143w ago - A few days ago PS JailBreak was reverse-engineered, and today Descrambler sniffed the USB traffic and shared the log.

I don't know that much about the USB protocol, but I think this is what happens:

• The PSJailbreak is inserted
• It connects with the host (PS3) and sends 09 02 12 00 01 00 00 80 + all the bytes from the first packet starting at 0008 up to 00EFF.
• The stack is overwritten and the PS3 jumps into code from the packet
• The Atmega sends a "USB Disconnect command"
• The last three steps are repeated four times

• It connects with the host and sends 09 02 4D 0A 01 01 00 80 + the bytes from the second packet starting at 0008 up to 0A4C
• The stack is overwritten and the PS3 jumps into code from the packet
• The Atmega sends a "USB Disconnect command"
• The last three steps are repeated twice.

Voilà... The PS3 is in "Debug Mode".

Apparently the third and fourth byte of the after the 09 02 are the numbers of bytes to be sent. At least this goes for the second log (4D 0A->0A4D bytes)...

The first 8 bytes are from the usb protocol left [09 02 ... ]

The code will be...