The printable version is no longer supported and may have rendering errors. Please update your browser bookmarks and please use the default browser print function instead.
There is a wiki page for patch tests that is not tracked by the wiki search engine, to access it click in the next link, and feel free to use it for any experiments:
#!/usr/bin/tclsh
#
# ps3mfw -- PS3 MFW creator
#
# Copyright (C) Anonymous Developers (Code Monkeys)
#
# This software is distributed under the terms of the GNU General Public
# License ("GPL") version 3, as published by the Free Software Foundation.
#
# Priority: 2300
# Description: Patch firmware for installation shop/promo unit
# Option --patch-promo-flags: Patch promo_flags file
# Option --patch-update-flags: Patch update_flags file
# Option --patch-version: Append string to build version
# Type --patch-promo-flags: boolean
# Type --patch-update-flags: boolean
# Type --patch-version: string
namespace eval ::patch_shop {
array set ::patch_shop::options {
--patch-promo-flags true
--patch-update-flags true
--patch-version "Promotional-to-Retail"
}
proc main {} {
if {$::patch_shop::options(--patch-promo-flags)} {
debug "Patching [file tail $::CUSTOM_PROMO_FLAGS_TXT]"
}
if {$::patch_shop::options(--patch-update-flags)} {
debug "Patching [file tail $::CUSTOM_UPDATE_FLAGS_TXT]"
set fd [open $::CUSTOM_UPDATE_FLAGS_TXT w]
puts -nonewline $fd "0000"
close $fd
}
if {$::patch_shop::options(--patch-version) != ""} {
append ::options(--build-suffix) "($::patch_shop::options(--patch-version))"
}
}
}
patote succesfully installed the resulting 3.55 PUP on a Retail console. The console is in locked mode after installation of the firmware.
patote 8294 does nothing
patote 0168 does nothing
patote 5138 does nothing
patote 1739 worked fine
patote or not ; it didnt said wrong password ; but all is still locked
patote 2297 nothing
patote the code is................. 0000
patote and now the install package files and app_home are back in game menu
patote ohhh ; and in system too ; all the way down
patote if you go to security settings and do l1+r1+select+square it goes back to demo without turn the unit off
patote thats system settings install packages option only does blind installations
patote you cant browse the thumbdrive ; it just starts installing all the pkgs in the drive
patote it works ; but fails in geohot signed ones ; the regular ones installs without problems
patote theres another extra option
patote automatic update
patote "sets wheter to update the system software automatically via internet when the ps3 system is turned on"
FSELF patch appldr
MFW does not seem to have (proper) support for fself's.
Mathieulh why do all those emu devs actually use geohot's tool on their selfs, I wonder xD
Mathieulh the proper format to use is fself
Mathieulh there are existing patches for fself on 3.41
Mathieulh but those guys who make those so called cfw didn't port many patches at all
Mathieulh if not any
Mathieulh and the memory patcher one for fself isn't there
eussNL ehm, including MFW Mathieulh ?
Mathieulh you should just patch appldr
Mathieulh and make the function that detects the model return true for debug
Mathieulh and you get native fself + edata
Mathieulh it's an easy patch
Mathieulh you can also patch the sign check along with it
Mathieulh 4 bytes to patch
eussNL I dont see a mention of appldr patch in MFW or I am overlooking it
Mathieulh yeah MFW doesn't do that
Mathieulh but there is a lv2 patch for fself too
Mathieulh (memory patcher)
Mathieulh at least in 3.41 there is
Mathieulh it's in psgroove
Mathieulh but it doesn't work for compressed fself
Mathieulh it's better to patch appldr
Mathieulh besides I use compressed fself on all my shit now xD
Mathieulh saves some room :P
Mathieulh people should just use fself anyway
Mathieulh that way you don't need to sign or encrypt
Mathieulh and it's future proof
Mathieulh the geohot signed shit doesn't work with 3.56+ cause of the whitelistù
Mathieulh so you have to patch the whitelist check in the ldr to get them to run
eussNL some people are having trouble with ps3load/ps3loadx with launching it fselfs on CFWs
eussNL and with makeself for the same reason I suppose
irssi_ devs won't support it if the CFW doesn't run it
Mathieulh if the cfw doesn't run fself, it's not complete
Mathieulh at least not to me
Mathieulh all my personal cfw all run fself natively
eussNL hmmm, seems a thing to add to MFW then... appldr patch for fselfs - if it isnt working now
the 4 byte patch he speaks of is:
< 00001360 40 80 0e 0c 20 00 57 83 32 00 04 80 32 80 80 8e |@... .W.2...2...|
---
> 00001360 40 80 0e 0c 20 00 57 83 32 11 73 00 32 80 80 8e |@... .W.2.s.2...|
Experimental
Patch Appldr task
patch_appldr.tcl
#!/usr/bin/tclsh
#
# ps3mfw -- PS3 MFW creator
#
# Copyright (C) Anonymous Developers (Code Monkeys)
#
# This software is distributed under the terms of the GNU General Public
# License ("GPL") version 3, as published by the Free Software Foundation.
#
# Priority: 300
# Description: Patch Appldr
# Option --patch-appldr-fself: Patch Appldr to allow Fself (set debug true)
# Type --patch-appldr: boolean
namespace eval ::patch_appldr {
array set ::patch_appldr::options {
--patch-appldr-fself true
}
proc main { } {
set self "appldr"
::modify_coreos_file $self ::patch_appldr::patch_self
}
proc patch_self {self} {
if {!$::patch_appldr::options(--patch-appldr-fself)} {
log "WARNING: Enabled task has no enabled option" 1
} else {
::modify_self_file $self ::patch_appldr::patch_elf
}
}
proc patch_elf {elf} {
if {$::patch_appldr::options(--patch-appldr-fself)} {
log "Patching Appldr to allow Fself"
set search "\x40\x80\x0e\x0c\x20\x00\x57\x83\x32\x00\x04\x80\x32\x80\x80"
set replace "\x40\x80\x0e\x0c\x20\x00\x57\x83\x32\x11\x73\x00\x32\x80\x80"
catch_die {::patch_elf $elf $search 7 $replace} \
"Unable to patch self [file tail $elf]"
}
}
}
Errorlog
Patching Appldr to allow Fself
Executing command ::patch_elf $elf $search 7 $replace
offset: 4967
Rebuilding self file appldr.self
Executing command makeself $in $out $original
Executing shell self_rebuilder {Temp\PS3MFW\PS3MFW-MFW\update_files\CORE_OS_PACKAGE\appldr.elf} {Temp\PS3MFW\PS3MFW-MFW\update_files\CORE_OS_PACKAGE\appldr.self} {Temp\PS3MFW\PS3MFW-MFW\update_files\CORE_OS_PACKAGE\appldr}
FATAL ERROR: Could not rebuild file appldr.self : child process exited abnormally
See Temp/PS3MFW/ps3mfw.log for more info
Last lines of log :
*****************
auth id: 1ff000000c000001
vendor id: 00000000ff000000
app version: 3.55.0
version suffix: 355
SDK type: Retail (Type 0)
app type: secure loader
file suffix: 355 (rev 0x0a)
key file: ps3keys\/ldr-key-355 (ERROR)
key_get failed
FATAL ERROR: Could not rebuild file appldr.self : child process exited abnormally
Error running script: Could not rebuild file appldr.self : child process exited abnormally
available LDR @ ps3keys: ldr-pub-retail, ldr-priv-retail, ldr-key-retail, ldr-iv-retail, ldr-ctype-retail
Although it is possible to add as a task, it is not recommended in general. There is brick risk (on 3.55 reported blackscreen brick -> seems to be related to self_rebuilder bug).
<mall0ry> eussNL, that appldr fself patch is risky because it is patching a branch target
game_ext_plugin
set search "\x88\x1f\x00\x06\x3b\x80\x00\x01"
set replace "\x88\x1f\x00\x02\x3b\x80\x00\x01"
sysconf_plugin
set search "\x88\x1c\x00\x06\x54\x00\x07\xfe"
set replace "\x88\x1c\x00\x02\x54\x00\x07\xfe"
premo_game_plugin
set search "\x41\x9e\x00\x4c\xe8\x01\x00\xa0\x38\x60\x00\x00"
set replace "\x41\x9e\x00\x4c\xe8\x01\x00\xa0\x38\x60\x00\x01"
premo_plugin
set search "\x41\x9e\x00\x4c\xe8\x01\x00\xa0\x38\x60\x00\x00"
set replace "\x41\x9e\x00\x4c\xe8\x01\x00\xa0\x38\x60\x00\x01"
This doesn't require an extra patch on explore_category_game,
If you use this file from DEX FW, you won't need this patch as it's enabled by default.
Reversed by Cyberskunk
Install Packages on 4.3x
explore_category_game.prx
set search "\xF8\x21\xFE\xD1\x7C\x08\x02\xA6\xFB\x81\x01\x10\x3B\x81\x00\x70"
set replace "\x38\x60\x00\x01\x4E\x80\x00\x20\xFB\x81\x01\x10\x3B\x81\x00\x70"
explore_plugin.sprx
set search "\xF8\x21\xFE\xD1\x7C\x08\x02\xA6\xFB\x81\x01\x10\x3B\x81\x00\x70"
set replace "\x38\x60\x00\x01\x4E\x80\x00\x20\xFB\x81\x01\x10\x3B\x81\x00\x70"