39w ago - Following up on the previous update, today I am releasing my True Blue USB dongle PS3 ELF dumper which works with any PlayStation 3 Firmware greater than 3.56 to dump the encrypted TB EBOOT / ELF files once they are loaded.
There are some bugs (size of dump ...) but it works. It's ELF dumper from memory and it work with True Blue cfw v2 and any 3.55 firmware because it doesn't use lv2 peek/poke.
Warning: It will not brick your ps3. But I am not responsible for any damage.
Enable dev_blind with multiman
copy libsysutil_np_trophy.sprx from /dev_blind/sys/external/external to dev_hdd0/ and rename it "orignal_libsysutil_np_trophy.sprx"
copy my modified "libsysutil_np_trophy.sprx" to /dev_blind/sys/external/
load a True blue game from multiman
run your game
wait few minutes (if you get black screen after 3 minutes reboot ps3)
go to ftp
in dev_hdd0/ there are your decrypted DUMPEDBOOT.bin
copy and rename it with another name.
Howto uninstall patch - Two ways:
You could uninstall this patch by replacing modified libsysutil_np_trophy.sprx by orginal libsysutil_np_trophy.sprx
Or update in recovery mode
Thanks to: Ps3dev
1 - Install TB ELF Dumper first as stated in its readme file.
2 - Start Multiman, it will make a dump of multiman eboots, so you must delete it first by browsing to dev_hdd0 then delete all DUMPEDEBOOT.BIN files you found there.
3 - Back to multiman game selection then select any TB game then launch it.
4 - Start the game from XMB then wait for some times until game start.
5 - Exit game now then start multiman again then browse to dev_hdd0 and now you must found a decrypted game dump.
From PlayStation 3 developer deank (via pastebin.com/avcM5iuU) comes a revision as follows:
// Author: Shadoxi
// Backup the original /dev_flash/sys/external/libsysutil_np_trophy.sprx to /dev_hdd0
// Replace /dev_blind/sys/external/libsysutil_np_trophy.sprx by this sprx
SYS_MODULE_INFO (sceNpTrophyhook, 0, 1, 0 );
SYS_MODULE_START( _start );
SYS_MODULE_STOP ( _stop );
SYS_LIB_DECLARE( sceNpTrophyhook, SYS_LIB_AUTO_EXPORT | SYS_LIB_WEAK_IMPORT );
SYS_LIB_EXPORT ( loader_sprx, sceNpTrophyhook );
void loader_sprx(const char* PATH_PRX);
static void write_message (char const * message)
unsigned int write_length;
char const * end;
for (end = message; *end != '\0'; ++end);
sys_tty_write(SYS_TTYP_PPU_STDERR, message,end - message, &write_length);
write_message("Dumping ELF from RAM...\n");
uint64_t ptr= 0x00010000ULL; //ELF offset in RAM;
uint64_t sizeelf = 35*1024*1024; //Need a way to get size of ELF
for(uint8_t i=0; i<100; i++)
if (cellFsOpen(dump_path, CELL_FS_O_RDONLY, &fd, NULL, 0) != CELL_FS_SUCCEEDED)
cellFsOpen(dump_path, CELL_FS_O_CREAT|CELL_FS_O_RDWR|CELL_FS_O_TRUNC, &fd, NULL, 0);
cellFsWrite(fd, (void*)ptr, sizeelf, &nread);
void loader_sprx(const char* PATH_PRX)
sys_prx_id_t prx_id ;
write_message ("Loading original prx... ");
prx_id = sys_prx_load_module(PATH_PRX, 0, NULL);
if (prx_id <= CELL_OK)
write_message ("Done!\n\nStarting module... ");
if(sys_prx_start_module( prx_id, 0, NULL, &modres, 0, NULL) != CELL_OK)
write_message ("By shadoxi\n");
// place here original libsysutil_np_trophy.sprx
Doesn't stop dumping when it reaches embedded ELF
Dumps 35MB of RAM in one write call (so it takes ~1 second)
Dumps are saved in /dev_hdd0/RAMDUMP-##.BIN where ## is from 00 to 99 for 100 sequential dumps
Doesn't really require the original sprx, since loading never succeeds anyway
Tested: dumps mM, Beyond Good&Evil HD PSN...
Rebuilding the original 'elf' takes few minutes if you know what you're doing
Finally, from mellss: I tested shadoxi patch, in ofw 3.55 dex and 3.55 cfw it work fine (but like he said some buggy with size of dump). And also let him time to dump all memory!!! (it take for me around ~10 - 20 min !!!)
dumpedboot.bin -> decrypt EBOOT.bin fifa 953 ko (original eboot 68 ko) -> winhex offset of decrypted elf 0x0 to 0xEA60 ~61 ko
dumpedboot1.bin -> decrypt fifazf.elf 25 mo (original self 35 mo) -> need to increase size of dump to 35 mo
I make a fself EBOOT.bin (4.11 dex) which load reencrypted (flself) shadoxi patch and YES his patch dump my eboot and also some 4.11 dex lib sprx !!! So if someone can run shadoxi or deank patch when a game is running we can get decrypted 4.xx EBOOT.
I think TB team load the decrypted eboot to another offset in memory, that's why some of people get ps3 crash when TB was plugged. But, We can get this new offset by editing shadoxi exploit and print the address of a variable (stack address) to get the new one.
Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!
Recently and_fis reports that the PS3 Slim 3K series of PlayStation 3 consoles are surfacing on 3.55 Custom Firmware (CFW), leading to speculation of a new DRM-infected JailBreak Software Tanpa dongle or service from Indonesia.
To quote (via ps3crunch.net/forum/threads/5321-3K?p=58294&viewfull=1#post58294) on the (tokoteknologi.com/home/browse/25-consolemesin.html?sef=hc):
For some Indonesian rupies according to the site above you can purchase A 3K console with a Seri CFW 3.55 (RFW Version) installed! Which also comes with a JAILBREAK SOFTWARE TANPA DONGLE as they call it... If this site is real then someone has found a new exploit that allows 300X version ps3 consoles to downgrade to 3.55 cfw. They have also locked this to a new drm dongle... Let the games begin again!
Rp 3.700.000,00 or about $320 usa, for a base model 160 gb ps3
The only way this would be possiable is if they used hardware to somehow reflash the syscon. that is where the hash checks are that determine the lowest firmware you can have...or they were able to use a hardware flasher and a cfw that had all the hash checks removed.
Or changed and reflashed a cfw that the ps3 "thought" was the right firmware... IDK there is nothing on wiki about either processes
From Abkarino: I know this seller and i talked with him and have a deal 1 and half month ago, they offer me a pre-moded 3K console and they does not sell the modchip/method used to do that. Also he claim that this console uses a special modified CFW based on Rogero CFW.
Also they had used some kind of modchip/flasher to do that. Also he told me that there is a modchip under development for hacking 3K console and it must be released around this month, but till now no new news from him.
From and_fis: I found this info (lan.st/showthread.php?t=3313&page=2) from back in 2010 when 3.41 had alot of access and workings... So if it is true that syscon can be written to with a pkg BUT, it would have to be offically signed or a hardware flasher of some sorts would have to be used if a pkg could not. So in theory, it would be possiable to reflash a syscon from a factory install of 3.60 to 3.55
Thanks Abkarino I posted this at the same time you did.. So my suspicions were true about a hardware flasher.. Thank you for the info
From Abkarino: Yea may be they had found a way to reprogram Syscon EEPROM may be they had used an SPI Flasher since SysCon conect to Cell/BE using SPI Bus. I think that they had used a hardware method not a software (sure if this is legit and not a fake, until some one get this console and confirm this news).
Below is a video from dantezteam (via twitter.com/dantezteam/status/244856386469638144) demonstrating what appears to be PSN back online for PS3 3.55 TB CFW using a ppoof method.
The video shows today's date (September 9, 2012) with him downloading files from Sony's PS Store while being connected to PlayStation Network using a new PSN passphrase that has surfaced in encrypted and decrypted format (via ps3devwiki.com/wiki/Online_Connections#Online_Connections).
He is on DEX, uses FAKE PLUS and points the finger showing is ON with a CFW (according to him) 3.55 TB spoof.
In short: He bought borderlands in the video via DEX with PLUS option ON... For me is just another attemp to troll or to give some life to TB, since he says he is using CFW TB 3.55 Spoof. And in the part description he says later I will add the Web.
So he avoided so far any download link and surveys because he knows what happens next: youtube.com/user/dantezteam
From dantezteam comes a FckPSN revision by Chinese developer Luckystar (via bbs.duowan.com/thread-28656355-1-1.html): http://www.multiupload.nl/40S5UPQYVH / http://www.putlocker.com/file/E62645DA4EE9339C (Mirror) / https://anonfiles.com/file/03cb21c25efd41bda59885fd2edfca51 (Mirror #2)
Here is the upstreams and video for those interested: ustream.tv/recorded/25308408 and ustream.tv/recorded/25328218
Finally, below is what redcfw claims is a real TB2 LV2 dump for those interested:
ALL TB2LV2 DUMPs posted before were FAKE!! tb2.51 lv2 dumped on Mar 2012. folks, feel free to study it.
Today /GriFFin reports that OxweB has apparently leaked the True Blue PS3 disc BCA codes (although curiously a source wasn't specified), however, they are now conveniently deemed useless as the DRM-infected USB dongle itself.
To quote: When the True Blue dongle first launched last year, it was originally using 'special' blu-ray discs to play games, instead of just DRMencoded eboots on the HDD.
But even after all the Paradox releases, there was a few games that only were available still on 'special' blu-ray discs. Over the course of last year, various groups try to figure out how to copy these discs, as they were sadly pirate stores that wish to sell them to their customers. Finally have much research the BD-Rom marks called 'BCA Codes' were figured out so they could by copied on normal blu-ray burner.
And now an person by the name 'OxweB' has leaked them onto the 'net, as basically they are useless now, but still it is part of sad scene PS3 history!
These are BCA codes off the TB discs (the barcode on the inner part of the disc).
You to can read them off the disc yourself with a scanner or magnifying glass, they are in binary format (skinny line = 0, Fat line = 1). Binary to HEX and there you go, a code almost ready to be stamped on to a BD-R.
*Note - It's not that simple for regular retail games as there is still the PIC Zone to contend with.
**Note - I realize these aren't overly useful but it's information which is all worth it in the long run.
Finally, in related news from GoD]oF[WaR (via nextgenupdate.com/forums/playstation-3-exploits-hacks/583397-bca.html#post4685403) to quote:
I have done more research on BCA codes, they seem to be the new protection put on games, meaning with these values they can be cracked, and possibly pirated to even non-jailbroken systems.
For those unaware, BCA is the new protection utilized in newer games and with a future editor you can have the BCA codes to use with the a loader which can patch games to run without the needed keys.
There will be a patch released for each game, which is basically 64 bytes of BCA data in the form of a separate text file, that will come with the ISO file (this obviously only applies to scene releases)
IF you have access to a retail copy of the game, then you can obtain the BCA code yourself to patch the game.
Changelog, roughly translated:
New IOS 38 base. dev/mload with powerful features and EHCI driver based in interruptions and more stable
Support for DVD USB Devices: It can run only DVD backups from .iso (original don't work because DVD drivers don't support the Wii format). Remember you must insert a DVD to work at start the program.
Support for BCA datas. You can add it from .ISO offset 0x100 (64 bytes). If this area is filled with zeroes it use one BCA by default (NSMB compatible).
New ioctl 0xda function supported in dip_plugin and new option added for
DVD mode to read the BCA Datas from the original DVD
Support to load games from DVD with alternative DOL (press '2' without
USB device or press the DVD icon from the upper-right corner in the selection game screen)
Support for SD and USB FAT/FAT32: Now you can use cheats codes and loads alternative .dol from the USB 2.0 device (FAT partition is required)
Added alternative dol loader (now support for 5+ dols) for games as Red Steel and othrers (see readme.txt) , New error 002 patch and videomode autodetection patch (for PAL2NTSC, NTSC2PAL and NTSC2PAL60 (use F. PAL60 for this))
Added direct access for Dol Alternative selection
You can load differents ehcmodule.elf from sd:/apps/uloader/
Parental control added: by default the password is 00000 (the last 0 is the 'ENTER', so you can program as new password as XXXX0 ). You can change it from special menu pressing HOME. You can exits from the password box pressing B. Parental control list the last 8 games launched with date/time, enables the password box and fix a new password. Now 00000 disables the Parental Control
Support for covers (less than 200KB 160x224). You can download from internet or adquire covers from the curren tfolder in the SD automatically
Added one option to delete PNG icons/covers
Some bugs fixed (bug with no modchip game instal, for examplel)
Support for multiples WBFS partitions (max 4).
Possiblity to use the alternative cIOS 223 (only to launch games)
Added one option to rename games
Added one option to record the cheats selected from txt files
New usb code and more!
The above thread gives information on BCA codes for the Wii, which could also apply to PS3 games in the same way. Meaning these BCA codes could lead to easily pirating games on all consoles who utilize the BCA algorithm.
After further research, I am under the suspicion that these BCA codes are in fact a lead to playing pirated games (3.60+ games burned to BD/Launched via USB or external HDD - played on 3.55 WITHOUT CFW) possibly on current firmwares with a real developer at hand.
Basically these BCA codes could lead to playing these burned ISO images on 3.55 (No CFW; without 3.60+ keys) and possibly current firmwares.
The BCA codes that True Blue "leaked" are actually the codes to games that have been tested and work on 3.55 OFW. With the use of a new true blue dongle (JB2/Jailbreak2), games played off the BD without 3.60+ keys.
The games that have been tested are the ones listed below;
Driver san Fransisco
God of war Origin
Sniper ghost warrior
I load up Multiman, select Ghost Recon FS and it goes backt o XMB like normal.
I try to run GRFS and it black screens and locks up.
I reboot and load up multiman and it also black screens and locks up.
I reboot WITHOUT the dongle and it finally loads MM.
I copy the file over to the PC, convert from ELF to BIN, put it in GRFS folder.
I reboot WITH the dongle. goto MM select GRFS go back to XMB.
I run GRFS from DVD. It loads up Multiman.
I tried this 3 times and each time its the dump of Multiman NOT GRFS. And the file DOESN'T go, 00, 01, 02 etc, there is only 1 file and its 00. At least v1 gave multiple files but I couldn't get GRFS to work without the tb patched files.