[Nateblitz16]

I (aka shadoxi) figured out where is located the payload of Trueblue and cobra dongle. You can find it at offset @360 000 in lv2_kernel and 7f0000 in ps3 memory.

First of all you need to edit the header of lv2_kernel.self (from cfw trueblue) at offset 0x1D, replace 36 1A 00 by 4C FC F0. And decrypt it with unself tool from fail0verFlow. Open lv2_kernel.elf with Ida pro (in binary file mode), go to offset 360000 and press "C" to convert to asm code.

TrueBlue use some HVCALL:
lv1_insert_htab_entry
lv1_undocumented_function_114
lv1_undocumented_function_115
lv1_allocate_device_dma_region
lv1_map_device_dma_region
lv1_net_start_tx_dma
lv1_net_control
lv1_panic (shutdown ps3 when TB is unplugged)

This payload do some hvcall:
lv1_insert_htab_entry (map lv1)
lv1_allocate_device_dma_region (?)
lv1_map_device_dma_region (?)
lv1_net_start_tx_dma (?)
lv1_net_control (?)
lv1_panic (shutdown ps3 when TrueBlue Dongle is unplugged)
lv1_undocumented_function_114 (map lv1)
lv1_undocumented_function_115 (unmap lv1)



We need now to dump lv2 and lv1 memory when TrueBlue is plugged. So I create a modified TrueBlue Cfw with peek and poke syscall. It work fine !


Payload

mirror: www.mediafire.com/?vpf113m30y5x4kh

source: ps3newz

[vhs]

This is true? Now what?

Sent from my u8800 using Tapatalk

[enosrasun]

Originally Posted by vhs This is true? Now what? Sent from my u8800 using Tapatalk

now true blue scam is over ,let see how tb will react to this

[Chris9191]

Wait what? what does this work for huh

Is this big news or what?

[Nateblitz16]

ps3newz just deleted the thread..

[japsander]

Originally Posted by Chris9191 Wait what? what does this work for huh

im thinking much the same

[japsander]

Originally Posted by Nateblitz16 ps3newz just deleted the thread..

i got the files in case they are of use

[big_russ]

WHAT!!!!!!!!!

[Chris9191]

not downloaded the files, too lazy

But are the payloads for other atmel devices?

[Rixevo]

hopefully this is the end of the disease