payloads found

Developer shadoxi has released the True Blue and Cobra-USB payloads. With these developments, there may soon be a way for those without the dongles to enjoy the same experiences as those with the dongles. Hopefully all that is left is to sit back and wait for the MFW patches to come rolling in, but in the mean time most of us will have to wait for the dongle-less True Blue and Cobra-USB experience.


 

I (aka shadoxi) figured out where is located the payload of Trueblue and cobra dongle. You can find it at offset @360000 in lv2_kernel and 7f0000 in ps3 memory.

First of all you need to edit the header of lv2_kernel.self (from cfw trueblue) at offset 0Ɨ1D, replace 36 1A 00 by 4C FC F0. And decrypt it with unself tool from fail0verFlow. Open lv2_kernel.elf with Ida pro (in binary file mode), go to offset 360000 and press ā€œCā€ to convert to asm code.

TrueBlue use some HVCALL:
lv1_insert_htab_entry
lv1_undocumented_function_114
lv1_undocumented_function_115
lv1_allocate_device_dma_region
lv1_map_device_dma_region
lv1_net_start_tx_dma
lv1_net_control
lv1_panic (shutdown ps3 when TB is unplugged)

This payload do some hvcall:
lv1_insert_htab_entry (map lv1)
lv1_allocate_device_dma_region (?)
lv1_map_device_dma_region (?)
lv1_net_start_tx_dma (?)
lv1_net_control (?)
lv1_panic (shutdown ps3 when TrueBlue Dongle is unplugged)
lv1_undocumented_function_114 (map lv1)
lv1_undocumented_function_115 (unmap lv1)

We need now to dump lv2 and lv1 memory when TrueBlue is plugged. So I create a modified TrueBlue Cfw with peek and poke syscall. It work fine !

Download Link: Payload.zip

true blue proven to be a huge scam!

TeaM AC1D has announced that they know the secret behind the True Blue dongle and in the process calling the True Blue a scam. They explain that no real code is used but rather files from higher firmware and some of these files are compatible with older firmware, although the ones that don’t work need a little fixing. Below is an extract.

To Quote:

Finally, after a long period of a scene that got riddled and raped by money hungry dongle suppliers we uncover this big scam and show you how things like the true blue dongle actually work.

First of all, non of the code used comes from the true blue creators. All files used come directly from higher PS3 firmwares.

All you need to do is place them in the right folder and thats it. Of course this does not work with all the procdure quiet games so easy, some of the 3.6 + games load right away, otheres need some fixing.

They are basically charging you money for a small custom firmware, i would call it the biggest scam the ps3 scene a lot has ever seen and we have seen.

This scam needs to be stopped and we should all join hands to finally put to end to all of this. Use this information and do what you have to do.

Now lets sit back, await a release of the method so we can get our own legally purchased games running on custom firmware.

Thanks to psx-scene members tulla and itzViolence for the news submission.