Editing Graf's PSGroove Payload

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
=graf_chokolo's Payload=
Source Code for a git bootstrap and the payload from coolstuff.rar:<br>
http://www.megaupload.com/?d=9BGFIXJD


This payloads have been around for months, and not many people have played with them.. they do amazing stuff <br />
Requirements:
 
==Source Code for a git bootstrap and the payload from coolstuff.rar:<br>==
 
git
http://git-hacks.com/graf_payloads/graf_payloads/
 
zip
http://www.mirrorcreator.com/files/N0XNBWWI/grafchokolo-psgroove-8a5898f.zip_links (grafchokolo-psgroove-8a5898f.zip)
other variant: http://dl.dropbox.com/u/9694818/grafchokolo.zip  17-1-2011 9:44
 
==Requirements:==
  - Working ppc64 toolchain
  - Working ppc64 toolchain
  - libpcap (sudo apt-get install libpcap-dev)
  - libpcap (sudo apt-get install libpcap-dev)
  - libnet (sudo apt-get install libnet1-dev)
  - libnet (sudo apt-get install libnet1-dev)


==Instructions:==
Instructions:
  - cd bootstrap-8a5898f
  - cd bootstrap-8a5898f
  - make
  - make
Line 28: Line 17:


----
----
==Graf's Tutorial (Cut IRC Log):==
Graf's Tutorial (Cut IRC Log):
  On decrypter payload https://github.com/grafchokolo/psgroove
  On decrypter payload https://github.com/grafchokolo/psgroove
   
   
Line 101: Line 90:
----
----


==Graf's Tutorial (Full IRC Log):==
Graf's Tutorial (Full IRC Log):
  [23:06] <@graf_chokolo> so guys should i start ?
  [23:06] <@graf_chokolo> so guys should i start ?
  [23:06] <Heden_DLT> Hi all
  [23:06] <Heden_DLT> Hi all
Line 419: Line 408:
  [00:40] <@theruler_> @graf: thanks for all your help
  [00:40] <@theruler_> @graf: thanks for all your help
  [00:40] <Heden_DLT> bye bye
  [00:40] <Heden_DLT> bye bye
=Features=
==Feature/Payload list==
===Communication===
**gelic_xmit_test
**gelic_recv_test
===Dump===
**dump_lv2
**dump_slb
**dump_sprg0
**dump_htab
**dump_stor
**dump_flash
**dump_repo_nodes
**dump_repo_nodes_spu
**dump_profile
**dump_sysrom
**dump_dev_flash
**dump_hvcall99_param
**dump_lpar_ra
**dump_lv1
===Decrypt===
**decrypt_profile
**decrypt_usb_dongle_master_key
**decrypt_pkg
**decrypt_self
**decrypt_npdrm
**decrypt_game
**decrypt_lv2_direct
**decrypt_lv2_direct_355
**decrypt_self_direct
**decrypt_self_direct_355
**decrypt_profile_direct
===QA flag and token===
**update_mgr_qa_flag
**update_mgr_get_token_seed
**update_mgr_set_token
**update_mgr_calc_token
**update_mgr_verify_token
===PKG's===
**update_mgr_inspect_pkg
===Hooks===
**self_decrypter_hook
**vuart_hook
**stor_hook
**hvcall209_hook
===Dongle/Product Mode (recovery mode)===
**usb_dongle_auth
**product_mode_off
===Exploits===
**hv_mmap_exploit
**exploit_isoldr_mbox
**exploit_lv2ldr_mbox
**exploit_lv2ldr_ls
**exploit_appldr_mbox
===System Controller (SC) manager===
**sc_mgr_read_eprom
**sc_mgr_get_region_data
**sc_mgr_get_sc_status
**sc_mgr_get_srh
=== aim - aim_spu_module.self ===
**aim_get_device_type
**aim_get_device_id
**aim_get_ps_code
**aim_get_open_ps_id
=== SC - sc_iso.self ===
**sc_iso_sc_binary_patch
**sc_iso_get_sc_status
**sc_iso_get_property
**sb_iso_get_rnd
**sb_iso_encdec_key
===MFW/CFW/Patch Testing===
**store_file_on_flash
**replace_lv2
===vflash/flash/hdd===
**patch_vflash_region
**create_vflash_region
**store_file_on_vflash
**create_hdd_region
===Patches===
**patch_region_access
**patch_sll_load_lv2
**disable_hdd_crypto
===MISC===
**vuart_sysmgr
**vuart_dispmgr
**query_lpar_address
**encdec_cmd_0x85
**edec_kgen1
==Dumping Flash==
Uncomment '''dump_dev_flash()''' compile and run the payload
==Setting QA Mode==
<pre>
'''This section is in development anyone feel free to share and edit this section'''
</pre>
First you have to dump your Flash -> Extract EID -> Extract EID0 and EID4 -> put them on eid.c
*To do this you can use [[Hardware_flashing]], Linux with graf_chokolo kernel with acces to '''/dev/ps3nflasha''' [[Links_to_precompiled_stuff]] or using this payload uncommenting '''dump_dev_flash()'''
*More info in [[Flash]]
Once you are set
----
Use the payloads in the following order uncommenting the required function
*Set the QA flag
**update_mgr_qa_flag()
*Calculate the token
**update_mgr_calc_token()
*Verify token
**update_mgr_verify_token()
*Set the calculated and verified token in '''update_mgr_set_token.c'''
**update_mgr_set_token()
'''You should use wireshark or tcpdump to capture the responses'''
{{Custom Firmware}}<noinclude>[[Category:Main]]</noinclude>
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)