Editing ReDRM / Piracy dongles

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
{{Wikify}}
[[Category:Software]][[Category:Hardware]]
=Description=
=Description=
TrueBlue dongles are USB dongles for the PS3 which enable custom firmware 'special' functionality to launch resigned game backups. These dongles are themselves a form of DRM, as the particular format of these backups will not work without the TB dongle. Contentdisc's contain fself'ed eboot.bin's. <br />
TrueBlue dongle is DRM to make sure you have the dongle, the firmware 'special' functionality will not work without it.
Hardware-wise, there are many similarities with [[PS3Cobra_Payload_Reverse_Engineering#Hardware_Dongle|PS3Cobra]]
Contentdisc's contain fself'ed eboot.bin's. <br />
Hardwarewise, there are many simularities with [[PS3Cobra_Payload_Reverse_Engineering#Hardware_Dongle|PS3Cobra]]


== Clarifications ==
== Debunking ==
* '''If the content works with the dongle, that means the original content also works (without the dongle) if resigned for Firmware v3.55!'''
* '''If the content works with the dongle, that means the original content if resigned for 3.55 also works (without the dongle)!'''
* TrueBlue dongles/firmware do not support PSN (OFW and [[KaKaRoTo Kind of ´Jailbreak´]] do)
* No PSN (OFW and [[KaKaRoTo Kind of ´Jailbreak´]] do)
* Special features for PS Vita are not usable (OFW and [[KaKaRoTo Kind of ´Jailbreak´]] can)
* Cannot use special features for PS Vita (OFW and [[KaKaRoTo Kind of ´Jailbreak´]] can)
* TrueBlue cannot play Firmware 3.6x+/3.7x+/4.x+ original content (it does not have the keys for it).
 
* It can only play such content which is re-encrypted/resigned with the key supported by the dongle.
* It does not play 3.6x+/3.7x+/4.x+ original content (it does not have the keys for it).
** Such content was limited to already decryptable and debug eboot.bin's.
* It can only play such content which is re-encrypted/resigned with their donglekey.
*** Titles in the wild were almost entirely released by PARADOX (patches) & PARADiSO (full pirated releases) between November 2011 and June 2012 - with groups like BORG and EHRGEIZ appearing from May through June of 2012. There was also lighttake, which sold full pre-patched pirated Blu-ray discs. It seems possible that they were involved in the TrueBlue production/distribution. Profiting from or otherwise receiving money for re-applying DRM could likely be considered a scam.
** Such content will be limited to those already decryptable and debug eboot.bin's.
*** No public tools exist for 'converting' to TB format (re-encrypting/resigning) - making TB dongle users completely dependent on warez release groups like PARADOX/PARADiSO/BORG/EHRGEIZ.
*** At this moment, only a few titles in the wild released:
* Content for Firmware v3.55 and lower still works (after all, its just a MFW 3.55) - with some exceptions (in some cases it will even brick the dongle when running certain pieces of homebrew).
**** all by PARADOX (patches)/PARADiSO (full pirated releases) and lighttake that sells full prepatched pirated BD-discs, which makes it seem they are into the money/DRM scam or otherwise profiting from releasing for it.
* Needs the MFW (and cannot work on OFW's, that is why there is no 'power/eject trick')
**** Because the resellers profit from selling discs, those titles will not be released by PARADOX (patches)/PARADiSO (full pirated releases)
**** You can hear daily 'more games today' and still see nothing released for 5+ days in a row
** no public tools exist for 'converting' to TB format (re-encryption/resigning) - making you completely dependant of releasegroups like PARADOX/PARADiSO.
* Content for 3.55 and lower still work (after all, its just a MFW 3.55) - with some exceptions (in some cases it will even brick the dongle when running those homebrew)
* Needs the MFW (and cannot work on OFW's, that is why there is 'no power/eject trick')
* Cannot be used for downgraded consoles (which rely on lv1 syscon hashcheck patches)
* Cannot be used for downgraded consoles (which rely on lv1 syscon hashcheck patches)
* If you are using special firmware now, they will not be compatible with this one. e.g. Incompatible with:
* If you are using special firmwares now, they will not be compatible with this one. e.g. Incompatible with:
** OtherOS++
** OtherOS++
** Proper MFW's
** Proper MFW's
Line 256: Line 261:
CLK for Actel <br />
CLK for Actel <br />
==== AMS1117  2.851049 - Low Dropout Linear Regulator ====
==== AMS1117  2.851049 - Low Dropout Linear Regulator ====
Datasheet:  
Datasheet: http://www.sltdigital.com/product/product_pdf/AMS1117.pdf / http://home1.cyber-labo.co.jp/board/goods/pdf/AMS1117.pdf <br />
* https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Datasheets/AMS1117-.pdf
* https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Datasheets/AMS1117.pdf<!--// http://www.sltdigital.com/product/product_pdf/AMS1117.pdf / http://home1.cyber-labo.co.jp/board/goods/pdf/AMS1117.pdf //--> <br />
[[:File:AMS1117 - SOT-223.png]]
[[:File:AMS1117 - SOT-223.png]]


Line 298: Line 301:
== Dongle Clones ==
== Dongle Clones ==


=== Jb2usb ===
* JB-King is a "copy-cat" clone by dongle makers in China. (some have claimed by the makers of PS3Go)
 
<table width="100%" align="left"><tr>
<table width="100%" align="left"><tr>
<td align="left">[[File:Jb2usb1.jpg|200px|thumb|left|Jb2usb clone dongle overview]]</td>
<td align="left">[[File:Jb-king-front.jpg|200px|thumb|left|JB-King clone dongle front]]<br />[[File:JB-King BACK.jpg|200px|thumb|left|JB-King clone dongle - BACK]]</td>
<td align="left">[[File:Jb2usb2.jpg|200px|thumb|left|Jb2usb clone dongle board]]</td></tr></table>
<td align="left">[[File:JB-King_Dongle_Abkarino_DVD4Arab_01.png|200px|thumb|left|tb-king clone dongle overview]]</td>
<br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br />
<td align="left">[[File:JB-King_Dongle_Abkarino_DVD4Arab_02.png|200px|thumb|left|tb-king clone dongle board]]</td></tr></table>
 
=== JB-King ===
* JB-King is a "copy-cat" clone by dongle makers in China. (some have claimed by the makers of PS3Go). Its poetic, piracy and theft of the "intellectual property" of pirates and thieves.


<gallery>
Its poetic, piracy and theft of the "intellectual property" of pirates and thieves.
File:Jb-king-front.jpg|JB-King clone dongle front
File:JB-King BACK.jpg|JB-King clone dongle - BACK
File:JB-King_Dongle_Abkarino_DVD4Arab_01.png|tb-king clone dongle overview
File:JB-King_Dongle_Abkarino_DVD4Arab_02.png|tb-king clone dongle board
File:JBKing-1.jpg
File:JBKing-2.jpg
</gallery>


=== Components ===
=== Components ===
Line 328: Line 322:
I - Temperature Range: Industrial (-40'C ~ 85'C)
I - Temperature Range: Industrial (-40'C ~ 85'C)
G - Environment: Green Package (Lead-free, RoHS Compliant, Halogen-free (TBBA), Antimony-Oxie-free)</pre>
G - Environment: Green Package (Lead-free, RoHS Compliant, Halogen-free (TBBA), Antimony-Oxie-free)</pre>
datasheet: [http://www.winbond.com/NR/rdonlyres/C6366616-2CB7-49F8-A1F9-3BC363DF9480/0/W25X16A.pdf W25X16A.pdf (1.3 MB)] / https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/Datasheets/W25X16A.pdf <br />
datasheet: [http://www.multiupload.com/P2833U5SOW W25X16A.pdf (1.3 MB)] <br />
Note: can use [http://blog.hodgepig.org/busninja/ Bus Ninja] or [http://flashrom.org/Bus_Pirate Bus Pirate] and [http://flashrom.org/Flashrom FlashROM] - <abbr title="In-System Programming (ISP)">ISP</abbr> is possible, so long as no other devices on the SPI bus are trying to access the device (in that case, you might want to cut Vcc to the FPGA or the regulator for it).  
Note: can use [http://blog.hodgepig.org/busninja/ Bus Ninja] or [http://flashrom.org/Bus_Pirate Bus Pirate] and [http://flashrom.org/Flashrom FlashROM] - <abbr title="In-System Programming (ISP)">ISP</abbr> is possible, so long as no other devices on the SPI bus are trying to access the device (in that case, you might want to cut Vcc to the FPGA or the regulator for it).  


Line 360: Line 354:
==== STM32 F103C8T6 : U2 ====
==== STM32 F103C8T6 : U2 ====
U2 <br />
U2 <br />
datasheet: [https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Datasheets/stm32_f103c8t6.pdf stm32_f103c8t6.pdf (1.38 MB)]
datasheet: [http://www.multiupload.com/WPXWYMX3UU stm32_f103c8t6.pdf (1.38 MB)]
===== Pinout STM32 F103C8T6 LQFP48 =====
===== Pinout STM32 F103C8T6 LQFP48 =====
<div style="float:right">[[File:STM32 F103C8T6 - LQFP48.png|200px|thumb|left|STMicroelectronics STM32 F103C8T6 - LQFP48 package]]</div>
<div style="float:right">[[File:STM32 F103C8T6 - LQFP48.png|200px|thumb|left|STMicroelectronics STM32 F103C8T6 - LQFP48 package]]</div>
Line 702: Line 696:
= Downloads =
= Downloads =
== First release (1.0/2.1) ==
== First release (1.0/2.1) ==
* MFW: [https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Firmware/Jailbreak2.CFW.rar Jailbreak2.CFW.rar (172.34 MB)]<!--//http://www.filesonic.nl/file/2688912531/Jailbreak2.CFW.zip (password: whyudie)//-->
* MFW: [http://www.multiupload.com/O7SP26A83E Jailbreak2.CFW.rar (172.34 MB)]<!--//http://www.filesonic.nl/file/2688912531/Jailbreak2.CFW.zip (password: whyudie)//-->
** Alternative FW compatible with the PSJB2/TrueBlue dongle DRM lock-in : [http://rebug.me REBUG 3.55.2 TB EDITION] / [https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Firmware/3.55.2_TBE_Links.rar 3.55.2_TBE_Links.rar]
** Alternative FW compatible with the PSJB2/TrueBlue dongle DRM lock-in : [http://rebug.me REBUG 3.55.2 TB EDITION]
* Dongle Updater v2.1: [https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.1/dongle-updater.pkg dongle-updater.pkg (2.1 MB)]<!--//http://www.filesonic.nl/file/2689038911/JB2.Dongle.Updater.zip (password: whyudie)//-->
* Dongle Updater v2.1: [http://www.multiupload.com/9YPQX47G7F JB2.Dongle.Updater.rar (2.1 MB)]<!--//http://www.filesonic.nl/file/2689038911/JB2.Dongle.Updater.zip (password: whyudie)//-->
 
== Update 2.2 ==
== Update 2.2 ==
* Dongle Updater v2.2: https://web.archive.org/web/*/http://ps3devwiki.com/files/TrueBlue/Updates/TrueBlueUpdate-2.2/
* Dongle Updater v2.2: [http://www.multiupload.com/QU4XVYD4CF TrueBlueUpdate2_2.zip (544.2 KB)]


== FW Info (1.0/2.1) ==
== FW Info (1.0/2.1) ==
Line 772: Line 765:
Data length: 172890112
Data length: 172890112
File hash : 93A7A95BFCFC263DCB4A18477062FDCC72BE47A0</pre>
File hash : 93A7A95BFCFC263DCB4A18477062FDCC72BE47A0</pre>
== JBKing 1.5 update ==
http://www.ps3hax.net/2012/03/finally-jb-king-cracks-v2-5-update/
https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/JBKing/Updates/JBKing%202.5/


=Content discs=
=Content discs=
Line 849: Line 837:
== Paradox TB ==
== Paradox TB ==
Note: Releases seen in the wild are full BD content prepatched for TrueBlue. We are only interested in documenting/reversing, so please don't post full links (only stripped).
Note: Releases seen in the wild are full BD content prepatched for TrueBlue. We are only interested in documenting/reversing, so please don't post full links (only stripped).
* [https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Patches/portal_2_BLUS30732_TB.rar portal_2_BLUS30732_TB.rar (78.04 MB)]
* [http://www.multiupload.com/9A4DXVTXX9 portal_2_BLUS30732_TB.rar (78.04 MB)]


=== EBOOT.BIN details ===
=== EBOOT.BIN details ===
Line 857: Line 845:
== FW Changes (1.0/2.1) ==
== FW Changes (1.0/2.1) ==
Compared to OFW 3.55:
Compared to OFW 3.55:
[https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Firmware/analysis/ofw-vs-jb2.rar ofw-vs-jb2.rar (4.18 MB)]
[http://www.multiupload.com/LAIIB6IMX0 ofw-vs-jb2.rar (4.18 MB)]
====EULA.xml====
====EULA.xml====
<pre> <str id="msg_updater_10">This update will install PS3 system software version 3.55, modified to support homebrew software and the disc dongle.</str> </pre>
<pre> <str id="msg_updater_10">This update will install PS3 system software version 3.55, modified to support homebrew software and the disc dongle.</str> </pre>
Line 885: Line 873:
only 1 function change, and a section added <br />
only 1 function change, and a section added <br />
sub_28fe30 is replaced <small>1)</small><br />
sub_28fe30 is replaced <small>1)</small><br />
the new section is loaded at 0x80000000007f0000 (which is where those payloads are being loaded) [https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Firmware/analysis/lv2_kernel.bin lv2_kernel.bin (6.41 KB)]
the new section is loaded at 0x80000000007f0000 (which is where those payloads are being loaded) [http://www.multiupload.com/CI5XRM3FOP lv2_kernel.bin (6.41 KB)]


<small>note 1) : * ''the 28fe30 function is replaced with OFW code during exploit execution (which is why it is OFW, when there is no dongle). That 28fe30 function mounts dev_flash, so they are in control before even dev_flash loads. When lv2 loads dev_flash, the exploit is triggered which, among the things it does, is replace the function with the proper one to mount dev_flash, then branchs to it and boot continues.''</small>
<small>note 1) : * ''the 28fe30 function is replaced with OFW code during exploit execution (which is why it is OFW, when there is no dongle). That 28fe30 function mounts dev_flash, so they are in control before even dev_flash loads. When lv2 loads dev_flash, the exploit is triggered which, among the things it does, is replace the function with the proper one to mount dev_flash, then branchs to it and boot continues.''</small>
Line 920: Line 908:


== 2.1 ==
== 2.1 ==
[https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.1/dongle-updater.pkg TrueBlueUpdate-2.1/dongle-updater.pkg]
Dongle is released with 1.0, this PKG is used to update the dongle to 2.1
Dongle is released with 1.0, this PKG is used to update the dongle to 2.1
     SHA1: 4066FFEFD723FAF08EB84A62F4AA38180C40129C // MD5: 0200689D58FCA0FC51F7B738C33A5DC9 // CRC32: 4D72836 // CRC16: 8A62  
     SHA1: 4066FFEFD723FAF08EB84A62F4AA38180C40129C // MD5: 0200689D58FCA0FC51F7B738C33A5DC9 // CRC32: 4D72836 // CRC16: 8A62  


Unpkg/unself'ed: [http://www.multiupload.com/XC00DAHUXP dongle-updater.pkg.out.rar (2.03 MB)] <br />
Plaintext visible in the unself'ed eboot.bin : http://pastebin.com/EFQczE2r (interesting note: it used /dev_hdd0/vsh/tmp.bin as temp for the payload)<br />
Plaintext visible in the unself'ed eboot.bin : http://pastebin.com/EFQczE2r (interesting note: it used /dev_hdd0/vsh/tmp.bin as temp for the payload)<br />


Line 935: Line 922:
   002084E0  001FFFF0  EB 3B 01 F7 6F A9 CF 3C B6 EB 89 82 7D E6 7D 3B  ë;.÷o©Ï<¶ë‰‚}æ};
   002084E0  001FFFF0  EB 3B 01 F7 6F A9 CF 3C B6 EB 89 82 7D E6 7D 3B  ë;.÷o©Ï<¶ë‰‚}æ};


[https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.1/TB_dongle_payload.bin TrueBlueUpdate-2.1/TB_dongle_payload.bin (2 MB)]
[http://www.multiupload.com/PFC3IZZNNN TB_dongle_payload.bin (2 MB)]
     SHA1: 43402D6FE2ECE43EBE91531EFA07C366D46DD121 // MD5: BA5AFAB174BF6003D41AC8951301B822 // CRC32: 248284D2 // CRC16: 8C78
     SHA1: 43402D6FE2ECE43EBE91531EFA07C366D46DD121 // MD5: BA5AFAB174BF6003D41AC8951301B822 // CRC32: 248284D2 // CRC16: 8C78


Line 1,418: Line 1,405:
   00000010  03 6b 2d 2c 45 d7 25 ff  aa 34 b1 a8 8b 5d a7 b3   
   00000010  03 6b 2d 2c 45 d7 25 ff  aa 34 b1 a8 8b 5d a7 b3   
   ...
   ...


== 2.2 ==
== 2.2 ==
True Blue Dongle Update v2.2 - Initial worldwide release
True Blue Dongle Update v2.2 - Initial worldwide release
    SHA1: 504D53CD6EDFA3382510CCB40CE49F802073FBD4 // MD5: A09CBCD5B3AEC31B07D974BEB4AC21FE // CRC32: 82F977CC // CRC16: 92D4


[https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.2/TrueBlueUpdate-2.2.pkg TrueBlueUpdate-2.2/TrueBlueUpdate-2.2.pkg]
Unpkg/unself'ed: [http://www.multiupload.com/NUILFATYL1 TrueBlueUpdate-2.2.pkg.out.rar (1018.2 KB)] <br />
    SHA1: 504D53CD6EDFA3382510CCB40CE49F802073FBD4 // MD5: A09CBCD5B3AEC31B07D974BEB4AC21FE // CRC32: 82F977CC // CRC16: 92D4


=== Payload (2.2) ===
=== Payload (2.2) ===
Line 1,433: Line 1,421:
   0007B588  00072EF0  99 0A 4C 65 2A CE DE D6 0D C8 D2 73 FC B3 85 E2  ™.Le*ÎÞÖ.ÈÒsü³…â
   0007B588  00072EF0  99 0A 4C 65 2A CE DE D6 0D C8 D2 73 FC B3 85 E2  ™.Le*ÎÞÖ.ÈÒsü³…â


[https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.2/TB_payload_2.2.bin payload2-2.bin (459.75 KB)]
[http://www.multiupload.com/KARELUPQRS payload2-2.bin (459.75 KB)]
     SHA1: 69953C9CF60E67E798A22C1016ABCB44A1D42CDF // MD5: F0826BA059B352BC6100647DB7EFDE5F // CRC32: 4B3C2132 // CRC16: 8181
     SHA1: 69953C9CF60E67E798A22C1016ABCB44A1D42CDF // MD5: F0826BA059B352BC6100647DB7EFDE5F // CRC32: 4B3C2132 // CRC16: 8181


Line 2,229: Line 2,217:


== 2.3 ==
== 2.3 ==
True Blue Dongle Update v2.3 - [https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.3/TrueBlueUpdate-2.3.pkg /TrueBlueUpdate-2.3/TrueBlueUpdate-2.3.pkg]
True Blue Dongle Update v2.3 - [http://www.multiupload.com/S5S9X4UON0 TrueBlueUpdate-2.3.zip (546.29 KB)]
* Fixed games requiring "BD Mirror"
* Fixed games requiring "BD Mirror"
* True Blue firmware version is now displayed on the XMB "System Information" screen
* True Blue firmware version is now displayed on the XMB "System Information" screen
Line 2,236: Line 2,224:


<!--// The 'True Blue' team again comes thru with more support, this time with another update (v2.3), which was developed after the team was contacted by 'Paradox' in regard to problems with some of the latest games like 'Modern Warfare 3', and up-coming releases and patches, after some brain-storming and figuring out the compatibility problems the 'True Blue' team has now released the v2.3 update which will be required for all 'future' PS3 games released. //-->
<!--// The 'True Blue' team again comes thru with more support, this time with another update (v2.3), which was developed after the team was contacted by 'Paradox' in regard to problems with some of the latest games like 'Modern Warfare 3', and up-coming releases and patches, after some brain-storming and figuring out the compatibility problems the 'True Blue' team has now released the v2.3 update which will be required for all 'future' PS3 games released. //-->
Unpkg/unself'ed: [http://www.multiupload.com/FHT635SH7W TrueBlueUpdate-2.3.pkg.out.rar (1022.45 KB)] <br />


=== Payload (2.3) ===
=== Payload (2.3) ===
Line 2,245: Line 2,234:
   0007BD88  000736F0  99 0A 4C 65 2A CE DE D6 0D C8 D2 73 FC B3 85 E2  ™.Le*ÎÞÖ.ÈÒsü³…â
   0007BD88  000736F0  99 0A 4C 65 2A CE DE D6 0D C8 D2 73 FC B3 85 E2  ™.Le*ÎÞÖ.ÈÒsü³…â


[https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.3/payload_2.3.bin payload_2.3.bin (461.75 KB)]
[http://www.multiupload.com/F0OVXTV2UV payload_2.3.bin (461.75 KB)]
   SHA1: DD8C3302F5F2394B2A0D907DE972AFB8E94DB0B5 // MD5: 7E4C3C6D7BA24375D3BE83074D882E0A // CRC32: 7D748CE8 // CRC16: 4A3B
   SHA1: DD8C3302F5F2394B2A0D907DE972AFB8E94DB0B5 // MD5: 7E4C3C6D7BA24375D3BE83074D882E0A // CRC32: 7D748CE8 // CRC16: 4A3B


Line 2,274: Line 2,263:


== 2.4 ==
== 2.4 ==
[https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.4/TrueBlueUpdate-2.4.pkg TrueBlueUpdate-2.4/TrueBlueUpdate-2.4.pkg]
[http://www.multiupload.com/8D38XV8KFK TrueBlueUpdate-2.4.zip (704.48 KB)]
 
Unpkg/unself'ed: [http://www.multiupload.com/5TA80L7I8V UP0001-TRUEBLUE4_00-0000000000000000.rar (1.31 MB)]
 
=== Payload (2.4) ===
=== Payload (2.4) ===
located in unself'ed eboot.bin @ offset:
located in unself'ed eboot.bin @ offset:
Line 2,283: Line 2,275:
   000A3620  0009AEFF  99 0A 4C 65 2A CE DE D6 0D C8 D2 73 FC B3 85 E2  ™.Le*ÎÞÖ.ÈÒsü³…â
   000A3620  0009AEFF  99 0A 4C 65 2A CE DE D6 0D C8 D2 73 FC B3 85 E2  ™.Le*ÎÞÖ.ÈÒsü³…â


[https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.4/payload_2.4.bin payload_2.4.bin (619.75 KB)]
[http://www.multiupload.com/0F9906NKSO payload_2.4.bin (619.75 KB)]
   SHA1: C062057BFBE4A0DF6C6C6E1B33C7561BC859C23F // MD5: 69FC4CE04DD4255A0BEEF4C2168F0AB0 // CRC32: 1C9EE18 // CRC16: 85DE
   SHA1: C062057BFBE4A0DF6C6C6E1B33C7561BC859C23F // MD5: 69FC4CE04DD4255A0BEEF4C2168F0AB0 // CRC32: 1C9EE18 // CRC16: 85DE


IDA DB: [https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.4/EBOOT_SHT_fixed.i64 EBOOT_SHT_fixed.i64 (3.01 MB)]
IDA DB: [http://www.multiupload.com/2GBP8AY2NF EBOOT_SHT_fixed.i64 (3.01 MB)]


== 2.5 ==
== 2.5 ==
=== Payload (2.5) ===
start: 8600, end: 63e00, size: 5b800
start: 8600, end: 63e00, size: 5b800


[https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.5/EBOOT,BIN.elf TrueBlueUpdate-2.5/EBOOT,BIN.elf]
http://www.mirrorcreator.com/files/LVSICBFB/TB_2.5_updater.elf_links


[https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.5/update_data_2.5.bin TrueBlueUpdate-2.5/update_data_2.5.bin]
http://www.mirrorcreator.com/files/1DKNUZOW/update_data_2.5.bin_links


== 2.61 ==
<code>zadow@zadow-PC ~
[https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.61/TrueBlueUpdate-2.61.pkg TrueBlueUpdate-2.61.pkg]
$ readself eboot.bin
=== Payload (2.61) ===
  priv file: /home/zadow/.ps3//app-priv-360 (ERROR)
located in unself'ed eboot.bin @ offset:
  key file:  /home/zadow/.ps3//idps (ERROR)
SELF header
  elf #1 offset:  00000000_00000090
  header len:    00000000_00000a80
  meta offset:    00000000_000004a0
  phdr offset:    00000000_00000040
  shdr offset:    00000000_00061070
  file size:      00000000_00071524
  auth id:        10100000_01000003 (Unknown)
  vendor id:      01000002
  info offset:    00000000_00000070
  sinfo offset:  00000000_00000290
  version offset: 00000000_00000390
  control info:  00000000_000003c0 (00000000_00000100 bytes)
  app version:    3.40.0
  SDK type:      Retail
  app type:       NP-DRM application


  Offset(h)  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
Control info
  00008768   00000000  E4 C7 60 B6 E3 77 C2 89 B3 71 1D 06 EE 4C DF F7  äÇ`¶ãw‰³q..îLß÷
  control flags:
     ...
    40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  00066F58   0005E7F0 99 0A 4C 65 2A CE DE D6 0D C8 D2 73 FC B3 85 E2 ™.Le*ÎÞÖ.ÈÒsü³…â
   file digest:
     62 7c b1 80 8a b9 38 e3 2c 8c 09 17 08 72 6a 57 9e 25 86 e4
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   NPDRM info:
    magic: 4e504400
    unk0 : 00000001
    unk1 : 00000003
    unk2 : 00000001
    content_id: UP0001-TRUEBLUE4_00-0000000000000000
    digest:    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    invdigest: 04 9c 2d 70 9d ee ac 8f e2 3f db 52 a8 f6 dd fb
    xordigest: 02 43 1f ec 41 3b 64 c4 70 a1 2b 4a 36 9b 92 15


[https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.61/payload_2.61.bin payload_2.61.bin (378 KB)]
Section header
  SHA1: 7CEA46601B717912D6A434CA2C164E0A9B890825 // MD5: 1114BC3061581FC592A3797B340FD545 // CRC32: B66F50FD // CRC16: B685
    offset            size              compressed unk1    unk2    encrypted
    00000000_00000a80  00000000_00060369 [YES]      00000000 00000000 [YES]
    00000000_00060df0  00000000_0000027a [YES]      00000000 00000000 [YES]
    00000000_00061070  00000000_00000008 [YES]      00000000 00000000 [YES]
    00000000_00061080  00000000_00000008 [YES]      00000000 00000000 [YES]
    00000000_00061090  00000000_00000000 [NO ]      00000000 00000000 [YES]
    00000000_00061090  00000000_00000004 [NO ]      00000000 00000000 [N/A]
    00000000_000610a0  00000000_00000020 [NO ]      00000000 00000000 [N/A]
    00000000_000610c0  00000000_00000040 [NO ]      00000000 00000000 [N/A]


IDA DB: [https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.61/TrueBlueUpdate-2.61.idc TrueBlueUpdate-2.61.idc (203 KB)]
Encrypted Metadata
  Key:           87 c7 4f fe 66 93 0b aa a1 6f 86 40 91 c5 66 fb
  IV :           08 28 b5 8f ac f9 de c8 d7 0d fe f0 f3 76 63 ae
  Signature end  000009e0
  Sections        7
  Keys            52


== 2.62 ==
  Sections
=== Payload (2.62) ===
    Offset            Length            Key IV  SHA1 Type
located in unself'ed eboot.bin @ offset:
    00000000_00000a80 00000000_00060369 006 007 000    2
    00000000_00060df0 00000000_0000027a 014 015 008    2
    00000000_00061070 00000000_00000008 022 023 016    2
    00000000_00061080 00000000_00000008 030 031 024    2
    00000000_00061090 00000000_00000000 038 039 032    2
    00000000_00061090 00000000_00000004 -01 -01 040    1
    00000000_000610a0 00000000_00000020 -01 -01 046    1


  Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
  Keys
  00000000 E0 AE 1B 14 9D 24 05 8A D0 BB 65 D8 7F CC 1C 24  à®...$.ŠÐ»eØ.Ì.$
    Idx  Data
    ...
    000  9c 4e aa 52 6c 32 46 ad 89 84 2e 28 0e 5b 10 8b
  0005E7F0 99 0A 4C 65 2A CE DE D6 0D C8 D2 73 FC B3 85 E2 ™.Le*ÎÞÖ.ÈÒsü³…â
    001  20 01 fe ce 00 00 00 00 00 00 00 00 00 00 00 00
    002  30 8b da 8f 22 de 20 4b be ef ef b7 2c 23 ee 79
    003  dd fa 9c a8 d1 69 53 f9 77 a1 7e b1 77 a7 7c 83
    004  0f e1 61 63 43 8d 21 b2 46 0c 5c 89 71 2e f7 8f
    005  00 35 70 ca 5e 5d f7 69 2f bb 89 98 09 c0 10 63
    006  ef 25 79 e9 6d 56 1f c6 1d ef 7f 03 f7 76 1b 0e
    007  5b 9b f0 7d b2 57 a1 92 b6 34 d0 3e 78 37 4b 4c
    008  53 33 fc 56 63 c4 19 53 1e ea f4 45 4d 6d c7 18
    009  a6 37 87 95 00 00 00 00 00 00 00 00 00 00 00 00
    010  d4 cd f7 02 12 9b 74 40 b7 86 c0 0e f8 4d 13 1c
    011  97 99 71 aa bb 6e 24 43 1a 5e 0f f3 59 26 0a c6
    012  79 47 54 84 c6 f9 15 2d da 40 e5 89 8a 84 15 b1
    013  b8 db 0c fb 64 54 1a bd 5b 71 4d c2 f2 b1 d9 06
    014  f5 c8 e0 f3 8f 33 c1 35 4c 2d 3d 87 ad aa c6 0c
    015  7c a0 cb ad da d0 a7 92 1f ab be 47 3c 6a e8 43
    016  fc 81 98 42 cc 47 e7 8f 8e 67 b7 85 7f 40 05 ec
    017  5e 68 df 84 00 00 00 00 00 00 00 00 00 00 00 00
    018  49 99 ee 9b 1a 7d 9b 2b 79 95 1b 29 0d fa a0 5e
    019  97 b2 af 41 d1 a7 f6 de c9 8f 19 1f da cf 5e a0
    020  38 b7 41 ab d4 b4 ce a0 34 4f 0b 0a 34 d4 58 3c
    021  f1 29 10 56 f1 52 5d 67 56 74 54 b4 fd 9b 66 63
    022  f1 b4 86 66 dc 4a 46 9d 88 39 64 f6 24 a3 0a 33
    023  2b 86 13 d3 7c cd 4b 08 85 f3 cb 8e 5c fe d8 b5
    024  c0 51 7e cb a8 00 3e 4a b1 51 25 09 6f 4b 70 69
    025  9d 3d 06 4e 00 00 00 00 00 00 00 00 00 00 00 00
    026  5b 49 9f 60 32 7a f1 60 0b 97 10 3a cb e4 c2 eb
    027  58 86 f1 58 a4 ef 5b 90 45 99 a3 b2 ea 45 8e 43
    028  37 db db b9 59 02 60 c2 f4 eb eb 14 ae e4 a5 12
    029  96 07 a5 cb d6 fc de 76 4a 83 1e 4f 14 f5 14 a9
    030  b1 c6 0c 41 cf 98 86 71 0d 50 77 43 2c 21 20 f1
    031  8a 15 f6 61 85 21 87 7b 7b 45 2d f4 50 f6 55 01
    032  fe a1 80 84 dd 7e 91 9b f1 04 69 63 af b9 74 93
    033  48 fe fc ad 00 00 00 00 00 00 00 00 00 00 00 00
    034  39 28 4d 8a 70 0a fb dd 42 45 00 a3 9b 94 af 33
    035  34 78 4e 09 4d c1 18 bc 31 96 34 1d 61 95 93 c0
    036  e6 4f 9a 7f 8e 86 9d a0 7c 19 a6 c5 fb ab ab 97
    037 38 ea 02 9e ea 16 0e 18 24 36 2b e7 79 4c 04 d8
    038  d0 fe 73 39 50 5f c5 04 26 5d 66 71 58 d2 22 2d
    039  c5 0b b7 91 40 46 7a 80 f3 60 39 0c 6b 70 c5 bc
    040  fd cf c6 ac 73 e8 9c a6 4e 89 0d 2d cc d8 29 e3
    041  04 8f ed 3d 00 00 00 00 00 00 00 00 00 00 00 00
    042  d8 1f bd e1 a3 6a 63 b6 94 38 88 ed 9b 9c 73 42
    043  8b bc bb d2 e2 5a 9c 5a 93 4c a0 f8 69 01 25 9e
    044 e5 0d e1 79 38 47 30 cc f6 ef 1f 22 c4 98 51 11
    045  a9 46 8d a4 e5 a1 76 53 5d fc 1b 98 ff c8 5c f1
    046 3d e2 b6 1b a2 fb fe f4 db 7d 29 89 30 99 4a 71
    047  66 8a c6 84 00 00 00 00 00 00 00 00 00 00 00 00
    048  7d 91 cc 95 3e de d3 5a f3 c2 40 1f ec c2 20 e4
    049  4a e3 2c 40 22 4a 9c e8 8d ec bc fa 8b 9d 40 9c
    050  4e 48 aa 9c a6 bf d5 ac 2c e9 f3 2d 42 e3 33 5a
    051 fb 3e c1 d4 1c b6 ed 21 fb 6e 77 1a fe 74 c9 3a


[https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.62/payload_2.62.bin payload_2.62.bin (378 KB)]
  SHA1: C5D37456FD5E59CFB648C82BBBE3FD95875E7C49 // MD5: 870C58F2CEC6BDB0ACF43EDD459ECD1C // CRC32: 35B2B2CA // CRC16: E3DE


== 2.7 ==
ELF header
=== Payload (2.7) ===
  type:                                Executable file
located in unself'ed eboot.bin @ offset:
  machine:                              PowerPC64
  version:                              1
  phdr offset:                          00000000_00000040
  shdr offset:                         00000000_00070e20
  entry:                                00000000_000800f0
  flags:                                00000000
  header size:                          00000040
  program header size:                  00000038
  program headers:                      8
  section header size:                  00000040
  section headers:                      28
  section header string table index:    27


  Offset(h) Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
Program headers
  000087c8  00000000 E0 AE 1B 14 9D 24 05 8A D0 BB 65 D8 7F CC 1C 24 à®...$.ŠÐ»eØ.Ì.$
    type  offset            vaddr            paddr
     ...
          memsize          filesize          PPU  SPE  RSX  align
  00067fc8  0005F7F0 D9 5A C0 45 E8 78 E6 C6 16 0A 98 10 1B CA 52 3B ÙZÀEèxæÆ..˜..ÊR;
    LOAD 00000000_00000000 00000000_00010000 00000000_00010000
          00000000_000651a0 00000000_000651a0 r-x  r--  ---  00000000_00010000
    LOAD 00000000_00070000 00000000_00080000 00000000_00080000
          00000000_00001328 00000000_000005c8 rw-  rw-  ---  00000000_00010000
    LOAD 00000000_000705c8 00000000_00000000 00000000_00000000
          00000000_00000000 00000000_00000000 r--  --- ---  00000000_00010000
    LOAD 00000000_000705c8 00000000_00000000 00000000_00000000
          00000000_00000000 00000000_00000000 rw- --- ---  00000000_00010000
     LOAD 00000000_000705c8 00000000_00000000 00000000_00000000
          00000000_00000000 00000000_00000000 rw-  rw-  rw-  00000000_00010000
    ????? 00000000_0007038c 00000000_0008038c 00000000_0008038c
          00000000_00000090 00000000_00000004 r--  ---  ---  00000000_00000004
    ????? 00000000_00065140 00000000_00075140 00000000_00075140
          00000000_00000020 00000000_00000020 ---  ---  ---  00000000_00000008
    ????? 00000000_00065160 00000000_00075160 00000000_00075160
          00000000_00000040 00000000_00000040 ---  --- --- 00000000_00000004


[https://web.archive.org/web/*/http://ps3devwiki.com/files/reDRM/TrueBlue/Updates/TrueBlueUpdate-2.7/TB_payload_27.bin TB_payload_27.bin (382 KB)]
Section headers
   SHA1: 107A4E37471D58E79B6F8A884FF09DD3A5F83DD0 // MD5: 495970F92139F966BF78E43509BB7C38 // CRC32: FBA0FCEB // CRC16: AD81
  [Nr] Name            Type      Addr              ES Flg Lk Inf Al
      Off                      Size
  [00] <no-name>      NULL      00000000_00000000 00    00 000 00
      00000000_00000000        00000000_00000000
  [01] <no-name>      PROGBITS  00000000_00010200 00 wa  00 000 04
      00000000_00000200        00000000_0000002c
  [02] <no-name>      PROGBITS  00000000_00010230 00 wa  00 000 08
      00000000_00000230        00000000_00007ae8
  [03] <no-name>      PROGBITS  00000000_00017d18 00 wa  00 000 04
      00000000_00007d18        00000000_00000024
  [04] <no-name>      PROGBITS  00000000_00017d3c 00 wa  00 000 04
      00000000_00007d3c        00000000_00000640
  [05] <no-name>      PROGBITS  00000000_0001837c 00  a  00 000 04
      00000000_0000837c        00000000_00000004
  [06] <no-name>      PROGBITS  00000000_00018380 00  a  00 000 04
      00000000_00008380        00000000_00000070
  [07] <no-name>      PROGBITS  00000000_000183f0 00  a  00 000 04
      00000000_000083f0        00000000_000000c8
  [08] <no-name>      PROGBITS  00000000_000184b8 00  a  00 000 04
      00000000_000084b8        00000000_00000004
  [09] <no-name>      PROGBITS  00000000_000184bc 00  a  00 000 04
      00000000_000084bc        00000000_00000004
  [10] <no-name>      PROGBITS  00000000_000184c0 00  a  00 000 04
      00000000_000084c0        00000000_00000004
  [11] <no-name>      PROGBITS  00000000_000184c4 00  a  00 000 04
      00000000_000084c4        00000000_00000134
  [12] <no-name>      PROGBITS  00000000_000185f8 00  a  00 000 04
      00000000_000085f8        00000000_00000004
  [13] <no-name>      PROGBITS  00000000_00018600 00  a  00 000 08
      00000000_00008600        00000000_0005cb40
  [14] <no-name>      PROGBITS  00000000_00075140 00  ae 00 000 08
      00000000_00065140        00000000_00000020
  [15] <no-name>      PROGBITS  00000000_00075160 00  a  00 000 04
      00000000_00065160        00000000_00000040
  [16] <no-name>      PROGBITS  00000000_00080000 00  ae 00 000 04
      00000000_00070000        00000000_00000008
  [17] <no-name>      PROGBITS  00000000_00080008 00  ae 00 000 04
      00000000_00070008        00000000_00000008
  [18] <no-name>      PROGBITS  00000000_00080010 00  ae 00 000 04
      00000000_00070010        00000000_00000004
  [19] <no-name>      PROGBITS  00000000_00080014 00  ae 00 000 04
      00000000_00070014        00000000_000000c8
  [20] <no-name>      PROGBITS  00000000_000800e0 00  ae 00 000 08
      00000000_000700e0        00000000_00000060
  [21] <no-name>      PROGBITS  00000000_00080140 00  ae 00 000 08
      00000000_00070140        00000000_0000024c
  [22] <no-name>      PROGBITS  00000000_0008038c 00  ae 00 000 04
      00000000_0007038c        00000000_00000004
  [23] <no-name>      NOBITS   00000000_00080390 00  ae 00 000 04
      00000000_00070390        00000000_0000008c
  [24] <no-name>      PROGBITS  00000000_00080420 00  ae 00 000 08
      00000000_00070420        00000000_000001a8
  [25] <no-name>      NOBITS    00000000_000805c8 00  ae 00 000 08
      00000000_000705c8        00000000_00000d60
  [26] <no-name>      PROGBITS  00000000_00000000 00    00 000 01
      00000000_000705c8        00000000_00000743
  [27] <no-name>      STRTAB    00000000_00000000 00    00 000 01
      00000000_00070d0b        00000000_00000115




{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
zadow@zadow-PC ~
$
</code>
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)