Bluedisk EID0 reDRM: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
mNo edit summary
 
(24 intermediate revisions by 7 users not shown)
Line 1: Line 1:
[[Category:Software]]
== Description ==
Bluedisk is a modified frankenstein firmware, with 4.21 and 4.25 files.  The PS3 needs to be already running 3.55 to "upgrade" to 'Bluedisk', and user should send EID0 and a CDKEY before getting a download link. It has a non Sony DRM mechanism, locking it to the perconsole unique eid0 via serverside injected aim iso module, which was rendered useless within half an hour of the release. The same day a nonDRM version was released, while the server of Bluedisk was no longer capable of handling the traffic and cdkey handing out was suspended.


== XMB eEID Dumper and MM4.25 download ==
== Bluedisk release ==
http://www.sendspace.com/file/q8rk8b
=== XMB eEID Dumper and MM4.25 ===
Link : [http://www.sendspace.com/file/q8rk8b XMB eEID Dumper and MM4.25.zip]


=== XMB eEID Dumper.pkg ===
==== XMB eEID Dumper.pkg ====


=== MM4.25.pkg ===
==== MM4.25.pkg ====
Old version of [[MultiMan]] (2.08, last open source version) patched to work on this CFW.


== CFWUpgrader ver1.01 and manual.zip ==
=== CFWUpgrader ver1.01 and manual ===
http://www.sendspace.com/file/2mysue
Link : [http://www.sendspace.com/file/2mysue CFWUpgrader ver1.01 and manual.zip]


=== CFW Upgrader and downgrade manual.pdf ===
==== [http://www.slideshare.net/slideshow/embed_code/14857769 CFW Upgrader and downgrade manual.pdf] ====


=== CFWUpgrader.exe ===
==== CFWUpgrader.exe ====


== CD Key ==
[[File:BlueDiskThingy.png]]
9E8302C692EEFBD1 <!--// Senaxx //--> <br />
0CB52A87B221BC50 <!--// bubba //--> <br />
C0B7431B5073CC52 <!--// LuckyStar //--> <br />
0CB52A87B221BC50 <!--// LuckyStar //--> <br />
FA73FDEF3A3949DE <!--// http://bbs.duowan.com/thread-29221529-1-1.html //--> <br />
1C24792552F19D59 <!--// http://bbs.duowan.com/thread-29221529-1-1.html //--> <br />
45A76B28633A4B82 <!--// http://bbs.duowan.com/thread-29221529-1-1.html //-->


== EID0.BIN ==
When you enter your credentials and press "CDKey Check" it generates a file called ''CFWUpgrader.exe.txt''. I used Senaxx's info and it was probably wrong but it generate this log:
[http://www.mediafire.com/?1ib0c9b3b3mrld7 EID.rar]


== Firmwares ==
<pre>ERROR:PatchClient:Could not open I/O for 67.198.173.122:8090
=== PS3UPDAT.PUP ===
Traceback (most recent call last):
[http://www.mediafire.com/?jxu0d97sflb5717 4.25 CFW based on EID0 Senaxx.rar] <!--// http://67.198.173.122/webeditor/PS3UPDAT_9E8302C692EEFBD1.PUP //--> <br />
  File "PatchClient.pyo", line 29, in verifykey
[http://www.sendspace.com/file/xx9qal 4.25 CFW based on EID0 bubba.rar] <!--// http://67.198.173.122/webeditor/PS3UPDAT_0CB52A87B221BC50.rar //--> <br />
  File "protobuf\socketrpc\service.pyo", line 114, in <lambda>
[http://kuai.xunlei.com/d/TJAKBXYICPTO 4.25 CFW based on EID0 Luckystar.rar] <!--// http://67.198.173.122/webeditor/PS3UPDAT_A33BB116F4D71DAD(CE95EC2457008FCC).PUP//-->
  File "protobuf\socketrpc\service.pyo", line 157, in call
  File "google\protobuf\service_reflection.pyo", line 267, in <lambda>
  File "google\protobuf\service_reflection.pyo", line 284, in _StubMethod
  File "protobuf\socketrpc\channel.pyo", line 192, in CallMethod
  File "protobuf\socketrpc\channel.pyo", line 292, in tryToRunCallback
RpcError: Could not open I/O for 67.198.173.122:8090
Traceback (most recent call last):
  File "main.py", line 104, in doverifykey
AttributeError: 'NoneType' object has no attribute 'ret'
</pre>
 
When I clicked download it added this to the file:


* 4.21 CoreOS
<pre>AttributeError: 'NoneType' object has no attribute 'ret'
* 4.25 Spoof/dev_flash for NP/SEN
ERROR:PatchClient:Could not open I/O for 67.198.173.122:8090
Traceback (most recent call last):
  File "PatchClient.pyo", line 43, in login
  File "protobuf\socketrpc\service.pyo", line 114, in <lambda>
  File "protobuf\socketrpc\service.pyo", line 157, in call
  File "google\protobuf\service_reflection.pyo", line 267, in <lambda>
  File "google\protobuf\service_reflection.pyo", line 284, in _StubMethod
  File "protobuf\socketrpc\channel.pyo", line 192, in CallMethod
  File "protobuf\socketrpc\channel.pyo", line 292, in tryToRunCallback
RpcError: Could not open I/O for 67.198.173.122:8090
Traceback (most recent call last):
  File "main.py", line 123, in dologin
AttributeError: 'NoneType' object has no attribute 'desc'
</pre>


=== Downgrade firmwares ===
=== Downgrade firmwares ===
[http://www.sendspace.com/file/d9pe9v 4.25TO3.55 CFW]<br />
* [http://www.sendspace.com/file/d9pe9v 4.25TO3.55 CFW] [http://www.mediafire.com/?1iwd6c811pgpats 4.25TO3.55 CFW]<br />
[http://www.sendspace.com/file/zfzeo6 CFW3.55CHECKOFF]<br />
* [http://www.sendspace.com/file/zfzeo6 CFW3.55CHECKOFF]<br />
8BCF7AB97EE4B9D9F74ECDF9FA9E59A8 = cfw3.55checkoff<br />
8BCF7AB97EE4B9D9F74ECDF9FA9E59A8 = 3.55 Rogero CEX v2<br />
so no need to re-download cfw3.55 checkoff if you have Rogero CEX v2 .355v<br />
Originally Posted by GraVoX959 ps3hax<br />


== reDRM mechanism / eid0 binding ==
<pre>
aim_spu_module.self [[Iso module]]
* cfw3.55checkoff MD-5: 8BCF7AB97EE4B9D9F74ECDF9FA9E59A8
* 3.55 Rogero CEX v2 MD-5: 8BCF7AB97EE4B9D9F74ECDF9FA9E59A8
</pre>
So no need to re-download "cfw3.55checkoff" if you have Rogero CEX 3.55 v2 (Source : [http://www.ps3hax.net/showpost.php?p=455374&postcount=330 GraVoX959 on ps3hax])<br />


https://twitter.com/naehrwert/status/260356650257498113
== Firmwares / EID0.BIN / CD Keys ==
=== Firmware ===
* 4.21 CoreOS
* 4.25 Spoof/dev_flash for NP/SEN


the check is basically a
=== PS3UPDAT.PUP ===
if(memcmp(eid0_section0, first_encrypt_0x10_bytes, 0x10)!=0)fail();
{| class="wikitable collapsible"
|-
!Firmware !! EID0.BIN !! CD Key
|-
| [http://www.mediafire.com/?jxu0d97sflb5717 4.25 CFW based on EID0 Senaxx.rar] <!--// http://67.198.173.122/webeditor/PS3UPDAT_9E8302C692EEFBD1.PUP //--> || [http://www.mediafire.com/?1ib0c9b3b3mrld7 EID.rar] || 9E8302C692EEFBD1
|-
| [http://www.sendspace.com/file/xx9qal 4.25 CFW based on EID0 bubba.rar] <!--// http://67.198.173.122/webeditor/PS3UPDAT_0CB52A87B221BC50.rar //--> <br /> || N/A || 0CB52A87B221BC50 <!--// bubba //-->
|-
| [http://kuai.xunlei.com/d/TJAKBXYICPTO 4.25 CFW based on EID0 Luckystar.rar] <!--// http://67.198.173.122/webeditor/PS3UPDAT_A33BB116F4D71DAD(CE95EC2457008FCC).PUP//--> || N/A || C0B7431B5073CC52 <!--// LuckyStar //-->
|-
|}


=== nonbound eid0 firmware ===
=== Other CD Keys ===
To remove eid0 binding, replace the aim_spu_module.self [[Iso module]] from unpatched OFW 4.25 one (tested, it works).
* FA73FDEF3A3949DE <!--// http://bbs.duowan.com/thread-29221529-1-1.html //-->
* 1C24792552F19D59 <!--// http://bbs.duowan.com/thread-29221529-1-1.html //-->
* 45A76B28633A4B82 <!--// http://bbs.duowan.com/thread-29221529-1-1.html //-->


==== Rogero CEX-4.21 CFW ====
== reDRM mechanism / eid0 binding ==
{{warning|content=This CFW does not have LV1(/syscon) checks disabled and cannot be installed on Downgraded PS3 consoles unless you have [http://www.ps3devwiki.com/wiki/Downgrading_with_Hardware_flasher#Dehashing Dehashed/Reset Syscon] properly
=== Analysis ===
}}<br /><br />
eid0 is checked in [[Iso module|aim_spu_module.self]] (Source : https://twitter.com/naehrwert/status/260356650257498113)


link: [http://www.mediafire.com/?hrvvaqh7l5gzss9 Rogero_CEX4.21_v1.PUP]<br />
The check is basically a: <pre>if(memcmp(eid0_section0, first_encrypt_0x10_bytes, 0x10)!=0)fail();</pre>
mirror: [http://www.sendspace.com/file/49iddc  Rogero_CEX4.21_v1.PUP]<br />
CRC-16: 05E4  / CRC-32: AE88016F
SHA-1: 5B8F488D977CFB2E3E0B5C3362F0275C840443B0
SHA-256: C1EAE5CD430B2186C221638EF594A477323C12FCFC2DB0C28E64B621BCF4979D
SHA-384: 36ED4C291EC5AA983EA5E44D710FB1C33B25CF8E503B1C957ACFC3CB0F069894DCD0E336891024D82211988B620E9558
SHA-512: 435F276733499E228F38866D3BAC07FD442A3BF698898A7412392E6C1D44934DB914E2324BBCB43A0E422405012B64901D713CC2D7E26D4B84B10B96A3DA9E9E
MD-2: 12D0DB8C096C8A8E2D7117B0681CCCCA
MD-4: 3AC6AC81B971919B4CAF0DEDBF3B24E1
MD-5: 418B6D659BA7201B04247618929E73FF
Size : 192 MB (201,814,594 bytes)


v1.00 Info
=== nonbound eid0 firmware ===
* This is a 4.21CFW spoofed to version 4.25 to allow SEN access
To remove eid0 binding, replace the [[Iso module|aim_spu_module.self]] from unpatched OFW 4.25 one (tested, it works).
* It can be used as a normal System Update from any 3.55 OFW/CFW/MFW
* It was tested using a hardware flasher and no bricks or any problems at all were encountered
* It can run games signed with Keys up to version 4.21 without any Eboot/Sprx patching needed
* Games must be loaded from Disc Icon (with Original game in BD) and not from app_home
* Current 3.55 homebrew application can't be loaded on this CFW, applications must be re-signed properly.
* Downgrading back to 3.55 is always possible using hardware flashers and will be tested soon using software methods.
 
Credits to eussNL and the PS3DevWiki for the valuable and always up-to-date source of information.
Credits to Deank for his continuous efforts on Multiman and many other PS3 tools/fixes.
 
<span style="background-color:white; color:red;">You need to already be on 3.55 to install this. Installing from any firmware other than 3.55 will simply not work</span>
 
Source: http://www.tortuga-cove.com/forums/viewtopic.php?t=3636&p=8516#p8516


== Compatibility ==
== Compatibility ==
Line 94: Line 104:


=== Homebrew ===
=== Homebrew ===
3.60 or 3.60＋ signed EBOOTs are working.
3.60 or 3.60＋ signed EBOOTs are working. 3.41/3.55 signed homebrews must be resigned with 3.60+ keys.
 
 
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>

Latest revision as of 19:58, 5 February 2014

Description[edit | edit source]

Bluedisk is a modified frankenstein firmware, with 4.21 and 4.25 files. The PS3 needs to be already running 3.55 to "upgrade" to 'Bluedisk', and user should send EID0 and a CDKEY before getting a download link. It has a non Sony DRM mechanism, locking it to the perconsole unique eid0 via serverside injected aim iso module, which was rendered useless within half an hour of the release. The same day a nonDRM version was released, while the server of Bluedisk was no longer capable of handling the traffic and cdkey handing out was suspended.

Bluedisk release[edit | edit source]

XMB eEID Dumper and MM4.25[edit | edit source]

Link : XMB eEID Dumper and MM4.25.zip

XMB eEID Dumper.pkg[edit | edit source]

MM4.25.pkg[edit | edit source]

Old version of MultiMan (2.08, last open source version) patched to work on this CFW.

CFWUpgrader ver1.01 and manual[edit | edit source]

Link : CFWUpgrader ver1.01 and manual.zip

CFW Upgrader and downgrade manual.pdf[edit | edit source]

CFWUpgrader.exe[edit | edit source]

BlueDiskThingy.png

When you enter your credentials and press "CDKey Check" it generates a file called CFWUpgrader.exe.txt. I used Senaxx's info and it was probably wrong but it generate this log: 

ERROR:PatchClient:Could not open I/O for 67.198.173.122:8090
Traceback (most recent call last):
  File "PatchClient.pyo", line 29, in verifykey
  File "protobuf\socketrpc\service.pyo", line 114, in <lambda>
  File "protobuf\socketrpc\service.pyo", line 157, in call
  File "google\protobuf\service_reflection.pyo", line 267, in <lambda>
  File "google\protobuf\service_reflection.pyo", line 284, in _StubMethod
  File "protobuf\socketrpc\channel.pyo", line 192, in CallMethod
  File "protobuf\socketrpc\channel.pyo", line 292, in tryToRunCallback
RpcError: Could not open I/O for 67.198.173.122:8090
Traceback (most recent call last):
  File "main.py", line 104, in doverifykey
AttributeError: 'NoneType' object has no attribute 'ret'

When I clicked download it added this to the file: 

AttributeError: 'NoneType' object has no attribute 'ret'
ERROR:PatchClient:Could not open I/O for 67.198.173.122:8090
Traceback (most recent call last):
  File "PatchClient.pyo", line 43, in login
  File "protobuf\socketrpc\service.pyo", line 114, in <lambda>
  File "protobuf\socketrpc\service.pyo", line 157, in call
  File "google\protobuf\service_reflection.pyo", line 267, in <lambda>
  File "google\protobuf\service_reflection.pyo", line 284, in _StubMethod
  File "protobuf\socketrpc\channel.pyo", line 192, in CallMethod
  File "protobuf\socketrpc\channel.pyo", line 292, in tryToRunCallback
RpcError: Could not open I/O for 67.198.173.122:8090
Traceback (most recent call last):
  File "main.py", line 123, in dologin
AttributeError: 'NoneType' object has no attribute 'desc'

Downgrade firmwares[edit | edit source]

* cfw3.55checkoff MD-5: 8BCF7AB97EE4B9D9F74ECDF9FA9E59A8
* 3.55 Rogero CEX v2 MD-5: 8BCF7AB97EE4B9D9F74ECDF9FA9E59A8

So no need to re-download "cfw3.55checkoff" if you have Rogero CEX 3.55 v2 (Source : GraVoX959 on ps3hax)

Firmwares / EID0.BIN / CD Keys[edit | edit source]

Firmware[edit | edit source]

  • 4.21 CoreOS
  • 4.25 Spoof/dev_flash for NP/SEN

PS3UPDAT.PUP[edit | edit source]

Firmware EID0.BIN CD Key
4.25 CFW based on EID0 Senaxx.rar EID.rar 9E8302C692EEFBD1
4.25 CFW based on EID0 bubba.rar
N/A 0CB52A87B221BC50
4.25 CFW based on EID0 Luckystar.rar N/A C0B7431B5073CC52

Other CD Keys[edit | edit source]

  • FA73FDEF3A3949DE
  • 1C24792552F19D59
  • 45A76B28633A4B82

reDRM mechanism / eid0 binding[edit | edit source]

Analysis[edit | edit source]

eid0 is checked in aim_spu_module.self (Source : https://twitter.com/naehrwert/status/260356650257498113)

The check is basically a: 

if(memcmp(eid0_section0, first_encrypt_0x10_bytes, 0x10)!=0)fail();

nonbound eid0 firmware[edit | edit source]

To remove eid0 binding, replace the aim_spu_module.self from unpatched OFW 4.25 one (tested, it works).

Compatibility[edit | edit source]

Its MFW 4.2x, so all OFW 4.2x signed content should work.

Games[edit | edit source]

Do not start games from APP_HOME, to prevent "EAUTHFAIL - 0x80010017 - Failure in authorizing SELF. Program authentication fail (Error starting BluRay game)"

Homebrew[edit | edit source]

3.60 or 3.60＋ signed EBOOTs are working. 3.41/3.55 signed homebrews must be resigned with 3.60+ keys.


General
Hypervisor
Services
Plugin
Interfaces
ap_plugin · audioplayer_plugin · audiop_plugin_dummy · audiop_plugin_mini · auth_plugin · autodownload_plugin · autoupdateconf_plugin · avc_plugin · avc_util · avc2_game_plugin · avc2_game_video_plugin · avc2_text_plugin · bdp_disccheck_plugin · bdp_plugin · bdp_storage_plugin · campaign_plugin · category_setting_plugin · comboplay_plugin · custom_render_plugin · data_copy_plugin · deviceconf_plugin · dlna_plugin · download_plugin · dtcpip_util · edy_plugin · esehttp · eseibrd · eseidle · eselock · eula_cddb_plugin · eula_hcopy_plugin · eula_net_plugin · explore_plugin · explore_plugin_ft · explore_plugin_game · explore_plugin_np · filecopy_plugin · friendim_plugin · friendml_plugin · friendtrophy_plugin · game_ext_plugin · game_indicator_plugin · game_plugin · gamedata_plugin · gamelib_plugin · gameupdate_plugin · hknw_plugin · idle_plugin · impose_plugin · kensaku_plugin · msgdialog_plugin · mtpinitiator_plugin · musicbrowser_plugin · nas_plugin · netconf_plugin · newstore_plugin · np_eula_plugin · np_matching_plugin · np_multisignin_plugin · np_sns_plugin · npsignin_plugin · np_trophy_ingame · np_trophy_plugin · osk · oskfullkeypanel · oskpanel · pesm_plugin · photo_network_sharing_plugin · photolist_plugin · photoviewer_plugin · playlist_plugin · poweroff_plugin · premo_plugin · premo_game_plugin · print_plugin · profile_plugin · ps3_savedata_plugin · ps3_savedata_plugin_game · ps3_savedata_plugin_psp · rec_plugin · regcam_plugin · remotedownload_plugin · sacd_plugin · scenefolder_plugin · screenshot_plugin · software_update_plugin · soundvisualizer_plugin · strviewer_plugin · sysconf_plugin · system_plugin · thumthum_plugin · upload_util · user_info_plugin · user_plugin · videodownloader_plugin · videoeditor_plugin · videoplayer_util · videoplayer_plugin · vmc_savedata_plugin · wboard_plugin · webbrowser_plugin · webbrowser_service · webrender_plugin · xai_plugin · xmb_ingame · xmb_plugin
Emulation
Extended
features
Online
Hardware
SC
CELL
RAM
SB
HDD
BD
Tools
Strings
files
dumps
Reference
Keys & Seeds
Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=Bluedisk_EID0_reDRM&oldid=25866"