Recently xorloser has released a PS3 NID Attack Tool for other PS3 Devs. To quote:
NidAttack was a tool created to work out PRX export/import names by dictionary attack. A PRX file is a DLL file for Playstation consoles; (Playstation Relocatable eXecutable ... maybe)
NidAttack was initially created by others to work out PSP export/import names and I have just altered it slightly to also calculate PS3 names.
Included is an xml database of all exports from PRX files found in the PS3 v2.30 system flash. Also present is a file with NIDs for just the unknown names, so these are the ones to use NidAttack on.
This is a PS3 loader for IDA, it lets you open PS3 elf/self/prx/sprx files in IDA. I highly recommend you use this with the PPC-Altivec plug-in also available on this site.
THIS DOES NOT DECRYPT ANY FILES !!!! That means that for now this loader will ONLY work on unencrypted files. There are a few such files "in the wild" that have been found on Sony update servers and such.
As well as loading the supported PS3 filetypes in both 32bit and 64bit vesions of IDA this also resolves and sets up all imports, exports and syscalls. It also only supports PS3 PPU files as the PS3 SPU CPU is not supported by IDA at this time... More »
A quick update tonight with a few more details about the upcoming Eboot.bin Dumper utility. It dumps the Eboot.bin from your original PS3 Game disc, and strips the disc layer of encryption, so it is a less-encrypted SELF.
The program is simple to use: first install the package to a TEST/TOOL PS3. Then insert a memory stick in the PS3 and run the program. Upon completion, remove the memory stick and read it in a PC.
You now have an EBOOT.BIN that is void of the disc layer of encryption! There are still a few add-ons that can be made such as dumping to a PC, however that may be done down the road. Below is a picture of the BETA version of the XMB info screen for the utility.
Furthermore, we have noticed it's a bit easier to dump some of the system memory via GDB than our own custom code.
Why? Well check back on that, but we have already found a decrypted sprx in memory, and that was only after a few seconds of looking.. so ... More »
Another brief update based on the yesterday's findings: the PS3 Flash is quite accessible as the majority of it is mounted inside the PS3 as a filesystem (think PSP), and is able to be read/written.
A picture is below for a peek at a partial filelist. As you can see there are quite a few sprx's. These are encrypted of course, however they function quite the same as their PSP counterparts. For the majority of the PS3 OS's functions, there is a sprx that is tasked to do the job.
For the big chunk of interesting news: Every single scene release ever released for PS3 will not work without being patched.
Why? It is because backup PS3 images lack some data that we will call a key. On an original, when the disc is inserted, the PS3 reads the key, and it is used to decrypt any encrypted files on disc (the DISC layer of encryption). On a backup, the PS3 can not read this key so it will not be able to decrypt the file. Of course if a hardware mod surface... More »