yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] amazinglarry311:
Payload Binary Hex Conversion Tutorial

the v2 recovery and the rc3 in the original post CAN use the current binaries. on most devices a little modifcation is required for payloads to work, jadflat was the first to regularly keep them coming and i have been succesfully porting payloads for use with my recovery mod and also compatible with rc3 in the OP which are being maintained

HERE

As promised, here's a tutorial for editing released .bin files for use with rc3 in OP or my recovery v2 mod.

You will need:

Hex Editor (for several reasons i use

PSPad

for windows it keeps unix format intact and has a hex editor, very easy to use) I wont be including specific addresses to make things easier on people who are not familiar with a hex editor.

Payload binary - These can be compiled if you know how (i personally don't have a linux box or live cd at the moment so cant really do this) but are easier found with a google search. In this case i got the payload from EvilSperm's thread at ps3news

Since this is a hermes payload very little needs to be done, we'll go over pl3 binaries afterwards.

Now that you have both of those things:

Open the port1_config_descriptor.bin (or whatever the binary is named) file

As stated in .kAroshi's OP (post 2 regarding payloads) you will want to remove everything before 0000 0000 0000 FACE B003 AABB CCDD to do so with PSPad just open it up and click into the first line and press insert, select the bytes pictured here and delete them. Save the file as payload or whatever you want to call it.

Hermes payloads are easy, that's all there is to it on those.

PL3 payloads

For this example i used the PL3 payload posted on the previous page (payload_no_unauth_syscall_3_41.bin) after opening in a hex editor it should look like this:

Press insert and at the beginning of the file add 0000 0000 0000 FACE B003 AABB CCDD

now navigate to the bottom of the file

we need to resize it so it works correctly, to do so add 0000 several times at the bottom until it looks like this:

and it's size should be

Now save this file as payload or whatever you want to call it and use with v2 recovery or with rc3 in the OP.

HELP:

As for acheiving the opposite, i can't seem to get hermes payloads to work whatsoever on a PL3 based psfreedom module, does anyone have any idea? I added some lines to the psfreedom script on the amon_ra 1.3.0 PL3 recovery image to make a payload dump after loading and the payloads seem to just be unedited kakaroto PL3 binaries when looked at in a hex editor. My logic was that since they had no header and a different filesize i could just remove the header from a hermes payload and reduce the filesize a little, when doing so the ps3 doesnt boot at all. i have one thing left to try, but has anyone heard of any success of getting a hermes payload running on psfmod from klutsh? if so is there a link? jadflat... any ideas?

oh and jadflat thanks for mentioning the TI-84 thread, the payloads are actually compatible with both my recovery mod and rc3 if the TI-84 header is removed, but i'm sure you were already aware of that.
[G1 Android Development] jadflat:
great tutorial!!

I do the pl3 process a little differently but I think your way is probably simpler. I use dos to merge a pre-made header file and the bin together and then a little dos program to resize it automatically.

I'm afraid I can't help with the hermes on pl3 recovery module, my knowledge of this stuff is quite limited, I've been happy using the enable and disable zips and haven't really looked beyond that. I just keep all of the payloads in seperate folders and copy them to data/local when needed.

Again, great work on the tutorial, maybe a mod could add it to the 2nd post?
[G1 Android Development] dj_hype:
Has anyone had any luck signing in to PSN? My system information says 3.50 but trying to log in to PSN it tells me I need to update.

And a big thanks to everyone doing development and payload releasing. Really appreciate all of your hard work.
[G1 Android Development] Stryder5:
The PSN trick was already patched by Sony.
[G1 Android Development] xxvitaljaxx:
Hey guys what´s going on?i heared sony started to bann since yesterday?

bad news....:-(

Edit:

Ok seems to be a fake but no one knows:!!! http://www.ps3hax.net/2010/09/ps3-consoles-are-not-being-banned/ !!!
[G1 Android Development] amazinglarry311:
Rumor and old news, disregard it
[G1 Android Development] dev78:
You know its funny, no matter what exploit the community comes up with, Sony will patch it. I guess its a good thing that Sony didn't ban consoles like Microsoft did.
[G1 Android Development] xxvitaljaxx:
it would be hard if they do like microsoft....

is something else new out there.

i am very happy about ur work amazinglarry your recovery is just too hot ;-)

i wish i could learn such things,that´s why i respect all devs cause they do crazy jobs!!

respect to all of u !!

greetz =)
[G1 Android Development] Ohsaka:
https://github.com/zAxis/PSGrade

PING! :) (some insane drunk person sent me this link)
[G1 Android Development] amazinglarry311:
Edit : waiting for psgrade keys, might just purchase psdowngrade and get a 3.15 machine again for the keys.
[G1 Android Development] naguz:
I am currently wanting to give building psfmod for Dream a try, but I need suitable kernel sources for Klutch's patch, or a patched kernel. Anyone have a source for that?
[G1 Android Development] Tornadobarrage:
i tried searching this thread and no answer. i am using a g1 with stock android rooted 1.6 and i tried all usb cables and it doesnt work but it stalls for 8 seconds and then the ps3 logo appears.
[G1 Android Development] Stryder5:
Which method are you using? After the PS3 logo appears, do you see the 2 new options under games?
[G1 Android Development] mitsu3000gt:
hi, everyone...

i've been using recovery-PSfreedom-Dream-v1.3.1 for about a month now...everything is working great...

until now, i just bought GT5 today...n I got some questions...

1. I saw some payload such as "spoofing FW3.50", will it work with GT5 (not thinking about online playing)

2. with recovery-PSfreedom-Dream-v1.3.1 recovery, will i able to change payload?...simply place the payload at \SDCARD\payload?

3. PL3, hermes ....are they all payloads name for PSfreedom??...the more research i do, more confused that i m ....

please, anyone? enlighten me.... thanks

*edited*

after tons of researching....figured out how to get spoofing FW3.50 to work ...thought i'd be able to play GT5...but not so...

checked other ps3 hacking forum... unfortunately, a jb ps3 playing GT5 is currently not possible ...even with spoofing FW 3.50 featured payload...so i gave it up....

updating my ps3 to 3.50 now...

crossing my finger hoping 3.50 downgrader will be out soon....
[G1 Android Development] tearsphere:
Didn't read all this until it was too late... My PS3 is on 3.50... I know there is a usb stick that you can buy to downgrade it to whatever u want.... But is there another way I can do it without ordering it.. Kinda like the 3.41 way...

Someone help... Please.
[G1 Android Development] Lieu10ant:
no there's not. people are working right now to port that downgrader and make it free.
[G1 Android Development] raimeiken:
is there a new version yet that has a 3.5 spoof?
[G1 Android Development] ssws90:
Has anybody managed to get Star Wars Force Unleashed II working using any of the methods outlined in this thread?? It is one of those games that requires 3.42 update. I have tried some but failed so far...

EDIT: I kinda knew that the next method I tried after posting would work :D In case anyone was wondering, the spoof by thugplayer on page 69 works fine (at least for this game).
[G1 Android Development] tearsphere:
Anything NEW for hacking the PS3 on Firmware 3.5 ....?? .. I just recently modded my Wii and it works wonders... Wanting to get my PS3 up and running the same...

Thanks
[G1 Android Development] chromersmith:
Tron Legacy

anyone have any payloads that work with Tron Legacy or Harry Potter Deathly Hallows?
[G1 Android Development] erickdj:
Today I updated my ROM to Cyanogen 6.1 RC1, now I can't use the enabler method to jailbreak my ps3. I disabled/enabled several times and copied the payload to the /data/local folder several times too, but it just won't work. Using the recovery image psfreedom method still works, so I guess it must have something to do with the CM 6.1 RC1 kernel. Anyone else come across this?
[G1 Android Development] Stryder5:
Not yet, you will have to wait for a downgrade fix to come out.
[G1 Android Development] gigoo25:
Downgradind Unencrypted PS3Yes

ITS FINNALY OUT!

Could someone be kind enough to convert this to a G1 payload?

http://psx-scene.com/forums/f6/ps3yes-becomes-first-release-non-encrypted-atmel-based-downgrader-72453/
[G1 Android Development] Ohsaka:
Heeey, nobody pinged me!!!

j/k

Ps3eyes website says "we will open source soon" i.e. "We want to make some money first"
[G1 Android Development] HipCat:
The hex and PS3 masterkey have been released. Free.

Now, to get it to work on here. :p
[G1 Android Development] Ohsaka:
That plus this: https://github.com/zAxis/PSGrade

plus elbow grease == the motherlode :)

Got a link to the key info?
[G1 Android Development] HipCat:
Yeah, but due to my lack of eight posts, I cannot post a link. However, I can tell you to check out Mathieulh's twitter ;)

Edit: Seems it's not THE master key; just the JIG masterkey. Still, pretty great!
[G1 Android Development] amazinglarry311:
I have the psgrade+ key payload but not sure if the g1/32b will work, I'll test in a few hours when i'm home.
[G1 Android Development] KoolKidsKlub:
Hey guys, that one key was not reall key, KaKaRoToKS just reversed the hex and got the key, the key is right here:

https://github.com/kakaroto/PSFreedom/blob/master/psfreedom_devices.h#L222

:DD When can we expect a playload for it? :o oh and here is his twitter post http://twitter.com/#!/KaKaRoToKS
[G1 Android Development] amazinglarry311:
i'm not going to have a payload for a while. the one i compiled with the correct key isnt working. might need someone to compile a psfreedom module that is capable of loading it.
[G1 Android Development] bigd5783:
more than likely an entire module will need to be written as this is not a payload it is a completely different bag of tricks all together.
[G1 Android Development] KoolKidsKlub:
Ah that sucks... Here is the actual github of PSGrade by zAxis https://github.com/zAxis/PSGrade you can see the psx-scene post here http://psx-scene.com/forums/cmps_index.php it also has the hex avalible for ALL boards. Maybe you can do something with it?

EDIT: And heres the PSFreedom github if it helps, it looks like it was updated.. https://github.com/kakaroto/PSFreedom
[G1 Android Development] .kAroshi:
Untested new psfreedom module attached, should have jig mode enabled.

Module is zipped, extract and put it in /system/lib/modules, reboot and test.

It is not flashable, for now. It should work on both 32A and 32B, plus of course G1.

If anybody could please try it and report back i will prepare the zip for flashing tomorrow morning.

I REPEAT, IT'S NOT FLASHABLE AND IT'S UNTESTED, TRY IF ONLY IF YOU KNOW WHAT YOUR DOING, USE AT YOUR OWN RISK.
[G1 Android Development] KoolKidsKlub:
So do we just put on that module then hook up our phone to our ps3 then it comes up as service mode? Or do we need to put on the module then use the payload(that larry posted EDIT: Oh wait, he didn't post one xD) that puts the ps3 into service mode?

EDIT: And I'll use this once some one else has tested this :)
[G1 Android Development] RanT476:
Good to see your still here K4roshi. much appreciated man. I can see Psfreedom recovery with the psfreedom downgrade payload and the regular payloads that would be perfect, like if you changed a few things in side of Amon_Ra's recovery(his last one or the latest one he didnt make with the newer payloads) to add psfreedom downgrade and 1 of the good payloads
[G1 Android Development] KoolKidsKlub:
Has anyone tested the new module yet?
[G1 Android Development] bigd5783:
Big thanks to .kAroshi

If I wasnt at work right now I would test this out. My understanding is we need to boot into recovery and push this to /system/lib/modules where the old psfreedom.ko is and boot the phone. You should be able to use adb or recovery console if you put it on the sd card. If I was able to test this I would.

OH MAKE NANDROID BACKUP FIRST!!!

boot my phone into recovery

connect my phone to my pc

place my psfreedom.ko in the root of c:\

then in my command prompt

cd c:\
adb remount
adb push psfreedom.ko /system/lib/modules/psfreedom.ko
adb shell
reboot

or place the psfreedom.ko on the sd card then in recovery terminal

mount -a
mount -n -o remount,rw /system
cd /sdcard
cp psfreedom.ko /system/lib/modules/psfreedom.ko
reboot

good luck for anyone willing to try it right now. I wont have a chance to try it till tomorrow around noon or after. Post back if it works.
[G1 Android Development] amazinglarry311:
Tested it a number of ways, no dice so far.

.kAroshi,

which kernel was this built for?

is there any way you could compile this against amon_ra's current recovery kernel?
[G1 Android Development] dev78:
Not working for me neither.
[G1 Android Development] amazinglarry311:
yeah, no go with both v3 and v4rc1 the module loads at boot at startup (it seems..) but when you power on the ps3 as soon as the module starts communicating with the ps3 the device hard resets.

sigh...

I REALLY dont want to wait for my E3
[G1 Android Development] dev78:
is the e3 working with the the newest firmware version?
[G1 Android Development] RanT476:
this recovery rite here, i wanna kno how to make the psfreedom downgrade payload the default payload in this recovery. i still wanna be able to add my own payloads as bin files also thou so yea lets figure out how to do that, it will be the dream recovery for the G1 or just make the bin for the psfreedom downgrade payload. either way its all good : )
[G1 Android Development] bigd5783:
Here is the thing this downgrade is NOT a payload. This is its own entity. It actually uses the official master key to initiate the service mode. This does not use the "USB hub disconnect reconnect" trick overflowing the USB buffer like a serial rapist. The Playstation asks what do I have plugged into me and it says I'm a mother effing service dongle biatch go into service mode now. The Playstation then asks for the key to which the dongle offers up and the Playstation spreads eagle and opens its service mode doors to you.
[G1 Android Development] RanT476:
i said it that way so people wouldnt be confused. and yes i kno wut it is i do read. but yea im sure we can get it to work, we just gatta make it into a .ko file but the one that runs off the recovery as the default load. and then you should be able to load other payloads as for the /sdcard/payload file location is concerned
[G1 Android Development] Ohsaka:
best description ever!!!! Lol!!!
[G1 Android Development] tearsphere:
Glad to hear about downgrader finally.. I hope it will be just as easy as the the 3.41 Jailbreak.. I update ps3 to 3.5 right before I read about the jailbreak... :( .. Now, I am making sure to stay on 3.5 so I can downgrade as soon as it is easily available... Hopefully within the next few days..

Please keep up the good work Devs.....
[G1 Android Development] Ohsaka:
I think it goes in /lib/modules not /system/lib/modules?

Just ran find / -name "psfreedom.ko"...
[G1 Android Development] Ohsaka:
Im new to the PSFreedom scene, but have a 3.5 FW.

My suggested corrections:

cd c:\
adb remount
adb push psfreedom.ko /lib/modules/psfreedom.ko
adb shell
chmod 755 /lib/modules/psfreedom.ko
chown 1000.1000 /lib/modules/psfreedom.ko
reboot
[G1 Android Development] bigd5783:
corrected thank you. Like I said I am at work right now and dont have access to my pc with adb. I just downloaded the file and unzipped it and found in the update.zip it was located in /system/lib/modules so I assumed that would be where it would have been located. Honestly I havent been running this ever since larry released the new recovery and I bought a p3go
[G1 Android Development] .kAroshi:
system/lib/modules/psfreedom.ko is correct, that's where my startup script looks for the module, so put it there.

The module was compiled against cm-kernel 2.6.35, as usual should work with CM6. Not CM6.1.

I have nothing to do with the recovery, and never looked at it, so i cannot help in that regard.

Unfortunately i cannot test it until saturday, because i'm not at home right now, so some dmesg messages to debug the thing would be quite appreciated..
[G1 Android Development] HipCat:
Tried both of the suggested commands. No luck... How do I get the debug messages?

Also, I'm using RA-dream-v1.7.0+CM6.0
[G1 Android Development] KoolKidsKlub:
I would also like to help, how could I get you the debug messages? And thank you for helping the community.

EDIT: And also, all we need is to put the module in system/lib/modules/ , right? Or do we need to first flash one of the zips THEN put in the new module?

EDIT2: Also, I am running Amon-Ra's 1.7.0 recovery(the newest one) and CM6 Final, if it helps.

EDIT3: To get debug messages, would I just do: adb shell dmesg ls system/lib/modules/psfreedom.ko but to do that, don't I have to be in ADB, and if I'm using ADB, how am I gonna connect my phone to the PS3 if the phone's USB is already being used by ADB? And could I do that in terminal by doing: dmesg ls /system/lib/modulespsfreedom.ko ? Just tell me how to get the debug logs and I'll do it ;)
[G1 Android Development] Ohsaka:
My best guess would be to download PSFreedom for the HTC Dream.

http://psfreedom.com/wiki/HTC_Dream

Install "recovery-PSFreedom-Dream-v1.3.0.img"

Then boot into recovery, replace the psfreedom.ko file, reboot again, and then run PSFreedom according to instructions.
[G1 Android Development] amazinglarry311:
Don't waste your time, the module won't load in any of the available recovery images.
[G1 Android Development] HipCat:
Damn... so, there's no way to get it work, even with the packages in the OP?
[G1 Android Development] ukgtitch:
http://www.klutsh.com/downloads/

Keep an eye here, you'll soon see G1 pop up.
[G1 Android Development] Vorbeth:
You also need a new insmod command

insmod /system/lib/modules/psfreedom.ko jig=1
[G1 Android Development] mghtyred:
Yeesh. Oh well... Wish there was a more permanent solution.
[G1 Android Development] Stryder5:
Awesome, worked like a charm on CM6 stable.
[G1 Android Development] crypysmoker:
Been working all day on my Fender mytouch. Yes you have to fully power down and plug the phone in each time.

Not all games work I.E Bad company 2 from disc, MW 2 from disc will not start for me, but Orange box, Infamous work from internal and external HDD.

Split second wants me to have the split second disc in to play lol
[G1 Android Development] apples7:
really bad company 2 worked for me
[G1 Android Development] noboard:
Can also confirm my CM5 G1 is working fine. Just flashed the enabler and now have one submissive PS3 :) Not tried the disabler though.

Thanks to everyone involved, these last few days have been quite amazing to watch.
[G1 Android Development] semm:
Works perfect here on the HTC Magic 32B on CM6, never thought it would be so easy.

The next goal is a exploit where you don't have to use your phone (or anything else).

Maybe with the psfreedom 1.1 with access to L2 they can make some memory dumps this would help much.

Waiting with excitement
[G1 Android Development] introv:
Despite working for multiple PS3 reboots last night it's back to not working again this morning. That's without any phone reboots.

Have tried flashing 5.0.8 to see if that is any better but first time got a 'USB device not recognised' and second time nothing (EDIT: Just looked again and it has actually frozen up).

Using the exact same wire as it was working with last night, the wire that came with the PS3.

Just gets stranger and stranger. But at least I was fortunate enough to see it working for a little while!

EDIT AGAIN: Just used a really short thin wire from a portable hard drive and it's working again. I'm confused! Is it possible it only would only work when the charging light is on green, so either fully charged or close to?
[G1 Android Development] semm:
My own experience with the usb cable on the phone is that, with a long cable i can only charge my phone battery (not recognized on pc) and with the original or with a very short cable you can use it for data transfer.

So i think that on the PS3 its the same, short or original cable it can read data long cable it can't.
[G1 Android Development] .kAroshi:
Is anyone interested in having the new psgroove functions? (peek & poke)

I could compile the new version, but, as it is of no use for non developers i will repackage it only if there's demand for it.
[G1 Android Development] taz2781:
Do it, possibly here there no one that take advantage of it... but i personaly, make a copy of your post here in a ps3 forum and there possibly someone make use of it...

Note: I make reference to you of course
[G1 Android Development] metalfangs:
Sure I would definitely try it out.
[G1 Android Development] perroh:
But wait, since we're all using our android phones for this, our phone is considered the USB drive right? So do we find the backup manager pkg file and put it inside the "ENABLE" folder or something when we flash it??
[G1 Android Development] taz2781:
No you need another UsbDrive to put in the root the "backupmanager.pgk" and do the installation.

Look this video, is from the original device but the process of installation is the same.

http://www.youtube.com/watch?v=DxgmQAySmSI&feature=related
[G1 Android Development] G1ForFun:
Can anyone upload the dis-abler for the g1 please. The link in the op is not working....again. :(
[G1 Android Development] taz2781:
Use the mirrrors:

Enabler: http://db.tt/XEKCdBi

Disabler: http://db.tt/QkpccHB
[G1 Android Development] ironstorm:
Here's my observations...

I had CM6.0-final installed, I installed the Enable package, Recovery said it installed correctly, however when going into terminal lsmod gave no output and 015psfreedom in init.d was blank (0 bytes)...

Reinstalling CM-6.0RC3 followed by the Enable package, also reported to install correctly by Recovery. However upon reboot, lsmod showed "psfreedom" loaded, so I assume the rest of the package installed.

md5sum for enable package was the same as md5 sum on my Mac, which I downloaded and had extracted to look at it. On Android, unzip reports that "flags 1 and 8 aren't supported" when I try to extract it to a tmp folder on the G1.

Anyway, I'm not sure why it was not installing on 6.0-final, perhaps this will be helpful to others.

Still have to try it out now that I see the psfreedom module loaded.

-G
[G1 Android Development] G1ForFun:
Thanks! I didn't see them anywhere in the thread previously.

Buuuut I see them now in the op.
[G1 Android Development] Yargol:
Same here. Do you find a solution ?
[G1 Android Development] Aldasa:
Working Great on CM-6. Thanks for the port
[G1 Android Development] metalfangs:
Are you plugging in the phone while the PS3 is powered and then unplugging (or switching off) the ps3 and THEN turning on followed by quickly pressing eject ? From my experience that's the only way.
[G1 Android Development] Vorbeth:
Eventually, maybe :P
[G1 Android Development] KoolKidsKlub:
Is this the dmesg log that you were looking for? (see the attachment) I looked at the log but I didn't see anything interesting, but then again, idk what I'm suppose to look for in the first place xD

The way that I got it is that I went into terminal and typed: dmesg >> /sdcard/jb2.txt

Then I plugged in the USB to my PS3 and pressed the power button then quickly pressed the eject button, I had a disk in the drive so idk if that will mess anything in the log up, my phone's battery just died before I could try it again with no disk in the drive, so if you need a log with no disk in the drive then just ask me, and I'll try my best at it. And btw, is that even the right kind of log that you wanted?

And did I do everything right with the log?
[G1 Android Development] amazinglarry311:
Klutsh,

Will test now, old insmod is still in use.