[Tutorial] PSN Bypass Techniques and Setting Up Development/Debugging Environment

Discussion in 'Tutorials & Guides' started by esc0rtd3w, Apr 1, 2017.

  1. 748
    1,677
    247
    esc0rtd3w

    esc0rtd3w Developer

    Joined:
    Mar 10, 2017
    Messages:
    748
    Likes Received:
    1,677
    Trophy Points:
    247
    Gender:
    Male
    Occupation:
    Hacker
    Location:
    OHIO, USA
    Home Page:


    **** I AM STILL ADDING CONTENT TO THIS PAGE! ****
    **** I HAVE BEEN BUSY WITH OTHER PROJECTS LATELY ****

    [​IMG]

    **** PLEASE BEAR WITH ME! I WILL BE MAKING THIS EASIER TO READ AND REDUCING THE CLUTTER OVER TIME ****


    Main Table of Contents
    Post #1: Getting Started / Bypassing PSN Exercise
    Post #2: Live Debugging Using Multiple Methods
    Post #3: PSN Bypass Methods and Examples
    Post #4: PSN App Package Information and Downloads
    Post #5: Open Source Projects / Development Resources
    Post #6: Credits For Everything Covered In This Tutorial



    Hello World,

    First and foremost, a huge THANK YOU to any and all of the people, teams, etc that have provided code, tools (legitimate and borderline illegal) and knowledge to myself and the rest of the world!

    This is basically my attempt to spew the things that I know about reverse-engineering the Playstation 3 at you!!!



    History and Background

    I suck at PowerPC, so let's get that out of the way! I have a background in mostly x86 platforms, as far as reverse-engineering. I mainly deal with CD checks, serial/registration bypasses, crippleware reversing, nag removal, etc. I have some exploitation experience and I mainly reverse on Windows, sometimes on Linux, and rarely on OSX. I use IDA for all platforms and use other debuggers such as OllyDBG, x64dbg, and W32Dasm on Windows. I am interested in reversing all video game consoles and usually will want to "hack" a game rather than play it. In 2016 I released the iLLiCiT SPRX Mod Menu for GTA5 on GitHub and then took about a year off from the PS3. I never updated it to support the newest 1.27 update, so it has been retired! OK, with that out of the way, you know where I am coming from!

    I have so far successfully patched 70 different PSN apps with almost 100 different patches in total for all the regions. I have also patched several apps to be ad-free! There are several different protections in place, including EBOOT, PRX, or other ELF modifications, Javascripting (usually SDAT encrypted), and simple text patching TRUE/FALSE flags with Hex editor. I will attempt to provide screenshots, TOC (Table of Contents) addresses, pitfalls, and other information that I have discovered, learned, or found along the way.


    I will try and set this up as neatly as possible. I will provide links and credits to everything that is mentioned throughout this tutorial. It will be divided into multiple sections using tabs and grouping will be split across multiple posts for easier navigation.

    If you are completely new to Hex Editing, Debugging, PS3 CFW or the like, please follow this tutorial in relatively close order, and I will try and do my best to guide you through the tentacles!





    • [​IMG]

      Before we begin, there are some things that you need and some things that you should have. I have listed everything below that you need and should have to get started, in the first section.

      Required

      - DEX Firmware (I am using Rebug 4.81.2 for this tutorial)

      - Debugger Flash Files <-- These are from 4.65 and should only be used while debugging.
      *UPDATE* These are not needed. Tested on Rebug 4.81.2 DEX and SDK 4.75

      - PS3 SDK Installer <-- This One Is On You To Find ;)

      - ProDG Debugger <-- This is bundled with the SDK
      * v470 is available (thanks @bguerville) but I have only tried the v420.1.15.3 version

      - Target Manager <-- This is bundled with the SDK
      * v470 is available (thanks @bguerville) but I have only tried the v420.1.14.7 version


      Recommended

      - My Compiled ZIP of All Tools In This Tutorial

      - IDA Interactive Disassembler & Debugger
      * IDA Addons / IDA Addons (without ppcjt plugin)

      - Microsoft Visual Studio
      * 2008 - 2017 Should Work, although either 2010, 2013, or 2015 are Recommended

      - PSL1GHT Open-Source PS3 SDK
      * This is an alternative if you do not have the official Sony SDK. I have not used this yet!

      - PS3 Toolchain / PS3 Libraries
      * Use these in conjunction with PSL1GHT.


      To download any of the mentioned files separately, please see the last post in the Credits Section.


      Important Note:
      If you skipped the above section, please press BACK on your BROWSER now!! :indecisiveness:

      Now that we have the things we need, let's begin with setting it all up.


      Please Continue By Using The Preparing Your System Tab!



    • [​IMG]

      Either download all tools manually or download my compiled tool package (IDA is NOT included)


      Install Applications To PC and PS3


      1) Install Visual Studio (I have tested 2010 Pro and 2015 Enterprise)
      * The VSI plugin can be installed, but not used for Express versions (thanks @bguerville)

      2) Install PS3 SDK (I used the 3.60 installer version) <-- Sorry Sony ;)

      3) Install "VSI2010forPS3v2.0.1.5.exe" or equivalent (This will show PS3 PPU/SPU Projects for VS)
      * You can also use the PSL1GHT version of VSI plugin (thanks @bguerville)

      4) Install AldoTools (This will give you a right-click context menu for EBOOT/PKG functionality)
      * If you receive a DLL error, try this link for MSVBVM50.DLL

      5) Install IDA (last free version was 5, which I have not tested, you probably need v6.1 or v6.5)
      * 64-bit does not work for most plugins. 32-bit will load 64-bit ELF files just fine

      6) Install ProDG Debugger and Target Manager, if not already done.

      7) Install CCAPI to PC (CCAPI-setupV2.70.exe) and to PS3 (XX0001-ENSTONEXX_00-00000000000CCAPI_v2.70_Rev6.pkg)
      * Some apps such as NetCheat do not currently support v2.70 on PC.
      * You can install CCAPI-setupV2.60.exe on PC and v2.70 PKG on PS3 and those apps should work fine.


      [​IMG]

      8) Run the CCAPI installer/uninstaller app on PS3 from XMB icon and reboot console.

      [​IMG]


      Extracting Files To PC and PS3

      1) Extract the contents of the prepared ZIP file with all used tools in this tutorial.

      2) Extract the IDA addons to the root of your IDA folder.
      * If you have issues with the PPC Jump Table (ppcjt) plugin, use this package instead

      3) Extract the Debugger Flash Files to a directory on your PC (ProDG Debugger/IDA will NOT work without this)

      a) Open Rebug Toolbox (symlinked as dev_rebug) or another app that gives access to dev_flash

      b) Backup the contents of flash (use Filezilla) for safe keeping ;)

      [​IMG]

      c) Overwrite the contents of /dev_rebug/ from the "debugger_files.zip" archive <-- files also located in ProDG folder
      [​IMG]

      d) Perform a Full Reboot of PS3 console


      Please Continue By Using The Connecting To The PS3 Tab!




    • [​IMG]

      Network and Debug Settings on PS3

      We next need to check a few Debug and Network Settings on the PS3

      1) Navigate To Settings Column In XMB (2nd From Left Icon) and select it
      2) Scroll to the bottom (Rebug, maybe others) and select * Debug Settings
      3) NP Environment should be set to np
      4) Release Check Mode should be set to Development Mode
      5) Boot Mode should be set to System Software Mode
      6) Network Settings For Debug can be set to Single or Dual (see below)

      Single Settings: This is currently my preferred setup. You can use your host PC WiFi bridged to LAN to allow internet access while debugging. This also allows using tools such as WireShark to MITM (Man-In-The_Middle) the PS3 connection while running and use the PC HOSTS file to block and redirect requests.

      Dual Settings: You can set the PS3 to connect to both the WiFi and the LAN if you would like. Although I haven't tested this method in a while, as I use the Single Bridged Setup now, it works well from what I remember.

      If any network or debug settings were changed, reboot the console before continuing.

      Connecting directly to PS3 with LAN (ethernet cable) is Recommended! :encouragement:
      WiFi can be used, but unless you have a kick-ass setup, the experience will suck! :blackeye:


      Getting Your PS3 IP Address

      You can get your IP address in a few ways.

      1) Navigate on XMB to System Settings and scroll down to System Information and select option.

      2) Use Rebug Toolbox and select Toggle Host Information on XMB [DEX] option and exit. See image below.

      3) Use your router and display connected DHCP Clients.

      4) Use your OS Terminal

      [​IMG]


      Setting Up Target Manager

      We will be setting up Target Manager. You will need this for most of your debugging tasks.
      Replace the IP with your PS3 IP address.

      The first thing to do is click Add Target from the toolbar icon.

      [​IMG]

      This will bring up some configuration options. Enter any name that you want for your console and select "Debugging station (DECHA00J / DECHA00A / DECHJ00J / DECHJ00A" option for Target Type.

      [​IMG]

      Now we need to enter our IP Address and Port. You can leave the default port set to 1000 unless you have a reason to use a different one.

      [​IMG]

      The last page will just show you a summary. Double check these settings and press Finish.

      [​IMG]

      Your PS3 console should now be displayed under Target. We can now connect to it and continue.

      [​IMG]

      There are multiple ways to connect to your console. The easiest way is to just double-click and it should change from Available to Connected. Other ways to connect are by right-clicking and selecting Connect from the menu or pressing F7 on the keyboard.

      [​IMG]

      This is what your screen should look like when a successful connection has been made.

      [​IMG]

      You should now be able to navigate to My Computer on your machine and find a now populated drive, usually mapped as drive P:\

      [​IMG]

      This is the default view when using Windows Explorer to navigate the PS3 console over Target Manager.

      [​IMG]


      Setting Up Filezilla

      You can connect with Filezilla. See below for details.
      Replace the IP with your PS3 IP address

      [​IMG]


      To make sure we are all on the same page before moving forward, here are my settings from Rebug Toolbox:

      PS3 System Firmware: 4.81 DEX
      LV2 Kernel: DEX
      Target Type: DEX

      From 2nd Column:

      System Mode: [REBUG]
      XMB Operation Mode: [Debug]
      Debug Menu Type: [DEX]
      Toggle XMB CFW Settings: [Enabled]
      Toggle Host Information on XMB: [Enabled]
      Toggle COBRA Mode: [Enabled]
      Toggle PS2 Emulator: [COBRA] <-- For completeness :encouragement:
      Toggle webMAN: [Enabled]

      TIP: To switch from CEX (Retail) to DEX (Debug) using Rebug Toolbox from the 4th column select Rewrite Target ID in Flash (must dump EID Root Key from last column first) and then select Swap LV2 Kernel option. When switching from CEX to DEX you will have to swap LV2 kernel separately (not needed if you want to use a CEX kernel), but when switching from DEX to CEX, you only have to choose the rewrite option and it will automatically swap the kernel.



      Once we have everything installed, extracted, and the network is setup, we are ready to begin!


      Please Continue By Using The PSN App Packages Tab!



    • [​IMG]

      Downloading Packages


      There are many ways to acquire a PSN package. You can use several apps to enter the games ID (ex. NPUP00030) and check for latest package, you can use several static URLs that Sony has in place, you can do advanced google searches, or you can use several online websites that re-host them. I have created some queries (google dorks) and files that you can use to help get started with finding these packages and where to start looking, if you need them below.

      My NoPSN NGU Thread:
      http://www.nextgenupdate.com/forums...eaming-multimedia-app-package-collection.html

      Collection of Scraped TV XML files from Sony servers
      https://github.com/esc0rtd3w/nopsn/tree/master/ps3/apps/xml/tv

      Collection of Google Dorks to help locate PSN packages
      https://github.com/esc0rtd3w/exploit-hub/blob/master/web/dorks/google/gaming/ps3.txt

      Collection of PSN Store App Listings For PS3
      https://github.com/esc0rtd3w/exploit-hub/blob/master/web/links/ps3.txt



      Installing Packages

      So now that we have our packages, we need to get them on the PS3! There are of course, several ways to do this. I will list a few below.

      1) Use Target Manager to connect and access PS3 with Windows drive letter (usually P:\) <-- Recommended :encouragement:

      2) FTP client such as Filezilla to connect and transfer files <-- Also Recommended :encouragement:

      3) USB Flash drive to copy from PC then insert into PS3 :untroubled:

      4) Use one of the package downloading plugins on the PS3 itself to download to USB or HDD


      The packages need to be copied to either dev_hdd0/packages/, dev_usbXX/, or dev_usbXX/packages/ for the PS3 to recognize them with the Package Manager. Once you have them in one of those places, go to your Package Manager and install one or as many as you want. They will be copied to their respective game ID directory under "dev_hdd0/game/". For example, if you are installing the US version of Netflix, the installed directory would be "dev_hdd0/game/NPUP00030/" and the root of that folder is "dev_hdd0/game/NPUP00030/USRDIR/". This is where you will find the EBOOT.BIN and all other app related files. The directory above /USRDIR/ contains PARAM.SFO, which contains app name, version info, lowest fw, etc.



      Extracting Packages

      Now that we can put packages on the PS3, lets extract the contents of a package and go through all the steps to do a complete NoPSN bypass and package rebuild. There are a lot of apps to choose from, our target will be the US version of Youtube.

      One of the main reasons that I chose Youtube v3.01 as our target is because the app fully loads in the background and the PSN XMB splash just overlays on top. If you press CIRCLE to leave PSN screen, you can navigate the app for about 2 seconds before the splash overlays again. This is to our advantage because we know that once we get rid of the splash then we are pretty much done. Some apps pause execution of the app while the PSN splash is being overlayed, therefore making it harder in most cases to find it.

      The second reason is because it is unique in the fact that it does not share one of the standard Trilithium or WebKit instruction sets, as most apps that use this platform share the same function to find using the easily found "EnablePSN" flag. Quite a few of these apps also share the exact same offset to patch for NoPSN checks! Youtube was one of the more difficult apps that I have done, and by difficult I mean it took more time. But for this tutorial I will make this app seem relatively easy to bypass the PSN check......hopefully :victorious:

      We will be using AldosTools for this part of the tutorial because we get the right-click context menu once installed, and this app works fine with the default re-signing settings.

      To start, we are just going to extract the package to a directory as seen below.

      [​IMG]

      [​IMG]


      Once the dialog box disappears, the app should be fully extracted and we are ready for the next step.


      Please Continue By Using The ELF File Decryption Tab!



    • [​IMG]

      Decrypting ELF Files

      Once the package is extracted, we need to navigate to [EXTRACTED_FOLDER]/NPUP10028/USRDIR/ to find EBOOT.BIN

      [​IMG]

      [​IMG]

      [​IMG]

      We need to decrypt the EBOOT.BIN to get the original ELF file. There are several ways to do this, but for this tutorial we will be again using AldosTools for this part. The EBOOT will not always be the target. Some apps, such as NetFlix use an external SPRX or SELF file to handle PSN requests.

      Again, we just right-click our previously extracted EBOOT.BIN file and click Extract ELF from menu.

      [​IMG]

      [​IMG]

      This is what your directory should look like at this point. See below image,

      [​IMG]


      So now we have our package decrypted, we have navigated to the /USRDIR/ where our app files are, and we have decrypted our original ELF file from EBOOT.BIN. You are now ready to load IDA and continue.


      Please Continue By Using The Static Debugging Using IDA Tab!



    • [​IMG]

      Opening and Loading ELF Files in IDA

      We now need to load the EBOOT.ELF into IDA. Do this by simply dragging the ELF into the IDA window.

      [​IMG]


      Next, make sure that the following options are selected
      Load as "Playstation 3 ELF" "Processor Type: PPC"

      [​IMG]

      [​IMG]

      Once IDA has finished analyzing the file, continue to the next step.


      Using ps3ida IDC Script

      Now we want to load the IDC script "analyze_self.idc" to parse out the functions, data areas, etc.

      [​IMG]

      [​IMG]

      Click YES here to re-analyze the file with IDC script.

      [​IMG]

      [​IMG]

      Once the script has finished, you will be presented with a dialog box that contains the Table Of Contents (TOC) for the ELF. Click OK on this box to continue.

      [​IMG]

      Copy the TOC to the clipboard by highlighting the text from the Output Window.

      [​IMG]

      Click on General from the top toolbar

      [​IMG]

      Click on Analysis tab and then click Processor specific analysis options button

      [​IMG]

      Paste in the TOC in HEX format that you copied previously to the clipboard and click OK.

      [​IMG]

      Now click Reanalyze program

      [​IMG]

      Finally, click the OK button

      [​IMG]


      Wait for IDA to re-analyze the file and then continue to the next step.


      Using Strings To Find Functions

      First, click on View and then Open Subviews and Strings (CTRL+F12)

      [​IMG]

      Once in Strings window, you can search by clicking Search and Search... (ALT+T)

      [​IMG]

      I usually start by searching for the letters "psn" for obvious reasons ;)

      [​IMG]

      You will find that searching for "psn" will return no valid results for this app.
      Another search term I use is "age" because this code usually resides closely to the PSN splash code.

      [​IMG]

      Searching for "age" hits a few matches. The first one is here at offset 0x8FE0

      [​IMG]

      Another search term I use is "sign" for hitting matches of "signed", "signed-in", "signed-out" or other similar matches.

      [​IMG]

      The first match for "sign" lands us here at offset 0x8F30.
      Upon further inspection, you will find that this is not our PSN suspect.

      [​IMG]

      The second match looks more closely to a PSN splash.

      [​IMG]

      The second match lands us here at offset 0x104962C.
      OK, so lets follow the sub65C18 function by double-clicking on it.

      [​IMG]

      We are taken here to an OFFLINE MESSAGE
      I was around this area for quite a while before finding the correct function. I usually look for sub-routines that are only called from one other place, although this is not always the case, as with apps like Netflix.

      [​IMG]

      If we scroll down a bit from the last "Playstation Not Connected" message, we will find this sub-routine that looks very suspicious.

      [​IMG]


      Finding XREFS and Jumps

      The next step is finding out where this function (sub-routine) is being called from.
      You can do this by highlighting (clicking) the sub_ function and pressing X.
      You can also right-click and select Jump to xref to operand.. option.

      [​IMG]

      This will display all references (calls) to this function. Lucky for us, there is only one :)
      Double-click on it to be taken to instruction that calls it to continue.

      [​IMG]

      Here we land at offset 0x55F30 which contains a "bl sub_65E0C" instruction.
      This instruction basically just means "Branch to this sub-routine at this Linked address", which is the PSN check.

      [​IMG]


      TIP: Renaming Function Labels
      You can rename almost everything in IDA to make it easier to navigate around. I will show an example below.

      [​IMG]

      [​IMG]


      Now that we have a function to nop and test we need the Hex Offset. To find the offset, simply look here at the bottom left of the IDA status bar. There are other things you can also do here using IDA itself to make patches and exporting files with modifications, etc but we will not be covering that here.

      [​IMG]


      Once we have an offset to test, we can open the file with a hex editor and test it.
      Some apps will require multiple patches, so you may think a patched area is not working when in fact it is working, there is just another address that also needs patched.

      This is the one area that you will be revisiting over and over and over and over again!!! o_O
      Fortunately, I have been to the future and for our Youtube target, this is the only patch that we need :saturn:


      Please Continue By Using The ELF File Editing Tab!



    • [​IMG]

      HxD Hex Editing The EBOOT.ELF File

      Use HxD or another hex editor to open the EBOOT.ELF.
      Navigate to our target address 0x55F30 by using GOTO Address command (CTRL+G in HxD)

      [​IMG]

      We land here at offset 0x55F30

      [​IMG]

      Change the 4 bytes from 4B FF FE DD to 60 00 00 00

      [​IMG]

      Now the EBOOT.ELF is patched and needs re-signed back to a BIN file.


      Please Continue By Using The ELF File Encryption Tab!



    • [​IMG]

      Re-signing ELF Files

      Resigning the EBOOT or other ELF files does not work for some apps without live debugging, which is covered in another section, mainly Hulu and Amazon v4.x.x. Hulu can be resigned with TrueAncestor (maybe others) using 4.xx ALT and No Compression. I have not found a way to resign the Amazon v4.x.x ELF files without immediate XMB return. Amazon v3.x.x ELF files can be resigned with any resigning tool and boot properly. Lastly, some apps do not need the EBOOT or any other ELF file modified to bypass PSN checks. This is also covered in another section.

      We will again be using our trusted friend AldosTools for re-signing this ELF file.

      [​IMG]

      [​IMG]


      Please Continue By Using The Transfer Files Tab!




    • [​IMG]

      Copy New EBOOT Back To PS3

      Transfer our now patched and re-signed EBOOT.BIN back to our PS3

      [​IMG]

      This example below is using Windows Explorer while connected to PS3 with Target Manager

      [​IMG]


      You Can Now Finish By Using The Repackaging Apps Tab!



    • [​IMG]

      Creating a New NoPSN Package

      Navigate to the root of your extracted original package from earlier (see below image)

      [​IMG]

      [​IMG]

      [​IMG]


      OK, you now have successfully patched the EBOOT.BIN using static debugging and have created a NoPSN package to install on the PS3. Congratulations!

      Now, to do more advanced debugging and some info and techniques for other apps, check below in the 2nd post.



    [​IMG]
     
    Last edited: Aug 10, 2017
    Nomeji, Rautz, kozarovv and 13 others like this.
  2. 748
    1,677
    247
    esc0rtd3w

    esc0rtd3w Developer

    Joined:
    Mar 10, 2017
    Messages:
    748
    Likes Received:
    1,677
    Trophy Points:
    247
    Gender:
    Male
    Occupation:
    Hacker
    Location:
    OHIO, USA
    Home Page:
    Slightly More Advanced Debugging :rolleyes new:


    [​IMG]


    Main Table of Contents
    Post #1: Getting Started / Bypassing PSN Exercise
    Post #2: Live Debugging Using Multiple Methods
    Post #3: PSN Bypass Methods and Examples
    Post #4: PSN App Package Information and Downloads
    Post #5: Open Source Projects / Development Resources
    Post #6: Credits For Everything Covered In This Tutorial



    In this section we will be using several tools to manipulate a running EBOOT on the PS3.

    To perform the following exercises you will have to resign the target EBOOT as Debug and make sure your Target Manager is connected to the console. Please check below to get started! :glee:




    • [​IMG]


      Re-signing ELF As Debug

      You can use several tools, I will show two examples below. The first one is AldosTools.

      [​IMG]


      The next option is using TrueAncestor SELF Resigner to sign as Debug (DEX)

      We will be signing the YouTube app as NPDRM, if this was a Disc game you would sign it as Non-NPDRM.

      [​IMG]



    • [​IMG]



      Here is a fun example of our earlier YouTube target.

      Target Manager Views

      This is the Kernel Explorer view (located on left pane tree) for our Youtube target again, this time the EBOOT running has been re-signed to Debug and the status of the app is idle with the "You are signed out of Playstation Network. To use YouTube, you need to sign in to Playstation Network." message displayed.

      [​IMG]



      Attaching Debugger To Running ELF

      Make sure you are connected with Target Manager and then open ProDG Debugger.

      [​IMG]

      Once you click refresh, you should be able to see the running EBOOT now.

      [​IMG]

      You will be prompted to provide debug symbols if they are available. Since we are not the original developers and we are essentially just reverse-engineering this app, we do not have them and must continue without them.

      [​IMG]

      [​IMG]


      Thread Viewing and Control

      [​IMG]

      [​IMG]



      Viewing and Reading From Memory

      [​IMG]

      [​IMG]


      Writing To Memory

      [​IMG]


      [​IMG]




    • [​IMG]

      Here is another fun example using our earlier YouTube target.

      We use Console Manager to select the running EBOOT, change size to dword (32b) (this is 4 bytes) and then poke the value 60000000 to VA 65F30 (Virtual Address is Offset+10000h) which effectively sets our PSN splash instruction to NOP.

      Once this memory is set and you press CIRCLE to go back, VOILA, the splash does not return! :emmersed:


      This is of course only temporary, as when the app is exited and launched again, that address will again be the original bl branch link instruction and no longer our nop instruction. :disgust:

      [​IMG]




    • [​IMG]

      [ Setting Up and Using NetCheat Placeholder ]

      [​IMG]

      [​IMG]

      [​IMG]

      [​IMG]





    • [​IMG]

      [ Setting Up and Using decid3bug Debugger Placeholder ]

      [​IMG]

      [​IMG]

      [​IMG]

      [​IMG]


      [ Attaching IDA To The Running EBOOT Placeholder ]

      [​IMG]

      [​IMG]

      [​IMG]

      You will receive this error (below) if your EBOOT is not encrypted as DEBUG or it is not running on the PS3.

      [​IMG]

      If everything is going smooth, you will receive this dialog box to connect to your running EBOOT

      [​IMG]



      [ Navigating The Running EBOOT Placeholder ]

      [​IMG]

      [​IMG]



      [ Registers and the Stack Placeholder ]



      [ Using Breakpoints and Stepping Execution Placeholder ]

      [​IMG]





    • [​IMG]


      You can use webMAN's web interface to read and write memory using only a web browser. Simply navigate to the IP address of your PS3 using your PC web browser such as Firefox or Chrome.....or that other one.....eh.....whatever! :eek new:

      Using our dear old friend, YouTube v3.01, we will do a simple exercise of reading and writing to memory, then reading back our modified value using the webMAN interface. Make sure the Debug EBOOT is running on your console!

      We will start by clicking PS3MAPI from the top toolbar on the main landing page.

      [​IMG]


      Read Memory Example:
      URL: http://192.168.1.250/getmem.ps3mapi?proc=16974336&addr=65F30&len=4
      * Your IP address and process will be different than the above example
      [​IMG]

      [​IMG]


      Write Memory Example:
      URL: http://192.168.1.250/setmem.ps3mapi?proc=16974336&addr=65F30&val=60000000
      * Your IP address and process will be different than the above example
      [​IMG]

      [​IMG]


      Reading Modified Value Back From Address:

      [​IMG]



      Again, you have bypassed the PSN check on YouTube in yet another fun way! :redface new:





    [​IMG]
     
    Last edited: Apr 8, 2017
    Nomeji, kozarovv, ed89 and 8 others like this.
  3. 748
    1,677
    247
    esc0rtd3w

    esc0rtd3w Developer

    Joined:
    Mar 10, 2017
    Messages:
    748
    Likes Received:
    1,677
    Trophy Points:
    247
    Gender:
    Male
    Occupation:
    Hacker
    Location:
    OHIO, USA
    Home Page:


    [​IMG]



    Main Table of Contents
    Post #1: Getting Started / Bypassing PSN Exercise
    Post #2: Live Debugging Using Multiple Methods
    Post #3: PSN Bypass Methods and Examples
    Post #4: PSN App Package Information and Downloads
    Post #5: Open Source Projects / Development Resources
    Post #6: Credits For Everything Covered In This Tutorial



    All other known PSN Bypass Methods, including EBOOT, SPRX, SELF, SDAT, JS, INI, and other file modifications will be placed here



    These methods are in order from easiest to most difficult, on average.


    • [ INI Config Edit Placeholder ]

    • [ CONF File Edit Placeholder ]

    • [ EBOOT Text Edit Placeholder ]

    • [ SDAT Javascript Edit Placeholder ]

    • [ EBOOT/SELF/SPRX Debug Placeholder ]

    • [ BONUS: Removing Ads From Apps Placeholder ]
     
    Last edited: Apr 8, 2017
    kozarovv, STLcardsWS and bitsbubba like this.
  4. 748
    1,677
    247
    esc0rtd3w

    esc0rtd3w Developer

    Joined:
    Mar 10, 2017
    Messages:
    748
    Likes Received:
    1,677
    Trophy Points:
    247
    Gender:
    Male
    Occupation:
    Hacker
    Location:
    OHIO, USA
    Home Page:


    [​IMG]


    Main Table of Contents
    Post #1: Getting Started / Bypassing PSN Exercise
    Post #2: Live Debugging Using Multiple Methods
    Post #3: PSN Bypass Methods and Examples
    Post #4: PSN App Package Information and Downloads
    Post #5: Open Source Projects / Development Resources
    Post #6: Credits For Everything Covered In This Tutorial


    ** TEXT LINKS ARE DOWN TEMPORARILY **

    Please use this link for now

    All PSN App related info, including TOC, offsets to patch, title IDs, package links, NoPSN status, etc will be placed here. I have patched over 70 apps already, so I will be adding content to this section for a while!


    [​IMG]

    Original Package: This is the original package untouched from Sony's servers. The file has been renamed for easier reading.

    NoPSN Package: These have all the required patches to bypass the PSN XMB splash and are ready to install to PS3.

    NoAds Package: These apps have ads removed. This includes removing or bypassing preroll, midroll, postroll, timeline insert, and indicator markers when able to do so.

    NoPSN + NoAds Package: Ahhh yes, the :angel: holy grail of PS3 app package types :devilish:, the ones everybody wants! These, of course have PSN signin bypassed and have no ads. Some apps such as Popcornflix, I have patched even further to disable logging and other CPU intensive un-needed things.

    Debug Package: These are original packages with resigned EBOOT.BIN and other files as needed for use with Target Manager.

    SPRX Enabled Package: These are the original packages, pre-patched to look for "dev_hdd0/tmp/nopsn.sprx" upon launch. The possibilities are endless! :eagerness: Currently, all of the SPRX Enabled packages are signed as DEX, maybe in the future I will also make CEX version packages!


    Some apps will appear to be a duplicate of another, but pay attention to the Content ID for each app. If there are multiple regions available for an app and only one region is PSN bypassed, then there will be an entry under the PSN Check Active tab and an entry under the PSN Check Bypassed tab.


    [​IMG]

    • These apps have not had their PSN check removed yet, at least by me, or that I could find. I will provide all the info that I can from my own research for each app. :distracted:

      If you want some good practice targets after completing the tutorial, please consider these first to give back to the community. :encouragement:


      adhoc Party For PSP
      Title ID: NPJA00040
      Version: 2.18
      Packages: Original Packages / Repacked Package Set / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:

      Comments: There are multiple links for the original packages that normally are installed in order. I have repackaged them all into one as a new package!

      CinemaNow
      Title ID: NPUP00060
      Version: 1.03
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:

      Comments: No PSN Bypass Available Yet! Replaces Best Buy Cinema App.

      Uses SHA-256 Hashes In Manifest and List Files To Keep Track of Modifications To Files.

      Cloud TV Test
      Title ID: NPUO00034
      Version: 1.02
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:

      Comments: No PSN Bypass Available Yet!

      This is a JSMAF "Hello World" TV App For Your Enjoyment, Similar To Trilithium Test App!

      HBO Go
      Title ID: NPUP10033
      Version: 1.05
      Packages: Original / CONF Mod Test #1 / CONF Mod Test #2 / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:

      Comments: There is no PSN Bypass available yet! Original PKG causes black screen freeze for some reason.

      I have posted 2 test packages that may or may not bypass PSN login. Please report back on FW version and status.

      Hulu
      Title ID: NPJB90455
      Version: 1.06
      Packages: Original / Debug Package / SPRX Enabled

      Target: EBOOT.BIN --> EBOOT.ELF
      Content ID: JA0002-NPJB90455_00-2011100401639300
      KLicensee: 8450021620413F2EBC5234937B5A0701
      OPD: [UNKNOWN]
      TOC: [UNKNOWN]
      Export Table: [UNKNOWN]
      Import Table: [UNKNOWN]

      Comments: Resigning Settings --> TrueAncestor [ALT 4.XX] [No Compression]


      Title ID: NPUP00028
      Version: 1.01
      Packages: Original / Debug Package

      Target(s): EBOOT.BIN, multiple SDAT files
      Content ID: UT0008-NPUP00028_00-2010061001639300
      KLicensee: [UNKNOWN]
      OPD: [UNKNOWN]
      TOC: [UNKNOWN]
      Export Table: [UNKNOWN]
      Import Table: [UNKNOWN]

      Comments: This is a v2.03 Preview Edition and the EBOOT is currently not decrypted yet.

      Love Film
      Title ID: NPEB00344
      Version: 1.03
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:

      Comments: There is no PSN Bypass available yet! New PKG Superseded by Amazon Underground UK App.

      MUBI
      Title ID: NPEB02149
      Version: 1.01
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000


      Title ID: NPEA00258
      Version: 1.06
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:

      Comments: There is no PSN Bypass available yet!

      US CID: UP4164-NPUP31347_00-MUBISCEASUBMTI00

      NBA Game Time
      Title ID: NPUP31373
      Version: 1.05
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:

      Comments: There is no PSN Bypass available yet!

      NowTV
      Title ID: NPHA80082
      Version: 1.02
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:

      Comments: There is no PSN Bypass available yet!

      PixelJunk 4 a.m. Live Viewer
      Title ID: NPUA80538
      Version: 1.01
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000


      Title ID: NPEA00376
      Version: 1.01
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000


      Title ID: NPJB00191
      Version: 1.03
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:

      Comments: There is no PSN Bypass available yet!

      Player
      Title ID: NPEB01430
      Version: 1.01
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:

      Comments: There is no PSN Bypass available yet!
      There is no EBOOT present in the package?!?!?

      PlaystationVUE
      Title ID: NPUO00038
      Version: 1.20
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:

      Comments: There is no PSN Bypass available yet!

      The old "jsmaf.location.requiresPsn = false;" SDAT trick no longer works on newer versions

      PlayTV
      Title ID: BCES00096
      Version: 2.04
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:

      Comments: There is no PSN Bypass available yet! I also get a black screen on original package.

      Sky Online
      Title ID: NPEB02339
      Version: 1.01
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:

      Comments: There is no PSN Bypass available yet!

      Stan
      Title ID: NPEB02362
      Version: 1.03
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:

      Comments: There is no PSN Bypass available yet!

      The common "EnablePSN" offset located at 0x093FAC causes a black screen.

      TuneIn Radio
      Title ID: NPEB01831
      Version: 1.01
      Packages: Original / Debug Package

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf
      Content ID: EP4423-NPEB01831_00-TUNEINPKG0000000
      KLicensee: 72F990788F9CFF745725F08E4C128387
      OPD: 0x753500
      TOC: 0x76E790
      Export Table: [UNKNOWN]
      Import Table: 0x64D7C8

      Comments:

      TV From Sky
      Title ID: NPEB02153
      Version: 1.01
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:

      Comments: There is no PSN Bypass available yet!

      VidZone
      Title ID: NPUP10041
      Version: 1.03
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:


      Title ID: NPEA00135
      Version: 2.09
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:

      Comments: There is no PSN Bypass available yet!

    • These apps have the PSN check removed or bypassed in some way. Each app will have tons of info unique to itself, as well as several download links available below. The game ID will be a link to the XML hosted on Sony's servers for updates. You can use some of the information to help reverse some apps that you may be struggling with and want to see where the PSN check happens.

      Some package types are not available for certain apps for different reasons. I will try and keep all of these updated as new versions are released as well.


      ABC iView
      Status: PSN Bypass [OK] / Available [YES] / Service [ERROR] / Account [NO] / Ads [?]

      Title ID: NPEB02205
      Version: 1.01
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4443-NPEB02205_00-ABC0IVIEW0000000
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf
      OPD: 0x213330
      TOC: 0x227DB0
      Export Table: 0x1E6510
      Import Table: 0x1E656C

      Offset: 0x1D8EDA
      Comments: The app seems to load normally, but when I try and play a video, it doesn't play. It may be going out of service.

      All4 (Formerly 4oD)
      Status: PSN Bypass [OK] / Available [YES] / Service [OK] / Account [REQUIRED] / Ads [?]

      Title ID: NPEB01271
      Version: 1.02
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4449-NPEB01271_00-CHANNEL404OD0100
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf
      OPD: 0x213360
      TOC: 0x227E38
      Export Table: 0x1E89E0
      Import Table: 0x1E8A3C

      Offset: 0x1DA922
      Comments: Geographically Region Locked

      Amazon Instant Video <-- Big Thanks To @catalinnc & @Rajesh Dutta
      Status: PSN Bypass [OK] / Available [YES] / Service [OK] / Account [REQUIRED] / Ads [?]

      Title ID: NPUP10021
      Version: 4.01
      Packages: Original / NoPSN Package / Debug Package
      Content ID: UP2064-NPUP10021_00-AMAZONIVIDEO0100


      Title ID: NPEB00344
      Version: 4.02
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4183-NPEB00344_00-LOVEFILMFULL0100


      Title ID: NPJB00773
      Version: 4.01
      Packages: Original / NoPSN Package / Debug Package
      Content ID: JA0011-NPJB00773_00-AMAZONVIDEOJAPAN

      Protection: SELF
      Bypass Method: ELF Modification / Multiple files merged from previous build

      Target: /USRDIR/bin/ignition.self -> ignition.elf
      TOC: 0x152B420
      KLicensee: 00000000000000000000000000000000

      Offset: 0x3CF73C
      Comments: You must press CIRLCE to bypass when prompted for PSN signin!

      Animax
      Status: PSN Bypass [ERROR] / Available [YES] / Service [?] / Account [?] / Ads [?]

      Title ID: NPEB01355
      Version: 1.01
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4398-NPEB01355_00-WEBMAF0000ANIMAX
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x25DAFA
      Comments: Black screen error on NoPSN version

      AnimeLab
      Status: PSN Bypass [OK] / Available [NO] / Service [OK] / Account [REQUIRED] / Ads [?]

      Title ID: NPEB02357
      Version: 1.00
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP8812-NPEB02357_00-WEBMAF00ANIMELAB
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x25C102
      Comments: Geographically Region Locked

      AOL.on
      Status: PSN Bypass [?] / Available [NO] / Service [?] / Account [?] / Ads [?]

      Title ID: NPUP31354
      Version: 1.04
      Packages: Original / NoPSN Package / Debug Package
      Content ID: UP2208-NPUP31354_00-AOLON20150112PS3
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN Branch Link
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf
      OPD: 0x2A3B90
      TOC: 0x2BB4F8
      Export Table: 0x26B9DC
      Import Table: 0x26BA38

      Offset: 0x09CCD0
      Comments: This is an example an "End Of Life" app and has an "infinite 3 dot" loading screen

      This is being looked into further when I have time!

      Blockbuster
      Status: PSN Bypass [OK] / Available [NO] / Service [OK] / Account [YES] / Ads [?]

      Title ID: NPEB02210
      Version: 1.03
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4543-NPEB02210_00-WEBMAF000BBUSTER
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf
      OPD: 0x2B3B90
      TOC: 0x2CB578
      Export Table: 0x26C628
      Import Table: 0x26C684

      Offset: 0x25E79A
      Comments: No Addition Information Is Available At This Time

      Cinepolis
      Status: PSN Bypass [?] / Available [YES] / Service [?] / Account [?] / Ads [?]

      Title ID: NPUP31348
      Version: 1.02
      Packages: Original / NoPSN Package / Debug Package
      Content ID: UP2191-NPUP31348_00-CINEPOLISKLICPS3
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN Branch Link
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf
      OPD: 0x2B3BC0
      TOC: 0x2CB708
      Export Table: 0x26F768
      Import Table: 0x26F7C4

      Offset: 0x092A94
      Comments: This is an example an "End Of Life" app and has an "infinite 3 dot" loading screen

      This is being looked into further when I have time!

      ClanTV
      Status: PSN Bypass [OK] / Available [NO] / Service [ERROR] / Account [?] / Ads [?]

      Title ID: NPEB02080
      Version: 1.00
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4490-NPEB02080_00-WEBMAF0000CLANTV
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf
      OPD: 0x213218
      TOC: 0x227900
      Export Table: 0x1E1450
      Import Table: 0x1E14AC

      Offset: 0x1D3BCA
      Comments: The app seems to load normally, but when I try and play a video, it doesn't play. It may be going out of service.

      Crackle
      Status: PSN Bypass [OK] / Available [YES] / Service [ERROR] / Account [?] / Ads [?]

      Title ID: NPUP00077
      Version: 2.41
      Packages: Original / NoPSN Package / Debug Package
      Content ID: US0007-NPUP00077_00-CRACKLEPS3TRILIT
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: SDAT Encryption
      Bypass Method: Javascript Modification

      Target: USRDIR/js/app/com/dadc/lithium/controller/ApplicationController.js.sdat

      Line: 2403
      Line: 2404
      Line: 2405
      Line: 2406
      Line: 2407
      Line: 2411

      Target: USRDIR/js/app/com/dadc/lithium/config/LoggerConfig.ca.js.sdat

      Line: 10

      Target: USRDIR/js/app/com/dadc/lithium/config/LoggerConfig.js.sdat

      Line: 10

      Target: USRDIR/js/app/com/dadc/lithium/config/LoggerConfig.la.js.sdat

      Line: 10

      Target: USRDIR/js/app/com/dadc/lithium/config/LoggerConfig.la.js.sdat

      Line: 10

      Target: USRDIR/ps3/UP9002-NPUO00080_00-LITESTAPPPS30001.pkg

      Remove This File
      Comments: For some reason i get an error screen that simply says "An error has occured. Please try again later" when the app is launched.

      There is also a NoAds version (in testing) available under NoAds Packages tab.

      Crunchyroll
      Status: PSN Bypass [OK] / Available [YES] / Service [?] / Account [REQUIRED] / Ads [?]

      Title ID: NPUP10027
      Version: 1.25
      Packages: Original / NoPSN Package / Debug Package / RAP File
      Content ID: UP2074-NPUP10027_00-2012070500000001
      KLicensee: 0268E5C3BED68DF39EB4BB4873C5B5CD


      Title ID: NPEB02307
      Version: 1.25
      Packages: Original / NoPSN Package / Debug Package / RAP File
      Content ID: EP8805-NPEB02307_00-20150410XCRUNCHY
      KLicensee: 00000000000000000000000000000000

      Protection: SDAT Encryption
      Bypass Method: Javascript Modification

      Target: /USRDIR/js/app/Crunchyroll/config.js.sdat

      Line: 4
      Comments: RAP Activation Required (currently unavailable for EU version).

      There is also a NoAds version (in testing) available under NoAds Packages tab.

      Daily Burn
      Status: PSN Bypass [OK] / Available [YES] / Service [OFFLINE] / Account [?] / Ads [?]

      Title ID: NPUP31344
      Version: 1.10
      Packages: Original / NoPSN Package / Debug Package
      Content ID: UP2110-NPUP31344_00-DAILYBURN0000100
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: INI Config File
      Bypass Method: Text Modification

      Target: /USRDIR/system.ini

      Line: 1
      Comments: Dust off your notepad.exe :victorious:

      Dansk Filmskat
      Status: PSN Bypass [OK] / Available [YES] / Service [OK] / Account [REQUIRED] / Ads [?]

      Title ID: NPEB02344
      Version: 1.01
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP8811-NPEB02344_00-000DANSKFILMSKAT
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x25F86A
      Comments: No Addition Information Is Available At This Time

      DAZN
      Status: PSN Bypass [?] / Available [YES] / Service [?] / Account [?] / Ads [?]

      Title ID: NPEB02391
      Version: 1.01
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP8819-NPEB02391_00-PERFORMGROUP2016
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x093FAC
      Comments: This is an example an "End Of Life" app and has an "infinite 3 dot" loading screen

      This is being looked into further when I have time!

      Demand5
      Status: PSN Bypass [OK] / Available [YES] / Service [ERROR] / Account [?] / Ads [?]

      Title ID: NPEB00861
      Version: 1.04
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4346-NPEB00861_00-CHANNEL50DEMAND5
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x1C10E2
      Comments: The app seems to load normally, but when I try and play a video, it doesn't play. It may be going out of service.

      DirecTV NFL Sunday Ticket
      Status: PSN Bypass [OK] / Available [YES] / Service [OK] / Account [REQUIRED] / Ads [?]

      Title ID: NPUO00019
      Version: 5.02
      Packages: Original / NoPSN Package / Debug Package
      Content ID: UP9002-NPUO00019_00-NFLTVPS3STREAM01
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: INI Config File
      Bypass Method: Text Modification

      Target: /USRDIR/system.ini

      Line: 1
      Comments: No Addition Information Is Available At This Time

      Drama Fever
      Status: PSN Bypass [?] / Available [YES] / Service [?] / Account [?] / Ads [?]

      Title ID: NPUP31359
      Version: 1.01
      Packages: Original / NoPSN Package / Debug Package
      Content ID: UP8903-NPUP31359_00-DRAMAFEVER000100
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN Branch Link
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x0AEE24
      Comments: This is an example an "End Of Life" app and has an "infinite 3 dot" loading screen

      This is being looked into further when I have time!

      DRTV
      Status: PSN Bypass [OK] / Available [NO] / Service [OK] / Account [?] / Ads [?]

      Title ID: NPEB02310
      Version: 1.00
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP8807-NPEB02310_00-WEBMAF000000DRTV
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x25C442
      Comments: No Addition Information Is Available At This Time

      FilmBox Live
      Status: PSN Bypass [OK] / Available [NO] / Service [?] / Account [REQUIRED] / Ads [?]

      Title ID: NPEB01920
      Version: 1.02
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4438-NPEB01920_00-WEBMAF000FILMBOX
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x1B8C7A
      Comments: No Addition Information Is Available At This Time

      FilmIn
      Status: PSN Bypass [OK] / Available [NO] / Service [?] / Account [REQUIRED] / Ads [?]

      Title ID: NPEB02418
      Version: 1.01
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP8824-NPEB02418_00-WEBMAF0000FILMIN
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x25E362
      Comments: No Addition Information Is Available At This Time

      Foxtel Play
      Status: PSN Bypass [OK] / Available [YES] / Service [?] / Account [?] / Ads [?]

      Title ID: NPEB02003
      Version: 1.01
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4480-NPEB02003_00-FOXTELFULLAPP000
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x1AD442
      Comments: Geographically Region Locked To Australia!

      FunimationNow
      Status: PSN Bypass [?] / Available [YES] / Service [?] / Account [?] / Ads [?]

      Title ID: NPEB02410
      Version: 1.01
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP8822-NPEB02410_00-FUNIMATIONNOW000
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN Branch Link
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x094D64
      Comments: This is an example an "End Of Life" app and has an "infinite 3 dot" loading screen

      This is being looked into further when I have time!

      GoPro Channel
      Status: PSN Bypass [OK] / Available [YES] / Service [?] / Account [?] / Ads [?]

      Title ID: NPUP31363
      Version: 1.01
      Packages: Original / NoPSN Package / Debug Package
      Content ID: UP8807-NPUP31363_00-GOPROAPPPS400000
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: CONF Text File
      Bypass Method: Text Modification

      Target: /USRDIR/lithium_ps3.conf

      Line: 15
      Line: 16
      Comments: No Addition Information Is Available At This Time

      HBO Nordic
      Status: PSN Bypass [OK] / Available [YES] / Service [OFFLINE] / Account [?] / Ads [?]

      Title ID: NPEB02292
      Version: 1.02
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP8806-NPEB02292_00-WEBMAF0HBONORDIC
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x261A5A
      Comments: No Addition Information Is Available At This Time

      HBO Now
      Status: PSN Bypass [OK] / Available [YES] / Service [OFFLINE] / Account [?] / Ads [?]

      Title ID: NPUP31369
      Version: 1.21
      Packages: Original / NoPSN Package / Debug Package
      Content ID: UP2084-NPUP31369_00-HBONOWPS30000000
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: CONF Text File
      Bypass Method: Text Modification

      Target: /USRDIR/lithium_ps3.conf

      Line: 14
      Comments: No Addition Information Is Available At This Time

      Hulu
      Status: PSN Bypass [OK] / Available [YES] / Service [OK] / Account [REQUIRED] / Ads [YES]

      Title ID: NPUP00046
      Version: 1.60
      Packages: Original / NoPSN Package
      Content ID: UT0008-NPUP00046_00-2010101201639300
      KLicensee: F4916D8BFFE769CCDF2AEDB57366C081

      Target: /USRDIR/EBOOT.BIN -> EBOOT.ELF

      Protection: SELF
      Bypass Method: ELF Modification (sceNpManagerGetStatus)

      Offset: 0x347B0
      Comments:

      ICFlix
      Status: PSN Bypass [OK] / Available [NO] / Service [OK] / Account [REQUIRED] / Ads [?]

      Title ID: NPEB02187
      Version: 1.00
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4532-NPEB02187_00-WEBMAF0000ICFLIX
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x25C102
      Comments: No Addition Information Is Available At This Time

      IGN
      Status: PSN Bypass [OK] / Available [NO] / Service [OK] / Account [?] / Ads [?]

      Title ID: NPUP31341
      Version: 1.01
      Packages: Original / NoPSN Package / Debug Package
      Content ID: UP2109-NPUP31341_00-WEBMAF0000000IGN
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x1BDDCA
      Comments: No Addition Information Is Available At This Time

      Infinity
      Status: PSN Bypass [OK] / Available [YES] / Service [?] / Account [?] / Ads [?]

      Title ID: NPEB01973
      Version: 1.06
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4463-NPEB01973_00-MEDIASETINFINITY
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x267190
      Comments: For some reason I get a black screen. Needs further testing.

      Laugh Factory Live
      Status: PSN Bypass [OK] / Available [YES] / Service [OFFLINE] / Account [?] / Ads [?]

      Title ID: NPUP00075
      Version: 1.03
      Packages: Original / NoPSN Package / Debug Package
      Content ID: US0040-NPUP00075_00-0000LAUGHFACTORY
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: INI Config File
      Bypass Method: Text Modification

      Target: /USRDIR/system.ini

      Line: 1
      Comments: No Addition Information Is Available At This Time

      Lightbox
      Status: PSN Bypass [OK] / Available [YES] / Service [?] / Account [REQUIRED] / Ads [?]

      Title ID: NPEB02213
      Version: 1.01
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4548-NPEB02213_00-WEBMAF00LIGHTBOX
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x1DA922
      Comments: No Addition Information Is Available At This Time

      Live Events Viewer
      Status: PSN Bypass [OK] / Available [YES] / Service [OFFLINE] / Account [?] / Ads [?]

      Title ID: NPUP10037
      Version: 2.01
      Packages: Original / NoPSN Package / Debug Package
      Content ID: UT0016-NPUP10037_00-LIVE0EVENTS00100
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: None
      Bypass Method: Javascript Modification

      Target: /USRDIR/scripts/app/model/PSNUser.js

      Line: X
      Target: /USRDIR/scripts/app/model/PSNUser.min.js

      Line: X
      Comments: No Addition Information Is Available At This Time

      Maxdome
      Status: PSN Bypass [OK] / Available [YES] / Service [?] / Account [REQUIRED] / Ads [?]

      Title ID: NPEB01192
      Version: 1.07
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4374-NPEB01192_00-MAXDOMEFULLAPP00
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x25EA1A
      Comments: No Addition Information Is Available At This Time

      MinBio (Mun Kino)
      Status: PSN Bypass [?] / Available [YES] / Service [?] / Account [?] / Ads [?]

      Title ID: NPEB02345
      Version: 1.03
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP8811-NPEB02345_00-WEBMAF0000MINBIO
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN Branch Link
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x093DD0
      Comments: This is an example an "End Of Life" app and has an "infinite 3 dot" loading screen

      This is being looked into further when I have time!

      MLB.tv
      Status: PSN Bypass [OK] / Available [YES] / Service [OK] / Account [YES] / Ads [?]

      Title ID: NPUP31353
      Version: 2.95
      Packages: Original / NoPSN Package / Debug Package
      Content ID: UP0181-NPUP31353_00-MLBTVPS3US000001
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: CONF Text File
      Bypass Method: Text Modification

      Target: /USRDIR/lithium_ps3.conf

      Line: 14

      Title ID: NPUP00024
      Version: 6.13
      Packages: Original / NoPSN Package / Debug Package
      Content ID: UT0006-NPUP00024_00-MLBTVPS3STREAM01
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: CONF Text File
      Bypass Method: Text Modification

      Target: /USRDIR/lithium_ps3.conf

      Line: 14

      Title ID: NPHA80252
      Version: 6.23
      Packages: Original / NoPSN Package / Debug Package
      Content ID: HP9010-NPHA80252_00-MLBTVPS3STREAM01
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: CONF Text File
      Bypass Method: Text Modification

      Target: /USRDIR/lithium_ps3.conf

      Line: 9
      Comments: There are also NoAds versions available under NoAds Packages tab.

      Movistar
      Status: PSN Bypass [OK] / Available [YES] / Service [OK] / Account [REQUIRED] / Ads [?]

      Title ID: NPEB02135
      Version: 1.06
      Packages: Original / NoPSN Package / Debug Package / SPRX Enabled
      Content ID: EP4512-NPEB02135_00-WEBMAF00000YOMVI
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf
      OPD: 0x2E3C40
      TOC: 0x2FD768
      Export Table: 0x295CEC
      Import Table: 0x295D48

      Offset: 0x00288322
      Comments: Thanks to @aosucas499 for pointing out that the old NoPSN patch was not working!

      Multiplayer.it
      Status: PSN Bypass [OK] / Available [YES] / Service [OK] / Account [NO] / Ads [?]

      Title ID: NPEB01990
      Version: 1.01
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4462-NPEB01990_00-WEBMAF00000MULTI
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x1BBC32
      Comments: No Addition Information Is Available At This Time

      NBA Game Time
      Status: PSN Bypass [OK] / Available [YES] / Service [?] / Account [YES] / Ads [?]

      Title ID: NPUO00030
      Version: 3.10
      Packages: Original / NoPSN Package / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000


      Title ID: NPHA80272
      Version: 3.03
      Packages: Original / NoPSN Package / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000

      Protection: INI Config File
      Bypass Method: Text Modification

      Target: /USRDIR/system.ini

      Line: 1
      Comments: No Addition Information Is Available At This Time

      Netflix
      Status: PSN Bypass [OK] / Available [YES] / Service [OK] / Account [YES] / Ads [?]

      Title ID: NPUP00030
      Version: 2.29
      Packages: Original / NoPSN Package / Debug Package / SPRX Enabled
      Content ID: UT0007-NPUP00030_00-NETFLIXRIGEL01NA
      KLicensee: 7AC7E325735C754B8C7F7984819B0A48

      Title ID: NPEB00874
      Version: 1.16
      Packages: Original / NoPSN Package / Debug Package / SPRX Enabled
      Content ID: EP4350-NPEB00874_00-NETFLIXRIGEL01EU
      KLicensee: A0FFF31F6A94046AF61550C7AC1F5DB3

      Target: /USRDIR/app.sprx --> app.prx

      Protection: Branch Link (x1)
      Bypass Method: SPRX Modification

      Offset: 0x011FB8
      IDA Details

      Title ID: NPJB00766
      Version: 1.03
      Packages: Original / NoPSN Package / Debug Package / SPRX Enabled
      Content ID: JA0010-NPJB00766_00-NETFLIXRIGEL01JP
      KLicensee: 540A3FBE1D97488493CA3696B20DEAF5

      Target: /USRDIR/app.sprx --> app.prx

      Protection: Branch Link (x1)
      Bypass Method: SPRX Modification

      Offset: 0x017038
      Offset: 0xF0D593 <-- PSN True/False Flag (May not be needed)
      IDA Details

      Comments:
      The USA and EUR versions have a different NoPSN patch than the JPN version :grin:

      NHL GameCenter LIVE
      Status: PSN Bypass [OK] / Available [YES] / Service [OK] / Account [YES] / Ads [?]

      Title ID: NPUP31340
      Version: 5.74
      Packages: Original / NoPSN Package / RAP Activation File
      Content ID: UT0026-NPUP31340_00-NHLGAMECENTERPS3
      KLicensee: 9C72DF61EC18B52FAD682EA5C0B17E68

      Protection: CONF Text File
      Bypass Method: Text Modification

      Target: /USRDIR/lithium_ps3.conf

      Line: 18
      Comments: RAP Activation Required.

      There is also a NoAds version available under NoAds Packages tab.

      NowTV
      Status: PSN Bypass [?] / Available [YES] / Service [?] / Account [?] / Ads [?]

      Title ID: NPEB01919
      Version: 1.04
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4439-NPEB01919_00-WEBMAF0SKYITALIA
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN Branch Link
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x092A94
      Comments: This is an example an "End Of Life" app and has an "infinite 3 dot" loading screen

      This is being looked into further when I have time!

      NRK Super
      Status: PSN Bypass [?] / Available [YES] / Service [?] / Account [?] / Ads [?]

      Title ID: NPEB02136
      Version: 1.02
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4509-NPEB02136_00-WEBMAF00NRKSUPER
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN Branch Link
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x093DD0
      Comments: This is an example an "End Of Life" app and has an "infinite 3 dot" loading screen

      This is being looked into further when I have time!

      NRK TV
      Status: PSN Bypass [?] / Available [YES] / Service [?] / Account [?] / Ads [?]

      Title ID: NPEB02137
      Version: 1.02
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4509-NPEB02137_00-WEBMAF00000NRKTV
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN Branch Link
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x093DD0
      Comments: This is an example an "End Of Life" app and has an "infinite 3 dot" loading screen

      This is being looked into further when I have time!

      Pathe Thuis
      Status: PSN Bypass [OK] / Available [NO] / Service [?] / Account [?] / Ads [?]

      Title ID: NPEB01974
      Version: 1.00
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4466-NPEB01974_00-WEBMAF00000PATHE
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN Branch Link
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x080784
      Offset: 0x080994
      Comments: You will have to press CIRCLE to bypass when PSN Login appears.

      This is an example an "End Of Life" app and has an "infinite 3 dot" loading screen

      This is being looked into further when I have time!

      Playstation Store
      Title ID: NPIA00025
      Version: 1.26
      Packages: Original / Cache Only / Debug Enabled / OSC Enabled / NoPSN Package
      Content ID: IP9100-NPIA00025_00-SFPROD0000000000
      KLicensee: 72F990788F9CFF745725F08E4C128387
      OPD: 0x428ED8
      TOC: 0x43D138
      Export Table: 0x3B9ABC
      Import Table: 0x3B9B50

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Protection: Forces PSN Login Before App Starts
      Bypass Method: EBOOT Modification / New ID [NPEB02080] and Package + Update Check Fix

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf


      Offset: 0x13989C
      Offset: 0x92484
      Comments: This will create another Playstation Store icon under Game column on XMB. This patch basically forces "Guest Mode". The update check has also been removed. The app will load and most likely give you a "Maintenance Error" which there are several ways to redirect default navigation and even use custom button combos for things by modifying SDATs. Some SDAT modifications will be needed to do anything with the app....I am assuming!

      Plus7 by Yahoo!
      Status: PSN Bypass [OK] / Available [YES] / Service [?] / Account [YES] / Ads [?]

      Title ID: NPEB02161
      Version: 1.01
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4447-NPEB02161_00-WEBMAF00000PLUS7
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x288322
      Comments: The app seems to load normally, but when I try and play a video, it doesn't play. It may be going out of service.

      Popcornflix
      Status: PSN Bypass [OK] / Available [YES] / Service [OK] / Account [NO] / Ads [YES]

      Title ID: NPUP31351
      Version: 1.01
      Packages: Original / NoPSN Package / Debug Package / SPRX Enabled
      Content ID: UP2202-NPUP31351_00-POPCORNFLIX30875
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: SDAT Encryption
      Bypass Method: Javascript Modification

      Target: /USRDIR/com/dadc/tls/config/NetworkConf.js.sdat

      Line: 21

      Target: /USRDIR/com/dadc/tls/network/HttpManager.js.sdat

      Line: 82
      Comments: There are also Ad-Free versions available under NoAds Packages tab

      Qello HD Concerts
      Status: PSN Bypass [OK] / Available [NO] / Service [OK] / Account [NO] / Ads [?]

      Title ID: NPUP10043
      Version: 1.10
      Packages: Original / NoPSN Package / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000

      Protection: INI Config File
      Bypass Method: Text Modification

      Target: /USRDIR/system.ini

      Line: 1

      Title ID: NPEB02055
      Version: 1.03
      Packages: Original / NoPSN Package / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000

      Protection: SDAT Encryption
      Bypass Method: Javascript Modification

      Target: /USRDIR/js/app/main.js.sdat

      Line: 1
      Comments: No Addition Information Is Available At This Time

      QuickFlix
      Status: PSN Bypass [OK] / Available [YES] / Service [?] / Account [REQUIRED] / Ads [?]

      Title ID: NPEB00864
      Version: 2.03
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4342-NPEB00864_00-QUICKFLIX0000FUL
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: EnablePSN True/False Flag
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x25E14A
      Comments: No Addition Information Is Available At This Time

      Redbull TV
      Status: PSN Bypass [OK] / Available [NO] / Service [?] / Account [?] / Ads [?]

      Title ID: NPUP31352
      Version: 1.08
      Packages: Original / NoPSN Package / Debug Package
      Content ID: UP8904-NPUP31361_00-REDBULLTVAPP2015
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Target: /USRDIR/js/lib/util/Network.js.sdat

      Line: 19
      Line: 44
      Line: 48
      Line: 52
      Line: 60
      Line: 64
      Line: 99
      Line: 102
      Comments: This app may be able to be revived by patching the server paths and some creative javascripting ;)

      SBS On Demand
      Title ID: NPEB02050
      Version: 1.03
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4355-NPEB02050_00-SBSONF0000DEMAND
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x093DD0
      Comments: This is an example an "End Of Life" routine and PSN Bypass

      Skai
      Title ID: NPEB01987
      Version: 1.00
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4465-NPEB01987_00-WEBMAF000000SKAI
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x1A68CA
      Comments: This is an example of the TRUE/FALSE Hex Edit PSN Bypass

      Sky Ticket
      Title ID: NPEB02339
      Version: 1.02
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP8809-NPEB02339_00-00SKYDEUTSCHLAND
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x09348C
      Comments: This is an example an "End Of Life" routine and PSN Bypass

      Spotify
      Title ID: NPEB02222
      Version: 1.00
      Packages: Original / NoPSN Package / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x0B75E7
      Offset: 0x26A102
      Comments: NoPSN version does not work properly!

      Total Channel
      Title ID: NPEB01848
      Version: 1.02
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4419-NPEB01848_00-TOTALCHANNEL0000
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x25DAFA
      Comments: This is an example of the TRUE/FALSE Hex Exit PSN Bypass

      TuneIn Radio
      Status: PSN Bypass [OK] / Available [YES] / Service [OK] / Account [?] / Ads [NO]

      Title ID: NPUP10042
      Version: 1.01
      Packages: Original / NoPSN Package / Debug Package / SPRX Enabled
      Content ID: UT0020-NPUP10042_00-TUNEINPKG0000000
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: Branch Link (x3)
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x00B700
      Offset: 0x00B708
      Offset: 0x00BB20
      Comments: No Addition Information Is Available At This Time

      TV 2 Sumo
      Title ID: NPEB01956
      Version: 1.02
      Packages: Original / NoPSN Package / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x25FD6A
      Comments: This is an example of the TRUE/FALSE Hex Edit PSN Bypass

      TV3
      Title ID: NPEB02166
      Version: 1.01
      Packages: Original / NoPSN Package / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x1C29D2
      Comments: This is an example of the TRUE/FALSE Hex Edit PSN Bypass

      Twitch
      Status: PSN Bypass [OK] / Available [YES] / Service [OK] / Account [YES] / Ads [YES]

      Title ID: NPUP31358
      Version: 1.07
      Packages: Original / NoPSN Package / Debug Package
      Content ID: UP8902-NPUP31358_00-TWITCHPS3APPSCEA
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Title ID: NPEB02359
      Version: 1.07
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP8816-NPEB02359_00-GTWITCHXXX000001
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Title ID: NPHB00730
      Version: 1.07
      Packages: Original / NoPSN Package / Debug Package
      Content ID: HP8901-NPHB00730_00-TWITCHPS3APPASIA
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: SDAT Encryption
      Bypass Method: Javascript Modification

      Target: /USRDIR/js/app/presenter/PSNLoginPresenter.js.sdat

      Line 20:

      Target: /USRDIR/js/tls/network/PSNManager.js.sdat

      Line 38:
      Line 41:
      Line 44:
      Line 48:
      Line 56:
      Line 57:
      Line 65:
      Line 66:
      Line 70:<-- Probably Not Needed
      Line 80:<-- Probably Not Needed
      Line 90:<-- Probably Not Needed
      Line 99:
      Line 100:
      Line 108:
      Line 109:
      Line 130:
      Line 131:
      Line 132:
      Line 135:
      Line 136:
      Line 137:
      Line 141:
      Line 142:
      Line 148:
      Line 168: <-- This may not be needed, but was not yet tested without writing 'online' to the log
      Line 169:
      Comments: There are two files to patch and multiple edits to be made with this one!

      VEVO
      Title ID: NPEB02212
      Version: 1.00
      Packages: Original / NoPSN Package / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x1D901A
      Comments: This is an example of the TRUE/FALSE Hex Edit PSN Bypass

      ViaPlay
      Title ID: NPEB00863
      Version: 1.10
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4345-NPEB00863_00-VIAPLAYFULLAPP00
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x25DDC2
      Comments: This is an example of the TRUE/FALSE Hex Exit PSN Bypass

      VUDU
      Status: PSN Bypass [OK] / Available [YES] / Service [OK] / Account [YES] / Ads [?]

      Title ID: NPUP00047
      Version: 2.01
      Packages: Original / Region-Free / NoPSN Package / NoPSN + Region-Free / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000

      Protection: Branch Link (x3)
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x003868
      Offset: 0x5AAD1C
      Offset: 0x00B450 <-- Region Free
      Comments: No Addition Information Is Available At This Time

      Wuaki.tv
      Title ID: NPEB01813
      Version: 1.08
      Packages: Original / NoPSN Package / Debug Package
      Content ID: EP4410-NPEB01813_00-WUAKI0FULL000000
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x288322
      Comments: This is an example of the TRUE/FALSE Hex Exit PSN Bypass

      YLE Areena
      Title ID: NPEB02338
      Version: 1.00
      Packages: Original / NoPSN Package / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x25C412
      Offset: 0x0B7734 <-- EnablePSN Branch/Link Call. May not need patched
      Comments: This is an example of the TRUE/FALSE Hex Edit PSN Bypass

      Yomvi
      Title ID: NPEB02135
      Version: 1.00
      Packages: Original / NoPSN Package / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x09A868
      Comments: This is an example an "End Of Life" routine and PSN Bypass. New PKG Superseded by Movistar App.

      YouTube
      Status: PSN Bypass [OK] / Available [YES] / Service [OK] / Account [YES] / Ads [YES]

      Title ID: NPUP10028
      Version: 3.01
      Packages: Original / NoPSN Package / Debug Package / SPRX Enabled
      Content ID: UP2075-NPUP10028_00-YOUTUBE000000001
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Title ID: NPEB01229
      Version: 3.01
      Packages: Original / NoPSN Package / Debug Package / SPRX Enabled
      Content ID: EP4381-NPEB01229_00-YOUTUBE000000001
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Title ID: NPJB00286
      Version: 3.01
      Packages: Original / NoPSN Package / Debug Package / SPRX Enabled
      Content ID: JA0004-NPJB00286_00-YOUTUBE000000001
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Protection: Branch Link (x1)
      Bypass Method: EBOOT Modification

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      HxD Offset: 0x055F30
      IDA Details

      Comments:
      This is our old friend again! We should all have patched this one already

      YuppTV
      Title ID: NPEB02350
      Version: 1.00
      Packages: Original / NoPSN Package / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000

      Target: /USRDIR/EBOOT.BIN --> EBOOT.elf

      Offset: 0x25CE32
      Comments: This is an example of the TRUE/FALSE Hex Edit PSN Bypass

    • [ No PSN Bypass Needed Placeholder ]

      These apps do not require logging into Playstation Network and therefore do not need a PSN bypass.

      BBC iPlayer
      Title ID: NPEB00683
      Version: 1.03
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target: [Not Required]

      Comments: No PSN Bypass Is Needed For This App!

      BBC Sport
      Title ID: BLET70024
      Version: 1.02
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target: [Not Required]

      Comments: No PSN Bypass Is Needed For This App!

      du View
      Title ID: NPEB02263
      Version: 1.01
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target: [Not Required]

      Comments: No PSN Bypass Is Needed For This App!

      EPIX
      Title ID: NPUP10036
      Version: 1.10
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target: [Not Required]

      Comments: No PSN Bypass Is Needed For This App!

      FunimationNow
      Title ID: NPUP31349
      Version: 1.07
      Packages: Original / 480p Fix Package / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target: [Not Required]

      Comments: No PSN Bypass Is Needed For This App!

      iHeart Radio
      Title ID: NPUP31352
      Version: 1.03
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target: [Not Required]

      Comments: No PSN Bypass Is Needed For This App!

      iPla
      Title ID: NPEB00703
      Version: 1.00
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target: [Not Required]

      Comments: Browser Application. No PSN Bypass Is Needed For This App!

      NOS
      Title ID: NPEB00706
      Version: 1.00
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target: [Not Required]

      Comments: Browser Application. No PSN Bypass Is Needed For This App!

      Plex
      Title ID: NPUP31350
      Version: 1.01
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target: [Not Required]

      Comments: No PSN Bypass Is Needed For This App!


      Title ID: NPEB02144
      Version: 1.01
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target: [Not Required]

      Comments: No PSN Bypass Is Needed For This App!

      PlutoTV
      Title ID: NPUP31364
      Version: 2.01
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target: [Not Required]

      Comments: No PSN Bypass Is Needed For This App!

      Qriocity / Music Unlimited
      Title ID: NPIA09002
      Version: 2.10
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target: [Not Required]

      Comments: No PSN Bypass Is Needed For This App!

      RTVE
      Title ID: NPEB00709
      Version: 1.00
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target: [Not Required]

      Comments: Browser Application. No PSN Bypass Is Needed For This App!

      Trilithium Test App
      Title ID: NPUO00080
      Version: 1.01
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target: [Not Required]

      Comments: No PSN Bypass Is Needed For This App! This is basically a "Hello World" TV App For Your Enjoyment. It was ripped from Crackle (UP9002-NPUO00080_00-LITESTAPPPS30001.pkg)!

      YLE Areena
      Title ID: NPEB00710
      Version: 1.00
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target: [Not Required]

      Comments: Browser Application. No PSN Bypass Is Needed For This App!

      EyeCreate
      Title ID: NPUA80095
      Version: 1.00
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target: [Not Required]

      Comments: No PSN Bypass Is Needed For This App!

      Move.me
      Title ID: NPUO00014
      Version: 2.01
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target: [Not Required]

      Comments: No PSN Bypass Is Needed For This App!

      Headset Companion App
      Title ID: NPUO00025
      Version: 1.12
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target: [Not Required]

      Comments: No PSN Bypass Is Needed For This App!

      PS2 System Data
      Title ID: NPIA00001
      Version: 1.00
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target: [Not Required]

      Comments: No PSN Bypass Is Needed For This App!


    • [NoAds Packages Placeholder ]

      These apps have had the ads removed or blocked in some way.

      MLB.tv
      Title ID: NPUP31353
      Version: 2.95
      Packages: NoPSN+NoAds
      Content ID:
      KLicensee:
      00000000000000000000000000000000

      Target: /USRDIR/lithium_ps3.conf

      Line: 90
      Line: 93
      Comments:

      NHL GameCenter LIVE
      Title ID: NPUP31340
      Version: 5.74
      Packages: NoPSN+NoAds / RAP Activation File
      Content ID: UT0026-NPUP31340_00-NHLGAMECENTERPS3
      KLicensee: 9C72DF61EC18B52FAD682EA5C0B17E68

      Target: /USRDIR/lithium_ps3.conf

      Line: 106
      Line: 109
      Comments: RAP Activation Required.

      Popcornflix
      Title ID: NPUP31351
      Version: 1.01
      Packages: NoPSN+NoAds / NoPSN+NoAds Agressive / NoPSN+NoAds+NoLogging
      Content ID: UP2202-NPUP31351_00-POPCORNFLIX30875
      KLicensee: 72F990788F9CFF745725F08E4C128387

      Target: /USRDIR/com/dadc/app/presenter/FeatureVideoPresenter.js.sdat

      Line: 134 <-- Aggressive ONLY (Hides Ad Mark Bubbles On Playback Line)
      Line: 135 <-- Aggressive ONLY (Hides Ad Mark Bubbles On Playback Line)
      Line: 384
      Line: 400
      Line: 498
      Line: 504
      Comments:

    • [ Unavailable Packages Placeholder ]

      These packages are discontinued and the original download links are no longer available.

      If you have any of these, please post a link so it can be added to the archive.

      adhoc Party For PSP
      Title ID: NPEA00153
      Version: 1.00
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:

      Comments:

      CBS News
      Title ID: NPUP31372
      Version: 1.00
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:

      Comments:

      MUBI
      Title ID: NPUP31347
      Version: 1.00
      Packages: Original / Debug Package
      Content ID:
      KLicensee:
      00000000000000000000000000000000
      OPD: 0x000000
      TOC: 0x000000
      Export Table: 0x000000
      Import Table: 0x000000

      Target:

      Comments:


    • [ End Of Life Description Placeholder ]

      This is a common routine found in EBOOT.ELF files that are no longer in service or discontinued.

      [​IMG]

     
    Last edited: Dec 13, 2017
    Nomeji, roie, Death_Dealer and 4 others like this.
  5. 748
    1,677
    247
    esc0rtd3w

    esc0rtd3w Developer

    Joined:
    Mar 10, 2017
    Messages:
    748
    Likes Received:
    1,677
    Trophy Points:
    247
    Gender:
    Male
    Occupation:
    Hacker
    Location:
    OHIO, USA
    Home Page:


    [​IMG]


    Main Table of Contents
    Post #1: Getting Started / Bypassing PSN Exercise
    Post #2: Live Debugging Using Multiple Methods
    Post #3: PSN Bypass Methods and Examples
    Post #4: PSN App Package Information and Downloads
    Post #5: Open Source Projects / Development Resources
    Post #6: Credits For Everything Covered In This Tutorial



    [ All other debugging info, tips, and tricks will be placed here ]

    [ All open source code to PSN projects, programming, Visual Studio, GCC, Linux options, and related info will be placed here ]




    • Open Source PSN Projects Placeholder

      [C++] [PC] NoPSN PS3 TMAPI Memory Patcher
      * Currently Only YouTube PSN Bypass Working
      https://github.com/esc0rtd3w/nopsn-tmapi
      This is just a small app that uses ps3tmapi.dll to set nop and jmp operations from PC while EBOOT is running on PS3. I started writing my own ps3api after watching a few TMAPI videos here, from BadLuckModders and recommend others take a look that are interested. I have only added a few functions for connecting, attaching, and reading/writing memory.

      This can be easily expanded and can be a good ps3api base to use for your own small project. I have an expanded ps3api project that I will release separately when finished. There are several other sources available from others that have already created most or all functions from PS3 TMAPI, but I think it's fun to make your own. :welcoming:

      Click Here For Tutorial File and Source

      [​IMG]

      [​IMG]

      [​IMG]


      [C++] [PS3] NoPSN SPRX Memory Patcher
      * YouTube PSN Bypass Working by patching memory

      * Netflix PSN also bypassed without patching any memory, just superseding the original splash cancels it! :beaten:
      https://github.com/esc0rtd3w/nopsn-sprx
      This is the default nopsn.sprx file that all SPRX Enabled packages will support. Currently there is support for YouTube, but for some odd reason, Netflix is also bypassed by commenting out the memory patches and just having the Debug Output splash screen being displayed! :topsy turvy:

      You can build from source or use the compiled pre-compiled SPRX. Copy file to /dev_hdd0/tmp/, install the Original SPRX Enabled YouTube App and run it. You can build your own EBOOT with nopsn.sprx loader support by using this file. The SPRX will wait 5 seconds and then disable the PSN check. I am expanding this to support all PSN restricted apps to use as a generic SPRX loader.

      [​IMG]


      I have also started a NoAds module integrated into the NoPSN SPRX to further enhance the crap removal experience! I'm lookin' at you, YouTube! :smiley simmons:

      [​IMG]


    • [ Debugging Resources Placeholder ]

    • [ Debugging Tips/Tricks Placeholder ]

    • [ Visual Studio / GCC Help Placeholder ]

    • [ Linux Resources Placeholder ]
     
    Last edited: Apr 11, 2017
    kozarovv, smikk, freddy38510 and 2 others like this.
  6. 748
    1,677
    247
    esc0rtd3w

    esc0rtd3w Developer

    Joined:
    Mar 10, 2017
    Messages:
    748
    Likes Received:
    1,677
    Trophy Points:
    247
    Gender:
    Male
    Occupation:
    Hacker
    Location:
    OHIO, USA
    Home Page:


    [​IMG]


    Main Table of Contents
    Post #1: Getting Started / Bypassing PSN Exercise
    Post #2: Live Debugging Using Multiple Methods
    Post #3: PSN Bypass Methods and Examples
    Post #4: PSN App Package Information and Downloads
    Post #5: Open Source Projects / Development Resources
    Post #6: Credits For Everything Covered In This Tutorial



    Ideas and Inspiration

    Original NoPSN Idea: bitsbubba :bitsbubba:
    http://www.psx-place.com/ps3-news/1459/the-latest-no-psn-apps-by-bitsbubba.html

    SDAT Decryption: strictlyfocused
    http://psx-scene.com/forums/content...s-no-psn-apps-strictlyfocused-bitsbubba-4866/

    Coding and VSH Help: bguerville
    http://www.psx-place.com/members/bguerville.2198/


    Tools I Have Used Along The Way

    Aldos Tools: aldo
    http://www.aldostools.org/

    Break N Make: CMX (posted by tthousand)
    http://www.psx-place.com/threads/makeself-v1-1-by-cmx-break-n-make-bundle.1030/

    CCAPI: Enstone
    http://www.enstoneworld.com/

    CFW EBOOT PKG Resigner: razorx
    http://www.dashhacks.com/ps3/apps/new-tool-from-razorx-cfw-eboot-pkg-resigner.html

    CodeWizard PS3: Dnawrkshp
    https://github.com/Dnawrkshp/CodeWizardPS3/

    deci3dbg (IDA Plugin): oct0xor
    https://github.com/oct0xor/deci3dbg

    ESSE Resigner: bigjokker
    http://www.ps3hax.net/showthread.php?t=79491&p=811800&viewfull=1#post811800

    HxD Hex Editor: mh-nexus
    https://mh-nexus.de/en/hxd/

    IDA: HexRays
    https://www.hex-rays.com/products/ida/index.shtml

    NetCheat: Dnawrkshp
    http://www.ps3hax.net/showthread.php?t=71280

    PS3 Game Updates: Eddie Lucas
    http://www.nextgenupdate.com/forums/ps3-mods-cheats/862624-ps3-game-updates.html

    PS3IDA (IDA Plugin/Loader): kakaroto
    https://github.com/kakaroto/ps3ida

    PPC Altivec (IDA Plugin): xorloser
    http://xorloser.com/blog/?p=144

    PS VS Integration: Dnawrkshp
    https://github.com/Dnawrkshp/PS3-VS-Integration

    PSL1GHT Open-Source PS3 SDK: AerialX/HackerChannel :: Estwald
    https://github.com/HACKERCHANNEL/PSL1GHT :: https://github.com/Estwald/PSDK3v2

    PS3 Toolchain / Libraries: PS3Dev
    https://github.com/ps3dev/ps3toolchain / https://github.com/ps3dev/ps3libraries

    SPRX Elf Builder: seb5594
    http://www.nextgenupdate.com/forums/ps3-mods-cheats/748626-sprx-elf-builder-v1-03-ps3-plugins.html

    TrueAncestor: jjkkyu
    http://www.ps3hax.net/showthread.php?t=93343&p=854900

    Visual Studio: Microsoft
    https://www.visualstudio.com/


    Code Reference Credits

    COBRA Source Code: Joonie86
    https://github.com/Joonie86/COBRA-7.3/

    PS3 Manager API: NzV
    http://www.psx-place.com/threads/ps3-manager-api.931/

    SPRX Read/Write Memory: Winter
    http://www.nextgenupdate.com/forums/ps3-mods-cheats/749680-how-make-sprx-read-write-memory.html

    TMAPI C++ Help: Bad Luck Modders
    https://www.youtube.com/user/BadLuckModders


    Other Credits

    Sections Font: NAL (The Rave Is In Your Pants)
    http://www.1001fonts.com/the-rave-is-in-your-pants-font.html


    Special Credits

    Sony: Playstation 3 Dev Team
    http://www.playstation.com/

    Rebug: The Entire Rebug Dev Team
    https://rebug.me/


    Everyone That I Missed!





    The End!

    Comments Are Welcome :cheerful:
     
    Last edited: Apr 13, 2017
    kozarovv, smikk, freddy38510 and 5 others like this.
  7. 2,568
    2,167
    372
    sandungas

    sandungas Moderator Developer

    Joined:
    Dec 31, 2014
    Messages:
    2,568
    Likes Received:
    2,167
    Trophy Points:
    372
    Location:
    Babylon 20xxE series
    A couple of questions about "VSI2010forPS3v2.0.1.5.exe"...
    It works with visual c++ express 2010 ?... or it needs to be the complete visual studio suit ?
    After installing it i can continue using visual studio normally for other projects... or the visual studio installation is going to be highlly modifyed ?

    P.S.
    I think you could add an small explain about this questions in the tutorial (or any other you consider insteresting related with that file) so this message im just writing (and eventually your answer) could be deleted from the thread

    P.S.2.
    The first time i opened this thread while it was not finished i took a look overall without reading in detail... i thought "wow, this is too long, there are too much images and probably is not needed to have so much"
    But the other day i did read everything calmlly and i have to say is awesome the level of detail in this tutorial, great work, there is no room for error or misunderstandings :)
     
  8. 649
    664
    147
    Zar

    Zar Developer

    Joined:
    Oct 15, 2014
    Messages:
    649
    Likes Received:
    664
    Trophy Points:
    147
    nice tuto, ty.

    Just a little advice for the next one. You can use "Snipping Tool" to do your screenshots. It's included in Windows. It also allow you to save only the window that you want to capture.
     
    STLcardsWS, bitsbubba and esc0rtd3w like this.
  9. 7,340
    5,958
    622
    bguerville

    bguerville Moderator Developer

    Joined:
    Feb 25, 2015
    Messages:
    7,340
    Likes Received:
    5,958
    Trophy Points:
    622
    Location:
    Earth
    The visual studio 2010 extensions require visual studio 2010 with vc++ installed. Personally I recommend installing C# as well (or VB) for creating/compiling Windows code.

    In theory, Visual C++ 2010 Express edition like all express editions does not support vsix extensions except Microsoft's own. Of course vsix extensions can be installed but they don't load properly.
    So in theory the ps3 sdk extension should not work however it works fine. Go figure.. Am not really sure why, maybe S#ny has some kind of agreement with MS...?
    Btw nowadays, with ProDG 4.70 available & the new vsix extension version included with it, you could at least use VS 2013 instead anyway.

    As to the consequences of installing the ps3 sdk vsix extension, well, it adds project types to the ide, that kind of things, but does not modify Visual Studio's original features. You can of course continue to use Visual studio for the rest of your standard projects.

    Edit:
    I remind users who would like to use the open source psl1ght sdk instead of the licensed ps3 sdk to manage their project with Visual Studio, a custom vsix extension to add a psl1ght project type to the VS 2013 ide (not on Express Edition in theory although I have never tried as I usually use VS Ultimate Edition) is available thanks to Dnawrkshp.
    https://github.com/Dnawrkshp/PS3-VS-Integration

    The level of detail in the tutorial is praise worthy imo, it would allow complete noobs to step by step... Lol
     
    Last edited: Apr 7, 2017
    bitsbubba, esc0rtd3w and RandQalan like this.
  10. 748
    1,677
    247
    esc0rtd3w

    esc0rtd3w Developer

    Joined:
    Mar 10, 2017
    Messages:
    748
    Likes Received:
    1,677
    Trophy Points:
    247
    Gender:
    Male
    Occupation:
    Hacker
    Location:
    OHIO, USA
    Home Page:
    @sandungas I will see what the deal with that is, thanks to @bguerville for clearing that up for the most part.

    @Zar I have used the snipping tool for some. I was battling myself as whether to do full screenshots for some because of the room it takes up, but I feel some people may get confused without the full capture. I am going to do video tutorials for each section here soon and clean up the post. I was not sure how large the post would be until I actually started going through the step-by-step and building the tutorial.

    thanks for all the replies and I will continue to update it to get all the details I can in there.

    EDIT #1: I have updated some of the text and links in original posts pertaining to the above discussed issues
     
    Last edited: Apr 6, 2017
  11. 7,523
    6,356
    747
    STLcardsWS

    STLcardsWS Administrator

    Joined:
    Sep 18, 2014
    Messages:
    7,523
    Likes Received:
    6,356
    Trophy Points:
    747
    Nice work @esc0rtd3w I hope you don't mind (if you do its okay we can revert it easily)

    In your first post i formatted it a bit (just added the tabs) if you like i can do the other post as well, or i can revert it back.
     
    bitsbubba and esc0rtd3w like this.
  12. 748
    1,677
    247
    esc0rtd3w

    esc0rtd3w Developer

    Joined:
    Mar 10, 2017
    Messages:
    748
    Likes Received:
    1,677
    Trophy Points:
    247
    Gender:
    Male
    Occupation:
    Hacker
    Location:
    OHIO, USA
    Home Page:
    @STLcardsWS yeah I noticed that as I was editing and was like WTF?!? But yeah, I was thinking of that anyways, it looks a lot cleaner.

    Thanks!
     
    bitsbubba and STLcardsWS like this.
  13. 7,523
    6,356
    747
    STLcardsWS

    STLcardsWS Administrator

    Joined:
    Sep 18, 2014
    Messages:
    7,523
    Likes Received:
    6,356
    Trophy Points:
    747
    Sorry my bad, hopefully i did not mess you up any? if so i can revert/retreve any saved edit.
     
    esc0rtd3w likes this.
  14. 748
    1,677
    247
    esc0rtd3w

    esc0rtd3w Developer

    Joined:
    Mar 10, 2017
    Messages:
    748
    Likes Received:
    1,677
    Trophy Points:
    247
    Gender:
    Male
    Occupation:
    Hacker
    Location:
    OHIO, USA
    Home Page:
    @STLcardsWS everything appears to be there, the last text that I added showed up after I initially refreshed when the tabs first showed up. I updated the other post to use the tabs too. Saves a ton of room :topsy turvy:

    EDIT #1: I am going to organize them a bit better and group different tutorial steps into tab form to keep it clean.
     
    Last edited: Apr 6, 2017
  15. 3,817
    1,814
    272
    bitsbubba

    bitsbubba Super Moderator / Developer Super Moderator Developer

    Joined:
    Sep 27, 2014
    Messages:
    3,817
    Likes Received:
    1,814
    Trophy Points:
    272
    Gender:
    Male
    Occupation:
    Homicidal Super Moderator
    Location:
    Camp Crystal Lake, USA
    Home Page:
    awesome work @esc0rtd3w & thanks again for the shout out
     
    Last edited: Apr 6, 2017
    esc0rtd3w likes this.
  16. 748
    1,677
    247
    esc0rtd3w

    esc0rtd3w Developer

    Joined:
    Mar 10, 2017
    Messages:
    748
    Likes Received:
    1,677
    Trophy Points:
    247
    Gender:
    Male
    Occupation:
    Hacker
    Location:
    OHIO, USA
    Home Page:
    if anyone has any older (pre 1.54) versions of Hulu packages, can you please PM or post link? I want to look through the history a bit and see if I can get a working PSN bypass somehow!
     
  17. 124
    85
    57
    catalinnc

    catalinnc Member

    Joined:
    Dec 26, 2015
    Messages:
    124
    Likes Received:
    85
    Trophy Points:
    57
    here it is...
    Code:
    hulu plus update v1.53
    http://b0.ww.np.dl.playstation.net/tppkg/np/NPUP00046/NPUP00046_T14/73bb6f7a0d17fba8/UT0008-NPUP00046_00-2010101201639300-A0153-V0100-PE.pkg
    _

    p.s. please, when requesting links post the game id...
     
    esc0rtd3w likes this.
  18. 748
    1,677
    247
    esc0rtd3w

    esc0rtd3w Developer

    Joined:
    Mar 10, 2017
    Messages:
    748
    Likes Received:
    1,677
    Trophy Points:
    247
    Gender:
    Male
    Occupation:
    Hacker
    Location:
    OHIO, USA
    Home Page:
    thanks!

    yeah, the id is NPUP00046. If you have any other version links, let me know. thanks again!

    EDIT: I guess the 1.53 was the last "Hulu Plus" version, before changing logo to just say "Hulu" now. It follows the same file template as the 1.54 and I assume extracts files upon signin. Older versions before 1.53 will probably not help, but feel free to PM any other links.
     
    Last edited: Apr 11, 2017
  19. 9,122
    3,406
    472
    pinky

    pinky Bitsiboo's Other Half Developer

    Joined:
    Mar 8, 2015
    Messages:
    9,122
    Likes Received:
    3,406
    Trophy Points:
    472
    Gender:
    Male
    Location:
    The Great Gig in the Sky
    u can find the links using game updates from @aldostools ps3 tools. u just need the title id. I just found the one above. no other links to previous updates. they may have been removed, so if someone has them on their computer or ps3....

    edit: nm. the one I found is 1.56. that should be the latest. the previous versions must still be up.

    Code:
    http://b0.ww.np.dl.playstation.net/tppkg/np/NPUP00046/NPUP00046_T19/c57810fa9fbabafc/UT0008-NPUP00046_00-2010101201639300-A0156-V0101-PE.pkg
     
    esc0rtd3w likes this.
  20. 748
    1,677
    247
    esc0rtd3w

    esc0rtd3w Developer

    Joined:
    Mar 10, 2017
    Messages:
    748
    Likes Received:
    1,677
    Trophy Points:
    247
    Gender:
    Male
    Occupation:
    Hacker
    Location:
    OHIO, USA
    Home Page:
    yeah, i usually do that or use the "https://a0.ww.np.dl.playstation.net/tpl/np/-ver.xml" link with ID, but as far as I was aware, that only displays current version, unless other older updates have files not present in newest update. That's my understanding anyways. Thanks though for the tip!

    EDIT #1: That's basically what I was hoping for, is people that just have packages still on their PC!

    EDIT #2: I forgot about the b0.ww.np.dl domain!
     
    Last edited: Apr 11, 2017
    pinky likes this.

Share This Page