True Blue (TB) and Cobra PS3 JB2 DRM Dongle Payloads WIP


113w ago - Following up on the previous True Blue (TB) PS3 JailBreak 2 (JB2) DRM-infected dongle news comes a WIP update from Shadoxi on dumping and decrypting the TB and Cobra payloads below, as follows:

Download: TB / Cobra Payloads (2.84 MB) / TB / Cobra Payloads (2.84 MB - Mirror) / TB / Cobra Payloads (2.84 MB - Mirror) / PS3 True Blue MFW (172.19 MB)

I have figured out where the payload is located of the TB and Cobra dongles. You can find it at offset @360000 in lv2_kernel and 7f0000 in PS3 memory. According to the PS3 Developer Wiki (ps3devwiki.com/index.php/ReDRM_/_Piracy_dongles) the LV2 dump payload at 0x7f0000 has also been decrypted @ LV2 dump 0x7f0000 (pastebin.com/3VG76HQs)

Drag and drop payload in IDA and load it in Binary file mode, Processor type PPC.Press "C" to convert in ASM code.

First of all you need to edit the header of lv2_kernel.self (from CFW TrueBlue) at offset 0x1D, replace 36 1A 00 by 4C FC F0. And decrypt it with unself tool from fail0verflow. Open lv2_kernel.elf with IDA Pro (in binary file mode), go to offset 360000 and press "C" to convert to asm code.

TrueBlue use some HVCALL:

  • lv1_insert_htab_entry
  • lv1_undocumented_function_114
  • lv1_undocumented_function_115
  • lv1_allocate_device_dma_region
  • lv1_map_device_dma_region
  • lv1_net_start_tx_dma
  • lv1_net_control
  • lv1_panic (shutdown ps3 when TB is unplugged)

This payload do some HVCALL:

  • lv1_insert_htab_entry (map lv1)
  • lv1_allocate_device_dma_region (?)
  • lv1_map_device_dma_region (?)
  • lv1_net_start_tx_dma (?)
  • lv1_net_control (?)
  • lv1_panic (shutdown ps3 when TrueBlue dongle is unplugged)
  • lv1_undocumented_function_114 (map lv1)
  • lv1_undocumented_function_115 (unmap lv1)

We needed to dump lv2 and lv1 memory when the dongle is plugged in, so I created a modified TB CFW with peek and poke syscall. It works fine !

Finally, from the MFW_TrueBLue.zip ReadMe file: Warning this mfw can brick your dongle !!!

  • First install PS3PEEKTEST.pkg
  • Install MFW TrueBlue firmware in recovery mode
  • Start ps3peektest

If Peek Result is equal to 10 and true blue light is green -> work.




Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!

Comments 860 Comments - Go to Forum Thread »

Quick Reply Quick Reply

niwakun's Avatar
#830 - niwakun - 87w ago
yeah, it's available already in newsgroup

matomato's Avatar
#829 - matomato - 87w ago
New Fix DRM-Free Released by Team Duplex:

- Neverdead.Eboot.Patch.DirFix.PS3-DUPLEX
- Tiger.Woods.PGA.Tour.13.Eboot.Patch.PS3-DUPLEX
- PS3 Dirt.Showdown.Eboot.Patch.PS3-DUPLEX
- Devil.May.Cry.HD.Collection.Eboot.Patch.PS3-DUPLEX
- Sniper.Elite.V2.Eboot.Patch.PS3-DUPLEX
- Syndicate.Eboot.Patch.PS3-DUPLEX
- Twisted.Metal.Eboot.Patch.PS3-DUPLEX
- Snipers.Invisible.Silent.Deadly.Eboot.Patch.PS3-DUPLEX
- Puss.in.Boots.Eboot.Patch.PS3-DUPLEX
- Assassins.Creed.Revelations.Eboot.Patch.PS3-DUPLEX

Hernaner28's Avatar
#828 - Hernaner28 - 87w ago
Just a noobish question: will only TB patches become available for CFW 3.55 or will other games still unfixed get a fix? For example the Amazing spiderman... or any other game unplayable yet.

cfwprophet's Avatar
#827 - cfwprophet - 87w ago
Transient I don't care about fame or credit's i just try to talk to peoples but it is a diff if you talk in public via forums or if you talk private via irc channel's and so on. I never made any mysterious about my finding's but i won't do it puplic any more. Anyway, i already told other's about my finding's in case of the core dump function. It's just thing's like that WHY i mainly don't talk puplic any more. I don't need to proof thing's to any one. If you wan't to know something ask me in private, then trie, and if it works....well you then will see for your self.

One last word about credit's... if i want to have credit's i would release stuff under my public name and not under a "anonymous" name

racer0018 You misunderstood me. I'm still there and do thing's and from time to time you will also see releases under my puplic name. But yea... those are 2 diff world's... the public scene and the underground scene. Really you can't imagine. Everything start underground. And sooner or later it get's public. But the real ongoing is in underground scene.

racer0018's Avatar
#826 - racer0018 - 87w ago
That is the last thing that we need is for you to do that. Are we not working all for the same goal and that is to play newer games without the need for dongles. Just don't give in a go underground. Thanks













Affiliates - Contact Us - PS3 Downloads - Privacy Statement - Site Rules - Top - © 2014 PlayStation 3 News