Sponsored Links

Sponsored Links

TrueBlue PS3 USB Dongle DRM Protection Removed By DUPLEX!


Sponsored Links
114w ago - Not long after the release of the PS3 3.60 Keys comes the first of several PlayStation 3 releases with the TrueBlue PS3 USB dongle DRM-infected protection now removed by scene group DUPLEX!

Download: DUPLEX PS3 Releases - Ongoing thread, add new game releases here guys!

Below is the release information, from their Max Payne 3 Eboot Patch READNFO PS3 DUPLEX PS3 NFO as follows:

Release Name: Max.Payne.3.Eboot.Patch.READNFO.PS3-DUPLEX
Date: August 2012
Languages: English
Platform: PS3 CFW 3.55
Genre: Action

[Register or Login to view code]

Max Payne 3 TB Eboot Patch *CRACKED*

Release Info:

When we first read about the TrueBlue USB Dongle we were excited about it. Finally having a way to play FW 3.60+ games on CFW 3.55 again. What a great asset to the scene everyone thought .. until people found out that this USB Dongle was solely made for cashing in! Its only purpose was to check on the DRM the TrueBlue Team added to their 3.55 Eboots. What a shame!

DUPLEX to the rescue! Finally bury your TB dongle because we removed their unnecessary DRM and their Patches will now work on Cfw 3.55 without any dongle or special TB CFW.

Notes:

Copy the files inside the rars into your games usrdir and replace existing ones Tested on Kmeaw CFW 3.55 with Max.Payne.3.PROPER.PS3-DUPLEX more to come ...

Enjoy This Fine DUPLEX Release

From anonymous also comes another Max Payne 3 Update v1.05 [FW 4.0] Patched for CFW 3.40+ workaround as follows:

Max Payne 3 BLES / BLUS Test EBOOT and Param.sfo:

Download: [Register or Login to view links]

  • Max Payne 3 BLES / BLUS Test EBOOT and param.sfo
  • The rar has an embedded readme with the pkg links
  • Its probably best if they have the common.sdat from the duplex release, though I am not positive.
  • They need to backup files, preferable that person has spoofing
  • Game update sfo's, don’t replace the Game sfo!!!!

From CaptainCPS-X: Here you have the PKG files for easy install of this awesome “Anonymous” collaboration! (thanks to hellsing9 to for providing with the files) This is really cool since maybe more 4.0 FW games will be patched in the future by this Anonymous person! Thanks!

US Patch [BLUS-30557]

[Register or Login to view links] (51 MB)

Europe Patch [ BLES-00942 ]

[Register or Login to view links] (51 MB)

Installation instructions:

1- Download your specific PKG (US / EU)
2- Install normally from XMB.
3- Replace the original “common.sdat” from your untouched backup with DUPLEX’s one ([Register or Login to view links] / [Register or Login to view links]).
4- Load with multiMAN normally.

Enjoy! SeeYa!

In related PS3 news today, pr0p0sitionJOE has released several new PlayStation 3 fixes both HERE and HERE for those interested.

Update: A second PlayStation 3 scene group named NRP has also followed suit and released Kidou Senshi Gundam Extreme VS EBOOT PATCH READNFO JPN PS3 NRP. Below are the details from the PS3 NFO to the release as well:

Release Name: Kidou_Senshi_Gundam_-_Extreme_VS_EBOOT_PATCH_READNFO_JPN_PS3-NRP

NoRePack Presents. It's NoT a repack !

FiLENaME ------ nrp-exvsp
PlaTForM ------ PS3 CFW 3.55
Region ------ Japan
Language ------ Japanese
Supplier ------ Team NoRePack
rlz.Date ------ 2o12-o8-15
Serial ------ BLJS10131

Finally, a hero comes to kick the fcking TB'sass, cheers! And now we want to support dear DUPLEX with this release. Gundam stands on the ground without any dongle or special TB CFW. Works with our release: Kidou_Senshi_Gundam_-_Extreme_VS_JPN_REPACK_JB_PS3-NRP

Let's be the witness of the ruin of TB dynasty. Love & Peace! Enjoy! iF u LOvE or HATe THiS GAmE, BuY iT ;]

Other related PS3 releases from today:

  • Neverdead.Eboot.Patch.DirFix.PS3-DUPLEX
  • Tiger.Woods.PGA.Tour.13.Eboot.Patch.PS3-DUPLEX
  • Dirt.Showdown.Eboot.Patch.PS3-DUPLEX
  • Devil.May.Cry.HD.Collection.Eboot.Patch.PS3-DUPLEX
  • Sniper.Elite.V2.Eboot.Patch.PS3-DUPLEX
  • Syndicate.Eboot.Patch.PS3-DUPLEX
  • Twisted.Metal.Eboot.Patch.PS3-DUPLEX
  • Snipers.Invisible.Silent.Deadly.Eboot.Patch.PS3-DUPLEX
  • Puss.in.Boots.Eboot.Patch.PS3-DUPLEX
  • Assassins.Creed.Revelations.Eboot.Patch.PS3-DUPLEX
  • Kidou_Senshi_Gundam_-_Extreme_VS_EBOOT_PATCH_READNFO_JPN_PS3-NRP
  • Max.Payne.3.Eboot.Patch.READNFO.PS3-DUPLEX
  • Kidou_Senshi_Gundam_UC_EBOOT_PATCH_JPN_PS3-NRP

Here is a list of the TB releases for those who need to remove the dongle patched games and overwrite them with the PS3 scene release (Duplex, NRP, etc) fixes as they become available.

In related PS3 hacking news SGuerrini97 made available a [Register or Login to view links] (Password: BySGuerrini97) stating: Here is the Core Dump + Original self of NBA 2K7 (BLES00025). I made the dump from the original disk, i think that i can dump ALL the originals games.

Also below harryoke has outlined how he did a PS3 full core dump, as follows:

Download: [Register or Login to view links] / [Register or Login to view links] (Mirror)

Hello there my friends... as you may or may not know i have been looking into the possibility to get a full core dump from my ps3... a few hours ago i was sent a pm from ANON ... here it is....

Hey mate, yeh cfwprophet told something about the ram dump too. you can make a core dump on a dex. here is a quote from him:

'I say it now for the last time: There is NO fself for new games !! TrueBlue use the CoreDump function and a RSX exception to dump the games like i told the scene for over a half year.'

'Take MultiMan 04.02 which is a Retail NPDRM >> enable core dump function >> start MultiMan >> exit to XMB and be surprised'

'The Coredump function is a embended system of the debug FW and get handled of liblv2dbg. The send signal call aka send_signal_to_coredump_handler() and the trigger function are always running and CAN NOT be deactivated.'

He also said that you will get one 250MB file. there you have to search the decrypted file(s). it would be pretty sure that they use this method, because newer games wouldnt have debug eboots or fselfs.

If you open a tb eboot with a hex editor, you will see near at the end , that they stand right after the codes some passages with 'liblv2'. if you open a original eboot , you cant find passages with 'liblv2'. like cfwprophet said, the core dump get handled of 'liblv2dbg' and you can find 'liblv2' passages in tb eboots. so they use coredump pretty sure.

But the problem is to trigger a crash or so. i really dont know. i'm not a dev and dont have an idea. i just wanted to tell you this infos because i saw your post about coredump.

Here you can read more infos: ps3devwiki.com/files/documents/-SONY%20PS3%20SDK%20Documentation/360.01/cell/en/pdf/debug_support/Core_Dump-Overview_e.pdf

And here about liblv2dbg: ps3devwiki.com/files/documents/-SONY%20PS3%20SDK%20Documentation/RTL2.3.0/debug_support/liblv2dbg-Overview_e.pdf

Well i now have a few core dumps ...some were 250mb and a 500mb dump which i have uploaded including the log file...it is in rar format & compressed to 45mb

Hopefully this will lead us to the magic decrypted eboots that we all want. i hope someone with a bit more knowledge than me can use this info.

Just done a quick search of dump for USRDIR found this at address 002530E0

[Register or Login to view code]


And at 05D87600

[Register or Login to view code]


At the end of the dump filename you see EBOOT.BIN this tells you where the crash happened... the crash that happened on showtime....the file ends showtime.self. remember have your DEX in system software mode or you wont get a dump

I'm going to upload a 2 more dumps... try comparing the log files to see if there are anything common between them...

Please grab em before links go down: [Register or Login to view links] / [Register or Login to view links] (Mirror)

This dump is from catherine v1.0 and the decrypted elf starts at 0x1B6B30. BLUS30428. I'd need the original EBOOT.BIN ([Register or Login to view links] / [Register or Login to view links]) to get the rest of the info (and possibly reconstruct the ELF)

If the decrypted eboot is there then maybe we don't need a full dump and a 250mb dump will be ok... i hope this is the case.

You could look at a games filesystem...lets say a file called hello.sprx - replace it with a dummy file with the same filename.. this could cause a crash. even if you do not see the squares in the bottom left hand corner still check that a dump has been achieved... as a few times i didn't notice the squares.

From badhabit and sguerrini97: To trigger the core dump you could use samples/sdk/dbg/exception_handler in the 4+ sdk for example using liblv2dbg. I've compiled the exception_handler sample. Then I've made an mself (samples\sdk\lv2\multi-self) that contains as first self the "exception_handler_main.ppu.self" and as second self the original EBOOT (renamed EBOOT.self) of COD MW3 (BLES01430).

Here is it: [Register or Login to view links]

If I'm right this should cause a core dump of both selfs. I can't test it until tomorrow evening.. If someone wants to test just update to DEX 4.20, put the files from the archive to the fileserving dir (app_home) and execute from the target manager "/app_home/mself-main.ppu.self" then wait.

Trigger a Core Dump from a Retail Original Disk (PS3 DEX 4.20) by sguerrini97





In conclusion, while it would be miraculous if Max Louarn, Paul Owen, GaryOPA et al had a change of heart and stopped profiting off the PS3 scene with useless DRM devices odds are they already have another dongle scheme in the works for newer PS3 Firmware and plan to con unsuspecting users into forking out more cash unfortunately... so remember this day folks- good things come to those who wait and patience is a virtue.




Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!

Comments 860 Comments - Go to Forum Thread »

• Please Register at PS3News.com or Login to make comments on Site News articles. Thanks!

PS3 News's Avatar
#860 - PS3 News - 103w ago
Recently and_fis reports that the PS3 Slim 3K series of PlayStation 3 consoles are surfacing on 3.55 Custom Firmware (CFW), leading to speculation of a new DRM-infected JailBreak Software Tanpa dongle or service from Indonesia.

To quote (via ps3crunch.net/forum/threads/5321-3K?p=58294&viewfull=1#post58294) on the (tokoteknologi.com/home/browse/25-consolemesin.html?sef=hc):

For some Indonesian rupies according to the site above you can purchase A 3K console with a Seri CFW 3.55 (RFW Version) installed! Which also comes with a JAILBREAK SOFTWARE TANPA DONGLE as they call it... If this site is real then someone has found a new exploit that allows 300X version ps3 consoles to downgrade to 3.55 cfw. They have also locked this to a new drm dongle... Let the games begin again!

Rp 3.700.000,00 or about $320 usa, for a base model 160 gb ps3

The only way this would be possiable is if they used hardware to somehow reflash the syscon. that is where the hash checks are that determine the lowest firmware you can have...or they were able to use a hardware flasher and a cfw that had all the hash checks removed.

Or changed and reflashed a cfw that the ps3 "thought" was the right firmware... IDK there is nothing on wiki about either processes

From Abkarino: I know this seller and i talked with him and have a deal 1 and half month ago, they offer me a pre-moded 3K console and they does not sell the modchip/method used to do that. Also he claim that this console uses a special modified CFW based on Rogero CFW.

Also they had used some kind of modchip/flasher to do that. Also he told me that there is a modchip under development for hacking 3K console and it must be released around this month, but till now no new news from him.

From and_fis: I found this info (lan.st/showthread.php?t=3313&page=2) from back in 2010 when 3.41 had alot of access and workings... So if it is true that syscon can be written to with a pkg BUT, it would have to be offically signed or a hardware flasher of some sorts would have to be used if a pkg could not. So in theory, it would be possiable to reflash a syscon from a factory install of 3.60 to 3.55

He is talking about the syscon's eeprom, we can already (at least in private) read and write to it, in fact I am trying to find a way to contact graf_chokolo (he has been absent from irc lately) since he seems somewhat interested in it, at worse I'll add this the wiki's private sections. The syscon's eeprom doesn't seem to be touched on a debug console though, I dumped mine on 3.41, then downgraded to 3.40 and it was still untouched.

I don't know about retail though, I only have one and it's already on 3.41 so I rather not touch it, but I didn't see anything that looks like hashes. Flags are there though. (like the product mode flag, QA flag, debug support flag etc etc...) There are also factory informations stored in there (such as the first firmware flashed at factory) but no hash that I could see, though maybe I overlooked something.

Of course the bootloader wouldn't be in any eeprom, lv0 probably starts and talks to syscon through a vuart in order to read the eeprom content (if the hashes are there) and look at the hashes (to compare them to the digests from the other coreos selfs)


Thanks Abkarino I posted this at the same time you did.. So my suspicions were true about a hardware flasher.. Thank you for the info

From Abkarino: Yea may be they had found a way to reprogram Syscon EEPROM may be they had used an SPI Flasher since SysCon conect to Cell/BE using SPI Bus. I think that they had used a hardware method not a software (sure if this is legit and not a fake, until some one get this console and confirm this news).

PS3 News's Avatar
#859 - PS3 News - 110w ago
Below is a video from dantezteam (via twitter.com/dantezteam/status/244856386469638144) demonstrating what appears to be PSN back online for PS3 3.55 TB CFW using a ppoof method.

The video shows today's date (September 9, 2012) with him downloading files from Sony's PS Store while being connected to PlayStation Network using a new PSN passphrase that has surfaced in encrypted and decrypted format (via ps3devwiki.com/wiki/Online_Connections#Online_Connections).

3.55 / 3.56: saktdlMapxsbsghmq5dhlwrmtsicyijmzntqaLcpgd8ybbetdmsha=jm

[Register or Login to view code]


3.60 / 3.61 / 3.65 / 3.66: c4ce4023bd7e0345feeb0dca80caf487a03b4545a8230a5d41fe9855

3.70 / 3.72 / 3.73 / 3.74 / 4.00: f81c4c14a0cd2c2dc566a885136fd5b51ca847cbb70fcc296b24ec20

4.10 / 4.11: 0e444f4dbd92145de39ab5bff3a23071f9d44db7bcf13e8c455c81f1

[Register or Login to view code]


4.20 / 4.21: t2wSyoqasqb_wndpmdmbhputnokghlupgtpighyrsygfbmrsectfkqOb

[Register or Login to view code]


From Twitter: TB dongle is not needed works on rebug or kmeaw etc .. The method is turn on fake plus go to store and buy plus free games

From hellsing9: Games, PSTORE. (Someone signs out) Borderlands downloading. Closes PSSTORE.

He is on DEX, uses FAKE PLUS and points the finger showing is ON with a CFW (according to him) 3.55 TB spoof.

In short: He bought borderlands in the video via DEX with PLUS option ON... For me is just another attemp to troll or to give some life to TB, since he says he is using CFW TB 3.55 Spoof. And in the part description he says later I will add the Web.

So he avoided so far any download link and surveys because he knows what happens next: youtube.com/user/dantezteam

From dantezteam comes a FckPSN revision by Chinese developer Luckystar (via bbs.duowan.com/thread-28656355-1-1.html): [Register or Login to view links] / [Register or Login to view links] (Mirror) / [Register or Login to view links] (Mirror #2)

Here is the upstreams and video for those interested: ustream.tv/recorded/25308408 and ustream.tv/recorded/25328218





Finally, below is what redcfw claims is a real TB2 LV2 dump for those interested:

Download: [Register or Login to view links]

ALL TB2LV2 DUMPs posted before were FAKE!! tb2.51 lv2 dumped on Mar 2012. folks, feel free to study it.

some IDA list

[Register or Login to view code]


how to hook decKey?

[Register or Login to view code]


PS3 News's Avatar
#858 - PS3 News - 111w ago
Today /GriFFin reports that OxweB has apparently leaked the True Blue PS3 disc BCA codes (although curiously a source wasn't specified), however, they are now conveniently deemed useless as the DRM-infected USB dongle itself.

To quote: When the True Blue dongle first launched last year, it was originally using 'special' blu-ray discs to play games, instead of just DRMencoded eboots on the HDD.

But even after all the Paradox releases, there was a few games that only were available still on 'special' blu-ray discs. Over the course of last year, various groups try to figure out how to copy these discs, as they were sadly pirate stores that wish to sell them to their customers. Finally have much research the BD-Rom marks called 'BCA Codes' were figured out so they could by copied on normal blu-ray burner.

And now an person by the name 'OxweB' has leaked them onto the 'net, as basically they are useless now, but still it is part of sad scene PS3 history!

These are BCA codes off the TB discs (the barcode on the inner part of the disc).

You to can read them off the disc yourself with a scanner or magnifying glass, they are in binary format (skinny line = 0, Fat line = 1). Binary to HEX and there you go, a code almost ready to be stamped on to a BD-R.

*Note - It's not that simple for regular retail games as there is still the PIC Zone to contend with.
**Note - I realize these aren't overly useful but it's information which is all worth it in the long run.

RESISTANCE 3

[Register or Login to view code]


DISGEA 4

[Register or Login to view code]


FIFA2012

[Register or Login to view code]


PES2012

[Register or Login to view code]


XMEN DESTINY

[Register or Login to view code]


BATMAN ARKHAN CITY

[Register or Login to view code]


Finally, in related news from GoD]oF[WaR (via nextgenupdate.com/forums/playstation-3-exploits-hacks/583397-bca.html#post4685403) to quote:

I have done more research on BCA codes, they seem to be the new protection put on games, meaning with these values they can be cracked, and possibly pirated to even non-jailbroken systems.

For those unaware, BCA is the new protection utilized in newer games and with a future editor you can have the BCA codes to use with the a loader which can patch games to run without the needed keys.

There will be a patch released for each game, which is basically 64 bytes of BCA data in the form of a separate text file, that will come with the ISO file (this obviously only applies to scene releases)

IF you have access to a retail copy of the game, then you can obtain the BCA code yourself to patch the game.

Changelog, roughly translated:

  • New IOS 38 base. dev/mload with powerful features and EHCI driver based in interruptions and more stable
  • Support for DVD USB Devices: It can run only DVD backups from .iso (original don't work because DVD drivers don't support the Wii format). Remember you must insert a DVD to work at start the program.
  • Support for BCA datas. You can add it from .ISO offset 0x100 (64 bytes). If this area is filled with zeroes it use one BCA by default (NSMB compatible).
  • New ioctl 0xda function supported in dip_plugin and new option added for
  • DVD mode to read the BCA Datas from the original DVD
  • Support to load games from DVD with alternative DOL (press '2' without
  • USB device or press the DVD icon from the upper-right corner in the selection game screen)
  • Support for SD and USB FAT/FAT32: Now you can use cheats codes and loads alternative .dol from the USB 2.0 device (FAT partition is required)
  • Added alternative dol loader (now support for 5+ dols) for games as Red Steel and othrers (see readme.txt) , New error 002 patch and videomode autodetection patch (for PAL2NTSC, NTSC2PAL and NTSC2PAL60 (use F. PAL60 for this))
  • Added direct access for Dol Alternative selection
  • You can load differents ehcmodule.elf from sd:/apps/uloader/
  • Parental control added: by default the password is 00000 (the last 0 is the 'ENTER', so you can program as new password as XXXX0 ). You can change it from special menu pressing HOME. You can exits from the password box pressing B. Parental control list the last 8 games launched with date/time, enables the password box and fix a new password. Now 00000 disables the Parental Control
  • Support for covers (less than 200KB 160x224). You can download from internet or adquire covers from the curren tfolder in the SD automatically
  • Added one option to delete PNG icons/covers
  • Some bugs fixed (bug with no modchip game instal, for examplel)
  • Support for multiples WBFS partitions (max 4).
  • Possiblity to use the alternative cIOS 223 (only to launch games)
  • Added one option to rename games
  • Added one option to record the cheats selected from txt files
  • New usb code and more!

The above thread gives information on BCA codes for the Wii, which could also apply to PS3 games in the same way. Meaning these BCA codes could lead to easily pirating games on all consoles who utilize the BCA algorithm.

After further research, I am under the suspicion that these BCA codes are in fact a lead to playing pirated games (3.60+ games burned to BD/Launched via USB or external HDD - played on 3.55 WITHOUT CFW) possibly on current firmwares with a real developer at hand.

Basically these BCA codes could lead to playing these burned ISO images on 3.55 (No CFW; without 3.60+ keys) and possibly current firmwares.

The BCA codes that True Blue "leaked" are actually the codes to games that have been tested and work on 3.55 OFW. With the use of a new true blue dongle (JB2/Jailbreak2), games played off the BD without 3.60+ keys.

The games that have been tested are the ones listed below;

  • Fifa 2012
  • Pes 2012
  • Driver san Fransisco
  • God of war Origin
  • X-men Destiny
  • Sniper ghost warrior

Games that are in process of being tested;

  • Resistance 2
  • Disgaea 2
  • Batman Arkham City

POC:




More PlayStation 3 News...

StanSmith's Avatar
#857 - StanSmith - 113w ago
I just tried V2 and it doesn't work.

I load up Multiman, select Ghost Recon FS and it goes backt o XMB like normal.
I try to run GRFS and it black screens and locks up.
I reboot and load up multiman and it also black screens and locks up.
I reboot WITHOUT the dongle and it finally loads MM.
I copy the file over to the PC, convert from ELF to BIN, put it in GRFS folder.
I reboot WITH the dongle. goto MM select GRFS go back to XMB.
I run GRFS from DVD. It loads up Multiman.

I tried this 3 times and each time its the dump of Multiman NOT GRFS. And the file DOESN'T go, 00, 01, 02 etc, there is only 1 file and its 00. At least v1 gave multiple files but I couldn't get GRFS to work without the tb patched files.

imajei's Avatar
#856 - imajei - 113w ago
Can you do ghost recon eboot? please

Sponsored Links

Sponsored Links
Sponsored Links

Sponsored Links







Advertising - Affiliates - Contact Us - PS3 Downloads - Privacy Statement - Site Rules - Top - © 2014 PlayStation 3 News