86w ago - Following up on the initial PS3 JailBreak 2 news comes various PS3 CFW JailBreak 2 and JB2 Updater details today including the examination of an EBOOT.BIN from the Driver: San Francisco Blu-ray Disc in comparison to one from an official PS3 Game (BLES00891) Disc with developments on reverse-engineering the PS3 JB2 file dumps and more below.
To begin, whyudie states the following on the PS3 CFW JailBreak 2 and JB2 Updater for PlayStation 3: I just wanted to share this CFW. This CFW is intended more specifically for Jailbreak 2 dongle only. Most likely will not run well without that dongle. Perhaps some developers out there could investigate this CFW, and develop it even better.
If anyone out there want to install this CFW on your PS3. Do it at your own risk!!
JailBreak 2 Dongle Features
Can play backup games that require firmware 3.60 + (Direct boot just like the original games)
Only burned BD Disc format with some patches will work. For now, there's no info how to make a backup iso to work with this CFW.
Can play backup games from the HDD. PS3 games with FW 3.55 or lower (via internal or external hdd)
Only works on the PS3 with official/custom firmware 3.55, not the downgrade PS3.
What's your source? Have you make a dump from JB2 Dongle?
From my local game store. I live in Indonesia. And I bought the dongle. And get the bonus cd and the CFW files is from that cd. And that CFW must be installed first on PS3, and upgrade the dongle with that pkg files.
Driver: San Francisco EBOOT from Blu-ray Disc courtesy of lindwurm:
Driver: San Francisco EBOOT (BLES00891) from original PS3 game disc courtesy of elser1:
Driver: San Francisco EBOOT (Untested, Generated by SiLENTGame)
UPLAY SELF (Untested, Patched by SiLENTGame)
FIFA 12 EBOOT from Blu-ray Disc courtesy of lindwurm:
Sniper Ghost EBOOT from Blu-ray Disc courtesy of lindwurm:
Sakunchai also states the following on examination of the PS3 JB2 dump: I find 1 point not same in original FW in lv2_kernel.self
Also below are some related PlayStation 3 JB2 files from 3muk and ireggae among others and a preliminary PS3 JB2 RE examination, as follows:
Here is the files changed in the FMW including CORE_OS_PACKAGE.pkg, dev_flash_010.tar.aa.2010_11_27_051337 and dev_flash_016.tar.aa.2010_11_27_051337:
PS3 .PKG File from the dongle, unpacked with an .ELF of the EBOOT included:
PS3 JB2 Reverse Engineering
Below is a preliminary synopsis from moogie via Twitter and ps3devwiki.com/index.php?title=PS3JB2_Reverse_Engineering and ps3devwiki.com/index.php?title=Talk:Keys#sv_iso_spu_module_1.02-3.55:
JB2's dongle updater pkg, its EBOOT.BIN is just an FSELF (fake signed), the Driver: SF eboot fix is also an FSELF, FSELF's are mean't for debug consoles, easier to fself your game, then to actually sign it, you can patch retail FW to run FSELF's, either through the fw, or you can modify PL3, or even, resign the EBOOT.BIN, its nothing special, from the looks of it, they don't have any keys, just debug EBOOT.BIN's.
You don't need that dongle either, just resign the EBOOT.BIN or patch the FW to run FSELF's, their MFW could have these patches, or maybe, their dongle deliver's the patches. I do not know for sure, maybe their dongle does something else entirely, but I know its an FSELF, and you can make that run, without their dongle.
Dongle is DRM to make sure you have the dongle, the firmware 'special' functionality will not work without it. Contentdisc's contain fself'ed eboot.bin's.
Those JB2 eboot.bin stuff, actually isn't debug fself's, but readself says it is its their DRM. Can't be decrypted without their stuff. They have their own keys, which they are signing the EBOOT.BIN's with, I think they are debug eboot's resigned with their stuff.
That's the algo for masterdiscs, ps3gen.dll has the static keys for masterdiscs. You can also get it from sv_iso the sdk tool that generates masterdisc images.
Then you take the decrypted fself and resign it for 3.55 with makeself then swap eboot. I think it should be somewhere in the PS3_Generator_Tools-312.zip in the 3.60 SDK but I'm not finding it, but that's where the master disc stuff is.
Finally, upon examination several users including DanyL, TheLostDeathKnight and bubbleboy have stated that the JB2 doesn't use a new PlayStation 3 exploit nor contain PS3 3.6+ keys, and that the dongle is only used as identification for activating the patch.
For those curious, patching the appldr keys has been done but not made public back with the PS3 3.56 keys so it isn't unfamiliar to most PlayStation 3 developers but unfortunately it is patchable by Sony. A brief outline of the process involved is below, as follows:
Obtain PS3 Debug EBOOT file from Sony's Developer Network via Debug console by one of the following methods:
Boot up your PS3 to the XMB, make sure in debug settings that NP environment is set to “sp-int” or “prod-qa”, sign into PSN (with sp-int or prod-qa credentials, you can use the quick sign-up), and launch the game. If your in luck, it will say an update is available – download it!
To get the URL you have a few options. You could either sniff out the connection with something like Wireshark - that takes a bit more setup. Other times the URL is actually passed right to dtccons - so make sure you have the debugging windows open. Or, you could use any number of the PS3 Proxy applications to grab the link.
Those who know their PS3 Game's Title ID and are seeking PS3 Game Update Packages can now use this simple guide to grab them while they last.
Patch Retail PS3 Firmware to run a Debug EBOOT file
Dump and burn the PS3 3.60+ games to BD-DVD with the included Debug EBOOT file
Add the DRM to the PS3 MFW / CFW that JB2 uses and validate it via the dongle
The above process will likely continue to work until Sony locks down the PS3 Debug EBOOT files.
PS3 JB2 Keys
The encryption keys for PS3 Debug Discs utilized by the PS3 JB2 method can be found below.
key_0: EF4F6A107742E8448BC1F9D8F2481B31 //key_0 is an aes_cfb128 iv
key_0_0: 126C6B5945370EEECA68262D02DD12D2 //key_0_0 is used with iv_0 to generate gen_key_0
key_0_1: D9A20A79666C27D11032ACCF0D7FB501 //key_0_1 is used with iv_0 to generate gen_key_1
key_1: 7CDD0E02076EFE4599B1B82C359919B3 //key_1 is used with iv_0
iv_1: 3BD624020BD3F865E80B3F0CD6566DD0 //iv_1 is used with gen_key_0 and gen_key_1
key_2: 380BCF0B53455B3C7817AB4FA3BA90ED //key_2 + iv_2 are used to generate something from the disk name (id?)
debug_disc_fallback: 67C0758CF4996FEF7E88F90CC6959D66 //this fallback is used if the disk name (id?) is 'PS3_L_DEBUG_DISC'
Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!
i have a true blue will do my best to get a dump for you to proceed where we were stuck for a long time but no it seems like we are going uphill again thanks shadoxi for starting this elf dumper , amazing work cheers triple thumbs up
Then we know the section headers start at 0x17EC228
Last section STRTAB:
ELF64 Section Headers:
Idx Name Type Flags Address Offset Size ES Align LK
029 0001 STRTAB --- 00000000 017EC0F7 0000012C 0000 00000001 000
So elf ends at 0x17EC0F7 + 0x12C. We add padding to 0x17EC228, and insert clean elf64 section headerd dump from original eboot.bin, right? Or does this dump ELF+section headers+some extra stuff we can cut off?
Anybody care to post a dumped elf (raw, with this tool) so i can look at it?
Following up on the previous update, today I am releasing my True Blue USB dongle PS3 ELF dumper which works with any PlayStation 3 Firmware greater than 3.56 to dump the encrypted TB EBOOT / ELF files once they are loaded.
Original 355 -> ok
True Blue CFW v2 -> ok
There are some bugs (size of dump ...) but it works. It's ELF dumper from memory and it work with True Blue cfw v2 and any 3.55 firmware because it doesn't use lv2 peek/poke.
Warning: It will not brick your ps3. But I am not responsible for any damage.
Enable dev_blind with multiman
copy libsysutil_np_trophy.sprx from /dev_blind/sys/external/external to dev_hdd0/ and rename it "orignal_libsysutil_np_trophy.sprx"
copy my modified "libsysutil_np_trophy.sprx" to /dev_blind/sys/external/
load a True blue game from multiman
run your game
wait few minutes (if you get black screen after 3 minutes reboot ps3)
go to ftp
in dev_hdd0/ there are your decrypted DUMPEDBOOT.bin
copy and rename it with another name.
Howto uninstall patch - Two ways:
You could uninstall this patch by replacing modified libsysutil_np_trophy.sprx by orginal libsysutil_np_trophy.sprx
Or update in recovery mode
Thanks to: Ps3dev
1 - Install TB ELF Dumper first as stated in its readme file.
2 - Start Multiman, it will make a dump of multiman eboots, so you must delete it first by browsing to dev_hdd0 then delete all DUMPEDEBOOT.BIN files you found there.
3 - Back to multiman game selection then select any TB game then launch it.
4 - Start the game from XMB then wait for some times until game start.
5 - Exit game now then start multiman again then browse to dev_hdd0 and now you must found a decrypted game dump.
From PlayStation 3 developer deank (via pastebin.com/avcM5iuU) comes a revision as follows:
write_message("Dumping ELF from RAM...\n");
uint64_t ptr= 0x00010000ULL; //ELF offset in RAM;
uint64_t sizeelf = 35*1024*1024; //Need a way to get size of ELF
for(uint8_t i=0; i