Printable View
Use Beagle Data Center Software to read the dumps.
http://www.totalphase.com/support/pr...beagle_usb480/
One file is a ps3key boot, the other is a psdowngrade boot.
The psdowngrade is supposed to be encrypted and not "analyzeable" according to a distributor. But maybe something can be learned anyway.
Have fun!
Bifogning 1073
Bifogning 1074
Bra jobbat, du har precis gjort så att man aldrig kommer kunna handla hos nån av era konkurrenter (hur fan stavas det?) =)
can you dump it again (or a few times more?) so we can compare, please.
That particular dongel is now dead... :pCitat:
Original inlägg av madshaun1984
One time shot only, sorry folks... Thats why we got hold of a Beagle USB sniffer that was quite expensive *lol*
Oh yes, we ordered the expensive one just for this....
Remember ( Sharing is Caring! )
Downgrade should be free for all just like the JigKick/Pandora memory on PSP!
This is wonderful news, Hansi and his PSXCare crew makes me proud to be a Swede...well, not that we Swede's need any reason to be proud. ;)
If needed, yes, i can aquire some more psdowngrade license keys. But what needs to be done now is that I have to bring my private 60GB fat ps3 to the office. That particular PS3 is still on version 3.15. A "fat" ps3 on version 3.15 can be "glitched" and used to dump the hypervisor memory after doing a particular system call that will leave the much needed dongle key in hypervisor memory. That key is what is needed to code the correct challenge-response protocol that is used between the ps3 and the dongle to activate service mode.Citat:
Original inlägg av madshaun1984
Actually we should try to dump the data when the JB key is upgraded to a Downgrade key too :)
After that it seams somewhat complicated :D
Then when downgrading again of cause :)
Hansi: I have a 60Gb model that runs 2.60 an another still running 3.15 with Linux installed just in case..
As long as we dont fuck them up and just dump firmware im game too.
2.60 should even be able to tell us something if they changed the Jigmode to another key value before booting in Facctory/Service/Repair mode.
The 2.60 unit i have and the 3.15 are brand new ( got them exchanged from Sony and i havent used them since i got them *apart from booting and testing so they worked*
Some crazy friend of mine offered me 8000 Sek for one of them long before JB was born just so he could have a "perhaps hackable" unit when a solution comes... i refused and he upped the price but i declined again :)
Im just like you, sentimental and caring *lol* if my Slim 3.41 or my other Fat 3.15 dies i could exchange them... That was my reason for saving those.
Hi,
it looks like way too easy to have a psdowngrade for free , anyway,
here's my findings ..
the PSDown looks like it just use directly the fake JIG in order to achieve the goal,
then instead of the device with IDs AAAA C0DE after JIG TASK
a device ID AAAA A2F1 is used
the main difference anyway is the JIG Payload response
PSJB ---------------
//JIG RESPONSE
80 00 00 00 00 3D EE 78 //SHELLCODE_PTR
80 00 00 00 00 3D EE 88 //SHELLCODE_ADDRESS
80 00 00 00 00 33 E7 20 //RTOC_TABLE (v 3.41)
//SHELCODE PAYLOAD
E8 83 FF F0 E8 63 FF F8
E8 A3 00 18 38 63 10 00
7C 04 28 00 40 82 FF F4
38 C3 F0 20 7C C9 03 A6
4E 80 04 20 04 00 00 00
------------------------
PSDOWN ---------------
//JIG RESPONSE
00 00 FF 00 2E 02 02 AA // ??
AA 74 1D 18 EB 2D 39 7B // ??
F5 22 5C 93 B2 1F 72 F7 // ??
//SHELCODE PAYLOAD?
1B 45 23 72 01 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
-----------------------
would be interesting to have more dumps to compare against
Ok, I have ordered the hardware needed to glitch the PS3 and use xorlosers files and instructions for dumping the hypervisor. So far I think i have digested all information needed to successfully dump the hypervisor to a file using xorlosers tools.
I have not yet understood exactly how to actually execute the call to 0x24001 - Generate Challenge. Can it be done using xorlosers tools or is it something i have to code and compile in C?
(Its been more than 10 years ago i last did any coding in C, and I have never bothered to look this close at PS3 hacking before...so any hints would be appreciated)
So:
Step 1: Build and install hardware to glitch the memory bus = no problem
Step 2: Install and run Linux on the PS3 = no problem
Step 3: Execute the call to 0x24001 to generate challenge = Clueless!
Step 4: Run dumphv (Dumps the hypervisor to a file in the current directory) or ps3peek 0 -s 0×1000000 -d 8 -b > hvdump.bin (does the same thing?)
Step 5: Upload the file for the real hackers here to play with
http://psx-scene.com/forums/597656-post103.html
As soon as I have received my sx28 controller to glitch (using xorlosers files) I will try this. Unless someone else beats me to it :-) It is on its way UPS express so it should arrive tomorrow.Citat:
zAxis:
@ Hansi
do you have teensy 2.0?
if you do then could you do the following:
1- run this hex (as if you were running the jp: power cycle, start then eject)
2- reboot ps3 into linux (NO power cycling!! just do it through GameOS)
3- dumb the HV and post it here (or pm where it is)
if you dont have teensy then what board do you have at hand? (must atmel) I will make the hex
oh, and could you please sniff the usb? it ill help with debugging. ty
@ other ppl
I am just trying something, there is very good chance it wont work, so no flaming please
EDIT: please get psgroove2.zip it has a fix
Bifogning 1075
"Downgrade should be free for all just like the JigKick/Pandora memory on PSP!" why do you make money on free stuff then?=)
The word "free" can be used in different contexts. Free as in Freedom as in available to everyone. Or Free as in you dont have to pay to receive/use it.Citat:
Original inlägg av skystar
We, as in "psxcare", run a business. We have hired staff that get paid every month. We have expensive web servers running in hired server rack space in secure (expensive!) data centers. We have a physical shop location where our staff work and where customers can come in to buy stuff and/or get stuff repaired/modified.
Just as you cant expect to bring your car with a new clutch in a box to your local mechanic and expect to have it installed for free, you cant expect us to install "free" stuff in our customers computers or game consoles without charging them a fee to cover our expenses and make a profit so we can pay ourself som salary so we can pay our rent and put food on the table for our kids...
We would like to thank the PSJAILBREAK team for their policy change regarding psdowngrade!
They promise to release it as a FREE tool for all psjailbreak owners. And it will be for unlimited use. Great news for us distributors/resellers that will actually be able to sell some of our stock now that psjailbreak actually does something that is still not available with any of the clones.
Hansi,
is there any chance to have some other dump now that is for free ?
many thnX
for any of you may be interested , here is the flashing loop that write the .FLA into the PSJB dongle
it just send the content of the file in chunks of EXACT 128 bytes,(the length in fact is 1180 hex) the FLA is true is encrypted,
and the decryption is completely done inside the boot loader , which by the clues looks pretty much like a DES Algorithm
and probably the key is just a function of the serial number itself
or maybe even easier the serial number is just used to setup IV and the key is a fixed secret inside the boot loader
too me looks much to complex for this kind of product for them to have a DDBB
which would keep the association of each sold serialNum with respective KEY
--------------------------------------------------------------------------------------------
loc_40153B:
mov eax, [ebp+file_handle]
mov [esp+48h+var_3C], eax
mov [esp+48h+var_40], 80h
mov [esp+48h+var_44], 1
mov [esp+48h+var_48], offset read_buff
call fread
cmp eax, 80h
jnz print_NL
cmp [ebp+var_D], 0
jz print_NL
mov [esp+48h+var_2C], 2710h
mov [esp+48h+var_30], 80h
mov [esp+48h+var_34], offset read_buff
mov [esp+48h+var_38], 0
mov [esp+48h+var_3C], 0
mov [esp+48h+var_40], 1
mov [esp+48h+var_44], 21h
mov eax, ds:dongle_handle
mov [esp+48h+var_48], eax
call usb_control_msg
mov [esp+48h+var_2C], 3E8h
mov [esp+48h+var_30], 1
lea eax, [ebp+var_D]
mov [esp+48h+var_34], eax
mov [esp+48h+var_38], 0
mov [esp+48h+var_3C], 0
mov [esp+48h+var_40], 0
mov [esp+48h+var_44], 0A1h
mov eax, ds:dongle_handle
mov [esp+48h+var_48], eax
call usb_control_msg
mov [esp+48h+var_48], offset a_ ; "."
call printf
mov eax, ds:_iob
add eax, 20h
mov [esp+48h+var_48], eax
call fflush
jmp loc_40153B
print_NL: ; "\n"
mov [esp+48h+var_48], offset asc_403006
call printf
cmp [ebp+var_D], 4
jnz short Flash_Failed
mov [esp+48h+var_48], offset aFlashCompleted ; "flash completed successfully!!!\n"
call printf
jmp short loc_401651
Flash_Failed:
movsx eax, [ebp+var_D]
mov [esp+48h+var_44], eax
mov [esp+48h+var_48], offset aFlashFailedD ; "FLASH FAILED: %d\n"
call printf
Status from todays work so far:
PS3 version 3.15 have been modified with wires attached to do the geohot attack
Parallax SX28 development board arrived and xorlosers design to glitch the ps3 built
Linux installed on PS3
Right now:
Moving stuff around so we can run the ps3 on a good monitor for linux, and close enough to a computer running the Beagle USB sniffer
Looking at the latest zAxis psgrade version, this is the prototype downgrade code for the Teensy. It is used to trigger the usb key check routine so that the secret key will be waiting for us (hopefully) in the hypervisor memory that we will dump using xorloser tools.
Some pictures of the setup...Bifogning 1076Bifogning 1077Bifogning 1078
Linux guy is looking at the xorlosertools.
I am looking at the latest psgrade, hopefully i will figure out how to compile it for the teensy.
R6Armadillo have compiled the latest psgrade, just waiting for the file as it is uploaded to one of the file download sites and not available just yet.
Thank you, you probably saved me one hour of work!
Fresh psgrade flashed to teensy 2.0, thank you R6Armadillo.
Linux guy trying to run makefile for xorloser toolkit.
We got FATAL: modpost: GPL-incompatible module xorhack.ko uses GPL-only symbol 'nr_irqs'
We use a later version of ubuntu and it looks like our kernel is compiled with some sort of GPL blaha blaha checking that it does not need to do. Looking at a fix. Helpful tips appreciated.
I need some food, going out for a quick lunch, hope the linux stuff is running when i get back.
I think adding this to the module source should do it.
EXPORT_SYMBOL_GPL(nr_irqs);
We changed something about "module license" from lgpl to gpl in some file and now make is running. Sorry about license infractions etc but it was an emergency :-)
Gods are unhappy. Xorhack 2.0 ps3exploit refuse to loop "100 times" it just do one loop regardless of what i ask it to do.
First version cause kernel krashes.
I do have a dump now of latest version psgrade: Bifogning 1079
We are installing Ubuntu 8.10 now, instead of the 10.10 we installed first. Thanks goes to the 4-5 unknown seeders who bothered to keep a very old torrent alive still.
the dump is not really useful, is just interesting because it shows a fight over the BUS, but nothing more interesting (though) ...
PSGrade is still far away from a working JIG clone,
first of all because it still keeps the HUB stuff from PSGroove which is likely to be a wrong way to use the JIG clone,
in fact, PSDwngrade even if being made by the same people of PSJBreak ,
doesn't use the HUB stuff at all it just shows up as JIG and then answer to the challenge sent by PS3.
PSGroove doesn't work as a JIG clone , it just use it as additional exploit ...
I'm not sure but why they should use it like this if it would be easier having 2 version of the same code,
slightly modified to do both task ?? as in PSgroove/PSGrade ...
in the dump you got there's a problem even before the JIG shows up, and then PS3 just ignores it
I hope it is useful for zaxis trying to code something that 1: helps us trigger the challenge to get the key into memory and 2: use as a jig when we have the key.
So I see the usb scans as a debugging tool for him, not more not less.
So why you don't just trigger the challenge,
by using the original JIG clone or PSJailbreak which does it as well
(even if in this case maybe there's also something wrong given that the answer to the challenge is not really made to be checked )
PSJBreak challenge in your first dump follows ...
00 01 FF FF 2E 02 01 FE
28 99 E5 8D 3B 96 27 70
E3 50 8B BE 52 4C 39 21
68 C1 53
looks good , even if maybe in this case as said above may be corrupt ...
1) PSdowngrade as it's a real JIG clone will trigger it the right way
2) I can't see PS3 taking your PSGrade dongle too seriously in the last dump
3) PSJBreak can trigger it as well but the key may be corrupt
the real trouble with original JIG clone ,
could be to have chance to switch to Linux without loosing the RAM content
(I didn't see directly till now any PS3 running into service mode,
It just reboot the console at the end or what ? )
Problem with psdowngrade is that i only had one code for one psjailbreak that could only be used one time. I tried to order 5pcs extra from ps-downgrade.com but after not receiving an answer to my emails and read that psdowngrade will be a free download soon, I cancelled that order as I would probably not receive my paid "licenses" before i could get them free. Wouldnt be surprised if I have to fill in a chargeback form to my bank to get those $200 back.Citat:
Original inlägg av cloned67
And problem#2 is, when the PS3 have been powered up with psdowngrade, it freezes. You need to turn it off and then on again, then it will be in service mode each time you start it until you run that .self that turn it back into "regular" mode. So I dont think you can actually use a working jig to do what we are trying to do.
For me it does not matter if i use zaxis code to trigger or anything else. But he is trying to get his code to do what needs to be done to get into service mode, so that if/when we find the key that is missing it will be a working solution.
And if my usb traffic scans help him debug his code, I am here to help.
Me, I am stuck at getting our Linux to run xorloser tools correctly. Any help appreciated. Until we get that sorted out we cant dump hypervisor. So much for me being the hacker :-)
If you can just write some code or do some peek/poking to get the key into hypervisor memory, yes please, I would like to have that. That was how i thougt it was supposed to be done from the beginning, then I got involved with zaxis so we are doing it "this" way until a better way opens up.
I am sure some skilled developers know exactly what to do and could do it in 5 minutes but are very very uninterested to help with this because it will only lead to more piracy and chinese companies making more money on cheap usb dongles. And ultimately higher priority at Sony to patch the hole.
Did it do anything different on the step you say u missed?
Citat:
I missed that one, some steps documented there that I am sure we skipped, no wonder it never worked. Going to work now to try again :-)
OK, we have stuff going the right way now.
Managed to dump HV for the first time.
However, the ps3 was booted normally, not with any usb dongle at that attempt.
Now we are trying by booting straight into linux with psgrade activated during boot.
Spännande att följa era försök, både här och på psx-scene. Håller tummarna
OH! SO CLOSE, Stan64 got the exploit again but the ps3 froze when trying to dump hv...
UPDATE:
Hypervisor now dumped without dongle...
http://forum.psxcare.com/support/att...0&d=1290703897
Bifogning 1080
Small steps :D
Now for the serious business when people that haven't slept or smoked for a while gets a small power break and some refreshments ;)
Because of all the fake postings, off topic bullshit and locked threads on psx-scene, I will only use this thread for coming updates.
As we now have unlimited psdowngrade dongles, getting fat 3.15 ps3:s is not a problem anymore. We have already a new 3.15 machine being modified with the geohot exploit, and with two working ps3:s to play with, this new one can be used for more risky modifications such as the proposed "extra power to ram" wires.
However, we have put this project on a lower priority because of the very very busy December with so many customers coming in that we need to help with regular modifications and repairs.
http://twitter.com/KaKaRoToKS/status/12274655385620480
0xAAAA dongle key: 0x04, 0x4E, 0x61, 0x1B, 0xA6, 0xA6, 0xE3, 0x9A, 0x98, 0xCF, 0x35, 0x81, 0x2C, 0x80, 0x68, 0xC7, 0xFC, 0x5F, 0x7A, 0xE8
Thanks to psjailbreak, ps3yes, zaxis, kakaroto, mathieulh and all other devoted console hackers out there.
Come on now psjailbreak, you need to invent something new again before christmas or we need to recycle your dongles as christmas tree lighting...
Någon som vet var man kan hitta den modifireade 3.41pup filen?
Be aware - downgrading can kill bluray movie player support in the PS3.
If you have 3.41 and is already jaibreaking, be sure to backup /dev_flash2 and /dev_flash3 as the only known way to restore bluray movie support at the moment is to restore files from those directorys.
Do you know if it is possible to make a backup of those files with the ps3key dongle?
Shouldn't be a problem if you boot with a Jailbreak dongle of your choice and ftp into flash 1-3 on your ps3 and backup those files from there.
Rumous say that people disable their BDR movie support just by setting their Ps3 to Factory/Service mode and finalizing that mode to stock/end user mode. But if you have backupped the Flash 2 and flash 3 and rewrite them back you can get BDR Movie to work again.
We have not comfirmed this ourselves.
Currently im upgrading a Stock Ps3 60GB PAL to 3.41 from 3.40 *Tested BDM on 3.40 and it works*
Will test BDM on 3.41 official FW soon, FTP and backup everything i can get hold of and enter Service mode and finalize and then test BDM again.
Work in progress :D
The 60GB PAL PS3 unit im working on just went fron3.40 to 3.41 *BDRM* OK
And from 3.41 JB *BDRM* OK **Dumped Flash 1-3**
Then from 3.41 to Service mode and out again *BDRM* OK **Dumped Flash 1-3**
Then we downgraded it with PSJB and out from servicemode *BDRM* FAIL **Dumped Flash 1-3**
Now were testing to Downgrade again but this time pulling out the main power and from downgrade factory service to user mode again just for funs sake.
If that does not enable BDRM ill test to JB teh unit and restoring the Flash 2 + 3
and post info.
Progress... I got BDRW working again after downgrading by restoring Flash 2+3 and then booting a BDR disc Movie and voila presto... Its alive..
The Ps3 60Gb European PAL FAT unit i laid my hands on yesterday was a virgin 3.40 that was upped to 3.41 and BluRay movies worked fine.
Jailbroken and i dumped Flash 1 to Flash 3 ( BluRay movies worked fine. )
Was forced into service mode and out again + backup of flash 1-3 ( BluRay movies worked fine. )
Was downgraded with a PSJB in Downgrade mode and flash 1-3 was backupped with the PSDG info file ( BluRay movies FAILED )
Wrote back Flash 2+3 and backupped it again ( BluRay movies worked fine. )
So we now know that restoring Flash 2-3 on the same unit before downgrading works to get the blu ray to play movies again.
We have a 40Gb Fat model too that was downed and does not play BluRay movies and we will actually try to inject flash 2+3 files to it and see if that works, we will try to restore files from flash 2-3 from a 40Gb unit that belongs to a friend of mine that has a working unit that plays movies from bluray too onto another 40Gb unit if it is model specific or unit specific.
Did anyone find a solution yet or did i just miss that info ?
and does anyone need the dumps i made ( b4 downgrade when all works, after dg when bluray fails and after restoring flash2+3 and it worked again )
or is it going to be more cheese needed with more whine *lol*
Our findings *Gharr*
Bifogning 1084
why are you talking in English :)
Whajj do jo bump tråd som is gammal :DCitat:
Original inlägg av radical2005
We speak English here in this thread because we grew tired of all crossposting and spamming/flaming we encountered on another big dev forum and we decided to post all our facts at our place so we could control the flow better.