PSDowngrade / Ps3 jig USB traffic protocol scan

**Hansi** · 2010-11-18

Use Beagle Data Center Software to read the dumps.

http://www.totalphase.com/support/pr...beagle_usb480/

One file is a ps3key boot, the other is a psdowngrade boot.

The psdowngrade is supposed to be encrypted and not "analyzeable" according to a distributor. But maybe something can be learned anyway.

Have fun!

test boot ps3key.tdc
service mode by psdowngrade.tdc

**Hansi** · 2010-11-18

**caballerial** · 2010-11-18

Bra jobbat, du har precis gjort så att man aldrig kommer kunna handla hos nån av era konkurrenter (hur fan stavas det?) =)

**madshaun1984** · 2010-11-19

can you dump it again (or a few times more?) so we can compare, please.

**Swizzy** · 2010-11-19

Original inlägg av madshaun1984

can you dump it again (or a few times more?) so we can compare, please.

That particular dongel is now dead...

**Pendragon** · 2010-11-19

One time shot only, sorry folks... Thats why we got hold of a Beagle USB sniffer that was quite expensive *lol*
Oh yes, we ordered the expensive one just for this....

Remember ( Sharing is Caring! )
Downgrade should be free for all just like the JigKick/Pandora memory on PSP!

**mog** · 2010-11-19

This is wonderful news, Hansi and his PSXCare crew makes me proud to be a Swede...well, not that we Swede's need any reason to be proud.

**Hansi** · 2010-11-19

Original inlägg av madshaun1984

can you dump it again (or a few times more?) so we can compare, please.

If needed, yes, i can aquire some more psdowngrade license keys. But what needs to be done now is that I have to bring my private 60GB fat ps3 to the office. That particular PS3 is still on version 3.15. A "fat" ps3 on version 3.15 can be "glitched" and used to dump the hypervisor memory after doing a particular system call that will leave the much needed dongle key in hypervisor memory. That key is what is needed to code the correct challenge-response protocol that is used between the ps3 and the dongle to activate service mode.

**Pendragon** · 2010-11-19

Actually we should try to dump the data when the JB key is upgraded to a Downgrade key too

After that it seams somewhat complicated

Then when downgrading again of cause

Hansi: I have a 60Gb model that runs 2.60 an another still running 3.15 with Linux installed just in case..
As long as we dont fuck them up and just dump firmware im game too.
2.60 should even be able to tell us something if they changed the Jigmode to another key value before booting in Facctory/Service/Repair mode.

The 2.60 unit i have and the 3.15 are brand new ( got them exchanged from Sony and i havent used them since i got them *apart from booting and testing so they worked*
Some crazy friend of mine offered me 8000 Sek for one of them long before JB was born just so he could have a "perhaps hackable" unit when a solution comes... i refused and he upped the price but i declined again

Im just like you, sentimental and caring *lol* if my Slim 3.41 or my other Fat 3.15 dies i could exchange them... That was my reason for saving those.

**cloned67** · 2010-11-19

Hi,

it looks like way too easy to have a psdowngrade for free , anyway,
here's my findings ..

the PSDown looks like it just use directly the fake JIG in order to achieve the goal,
then instead of the device with IDs AAAA C0DE after JIG TASK
a device ID AAAA A2F1 is used

the main difference anyway is the JIG Payload response

PSJB ---------------
//JIG RESPONSE
80 00 00 00 00 3D EE 78 //SHELLCODE_PTR
80 00 00 00 00 3D EE 88 //SHELLCODE_ADDRESS
80 00 00 00 00 33 E7 20 //RTOC_TABLE (v 3.41)
//SHELCODE PAYLOAD
E8 83 FF F0 E8 63 FF F8
E8 A3 00 18 38 63 10 00
7C 04 28 00 40 82 FF F4
38 C3 F0 20 7C C9 03 A6
4E 80 04 20 04 00 00 00
------------------------

PSDOWN ---------------
//JIG RESPONSE
00 00 FF 00 2E 02 02 AA // ??
AA 74 1D 18 EB 2D 39 7B // ??
F5 22 5C 93 B2 1F 72 F7 // ??
//SHELCODE PAYLOAD?
1B 45 23 72 01 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
-----------------------

would be interesting to have more dumps to compare against

**Hansi** · 2010-11-20

Ok, I have ordered the hardware needed to glitch the PS3 and use xorlosers files and instructions for dumping the hypervisor. So far I think i have digested all information needed to successfully dump the hypervisor to a file using xorlosers tools.

I have not yet understood exactly how to actually execute the call to 0x24001 - Generate Challenge. Can it be done using xorlosers tools or is it something i have to code and compile in C?

(Its been more than 10 years ago i last did any coding in C, and I have never bothered to look this close at PS3 hacking before...so any hints would be appreciated)

So:

Step 1: Build and install hardware to glitch the memory bus = no problem
Step 2: Install and run Linux on the PS3 = no problem
Step 3: Execute the call to 0x24001 to generate challenge = Clueless!
Step 4: Run dumphv (Dumps the hypervisor to a file in the current directory) or ps3peek 0 -s 0×1000000 -d 8 -b > hvdump.bin (does the same thing?)
Step 5: Upload the file for the real hackers here to play with

**Hansi** · 2010-11-22

http://psx-scene.com/forums/597656-post103.html

zAxis:

@ Hansi
do you have teensy 2.0?
if you do then could you do the following:
1- run this hex (as if you were running the jp: power cycle, start then eject)
2- reboot ps3 into linux (NO power cycling!! just do it through GameOS)
3- dumb the HV and post it here (or pm where it is)

if you dont have teensy then what board do you have at hand? (must atmel) I will make the hex

oh, and could you please sniff the usb? it ill help with debugging. ty

@ other ppl
I am just trying something, there is very good chance it wont work, so no flaming please

EDIT: please get psgroove2.zip it has a fix

As soon as I have received my sx28 controller to glitch (using xorlosers files) I will try this. Unless someone else beats me to it :-) It is on its way UPS express so it should arrive tomorrow.

psgroove2.zip

**skystar** · 2010-11-22

"Downgrade should be free for all just like the JigKick/Pandora memory on PSP!" why do you make money on free stuff then?=)

**Hansi** · 2010-11-22

Original inlägg av skystar

"Downgrade should be free for all just like the JigKick/Pandora memory on PSP!" why do you make money on free stuff then?=)

The word "free" can be used in different contexts. Free as in Freedom as in available to everyone. Or Free as in you dont have to pay to receive/use it.

We, as in "psxcare", run a business. We have hired staff that get paid every month. We have expensive web servers running in hired server rack space in secure (expensive!) data centers. We have a physical shop location where our staff work and where customers can come in to buy stuff and/or get stuff repaired/modified.

Just as you cant expect to bring your car with a new clutch in a box to your local mechanic and expect to have it installed for free, you cant expect us to install "free" stuff in our customers computers or game consoles without charging them a fee to cover our expenses and make a profit so we can pay ourself som salary so we can pay our rent and put food on the table for our kids...

**Hansi** · 2010-11-22

We would like to thank the PSJAILBREAK team for their policy change regarding psdowngrade!

They promise to release it as a FREE tool for all psjailbreak owners. And it will be for unlimited use. Great news for us distributors/resellers that will actually be able to sell some of our stock now that psjailbreak actually does something that is still not available with any of the clones.

**cloned67** · 2010-11-22

Hansi,

is there any chance to have some other dump now that is for free ?

many thnX

**cloned67** · 2010-11-23

for any of you may be interested , here is the flashing loop that write the .FLA into the PSJB dongle
it just send the content of the file in chunks of EXACT 128 bytes,(the length in fact is 1180 hex) the FLA is true is encrypted,
and the decryption is completely done inside the boot loader , which by the clues looks pretty much like a DES Algorithm

and probably the key is just a function of the serial number itself
or maybe even easier the serial number is just used to setup IV and the key is a fixed secret inside the boot loader

too me looks much to complex for this kind of product for them to have a DDBB
which would keep the association of each sold serialNum with respective KEY

--------------------------------------------------------------------------------------------

loc_40153B:
mov eax, [ebp+file_handle]
mov [esp+48h+var_3C], eax
mov [esp+48h+var_40], 80h
mov [esp+48h+var_44], 1
mov [esp+48h+var_48], offset read_buff
call fread
cmp eax, 80h
jnz print_NL

cmp [ebp+var_D], 0
jz print_NL

mov [esp+48h+var_2C], 2710h
mov [esp+48h+var_30], 80h
mov [esp+48h+var_34], offset read_buff
mov [esp+48h+var_38], 0
mov [esp+48h+var_3C], 0
mov [esp+48h+var_40], 1
mov [esp+48h+var_44], 21h
mov eax, ds:dongle_handle
mov [esp+48h+var_48], eax
call usb_control_msg
mov [esp+48h+var_2C], 3E8h
mov [esp+48h+var_30], 1
lea eax, [ebp+var_D]
mov [esp+48h+var_34], eax
mov [esp+48h+var_38], 0
mov [esp+48h+var_3C], 0
mov [esp+48h+var_40], 0
mov [esp+48h+var_44], 0A1h
mov eax, ds:dongle_handle
mov [esp+48h+var_48], eax
call usb_control_msg
mov [esp+48h+var_48], offset a_ ; "."
call printf
mov eax, ds:_iob
add eax, 20h
mov [esp+48h+var_48], eax
call fflush
jmp loc_40153B

print_NL: ; "\n"
mov [esp+48h+var_48], offset asc_403006
call printf
cmp [ebp+var_D], 4
jnz short Flash_Failed

mov [esp+48h+var_48], offset aFlashCompleted ; "flash completed successfully!!!\n"
call printf
jmp short loc_401651

Flash_Failed:
movsx eax, [ebp+var_D]
mov [esp+48h+var_44], eax
mov [esp+48h+var_48], offset aFlashFailedD ; "FLASH FAILED: %d\n"
call printf

**Hansi** · 2010-11-24

Status from todays work so far:

PS3 version 3.15 have been modified with wires attached to do the geohot attack
Parallax SX28 development board arrived and xorlosers design to glitch the ps3 built
Linux installed on PS3

Right now:

Moving stuff around so we can run the ps3 on a good monitor for linux, and close enough to a computer running the Beagle USB sniffer
Looking at the latest zAxis psgrade version, this is the prototype downgrade code for the Teensy. It is used to trigger the usb key check routine so that the secret key will be waiting for us (hopefully) in the hypervisor memory that we will dump using xorloser tools.

**Hansi** · 2010-11-24

Some pictures of the setup...H1150002.jpg H1150001.jpg H1150003.jpg

**Hansi** · 2010-11-24

Linux guy is looking at the xorlosertools.

I am looking at the latest psgrade, hopefully i will figure out how to compile it for the teensy.

**Hansi** · 2010-11-24

R6Armadillo have compiled the latest psgrade, just waiting for the file as it is uploaded to one of the file download sites and not available just yet.

Thank you, you probably saved me one hour of work!

**Hansi** · 2010-11-24

Fresh psgrade flashed to teensy 2.0, thank you R6Armadillo.

Linux guy trying to run makefile for xorloser toolkit.

We got FATAL: modpost: GPL-incompatible module xorhack.ko uses GPL-only symbol 'nr_irqs'

We use a later version of ubuntu and it looks like our kernel is compiled with some sort of GPL blaha blaha checking that it does not need to do. Looking at a fix. Helpful tips appreciated.

**Hansi** · 2010-11-24

I need some food, going out for a quick lunch, hope the linux stuff is running when i get back.

**andyt12** · 2010-11-24

I think adding this to the module source should do it.

EXPORT_SYMBOL_GPL(nr_irqs);

**Hansi** · 2010-11-24

We changed something about "module license" from lgpl to gpl in some file and now make is running. Sorry about license infractions etc but it was an emergency :-)

**Hansi** · 2010-11-24

Gods are unhappy. Xorhack 2.0 ps3exploit refuse to loop "100 times" it just do one loop regardless of what i ask it to do.

First version cause kernel krashes.

I do have a dump now of latest version psgrade: psgrade usb dump 2010-11-24.rar

**Hansi** · 2010-11-24

We are installing Ubuntu 8.10 now, instead of the 10.10 we installed first. Thanks goes to the 4-5 unknown seeders who bothered to keep a very old torrent alive still.

**cloned67** · 2010-11-24

the dump is not really useful, is just interesting because it shows a fight over the BUS, but nothing more interesting (though) ...

PSGrade is still far away from a working JIG clone,
first of all because it still keeps the HUB stuff from PSGroove which is likely to be a wrong way to use the JIG clone,
in fact, PSDwngrade even if being made by the same people of PSJBreak ,
doesn't use the HUB stuff at all it just shows up as JIG and then answer to the challenge sent by PS3.

PSGroove doesn't work as a JIG clone , it just use it as additional exploit ...

I'm not sure but why they should use it like this if it would be easier having 2 version of the same code,
slightly modified to do both task ?? as in PSgroove/PSGrade ...

in the dump you got there's a problem even before the JIG shows up, and then PS3 just ignores it

**Hansi** · 2010-11-24

I hope it is useful for zaxis trying to code something that 1: helps us trigger the challenge to get the key into memory and 2: use as a jig when we have the key.

So I see the usb scans as a debugging tool for him, not more not less.

**cloned67** · 2010-11-24

So why you don't just trigger the challenge,
by using the original JIG clone or PSJailbreak which does it as well
(even if in this case maybe there's also something wrong given that the answer to the challenge is not really made to be checked )

PSJBreak challenge in your first dump follows ...

00 01 FF FF 2E 02 01 FE
28 99 E5 8D 3B 96 27 70
E3 50 8B BE 52 4C 39 21
68 C1 53

looks good , even if maybe in this case as said above may be corrupt ...

1) PSdowngrade as it's a real JIG clone will trigger it the right way
2) I can't see PS3 taking your PSGrade dongle too seriously in the last dump
3) PSJBreak can trigger it as well but the key may be corrupt

the real trouble with original JIG clone ,
could be to have chance to switch to Linux without loosing the RAM content
(I didn't see directly till now any PS3 running into service mode,
It just reboot the console at the end or what ? )