推 JupIte:只有一個 字 強 112.104.165.49 03/19 20:39
推 hpo14:真的帥透了!! 123.204.46.87 03/19 22:28
推 is1128:看起來sony防在多也沒用了～sony哭哭 122.116.47.149 03/19 22:41
推 tsming:玩弄主機的男人XDDDD218.164.151.226 03/20 09:42
推 f1234518456:拆光摟~ 122.116.201.47 03/20 11:24
graf_chokolo確實很有天份……。
http://grafchokolo.com/ps3-development-page.html/comment-page-8/#comment-2558
graf_chokolo says:
March 16, 2011 at 2:36 pm
Guys, take a look at my ps3dm-utils.
Now you can enable service mode from Linux :-)
Look at ps3dm_usb_dongle_auth :-)
嘿！大家看一下我的ps3dm-utils ，現在可以從 Linux進service mode了。
注意ps3dm_usb_dongle_auth 的部份。
nEsCh says:
March 16, 2011 at 9:32 pm
enable… cool
開啟……，真酷。
Could you disable it to?
那有辦法關閉嗎？
graf_chokolo says:
March 17, 2011 at 7:09 am
Yes :-) You have to write 0xff to EPROM offset "Product Mode" (see
my HV page) by using ps3dm_um :-)
當然可以，只要利用ps3dm_um工具在 EPROM關於Product Mode的位址寫入0xff就
可以離開了。
graf_chokolo says:
March 17, 2011 at 7:59 am
1st step – Generating a challenge
----------------------------------
第一步－讓主機詢問
# ps3dm_usb_dongle_auth /dev/ps3dmproxy gen_challenge
2nd step – Generating a valid response for a challenge
-------------------------------------------------------
第二步－產生正確的回答
You need a dongle id.
Valid range for dongle IDs is 0x0000 ~ 0xffff. So choose one, doesn't
matter which one, but some are revoked !!!
你會需要一個電子狗的ID，在0x0000 ~ 0xffff 的範圍之內隨便選一個，數字不
重要，只是有些已經被列黑名單了（，所以不行的話就換一個）
# ps3dm_usb_dongle_auth /dev/ps3dmproxy gen_resp 0xBABE
here is a challenge like this 0xXX 0xXX ... of size 20 bytes
詢問的形式長得像0xXX 0xXX … 總長度有20個位元組
3rd step – Verifying response (Enabling "Product Mode")
--------------------------------------------------------
第三步－檢查回答（正確就可以啟動Product Mode）
# ps3dm_usb_dongle_auth /dev/ps3dmproxy verify_resp 0xBABE
here is the response from step 2 like this 0xXX 0xXX ... of size 20
bytes"
回答跟詢問格式一樣，長度也是20位元組
4th step – Checking if "Product Mode" is enabled
-------------------------------------------------
第四步－檢查Product Mode是否啟動
The returned value shouldn't be 0xff.
回傳的結果不能是0xff
# ps3dm_um /dev/ps3dmproxy read_eprom 0x48C07
5th step – Disabling "Product Mode"
------------------------------------
第五步－關閉Product Mode
# ps3dm_um /dev/ps3dmproxy write_eprom 0x48C07 0xff
graf_chokolo says:
March 18, 2011 at 12:42 pm
Guys, just to make sure that you understand. There is no need for
Linux and my ps3dm-utils to enable "Service Mode". You could also
create a GameOS app which does the same what i'm doing on PS3 Linux.
GameOS can do it also, communicate with USB Dongle Authenticator in
HV process 6 :-) So, you could create a GameOS app which enables
"Service Mode" without USB dongle.
為了怕大家誤會，我在這裡澄清一下。你們不一定需要靠我的ps3dm_utils 來
啟動Service Mode，你也可以寫一個程式從GameOS啟動，只是我是透過 Linux
來啟動。在GameOS裡面一樣有辦法達成，只要你能夠跟HV程序 6的電子狗認證
管理程式溝通就行，所以說從GameOS的應用程式來進入Service Mode是完全可
行的。
graf_chokolo says:
March 17, 2011 at 7:25 pm
And after you enabled "Service Mode" guys, you can use ps3dm_um
utility to install your new custom CORE_OS_PACKAGE.pkg without PUP
file direct from Linux :-)
另外就是當你進入Service Mode後，就可以使用ps3dm_um的工具，在 Linux下
將自製的CORE_OS_PACKAGE.pkg 檔案寫入主機的NOR Flash （，而不需要破解
SONY在更新管理員裡面新增的檔案完整性查驗機制）
Remote_Buffer says:
March 18, 2011 at 1:37 am
And this core_os can be from the original 3.60 unpacked firmware?
Thanks by reply friend, you are not alone in this fight against
$QNY, i will help you.
而CORE_OS可以從3.60 版的.PUP檔案得到。感謝回答啦！對抗SONY的路不會孤獨
的。
graf_chokolo says:
March 18, 2011 at 12:41 pm
It can be either original or modified. But i don't think you should
update to 3.60 :-)
對，CORE_OS 可以官方的也可以是自製的，就算如此我不覺得你有升級到3.60版
的需要。
Cookie says:
March 18, 2011 at 4:51 pm
Graf, would downgrading be as simple as entering service mode on your
linux, installing a lower version core_os via your updater, exiting
service mode, and linux and going into recovery mode and installing
the lower version pup? I assume the recovery mode step will be
necessary to flash the other required parts of the firmware.
Or can you emulate the full update process in linux?
Graf，請問一下降級的步驟是不是先進service mode，然後透過你的更新工具安
裝低版本的CORE_OS ，接著離開service mode，最後使用低版本的官方韌體從回
復模式重新安裝一次？我猜必須進回復模式的原因是還有其他的部份的 Flash需
要寫入，還是說你從 Linux也能進行完整的韌體更新？
graf_chokolo says:
March 18, 2011 at 8:26 pm
You have access to all VFLASH regions on Linux with my drivers, so
you could extract dev_flash tars and write the content to VFLASH.
我的工具讓你有讀寫整個VFLASH區域的權限，所以你也可以將dev_flash 相關的
檔案寫到相對應的地方。（譯注：在 Linux下進行完整的降級是可能的）
******
到現在也只有玩玩graf_chokolo的核心而已，這種高度危險性的操作還沒有時間
碰。
--
○ ____ _ _ _ _ ____ _ _ ____ _____ ____
。 ★(_ _)( \( )( \/ )( ___)( \( )(_ _)( _ )( _ \
ｏ _)(_ ) ( \ / )__) ) ( )( )(_)( ) / ● ‧
(____)(_)\_) \/ (____)(_)\_) (__) (_____)(_)\_) ★
ｏ
--
※ 發信站: 批踢踢實業坊(ptt.cc)
◆ From: 140.120.31.137