Q - [TheEvolution_PT] Is it Iker Casillas from real madrid? Why wear those gloves..?

A - The gloves were used for two reasons :P Firstly, to preserve the anonymity of those who helped us with the demo, and secondly, because we thought it would be hilarious.

Q - [wakka1, musashiro] Restarting the PS3 after each game selection looks annoying.

A - We have been testing the product for months, and we're pleased to say that ressarting the system is less annoying than you might imagine. The time needed to press 'quit game' or 'turn off system' is the same, and the time required to boot the PS3 is the same as the time the XMB takes to return after you quit a game, hence the only difference is the option chosen from the in-game XMB.

The reasons for selection of games in this manner are two fold. Firstly, switching to the new game after the console reboots will allow you to change your game selection in case you make an error. Secondly, the PS3 keeps a cache of the inserted disc's structure and even if we did switch the virtual disc on the selection of the game, the PS3 will cannot recognize it until it detects an eject or until reboot.

While we could emulate disc ejection, this would require more complex installation on the newer models such as 2k5, 3k and 4k, which we wanted to avoid. We opted instead for the easiest and most friendly installation possible with a single QSB on newer models and solderless on the older models.

In the interests of consistency in behavior of the ODE on all models, we have chosen to use the method of triggering the game selection upon reboot, and we are sure everyone will like this solution once they get to try it.

Note that restarting the PS3 is only needed when you wish to select your game in the manager. The game you selected will stay selected through several reboots, until you action the 'return to manager' event by either simulating a disc ejection (eject button or 'remove disc' from XMB on fat and slim or open/close the drive cover on the super slim) or by disconnecting or changing the hard drive connected to the ODE.

Q - [saxile, GregoryRasputin] ICO & Shadow of the Colossus is available on PSN.

A - This may be the case, but the COBRA Manager is not, and seeing the COBRA Manager run on the 4k model proves the validity of our product. We have used ICO & Shadow of Colossus (retail disc version) in the demo for two reasons, firstly, because the game is small enough for the USB Stick which we used, and we wanted to show the COBRA ODE working with both USB flash drives/ USB sticks and USB Hard Drives in our video demos. We also wanted to show that game since it's a special, as it executes separate .self files other than the main EBOOT.BIN, one for each of the individual games.

Q - [felino_31, mrKruger] Can a new hacked firmware/CFW be developed for the 3k and 4k through the ODE ?

A - Unfortunately not. The firmware on 2k5/3k/4k consoles can not be modified in any way due to the new security checks with lv0.2 signatures. The ODE works with the original firmware (OFW and CFW on earlier models)

Q - [carldenning] Was there another PS3 connected to the TV? What was the wire behind the TV?

A - There was no other console or any other trickery invloved in making the video. The cables behind the TV were the power and the antenna that were plugged directly into the wall. We showed the actual HDMI cable going from the PS3 to the TV, nothing in between. There were no other cables coming out of the TV and we do not know of any wall sockets in existence with HDMI connectors.

Q - [mrc1978] Why zoom in and out?

A - Zooming in was required since without doing so, the camera's white balance for the room and the TV's brightness would not match and the content on the TV would not be clearly visible, only a bright white image. We zoomed in at various intervals in the video to allow you to see what was appearing on the screen instead of a small, blurred, very bright image.

Q - [mrKruger] Is there a release date?

A - Production phase has commenced, which means that by the time the factory assembles the boards and tests them. then ships them to retailers, the release date will be upon us. While it is hard to estimate, we believe the ODE should be available in stores in the beginning of July.

Q - [3absiso, hellsing9] Was the Cobra Team working on the security of the device for the 4 past month?

A - Security of the device was completed over a year ago. As we explained in the announcement post, the additional research and development time which has caused the delays was due to a bug in the hardware with a specific drive model, and we had to eradicate that before release. During that time, we discovered a way to vastly improve the product and enhance the experience, in turn making it much easier to install and use the ODE. Consequently, we decided to delay the product a little further and deliver to our users a far superior product overall.

Q - [mrc1978] Can the COBRA ODE be hacked ?

A - Our device is well secured, so it cannot be hacked in the sense that you are referring to. A similar solution cannot be achieved through software only means.

Q - [musashiro] Can this ODE open up an eventual software solution ?

A - We resolutely believe this to be impossible. We do not think the security of the newer firmwares can be bypassed without a hardware device such as ours at this point.

Q - [Abkario] Has the COBRA Team discovered a new exploit or have the 3.56+ private keys ?

A - Unfortunately we have not discovered a new exploit. The method of running homebrew is the result of the hard work of the work of fail0verflow team two years ago, nothing has changed and if our product was ready at that time, it would have worked then just as it does now.

Q - [VIRGINKLM] Can running homebrew be done via a USB dongle instead of an ODE?

A - This is not possible. Had it been possible we would have released Cobra USB 2

Q - [BobbyBlunt] How did you manage to get a homebrew app to launch on PS3 OFW 4.41 ?

A - The only method currently known of getting homebrew running on those firmwares is if they have the 'discbind' flag. Detailed instructions on how to compile your applications or port existing binary .pkg into a valid homebrew .iso will be released with the user manual.

Q - [brenza] Did you make the homebrew work by matching it's SHA1 with one of the whitelisted SHA1? Can other homebrew apps work as well?

A - No, we did not. Following the instructions on the user manual will allow any and all homebrew apps to run on the OFW via the COBRA ODE (although peek and poke syscalls will not be available).

Q - [brenza] Can we bring linux back using the 'homebrew mode' of the ODE?

A - Unfortunately, that is not possible since all linux-enabling homebrew use peek and poke syscalls which are only available on CFW's.

Q - [itskamel] I know some people connected and they have the private keys!

A - We appreciate the sentiment, but unless those people are called "Kaz Hirai" or "Jack Tretton", that is mathematically impossible.

Here are our answers to the questions from the users:

Q - [kalberto] Why do we need to turn off console to chose the game? Can it go directly to the XMB disc game icon ?

A - Please see response given above.

Q - [Brenza] Can we downgrade the 3k/4k models too now ?

A - No, it is not possible to downgrade newer 2k5/3k and 4k models. It could be possible to have write access to the NOR from a homebrew app (untested, but it is highly unlikely). However even if write acces was possible, the downgrade will not achieve anything since those consoles cannot go lower than their factory version, which is for sure an OFW version above the software-hackable 3.55 versions.

Q - [yonut32] What can you tell us about chances of being banned ?

A - We cannot offer any guarantee of any kind in terms of being banned or not, although we do not think it is possible for the PS3 to detect the use of the COBRA ODE. That said, we can not predict the future, thus we do not know what solutions the Sony developers could find for this issue.

We can say however, that it the COBRA ODE is not visible to the PS3. The Cobra ODE emulates the drive, and this gives an almost zero % chance of being banned. The COBRA Manager uses a valid game id from a commercially released PS3 game, thus making it stealthy to the PS3 servers. However, if you use other homebrew applications or if you use a different manager with your COBRA ODE, we cannot guarantee that Sony will not be able to detect it.

Q - [yonut32] Do we need to downgrade the firmware of our console in order to use the COBRA ODE?

A - It is not necessary to upgrade or downgrade the OFW or CFW on your console. Installation is a simple plug and play process on older models and can be installed in less than 5 minutes. Simply open the console, disconnect the drive's cable, connect it to the ODE, then connect the ODE to the drive, close the console, and it will run straight away. With the 2k5/3k/4k models, there is a bit more involved requiring soldering of a quick solder board (QSB). Once this has been completed simply connect the QSB to the ODE, and it is ready to work. No downgrade or modification will be needed to the firmware on your console.

Q - [yonut32] Will the COBRA ODE use the internal hard drive of the PS3?

A - As afore mentioned, the COBRA ODE does not access the internal hard drive of the PS3. You can connect an external hard drive or USB flash drive to the ODE, which allows loading your backups. The COBRA ODE supports external HDDs in both FAT32 and NTFS partitions.

Update: COBRA ODE Loading on PS3 Super Slim 4k Video:




Azrial's Avatar
#552 - Azrial - 76w ago
Just install the .pkg file and that's it really.

Sponsored Links

Sponsored Links
Sponsored Links

Sponsored Links







Advertising - Affiliates - Contact Us - PS3 Downloads - Privacy Statement - Site Rules - Top - © 2014 PlayStation 3 News