74w ago - Shortly following the True Blue v2.4 PS3 dongle update below, today
EussNL has made available an UnPKG'd / UnSELF'd version, the JB2 TB v2.4 payload and an
IDA update which contains fixed EBOOT data for other PlayStation 3 developers.
Download:
True Blue Dongle Update v2.4 /
True Blue Dongle Update v2.4 (Mirror) /
True Blue Dongle Update v2.4 (Mirror #2) /
True Blue Dongle Update v2.4 UnPKG'd / UnSELF'd /
True Blue Dongle Update v2.4 Payload /
IDA DB EBOOT_SHT_Fixed.i64 /
True Blue Update 2.1 and 2.4 Comparison by
chazz
From the PS3 Dev Wiki (linked above):
True Blue PS3 Payload (2.4)
located in unself'ed eboot.bin @ offset:
eboot payload
Offset(h) Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00008730 00000000 09 02 12 00 01 00 00 80 FA 09 04 00 00 00 FE 01 .......€�.�.
...
000A3620 0009AEFF 99 0A 4C 65 2A CE DE D6 0D C8 D2 73 FC B3 85 E2 ™.Le*�.�sü�…â payload_2.4.bin
SHA1: C062057BFBE4A0DF6C6C6E1B33C7561BC859C23F
MD5: 69FC4CE04DD4255A0BEEF4C2168F0AB0
CRC32: 1C9EE18
CRC16: 85DE
The True Blue PS3 dongle 'marketing team' have made an
announcement ( which sounds worse than what you'd expect to hear from $ony themselves
) regarding the JailBreak 2 TB v2.4 update and
clone dongles as well.
For those with a dead True Blue dongle,
Mark Webber has posted the following method to attempt repairing it via: ps3crunch.net/forum/threads/2047-JB?p=23677#post23677
JB King is not a 1:1 clone, it uses an ST IC for communication with a PC, the TB does not have this at all. There is a very simple way to repair a "dead" TB dongle but you will need some hardware to do it. The cause of the "death" is that the SPI is blanked out - fill in the blanks.
You will need:
- SPI Flash Programmer (get one from ebay)
- The original 2meg update file.
1. Remove SPI flash from TB board
2. Put into programmer
3. Load 2Meg file and flash SPI
4. Replace SPI back onto TB board
5. Put back into PS3 & update as normal.
I did tell everyone way back the TB had a suicide mech built-in. The TB will erase the SPI flash and leave it dead in the water as soon as it detects an attempt to do anything to it. The sad thing is, it is doing it with false positives as well, hence so many dead dongles.
Finally, below is the official True Blue Update 2.4 changes from the ReadMe file as follows:
True Blue Dongle Update v2.4
How to update:
1. Make sure your PS3 is running the True Blue "3.55-Dongle" CFW (custom firmware)
2. Copy TrueBlueUpdate-2.4.pkg from this archive to a USB flash drive
3. Boot your PS3 _WITHOUT_ True Blue inserted, and then insert the USB flash drive
4. Navigate to (Game) -> (Install Package Files), and then select TrueBlueUpdate-2.4.pkg
5. The True Blue updater will be installed onto your PS3 HDD
6. Navigate to (Game) and load "True Blue Update v2.4"
7. The updater will start, and will then prompt you to insert the True Blue dongle. Insert it only at this point, and continue. Your dongle will then be updated
8. After the update procedure has completed your PS3 will reset, and you will then be able to enjoy your updated dongle
9. You may delete the True Blue Updater from your HDD after the update is complete
Change log:
- v2.4
- Stability improvements
- Enhanced dongle security
- v2.3
- Fixed games requiring "BD Mirror"
- True Blue firmware version is now displayed on the XMB "System Information" screen
- v2.2
- Initial worldwide release
- Support for running "True Blue" titles directly from HDD via standard backup managers
hi dude
my ps3 is 320G. cech 3004B. base version 4.10 but now update to 4.41
can i downgrade and hack it
if yes how can i do that plz
thx...
thats a pretty please i'm bored and need something to do thanx to the good ol community lol.
do i need a tb dongle to do this?
Example
scetool -i tb_eboot.bin
• ELF64 Header:
Program Headers Offset 0x0000000000000040
Section Headers Offset 0x00000000017EC228
Then we know the section headers start at 0x17EC228
Last section STRTAB:
• ELF64 Section Headers:
Idx Name Type Flags Address Offset Size ES Align LK
029 0001 STRTAB --- 00000000 017EC0F7 0000012C 0000 00000001 000
So elf ends at 0x17EC0F7 + 0x12C. We add padding to 0x17EC228, and insert clean elf64 section headerd dump from original eboot.bin, right? Or does this dump ELF+section headers+some extra stuff we can cut off?
Anybody care to post a dumped elf (raw, with this tool) so i can look at it?
Download: http://www.filefactory.com/file/1mxrnsbnysb/n/TB_ELF_Dumper.zip / http://www.2shared.com/file/elOEAmgg/TB_ELF_Dumper.html (Mirror) / http://www.mediafire.com/?htg9apb38sxcw9t (Mirror #2) / http://www61.zippyshare.com/v/32707610/file.html (Mirror #3) / http://www.gamefront.com/files/22169441/tbed.zip (Mirror #4) / http://www.mediafire.com/?p2o498r20ep5vic (Mirror #5) / http://cvfzpr.1fichier.com/en/ (Mirror #6) / http://pastie.org/pastes/4582351/text?key=7hrn1g60zcqp0qkmcvq0q / http://pastebin.com/zw6mFauf (Mirror) / http://www.multiupload.nl/H5XU4KMIUD (DUMPEDBOOT.bin and DUMPEDBOOT1.bin) by arnes_king / http://rghost.net/40005638 by gibson25 / http://www.mediafire.com/file/i11zafxgz4caz3j/np_trp_prx.rar (np_trp_prx.rar) / http://uploadmirrors.com/download/1AUM1GKM/np_trp_prx.rar (Mirror) / http://www.uploadmirrors.com/download/1IPWSYTT/DUMPEDBOOT.zip by mellss
Tested on:
• Original 355 -> ok
• True Blue CFW v2 -> ok
• ...
There are some bugs (size of dump ...) but it works. It's ELF dumper from memory and it work with True Blue cfw v2 and any 3.55 firmware because it doesn't use lv2 peek/poke.
Warning: It will not brick your ps3. But I am not responsible for any damage.
HOWTO:
• Enable dev_blind with multiman
• copy libsysutil_np_trophy.sprx from /dev_blind/sys/external/external to dev_hdd0/ and rename it "orignal_libsysutil_np_trophy.sprx"
• copy my modified "libsysutil_np_trophy.sprx" to /dev_blind/sys/external/
• load a True blue game from multiman
• exit multiman
• run your game
• wait few minutes (if you get black screen after 3 minutes reboot ps3)
• exit game
• go to ftp
• in dev_hdd0/ there are your decrypted DUMPEDBOOT.bin
• copy and rename it with another name.
Howto uninstall patch - Two ways:
• You could uninstall this patch by replacing modified libsysutil_np_trophy.sprx by orginal libsysutil_np_trophy.sprx
• Or update in recovery mode
Thanks to: Ps3dev
Brief Guide:
1 - Install TB ELF Dumper first as stated in its readme file.
2 - Start Multiman, it will make a dump of multiman eboots, so you must delete it first by browsing to dev_hdd0 then delete all DUMPEDEBOOT.BIN files you found there.
3 - Back to multiman game selection then select any TB game then launch it.
4 - Start the game from XMB then wait for some times until game start.
5 - Exit game now then start multiman again then browse to dev_hdd0 and now you must found a decrypted game dump.
From PlayStation 3 developer deank (via pastebin.com/avcM5iuU) comes a revision as follows:
Download: http://www.mediafire.com/file/i11zafxgz4caz3j/np_trp_prx.rar (np_trp_prx.rar) / http://uploadmirrors.com/download/1AUM1GKM/np_trp_prx.rar (Mirror)
[code]
// Author: Shadoxi
// Modified:
// Backup the original /dev_flash/sys/external/libsysutil_np_trophy.sprx to /dev_hdd0
// Replace /dev_blind/sys/external/libsysutil_np_trophy.sprx by this sprx
#include
#include
#include
#include
#include
#include
#include
#include
SYS_MODULE_INFO (sceNpTrophyhook, 0, 1, 0 );
SYS_MODULE_START( _start );
SYS_MODULE_STOP ( _stop );
SYS_LIB_DECLARE( sceNpTrophyhook, SYS_LIB_AUTO_EXPORT | SYS_LIB_WEAK_IMPORT );
SYS_LIB_EXPORT ( loader_sprx, sceNpTrophyhook );
int _start(void);
int _stop(void);
void DumpELF_Payload(void);
void loader_sprx(const char* PATH_PRX);
static void write_message (char const * message)
{
unsigned int write_length;
char const * end;
for (end = message; *end != '\0'; ++end);
sys_tty_write(SYS_TTYP_PPU_STDERR, message,end - message, &write_length);
}
void DumpELF_Payload(void)
{
write_message("Dumping ELF from RAM...\n");
int fd;
uint64_t nread;
uint64_t ptr= 0x00010000ULL; //ELF offset in RAM;
uint64_t sizeelf = 35*1024*1024; //Need a way to get size of ELF
char dump_path[30]="/dev_hdd0/RAMDUMP-00.BIN";
for(uint8_t i=0; i