Developer shadoxi has released the True Blue and Cobra-USB payloads. With these developments, there may soon be a way for those without the dongles to enjoy the same experiences as those with the dongles. Hopefully all that is left is to sit back and wait for the MFW patches to come rolling in, but in the mean time most of us will have to wait for the dongle-less True Blue and Cobra-USB experience.
First of all you need to edit the header of lv2_kernel.self (from cfw trueblue) at offset 0×1D, replace 36 1A 00 by 4C FC F0. And decrypt it with unself tool from fail0verFlow. Open lv2_kernel.elf with Ida pro (in binary file mode), go to offset 360000 and press “C” to convert to asm code.
TrueBlue use some HVCALL:
lv1_panic (shutdown ps3 when TB is unplugged)
This payload do some hvcall:
lv1_insert_htab_entry (map lv1)
lv1_panic (shutdown ps3 when TrueBlue Dongle is unplugged)
lv1_undocumented_function_114 (map lv1)
lv1_undocumented_function_115 (unmap lv1)
We need now to dump lv2 and lv1 memory when TrueBlue is plugged. So I create a modified TrueBlue Cfw with peek and poke syscall. It work fine !
Download Link: Payload.zip