79w ago - Today the True Blue PS3 JB2 v2.2 USB JailBreak dongle update has arrived, and similar to the
first version also came the free True Blue Unpkg'd / Unself'd PKG file and Payload from PlayStation 3 scene hackers!
Download:
True Blue Update v2.2 (PKG) /
True Blue Update v2.2 (PKG) (Mirror) /
True Blue v2.2 User's Guide (PDF) /
True Blue v2.2 User's Guide (PDF) (Mirror) /
True Blue v2.2 Dongle 3.55 CFW /
True Blue v2.2 Dongle 3.55 CFW (Mirror) /
True Blue v2.2 Dongle 3.55 CFW (Mirror #2 for
TrueBlue-3.55-CFW.zip) /
True Blue v2.2 Dongle Update (UnPKG'd/UnSelf'd) /
True Blue v2.2 Payload (BIN)
To quote from the PDF File:
True Blue User Guide v2.2
Introduction
Unlock the true potential of your PS3 with True Blue – keep your PS3 on a homebrew enabled custom firmware, while at the same time enjoying the newest and most popular PS3 games.
Features Include:
- Booting of games designed for PS3 system software v3.6 and above
- Runs your existing games and new v3.6+ games from HDD in conjunction with standard backup managers
- Does not require the power/eject trick
- Custom v3.55 Dongle firmware behaves like OFW when True Blue is not inserted
- Manufactured from highest grade components and Actel based
- Durable and high quality metal case design
- Tough and durable plastic packaging
- Further features to be added as they are developed
- On board 2 MBytes SPI flash
- Supports Fat and Slim PS3 consoles currently running any firmware up to v3.55 and any PS3 which can be downgraded successfully from v3.6+ to v3.55 (NOTE: requires other tools, True Blue cannot downgrade a console)
- Supports all regions of consoles
- Supports all regions of v3.6+ games
- Rock solid crystal oscillator on board for flawless timing
Setting up your PS3
Before you may use True Blue, you must first install the 3.55-Dongle custom firmware onto your PS3. This is similar in function to the well known kmeaw CFW; however it also includes modifications which allow True Blue to operate correctly. The 3.55-Dongle firmware updater is distributed in a file labelled “TrueBlue-3.55-CFW.ZIP”, and may be obtained through an internet search – once you have obtained it, please confirm the validity of the PS3UPDAT.PUP file contained within the ZIP archive by matching with one of the following hashes:
MD5: 43C522F8897D77B6165F95BCF3409090
SHA1: A64B010DB98996C7E53768D37D4D346F271D5950
Once you have confirmed that you have obtained the correct updater file, proceed with the update as follows:
- Obtain a USB storage device such as a USB HDD or USB flash memory stick
- Create a folder on the storage device in which to save the update file. Using a PC, create a folder named “PS3” on the storage device. Within the PS3 folder, create a folder named "UPDATE"
- Copy the PS3UPDAT.PUP file to the “UPDATE” folder created in step 2. Thus, you will have this path structure on your USB storage device: \PS3\UPDATE\PS3UPDAT.PUP
- Boot your PS3 and insert the USB storage device into the PS3
- From the home menu, select (Settings) -> (System Update) -> (Update via Storage Media)
- The PS3 will notify you that the “3.55-Dongle” update was found. Select OK then follow the onscreen instructions to complete the update
- After the update has completed, your PS3 will restart and you now be running the 3.55‐Dongle custom firmware. You may now enjoy the use of the True Blue dongle
(NOTE: The above procedure is only applicable to PS3’s on or below system software v3.55)
Using True Blue
To use True Blue, simply insert the dongle into one of the USB ports on your PS3 and power the system up. Do not remove the dongle at any point while the PS3 is running.
True Blue for the most part functions just like a regular jailbreak/CFW in that you may install and run any homebrew software and all of the standard backup managers are supported. The most notable difference is that games designed for PS3 system software v3.6 and above are also supported.
However, in order to enjoy such titles, you must first obtain special “True Blue versions” which have been modified to function with True Blue. Such modified versions are available for download through the “usual channels” and are clearly labelled as being True Blue compatible.
Once you have obtained True Blue modified games, simply copy them to your PS3 internal or external USB HDD as you would with any usual jailbreak game and launch in the usual manner through any one of the many available backup managers.
Updating True Blue
From time to time, we will release firmware updates for True Blue which will add new features.
Directions and a list of changes will be provided inside the firmware update archive file.
True Blue Dongle Update v2.2
How to update:
1. Make sure your PS3 is running the True Blue "3.55-Dongle" CFW (custom firmware)
2. Copy TrueBlueUpdate-2.2.pkg from this archive to a USB flash drive
3. Boot your PS3 _WITHOUT_ True Blue inserted, and then insert the USB flash drive
4. Navigate to (Game) -> (Install Package Files), and then select TrueBlueUpdate-2.2.pkg
5. The True Blue updater will be installed onto your PS3 HDD
6. Navigate to (Game) and load "True Blue Update v2.2"
7. The updater will start, and will then prompt you to insert the True Blue dongle. Insert it only at this point, and continue. Your dongle will then be updated
8. After the update procedure has completed your PS3 will reset, and you will then be able to enjoy your updated dongle
9. You may delete the True Blue Updater from your HDD after the update is complete
Change log:
- v2.2
- Initial worldwide release
- Support for running "True Blue" titles directly from HDD via standard backup managers
From the PS3 Dev Wiki: ps3devwiki.com/index.php?title=PS3JB2_Reverse_Engineering#Content_Releases
Content Releases
Paradox TB
Note: Releases seen in the wild are full BD content prepatched for TrueBlue. We are only interested in documenting/reversing, so please don't post full links (only stripped).
EBOOT.BIN details
FW analysis
FW Changes (1.0/2.1)
Compared to OFW 3.55:
ofw-vs-jb2.rar
EULA.xml
<str id="msg_updater_10">This update will install PS3 system software version 3.55, modified to support homebrew software and the disc dongle.</str>
Version.txtCORE_OS_PACKAGE.pkg
lv1.self
One patch to lv1_map_htab (lv1 undocumented function 114) to allow for RW mapping of all RAM. So who knows how many other lv1 patches are done at runtime.
file
Offset(h) 00 01 02 03
OFW: 000F5A44 39 20 00 00 li r9,0
TB: 000F5A44 39 20 00 01 li r9,1
memory
Offset(h) 00 01 02 03
OFW: 2d5a44 39 20 00 00 li r9,0
TB: 2d5a44 39 20 00 01 li r9,1 lv2_kernel.self
http://pastie.org/private/onlbfdxjdtaddb9blu0sq
only 1 function change, and a section added
sub_28fe30 is replaced
the new section is loaded at 0x80000000007f0000 (which is where those payloads are being loaded)
lv2_kernel.bin
dev_flash_010.tar.aa.2010_11_27_051337
\dev_flash\vsh\module\nas_plugin.sprx
Offset(h) 00 01 02 03
OFW: 00003250 7C 60 1B 78 mr r0, r3
TB: 00003250 38 00 00 00 li r0, 0
Offset(h) 00 01 02 03
OFW: 00037350 41 9E 00 4C beq- cr7,4c
TB: 00037350 60 00 00 00 nop "standard pkg patches"
dev_flash_016.tar.aa.2010_11_27_051337
\dev_flash\vsh\resource\explore\xmb\category_game.xml
standard app_home and install package files from mfw builder.
http://pastie.org/private/ixsiyvycqmgmcdmv7swcsg
\dev_flash\vsh\resource\explore\xmb\category_video.xml
netflix removed
http://pastie.org/private/4i02xv2onvaezfiy3i56a
Finally, also from the PS3 Developer Wiki: ps3devwiki.com/index.php?title=PS3JB2_Reverse_Engineering#Dongle_2.0
Dongle 2.0
Supposed to be massproduced instead of manually soldered like the 1.0 dongle. Not seen in the wild yet.
Update 2.2
Dongle Updater PKG
True Blue Dongle Update v2.2 - Initial worldwide release
SHA1: 504D53CD6EDFA3382510CCB40CE49F802073FBD4
MD5: A09CBCD5B3AEC31B07D974BEB4AC21FE
CRC32: 82F977CC
CRC16: 92D4
Payload (2.2)
located in unself'ed eboot.bin @ offset:
eboot payload
Offset(h) Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00008690 00000000 09 02 12 00 01 00 00 80 FA 09 04 00 00 00 FE 01 .......€�.�.
...
0007B588 00072EF0 99 0A 4C 65 2A CE DE D6 0D C8 D2 73 FC B3 85 E2 ™.Le*�.�sü�…â SHA1: 69953C9CF60E67E798A22C1016ABCB44A1D42CDF
MD5: F0826BA059B352BC6100647DB7EFDE5F
CRC32: 4B3C2132
CRC16: 8181
lv2 dump (2.2)
payload @ file offset 0x8698 - 0x7b598
http://pastie.org/private/byhfezysb8iz2hed8o2hva
From
an0nym0us: http://pastie.org/pastes/2875491/text
descriptors (2.2)
Start Offset End Offset descriptor Description
00000000 ... 0x0 -
Finally, in related PS3 scene news today
fail0verflow have
Tweeted the following hint on what may be some interesting PlayStation 3 developments to come:
"Don't worry all, we are just warming up the twitter engine - getting ready for more tweeting in December
"
Odds are if it isn't done by other PlayStation 3 hackers beforehand, by December they will have made enough cash on the dongle and release a PSGroove-esque version to the PS3 scene for free... so definitely hold off blowing money on this useless device.
Ok, I got it. So newer consoles have firmwares higher than 3.55 since they need a downgrade. Are there still new PS3s sold with a 3.55 firmware? What ...
thats a pretty please i'm bored and need something to do thanx to the good ol community lol.
do i need a tb dongle to do this?
Example
scetool -i tb_eboot.bin
• ELF64 Header:
Program Headers Offset 0x0000000000000040
Section Headers Offset 0x00000000017EC228
Then we know the section headers start at 0x17EC228
Last section STRTAB:
• ELF64 Section Headers:
Idx Name Type Flags Address Offset Size ES Align LK
029 0001 STRTAB --- 00000000 017EC0F7 0000012C 0000 00000001 000
So elf ends at 0x17EC0F7 + 0x12C. We add padding to 0x17EC228, and insert clean elf64 section headerd dump from original eboot.bin, right? Or does this dump ELF+section headers+some extra stuff we can cut off?
Anybody care to post a dumped elf (raw, with this tool) so i can look at it?
Download: http://www.filefactory.com/file/1mxrnsbnysb/n/TB_ELF_Dumper.zip / http://www.2shared.com/file/elOEAmgg/TB_ELF_Dumper.html (Mirror) / http://www.mediafire.com/?htg9apb38sxcw9t (Mirror #2) / http://www61.zippyshare.com/v/32707610/file.html (Mirror #3) / http://www.gamefront.com/files/22169441/tbed.zip (Mirror #4) / http://www.mediafire.com/?p2o498r20ep5vic (Mirror #5) / http://cvfzpr.1fichier.com/en/ (Mirror #6) / http://pastie.org/pastes/4582351/text?key=7hrn1g60zcqp0qkmcvq0q / http://pastebin.com/zw6mFauf (Mirror) / http://www.multiupload.nl/H5XU4KMIUD (DUMPEDBOOT.bin and DUMPEDBOOT1.bin) by arnes_king / http://rghost.net/40005638 by gibson25 / http://www.mediafire.com/file/i11zafxgz4caz3j/np_trp_prx.rar (np_trp_prx.rar) / http://uploadmirrors.com/download/1AUM1GKM/np_trp_prx.rar (Mirror) / http://www.uploadmirrors.com/download/1IPWSYTT/DUMPEDBOOT.zip by mellss
Tested on:
• Original 355 -> ok
• True Blue CFW v2 -> ok
• ...
There are some bugs (size of dump ...) but it works. It's ELF dumper from memory and it work with True Blue cfw v2 and any 3.55 firmware because it doesn't use lv2 peek/poke.
Warning: It will not brick your ps3. But I am not responsible for any damage.
HOWTO:
• Enable dev_blind with multiman
• copy libsysutil_np_trophy.sprx from /dev_blind/sys/external/external to dev_hdd0/ and rename it "orignal_libsysutil_np_trophy.sprx"
• copy my modified "libsysutil_np_trophy.sprx" to /dev_blind/sys/external/
• load a True blue game from multiman
• exit multiman
• run your game
• wait few minutes (if you get black screen after 3 minutes reboot ps3)
• exit game
• go to ftp
• in dev_hdd0/ there are your decrypted DUMPEDBOOT.bin
• copy and rename it with another name.
Howto uninstall patch - Two ways:
• You could uninstall this patch by replacing modified libsysutil_np_trophy.sprx by orginal libsysutil_np_trophy.sprx
• Or update in recovery mode
Thanks to: Ps3dev
Brief Guide:
1 - Install TB ELF Dumper first as stated in its readme file.
2 - Start Multiman, it will make a dump of multiman eboots, so you must delete it first by browsing to dev_hdd0 then delete all DUMPEDEBOOT.BIN files you found there.
3 - Back to multiman game selection then select any TB game then launch it.
4 - Start the game from XMB then wait for some times until game start.
5 - Exit game now then start multiman again then browse to dev_hdd0 and now you must found a decrypted game dump.
From PlayStation 3 developer deank (via pastebin.com/avcM5iuU) comes a revision as follows:
Download: http://www.mediafire.com/file/i11zafxgz4caz3j/np_trp_prx.rar (np_trp_prx.rar) / http://uploadmirrors.com/download/1AUM1GKM/np_trp_prx.rar (Mirror)
[code]
// Author: Shadoxi
// Modified:
// Backup the original /dev_flash/sys/external/libsysutil_np_trophy.sprx to /dev_hdd0
// Replace /dev_blind/sys/external/libsysutil_np_trophy.sprx by this sprx
#include
#include
#include
#include
#include
#include
#include
#include
SYS_MODULE_INFO (sceNpTrophyhook, 0, 1, 0 );
SYS_MODULE_START( _start );
SYS_MODULE_STOP ( _stop );
SYS_LIB_DECLARE( sceNpTrophyhook, SYS_LIB_AUTO_EXPORT | SYS_LIB_WEAK_IMPORT );
SYS_LIB_EXPORT ( loader_sprx, sceNpTrophyhook );
int _start(void);
int _stop(void);
void DumpELF_Payload(void);
void loader_sprx(const char* PATH_PRX);
static void write_message (char const * message)
{
unsigned int write_length;
char const * end;
for (end = message; *end != '\0'; ++end);
sys_tty_write(SYS_TTYP_PPU_STDERR, message,end - message, &write_length);
}
void DumpELF_Payload(void)
{
write_message("Dumping ELF from RAM...\n");
int fd;
uint64_t nread;
uint64_t ptr= 0x00010000ULL; //ELF offset in RAM;
uint64_t sizeelf = 35*1024*1024; //Need a way to get size of ELF
char dump_path[30]="/dev_hdd0/RAMDUMP-00.BIN";
for(uint8_t i=0; i