PSDowngrade / Ps3 jig USB traffic protocol scan

[Hansi]

So why you don't just trigger the challenge,
by using the original JIG clone or PSJailbreak which does it as well
(even if in this case maybe there's also something wrong given that the answer to the challenge is not really made to be checked )

PSJBreak challenge in your first dump follows ...

00 01 FF FF 2E 02 01 FE
28 99 E5 8D 3B 96 27 70
E3 50 8B BE 52 4C 39 21
68 C1 53

looks good , even if maybe in this case as said above may be corrupt ...


1) PSdowngrade as it's a real JIG clone will trigger it the right way
2) I can't see PS3 taking your PSGrade dongle too seriously in the last dump
3) PSJBreak can trigger it as well but the key may be corrupt

the real trouble with original JIG clone ,
could be to have chance to switch to Linux without loosing the RAM content
(I didn't see directly till now any PS3 running into service mode,
It just reboot the console at the end or what ? )

Problem with psdowngrade is that i only had one code for one psjailbreak that could only be used one time. I tried to order 5pcs extra from ps-downgrade.com but after not receiving an answer to my emails and read that psdowngrade will be a free download soon, I cancelled that order as I would probably not receive my paid "licenses" before i could get them free. Wouldnt be surprised if I have to fill in a chargeback form to my bank to get those $200 back.

And problem#2 is, when the PS3 have been powered up with psdowngrade, it freezes. You need to turn it off and then on again, then it will be in service mode each time you start it until you run that .self that turn it back into "regular" mode. So I dont think you can actually use a working jig to do what we are trying to do.

For me it does not matter if i use zaxis code to trigger or anything else. But he is trying to get his code to do what needs to be done to get into service mode, so that if/when we find the key that is missing it will be a working solution.

And if my usb traffic scans help him debug his code, I am here to help.

Me, I am stuck at getting our Linux to run xorloser tools correctly. Any help appreciated. Until we get that sorted out we cant dump hypervisor. So much for me being the hacker :-)

If you can just write some code or do some peek/poking to get the key into hypervisor memory, yes please, I would like to have that. That was how i thougt it was supposed to be done from the beginning, then I got involved with zaxis so we are doing it "this" way until a better way opens up.

I am sure some skilled developers know exactly what to do and could do it in 5 minutes but are very very uninterested to help with this because it will only lead to more piracy and chinese companies making more money on cheap usb dongles. And ultimately higher priority at Sony to patch the hole.

[ToXiiC]

Did it do anything different on the step you say u missed?

I missed that one, some steps documented there that I am sure we skipped, no wonder it never worked. Going to work now to try again :-)

[Hansi]

OK, we have stuff going the right way now.

Managed to dump HV for the first time.

However, the ps3 was booted normally, not with any usb dongle at that attempt.

Now we are trying by booting straight into linux with psgrade activated during boot.

[samplehead]

Spännande att följa era försök, både här och på psx-scene. Håller tummarna

[Hansi]

OH! SO CLOSE, Stan64 got the exploit again but the ps3 froze when trying to dump hv...

[Pendragon]

UPDATE:
Hypervisor now dumped without dongle...



Hypervisor-dumped-without-dongle.JPG

Small steps

Now for the serious business when people that haven't slept or smoked for a while gets a small power break and some refreshments

[Hansi]

Because of all the fake postings, off topic bullshit and locked threads on psx-scene, I will only use this thread for coming updates.

As we now have unlimited psdowngrade dongles, getting fat 3.15 ps3:s is not a problem anymore. We have already a new 3.15 machine being modified with the geohot exploit, and with two working ps3:s to play with, this new one can be used for more risky modifications such as the proposed "extra power to ram" wires.

However, we have put this project on a lower priority because of the very very busy December with so many customers coming in that we need to help with regular modifications and repairs.

[Hansi]

http://twitter.com/KaKaRoToKS/status/12274655385620480

0xAAAA dongle key: 0x04, 0x4E, 0x61, 0x1B, 0xA6, 0xA6, 0xE3, 0x9A, 0x98, 0xCF, 0x35, 0x81, 0x2C, 0x80, 0x68, 0xC7, 0xFC, 0x5F, 0x7A, 0xE8

Thanks to psjailbreak, ps3yes, zaxis, kakaroto, mathieulh and all other devoted console hackers out there.

Come on now psjailbreak, you need to invent something new again before christmas or we need to recycle your dongles as christmas tree lighting...

[norda84]

Någon som vet var man kan hitta den modifireade 3.41pup filen?

[Hansi]

Be aware - downgrading can kill bluray movie player support in the PS3.

If you have 3.41 and is already jaibreaking, be sure to backup /dev_flash2 and /dev_flash3 as the only known way to restore bluray movie support at the moment is to restore files from those directorys.

[Electron]

Do you know if it is possible to make a backup of those files with the ps3key dongle?

[Pendragon]

Shouldn't be a problem if you boot with a Jailbreak dongle of your choice and ftp into flash 1-3 on your ps3 and backup those files from there.

Rumous say that people disable their BDR movie support just by setting their Ps3 to Factory/Service mode and finalizing that mode to stock/end user mode. But if you have backupped the Flash 2 and flash 3 and rewrite them back you can get BDR Movie to work again.

We have not comfirmed this ourselves.
Currently im upgrading a Stock Ps3 60GB PAL to 3.41 from 3.40 *Tested BDM on 3.40 and it works*
Will test BDM on 3.41 official FW soon, FTP and backup everything i can get hold of and enter Service mode and finalize and then test BDM again.

Work in progress

[Pendragon]

The 60GB PAL PS3 unit im working on just went fron3.40 to 3.41 *BDRM* OK

And from 3.41 JB *BDRM* OK **Dumped Flash 1-3**

Then from 3.41 to Service mode and out again *BDRM* OK **Dumped Flash 1-3**

Then we downgraded it with PSJB and out from servicemode *BDRM* FAIL **Dumped Flash 1-3**
Now were testing to Downgrade again but this time pulling out the main power and from downgrade factory service to user mode again just for funs sake.

If that does not enable BDRM ill test to JB teh unit and restoring the Flash 2 + 3
and post info.

[Pendragon]

Progress... I got BDRW working again after downgrading by restoring Flash 2+3 and then booting a BDR disc Movie and voila presto... Its alive..

[Pendragon]

The Ps3 60Gb European PAL FAT unit i laid my hands on yesterday was a virgin 3.40 that was upped to 3.41 and BluRay movies worked fine.

Jailbroken and i dumped Flash 1 to Flash 3 ( BluRay movies worked fine. )

Was forced into service mode and out again + backup of flash 1-3 ( BluRay movies worked fine. )

Was downgraded with a PSJB in Downgrade mode and flash 1-3 was backupped with the PSDG info file ( BluRay movies FAILED )

Wrote back Flash 2+3 and backupped it again ( BluRay movies worked fine. )

So we now know that restoring Flash 2-3 on the same unit before downgrading works to get the blu ray to play movies again.
We have a 40Gb Fat model too that was downed and does not play BluRay movies and we will actually try to inject flash 2+3 files to it and see if that works, we will try to restore files from flash 2-3 from a 40Gb unit that belongs to a friend of mine that has a working unit that plays movies from bluray too onto another 40Gb unit if it is model specific or unit specific.

Did anyone find a solution yet or did i just miss that info ?

and does anyone need the dumps i made ( b4 downgrade when all works, after dg when bluray fails and after restoring flash2+3 and it worked again )
or is it going to be more cheese needed with more whine *lol*

[Pendragon]

Our findings *Gharr*

PS3-Dev-PSXCARE-60GB_PAL-Phatty.rar

[radical2005]

why are you talking in English

[Pendragon]

why are you talking in English

Whajj do jo bump tråd som is gammal

We speak English here in this thread because we grew tired of all crossposting and spamming/flaming we encountered on another big dev forum and we decided to post all our facts at our place so we could control the flow better.