True Blue (TB) and Cobra PS3 JB2 DRM Dongle Payloads WIP

Can I NOT use a dongle and jailbreak a ps3 without it???

I don't have a dongle so can someone with a tb upload a decrypted ghost recon eboot i have an idea please

thats a pretty please i'm bored and need something to do thanx to the good ol community lol.

do i need a tb dongle to do this?

i have a true blue will do my best to get a dump for you to proceed where we were stuck for a long time but no it seems like we are going uphill again thanks shadoxi for starting this elf dumper , amazing work cheers triple thumbs up

shadoxi we can figure out the original ELF size using SCEtool to get this info right? (find start of elf64 header, + size = end of elf)

Example


Then we know the section headers start at 0x17EC228

Last section STRTAB:


So elf ends at 0x17EC0F7 + 0x12C. We add padding to 0x17EC228, and insert clean elf64 section headerd dump from original eboot.bin, right? Or does this dump ELF+section headers+some extra stuff we can cut off?

Anybody care to post a dumped elf (raw, with this tool) so i can look at it?

Following up on the previous update, today I am releasing my True Blue USB dongle PS3 ELF dumper which works with any PlayStation 3 Firmware greater than 3.56 to dump the encrypted TB EBOOT / ELF files once they are loaded.

Download: http://www.filefactory.com/file/1mxrnsbnysb/n/TB_ELF_Dumper.zip / http://www.2shared.com/file/elOEAmgg/TB_ELF_Dumper.html (Mirror) / http://www.mediafire.com/?htg9apb38sxcw9t (Mirror #2) / http://www61.zippyshare.com/v/32707610/file.html (Mirror #3) / http://www.gamefront.com/files/22169441/tbed.zip (Mirror #4) / http://www.mediafire.com/?p2o498r20ep5vic (Mirror #5) / http://cvfzpr.1fichier.com/en/ (Mirror #6) / http://pastie.org/pastes/4582351/text?key=7hrn1g60zcqp0qkmcvq0q / http://pastebin.com/zw6mFauf (Mirror) / http://www.multiupload.nl/H5XU4KMIUD (DUMPEDBOOT.bin and DUMPEDBOOT1.bin) by arnes_king / http://rghost.net/40005638 by gibson25 / http://www.mediafire.com/file/i11zafxgz4caz3j/np_trp_prx.rar (np_trp_prx.rar) / http://uploadmirrors.com/download/1AUM1GKM/np_trp_prx.rar (Mirror) / http://www.uploadmirrors.com/download/1IPWSYTT/DUMPEDBOOT.zip by mellss

Tested on:

• Original 355 -> ok
• True Blue CFW v2 -> ok
• ...

There are some bugs (size of dump ...) but it works. It's ELF dumper from memory and it work with True Blue cfw v2 and any 3.55 firmware because it doesn't use lv2 peek/poke.

Warning: It will not brick your ps3. But I am not responsible for any damage.

HOWTO:

• Enable dev_blind with multiman
• copy libsysutil_np_trophy.sprx from /dev_blind/sys/external/external to dev_hdd0/ and rename it "orignal_libsysutil_np_trophy.sprx"
• copy my modified "libsysutil_np_trophy.sprx" to /dev_blind/sys/external/
• load a True blue game from multiman
• exit multiman
• run your game
• wait few minutes (if you get black screen after 3 minutes reboot ps3)
• exit game
• go to ftp
• in dev_hdd0/ there are your decrypted DUMPEDBOOT.bin
• copy and rename it with another name.

Howto uninstall patch - Two ways:

• You could uninstall this patch by replacing modified libsysutil_np_trophy.sprx by orginal libsysutil_np_trophy.sprx
• Or update in recovery mode

Thanks to: Ps3dev

Brief Guide:

1 - Install TB ELF Dumper first as stated in its readme file.
2 - Start Multiman, it will make a dump of multiman eboots, so you must delete it first by browsing to dev_hdd0 then delete all DUMPEDEBOOT.BIN files you found there.
3 - Back to multiman game selection then select any TB game then launch it.
4 - Start the game from XMB then wait for some times until game start.
5 - Exit game now then start multiman again then browse to dev_hdd0 and now you must found a decrypted game dump.

From PlayStation 3 developer deank (via pastebin.com/avcM5iuU) comes a revision as follows:

Download: http://www.mediafire.com/file/i11zafxgz4caz3j/np_trp_prx.rar (np_trp_prx.rar) / http://uploadmirrors.com/download/1AUM1GKM/np_trp_prx.rar (Mirror)
[code]
// Author: Shadoxi
// Modified:

// Backup the original /dev_flash/sys/external/libsysutil_np_trophy.sprx to /dev_hdd0
// Replace /dev_blind/sys/external/libsysutil_np_trophy.sprx by this sprx


#include
#include

#include
#include

#include
#include
#include
#include

SYS_MODULE_INFO (sceNpTrophyhook, 0, 1, 0 );
SYS_MODULE_START( _start );
SYS_MODULE_STOP ( _stop );

SYS_LIB_DECLARE( sceNpTrophyhook, SYS_LIB_AUTO_EXPORT | SYS_LIB_WEAK_IMPORT );
SYS_LIB_EXPORT ( loader_sprx, sceNpTrophyhook );

int _start(void);
int _stop(void);
void DumpELF_Payload(void);
void loader_sprx(const char* PATH_PRX);

static void write_message (char const * message)
{
unsigned int write_length;
char const * end;
for (end = message; *end != '\0'; ++end);
sys_tty_write(SYS_TTYP_PPU_STDERR, message,end - message, &write_length);
}

void DumpELF_Payload(void)
{
write_message("Dumping ELF from RAM...\n");
int fd;
uint64_t nread;
uint64_t ptr= 0x00010000ULL; //ELF offset in RAM;
uint64_t sizeelf = 35*1024*1024; //Need a way to get size of ELF

char dump_path[30]="/dev_hdd0/RAMDUMP-00.BIN";
for(uint8_t i=0; i