44w ago - Not long after the release of the
PS3 3.60 Keys comes the first of several PlayStation 3 releases with the TrueBlue PS3 USB dongle
DRM-infected protection now removed by scene group
DUPLEX!
Download:
DUPLEX PS3 Releases - Ongoing thread, add new game releases here guys!
Below is the release information, from their Max Payne 3 Eboot Patch READNFO PS3 DUPLEX
PS3 NFO as follows:
Release Name: Max.Payne.3.Eboot.Patch.READNFO.PS3-DUPLEX
Date: August 2012
Languages: English
Platform: PS3 CFW 3.55
Genre: Action
- D U P L E X - ▄▄▄
███▄ ■
■▄▄▄▄▄▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▐██▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ █▄▄ ▀▀▀▀▀▀▀▀▀▄▄▄▄▄▄▄■
▒▓████▀▀██▄ ░▒████ ▐█▌▒▓███▀▀██▄▐██ ▒▓███▀▀██▄ ███▄ ▄█▄
▓█████ ███▄ ▒▓████ ▐█▌▓████ ▐██▐██ ▓████ ███ ▐▓██▌ ▓██
▓█████ ▐███ ▓█████ ▐█▌▓████ ▐██▐██ ▓████ ▐▓██▌ ▐██▌
██████ ▐███ ██████ ▐█▌█████ ▐██▌▐██ █████ ▀███ ██▀
██████ ▐███ ▓█████ ▐█▌█████ ▀ ▄███ ▓████▀ ███▀█
██████ ▐███ ██████ ▐█▌█████ ▓████ ▀▀▐██ ▄███ ▐█▄
██████ ████ ██████ ██▌█████ █████ ███▐██ ███ ▓███▌ ██▓
▀█████▄▄███▀ ▀█████▄▄██▌█████ █████▄▄███▐██▄▄███ ▐▓███ ▀█▀
■▀▀▀▀▀▀▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ████▀ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▀██▀▀▄▄▄▄▄▀▀▀▀▀▀▀■
▓ ▀▀▀▀ ▀▓▀
▀ ■ P R O U D L Y P R E S E N T S : ▄■
Max Payne 3 TB Eboot Patch *CRACKED*
Release Info:
When we first read about the TrueBlue USB Dongle we were excited about it. Finally having a way to play FW 3.60+ games on CFW 3.55 again. What a great asset to the scene everyone thought .. until people found out that this USB Dongle was solely made for cashing in! Its only purpose was to check on the DRM the TrueBlue Team added to their 3.55 Eboots. What a shame!
DUPLEX to the rescue! Finally bury your TB dongle because we removed their unnecessary DRM and their Patches will now work on Cfw 3.55 without any dongle or special TB CFW.
Notes:
Copy the files inside the rars into your games usrdir and replace existing ones Tested on Kmeaw CFW 3.55 with Max.Payne.3.PROPER.PS3-DUPLEX more to come ...
Enjoy This Fine DUPLEX Release
From
anonymous also comes another Max Payne 3 Update v1.05 [FW 4.0] Patched for CFW 3.40+ workaround as follows:
Max Payne 3 BLES / BLUS Test EBOOT and Param.sfo:
Download: http://www.mirrorcreator.com/files/RQWCQLZ7/max_payne3_patched_eboots.rar_links
- Max Payne 3 BLES / BLUS Test EBOOT and param.sfo
- The rar has an embedded readme with the pkg links
- Its probably best if they have the common.sdat from the duplex release, though I am not positive.
- They need to backup files, preferable that person has spoofing
- Game update sfo's, don’t replace the Game sfo!!!!
From
CaptainCPS-X: Here you have the PKG files for easy install of this awesome “Anonymous” collaboration! (thanks to hellsing9 to for providing with the files) This is really cool since maybe more 4.0 FW games will be patched in the future by this Anonymous person! Thanks!
US Patch [BLUS-30557]
FIX_340_UP1004-BLUS30557_00-MP3PATCH00000003-A0104-V0100-PE.pkg (51 MB)
Europe Patch [ BLES-00942 ]
FIX_340_EP1004-BLES00942_00-MP3PATCH00000004-A0105-V0100-PE.pkg (51 MB)
Installation instructions:
1- Download your specific PKG (US / EU)
2- Install normally from XMB.
3- Replace the original “common.sdat” from your untouched backup with DUPLEX’s one (
duplex-mp3ebootpatch.part1.rar /
duplex-mp3ebootpatch.part2.rar).
4- Load with multiMAN normally.
Enjoy! SeeYa!
In related PS3 news today,
pr0p0sitionJOE has released several new PlayStation 3 fixes both
HERE and
HERE for those interested.
Update: A second PlayStation 3 scene group named
NRP has also followed suit and released Kidou Senshi Gundam Extreme VS EBOOT PATCH READNFO JPN PS3 NRP. Below are the details from the
PS3 NFO to the release as well:
Release Name: Kidou_Senshi_Gundam_-_Extreme_VS_EBOOT_PATCH_READNFO_JPN_PS3-NRP
NoRePack Presents. It's NoT a repack !
FiLENaME ------ nrp-exvsp
PlaTForM ------ PS3 CFW 3.55
Region ------ Japan
Language ------ Japanese
Supplier ------ Team NoRePack
rlz.Date ------ 2o12-o8-15
Serial ------ BLJS10131
Finally, a hero comes to kick the fcking TB'sass, cheers! And now we want to support dear DUPLEX with this release. Gundam stands on the ground without any dongle or special TB CFW. Works with our release: Kidou_Senshi_Gundam_-_Extreme_VS_JPN_REPACK_JB_PS3-NRP
Let's be the witness of the ruin of TB dynasty. Love & Peace! Enjoy!
iF u LOvE or HATe THiS GAmE, BuY iT ;]
Other related PS3 releases from today:
- Neverdead.Eboot.Patch.DirFix.PS3-DUPLEX
- Tiger.Woods.PGA.Tour.13.Eboot.Patch.PS3-DUPLEX
- Dirt.Showdown.Eboot.Patch.PS3-DUPLEX
- Devil.May.Cry.HD.Collection.Eboot.Patch.PS3-DUPLEX
- Sniper.Elite.V2.Eboot.Patch.PS3-DUPLEX
- Syndicate.Eboot.Patch.PS3-DUPLEX
- Twisted.Metal.Eboot.Patch.PS3-DUPLEX
- Snipers.Invisible.Silent.Deadly.Eboot.Patch.PS3-DUPLEX
- Puss.in.Boots.Eboot.Patch.PS3-DUPLEX
- Assassins.Creed.Revelations.Eboot.Patch.PS3-DUPLEX
- Kidou_Senshi_Gundam_-_Extreme_VS_EBOOT_PATCH_READNFO_JPN_PS3-NRP
- Max.Payne.3.Eboot.Patch.READNFO.PS3-DUPLEX
- Kidou_Senshi_Gundam_UC_EBOOT_PATCH_JPN_PS3-NRP
Here is a
list of the
TB releases for those who need to remove the dongle patched games and overwrite them with the PS3 scene release (Duplex, NRP, etc) fixes as they become available.
In related PS3 hacking news
SGuerrini97 made available a
CoreDump BLES00025 NBA2K7 (Password: BySGuerrini97) stating: Here is the Core Dump + Original self of NBA 2K7 (BLES00025). I made the dump from the original disk, i think that i can dump ALL the originals games.
Also below
harryoke has outlined how he did a PS3 full core dump, as follows:
Download:
PS3 Core Dump /
PS3 Core Dump (Mirror)
Hello there my friends... as you may or may not know i have been looking into the possibility to get a full core dump from my ps3... a few hours ago i was sent a pm from ANON ... here it is....
Hey mate, yeh cfwprophet told something about the ram dump too. you can make a core dump on a dex. here is a quote from him:
'I say it now for the last time: There is NO fself for new games !! TrueBlue use the CoreDump function and a RSX exception to dump the games like i told the scene for over a half year.'
'Take MultiMan 04.02 which is a Retail NPDRM >> enable core dump function >> start MultiMan >> exit to XMB and be surprised'
'The Coredump function is a embended system of the debug FW and get handled of liblv2dbg. The send signal call aka send_signal_to_coredump_handler() and the trigger function are always running and CAN NOT be deactivated.'
He also said that you will get one 250MB file. there you have to search the decrypted file(s). it would be pretty sure that they use this method, because newer games wouldnt have debug eboots or fselfs.
If you open a tb eboot with a hex editor, you will see near at the end , that they stand right after the codes some passages with 'liblv2'. if you open a original eboot , you cant find passages with 'liblv2'. like cfwprophet said, the core dump get handled of 'liblv2dbg' and you can find 'liblv2' passages in tb eboots. so they use coredump pretty sure.
But the problem is to trigger a crash or so. i really dont know. i'm not a dev and dont have an idea. i just wanted to tell you this infos because i saw your post about coredump.
Here you can read more infos: ps3devwiki.com/files/documents/-SONY%20PS3%20SDK%20Documentation/360.01/cell/en/pdf/debug_support/Core_Dump-Overview_e.pdf
And here about liblv2dbg: ps3devwiki.com/files/documents/-SONY%20PS3%20SDK%20Documentation/RTL2.3.0/debug_support/liblv2dbg-Overview_e.pdf
Well i now have a few core dumps ...some were 250mb and a 500mb dump which i have uploaded including the log file...it is in rar format & compressed to 45mb
Hopefully this will lead us to the magic decrypted eboots that we all want. i hope someone with a bit more knowledge than me can use this info.
Just done a quick search of dump for USRDIR found this at address 002530E0
01 00 03 00 00 00 00 00 0F 9A 00 00 2F 64 65 76 5F 62 64 76 64 2F 50 53 33 5F 47 41 4D 45 2F 55 53 52 44 49 52 2F 45 42 4F 4F 54 2E 42 49 4E 00
.........š../dev_bdvd/PS3_GAME/USRDIR/EBOOT.BIN.
And at 05D87600
00 00 00 3C 00 00 03 86 2F 64 65 76 5F 62 64 76 64 2F 50 53 33 5F 47 41 4D 45 2F 55 53 52 44 49 52 2F 45 42 4F 4F 54 2E 42 49 4E 00 33 B0 37 60 33 B0 37 F0 33 B0 38 70 33 B0 38 F0 33 B0 39 80 33 B0 3A 10 33 B0 3A 90 33 B0 22 B0 33 B2 A5 80
...<...†/dev_bdvd/PS3_GAME/USRDIR/EBOOT.BIN.3�7`3�7ð3�8p3�8ð3�9€3�:.3�:.3�"�3��€
At the end of the dump filename you see EBOOT.BIN this tells you where the crash happened... the crash that happened on showtime....the file ends showtime.self. remember have your DEX in system software mode or you wont get a dump
I'm going to upload a 2 more dumps... try comparing the log files to see if there are anything common between them...
Please grab em before links go down: http://www.sendspace.com/file/ycec8y / http://www.sendspace.com/file/vht8zn (Mirror)
This dump is from catherine v1.0 and the decrypted elf starts at 0x1B6B30. BLUS30428. I'd need the original EBOOT.BIN (http://depositfiles.com/files/dn6i70v9o / https://anonfiles.com/file/d0a27bac0230c2c1d46980d0ac428545) to get the rest of the info (and possibly reconstruct the ELF)
If the decrypted eboot is there then maybe we don't need a full dump and a 250mb dump will be ok... i hope this is the case.
You could look at a games filesystem...lets say a file called hello.sprx - replace it with a dummy file with the same filename.. this could cause a crash. even if you do not see the squares in the bottom left hand corner still check that a dump has been achieved... as a few times i didn't notice the squares.
From
badhabit and
sguerrini97: To trigger the core dump you could use samples/sdk/dbg/exception_handler in the 4+ sdk for example using liblv2dbg. I've compiled the exception_handler sample. Then I've made an mself (samples\sdk\lv2\multi-self) that contains as first self the "exception_handler_main.ppu.self" and as second self the original EBOOT (renamed EBOOT.self) of COD MW3 (BLES01430).
Here is it: http://www.mediafire.com/?otqtt5lq97t58be
If I'm right this should cause a core dump of both selfs. I can't test it until tomorrow evening.. If someone wants to test just update to DEX 4.20, put the files from the archive to the fileserving dir (app_home) and execute from the target manager "/app_home/mself-main.ppu.self" then wait.
Trigger a Core Dump from a Retail Original Disk (PS3 DEX 4.20) by
sguerrini97
In conclusion, while it would be miraculous if
Max Louarn,
Paul Owen,
GaryOPA et al had a change of heart and stopped profiting off the PS3 scene with useless DRM devices odds are they already have another dongle scheme in the works for newer PS3 Firmware and plan to con unsuspecting users into forking out more cash unfortunately... so remember this day folks- good things come to those who wait and patience is a virtue.
After swapping back in my original 160GB HDD, I was still getting the 8002F281 error. I ended up having to do a full PS3 Reset and reformat of the 160...
thats a pretty please i'm bored and need something to do thanx to the good ol community lol.
do i need a tb dongle to do this?
Example
scetool -i tb_eboot.bin
• ELF64 Header:
Program Headers Offset 0x0000000000000040
Section Headers Offset 0x00000000017EC228
Then we know the section headers start at 0x17EC228
Last section STRTAB:
• ELF64 Section Headers:
Idx Name Type Flags Address Offset Size ES Align LK
029 0001 STRTAB --- 00000000 017EC0F7 0000012C 0000 00000001 000
So elf ends at 0x17EC0F7 + 0x12C. We add padding to 0x17EC228, and insert clean elf64 section headerd dump from original eboot.bin, right? Or does this dump ELF+section headers+some extra stuff we can cut off?
Anybody care to post a dumped elf (raw, with this tool) so i can look at it?
Download: http://www.filefactory.com/file/1mxrnsbnysb/n/TB_ELF_Dumper.zip / http://www.2shared.com/file/elOEAmgg/TB_ELF_Dumper.html (Mirror) / http://www.mediafire.com/?htg9apb38sxcw9t (Mirror #2) / http://www61.zippyshare.com/v/32707610/file.html (Mirror #3) / http://www.gamefront.com/files/22169441/tbed.zip (Mirror #4) / http://www.mediafire.com/?p2o498r20ep5vic (Mirror #5) / http://cvfzpr.1fichier.com/en/ (Mirror #6) / http://pastie.org/pastes/4582351/text?key=7hrn1g60zcqp0qkmcvq0q / http://pastebin.com/zw6mFauf (Mirror) / http://www.multiupload.nl/H5XU4KMIUD (DUMPEDBOOT.bin and DUMPEDBOOT1.bin) by arnes_king / http://rghost.net/40005638 by gibson25 / http://www.mediafire.com/file/i11zafxgz4caz3j/np_trp_prx.rar (np_trp_prx.rar) / http://uploadmirrors.com/download/1AUM1GKM/np_trp_prx.rar (Mirror) / http://www.uploadmirrors.com/download/1IPWSYTT/DUMPEDBOOT.zip by mellss
Tested on:
• Original 355 -> ok
• True Blue CFW v2 -> ok
• ...
There are some bugs (size of dump ...) but it works. It's ELF dumper from memory and it work with True Blue cfw v2 and any 3.55 firmware because it doesn't use lv2 peek/poke.
Warning: It will not brick your ps3. But I am not responsible for any damage.
HOWTO:
• Enable dev_blind with multiman
• copy libsysutil_np_trophy.sprx from /dev_blind/sys/external/external to dev_hdd0/ and rename it "orignal_libsysutil_np_trophy.sprx"
• copy my modified "libsysutil_np_trophy.sprx" to /dev_blind/sys/external/
• load a True blue game from multiman
• exit multiman
• run your game
• wait few minutes (if you get black screen after 3 minutes reboot ps3)
• exit game
• go to ftp
• in dev_hdd0/ there are your decrypted DUMPEDBOOT.bin
• copy and rename it with another name.
Howto uninstall patch - Two ways:
• You could uninstall this patch by replacing modified libsysutil_np_trophy.sprx by orginal libsysutil_np_trophy.sprx
• Or update in recovery mode
Thanks to: Ps3dev
Brief Guide:
1 - Install TB ELF Dumper first as stated in its readme file.
2 - Start Multiman, it will make a dump of multiman eboots, so you must delete it first by browsing to dev_hdd0 then delete all DUMPEDEBOOT.BIN files you found there.
3 - Back to multiman game selection then select any TB game then launch it.
4 - Start the game from XMB then wait for some times until game start.
5 - Exit game now then start multiman again then browse to dev_hdd0 and now you must found a decrypted game dump.
From PlayStation 3 developer deank (via pastebin.com/avcM5iuU) comes a revision as follows:
Download: http://www.mediafire.com/file/i11zafxgz4caz3j/np_trp_prx.rar (np_trp_prx.rar) / http://uploadmirrors.com/download/1AUM1GKM/np_trp_prx.rar (Mirror)
[code]
// Author: Shadoxi
// Modified:
// Backup the original /dev_flash/sys/external/libsysutil_np_trophy.sprx to /dev_hdd0
// Replace /dev_blind/sys/external/libsysutil_np_trophy.sprx by this sprx
#include
#include
#include
#include
#include
#include
#include
#include
SYS_MODULE_INFO (sceNpTrophyhook, 0, 1, 0 );
SYS_MODULE_START( _start );
SYS_MODULE_STOP ( _stop );
SYS_LIB_DECLARE( sceNpTrophyhook, SYS_LIB_AUTO_EXPORT | SYS_LIB_WEAK_IMPORT );
SYS_LIB_EXPORT ( loader_sprx, sceNpTrophyhook );
int _start(void);
int _stop(void);
void DumpELF_Payload(void);
void loader_sprx(const char* PATH_PRX);
static void write_message (char const * message)
{
unsigned int write_length;
char const * end;
for (end = message; *end != '\0'; ++end);
sys_tty_write(SYS_TTYP_PPU_STDERR, message,end - message, &write_length);
}
void DumpELF_Payload(void)
{
write_message("Dumping ELF from RAM...\n");
int fd;
uint64_t nread;
uint64_t ptr= 0x00010000ULL; //ELF offset in RAM;
uint64_t sizeelf = 35*1024*1024; //Need a way to get size of ELF
char dump_path[30]="/dev_hdd0/RAMDUMP-00.BIN";
for(uint8_t i=0; i