http://www.ps3news.com PS3 NEWS - PlayStation 3 News - PS3News - PS3News.com - PS3 Games - PS3 Hacks - PS3 Homebrew - PS3 Linux Fri, 15 Aug 2008 21:20:41 CDT en http://www.ps3news.com/PS3Dev/ps3-nand-flow-rebuilder-v3-35-beta-released/ http://www.ps3news.com/PS3Dev/ps3-nand-flow-rebuilder-v3-35-beta-released/ Fri, 15 Aug 2008 21:20:41 CDT NDT PS3 Dev http://www.ps3news.com/PS3Dev/ps3-nand-flow-rebuilder-v3-35-beta-released/ PS3 NAND Flow Rebuilder v3.36 BETA is now out, which fixes a tiny bug.

This tool, although in beta stage, allows you to unscramble the blocks of a PS3 dumps ordering them in a way that the dumps become readable and extractable!

From now on it also allow you to re-scramble back to the original order once you modified the data you want!

It's for study and tests purposes, for experienced people only (devs) that this way can manage the files inside the flashes.

Download Link: PS3 NAND Flow Rebuilder v3.35 BETA

In this updated version you'll find some good news:

1) It's more compatible, it support a larger number of dumps, please try it with your one and if something goes wrong please let me know (through irc, on Efnet, my nick is NDT).

2) It now directly extract the kernel files in an extraction directory (Use the option extract files from dump).

3) You can now re-scramble back a modified dump in order to flash it in your console (Note*1 You need to regenerate ECC, read below).

4) Analyzer has some more informations (it's still alpha, i use it for debug, it's complete only for versions 2.40/2.41).

USAGE:

- UNSCRAMBLE & INTERLEAVE FLASHES / RESCRAMBLE & DEINTERLEAVE FLASHES -

First of all select if you want to unscramble or re-scramble your dump.

The first option is the first you have to use, it unscramble your flashes and interleave them in order to obtain a readable and extractable dump.

Once you modified the unscrambled dump (you can swap files or change some data) the second one allow you to deinterleave the flashes rescrambling them as the original ones are (otherwise dump won't work).

- FILE SELECTION -

"Flash 0" (TOP): Is the flash0 dump file, warning, many USA dumps use the way around names, so if your dump is USA you should try to load Flash1 here instead.

"Flash 1" (BOTTOM): Is the flash1 dump file, warning, many USA dumps use the way around names, so if your dump is USA you should try to load Flash0 here instead.

OUTPUT (INTERLEAVED) file: It's the interleaved file that the tool produce using the UNSCRAMBLE option.

INPUT (INTERLEAVED) file: It's the modified interleaved file from witch the tool rebuild the new flashes (0/1) that you need reflash on PS3.

- ANALYZER -

It's the option that add to the log what's contained in the flashes blocks, the info is in this format:

0000000000.00.01.120.15140.00000#0249 | 00000000.0.1.78.3B24.0000 ==> File-System Root

On the Left there is the OOB block unique data, on the right (after the ==>) there is the analysis, so what the block contains.

It's fully working only for dump versions 2.40/2.41 and it's very slow, it's an alpha debug option.

- EXTRACT FILES FROM DUMP -

This option allow you to extract the kernel files from the dump, it automatically do it for you, if something goes wrong it's because your dump isn't supported yet, please contact me in this case!

You can use even on your modified dump (option "RESCRAMBLE & DEINTERLEAVE FLASHES") to check if you swapped the files correctly.

INSTALL NOTE:

This tool need the .net framework 2.0 in order to work: most computers should have it installed yet, by the way here is the link in case you wonder where to get it: microsoft.com/downloads/details.aspx?familyid=0856eacb-4362-4b0d-8edd-aab15c5e04f5&displaylang=en

NOTE*1:

ECC calculation is still private, i didn't included in the tool because PS3News don't wanna share this information yet because we don't like Sony to patch it right now. It's the only way to change Dump data, please understand it.

GREETINGS:

I'd like to greet all the ppl that helped me in this work: ggparallel, Ein, CJPC, Courier and all the PS3News.com staff :-)

NDT ;-)]]> http://www.ps3news.com/PS3Dev/unscramble-your-ps3-dump-flow-rebuilder-3-21-beta-released-1/ http://www.ps3news.com/PS3Dev/unscramble-your-ps3-dump-flow-rebuilder-3-21-beta-released-1/ Thu, 31 Jul 2008 18:48:04 CDT NDT PS3 Dev http://www.ps3news.com/PS3Dev/unscramble-your-ps3-dump-flow-rebuilder-3-21-beta-released-1/
It's for study and tests purposes, for experienced people only (devs) that this way can manage the files inside the flashes.

As example I included my PS3 dump map, it should help you understanding the dump layout.

Download: PS3 NAND Flow Rebuilder v3.21 BETA

I decided to share the tool early because it need a lot of testing, so, since I'll be in vacation in a few days I thought it would be nice to allow people to begin looking at it meanwhile I return home.

I tested it on like 10 dumps and I noticed that it perfectly worked only on 4 dumps (one was a Debug dump so yes, it works on debug dumps too :), this happen because of the fact I noticed I have to implement another variable in the unscrambling algorithm, my dump didn't needed it so I didn't noticed before of today, well, it's not a big deal, I think I'll manage the problem in the next releases. Have some patience :)

Let me know if you notice any problems using the tool or if you obtain a layout so much different than the example I included.

OPTIONS: ANALYZER is an option that save some info about the extracted blocks in the LOG directory:

flashFileName.EXT/Logs/Flash1RebuiltLog.txt

It only works for Flash1 and it's in a very early stage, it works on 2.40/2.41 dumps and it's very slow.

Treat bad blocks as empty is an option to manage the bad blocks otherwise tool cannot works on such dumps, just leave it always enabled, it shouldn't cause problems.

Note: I noticed that the Infectus USA PS3 dumps often have flash 0/1 inverted, if you notice strange layouts please load the flashes in the way around.

Note 2: In the future release I'll implement a function that will allow the dump to be scrambled back to the original state in order to be reflashed with eventually swapped files, it was already done in the
previous release of Flow Rebuilder so it shouldn't take a big while until I do it.

Note 3: In order to works this tool need the .net framework 2.0: most computers should have it installed yet, by the way here is the link in case you wonder where to get it: http://www.microsoft.com/downloads/details.aspx?familyid=0856eacb-4362-4b0d-8edd-aab15c5e04f5&displaylang=en

I'd like to greet all the ppl that helped me in this work: ggparallel, Ein (you man rocks!), CJPC, Courier and all the PS3News.com staff :-)

NDT ;-)]]> http://www.ps3news.com/PS3Dev/ps3-elfselfprxsprx-ppu-loader-v1-1-for-ida-v5-2-out/ http://www.ps3news.com/PS3Dev/ps3-elfselfprxsprx-ppu-loader-v1-1-for-ida-v5-2-out/ Wed, 16 Jul 2008 02:01:16 CDT PS3 News PS3 Dev http://www.ps3news.com/PS3Dev/ps3-elfselfprxsprx-ppu-loader-v1-1-for-ida-v5-2-out/
This is a PS3 loader for IDA, it lets you open PS3 elf/self/prx/sprx files in IDA. I highly recommend you use this with the PPC-Altivec plug-in also available on this site.

Download: PS3 ELF/SELF/PRX/SPRX PPU Loader v1.1 for IDA v5.2

THIS DOES NOT DECRYPT ANY FILES !!!! That means that for now this loader will ONLY work on unencrypted files. There are a few such files "in the wild" that have been found on Sony update servers and such.

As well as loading the supported PS3 filetypes in both 32bit and 64bit vesions of IDA this also resolves and sets up all imports, exports and syscalls. It also only supports PS3 PPU files as the PS3 SPU CPU is not supported by IDA at this time.]]> http://www.ps3news.com/PS3Dev/ps3-controller-eeprom-dumped-and-service-mode-information/ http://www.ps3news.com/PS3Dev/ps3-controller-eeprom-dumped-and-service-mode-information/ Sun, 13 Jul 2008 23:45:37 CDT CJPC PS3 Dev http://www.ps3news.com/PS3Dev/ps3-controller-eeprom-dumped-and-service-mode-information/ PS3 Downgrade PUP's for PS3 TEST/Debug consoles we recently acquired.

Yes, it does work fine, and we have successfully downgraded a PS3 Test to version 1.00! Version 1.00 is quite neutered for a TEST, about the only thing that works is the ability to run code from a DVD/BD, aside from that just about everything is non-functional.

More to come in those regards, including our ability to install and dump Retail PKG's on a Debug PS3 console!

Now onto the rumors: As we all know, many have been trying (but failing terribly) to dump the EEPROM chip inside the PS3's controller.

Our very own talented Courier successfully removed and dumped the chip, a picture of part of the dump is below and it weighs in at only 512 bytes. The theory is that the controller, after the EEPROM is FF'd, would function like the Jig Battery on a PSP. Although we are going to test this for thoroughness, the general consensus among PS3 Devs is doubtful at best.

Simply put, the PSP was limited in what could be plugged into where: it was UMD, MS, and Battery. MS was used with the files needed, and the battery kicked the PSP into loading off MS, etc.. we all know the story.

Now when it comes to PS3, aside from a Hardware Jig (known as PinJig) to fix the really bad problems, such as a console that wont even start, someone tampering with the NAND's etc, there is also the USBJig. The USBJig works similiar to the Jig Battery, but as the name implies over USB.

Now this isn't rocket science, but with the availability of a USB port, there are countless more complex options on how to trigger Service Mode in a PS3. Since the console is so secure, we highly doubt that FF'ing a simple EEPROM is the trigger.

It is likely some special flags put into a USB device that the PS3 knows the resulting value of (some sort of hash match), at least enough to ensure that it is legitimate, in turn to boot the special files off a USB flash device.

And after that, the PS3 is only in Service Mode! It then needs to be reflashed with yet again special software (which is unavailable outside of SCE), and brought back up from bootloader to full OS, which uses a PC over Ethernet.

In summary, just throwing out wild speculation is fun to do, but the PS3's Service Mode is most likely quite complex to access... if it's not, we will ALL be very surprised!]]> http://www.ps3news.com/PS3Dev/rumor-possible-hardware-exploit-in-ps3-controller/ http://www.ps3news.com/PS3Dev/rumor-possible-hardware-exploit-in-ps3-controller/ Sat, 12 Jul 2008 20:40:20 CDT wicked insanity PS3 Dev http://www.ps3news.com/PS3Dev/rumor-possible-hardware-exploit-in-ps3-controller/
This claim is based primarily on speculation that in the PS3 controller there is a chip that is the same as on PSP, and it is alleged to control Firmware in some fashion.

Info on the chip is available HERE, and a list of IC chips in PS3 is available HERE.

This EEPROM chip may allow Firmware to be installed (when you install Firmware on PS3, you always have to use the controller... before 2.1, you had to plug the controller in via USB).

For those who don't speak Spanish, they are currently looking into the contents of the chip and seeing whether this will lead to anything more.. but have long way to go yet.]]> http://www.ps3news.com/PS3Dev/video-ps3-test-bd-emulator-in-action-more/ http://www.ps3news.com/PS3Dev/video-ps3-test-bd-emulator-in-action-more/ Mon, 07 Jul 2008 01:15:40 CDT CJPC PS3 Dev http://www.ps3news.com/PS3Dev/video-ps3-test-bd-emulator-in-action-more/
After formatting a USB HDD (in this case, a 500GB EIDE Drive hooked to the PS3 via an old USB CDROM enclosure) in the PS3, it is transferred to a PC. Once transferred, a properly decrypted, patched and remastered retail game is written to the drive. The drive is then plugged back in via USB to the PS3 TEST, while off.

The Drive is then turned on, followed by the PS3. Once the PS3 is on the BD-Emulator is set to USB. DEV is for a PS3 TOOL, which has an additional internal HDD for BD-Emulator purposes, and BD Drive is self explanatory. The PS3 then gets rebooted.

n8ZH14lQr44

Upon reboot is where the video starts, it first shows the previous settings in the PS3, and then the game that was remastered, Kane & Lynch: Dead Men is started from BD-Emulator. The BD-Emulator is transparent to the PS3 system, it is accessed and used just like any normal Blu-ray disc is.

The game is then started to the title screen, then is quit and exited back to XMB. Since it works just like a Blu-ray Disc, the BD-Emu isn't much to look at, but it does work great!

On another interesting subject, a resident PS3 Dev has successfully reversed the Debug Disc Layer of encryption, and extracted the Debug Encryption key. Unfortunately, as expected PS3 Retail discs use a different key. He calculated that it would take forever times infinity to pop the Retail key, as there are 2 ^ 128 possible keys.

Precisely, he also wrote a brute forcer for the same kind of key for XBox 360 and got it up to 2 million keys/second, and worked out it would *only* take 5395141535403007094485264.577495 years to guess it.

Even if we got 1 million people working on it full time, you could only divide that number by 1,000,000 so still a HUGE number indeed. :p

Later this week we will share our current progress with the 1.00 Debug Firmware, stay tuned!]]> http://www.ps3news.com/PS3Dev/happy-4th-of-july-ps3-test-downgrade-pups-in-the-wild/ http://www.ps3news.com/PS3Dev/happy-4th-of-july-ps3-test-downgrade-pups-in-the-wild/ Fri, 04 Jul 2008 22:13:23 CDT CJPC PS3 Dev http://www.ps3news.com/PS3Dev/happy-4th-of-july-ps3-test-downgrade-pups-in-the-wild/
But for more explosive news (who doesn't love a pun?) we recently received two special PS3 PUP files from a VERY nice guy. As pictured below, they are PS3 Debug 1.00 (65.5 MB (68,765,224 bytes)) and PS3 Debug 1.50 (72.2 MB (75,762,080 bytes)).

These PUPs, which are the special downgrade PUPs, allow a user to downgrade their PS3 TEST from any version down to it. For example, with the 1.00 SPECIAL Downgrade PUP a user can be on 2.40, install it, and after a reboot be on 1.00!

1.00, which lacks just about every feature but ON/OFF functionality, will then let us upgrade to any DEV firmware above it.

Which brings us to 1.50... Through examining numerous Sony documentation recently, we have read that in the 1.60 Firmware the PS3's kernel memory and user memory are separated, leading us to believe that the kernel memory before hand had much more relaxed access permissions, if any at all.

The current theory (soon to be put to the TEST [another pun] by our resident PS3 Devs) is, using a lower Firmware console to peek around what we can access of the memory, and we might just get lucky! ;)]]> http://www.ps3news.com/PS3Dev/prodg-debugger-and-target-manager-for-ps3-unveiled/ http://www.ps3news.com/PS3Dev/prodg-debugger-and-target-manager-for-ps3-unveiled/ Mon, 30 Jun 2008 18:01:29 CDT CJPC PS3 Dev http://www.ps3news.com/PS3Dev/prodg-debugger-and-target-manager-for-ps3-unveiled/ post, this week we deliver more information on the SN Systems suite of products, specifically the Target Manager and ProDG Debugger for PS3.

As most recall, for ages SN Systems tools have required license files, usually based off a PC's MAC address and only available to licensed developers. We managed to 'acquire' a few for our PS3 Devs, but in addition to those each EXE had to be modified... but it was not a problem for one of our talented DEVs!

In the video below (clear version HERE), it demonstrates adding the SN license file, and showing that it is valid.

Ae7y5rltRyw

After that the Target Manager (which facilitates PC/PS3 communications) is started up, the old TEST removed, and then readded. Upon readding we take a quick browse around the program, while connecting to the PS3. It shows the PS3's IP address, SDK version (at 2.40) among other information.

Next the PS3 Debugger is started up, and we show its base operations. From in here one can load in a SELF, along with the ELF, and debug the code that one has just made. It allows access to registers, memory, and loads of information needed to properly develop a program.

Finally we launch a SELF from the Target Manager. This specific SELF does not return any data from the PS3 to the output window, as like other SELF's requires activity on the PS3 side to trigger debug events. The Target is finally put to bed, by setting it to shutdown.

Stay tuned later this week for a video of the PS3's BD-Emu in action!]]> http://www.ps3news.com/PS3Dev/ps3-nand-flow-rebuilder-v2-30-released/ http://www.ps3news.com/PS3Dev/ps3-nand-flow-rebuilder-v2-30-released/ Thu, 26 Jun 2008 01:05:57 CDT NDT PS3 Dev http://www.ps3news.com/PS3Dev/ps3-nand-flow-rebuilder-v2-30-released/
Download: PS3 NAND Flow Rebuilder v2.30

INTERPOLATE FLASHES SORTING BLOCKS: Using this tool you can build an interleaved file, sorted by block sequence or partition, (it seems that the most useful mode is to sort by block sequence).

This way you can check the files inside the NANDs in a better way because the blocks order is the one that the console use when boot. Then if you sort 2 dumps it's easier to compare them because the files inside them follow the same order.

DEINTERPOLATE INTO NEW FLASHES: This tool can be used on a modified sorted dump, you can modify some bytes or even swap some whole files, the tool will rebuild the NANDS dumps flash0 and flash1 using the original flow order (only this way the dump work) and will compile a log file writing the page in which the ECC needs to be recalculated.

Note: This requires .NET Framework installed to run.

NDT ;-)]]> http://www.ps3news.com/PS3Dev/ps3-dev-update-ps3-firmware-2-36-update-plugs-hole-more/ http://www.ps3news.com/PS3Dev/ps3-dev-update-ps3-firmware-2-36-update-plugs-hole-more/ Tue, 24 Jun 2008 00:31:11 CDT CJPC PS3 Dev http://www.ps3news.com/PS3Dev/ps3-dev-update-ps3-firmware-2-36-update-plugs-hole-more/
So what is the "a lot" part that has gone on lately? Mostly stuff that may eventually lead to newsworthy progress. I myself have recently acquired nearly 1GB of new Sony goodies to play with, and I have been spending much of my freetime examining a lot of the included documentation.

One interesting thing we recently found out is that Sony has released a NEW model PS3 TEST. It is the DECHJ00J/DECHJ00A. It is supported in SDK version 2.17 and later, and features a 40GB Hard Disk Drive, and two USB ports. Like its retail counterpart, it also lacks PS2 hardware, so it can not play PS2 games.

I've also been working with another PS3 Dev on getting ProDG running with TargetManager on my Debug PS3. Up until now, we have been stuck with a neutered version and unfortunately the PS3 ProDG is unlike the old PS2 version, where you can just bypass the License Check and Program Terminate, or use the defunct ZENiTH generator.

Instead, ProDG for PS3 is similar to the PSP version utilizing a client license manager and license text file (ie snl2000.txt), and contrary to popular belief it not only supports PS3 Development TOOLS (ie DECR-1000) but also Debugging Stations (ie DECHA00A) when flashed with v1.8.0 or newer. Needless to say, we finally did it... so that is a minor milestone for us.

Now that you know what I've been busy with, here is a brief rundown of what a few of the other PS3 Devs are currently working on:

Courier is currently awaiting delivery from flurix of a PS3 stuck in Factory/Service Mode (see picture below) with which he plans to dump the PS3's NAND Flashes... then we can begin work on unpacking and examining the flash in hopes of learning more about how to access that mode from within retail PS3 consoles. In doing so, we may be able to force other PS3's into service mode, and with time reflash the units as well.

NDT is still working on swapping Flash Dumps between PS3 consoles. This isn't for the faint-hearted, as just recently his friend gave him a bricked 2.10 JAP console which was upgraded to 2.17... but the friend never dumped 2.17. The goal here is if NDT can successfully swap PS3 Flash Dumps, then he can work on replicating the task for Debug Firmware to Retail consoles which has been his ongoing project. He is also working on comparing and examining the PS3 Flash Dump requests which were filled by ahmet16 recently.

GGParallel has been working on reversing the PS3's BD-EMU structure. It is similiar to an ISO file, but different at the same time. He is also working on gaining more understanding on the PS3's per disc crypt, as well as the disc hash that is stored on development discs. If he succeeds, we should be able to complete a non-(c) utility that will decrypt the disc layer of encryption on development discs, and retail discs if we are lucky! Furthermore we should be able to modify BRDGen to properly master BD-EMU images, for those that want to use it with a TEST, but do not have the proper software.

Finally, in regards to the title of this Site News update... we received word from a little birdie @ Sony just a day or so after PS3 Firmware 2.36 Update's release that it indeed plugs a Web browser hole.

According to the source's documentation, this hole is present in PS3 Firmware up to 2.36. We are awaiting further details from our contact regarding specifics of the Web browser hole to determine how 'useful' it may or may not be, but until then unless you have a reason to update it may be best to remain on PS3 Firmware 2.35 just to be on the safe side.

Additionally, NDT just confirmed for us today that Sony has blocked XVISTAMAN2005's Install Debug Firmware on a Retail PS3 system method in PS3 Firmware 2.36 for those curious. That's it for now!]]> http://www.ps3news.com/PS3Dev/old-but-new-news-ps3-debug-firmware-2-30-leaked/ http://www.ps3news.com/PS3Dev/old-but-new-news-ps3-debug-firmware-2-30-leaked/ Thu, 12 Jun 2008 16:02:19 CDT PS3 News PS3 Dev http://www.ps3news.com/PS3Dev/old-but-new-news-ps3-debug-firmware-2-30-leaked/
The file size is 110 MB (115,403,104 bytes), and it is available from our PS3 Debug Firmware section or download it linked below, however, unless you own a PS3 Debug/TEST console the most it will allow you to do is use XVISTAMAN2005's Install Debug Firmware on a Retail PS3 method to browse the non-functional menus.

Download: PS3 Debug Firmware v2.30 (USA) Update

More to come, another resident PS3 Dev hinted he plans to share something he has been working on here shortly...]]> http://www.ps3news.com/PS3Dev/video-a-peek-at-ps3-test-firmware-2-40/ http://www.ps3news.com/PS3Dev/video-a-peek-at-ps3-test-firmware-2-40/ Sun, 08 Jun 2008 01:43:06 CDT CJPC PS3 Dev http://www.ps3news.com/PS3Dev/video-a-peek-at-ps3-test-firmware-2-40/
Below is a video of it in action, displaying some of the new features. As expected, we can confirm from 2.40 onwards, the system software can be called any time during the gameplay. It appears the in-game XMB does not work while playing PS2 titles, probably the same with PS1 titles as well although we didn't have a PS1 game handy to try.

The video is slightly better quality than the previous PS3 TEST SD Launcher 1.00 Video as video capture was used this time instead of our old camera... as there is no need to view the TEST PS3 in the video this round.

Anyway, more soon... enjoy the video!

Hv-wEdM7yyI]]> http://www.ps3news.com/PS3Dev/pal-ps3-bad-flash-fix-diagram-available/ http://www.ps3news.com/PS3Dev/pal-ps3-bad-flash-fix-diagram-available/ Sat, 07 Jun 2008 16:15:51 CDT NDT PS3 Dev http://www.ps3news.com/PS3Dev/pal-ps3-bad-flash-fix-diagram-available/
Use and 3V 1600 - 1800 Milliampere to feed the NANDS.

Just feed Flash0 and you'll have Flash1 feeded too.

Click image below to enlarge some, or HERE for high res version.]]> http://www.ps3news.com/PS3Dev/ps3-infectus-double-nand-programmer-v1-41-released/ http://www.ps3news.com/PS3Dev/ps3-infectus-double-nand-programmer-v1-41-released/ Fri, 30 May 2008 03:14:20 CDT NDT PS3 Dev http://www.ps3news.com/PS3Dev/ps3-infectus-double-nand-programmer-v1-41-released/
Download: Infectus PS3 Double NAND Programmer v1.41

This version perfectly manage bad blocks, it successfully restored 2 PS3 of friends of mine.

Beware: Take a Cold dump before to reflash your PS3! Warm dumps doesn't works, at least with latest firmwares!

NDT ;-)]]> http://www.ps3news.com/PS3Dev/ps3-nand-dump-interleaver-v1-40-released/ http://www.ps3news.com/PS3Dev/ps3-nand-dump-interleaver-v1-40-released/ Wed, 28 May 2008 14:50:35 CDT NDT PS3 Dev http://www.ps3news.com/PS3Dev/ps3-nand-dump-interleaver-v1-40-released/
Download: PS3 NAND Dump Interleaver v1.40

PS3 NANDS are read and written interleaved, so if someone wants to check the Firmware content he have to use this tool in order to obtain a file that's like the console manage once we turn it on.

It's for study purposes, to allow skilled people to check the PS3 Firmware.

Some notes: Only full dumps should be used with this tool, old dumps without spare data are invalid so they won't output a valid result.

Swap bytes should be enabled, other checkmarks are there for study purposes.

Beware, almost all files are crypted! ...good study :)

NDT ;-)]]> http://www.ps3news.com/PS3Dev/ps3-test-sd-launcher-1-00-video-released/ http://www.ps3news.com/PS3Dev/ps3-test-sd-launcher-1-00-video-released/ Mon, 26 May 2008 02:22:52 CDT CJPC PS3 Dev http://www.ps3news.com/PS3Dev/ps3-test-sd-launcher-1-00-video-released/
A video capture of the PS3 would have been much clearer, but we wanted to show the PS3 in the video as well. It starts from the XMB, and allows non-NPDRM SELF's to be executed from SD card.

In the video you can see the SD Launcher loading and booting to the select screen. There is the ability to "move" throughout the list, and upon hovering on your slot of choice, pressing X.

At the moment the titles and locations are hardcoded, we need to add in support for reading either a filelist or the PARAM.SFO's.

SjkOnZrnAno

The real impressive part of the video is in regards to the Ridge Racer 7 Demo. We obtained the Ridge Racer 7 Demo from an Official PlayStation Magazine Demo Disc. Upon receiving, we decrypted the SELF, rebuilt and patched it. This patching allows us to run the SELF from other devices. We picked this Demo as it was small, around 500MB, as our largest SD card on hand was 1GB.

However, there is an issue with newer games. It seems there is an additional "check" that we have yet to pinpoint. But this does work fine with most older PS3 games, as well as any developmental SELF.

Needless to say, this only works on a Debug/TEST PS3 box... it will not work on a retail PS3 console (yet!)]]> http://www.ps3news.com/PS3Dev/ps3-pup-extractor-v1-00-yet-another-pup-extractor-released/ http://www.ps3news.com/PS3Dev/ps3-pup-extractor-v1-00-yet-another-pup-extractor-released/ Sat, 24 May 2008 03:53:58 CDT NDT PS3 Dev http://www.ps3news.com/PS3Dev/ps3-pup-extractor-v1-00-yet-another-pup-extractor-released/
Download: PS3 PUP Extractor v1.00 / PS3 PUP Extractor v1.00 [Mirror]

It extracts a Sony Update PUP file in a created pupname.EXT dir, and creates a logfile with useful information such as calculated SHA1 and Sony hashes.

Example: File processed: PS3UPDAT.PUP [124 MB (130,517,344 bytes)]

Image Version: 00003B05
N° of files: 6
Header size: 464 bytes
Data size: 130516880 bytes
Header Hash: DF22B91021C3649912DC70DB6FAACF766DE61DAB (Sony HMAC SHA1)
Header SHA1: 807479284EA02E06527D7C7707955188D21FF9FA (Calculated SHA1)

File 1 Name: PS3UPDAT.PUP.EXTSDK_Version.bin
File 1 Offset: 464 (dec.)
File 1 Size: 5 bytes
File 1 Hash: 78770614DF0A66C63BED70B89952C14DFF0AF8DA (Sony HMAC SHA1)
File 1 SHA1: C2CE36FD0B9C18F5AA3DFE76DEE3CFABBDB3C79A (Calculated SHA1)

File 2 Name: PS3UPDAT.PUP.EXTdots.txt
File 2 Offset: 469 (dec.)
File 2 Size: 3 bytes
File 2 Hash: 1AA4749D0EE0D0AE937FBF73BC4B9ACD352F732A (Sony HMAC SHA1)
File 2 SHA1: 6EAE3A5B062C6D0D79F070C26E6D62486B40CB46 (Calculated SHA1)

File 3 Name: PS3UPDAT.PUP.EXTupdater.self
File 3 Offset: 472 (dec.)
File 3 Size: 5568392 bytes
File 3 Hash: FCCCF5A0F4452FB871310A93BED467EDA0CC0843 (Sony HMAC SHA1)
File 3 SHA1: 9228780CB608BB02391723BBE63E0F44C3866037 (Calculated SHA1)

File 4 Name: PS3UPDAT.PUP.EXTvsh.tar
File 4 Offset: 5568864 (dec.)
File 4 Size: 10240 bytes
File 4 Hash: D9B66E0D2845D71A67D76E7907AB06368CE61E08 (Sony HMAC SHA1)
File 4 SHA1: 7D47A706EC0F5EDC3E8251757B7689203D887335 (Calculated SHA1)

File 5 Name: PS3UPDAT.PUP.EXTFile_5.tar
File 5 Offset: 5579104 (dec.)
File 5 Size: 0 bytes
File 5 Hash: B701CBBD3ACE82CAF2E4018E5327AA16637490DE (Sony HMAC SHA1)
File 5 SHA1: DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 (Calculated SHA1)

File 6 Name: PS3UPDAT.PUP.EXTFile_6.tar
File 6 Offset: 5579104 (dec.)
File 6 Size: 124938240 bytes
File 6 Hash: C7032697A0EDC63BB9E8B1022912F5B48ECBF7E2 (Sony HMAC SHA1)
File 6 SHA1: DD46247652F64569C7534ECF08C918C805A0246A (Calculated SHA1)

NDT ;)]]> http://www.ps3news.com/PS3Dev/flowchart-a-ps3-games-flow-of-execution-ps3s-base-aix/ http://www.ps3news.com/PS3Dev/flowchart-a-ps3-games-flow-of-execution-ps3s-base-aix/ Sat, 24 May 2008 03:53:58 CDT CJPC PS3 Dev http://www.ps3news.com/PS3Dev/flowchart-a-ps3-games-flow-of-execution-ps3s-base-aix/
The Flowchart in the image attached below explains a PS3 game's startup procedure from insertion to its execution.

Most of it is self-explanatory upon viewing the chart, however, there are a few notes. Any Retail SELF on a Blu-ray disc is flagged so it can only be decrypted and executed from the disc, and nowhere else.

Furthermore, the PARAM.SFO is also of importance... Upon insertion, the PS3 reads the Title ID of the disc in the PARAM.SFO and inserts it into the DB. Once the game is executed and decrypted, the Title ID is checked yet again to make sure it matches. If it does not (think a disc swap), the PS3 will silently error, and return to XMB.

In a final note, our PS3 Devs have been digging through numerous documents and patents, and came to the conclusion that the PS3 uses AIX (Advanced Interactive eXecutive) as a base! See Wikipedia for more details on the format.

Later this weekend, we will have more details and a video for those interested on how to run some PS3 games on a Debug/TEST PS3 from an SD card! As most are aware, PS3 games aren't designed to run from SD card at all- even after removing all the lovely layers of encryption.]]> http://www.ps3news.com/PS3Dev/ps3-flash-goodies-part-3-the-full-ps3-flash-filelist/ http://www.ps3news.com/PS3Dev/ps3-flash-goodies-part-3-the-full-ps3-flash-filelist/ Tue, 20 May 2008 18:53:23 CDT CJPC PS3 Dev http://www.ps3news.com/PS3Dev/ps3-flash-goodies-part-3-the-full-ps3-flash-filelist/ recent news of PS3 retail "trickery" going on, this post got postponed (mind the pun) until today.

The image below is a snippet of the FULL PS3 Flash FileList for the PS3's /dev_flash. It should be noted that the PS3 also has a /dev_flash2 and /dev_flash3, which upon rare occasion is updated, however we are not able to access them yet due to some pesky Kernel/Hypervisor issues.

The list is quite juicy, as you can see there are plenty of RCO files, XML files, as well as assets. Even the PS3 Startup sounds are in the flash! Alongside the assets are plenty of SPRX's as well as a few SELF's.

In regards to dev_flash2 + dev_flash3, we can only speculate what is held on there, but the Kernel and HV need to reside somewhere, don't they?

In other news, watch later this week for something cool. We ripped an Official PlayStation Magazine Demo Disc, extracted a Demo of Ridge Racer 7, and after patching it, successfully got it running solely off an SD card, using the PS3's SD card slot.

And a note to those claiming to know why the Retail to Debug HDD Swap Method of conversion does not work: It's failure has nothing to do with lacking keys, or a mupped registry. Look at the flash - tons of missing files!

The way that the method works means that the proper debug files (that in their file names have a timestamp) are never included as their file names do not match that of their retail counterparts. Since they don't match, the system never tries to install it, hense the quick update!

Another update mid-week, stay tuned!]]> http://www.ps3news.com/PS3Dev/ps3-flash-goodies-part-2-the-xml-revolution-1/ http://www.ps3news.com/PS3Dev/ps3-flash-goodies-part-2-the-xml-revolution-1/ Fri, 16 May 2008 19:31:43 CDT CJPC PS3 Dev http://www.ps3news.com/PS3Dev/ps3-flash-goodies-part-2-the-xml-revolution-1/ PS3 Forums with the RCO files, we are also going to talk about component two of the PS3's XMB includes- its XML Files!

Inside the directory exists 30 XML files. They control quite a bit in regards to the PS3's appearance and functioning, from telling the XMB what types of information to display, all the way to letting you download PlayStation Home!

Do make sure to check out the attached image, as it is code snippets of the XML files we're speaking of below.

For example, in category_game.xml, it appears upon disc insertion, the insertion is added into a database, along with what type of media it's on (CD/DVD/BDVD), and if it detects, what format it is (PS1/PS2/PS3) and so on. Now there are your different media types of course: PS1 CD, PS2 CD, PS2 DVD, PS3 DVD, PS3 BD.

Additionally, in that particular XML file pertinent game information is stored in a similar fashion such as game saves, including the type of Memory Card, if it is from Memory Stick, USB, Internal, Virtual, or through a PS2-USB Memory Card is also stored.

Also a hint for what's coming from Sony.. quite a few references to the Trophy room, right in the XMB!

In another XML file, category_tv.xml, contains all of the XMB options for the Korean IPTV service, MegaTV. It has the options for the buttons, as well as the download information.

Finally, category_psn.xml is an important one.. the one for PSN. The PSN, among other things, contains similiar options to the MegaTV service for downloading of files, including both F@H and HOME.

There are quite a few more files, and we will release a full filelist soon.. other files include registory.xml and category_video_bdponly.xml so check back this weekend. We only have so much freetime to work on this per day, and for the most part prefer to utilize it dev'ing versus posting news on every little step along the way.

Finally, in related PS3 Dev news next week we will discuss how a PS3 game boots up, what the HDD has to do with it, and why the PARAM.SFO is just so very important to the PS3, much MORE than what you would think!

We will also cover some VERY nice PS3 Flash ECC regeneration work that was a success recently among other things.

PS: In case you didn't notice, the PS3 KeyVault Project has been officially put it on hold, as significant progress is being made in other areas with the PS3 which we feel supercedes the Project's priority for the present time.]]> http://www.ps3news.com/PS3Dev/infectus-ps3-double-nand-programmer-v1-37-released/ http://www.ps3news.com/PS3Dev/infectus-ps3-double-nand-programmer-v1-37-released/ Wed, 14 May 2008 22:02:38 CDT NDT PS3 Dev http://www.ps3news.com/PS3Dev/infectus-ps3-double-nand-programmer-v1-37-released/
Download: Infectus PS3 Double NAND Programmer v1.37 / Infectus PS3 Double NAND Programmer v1.37 [Mirror]

Added functionalities are:

- Recognition and automatic skip of bad blocks, both in erase and writing functions, from both the file dump and the HW NAND (this function is usefull for people that receive an error in erasing using the official infectus programmer).

- Operations are now logged into a file saved in the same Dump directory (InfectusLog.txt)

- A progress bar has been added in order to check the operation progresses.

- At the end of the operations a message box with a summary is now displayed.]]> http://www.ps3news.com/PS3Dev/ps3-flash-goodies-part-1-1/ http://www.ps3news.com/PS3Dev/ps3-flash-goodies-part-1-1/ Mon, 12 May 2008 19:00:48 CDT CJPC PS3 Dev http://www.ps3news.com/PS3Dev/ps3-flash-goodies-part-1-1/ research into the PS3 RCO file format.

Note that it is different than that on a PSP, however, contains similarities as well. We have received a few questions as to "why" we want to examine the files... it's for a few reasons. First off- We are all curious! Secondly, the RCO files, in support with other files, enable/disable "links" to PS3 XMB options.

In related news, we have now accessed the PS3 Flash's FileSystem, and among other things (to be posted in Part 2 or 3 of this article) it contains a folder called "ps1emu".

What is it for? We found out! Inside the ps1emu folder, upon the insertion of a PS2 disc, a file is copied there by the name of "ps1_rom.bin". Oddly enough, it is actually the custom made PS2's BIOS for the PS3! Why it's in the PS1 folder is unknown to us just yet, however, we can confirm it is the PS2 BIOS. An excerpt from ps1_rom.bin is attached below in the screenshot.

Finally, in regards to our PS3 Flash work thus far: Successful changes have been made to some areas, however, they are not useful just yet. Before we can change large areas of code we need to recalculate the PS3 Flash's ECC. Work is ongoing on that, with more to come, including more goodies from the flash!]]> http://www.ps3news.com/PS3Dev/reminder-want-the-ps3-unlocked-check-the-ps3-forums-often/ http://www.ps3news.com/PS3Dev/reminder-want-the-ps3-unlocked-check-the-ps3-forums-often/ Sun, 11 May 2008 03:29:00 CDT PS3 News PS3 Dev http://www.ps3news.com/PS3Dev/reminder-want-the-ps3-unlocked-check-the-ps3-forums-often/ PlayStation 3 Chat Forum on behalf of the resident PS3 Devs who have been working steadily towards the ultimate goal of unlocking the PS3's full potential. Up until now, much of what they have been doing has been quite technical and didn't require much end-user assistance.

Over the last 2-3 days they have made significant progress in multiple areas of the PS3 (which will be detailed in the Site News), however, they are now asking the PS3 community to "get out of your armchair" (see video below- the ball symbolizes the PS3, the goal is unsigned code, and the community are in the chairs). How can you help? Check the Forums daily: [PS3 Dev Request]: Have a PSP and familiar with .RCO files?

24SI-9F1ZUc]]> http://www.ps3news.com/PS3Dev/sony-playstation-test-development-kit-ps3-debug-for-sale/ http://www.ps3news.com/PS3Dev/sony-playstation-test-development-kit-ps3-debug-for-sale/ Wed, 07 May 2008 16:50:40 CDT PS3 News PS3 Dev http://www.ps3news.com/PS3Dev/sony-playstation-test-development-kit-ps3-debug-for-sale/
The answer: Monitor places such as eBay like it's your job, and win them before "big brother" Sony catches on and closes the auction of course! :D

A perfect example (in case anyone is interested in buying one) is the auction set to end tomorrow here:

eBay Auction: Sony Playstation Test Development Kit - RARE PS3 Debug

Not only does that PS3 Dev machine include hardware, but as stated by the seller dev16, it has the required 1.92 and 2.00 Debug software updates too- very nice! Happy bidding guys, and if anyone wins drop us an e-mail. :P]]> http://www.ps3news.com/PS3Dev/ps3-debugtest-to-retail-flash-progress-and-more/ http://www.ps3news.com/PS3Dev/ps3-debugtest-to-retail-flash-progress-and-more/ Mon, 05 May 2008 16:04:09 CDT CJPC PS3 Dev http://www.ps3news.com/PS3Dev/ps3-debugtest-to-retail-flash-progress-and-more/ previous Site News posts that we're working on converting a Retail PS3 into a Debug PS3.. and we have some updated news on the process to share today.

For starters, we had quite a delay. Our PS3 Devs have been using an expensive external programmer to do the job, however, these dumps differed than the dumps from the Infectus chip. It was quite a puzzling issue indeed.. which was the proper dump?!

After many hours of examination spanning over a few weeks time, it turns out the external programmer was the culprit! The software that the manufacturer provided had a flaw in it that would drop certain bytes, resulting in a corrupt dump missing OOB 64 bytes of data. Luckily our PS3 Devs managed to find and correct the initial problem, so a big THANKS to them!

Once that was sorted, testing began by modifying both the IPL and METLDR.. however, the initial detection byte test failed [received (8002F169) before the install completes, versus the standard: "data type is not supported" (8002F029) mismatched PUP error] although the reprogram worked fine. A retail PUP file currently will not install either.

Needless to say, they are now trying other detection bytes and will continue to share their progress. Below is a picture of the work one of our PS3 Devs did- he wired up an external flash socket to his PS3. This allows for quick removal, reflashing, and retesting of the flash to test different scenarios. He plans to install a second flash socket this week, to facilitate in replacing the entire flash, versus just certain areas.

In other PS3 Dev news, I have been working on some PS3 Debug game patches for OOKAMIDJ which automatically install the games to the PS3 HDD patching them appropriately to run from there.

Finally, although we can't say much yet.. a bit of speculation if you will. We may have found in an earlier PS3 flash version the kernel memory was not seperated from the application memory, meaning it may be possible since kernel memory isn't protected (access restricted) to dump it.. more to come!]]> http://www.ps3news.com/PS3Dev/playstation-3-security-architecture-pdf-released/ http://www.ps3news.com/PS3Dev/playstation-3-security-architecture-pdf-released/ Mon, 21 Apr 2008 21:53:51 CDT ggparallel PS3 Dev http://www.ps3news.com/PS3Dev/playstation-3-security-architecture-pdf-released/ PlayStation 3 Security Architecture PDF document to the public. We still are doing some work on PS3 KeyVault Project, so still not ready yet.

For the PDF.. this is not for newbies sorry. Target Audience: Deep knowledge of CBEA SOC, Sony PlayStation 3 hardware logic, security, encryption/decryption and secure boot dynamics is the minimum to understand the parts of this document.

Thanks to all the stuff of http://www.PS3News.com, without their support this documentation would not be possible, thanks also to Sony for all the nice patents. :)]]> http://www.ps3news.com/PS3Dev/ps3-debugtest-flash-dumped-1/ http://www.ps3news.com/PS3Dev/ps3-debugtest-flash-dumped-1/ Wed, 09 Apr 2008 22:01:04 CDT CJPC PS3 Dev http://www.ps3news.com/PS3Dev/ps3-debugtest-flash-dumped-1/ last year) to have the PS3 Flash dumped.

Well, it has been done! In an amazing feat taking all of 10 minutes, Courier pulled the two PS3 NAND Flash chips from the PS3 TEST and dumped them. Nothing like a hot air rework station in the hands of a professional!

So, the PS3 TEST Flash has been dumped! We also had a chance to do a preliminary analysis on it as we have seen and catalogued nearly 15 seperate PS3 Retail Flash dumps- and there is only (1) constant string in the section we are examining in all of them.

But in the PS3 TEST, it differs!!

More information will be posted soon, but the plan is now to replace said data on a Retail PS3 system, and by doing so modifying its identity to pass the update verification so that Debug/TEST Firmware can be installed on it... along with all the goodies it allows of course.]]> http://www.ps3news.com/PS3Dev/some-easter-ps3-development-updates/ http://www.ps3news.com/PS3Dev/some-easter-ps3-development-updates/ Mon, 24 Mar 2008 21:14:49 CDT CJPC PS3 Dev http://www.ps3news.com/PS3Dev/some-easter-ps3-development-updates/ PS3 KeyVault Project and PS3 Flash news.

To start, resident PS3 Dev subdub has been a bit busy, so he has yet to put the finishing touches on our PS3 KeyVault Server Application. In his absence, both ggparallel and mainman have picked up the slack, and are finishing up the server application. While they are finishing up the app, they are also optimizing the code so it is more versatile as it can auto-update clients, and it will also be able to handle more requests.

Below is a picture of the client application's Web interface that runs on any PS3, including retail consoles via OtherOS. It basically lets you configure the PS3's IP address, check the status of the program, the kernel, and transmitted packets.

Another resident PS3 Dev, who recently received a PS3 TEST unit, is currently awaiting some new hot air rework tools. His PS3 TEST (see HERE) then has an appointment with some solder and wire. We expect to have the flash dumped soon, barring any unforseen circumstances, and then we can analyze the differences in the IPL as well as the mystery detection bits.

Finally, my PS3 Backup Launcher (for Debug units) is at version .002. The menu system was ported over, it is now a nice selectable menu. Due to this change, the graphics library is a bit limited.. so no cool moving background anymore, just a plain grey one.

Also we have noticed some extra checks in a few newer PS3 games that disallow repatching and running from Internal HDD (USB HDD still works fine). We are currently attempting to locate and patch these calls in the newer titles.

In the picture below you see four games, including the disc handed out in Japan at PS3 Launch- the "HD Visual Preview Disc" which is actually a game SELF with two movies! Also in Alpha .002, support was added to boot games from BD/DVD, which works perfectly provided the disc has been properly mastered.

More to come, and hopefully we can get our PS3 KeyVault Project underway soon!]]> http://www.ps3news.com/PS3Dev/wip-downgrade-your-ps3-version-without-previous-dumps/ http://www.ps3news.com/PS3Dev/wip-downgrade-your-ps3-version-without-previous-dumps/ Sat, 15 Mar 2008 15:49:03 CDT NDT PS3 Dev http://www.ps3news.com/PS3Dev/wip-downgrade-your-ps3-version-without-previous-dumps/ Infectus mod-chip on your PS3 to downgrade. This mod-chip allows you to take a backup of your current PS3 Firmware that can be restored.

The news is that before it wasn't possible to downgrade without a previous dump of your own PS3 console's Firmware, but now things have changed. :)

Using this tool you can modify a NAND backup in order to let the console think it has a lower Firmware version, so later you can use an official Sony upgrade PUP file to "downgrade" to the version you need.

It has been tested to patch all PS3 Firmware dumps up to 2.10 so far, but is a work-in-progress as we still need to test re-updating more thoroughly.

I would like to thanks to Gigi and Mainman for their support in this tool, and all the other PS3News Devs for helping us in all our work.]]> http://www.ps3news.com/PS3Dev/ps3-test-backup-launcher-v-001-alpha-wip/ http://www.ps3news.com/PS3Dev/ps3-test-backup-launcher-v-001-alpha-wip/ Mon, 10 Mar 2008 01:23:14 CDT CJPC PS3 Dev http://www.ps3news.com/PS3Dev/ps3-test-backup-launcher-v-001-alpha-wip/ PS3 KeyVault Project for retail PS3 consoles, below is a screenshot of something else I have been tinkering with recently via Debug.

As hinted by PS3News already HERE, it is a Backup Launcher for a PS3 Development Unit as shown. At the moment it it still pre-Alpha and very incomplete, however it allows:

- Boot PS3 Games from HDD
- Boot PS3 Games from DVD/BD-ROM
- Copy Original PS3 Games from DVD/BD-ROM to HDD
- Patch the executable on some games to run from HDD

Note: This will ONLY work on a DEVELOPMENT CONSOLE, not a RETAIL PS3 unit!

To be added soon:

- Read PARAM.SFO for name/titleid, patch to menu (Alpha is hard-coded)
- Support for deleting games from the menu
- Support a few more games to start (Alpha is hard-coded for four)
- Possible support for a "select" menu, versus the button presses

Optimistic things to be added:

- A better GUI
- Backing up PS3 Game files to PC

For those curious, how it works briefly: when the launcher is started, you can copy a game to the PS3 HDD. It will create a folder on the hard disk and copy the Game files over (it's NOT an "ISO" Loader, it just launches the PS3 Game's files), identical to the way PSN's demos are installed.

The games are then launched using a relevant call, such as sceNpDrmProcessExitSpawn or sys_game_process_exitspawn2 (depending on location) and the loader then passes control off to the game, where it is run from.

That is about it for now, just wanted to share some progress. Soon another resident PS3 Dev may share news of a side-project he is working on too!]]> http://www.ps3news.com/PS3Dev/BREAKiNG-NEWS-PS3-Debug-Firmware-2-15-leaked/ http://www.ps3news.com/PS3Dev/BREAKiNG-NEWS-PS3-Debug-Firmware-2-15-leaked/ Sun, 02 Mar 2008 16:27:24 CST CJPC PS3 Dev http://www.ps3news.com/PS3Dev/BREAKiNG-NEWS-PS3-Debug-Firmware-2-15-leaked/
This is VERY cool news mainly because (as we all know) even the retail PS3 Firmware 2.15 isn't available yet from Sony!

For other PS3 Devs to examine, we will be adding the 2.15 Firmware to our PS3 Downloads this weekend as it's a bit sizeable weighing in RAR'd at 103 MB (108,852,452 bytes).

PS3 Debug Firmware v2.15 FileList:

Directory of ..2.15_DEBUG

02/28/2008 05:38 PM .
02/28/2008 05:38 PM ..
02/28/2008 03:46 PM 3 dots.txt
02/28/2008 05:38 PM 0 firmware.txt
02/28/2008 03:47 PM update
02/28/2008 03:46 PM 103,260,160 update.tar
02/28/2008 03:46 PM 5,581,512 updater.sce
02/28/2008 03:46 PM 5 version.txt
02/28/2008 03:47 PM vsh
02/28/2008 03:46 PM 10,240 vsh.tar
6 File(s) 108,851,920 bytes

Directory of ..2.15_DEBUGupdate

02/28/2008 03:47 PM .
02/28/2008 03:47 PM ..
01/19/2008 03:41 AM 1,966,992 BDIT_FIRMWARE_PACKAGE.pkg
01/19/2008 03:42 AM 951,040 BDPT_FIRMWARE_PACKAGE_301R.pkg
01/19/2008 03:42 AM 951,040 BDPT_FIRMWARE_PACKAGE_302R.pkg
01/19/2008 03:42 AM 951,040 BDPT_FIRMWARE_PACKAGE_303R.pkg
01/20/2008 01:54 PM 243,559 BLUETOOTH_FIRMWARE.pkg
01/19/2008 03:43 AM 4,976,256 CORE_OS_PACKAGE.pkg
01/20/2008 01:51 PM 1,671 dev_flash_000.tar.aa.2008_01_21_084823
01/20/2008 01:51 PM 5,616,394 dev_flash_001.tar.aa.2008_01_21_084823
01/20/2008 01:52 PM 3,357,807 dev_flash_002.tar.aa.2008_01_21_084823
01/20/2008 01:52 PM 5,055,467 dev_flash_003.tar.aa.2008_01_21_084823
01/20/2008 01:52 PM 19,451 dev_flash_004.tar.aa.2008_01_21_084823
01/20/2008 01:52 PM 10,304,923 dev_flash_005.tar.aa.2008_01_21_084823
01/20/2008 01:53 PM 9,569,246 dev_flash_006.tar.aa.2008_01_21_084823
01/20/2008 01:53 PM 7,557,602 dev_flash_007.tar.aa.2008_01_21_084823
01/20/2008 01:53 PM 9,790,673 dev_flash_008.tar.aa.2008_01_21_084823
01/20/2008 01:53 PM 10,329,525 dev_flash_009.tar.aa.2008_01_21_084823
01/20/2008 01:53 PM 7,453,935 dev_flash_010.tar.aa.2008_01_21_084823
01/20/2008 01:54 PM 9,740,817 dev_flash_011.tar.aa.2008_01_21_084823
01/20/2008 01:54 PM 9,137,037 dev_flash_012.tar.aa.2008_01_21_084823
01/20/2008 01:54 PM 5,223,205 dev_flash_013.tar.aa.2008_01_21_084823
01/20/2008 01:54 PM 28,636 MULTI_CARD_FIRMWARE.pkg
01/19/2008 03:40 AM 576 RL_FOR_PACKAGE.img
01/19/2008 03:40 AM 704 RL_FOR_PROGRAM.img
01/20/2008 01:54 PM 4,864 SYS_CON_FIRMWARE_01000005.pkg
01/20/2008 01:54 PM 4,864 SYS_CON_FIRMWARE_01010302.pkg
01/20/2008 01:55 PM 1,209 UPL.xml.pkg
26 File(s) 103,238,533 bytes

Directory of ..2.15_DEBUGvsh

02/28/2008 03:47 PM .
02/28/2008 03:47 PM ..
12/17/2006 07:09 PM 0 a
1 File(s) 0 bytes

Total Files Listed:
33 File(s) 212,090,453 bytes
8 Dir(s) 158,846,169,088 bytes free]]> http://www.ps3news.com/PS3Dev/PS3News-com-gets-a-late-Presidents-Day-gift/ http://www.ps3news.com/PS3Dev/PS3News-com-gets-a-late-Presidents-Day-gift/ Thu, 21 Feb 2008 16:48:10 CST CJPC PS3 Dev http://www.ps3news.com/PS3Dev/PS3News-com-gets-a-late-Presidents-Day-gift/
We received it the other day and since this is an actual TEST unit, versus a prototype (which is what I have), we decided to show off a few pictures below!

With the additional TEST unit, we now have (2) development PS3's to work with. It will help work progress much more efficiently as the resident PS3 Devs will be able to offload work onto the other unit now too.

In related news, we have been able to get additional retail back-ups running on the TEST PS3, which squashes initial concerns that the current method may not work for all titles.. nice news indeed!

Furthermore, soon we will be launching a scene-wide BETA of a collaborative PS3 Dev project that has been in the works for awhile now. All individuals/sites are encouraged to participate so that the PS3's full potential can be unlocked- more very soon, it will be impressive!]]> http://www.ps3news.com/PS3Dev/PS3-NAND-Extractor-Update--More/ http://www.ps3news.com/PS3Dev/PS3-NAND-Extractor-Update--More/ Tue, 12 Feb 2008 20:44:38 CST CJPC PS3 Dev http://www.ps3news.com/PS3Dev/PS3-NAND-Extractor-Update--More/
It includes BETA support for the 40gb PlayStation 3 flash, however, we are still working out a few major bugs prior to a public release.

As mentioned above, extraction now dumps the files, plus additional data including the IDL section. It extracts the MAC Address, and also dumps the asecure loader section. More on this soon..

In other news, we are waiting for the InFeCtuS Team to update their program to support the new Samsung Flash revision, so we can experiment more with our recently discovered PS3 downgrading technique. Until then, not much new to report on this area yet.

Finally, we have been successful with running PS3 Retail game back-ups on a PS3 Test from both Internal and USB HDD (along with DVD). Unlike PS2 and PS1 development systems, a PS3 Test won't play a 1:1 copy/scene release.

It only plays development copies, so the executables (EBOOT.BIN) had to be decrypted and rebuilt for them to load. However, as mentioned previously, the executables also had to be patched to eliminate some disc checks.

VERY cool being able to run PS3 Retail Games via HDD though, and now we can tinker with game data to find a potential flaw in how a game handles included files!]]> http://www.ps3news.com/PS3Dev/A-little-something-from-the-inside/ http://www.ps3news.com/PS3Dev/A-little-something-from-the-inside/ Thu, 07 Feb 2008 02:59:47 CST hacked2123 PS3 Dev http://www.ps3news.com/PS3Dev/A-little-something-from-the-inside/
5BGsTX6Uwnw

Here are some things I have so thoroughly withheld.

First off is this video of the SuperSwapMethod in action. (The demonstrated application I am not at liberty to release for the practicality of using it further in the future, and the safety of others.)

This application allows swaps of original PS3 games for other original PS3 of any firmware, of any style, and gave me extensive information on they system's acceptability of burned mediums.

bVPg8K2LpJM

First of all, the system on disk insert takes the param.sfo and copies it to RAM. On execute, RAM is location is cleared, but you may still be able to view garbage data instead. Param.sfo determines if the game is to boot or not.

So if not there (in memory), the game will not launch. As for launching executable files (self, elf, bin, sce) from this area, it can't be done. I have tried several files, and several variations of those files and have concluded that it can't be done without a hardware mod to the BD-ROM or a complete software modification of the sprx's.

7U9JP2FxWQ0

Download: http://www.ps3news.com/forums/attachment.php?attachmentid=13400

The second, 3.1.rar, is be used with the Motorstorm update process and Apache. It was work that I had aims of completing, but now feel its impossible due to the time frame of patching. I have withheld the EBOOT.BIN so you will have to find your own, but also will have to finish my work.

I could not get the files to execute due to a error code other than the one you'll receive without the eboot.bin; proving in effect good things could have came of this. Anyways everything is self explanatory if the file pertains to you.

PLEASE in the future be more responsible when releasing stuff. We are on a mission here, and we don't need this hostage (the PS3's true power) to go MIA for good.]]> http://www.ps3news.com/PS3Dev/Resistance-FoM-Network-Update-Vulnerability/ http://www.ps3news.com/PS3Dev/Resistance-FoM-Network-Update-Vulnerability/ Tue, 05 Feb 2008 23:04:04 CST CJPC PS3 Dev http://www.ps3news.com/PS3Dev/Resistance-FoM-Network-Update-Vulnerability/ here and here), but more constrained.

For example, using the Warhawk hole users could change directories, in the R:FOM one you can't. In layman's terms, it means this R:FOM method is even more limited/useless than the Warhawk one was. Of course to those who just recently discovered it- this is being incorrectly labeled as something useful when it sadly isn't at all.

However, since Sony plugged the Warhawk hole in a past Firmware Update, most of the devs opted to keep quiet until tonight... as now this hole will certainly be addressed in an upcoming Firmware Update as it is indeed a security issue to Sony.

It's a fairly simple method. Using your favorite DNS "hijack" method, or proxy server redirect download-prod.online.scea.com to a HTTP server.

On the HTTP server, set up the path:
/client-patch/resistancegs-prod/resistancegs_SCEE/8.7.1.1/

So, http://download-prod.online.scea.com/client-patch/resistancegs-prod/resistancegs_SCEE/8.7.1.1/ will be redirected to your HTTP server.

You will want to download the files from there to your HTTP server, and recreate the file directory. You can then begin to play around with the files.

http://download-prod.online.scea.com/client-patch/resistancegs-prod/resistancegs_SCEE/8.7.1.1/manifest.dat

http://download-prod.online.scea.com/client-patch/resistancegs-prod/resistancegs_SCEE/8.7.1.1/EBOOT.BIN

Note: You may need to change _SCEE to _SCEA, depending on your region.

You cant do much with this, you can replace some files, but since they're all encrypted and signed, its somewhat useless indeed!

In regards to the Manifest.dat, a hint:

0x00: 0x49470001 - marker
0x04: 0x0000000a - number of files
0x08: 32 bytes per patch file

And the patch files:

0x00: 64-bit length
0x08: 32-bit checksum? (unused)
0x0c: 20 bytes - zero terminated file name]]> http://www.ps3news.com/PS3Dev/PS3-Eboot-bin-FULLY-decrypted-via-Memory-Dump/ http://www.ps3news.com/PS3Dev/PS3-Eboot-bin-FULLY-decrypted-via-Memory-Dump/ Mon, 04 Feb 2008 15:00:33 CST CJPC PS3 Dev http://www.ps3news.com/PS3Dev/PS3-Eboot-bin-FULLY-decrypted-via-Memory-Dump/
As you can see in the image below, there is an ELF file, totally decrypted from the retail game disc! This removes BOTH the disc layer of encryption on the EBOOT.BIN, as well as the file layer of encryption.

In other recent PS3 Dev news, we have managed to successfully downgrade a PlayStation 3 without utilizing a previous flash dump backup of the console. Normally to downgrade your PS3 you first need a copy of the original firmware (made with Infectus). However our method does not need any flash backup, as it uses the PS3's updates to downgrade for us.

Keep in mind it's still a work in progress, but expect additional details on this project as they become available. Look for more information coming this week!]]> http://www.ps3news.com/PS3Dev/A-Peek-inside-a-PS3-PKG-file/ http://www.ps3news.com/PS3Dev/A-Peek-inside-a-PS3-PKG-file/ Mon, 28 Jan 2008 22:55:18 CST CJPC PS3 Dev http://www.ps3news.com/PS3Dev/A-Peek-inside-a-PS3-PKG-file/
Here is a peek inside a PS3 Package file, see below!

For reference, some files like executables are still encrypted even when unpacked from a .PKG file, sound files are not. PSARC files are definitely compressed and likely encrypted as well.]]> http://www.ps3news.com/PS3Dev/Why-the-PS3-still-isnt-hacked-2/ http://www.ps3news.com/PS3Dev/Why-the-PS3-still-isnt-hacked-2/ Thu, 24 Jan 2008 14:59:36 CST nikkelitous PS3 Dev http://www.ps3news.com/PS3Dev/Why-the-PS3-still-isnt-hacked-2/
The PSP, the Wii, even the Xbox 360 have all been hacked and can run homebrew applications so everybody thinks "the PS3 should be just as easy." The PS3 in some ways is as easy, in fact easier. No other console let you install Linux and run anything you want to. Sure Linux on the PS3 is great. You can write your own code and use it. You have the largest collection of applications anywhere (thats right, WAY more than Windows). It's all free (or at a very low cost).

But it's limited. You can't touch the RSX (The very powerful graphics chip in the PS3), you can't use the full hard drive, and nothing is really optimized for the PS3's fantastic Cell processor, this means that what should be fast and easy tends to be slow and cumbersome. In fact, DVD playing which can be done on any modern computer is a monumental task in PS3 Linux.

The major problem is that the PS3 isn't any other console. The PS3 is different in many huge and terrifying ways. First, lets compare the PS3. I know you may think "Why compare the PS3 to the PSP? Why not the 360 or the Wii? The answer is simple, the PSP is another Sony product and if we can break one Sony product why not another? The PSP is hacked, it's true. In fact, it was hacked almost as soon as it was released!

Why? Because the PSP didn't have any security protections in the first version: Thats right! It essentially ran anything that you put on it. You could install any program from day 1 (Mind you, no programs existed at the outset, but in time they became common.)

Now you may say "But they added security in the next version and that was hacked very quickly". I agree with you here, the PSP now has a very powerful security system, but like the Greeks, we had people inside. Once a system is hacked and understood, very little can be used to continue to protect it. In other words, the moment the PSP was uncovered and investigated any future security measures would be trivial to remove and disarm. This proved true and to this day we have each version of the PSP firmware hacked and able to run homebrew within a few weeks.

Now, the Wii, homebrew for the Wii has been slower than expected, not because it's incredibly difficult to do, but because most developers don't see a reason. The Wii has been hacked, but it's almost exclusively used to play copied games.

Most homebrew, in fact, runs in the gamecube emulator built into the Wii. The only reason that developers were interested ing the Wii at all is the controller. Once the controller was found to be connectible to any computer (and even to the PS3) developers lost interest.

"But the Wii has still been hacked, lack of interest isn't an excuse for the PS3 being difficult". That's true, it isn't, but there is a valid excuse. The Wii isn't a full upgrade of all the technologies in the GameCube, in fact, it's almost identical except for a few upgrades. The GameCube has been hacked for a long time and with the Wii being so similar it was a trivial matter to map out the exact differences.

"The 360" some may cry out "it's on par with the PS3 and has been hacked as well." It's true, several hacks for the 360 exist, and some of them are actually monumentally difficult and fascinating. The first hack is rather simple actually. The 360 uses standard DVD disks for it's games. This means that duplicators exist widely for the 360s media, it also meant that people understand it very well. Sadly, the 360 was broken first by simply fooling the DVD drive to bypass all checks to ensure that a game wasn't copied.

Again it came from lack of security on the original version of the console. The DVD drive was easily put into "debug" mode and forced to reveal all it's secrets. Later versions of the console have rectified this with a newer drive. This hack is simply not possible for the PS3 because it's not using a DVD drive it's using a custom Blu-ray drive, we can't simply copy the disks, and we don't know enough about the firmware on the drive to accomplish a "debug mode" even if it's on there.

This wasn't the only hack to hit the 360. Momentarily vulnerable kernels have happened twice, where a bug in the firmware enabled homebrew to be run, each time, though, Microsoft closed the hole in the next version (which was usually released before the hack was really publicized). This is possible for the PS3, but we haven't yet found one of those bugs.

Remember: Only 2 of all the updates the 360 has had have been broken, all the others are still secure.

Only recently has the "timing" or "ultimate" attack on the 360 come to fruition. By counting the time it takes for the 360 to crash when confronted with code which is not valid the "hash" of a particular set of data can be found. This enables you to move back to one of the older firmwares and hack your 360. However, you are still unable to access the xbox live service until you return to a higher version.

Mind you, this hack is INCREDIBLY difficult to do and requires a specially designed mod-chip and several hours for your 360 to reset repeatedly until you can downgrade putting this hack well above the average user. (To the 360 hackers, I am sorry for simplifying your brilliant hack so much, but this article isn't just to sceners, it's to everyone.)

"It's still a hack." Well thats true, the 360 IS hacked. And it will probably only get further hacked as time goes on. But you must remember, the 360 was out for a full year longer than the PS3 and it has less security than the PS3 (which actually has a special "police" program running constantly to ensure that the PS3 remains secure). More time and less security mean that it's easier to break open.

"Well, fine then, when can we expect a PS3 hack?" Thats a good question but it's very hard to answer. You see, we have many expert hackers trying to break open the PS3 and eventually they will, the problem is that there are many groups of hackers who aren't communicating or sharing information. This means that many hackers are repeating work that another hacker has already done, or that may be useless due to information that another group may have discovered.

While many groups have claimed hacks, none have actually provided any proof, instead we get videos like the recent ICE video and we get excuses. They may very well have incredibly valuable information, but none of it is shared so it's hard to get anything out of it. Paradox may have a loader but no way of running it on the latest PS3 firmware, while another group may have a hack enabling code to be run on the latest firmware, but nothing to run on it.

"Why aren't they sharing?" Typically, the reason they don't want to share is glory. They want to be "first" they want to be "best" they want to be the Dark Alex or DVD Jon or Arnezami of the PS3. They want first dibs and for that, we all suffer. While each group has different skills, I don't think that any scene group is really better than any other.

I think that any group stands an equal chance of finding that hole, because like stumbling around blindly after a treasure, someone is bound to stub their toe on it eventually. But if all groups were to work together, we could pinpoint the treasure, and the beauty of this treasure, is that every PS3 owner wins.]]> http://www.ps3news.com/PS3Dev/PS3-Eboot-Dumper-Preview-and-MEMore/ http://www.ps3news.com/PS3Dev/PS3-Eboot-Dumper-Preview-and-MEMore/ Wed, 16 Jan 2008 14:52:05 CST CJPC PS3 Dev http://www.ps3news.com/PS3Dev/PS3-Eboot-Dumper-Preview-and-MEMore/
The program is simple to use: first install the package to a TEST/TOOL PS3. Then insert a memory stick in the PS3 and run the program. Upon completion, remove the memory stick and read it in a PC.

You now have an EBOOT.BIN that is void of the disc layer of encryption! There are still a few add-ons that can be made such as dumping to a PC, however that may be done down the road. Below is a picture of the BETA version of the XMB info screen for the utility.

Furthermore, we have noticed it's a bit easier to dump some of the system memory via GDB than our own custom code.

Why? Well check back on that, but we have already found a decrypted sprx in memory, and that was only after a few seconds of looking.. so some good things are to come soon!]]> http://www.ps3news.com/PS3Dev/Resistance-Fall-of-Disc-Based-Encryption/ http://www.ps3news.com/PS3Dev/Resistance-Fall-of-Disc-Based-Encryption/ Sun, 13 Jan 2008 22:48:38 CST CJPC PS3 Dev http://www.ps3news.com/PS3Dev/Resistance-Fall-of-Disc-Based-Encryption/
This second layer of encryption can be quite the bother, as it hinders our efforts to explore the console. So we have created a tool that runs on Dev machines that automatically dumps the main encrypted file (EBOOT.BIN) to a PC, or Memory Card.

The PS3News.com EBOOT.BIN dumper may be publically released in coming days, it is ready to go and is installable as a PKG, however it will only work on a Debug/Tool console!

This file is void of the Disc Based layer encryption, it is just a SELF. The SELF is encrypted as well, however we are much more familiar with the SELF file format, than with the randomness of an EBOOT.BIN.

Below is a picture of the utility, as well as screenshots of the following files, in their SELF form. The files were taken from Resistance: Fall Of Man:

EBOOT.BIN 9.15 MB (9,602,456 bytes) / game.self 8.22 MB (8,625,856 bytes)]]>