Logic-Sunrise : actualités, téléchargements, releases, dossiers et tutoriaux

Après la mise à jour 4.60 pour la PS3 (qui bloque les ODE), SONY met à jour sa petite sœur. La PS4 bénéficie donc d'un nouveau firmware et passe à la version 1.72.
 
Il s'agit d'une mise à jour mineure et SONY n'a pas communiqué pas sur les ajouts et corrections apportés.
 

Petite news de la part de la team Cobra sur leur site officiel : depuis la disponibilité de la version 4.60 du firmware officiel Sony, tous les Cobra ODE sont désormais désactivés. Il est donc évident si vous êtes possesseur de l'émulateur d'ISO de ne pas mettre à jour votre console avec cette dernière version sous peine ne plus pouvoir rien lancer.
 
La team semble travailler sur une solution, mais pour le moment aucune n'est disponible. Un peu de patience donc.
 

Depuis quelques jours, on assiste à la sortie de CFW PS3 avec le patch noDB. Ce patch, créé par zecoxao, développeur de PS3 IDPS/PSID Changer, permet l'installation d'un CFW sur une console PS3 (compatible) sans lecteur Blu-Ray ET/OU sans carte fille.
 
Voici donc une liste non exhaustive de CFW qui contiennent ce patch utile à certains :
 

- MLT-4.46 (Cobra 7.0 + XMB Mods + System manager + Core 3.3.2)
- Rogero/Cobra 4.46 CFW (Orion90)
- CFW CEX ARCH 4.55 RC1
- REBUG 4.46.1 REX (COBRA 7) - Unofficial Release
- HABIB 4.55 v1.03
- FERROX 4.55 v2.01 NoBD CFW
- Rogero 4.55 CEX v1.00 (Joonie86) 

 
Je ne préfère pas mettre de lien vers les téléchargements, voici pourquoi : cette news a seulement pour but de vous informer de la connaissance de ces CFW avec le patch noBD. Je vous invite donc à faire quelques recherches Google avec le nom de ces CFW pour avoir plus d'infos sur leur compatibilité, leurs fonctions avancées et autres.

Après la mise a jour PS3 4.60 que SONY vient de déployer, Arachetous nous propose son Spoof Enabler/Disabler pour réactiver le PSN sur les consoles en 4.55.
 
Le ReadMe et ChangeLog:
 

SPOOF package 4.60 for all CFW 4.55 CEX standard.

The connection to the PSN then works enjoy!

Features v1.00 :
Compatible standard CFW 4.55 CEX only version
Not compatible Rebug or CFW Cobra edition or no-BD
Enabling and disabling spoof easily

update v1.01 :

add : certificat / CAxx version 4.60

Operation
download and install the package
launch the application, choose enable or disable spoof 4.60
Then put yes to two successive questions (yes to reboot, yes to hard reboot).
Console restarts and ok.

Note : if you have a ps3 that does not restart correctly. No panic, just reinstall your CFW by the recovery mode.

 
Mise a jour en v1.02
 

update v1.02 :
add : support CFW 4.50 CEX Standard

 
Telechargement: http://uploaded.net/file/jo5gesld

Après la mise en ligne de la 2.10 bêta, la team 3k3y récidive avec la 2.11 bêta. Au menu, si vous possédez le "3Dump.bin", vous pouvez faire vos mises à jour et quitter correctement les jeux.
 
Changelog:
 

Notes for 3k3y firmware v2.11 Public Beta:

3k3y users with 3Dump.bin (drive key) can now enjoy full functionality on original firmware 4.55, it should work to update and quit games, make sure there is a FIX3DUMP=Y entry in 3key.cfg.

For now, while waiting for 3k3y isotools swap disc support, you can use the Cobra ODE Bypass 4.55 tools to create swap ISO file. Burn with ImgBurn, use quality BD-R, Ritek worked fine for me. I've read some claim BD-RE will work, but not in my tests, I tried with Verbatim BD-RE (rewritable) and it failed. Also, make sure you use an original game disk which is single layer (25GB), check the Cobra Anti-ODE security bypass manual for more info.

Setting SWAPTIMEOUT over 30 seconds made the PS3 XMB freeze, that is the reason I limit it to 25 seconds. If you get freeze problem in XMB, try lowering the value, or remove the SWAPTIMEOUT setting in 3key.cfg, then it will default to 15 seconds.

The remote display will show "Load SWP disk" or "Load PS3 disk" when the time comes, you need to quickly open the cover/lid and swap to the requested disc and close the cover before SWAPTIMEOUT reaches zero, if too slow the PS3 XMB will detect the open cover switch and give error, in this case try to start over, if that also fails, power off the PS3 and restart.

If you don't own a 3k3y remote you need to pay attention when the motor stops, but this can be tricky, hopefully someone with a remote can post a video on YouTube so you get an idea how the swap is done. During game updates the BD drive can stop without actually requiring the swap disk, if so just leave the PS3 disk in there when updates are installing on the XMB screen.

When installing a PS3 game update there will be several swaps between SWP (swap) disc and PS3 (original) disc, also, after a game has an update installed on the PS3 hard drive, there will be one extra swap to insert original disc during normal gameplay.

If you manage to screw up the swapping, or if it fails by itself, turn off the PS3 super slim using power button and start over. Pay attention to drive motor sound and be careful, since it can spin with open lid theoretically due to the cover switch handling by 3k3y. If a PS3 game update was installing during a bad swap you might have to delete it in XMB, because the update file can be corrupt (signed with the wrong disk loaded).

Please provide feedback in this topic on EurAsia, so I can fix the bugs.

Download: 3k3y firmware v2.11 beta
Zip file MD5: c45f5642c59922193300da8107262181

NOTE: If you need help using Cobra ISO tools with 3k3y, check this post (in the old release topic). For help how to delete corrupt game updates in XMB, check this post.

3k3y firmware changelog:

v2.11 Public Beta

Fix for 3Dump.bin users on OFW 4.55, game updates and quit game works, FIX3DUMP=Y setting added to 3key.cfg.v2.10 Public BetaCobra 4.55 ISO tools support, COBRAISO=Y setting added to 3key.cfg.v2.08 Private BetaOFW 4.55 swap disc support with game updates working.No wire/soldering required for cover switch handling.Remote display swap requests added.SWAPTRICK=Y setting added to 3key.cfg.SWAPTIMEOUT=xx (between 5 - 25 seconds) setting added to 3key.cfg.Optional LANGUAGE=P0T setting added to 3key.cfg, giving P0T-NOoDLE font on the remote display in English (Thanks Sir Garbagetruck aka Lastebil for the heads up). 

3k3y firmware v2.11 beta

Aldostools nous propose une mise a jour de sa suite d'outils "PS3 Tools Collection" en v2.7.22, Cet utilitaire est une compilation d'applications pour vos jeux ainsi que pour votre console Playstation 3. PS3 Tools Collection est un incontournable pour les bidouilleurs de fichiers de jeux .
 
Il regroupe les applications suivantes :
 
PKG ContentID,ps3gen patcher,PS3 Game Integrity,PARAM.SFO editor,PS3 File Splitter,PS3RIP,PS3_DISC.SFB edit,PS3 PSARC GUI,BruteForce/SCETool Decrypter,PS3 Cheats Editor,PS3 Game Integrity,mmDM,mmTM_GUI,Create PS3_EXTRA,TXT to Links.xml,PS3 NET Server GUI,PS3 Keys,netmon and renam.etc...

 
 

 
 

Télécharger PS3 Tools Collection 2.7.22

Nous connaissons tous AldosTools pour sa suite d'outils PS3TOOLS. Le voila cette fois avec IrisMan, un forks (dérivé) d'Iris Manager, un backup manager concurrent de Multiman.
Cette mise a jour apporte pas mal de nouveautés aussi bien esthétiques que softwares. (Nouvelle Interface, Prise en charge de webMAN et des dossiers réseaux, édition du PARAM.SFO etc..)
 
En voici le changelog:
 
New XMB-Like GUI (it's a clean GUI where you can appreciate better the background image of the game)webMAN integration for display of network games on IRISMAN(there is a combo that also let display all webMAN games on IRISMAN, but that's just for fun as IRISMAN can handle the other file types)Added several game list filters (Retro only, PS1+PS2+PSP only, dev_hdd0 only, ntfs + PS3 only, Homebrews, all games, etc.)Mount shared network folders (net0/ or net0/PKG) to browse remote of with the File ManagerAdded file count/total size, folder count to File Manager statisticsEdit PARAM.SFO directly from File Manager (no need hex editor)Fixed some broken functions in Hex Editor due new buttons mapping.Launch LUA scripts stored on any folder directly from File ManagerAnd many other improvements (internal in the code, bug fixes, improved functions, more combos , etc.) 
Pour le telecharger: IRISMAN v3.02  (Miroir: mediafire)

Une mise à jour 4.60 serait sortie ce jour et empêcherait le fonctionnement des ODE (Cobra/3k3y/E3 Ode Pro) y compris l'utilisation du disque SWAP sur nos chères PS3. Et ceux, quel qu'en soit le model : FAT/SLIM/SUPER SLIM.
 
D'après SONY, celle-ci permettrait une plus grande stabilité du système lors de l'usage de certaines applications. Aucun changelog officiel n'est pour l'instant disponible.
 
Un code d'erreur s'afficherait '80010017' au démarrage de la console pour les malchanceux qui auraient fait la mise à jour par erreur.
 
Utilisateurs d'ODE, ne mettez pas à jour de votre PS3 tant que vous n'aurez pas plus de retours.

Apres plusieurs mois sans donner de nouvelles, la team 3k3y nous informait il y a peu qu'une mise à jour de son 3k3y sur les Ultra Slim en firmware 4.55 était rentrée en phase de bêta test. Après une version 2.08 privée, voici la 2.10 en bêta publique. Le disque de swap est toujours nécessaire.
 
Voici le ReadMe :
 

Notes for 3k3y firmware v2.10 Public Beta:

For now, while waiting for 3k3y isotools swap disk support, you can use the
Cobra ODE Bypass 4.55 tools to create swap ISO file.

Burn with ImgBurn, use quality BD-R, Ritek worked fine for me. I've read some claim BD-RE will work, but not in my tests, I tried with Verbatim BD-RE (rewritable) and it failed. Also, make sure you use an original game disk which is single layer (25GB), check the Cobra Anti-ODE security bypass manual for more info.

Setting SWAPTIMEOUT over 30 seconds made the PS3 XMB freeze, that is the reason I limit it to 25 seconds. If you get freeze problem in XMB, try lowering the value, or remove the SWAPTIMEOUT setting in 3key.cfg, then it will default to 15 seconds.

The remote display will show "Load SWP disk" or "Load PS3 disk" when the time comes, you need to quickly open the cover/lid and swap to the requested disc and close the cover before SWAPTIMEOUT reaches zero, if too slow the PS3 XMB will detect the open cover switch and give error, in this case try to start over, if that also fails, power off the PS3 and restart.

If you don't own a 3k3y remote you need to pay attention when the motor stops, but this can be tricky, hopefully someone with a remote can post a video on YouTube so you get an idea how the swap is done. During game updates the BD drive can stop without actually requiring the swap disk, if so just leave the PS3 disk in there when updates are installing on the XMB screen.

When installing a PS3 game update there will be several swaps between SWP (swap) disc and PS3 (original) disc, also, after a game has an update installed on the PS3 hard drive, there will be one extra swap to insert original disc during normal gameplay.

If you manage to screw up the swapping, or if it fails by itself, turn off the PS3 super slim using power button and start over. Pay attention to drive motor sound and be careful, since it can spin with open lid theoretically due to the cover switch handling by 3k3y. If a PS3 game update was installing during a bad swap you might have to delete it in XMB, because the update file can be corrupt (signed with the wrong disk loaded).

Please provide feedback in this topic so I can fix the bugs.

 
Et le changelog :
 

v2.10 Public Beta
 
- Cobra 4.55 ISO tools support, COBRAISO=Y setting added to 3key.cfg

v2.08 Private Beta

- OFW 4.55 swap disc support with game updates working
- No wire/soldering required for cover switch handling
- Remote display swap requests added
- SWAPTRICK=Y setting added to 3key.cfg
- SWAPTIMEOUT=xx (between 5 - 25 seconds) setting added to 3key.cfg
- Optional LANGUAGE=P0T setting added to 3key.cfg, giving P0T-NOoDLE font on the remote display in English (Thanks Sir Garbagetruck aka Lastebil for the heads up)

Télécharger 3k3y Firmware v2.10

Alors que la Wii U commence à peine à se vendre grâce à l'arrivée de Mario Kart 8, et que certaines personnes se penchent sur le hack de la console, c'est Carlkenner qui annonce le développement du premier émulateur Wii U, une version non officielle de Dolphin. Actuellement à ses balbutiements, si le projet devient aussi important que la version Wii, le rendu risquera d’intéresser beaucoup de monde.
 

I started adding Wii U support to the Dolphin emulator.
Currently it can recognize your Wii U games (in addition to your GameCube and Wii games) in either WUD or ISO format, recognize what region it is, what size it is, get the game ID, and most importantly read the file system and extract files for all partitions except the game partition. Also it lets you open RPX files, although they don’t load correctly.
It can only find the partitions and read the file system for games where the title key has been released. Don’t ask me how to rip your games from your WiiU, because I don’t know, but some people seem to manage it.
 
Currently this is only useful for hackers who want to examine the update partition (I heard some exploit authors wanted binaries), or collectors who want to show off their list of games, or people who are curious what’s on those discs, or people who want to work on emulating the Wii U.
IT DOES NOT PLAY WII U GAMES YET.
 
The source code is here on github (requires Visual Studio 2013, or if you are on linux you may need to modify the build system to include the extra files in the DiscIO module):
https://github.com/C...lphin/tree/WiiU
 
There is a bug with at least 3 of the file names on SM3DW, where the names are not read correctly, which I believe is caused by the filenames being split across the cluster boundary. Which means there is probably also a bug which corrupts some of the contents of other files where that happens. So don’t rely on files being 100% accurate. The files whose formats I can understand, like app.xml or update.inf.USA, seem to be working perfectly (which is an especially good sign because those files are actually garbled when you decrypt the entire disc image with OpenSSL, at least on SM3DW).
 
I hope this will provide a starting point for other people who want to work on adding Wii U support to Dolphin. I believe the next step should be to try to get RPX files to load and to be viewable in Dolphin’s debugger (use the command line option -d I think). Then we can work on getting simple hello world rpx files to work with high level emulation of SDK functions.

Après un leak, c'est désormais une version officielle de l'exploit du navigateur Wii U qui est disponible. Pour rappel, cette faille ne permet pas encore le lancement d'un éventuel exploit permettant de lancer des jeux. C'est néanmoins une avancée évidente, qui rappelons-le est bloquée doit être adaptée à la dernière mise à jour Wii U officielle.
 
Assez complexe à mettre en place pour des novices, voici le ReadMe qui l'accompagne:
 

This repository contains a way to run code inside the Wii U's web browser. It provides a means to execute arbitrary code in the Cafe OS userspace on the Espresso processor. It does not allow running code in Espresso kernel-mode or provide any access to the Starbuck. We hope to implement this in the future, but the exploit is currently limited to userspace only. Right now, the only Wii U system software versions supported are 4.0.x and 4.1.0. 5.0.0 has the WebKit bug, but there is no exploit for it yet.

What's inside?

Inside this repository, you will find a set of tools that allow you to compile your own C code and embed it inside a webpage to be executed on the Wii U. There are also a few code examples doing certain tasks on the Wii U. Most notably, there is an RPC client which allows your Wii U to execute commands sent over the network from a Python script. Nothing in this repository is useful to the general public. You will only find it useful if you are a C programmer and want to explore the system by yourself.

How do I use this?

C build system

This repository contains a C build system, which allows you to compile your own C code and embed it inside a webpage to be executed on the Wii U. The webpage contains some Javascript code that triggers the WebKit bug and passes control to your C code. Running your own C code on the Wii U gives you full access to the SDK libraries. Any function's address can be retrieved if you know its symbol name and containing library's name (more on this below). Before using the C build system, you must have the following tools:

Unix-like shell environment (use Cygwin to get this on Windows)devkitPPC (needed to compile and link the C code)Python 3.xNavigate to the root of the repository in the shell. Then enter the following command at the command line:./build.sh [filename] [version]where [filename] is the name of a C file inside the "src" directory, and [version] is the Wii U system software version you're building for. Supported version strings are 400 (for 4.0.x) and 410 (for 4.1.0). Not supplying a version string will cause it to default to 4.1.0.

Accessing the SDK libraries

When you're writing C code on a PC, you have the standard library, a set of useful functions that you can call without caring how they work. For writing code on the Wii U, there's something similar: the SDK libraries. The SDK libraries provide access to graphics, audio, input, filesystem, and network functions. The SDK libraries are accessible from any application, including the web browser, which means that code running inside it using an exploit also gets access. All SDK libraries have full symbols available for every function. Aside from making reverse engineering easier, this means that you can get the address of any function by its library and symbol name.

Before using the SDK, it's important to understand the Wii U's linking model. Some of these details were provided in comex's part of the 30c3 talk, but it only touched on it. Each executable on the Wii U uses the ELF format, with slight modifications (this format is called RPX). RPX files contain a list of imports, which specify a symbol being imported from an external library along with the name of the library itself. The libraries referenced by imported symbols use the same modified ELF format, but are named RPL instead. When an RPX is loaded, the executable loader will also load its RPL dependencies.

Every SDK library is an RPL file. For example, gx2.rpl is the name of the graphics library, vpad.rpl is the name of the Gamepad input library, and nsysnet.rpl is the name of the BSD sockets library. There is also a special RPL called coreinit.rpl, which is quite interesting. coreinit provides direct access to many core Cafe OS services, including memory management and threading. coreinit was also quite useful for providing the functions we needed in our ROP chain.

Now that I've spent 3 paragraphs telling you how the SDK works, let's actually get around to using it. So how do you use it? The SDK libraries expose many functions, but how do you get their addresses? You could just hardcode them, obviously, but that's both lame and not portable to later exploit versions. Plus how do you find the address to hardcode in the first place? There's a much better method available, which allows you to get symbol addresses dynamically, in the form of the coreinit OSDynLoad functions. You can access these functions by including coreinit.h in your C file.

There are two functions involved in getting a symbol, splitting the process into two parts. The first function is OSDynLoad_Acquire(), which loads the RPL you specify. OSDynLoad_Acquire() takes two arguments: the RPL name as a string and a pointer to an integer. The RPL name is pretty straightforward, the pointer to an integer is where coreinit will store the library's location. OSDynLoad_Acquire() can also be used to get the location of a library that's already loaded. The second function is OSDynLoad_FindExport(), which finds a symbol given a library's location. It takes four arguments: the integer (not the pointer to it) used in OSDynLoad_Acquire(), just zero, the symbol name as a string, and a pointer to where the symbol address should be stored. Here are the function prototypes:void OSDynLoad_Acquire(char *rplname, unsigned int *handle);void OSDynLoad_FindExport(unsigned int handle, int always0, char *symname, void *address);Just as an example, let's say I wanted the VPADRead() symbol from vpad.rpl. If I have an integer called "handle", I first call OSDynLoad_Acquire("vpad.rpl", &handle); to get the RPL's location. Next, if I have a function pointer for VPADRead() called "VPADRead", I call OSDynLoad_FindExport(handle, 0, "VPADRead", &VPADRead); to retrive VPADRead()'s address. Simple. For more examples, look at rpc.c.

RPC system

In addition to letting you write your own C code to run on the Wii U, this repository also includes an RPC system to interactively experiment with the Wii U. It allows you to send commands over the network for your Wii U to execute. The two components of the RPC system are the server, a C program running on the Wii U listening for commands, and the client, a Python script that sends the commands.

To use the RPC system, first ensure that your PC and Wii U are connected to the same network. Once they are, find out your PC's IP address using the "ipconfig" command (Windows) or "ifconfig" command (Linux and OS X). Modify PC_IP in socket.h to be your PC's IP address (rather than 192.168.1.4, which it currently is). Build rpc.c and it will go in your htdocs.

Next, start rpc.py in an interactive Python session (IDLE or IPython is a good choice). Once you've started rpc.py, navigate to the browser exploit you just made on your Wii U. It should appear to finish loading the page, and the UI will continue to be responsive, but web browsing will be disabled. At that point, the Python shell should say something along the lines of "Connected by" followed by your Wii U's IP. Now you can control your Wii U with these commands:rpc.read32(address, num_words) - Read num_words words starting at address, returning a list of wordsrpc.write32(address, words) - Write each word in the list words to memory starting at addresssymbol(rplname, symname) - Get the symbol symname from RPL rplname and turn it into a callable Python functionrpc.exit() - Exit the browser and go back to the menuCreditsMarionumber1 - ROP chain design/implementationTheKit - WebKit bug finding, ROP chain implementationHykem - Finding ROP gadgetsbubba - Testing WebKit bug candidatescomex - Access to the coreinit and WebKit binaries 
Disponible ici : https://bitbucket.or...u-userspace/src
 
Petite vidéo de l'exploit en action :
 

La team E3 nous prévient aujourd'hui que des copies de très mauvaise qualité de son produit E3 ODE Pro sont sur le marché. En effet, après plusieurs mauvais retours de clients, la team a décidé de faire une petite enquête. Une fois chose faite, elle s'est aperçue que les problèmes rencontrés par les utilisateurs viennent du fait que ce sont des copies.
 
La team nous demande donc de bien faire attention au moment de la réception des E3 et de vérifier que ceux-ci sont bien des originaux. Pour cela, la team nous montre comment s'y prendre :
 
 
 

 
Elle demande de l'avertir via son site officiel du nom du vendeur si une copie tombait entre nos mains.
 
Par ailleurs, nous apprenons qu'elle prépare une nouvelle version de son E3 Ode Pro incluant déjà un hardware modifié pour ultra slim 4.55 qui sortirait d'ici 2 à 3 mois .