[japsander]

Originally Posted by Chris9191 not downloaded the files, too lazy But are the payloads for other atmel devices?

2 files in the zip with a readme
PayloadLv2cobra.bin
PayloadLv2TrueBlue.bin

Originally Posted by readme drag and drop payload in ida and load it in Binary file mode, Processor type PPC.Press "C" to convert in asm code.

[gliitch]

******* bums trueblue..thats why they removed the post ><

[Cage]

Originally Posted by Nateblitz16 ps3newz just deleted the thread..

Actually they just merged it with the bigger one related to DRM dongles.

These files are probably legit.

[derako]

so, how we dump lv2 and lv1 with trueblue working?

[pereb27]

You probably also want appldr for True Blue.
Interesting nonetheless, hope you figure it out

[spectlze]

hopefully this will make for a free true blue and cobra alternative.

[Cheesethief]

Here's a mediafire mirror so you do not have to wait half an hour to start the download:
http://www.mediafire.com/?vpf113m30y5x4kh

I also made other mirrors in case this gets taken offline.

[svenmullet]

I wouldn't doubt if this is the dongle-killer right here; I just ordered a Cobra, should be here Tuesday

This is exactly what happened with the downgrade payload, I order an E3 cardreader from lightake, and it goes open source the next day. I wonder if I can return it for my money back (when it gets here) (if this does end up pwning the dongles)

[euss]

Thank you for reading wiki november updates

/sarcasm

startpost 18 februari 2012: I (aka shadoxi) figured out where is located the payload of Trueblue and cobra dongle. You can find it at offset @360 000 in lv2_kernel and 7f0000 in ps3 memory.

versus

wiki 17-25 november 2011: lv2_kernel.self http://pastie.org/private/onlbfdxjdtaddb9blu0sq only 1 function change, and a section added sub_28fe30 is replaced 1) the new section is loaded at 0x80000000007f0000 (which is where those payloads are being loaded) lv2_kernel.bin (6.41 KB) note 1) : * the 28fe30 function is replaced with OFW code during exploit execution (which is why it is OFW, when there is no dongle). That 28fe30 function mounts dev_flash, so they are in control before even dev_flash loads. When lv2 loads dev_flash, the exploit is triggered which, among the things it does, is replace the function with the proper one to mount dev_flash, then branchs to it and boot continues.

as to the rest:

<eussNL> let me translate it for you: ¨offset 0x1D, replace 36 1A 00 by 4C FC F0¨ -> fix bad SHT <eussNL> and open lv2_kernel in IDA just like you normaly would <eussNL> the rest is just the same as on wiki <eussNL> nothing new I see <eussNL> ¨create a modified TrueBlue Cfw with peek and poke syscall.¨ which is funny when you see it tests for that syscall and bricks the dongle

Originally Posted by JOshISPoser [...] hopefully this leads somewhere quick so people can complain about something else

With the speed of how they read november wiki in februari, I would not be that hopefull

[JOshISPoser]

i bet they'll change their site saying no returns sven
hopefully this leads somewhere quick so people can complain about something else