Editing Talk:Playstation Update Package (PUP)
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
= | = Playstation Update Package (PUP) - Discussion/Talk = | ||
What is the part that defines, what firmware it really is?. I mean, for firmwares below 3.55 we have all the keys so whe can forge any PUP and make it appear as a +3.55, that would be a way to downgrade, without the need of a dongle and recovery mode. | |||
I know there are version strings in pupheader,version.txt, info0, and in vsh.self.. but what is missing? What isn´t correclty set in mfw to make it pass the checks of a legit +3.55 fw? | |||
We are using recovery mode to downgrade because, we haven´t found a way to create a legit +3.55 | |||
== Unpacking a firmware == | |||
===Unpack the PUP=== | |||
Dots.txt | Dots.txt | ||
EULA.xml | |||
Update_Files.tar | Update_Files.tar | ||
Updater.self | |||
Version.txt | Version.txt | ||
VSH.tar | VSH.tar | ||
Zeros.bin | |||
=== Untar the Update_Files.tar === | === Untar the Update_Files.tar === | ||
BDIT_FIRMWARE_PACKAGE.pkg | BDIT_FIRMWARE_PACKAGE.pkg | ||
Line 37: | Line 25: | ||
BDPT_FIRMWARE_PACKAGE_306R.pkg | BDPT_FIRMWARE_PACKAGE_306R.pkg | ||
BDPT_FIRMWARE_PACKAGE_308R.pkg | BDPT_FIRMWARE_PACKAGE_308R.pkg | ||
BLUETOOTH_FIRMWARE.pkg | BLUETOOTH_FIRMWARE.pkg | ||
CORE_OS_PACKAGE.pkg | CORE_OS_PACKAGE.pkg | ||
dev_flash3_022.tar.aa.2010_11_27_051800 | |||
dev_flash_000.tar.aa. | dev_flash_000.tar.aa.2010_11_27_051337 | ||
dev_flash_001.tar.aa. | dev_flash_001.tar.aa.2010_11_27_051337 | ||
dev_flash_002.tar.aa. | dev_flash_002.tar.aa.2010_11_27_051337 | ||
dev_flash_003.tar.aa. | dev_flash_003.tar.aa.2010_11_27_051337 | ||
dev_flash_004.tar.aa. | dev_flash_004.tar.aa.2010_11_27_051337 | ||
dev_flash_005.tar.aa. | dev_flash_005.tar.aa.2010_11_27_051337 | ||
dev_flash_006.tar.aa. | dev_flash_006.tar.aa.2010_11_27_051337 | ||
dev_flash_007.tar.aa. | dev_flash_007.tar.aa.2010_11_27_051337 | ||
dev_flash_008.tar.aa. | dev_flash_008.tar.aa.2010_11_27_051337 | ||
dev_flash_009.tar.aa. | dev_flash_009.tar.aa.2010_11_27_051337 | ||
dev_flash_010.tar.aa. | dev_flash_010.tar.aa.2010_11_27_051337 | ||
dev_flash_011.tar.aa. | dev_flash_011.tar.aa.2010_11_27_051337 | ||
dev_flash_012.tar.aa. | dev_flash_012.tar.aa.2010_11_27_051337 | ||
dev_flash_013.tar.aa. | dev_flash_013.tar.aa.2010_11_27_051337 | ||
dev_flash_014.tar.aa. | dev_flash_014.tar.aa.2010_11_27_051337 | ||
dev_flash_015.tar.aa. | dev_flash_015.tar.aa.2010_11_27_051337 | ||
dev_flash_016.tar.aa. | dev_flash_016.tar.aa.2010_11_27_051337 | ||
dev_flash_017.tar.aa. | dev_flash_017.tar.aa.2010_11_27_051337 | ||
dev_flash_018.tar.aa. | dev_flash_018.tar.aa.2010_11_27_051337 | ||
dev_flash_019.tar.aa. | dev_flash_019.tar.aa.2010_11_27_051337 | ||
dev_flash_020.tar.aa. | dev_flash_020.tar.aa.2010_11_27_051337 | ||
dev_flash_021.tar.aa. | dev_flash_021.tar.aa.2010_11_27_051337 | ||
MULTI_CARD_FIRMWARE.pkg | MULTI_CARD_FIRMWARE.pkg | ||
RL_FOR_PACKAGE.img | RL_FOR_PACKAGE.img | ||
Line 110: | Line 93: | ||
====== unself the self's ====== | ====== unself the self's ====== | ||
... | ... | ||
==== unpkg dev_flash* ==== | ==== unpkg dev_flash* ==== | ||
content | content | ||
Line 229: | Line 211: | ||
│ ├── info0 | │ ├── info0 | ||
│ └── info1 | │ └── info1 | ||
├── update_files.tar | |||
├── update_flags.txt | ├── update_flags.txt | ||
├── version.txt | ├── version.txt | ||
└── vsh.tar | └── vsh.tar | ||
---- | ---- | ||
==Adding new keys to older firmwares== | ==Adding new keys to older firmwares== | ||
Line 245: | Line 230: | ||
Proof of concept with added keys to appldr (and none of the other mentioned files above) : | Proof of concept with added keys to appldr (and none of the other mentioned files above) : http://www.ps3devwiki.com/wiki/Talk:Patches#appldr_3.55_add_3.56.2F3.60_keys | ||
---- | ---- | ||
== Using fake upgrade to get lowest firmware version info == | == Using fake upgrade to get lowest firmware version info == | ||
<div style="float:right">[[File:PS3 MinVerChk | <div style="float:right">[[File:PS3 MinVerChk used on CECHG04 SEM-001.jpg|thumb|left|PS3_MinVerChk use on the CECHG04, using fake upgrade to get lowest firmware version info]]</div> | ||
http://ps3devwiki.com/files/firmware/MFW-CEX/MinVerCheck/ // [http://www.mirrorcreator.com/files/KMIA5YMJ/MinVerCheck.rar_links MinVerChk.rar (1.28 KB)] / [http://www.mediafire.com/?uciv46g415zdii6 mirror] | |||
CRC-16: 9A11 | CRC-16: 9A11 | ||
CRC-32 (Ethernet and PKZIP): 50EE9A92 | CRC-32 (Ethernet and PKZIP): 50EE9A92 | ||
Line 262: | Line 247: | ||
# It will shortly fail and display the Firmware Base Value | # It will shortly fail and display the Firmware Base Value | ||
Note: console needs to run at least FW 2.50? (2.30 didn't work) | Note: console needs to run at least FW 2.50? (2.30 didn't work) | ||
---- | |||
== Cinavia DRM == | |||
Watermark which survives ripping to e.g. xvid/mp3 | |||
Detection of watermark | |||
According to Cinavia website (www cinavia com) there are 4 possible warning messages on detection: | |||
=== Message Code 1: Playback stopped === | |||
<pre>Typical on-screen message: | |||
“Playback stopped. The content being played is protected by Cinavia™ and is not authorized for playback on this device. | |||
For more information, see http://www.cinavia.com. | |||
Message Code 1.” | |||
Typical front panel message: | |||
“Cinavia™ playback restriction (1).” | |||
Explanation | |||
The audio track of the video that you are playing contains a Cinavia code indicating it was intended for presentation using professional equipment only (for example, in a theater) and is not authorized for playback by consumers. | |||
Recommendations | |||
If the video that you are playing is a professionally produced video (such as a movie or television show), you will need to obtain a copy that was made with the permission of the copyright owner. | |||
If the video that you are playing back is a home movie or other personal recording, that includes some professionally produced content (including the audio track of a professionally produced movie or television show), you will need to either skip over the parts of the video that contain the professionally produced content during playback or else create or obtain a version of the video that does not include this protected material.</pre> | |||
=== Message Code 2: Copying stopped === | |||
<pre>Typical on-screen message: | |||
“Copying stopped. The content being copied is protected by Cinavia™ and is not authorized for copying from this device. | |||
For more information, see http:// www.cinavia.com. | |||
Message Code 2.” | |||
Typical front panel message: | |||
“Cinavia™ copy restriction (2)” | |||
Explanation | |||
The audio track of the video that you are copying contains a Cinavia code indicating that it was intended for duplication using professional equipment only (for example, by a professional replicator) and is not authorized for copying by consumers. | |||
Recommendations | |||
If the video that you are copying is a professionally produced movie or television show, you will need to obtain a copy that was made with the permission of its copyright owner. | |||
If the video that you are copying is a home movie or other personal recording that includes some professionally produced content (including the audio track of a professionally produced movie or television show), in order to make a copy you will need to either copy only those parts of the recording that do not include professionally produced content or else you may create or obtain a version of the video that does not include this protected material.</pre> | |||
=== Message Code 3: Audio muted === | |||
<pre>Typical on-screen message: | |||
“Audio outputs temporarily muted. Do not adjust the playback volume. The content being played is protected by Cinavia™ | |||
and is not authorized for playback on this device. For more information, see http://www.cinavia.com. Message Code 3.” | |||
Typical front panel message: | |||
“Cinavia™ playback restriction (3)” | |||
Explanation | |||
The audio track of the video that you are playing contains a Cinavia code indicating that it is an unauthorized copy of professionally-produced content. | |||
Recommendations | |||
If the video that you are playing is a professionally produced video (such as a movie or television show), you will need to obtain a copy that was made with the permission of the copyright owner. | |||
If the video that you are playing is a home movie or other personal recording that includes some professionally produced content (including the audio track of a professionally produced video), to play your recording without muting you may either: | |||
Pause the video, wait 30 seconds for the audio to be un-muted, then skip over those portions where the professionally produced material is used and continue playing the rest of the video, or | |||
Pause the video, wait 30 seconds for the audio to be un-muted, then play video from a different optical disc for at least 10 minutes before continuing playback of this video. | |||
For information on how this professionally produced content can be included in your home movies or other personal recordings in a way that will not be limited by Blu-ray Disc players, see Cinavia website : Guidelines for Use of Content in Home Movies.</pre> | |||
=== Message Code 4: Copying stopped === | |||
<pre>Typical on-screen message: | |||
“Copying stopped. This content is protected by Cinavia™ | |||
and is not authorized for copying from this device. | |||
For more information, see http://www.cinavia.com” | |||
Typical front panel message: | |||
“Cinavia™ copy restriction (4)” | |||
Explanation | |||
The audio track of the video that you are copying contains a Cinavia code indicating that it is an unauthorized copy of professionally produced content. | |||
Recommendation | |||
If the video that you are copying is a professionally produced video (such as a movie or television show), you should obtain a copy that was made with the permission of the copyright owner. | |||
If the video that you are copying is a home movie or other personal recording that includes some professionally produced material (including the audio track of a professionally produced movie or television show), in order to make a copy without interruption you will need to either copy only those parts of the recording that do not include professionally produced content or else you may create or obtain a version of the video that does not include this protected material. | |||
For information on how this professionally produced material can be included in your home movies or other personal recordings in a way that will not be limited by Blu-ray Disc players, see Guidelines for Use of Content in Home Movies.</pre> | |||
=== PS3 specifics === | |||
Cinavia is not experienced in firmware 3.01 and older - firmware 3.10 and higher contain Cinavia DRM | |||
Most likely suspects for the DRM are the player, streamsplitter and video- / audio decoders (e.g. libmp3dec.sprx) | |||
Content known to trigger Cinavia DRM: certain xvid/mp3 rips (e.g. Battle_Los_Angeles_2011_R5_XViD-IMAGiNE & the R5.LiNE.XViD-FOAM release of that same title / The.Tourist.DVDR-TWiZTED) | |||
Playing Cinavia DRM protected content with Showtime works without problems (Showtime uses ffmpg), PS3 Media Server can also be used with the MEncoder transcoder otherwise it fails. | |||
Debug firmware doesnt contain Cinavia DRM, neither has Rebug which uses same Debug system files (only CoreOS = Retail on Rebug) | |||
====30.07.2011 addition==== | |||
''''I have traced the Cinavia DRM checks to 4 separate sprx files and after a long time trying to patch these files I have found that 3 of those files are present in the DEBUG (DEX) firmware don’t have the Cinavia DRM checks enabled. Files are videoplayer_util sprx, videoplayer_plugin sprx and videoeditor_plugin sprx.'' | |||
''I have successfully copied these 3 sprx files from DEBUG (DEX) FW 341 over to my retail PS3 unit running OFW 341 using dev_blind and Cinavia seems to be now disabled. I’ve confirmed this by playing back a number of Cinavia affected video files.'' | |||
''This means that Cinavia is now disabled for all DLNA playback and copying, but Cinavia checks on AVCHD and BD playback are still present with Message Code 3 that mutes the audio as the sprx file with the Cinavia check bdp_plugin sprx is not present in DEX firmware because BD playback is disabled in DEBUG. If someone is able to patch Cinavia out of bdp_plugin sprx this will be solved too.'' | |||
''I have created a new task for PS3MFW so this can be easily made part of any new MFW’s as needed. Any FW version that has had the DEX firmware leaked should be able to be used to create a CFW of the same version. eg DEX 3.41 -> MFW 341 or DEX 355 -> MFW 355 etc etc. Don’t use sprx files from different FW versions! See git hacks for change_cinavia_files task source.'' | |||
''Big thanks to the KaKaRoTo and REBUG team for their community contributions as this would have never been possible without the knowledge they’ve shared with us.'''' | |||
http://git.dashhacks.com/~tical/ps3mfw/ticals-tasks <br /> | |||
[http://www.multiupload.com/EOM4RB3DPB change_cinavia_files.tcl (4.22 KB)] <br /> | |||
<pre> | |||
#!/usr/bin/tclsh | |||
# | |||
# ps3mfw -- PS3 MFW creator | |||
# | |||
# Copyright (C) Anonymous Developers (Code Monkeys) | |||
# | |||
# This software is distributed under the terms of the GNU General Public | |||
# License ("GPL") version 3, as published by the Free Software Foundation. | |||
# | |||
# Notes: videoplayer_util.sprx, videoplayer_plugin.sprx and videoeditor_plugin.sprx | |||
# have Cinavia DRM checks. These checks are disabled in DEX firmware so these | |||
# files can be replaced by those from the equivalent DEX firmware or if they | |||
# have been manually patched. | |||
# TODO: bdp_plugin.sprx also contains checks but BD playback is disabled on | |||
# DEX firmware so this file is not included in DEX firmware. This means that | |||
# DNLA copy/playback won't have any Cinavia checks done on it but a copied BD | |||
# playback will still check for Cinavia and mute the audio (Message Code 3) | |||
# until DEX firmware with a bdp_plugin.sprx is released or someone patches | |||
# this file manually. | |||
# Priority: 2300 | |||
# Description: Change Cinavia DRM affected files | |||
# Option --cinavia-videoplayerutil: Patched videoplayer_util.sprx filename | |||
{ | # Option --cinavia-videoplayerplugin: Patched videoplayer_plugin.sprx filename | ||
# Option --cinavia-videoeditorplugin: Patched videoeditor_plugin.sprx filename | |||
# Option --cinavia-bdpplugin: Patched bdp_plugin.sprx filename | |||
# Type --cinavia-videoplayerutil: file open {"SPRX library" {sprx}} | |||
# Type --cinavia-videoplayerplugin: file open {"SPRX library" {sprx}} | |||
# Type --cinavia-videoeditorplugin: file open {"SPRX library" {sprx}} | |||
# Type --cinavia-bdpplugin: file open {"SPRX library" {sprx}} | |||
namespace eval change_cinavia_files { | |||
array set ::change_cinavia_files::options { | |||
--cinavia-videoplayerutil "/path/to/videoplayer_util.sprx" | |||
--cinavia-videoplayerplugin "/path/to/videoplayer_plugin.sprx" | |||
--cinavia-videoeditorplugin "/path/to/videoeditor_plugin.sprx" | |||
--cinavia-bdpplugin "/path/to/bdp_plugin.sprx" | |||
} | |||
proc main {} { | |||
variable options | |||
set cinavia_videoplayerutil [file join dev_flash vsh module videoplayer_util.sprx] | |||
set cinavia_videoplayerplugin [file join dev_flash vsh module videoplayer_plugin.sprx] | |||
set cinavia_videoeditorplugin [file join dev_flash vsh module videoeditor_plugin.sprx] | |||
set cinavia_bdpplugin [file join dev_flash vsh module bdp_plugin.sprx] | |||
if {[file exists $options(--cinavia-videoplayerutil)] == 0 } { | |||
log "Skipping videoplayer_util.sprx, $options(--cinavia-videoplayerutil) does not exist" | |||
} else { | |||
::modify_devflash_file ${cinavia_videoplayerutil} ::change_cinavia_files::copy_cinavia_file $::change_cinavia_files::options(--cinavia-videoplayerutil) | |||
} | |||
== | if {[file exists $options(--cinavia-videoplayerplugin)] == 0 } { | ||
log "Skipping cinavia_videoplayerplugin, $options(--cinavia-videoplayerplugin) does not exist" | |||
} else { | |||
::modify_devflash_file ${cinavia_videoplayerplugin} ::change_cinavia_files::copy_cinavia_file $::change_cinavia_files::options(--cinavia-videoplayerplugin) | |||
} | |||
if {[file exists $options(--cinavia-videoeditorplugin)] == 0 } { | |||
log "Skipping cinavia_videoeditorplugin, $options(--cinavia-videoeditorplugin) does not exist" | |||
} else { | |||
::modify_devflash_file ${cinavia_videoeditorplugin} ::change_cinavia_files::copy_cinavia_file $::change_cinavia_files::options(--cinavia-videoeditorplugin) | |||
} | |||
# TODO: no known bdp_plugin.sprx patch yet | |||
if {[file exists $options(--cinavia-bdpplugin)] == 0 } { | |||
log "Skipping cinavia_bdpplugin, $options(--cinavia-bdpplugin) does not exist" | |||
} else { | |||
::modify_devflash_file ${cinavia_bdpplugin} ::change_cinavia_files::copy_cinavia_file $::change_cinavia_files::options(--cinavia-bdpplugin) | |||
} | |||
} | |||
{ | proc copy_cinavia_file { dst src } { | ||
if {[file exists $src] == 0} { | |||
die "$src does not exist" | |||
} else { | |||
if {[file exists $dst] == 0} { | |||
die "$dst does not exist" | |||
} else { | |||
log "Replacing default file [file tail $dst] with patched [file tail $src]" | |||
copy_file -force $src $dst | |||
} | |||
} | |||
} | |||
} | |||
</pre> | </pre> | ||
Note: | |||
only : | |||
* bdp_plugin sprx | |||
* videoplayer_plugin sprx | |||
might need proper patching, because videoplayer_util.sprx is the same on Retail/CEX and Debug/DEX and videoeditor_plugin sprx might not be used for playback at all. | |||
edit, correction: videoeditor_plugin.prx is same on CEX and DEX | |||
[http://www.multiupload.com/4LE67XL4TM cinavia-310.rar (2.32 MB)] | |||
---- | |||
== Hashes == | |||
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable sortable" style="border:1px solid #999; border-collapse: collapse;" | |||
|- bgcolor="#cccccc" | |||
! Version !! MD5 !! SHA1 !! CRC32 !! CRC16 !! HMAC_SHA1 | |||
|- | |- | ||
| | | 0 file (do not use) || MD5::1f5039e50bd66b290c56684d8550c6c2 || SHA1::7b91dbdc56c5781edf6c8847b4aa6965566c5c75 || CRC32::2A0E7DBB || CRC16::0 || HMAC_SHA1:: | ||
|- | |- | ||
| 3.41 RETAIL/CEX PSJB || MD5::6f1ef9144c43c9a6f00f7ee7464a6689 || SHA1::f3c19e06c0e7b8cc550bb3244f5f88356173fa6d || CRC32::8A1E7548 || CRC16::7FFC || HMAC_SHA1::9F7001A6A93AE03A61ED7CFB7156A68DF0740708 | |||
|- | |- | ||
|} | |} | ||
Line 336: | Line 503: | ||
== Factory Service Mode - Installation log breakdown == | == Factory Service Mode - Installation log breakdown == | ||
Line 743: | Line 534: | ||
format partition: (region_id = 4, CELL_FS_IOS:BUILTIN_FLSH3, CELL_FS_FAT) | format partition: (region_id = 4, CELL_FS_IOS:BUILTIN_FLSH3, CELL_FS_FAT) | ||
create storage region: (region id = 5) | create storage region: (region id = 5) | ||
create storage region: (region id = 6)</pre> || creating FLASH regions 2, 3, 4, 5, 6 | create storage region: (region id = 6)</pre> || creating and formatting FLASH regions 2, 3, 4, 5, 6 || | ||
|- | |- | ||
| <pre> Initializing | | <pre> Initializing | ||
Line 924: | Line 715: | ||
read SC patch package (4864 bytes) elapsed = 24 msec | read SC patch package (4864 bytes) elapsed = 24 msec | ||
read SC patch package (4864 bytes) elapsed = 23 msec | read SC patch package (4864 bytes) elapsed = 23 msec | ||
Update System controller firmware done(0x8002f000)</pre> || [[Syscon Hardware]] is updated with appropiate [[ | Update System controller firmware done(0x8002f000)</pre> || [[Syscon Hardware]] is updated with appropiate [[System_Controller_Firmware|System controller firmware]] || | ||
|- | |- | ||
| <pre> update package elapsed time = 228361 msec</pre> || || | | <pre> update package elapsed time = 228361 msec</pre> || || | ||
Line 947: | Line 738: | ||
|- | |- | ||
|} | |} | ||
== old crossgrading Retail/CEX to Debug/DEX == | == old crossgrading Retail/CEX to Debug/DEX == | ||
Line 981: | Line 773: | ||
== Ancient preproduction / prototype == | == Ancient preproduction / prototype == | ||
CEB-201x, DEH-R1030 etc. | CEB-201x, DEH-R1030 etc. | ||
Line 1,170: | Line 958: | ||
<pre>from decrypted lv0: Boot Loader SE Version 1.0.0 (Build ID: 1643,16413, Build Data: 2006-10-05_16:32:34)</pre> | <pre>from decrypted lv0: Boot Loader SE Version 1.0.0 (Build ID: 1643,16413, Build Data: 2006-10-05_16:32:34)</pre> | ||
[http://www.multiupload.com/FZHV557R2J ebootrom.100.002.rar (51.29 MB)] | [http://www.multiupload.com/FZHV557R2J ebootrom.100.002.rar (51.29 MB)] | ||