Talk:Downgrading with NOR flasher
Jump to navigation
Jump to search
NOR patches
355checkoff.PUP
PS3 CFW Kmeaw by dospiedra - 355checkoff.PUP
('kmeaw' + lv1 nocheck (see below, V1/V2 etc)
Patches included (using PS3MFW Builder and Patches naming) :
- Patch LV1 hypervisor (lv1_function_114 mmap) lv1.self
- Allow mapping of any memory area (Needed for LV2 Poke)
- Patch LV2 kernel (lv2 peek/lv2 poke) lv2_kernel.self
- Patch to add Peek&Poke system calls to LV2
- Patch package installer (debug pkg/pseudo-retail pkg) nas_plugin.sprx
- Patch to allow installation of pseudo-retail package
- Patch to allow installation of debug packages
- Patch Application Launcher (unsigned app) vsh.self
- Patch to allow running of unsigned applications
- Add new icons to the XMB Game category (install pkgs/app_home) category_game.xml
- Add "Install Package Files" icon to the XMB Game Category
- Add "/app_home" icon to the XMB Game Category
Extracting pup and comparing
to see the actual patches/changes done:
CORE_OS_PACKAGE.pkg
default.spp
emer_init.self
lv1.self
lv2_kernel.self
emer_init.elf
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0005B5A0 79 27 F0 82 y'ð‚
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0005B5A0 38 E9 FF F8 8éÿø
lv1.elf
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00093490 39 20 00 4F 7C 00 F8 9 .O|.ø
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00093490 39 20 00 5F 7C 00 F8 9 ._|.ø
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000F5A40 39 20 00 00 38 60 00 9 ..8`.
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000F5A40 39 20 00 01 38 60 00 9 ..8`.
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000F5EB0 41 DA 00 54 AÚ.T
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000F5EB0 60 00 00 00 `...
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000FD5C0 E8 1E 00 18 è...
000FD5D0 E9 5E 00 20 E9 1E 00 28 E8 FE 00 30 EB EB 00 50 é^. é..(èþ.0ëë.P
000FD5E0 F8 01 00 ø..
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000FD5C0 E8 1E 00 20 è..
000FD5D0 E9 5E 00 28 E9 1E 00 30 E8 FE 00 38 EB FE 00 18 é^.(é..0èþ.8ëþ..
000FD5E0 F8 01 00 ø..
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000FD850 E8 1E 00 18 E9 3E 00 20 E9 5E 00 28 E9 1E 00 30 è...é>. é^.(é..0
000FD860 E8 FE 00 38 E8 DE 00 40 EB EB 00 50 90 A1 00 70 èþ.8èÞ.@ëë.P.¡.p
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000FD850 E8 1E 00 20 E9 3E 00 28 E9 5E 00 30 E9 1E 00 38 è.. é>.(é^.0é..8
000FD860 E8 FE 00 40 E8 DE 00 48 EB FE 00 18 90 A1 00 70 èþ.@èÞ.Hëþ...¡.p
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000FDCF0 E8 1E 00 18 E9 3E 00 è...é>.
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000FDCF0 E8 1E 00 20 E9 3E 00 è.. é>.
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000FDCF0 E8 1E 00 18 E9 3E 00 20 E9 5E 00 28 è...é>. é^.(
000FDD00 E9 1E 00 30 E8 FE 00 38 E8 DE 00 40 EB EB 00 50 é..0èþ.8èÞ.@ëë.P
000FDD10 90 A1 00 .¡.
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000FDCF0 E8 1E 00 20 E9 3E 00 28 E9 5E 00 30 è.. é>.(é^.0
000FDD00 E9 1E 00 38 E8 FE 00 40 E8 DE 00 48 EB FE 00 18 é..8èþ.@èÞ.Hëþ..
000FDD10 90 A1 00 .¡.
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00103CF0 38 00 00 0B 7F E9 00 8....é.
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00103CF0 38 00 00 0F 7F E9 00 8....é.
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00112670 10 39 20 00 09 E9 43 00 .9 ..éC.
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00112670 10 39 20 FF FF E9 43 00 .9 ÿÿéC.
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
001225E0 38 00 00 00 64 00 FF FF 8...d.ÿÿ
001225F0 60 00 FF EC F8 03 00 C0 4E 80 00 20 38 00 00 00 `.ÿìø..ÀN€. 8...
00122600 64 00 FF FF 60 00 FF EC F8 03 00 C0 4E 80 00 d.ÿÿ`.ÿìø..ÀN€.
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
001225E0 38 00 00 00 E8 83 00 18 8...èƒ..
001225F0 E8 84 00 00 F8 83 00 C8 4E 80 00 20 38 00 00 00 è„..øƒ.ÈN€. 8...
00122600 E8 A3 00 20 E8 83 00 18 F8 A4 00 00 4E 80 00 è£. èƒ..ø¤..N€.
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0021D0B0 9E 00 48 48 00 D7 15 2F 83 00 ž.HH.×./ƒ.
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0021D0B0 9E 00 48 38 60 00 00 2F 83 00 ž.H8`../ƒ.
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0021D260 38 60 00 00 48 01 8E AD 8`..H.Ž
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0021D260 38 60 00 01 48 01 8E AD 8`..H.Ž
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00222260 60 64 00 00 3B F9 3F 01 C8 60 00 F7 EE `d..;ù?.È`.÷î
00222270 F8 1F 01 ø..
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00222260 60 64 00 FF FF F9 3F 01 C8 60 00 FF FE `d.ÿÿù?.È`.ÿþ
00222270 F8 1F 01 ø..
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
002C5030 1B 00 00 ...
002C5040 41 9D 00 A8 7B FD 00 A..¨{ý.
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
002C5030 1B 00 00 ...
002C5040 60 00 00 00 7B FD 00 `...{ý.
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
002C7A20 02 B7 01 E8 18 00 08 2F A0 00 .·.è.../ .
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
002C7A20 02 B7 01 38 00 00 00 2F A0 00 .·.8.../ .
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
002DC410 38 00 00 09 8...
002DC420 41 9D 00 4C 48 00 05 A..LH..
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
002DC410 38 00 00 09 8...
002DC420 60 00 00 00 48 00 05 `...H..
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00340790 38 00 00 0D 8...
003407A0 7C 63 00 38 4E 80 00 |c.8N€.
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00340790 38 00 00 0D 8...
003407A0 38 60 00 00 4E 80 00 8`..N€.
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
003787E0 00 01 C0 80 00 00 00 00 00 01 C0 80 00 00 00 00 ..À€......À€....
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
003787E0 00 01 D0 00 00 00 00 00 00 01 D0 00 00 00 00 00 ..Ð.......Ð.....
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00378830 00 00 00 01 C0 80 00 00 00 01 ....À€....
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00378830 00 00 00 01 D0 00 00 00 00 01 ....Ð.....
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00378BD0 00 01 C0 80 00 00 00 00 00 01 C0 80 00 00 00 00 ..À€......À€....
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00378BD0 00 01 D0 00 00 00 00 00 00 01 D0 00 00 00 00 00 ..Ð.......Ð.....
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
003895C0 33 78 3x
003895D0 48 00 03 E1 EB A2 80 H..á뢀
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
003895C0 33 78 3x
003895D0 48 01 B6 1D EB A2 80 H.¶.뢀
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0038EF20 83 E3 78 F8 01 00 98 48 00 50 81 ƒãxø..˜H.P.
0038EF30 7F A4 EB 78 7F 83 E3 78 3B 81 00 78 48 00 4D 15 .¤ëx.ƒãx;..xH.M.
0038EF40 48 00 5A 71 7F A4 EB 78 7F 85 E3 78 4B FF F0 E5 H.Zq.¤ëx.…ãxKÿðå
0038EF50 54 63 06 Tc.
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0038EF20 83 E3 78 60 00 00 00 48 00 50 81 ċx`...H.P.
0038EF30 7F A4 EB 78 7F 83 E3 78 3B 81 00 78 48 00 4D 15 .¤ëx.ƒãx;..xH.M.
0038EF40 48 00 5A 71 7F A4 EB 78 7F 85 E3 78 38 60 00 01 H.Zq.¤ëx.…ãx8`..
0038EF50 54 63 06 Tc.
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0038EFC0 7F 84 E3 78 38 A1 00 70 9B E1 00 70 48 00 5F A5 .„ãx8¡.p›á.pH._¥
0038EFD0 2F 83 00 00 /ƒ..
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0038EFC0 7F 84 E3 78 3B E0 00 01 9B E1 00 70 38 60 00 00 .„ãx;à..›á.p8`..
0038EFD0 2F 83 00 00 /ƒ..
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
003A4BE0 C0 00 4E 38 00 00 00 00 À.N8....
003A4BF0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4C00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4C10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4C20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4C30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4C40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4C50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4C60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4C70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4C80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4C90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4CA0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4CB0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4CC0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4CD0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4CE0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4CF0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4D00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4D10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4D20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4D30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4D40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4D50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4D60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4D70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4D80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4D90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4DA0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4DB0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4DC0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4DD0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4DE0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4DF0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4E00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4E10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4E20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4E30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4E40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4E50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4E60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4E70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4E80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4E90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4EA0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4EB0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4EC0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4ED0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4EE0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4EF0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4F00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4F10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4F20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4F30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4F40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4F50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4F60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4F70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4F80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4F90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4FA0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4FB0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4FC0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4FD0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4FE0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A4FF0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A5000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A5010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A5020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A5030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A5040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A5050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A5060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A5070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A5080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A5090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A50A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A50B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A50C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A50D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A50E0 00 00 00 00 00 00 00 00 00 00 ..........
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
003A4BE0 C0 00 4E 38 F8 21 FF 01 À.N8ø!ÿ.
003A4BF0 7C 08 02 A6 F8 01 01 10 FB 21 00 F8 FB 41 00 F0 |..¦ø...û!.øûA.ð
003A4C00 FB 61 00 E8 FB 81 00 E0 FB A1 00 D8 FB C1 00 D0 ûa.èû..àû¡.ØûÁ.Ð
003A4C10 FB E1 00 C8 F8 61 00 C0 F8 81 00 B8 F8 A1 00 B0 ûá.Èøa.Àø..¸ø¡.°
003A4C20 48 00 00 05 7F E8 02 A6 3B FF FF C8 E8 1F 04 A0 H....è.¦;ÿÿÈè..
003A4C30 F8 01 00 88 E8 1F 04 A8 F8 01 00 90 E8 1F 04 B0 ø..ˆè..¨ø...è..°
003A4C40 F8 01 00 98 E8 1F 04 B8 F8 01 00 A0 38 00 00 00 ø..˜è..¸ø.. 8...
003A4C50 F8 01 00 78 F8 01 00 80 38 60 00 01 38 81 00 88 ø..xø..€8`..8..ˆ
003A4C60 38 A1 00 78 3B C0 00 00 67 DE 80 01 63 DE 2F D0 8¡.x;À..gÞ€.cÞ/Ð
003A4C70 7F C9 03 A6 4E 80 04 21 2F A3 00 00 40 9E 00 18 .É.¦N€.!/£..@ž..
003A4C80 E8 01 00 78 78 00 06 20 2F 80 00 FF 3B 60 00 0F è..xx.. /€.ÿ;`..
003A4C90 40 9E 03 54 E8 1F 04 A0 F8 01 00 88 E8 1F 04 A8 @ž.Tè.. ø..ˆè..¨
003A4CA0 F8 01 00 90 E8 1F 04 C0 F8 01 00 98 E8 1F 04 C8 ø...è..Àø..˜è..È
003A4CB0 F8 01 00 A0 38 00 00 00 F8 01 00 78 F8 01 00 80 ø.. 8...ø..xø..€
003A4CC0 38 60 00 01 38 81 00 88 38 A1 00 78 3B C0 00 00 8`..8..ˆ8¡.x;À..
003A4CD0 67 DE 80 01 63 DE 2F D0 7F C9 03 A6 4E 80 04 21 gÞ€.cÞ/Ð.É.¦N€.!
003A4CE0 2F A3 00 00 40 9E 00 18 E8 01 00 78 78 00 06 20 /£..@ž..è..xx..
003A4CF0 2F 80 00 FF 3B 60 00 0F 40 9E 02 EC E8 1F 04 A0 /€.ÿ;`..@ž.ìè..
003A4D00 F8 01 00 88 E8 1F 04 A8 F8 01 00 90 E8 1F 04 D0 ø..ˆè..¨ø...è..Ð
003A4D10 F8 01 00 98 E8 1F 04 C8 F8 01 00 A0 38 00 00 00 ø..˜è..Èø.. 8...
003A4D20 F8 01 00 78 F8 01 00 80 38 60 00 01 38 81 00 88 ø..xø..€8`..8..ˆ
003A4D30 38 A1 00 78 3B C0 00 00 67 DE 80 01 63 DE 2F D0 8¡.x;À..gÞ€.cÞ/Ð
003A4D40 7F C9 03 A6 4E 80 04 21 2F A3 00 00 40 9E 00 18 .É.¦N€.!/£..@ž..
003A4D50 E8 01 00 78 78 00 06 20 2F 80 00 FF 3B 60 00 0F è..xx.. /€.ÿ;`..
003A4D60 40 9E 02 84 E8 1F 04 A0 F8 01 00 88 E8 1F 04 A8 @ž.„è.. ø..ˆè..¨
003A4D70 F8 01 00 90 E8 1F 04 D8 F8 01 00 98 E8 1F 04 C8 ø...è..Øø..˜è..È
003A4D80 F8 01 00 A0 38 00 00 00 F8 01 00 78 F8 01 00 80 ø.. 8...ø..xø..€
003A4D90 38 60 00 01 38 81 00 88 38 A1 00 78 3B C0 00 00 8`..8..ˆ8¡.x;À..
003A4DA0 67 DE 80 01 63 DE 2F D0 7F C9 03 A6 4E 80 04 21 gÞ€.cÞ/Ð.É.¦N€.!
003A4DB0 2F A3 00 00 40 9E 00 18 E8 01 00 78 78 00 06 20 /£..@ž..è..xx..
003A4DC0 2F 80 00 FF 3B 60 00 0F 40 9E 02 1C E8 61 00 B0 /€.ÿ;`..@ž..èa.°
003A4DD0 38 80 00 00 EB 5F 04 58 EB 9F 04 80 7C BA E2 14 8€..ë_.XëŸ.€|ºâ.
003A4DE0 38 C1 00 A8 3B C0 00 00 67 DE 80 00 63 DE 26 B4 8Á.¨;À..gÞ€.cÞ&´
003A4DF0 7F C9 03 A6 4E 80 04 21 2F 83 00 00 7C 7B 1B 78 .É.¦N€.!/ƒ..|{.x
003A4E00 40 9E 01 E4 E8 61 00 A8 38 80 00 00 7F 85 E3 78 @ž.äèa.¨8€...…ãx
003A4E10 3B C0 00 00 67 DE 80 00 63 DE 02 78 7F C9 03 A6 ;À..gÞ€.cÞ.x.É.¦
003A4E20 4E 80 04 21 38 7F 04 88 38 80 00 00 3B 60 00 10 N€.!8..ˆ8€..;`..
003A4E30 3B C0 00 00 67 DE 80 01 63 DE 3D 40 7F C9 03 A6 ;À..gÞ€.cÞ=@.É.¦
003A4E40 4E 80 04 21 2F 83 00 00 7C 7D 1B 78 41 9C 01 7C N€.!/ƒ..|}.xAœ.|
003A4E50 7F A3 07 B4 E8 81 00 A8 3B 20 08 00 7F 25 CB 78 .£.´è..¨; ...%Ëx
003A4E60 3B 60 00 10 3B C0 00 00 67 DE 80 01 63 DE 3D B8 ;`..;À..gÞ€.cÞ=¸
003A4E70 7F C9 03 A6 4E 80 04 21 7F A3 C8 00 40 9E 01 34 .É.¦N€.!.£È.@ž.4
003A4E80 3B 60 00 14 38 7F 04 60 E8 81 00 A8 38 A0 00 10 ;`..8..`è..¨8 ..
003A4E90 3B C0 00 00 67 DE 80 01 63 DE 39 E0 7F C9 03 A6 ;À..gÞ€.cÞ9à.É.¦
003A4EA0 4E 80 04 21 2F A3 00 00 40 9E 01 08 E8 A1 00 A8 N€.!/£..@ž..è¡.¨
003A4EB0 83 25 00 10 2F 99 00 01 40 9E 00 F8 E8 A1 00 A8 ƒ%../™..@ž.øè¡.¨
003A4EC0 83 25 00 20 2F 99 00 00 40 9E 00 E8 E8 A1 00 A8 ƒ%. /™..@ž.èè¡.¨
003A4ED0 83 25 02 00 2F 99 00 00 41 9E 00 D8 E8 A1 00 A8 ƒ%../™..Až.Øè¡.¨
003A4EE0 83 25 00 24 7F B9 E0 00 41 9D 00 C8 7F A3 07 B4 ƒ%.$.¹à.A..È.£.´
003A4EF0 E8 81 00 A8 7F 25 CB 78 3B 60 00 10 3B C0 00 00 è..¨.%Ëx;`..;À..
003A4F00 67 DE 80 01 63 DE 3D B8 7F C9 03 A6 4E 80 04 21 gÞ€.cÞ=¸.É.¦N€.!
003A4F10 7F A3 C8 00 40 9E 00 9C E8 1F 04 E0 F8 01 00 88 .£È.@ž.œè..àø..ˆ
003A4F20 E8 1F 04 E8 F8 01 00 90 E8 1F 04 F0 F8 01 00 98 è..èø...è..ðø..˜
003A4F30 E8 1F 04 F8 F8 01 00 A0 38 00 00 00 F8 01 00 78 è..øø.. 8...ø..x
003A4F40 F8 01 00 80 38 60 00 01 38 81 00 88 38 A1 00 78 ø..€8`..8..ˆ8¡.x
003A4F50 3B C0 00 00 67 DE 80 01 63 DE 2F 88 7F C9 03 A6 ;À..gÞ€.cÞ/ˆ.É.¦
003A4F60 4E 80 04 21 39 20 00 00 48 00 00 14 E8 01 00 A8 N€.!9 ..H...è..¨
003A4F70 7C 09 02 14 7C 00 00 6C 39 29 00 80 7F A9 E0 00 |...|..l9).€.©à.
003A4F80 41 9C FF EC 7C 00 04 AC 39 20 00 00 48 00 00 14 Aœÿì|..¬9 ..H...
003A4F90 E8 01 00 A8 7C 09 02 14 7C 00 07 AC 39 29 00 80 è..¨|...|..¬9).€
003A4FA0 7F A9 E0 00 41 9C FF EC 4C 00 01 2C 3B 60 00 00 .©à.AœÿìL..,;`..
003A4FB0 7F A3 07 B4 3B C0 00 00 67 DE 80 01 63 DE 3D 7C .£.´;À..gÞ€.cÞ=|
003A4FC0 7F C9 03 A6 4E 80 04 21 E8 61 00 A8 7C 9A E2 14 .É.¦N€.!èa.¨|šâ.
003A4FD0 3B C0 00 00 67 DE 80 01 63 DE 3E B8 7F C9 03 A6 ;À..gÞ€.cÞ>¸.É.¦
003A4FE0 4E 80 04 21 7B 63 00 20 E8 01 01 10 EB 21 00 F8 N€.!{c. è...ë!.ø
003A4FF0 EB 41 00 F0 EB 61 00 E8 EB 81 00 E0 EB A1 00 D8 ëA.ðëa.èë..àë¡.Ø
003A5000 EB C1 00 D0 EB E1 00 C8 2F 83 00 00 41 9E 00 2C ëÁ.Ðëá.È/ƒ..Až.,
003A5010 E8 61 00 C0 E8 81 00 B8 E8 A1 00 B0 38 21 01 00 èa.Àè..¸è¡.°8!..
003A5020 7C 08 03 A6 38 C0 00 00 64 C6 80 00 60 C6 0E 44 |..¦8À..dÆ€.`Æ.D
003A5030 7C C9 03 A6 4E 80 04 20 38 21 01 00 7C 08 03 A6 |É.¦N€. 8!..|..¦
003A5040 4E 80 00 20 00 00 00 00 00 00 00 00 63 65 6C 6C N€. ........cell
003A5050 5F 65 78 74 5F 6F 73 5F 61 72 65 61 00 00 00 00 _ext_os_area....
003A5060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
003A5070 01 80 00 00 2F 64 65 76 2F 72 66 6C 61 73 68 5F .€../dev/rflash_
003A5080 6C 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 lx..............
003A5090 73 73 00 00 70 61 72 61 6D 00 00 00 75 70 64 61 ss..param...upda
003A50A0 74 65 00 00 73 74 61 74 75 73 00 00 70 72 6F 64 te..status..prod
003A50B0 75 63 74 00 6D 6F 64 65 00 00 00 00 72 65 63 6F uct.mode....reco
003A50C0 76 65 72 00 68 64 64 63 6F 70 79 00 00 00 00 00 ver.hddcopy.....
003A50D0 69 6F 73 00 61 74 61 00 00 00 00 00 72 65 67 69 ios.ata.....regi
003A50E0 6F 6E 30 00 61 63 63 65 73 73 on0.access
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
003B1420 00 00 0C F0 00 00 ...ð..
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
003B1420 00 00 1C 70 00 00 ...p..
lv2_kernel.elf
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00011700 7C 71 43 A6 7C 92 43 A6 48 00 00 00 00 00 00 00 |qC¦|’C¦H.......
00011710 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00011720 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00011730 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00011740 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00011750 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00011760 00 00 00 00 00 00 00 00 ........
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00011700 7C 71 43 A6 7C 92 43 A6 48 00 00 00 7C 08 02 A6 |qC¦|’C¦H...|..¦
00011710 F8 01 00 10 39 60 00 B6 44 00 00 22 7C 83 23 78 ø...9`.¶D.."|ƒ#x
00011720 E8 01 00 10 7C 08 03 A6 4E 80 00 20 7C 08 02 A6 è...|..¦N€. |..¦
00011730 F8 01 00 10 39 60 00 B7 44 00 00 22 38 60 00 00 ø...9`.·D.."8`..
00011740 E8 01 00 10 7C 08 03 A6 4E 80 00 20 7C 08 02 A6 è...|..¦N€. |..¦
00011750 F8 01 00 10 7D 4B 53 78 44 00 00 22 E8 01 00 10 ø...}KSxD.."è...
00011760 7C 08 03 A6 4E 80 00 20 |..¦N€.
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00029330 3C 60 80 01 <`€.
00029340 60 63 00 03 4E 80 00 20 3C 60 80 01 60 63 00 03 `c..N€. <`€.`c..
00029350 4E 80 00 20 3C 60 80 01 60 63 00 03 4E 80 00 20 N€. <`€.`c..N€.
00029360 3C 60 80 01 60 63 00 03 4E 80 00 20 3C 60 80 01 <`€.`c..N€. <`€.
00029370 60 63 00 03 4E 80 00 20 3C 60 80 01 60 `c..N€. <`€.`
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00029330 E8 63 00 00 èc..
00029340 60 00 00 00 4E 80 00 20 F8 83 00 00 60 00 00 00 `...N€. øƒ..`...
00029350 4E 80 00 20 4B FE 83 B8 60 00 00 00 60 00 00 00 N€. Kþƒ¸`...`...
00029360 4B FE 83 CC 60 00 00 00 60 00 00 00 4B FE 83 E0 KþƒÌ`...`...Kþƒà
00029370 60 00 00 00 60 00 00 00 3C 60 80 01 60 `...`...<`€.`
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
003591D0 E8 CF èÏ
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
003591D0 D6 94 Ö”
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
003592F0 E8 CF èÏ
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
003592F0 D6 94 Ö”
Original ofw355:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00359380 A0 40 36 6B 2D 8A 50 99 1E B3 0C 53 E5 9B 5D 6E @6k-ŠP™.³.Så›]n
00359390 61 2C AC B8 a,¬¸
Patched 355checkoff:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00359380 F3 9F FB 9D 2E 7F B5 EE 64 8B 3A 43 13 81 1E E9 óŸû...µîd‹:C...é
00359390 AD 15 50 5C .P\
dev_flash_010.tar.aa.2010_11_27_051337
dev_flash\vsh\module\nas_plugin.sprx
dev_flash_016.tar.aa.2010_11_27_051337
dev_flash\vsh\resource\explore\xmb\category_game.xml
V1
Tasks
MFW Task::patch_lv1.tcl with the following patches selected:
- --patch-lv1-storage-skip-acl-check
- --patch-lv1-sysmgr-disable-integrity-check
Patches
http://pastebin.com/aNehMfGi :
Downgrade patches http://www.multiupload.com/O0TZGNP92M DIFF: ------------- patch-lv1-storage-skip-acl-check : Patching LV1 to enable skipping of ACL checks for all storage devices ORIGINAL Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0007B340 54 63 06 3E Tc.> PATCHED Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0007B340 38 60 00 01 8`.. ----- patch-lv1-storage-skip-acl-check : Patching LV1 to enable skipping of ACL checks for all storage devices (continued) ORIGINAL Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0007B340 E8 01 00 70 è..p PATCHED Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0007B340 38 00 00 01 8... ----- patch-lv1-sysmgr-disable-integrity-check: Disable integrity check in System Manager ORIGINAL Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0021D0B0 48 00 D7 15 H.×. PATCHED Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0021D0B0 38 60 00 00 8`.. ------------- Reference: http://www.ps3devwiki.com/index.php?title=Talk:Dual_Firmware
Combining patches
There is a difference between the patches on the Talk:Downgrading with NOR flasher and Talk:Downgrading with NAND flasher
what if you combine those together? 1st try: selecting both patch tasks manually:
<keperfear> eussnl http://www.multiupload.com/6AZN5DOCM9 <keperfear> could you check if i patched everything correctly <keperfear> anyway i really need to sleep now <keperfear> good luck everyone * keperfear left <eussNL> oh dear, keperfear is already gone ... anyhow, this was my version : patched355coreos.rar (4.84 MB) (no "Patch In product mode erase standby bank skipped" selected)
<keperfear> Eussnl try with this one
# In product mode erase standby bank skipped
log "Patch In product mode erase standby bank skipped"
set search "\x41\x9E\x00\x0C\xE8\xA2\x8A\x38\x48\x00\x00\xCC\x7B\xFD\x00\x20"
set replace "\x60\x00\x00\x00\xE8\xA2\x8A\x38\x48\x00\x00\xCC\x7B\xFD\x00\x20"
catch_die {::patch_elf $elf $search 0 $replace} "Unable to patch self [file tail $elf]"
(difference is \x41\x9E\x00\x0C\xE8\xA2\x8A\x38 instead of \x41\x9E\x00\x0C\xE8\xA2\x8A\x30)
Combined TCL
2nd try, Combined single TCL "patch-lv1checks.tcl" :
#!/usr/bin/tclsh # # ps3mfw -- PS3 MFW creator # # Copyright (C) PsiColeO # Copyright (C) glevand ([email protected]) # Copyright (C) Anonymous Developers (Code Monkeys) # # This software is distributed under the terms of the GNU General Public # License ("GPL") version 3, as published by the Free Software Foundation. # # Priority: 300 # Description: Patch LV1 checks # Option --patch-lv1checks: Disables many checks in lv1 # Type --patch-lv1checks: boolean namespace eval ::patch_lv1checks { array set ::patch_lv1checks::options { --patch-lv1checks true } proc main { } { set self "lv1.self" ::modify_coreos_file $self ::patch_lv1checks::patch_self } proc patch_self {self} { if {!$::patch_lv1checks::options(--patch-lv1checks)} { log "WARNING: Enabled task has no enabled option" 1 } else { ::modify_self_file $self ::patch_lv1checks::patch_elf } } proc patch_elf {elf} { if {$::patch_lv1checks::options(--patch-lv1checks)} { log "Patching LV1 Checks" # ss_server1 # Patch core OS Hash check // product mode always on log "--------------- Patching ss_server1.fself ----------------------------" log "Patch core OS Hash check // product mode always on" set search "\x41\x9E\x00\x1C\x7F\x63\xDB\x78\xE8\xA2\x85\x68\x38\x80\x00\x01" set replace "\x60\x00\x00\x00\x7F\x63\xDB\x78\xE8\xA2\x85\x68\x38\x80\x00\x01" catch_die {::patch_elf $elf $search 0 $replace} "Unable to patch self [file tail $elf]" # Patch check_revoke_list_hash check // product mode always on log "Patch check_revoke_list_hash check // product mode always on" set search "\x41\x9E\x00\x1C\x7F\xA3\xEB\x78\xE8\xA2\x85\x68\x38\x80\x00\x01" set replace "\x60\x00\x00\x00\x7F\xA3\xEB\x78\xE8\xA2\x85\x68\x38\x80\x00\x01" catch_die {::patch_elf $elf $search 0 $replace} "Unable to patch self [file tail $elf]" # In product mode erase standby bank skipped log "Patch In product mode erase standby bank skipped" set search "\x41\x9E\x00\x0C\xE8\xA2\x8A\x38\x48\x00\x00\xCC\x7B\xFD\x00\x20" set replace "\x60\x00\x00\x00\xE8\xA2\x8A\x38\x48\x00\x00\xCC\x7B\xFD\x00\x20" catch_die {::patch_elf $elf $search 0 $replace} "Unable to patch self [file tail $elf]" # Patching System Manager to disable integrity check log "Patching System Manager to disable integrity check" set search "\x38\x60\x00\x01\xf8\x01\x00\x90\x88\x1f\x00\x00\x2f\x80\x00\x00" set replace "\x38\x60\x00\x00" catch_die {::patch_elf $elf $search 0 $replace} "Unable to patch self [file tail $elf]" # Patching LV1 to enable skipping of ACL checks for all storage devices log "Patching LV1 to enable skipping of ACL checks for all storage devices" set search "\x54\x63\x06\x3e\x2f\x83\x00\x00\x41\x9e\x00\x14\xe8\x01\x00\x70\x54\x00\x07\xfe" append search "\x2f\x80\x00\x00\x40\x9e\x00\x18" set replace "\x38\x60\x00\x01\x2f\x83\x00\x00\x41\x9e\x00\x14\x38\x00\x00\x01" catch_die {::patch_elf $elf $search 0 $replace} "Unable to patch self [file tail $elf]" } } }
download: patch_lv1checks.rar (1.29 KB) (2.88-3.42 / 3.50-3.55)
PreAlpha v1 smoketest - offsets
patch-lv1checks (Modifying CORE_OS file lv1.self - Patching LV1 Checks)
| No. | Description | 2.80 | 3.00 | 3.01 | 3.10 | 3.15 | 3.20 | 3.21 | 3.30 | 3.40 | 3.41-BAD | 3.41-FIX | 3.42 | 3.50 | 3.55 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Patch core OS Hash check // product mode always on | 2958632 | 2958452 | 2958452 | 2958984 | 2958984 | 2959072 | 2891632 | 2891556 | 2891596 | 2891596 | 2891596 | 2891596 | 2891684 | 2891684 |
| 2 | Patch check_revoke_list_hash check // product mode always on | 2961708 | 2961528 | 2961528 | 2962060 | 2962060 | 2962148 | 2894708 | 2894632 | 2894672 | 2894672 | 2894672 | 2894672 | 2894836 | 2894836 |
| 16 | Patch In product mode erase standby bank skipped | 2977960 | 2977780 | 2977780 | 2978324 | 2978324 | 2978412 | 2910972 | 2910896 | 2910936 | 2910936 | 2910936 | 2910936 | 2911100 | 2911100 |
| 23 | Patching System Manager to disable integrity check | 2211164 | 2211424 | 2211424 | 2217608 | 2217608 | 2218192 | 2218120 | 2215760 | 2216052 | 2216052 | 2216052 | 2216052 | 2216096 | 2216096 |
| 24 | Patching LV1 to enable skipping of ACL checks for all storage devices | 498208 | 500212 | 500212 | 505304 | 505420 | 506032 | 506032 | 505112 | 504568 | 504568 | 504568 | 504568 | 504640 | 504640 |
<keperfear> coreos 3.55 with above 1,2,16,23,24 combined patches: coreos355nandandnordowngradepatches.rosx (7 MB)
Status
MFW patch_lv1checks.tcl seems to work fine. Needs testing in the field by people with hardware flasher only.
Update:
[01:43:10] <Ryd3R> RSOD x_x
[01:44:41] <Ryd3R> i hate when it show up
[01:45:20] <Ryd3R> @eussNL: are you there ?
[01:46:41] <eussNL> I am, but also alot of sidestuff going on, whats the problem all of the sudden
and what did you do to make it bitch like that?
[01:47:36] <Ryd3R> i did the 3.70 downgrade using a teensy++
[01:48:42] <Ryd3R> it works well when i revert back to 3.70
[01:49:23] <Ryd3R> i think it have something to do whith the fuckin syscon
[01:49:37] <eussNL> ok, did you patch lv1 ?
[01:49:43] <Ryd3R> yeah
[01:50:09] <Ryd3R> the No hash check patch right ?
[01:51:50] <Ryd3R> for some fuckin reason any version perior 3.70 gave me an rsod
[01:52:41] <Ryd3R> i tried using the recovery menu to update to 3.60 from 3.55 (lv1 patched) still rsod
[01:53:15] <eussNL> yes and then some... Ryd3R> the No hash check patch right ?
[01:53:46] <eussNL> http://www.ps3devwiki.com/index.php?title=Talk:Downgrading_with_NOR_flasher#Combined_TCL
[01:55:47] <Ryd3R> i'll give it a try
[02:16:19] <Ryd3R> thanks eussNL you'r the man, the patch works like charm
[02:22:53] <eussNL> good to hear, hope it stays flawless now :)
V2
http://darkconsoles.com/foro/viewtopic.php?f=7&t=16
NOR offsets used
| target area | patch no. | NOR Offset | Paste length | Remarks |
|---|---|---|---|---|
| ROS0 | patch1 (7 MB) | 0x0C0010 | 0x6FFFE0 | version string not changed? |
| ROS1 | patch2 (7 MB) | 0x7C0010 | 0x6FFFE0 | same as patch1? |
| trvk_pkg0 | patch3 (128 KB) | 0x80000 | 0x20000 | |
| trvk_pkg1 | patch4 (128 KB) | 0xA0000 | 0x20000 | |
| trvk_prg0 | patch5 (128 KB) | 0x40000 | 0x20000 | |
| trvk_prg1 | patch6 (128 KB) | 0x60000 | 0x20000 |
LV1 patches used
Downgrade patches v2
http://www.multiupload.com/DVFD9AZGO5
DIFF:
-------------
patch-lv1-storage-skip-acl-check : Patching LV1 to enable skipping of ACL checks for all storage devices
ORIGINAL
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0007B340 54 63 06 3E Tc.>
PATCHED
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0007B340 38 60 00 01 8`..
-----
patch-lv1-storage-skip-acl-check : Patching LV1 to enable skipping of ACL checks for all storage devices (continued)
ORIGINAL
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0007B340 E8 01 00 70 è..p
PATCHED
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0007B340 38 00 00 01 8...
-----
???? Patch sys_mgr integrity lv1 and lv0 integrity check ????
ORIGINAL
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0021D0B0 48 00 D7 15 H.×.
PATCHED
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0021D0B0 38 60 00 00 8`..
-----
Combined TCL V2
Combined single TCL "patch-lv1checks.tcl" with added new patch :
#!/usr/bin/tclsh # # ps3mfw -- PS3 MFW creator # # Copyright (C) PsiColeO # Copyright (C) glevand ([email protected]) # Copyright (C) Anonymous Developers (Code Monkeys) # # This software is distributed under the terms of the GNU General Public # License ("GPL") version 3, as published by the Free Software Foundation. # # Priority: 300 # Description: Patch LV1 checks # Option --patch-lv1checks: Disables many checks in lv1 # Type --patch-lv1checks: boolean namespace eval ::patch_lv1checks { array set ::patch_lv1checks::options { --patch-lv1checks true } proc main { } { set self "lv1.self" ::modify_coreos_file $self ::patch_lv1checks::patch_self } proc patch_self {self} { if {!$::patch_lv1checks::options(--patch-lv1checks)} { log "WARNING: Enabled task has no enabled option" 1 } else { ::modify_self_file $self ::patch_lv1checks::patch_elf } } proc patch_elf {elf} { if {$::patch_lv1checks::options(--patch-lv1checks)} { log "Patching LV1 Checks" # ss_server1 # Patch core OS Hash check // product mode always on log "--------------- Patching ss_server1.fself ----------------------------" log "Patch core OS Hash check // product mode always on" set search "\x41\x9E\x00\x1C\x7F\x63\xDB\x78\xE8\xA2\x85\x68\x38\x80\x00\x01" set replace "\x60\x00\x00\x00\x7F\x63\xDB\x78\xE8\xA2\x85\x68\x38\x80\x00\x01" catch_die {::patch_elf $elf $search 0 $replace} "Unable to patch self [file tail $elf]" # Patch check_revoke_list_hash check // product mode always on log "Patch check_revoke_list_hash check // product mode always on" set search "\x41\x9E\x00\x1C\x7F\xA3\xEB\x78\xE8\xA2\x85\x68\x38\x80\x00\x01" set replace "\x60\x00\x00\x00\x7F\xA3\xEB\x78\xE8\xA2\x85\x68\x38\x80\x00\x01" catch_die {::patch_elf $elf $search 0 $replace} "Unable to patch self [file tail $elf]" # In product mode erase standby bank skipped log "Patch In product mode erase standby bank skipped" set search "\x41\x9E\x00\x0C\xE8\xA2\x8A\x38\x48\x00\x00\xCC\x7B\xFD\x00\x20" set replace "\x60\x00\x00\x00\xE8\xA2\x8A\x38\x48\x00\x00\xCC\x7B\xFD\x00\x20" catch_die {::patch_elf $elf $search 0 $replace} "Unable to patch self [file tail $elf]" # Patching System Manager to disable integrity check log "Patching System Manager to disable integrity check" set search "\x38\x60\x00\x01\xf8\x01\x00\x90\x88\x1f\x00\x00\x2f\x80\x00\x00" set replace "\x38\x60\x00\x00" catch_die {::patch_elf $elf $search 0 $replace} "Unable to patch self [file tail $elf]" # Patching LV1 to enable skipping of ACL checks for all storage devices log "Patching LV1 to enable skipping of ACL checks for all storage devices" set search "\x54\x63\x06\x3e\x2f\x83\x00\x00\x41\x9e\x00\x14\xe8\x01\x00\x70\x54\x00\x07\xfe" append search "\x2f\x80\x00\x00\x40\x9e\x00\x18" set replace "\x38\x60\x00\x01\x2f\x83\x00\x00\x41\x9e\x00\x14\x38\x00\x00\x01" catch_die {::patch_elf $elf $search 0 $replace} "Unable to patch self [file tail $elf]" # LV1 0021D0B4@355 patch (?Patch sys_mgr integrity lv1 and lv0 integrity check?) log "?Patch sys_mgr integrity lv1 and lv0 integrity check?" set search "\x48\x00\xD7\x15\x2F\x83\x00\x00\x38\x60\x00\x01" set replace "\x38\x60\x00\x00\x2F\x83\x00\x00\x38\x60\x00\x01" catch_die {::patch_elf $elf $search 0 $replace} "Unable to patch self [file tail $elf]" } } }
download: patch_lv1checks.rar (1.53 KB) (3.40-3.42 / 3.50-3.55)
PreAlpha v2 smoketest - offsets
patch-lv1checks (Modifying CORE_OS file lv1.self - Patching LV1 Checks)
| No. | Description | 2.80 | 3.00 | 3.01 | 3.10 | 3.15 | 3.20 | 3.21 | 3.30 | 3.40 | 3.41-BAD | 3.41-FIX | 3.42 | 3.50 | 3.55 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Patch core OS Hash check // product mode always on | 2958632 | 2958452 | 2958452 | 2958984 | 2958984 | 2959072 | 2891632 | 2891556 | 2891596 | 2891596 | 2891596 | 2891596 | 2891684 | 2891684 |
| 2 | Patch check_revoke_list_hash check // product mode always on | 2961708 | 2961528 | 2961528 | 2962060 | 2962060 | 2962148 | 2894708 | 2894632 | 2894672 | 2894672 | 2894672 | 2894672 | 2894836 | 2894836 |
| 16 | Patch In product mode erase standby bank skipped | 2977960 | 2977780 | 2977780 | 2978324 | 2978324 | 2978412 | 2910972 | 2910896 | 2910936 | 2910936 | 2910936 | 2910936 | 2911100 | 2911100 |
| 23 | Patching System Manager to disable integrity check | 2211164 | 2211424 | 2211424 | 2217608 | 2217608 | 2218192 | 2218120 | 2215760 | 2216052 | 2216052 | 2216052 | 2216052 | 2216096 | 2216096 |
| 24 | Patching LV1 to enable skipping of ACL checks for all storage devices | 498208 | 500212 | 500212 | 505304 | 505420 | 506032 | 506032 | 505112 | 504568 | 504568 | 504568 | 504568 | 504640 | 504640 |
| 25 | ?Patch sys_mgr integrity lv1 and lv0 integrity check? | no pattern | no pattern | no pattern | no pattern | no pattern | no pattern | no pattern | no pattern 2215780? |
2216072 | 2216072 | 2216072 | 2216072 | 2216088 | 2216116 |
Status
MFW patch_lv1checks.tcl seems to work fine. Needs testing in the field by people with hardware flasher only.
Rogero and VAL_ tested, no problems with games/trophy's and bluray movies
Premade MFW
Rogero MFW355_370_spoof_Internet_Blocked_LV1_Checks_Patched.PUP (170.59 MB)