PS3 4.88.2 Evilnat Cobra (8.3) Custom FirmWare (CFW-CEX) Released

Evilnat · Feb 11, 2021

aldostools said:
Excellent job Nathan!
Just a minor suggestion: C uses short circuit evaluation. If you first check CFW2OFW_game is more efficient:

post_cellFsUtilMount:

if(CFW2OFW_game && !strcmp(mount_point, "/dev_bdvd/PS3_GAME"))

load_process_hooked:
if (CFW2OFW_game && !strcmp(path, "/dev_flash/vsh/module/mcore.self"))

In regards to permissions.c, multiMAN is calling sys_permissions_get_access (aka SYSCALL8_OPCODE_GET_ACCESS) when it calls cobra_lib_init(). It basically checks that it returns 0.

multiman.cpp:
View attachment 30894

cobra_lib calls stage2 through sys_permission_get_access() using SYSCALL8_OPCODE_GET_ACCESS:
View attachment 30898

View attachment 30895

In permissions.c the function sys_permissions_get_access() sets the variable access_pid with the process id of stage2.

That variable *was* used in the hook permissions_func_hook to restrict the access to cobra process. That hook is commented out.
View attachment 30899

The variable access_pid is also used in get_pid_patched() to spoof cobra process id returning vsh_process->pid;

IMO The following opcodes can be simplified like this (instead of call their original functions):

Code:

case SYSCALL8_OPCODE_GET_ACCESS: case SYSCALL8_OPCODE_REMOVE_ACCESS: case SYSCALL8_OPCODE_COBRA_USB_COMMAND: return 0; // deprecated opcodes break; case SYSCALL8_OPCODE_DRM_GET_DATA: case SYSCALL8_OPCODE_VSH_SPOOF_VERSION: return ENOSYS; // deprecated opcodes

Excellent Aldo!

I updated my repo with your changes. I'll make a new PUP with all the new improvements.

aldostools · Feb 11, 2021

Evilnat said:
Excellent Aldo!

I updated my repo with your changes. I'll make a new PUP with all the new improvements.

LOL There is are more useless code that can be removed:

In main.c
case SYSCALL8_OPCODE_MOUNT_ENCRYPTED_IMAGE:
return ENOSYS; //deprecated opcode //sys_storage_ext_mount_encrypted_image((char *)param1, (char *)param2, (char *)param3, param4);

case SYSCALL8_OPCODE_PSP_CHANGE_EMU:
return 0; // deprecated opcode // sys_psp_set_emu_path((char *)param1);
break;

In storage_ext.c these patches and functions can be removed or commented out:
int sys_storage_ext_mount_encrypted_image(char *image, char *mount_point, char *filesystem, uint64_t nonce)

LV2_PATCHED_FUNCTION(int, fsloop_open, (const char *path, int flags, int *fd, int mode, void *arg, uint64_t size))
LV2_PATCHED_FUNCTION(int, fsloop_close, (int fd))
LV2_PATCHED_FUNCTION(int, fsloop_read, (int fd, void *buf, uint64_t nbytes, uint64_t *nread))

// For encrypted fsloop images
patch_call(fsloop_open_call, fsloop_open);
patch_call(fsloop_close_call, fsloop_close);
patch_call(fsloop_read_call, fsloop_read);

In psp.c these variables & function can be removed or commented out:

char pspemu_path[36];
char psptrans_path[37];

int sys_psp_set_emu_path(char *path)

They were used by Cobra 3.55 to mount the loop device named /dev_moo containing the psp emulator of 4.00
https://github.com/aldostools/webMA...63df833b805d906f6d5/cobra/cobra.c#L2242-L2249

For legal reasons Cobra Team included the psp emulator files of OFW 4.0 in an encrypted file lambda.db in the Cobra PSP Launcher
Cobra payload no longer uses that patch and all that legacy code can be removed.

The reason of all that code is that they tested several PSP games in Cobra 3.55 and found that the compatibility was improved for some games in 4.0, but they didn't want to break the compatibility for the ones already working in 3.55. For that time OFW 4.x was already released, but the CFW users were still stuck in 3.55 because the keys 4.x were not revealed yet.

This is a list of the games improved in 4.0
https://github.com/aldostools/webMA...d1ae18d63df833b805d906f6d5/cobra/cobra.c#L173

Evilnat · Feb 12, 2021

aldostools said:
LOL There is are more useless code that can be removed:

In main.c
case SYSCALL8_OPCODE_MOUNT_ENCRYPTED_IMAGE:
return ENOSYS; //deprecated opcode //sys_storage_ext_mount_encrypted_image((char *)param1, (char *)param2, (char *)param3, param4);

case SYSCALL8_OPCODE_PSP_CHANGE_EMU:
return 0; // deprecated opcode // sys_psp_set_emu_path((char *)param1);
break;

In storage_ext.c these patches and functions can be removed or commented out:
int sys_storage_ext_mount_encrypted_image(char *image, char *mount_point, char *filesystem, uint64_t nonce)

LV2_PATCHED_FUNCTION(int, fsloop_open, (const char *path, int flags, int *fd, int mode, void *arg, uint64_t size))
LV2_PATCHED_FUNCTION(int, fsloop_close, (int fd))
LV2_PATCHED_FUNCTION(int, fsloop_read, (int fd, void *buf, uint64_t nbytes, uint64_t *nread))

// For encrypted fsloop images
patch_call(fsloop_open_call, fsloop_open);
patch_call(fsloop_close_call, fsloop_close);
patch_call(fsloop_read_call, fsloop_read);

In psp.c these variables & function can be removed or commented out:

char pspemu_path[36];
char psptrans_path[37];

int sys_psp_set_emu_path(char *path)

They were used by Cobra 3.55 to mount the loop device named /dev_moo containing the psp emulator of 4.00
https://github.com/aldostools/webMA...63df833b805d906f6d5/cobra/cobra.c#L2242-L2249

For legal reasons Cobra Team included the psp emulator files of OFW 4.0 in an encrypted file lambda.db in the Cobra PSP Launcher
Cobra payload no longer uses that patch and all that legacy code can be removed.

The reason of all that code is that they tested several PSP games in Cobra 3.55 and found that the compatibility was improved for some games in 4.0, but they didn't want to break the compatibility for the ones already working in 3.55. For that time OFW 4.x was already released, but the CFW users were still stuck in 3.55 because the keys 4.x were not revealed yet.

This is a list of the games improved in 4.0
https://github.com/aldostools/webMA...d1ae18d63df833b805d906f6d5/cobra/cobra.c#L173

Nice one @aldostools, i updated my repo with these lines commented and a few more:

storage_ext.c

Code:

//static char *encrypted_image;
//static int encrypted_image_fd = -1;
//static uint64_t encrypted_image_nonce;

Btw i tested the new 4.87.3 PUP i made with the new changes and all is working fine, i will send it via PM and i'll keep updating cobra with your improvements, and i want to take a look into more features.

There are two options that need to be tested: QA Flag and CFW2OFW converted games (You must have the physical disk, otherwise i will not send the CFW).

If there is anyone who wants to try it please reply me.

jcorrea · Feb 12, 2021

Evilnat said:
If there is anyone who wants to try it please reply me.

I want to try.
PS3 Model: CECH-2501A
FW Type: CEX
Current CFW: Rebug Lite 4.86
E3 Flasher: don't have
webMAN MOD version: 1.47.34

I will try CFW2OFW with Dark Sector. I have the disc.

Brandon Stump · Feb 12, 2021

@Evilnat After installing 4.87.3 Evilnat Cobra [CEX] [BETA v6] on a CECHA01 the fan speed shoots to 100%. I went into Fan Tools and changed it back to Manual Payload "My Setting" went into webman setup, rechecked my settings saved config and rebooted. but for some odd reason the fan keeps going back to 100?? My temps are @ around 65c when it does this "My Max Temp Setting" any one else testing have this issue? Edit: The fan goes to 100% instead of stepping up gradually 1 degree away from your max setting in webman setup.

Evilnat · Feb 12, 2021

Brandon Stump said:
@Evilnat After installing 4.87.3 Evilnat Cobra [CEX] [BETA v6] on a CECHA01 the fan speed shoots to 100%. I went into Fan Tools and changed it back to Manual Payload "My Setting" went into webman setup, rechecked my settings saved config and rebooted. but for some odd reason the fan keeps going back to 100?? My temps are @ around 65c when it does this "My Max Temp Setting" any one else testing have this issue? Edit: The fan goes to 100% instead of stepping up gradually 1 degree away from your max setting in webman setup.

Do you have webMAN MOD Control FAN enabled? If so try disabling it and try again. This happened to me before with payload mode with both Control FAN enabled

DeViL303 · Feb 12, 2021

I had the same thing. It only happened once though after initial install. Then I set it to manual and it was fine. I did not have to touch wMMs settings.

BTW what is the difference between "Disabled" and "Syscon" in fan settings. ?

Brandon Stump · Feb 12, 2021

Evilnat said:
Do you have webMAN MOD Control FAN enabled? If so try disabling it and try again. This happened to me before with payload mode with both Control FAN enabled

That must have been what it was, I went and Unchecked Dynamic fan control in webMAN but left all of my temp setting alone, saved settings and rebooted. I then went into Cobra Tools\Fan Tools and set it to Cobra Payload. It is now running a dynamic style setting without shooting to 100%. webMAN is now showing its using SYSCON when using Show Temp shortcut from XMB.

Evilnat · Feb 12, 2021

DeViL303 said:
I had the same thing. It only happened once though after initial install. Then I set it to manual and it was fine. I did not have to touch wMMs settings.

BTW what is the difference between "Disabled" and "Syscon" in fan settings. ?

Maybe Cobra is setting MAX speed when Cobra config is not updated or must be Cobra or webMAN conflict nothing more, but don't worry your PS3 is safe and is not overheating.

Disabled means that Cobra doesn't change/set FAN speed at startup and Syscon let the PS3 to control the FAN speed.

I want to reproduce this issue in my PS3, can you tell me what steps did you do? Installed CFW with webMAN MOD enabled/fan control? Maybe i need to delete my Cobra config and install CFW after that

Brandon Stump said:
That must have been what it was, I went and Unchecked Dynamic fan control in webMAN but left all of my temp setting alone, saved settings and rebooted. I then went into Cobra Tools\Fan Tools and set it to Cobra Payload. It is now running a dynamic style setting without shooting to 100%. webMAN is now showing its using SYSCON when using Show Temp shortcut from XMB.

Cool, maybe there was a conflict with webMAN MOD Dynamic FAN control or an issue while Cobra config has not the size of the new Cobra 8.3 when a new PUP is installed.

webMAN and Cobra use different config files (i think webMAN loads Cobra config too).

aldostools · Feb 12, 2021

Evilnat said:
Maybe Cobra is setting MAX speed when Cobra config is not updated or must be Cobra or webMAN conflict nothing more, but don't worry your PS3 is safe and is not overheating.

Disabled means that Cobra doesn't change/set FAN speed at startup and Syscon let the PS3 to control the FAN speed.

I want to reproduce this issue in my PS3, can you tell me what steps did you do? Installed CFW with webMAN MOD enabled/fan control? Maybe i need to delete my Cobra config and install CFW after that

Cool, maybe there was a conflict with webMAN MOD Dynamic FAN control or an issue while Cobra config has not the size of the new Cobra 8.3 when a new PUP is installed.

webMAN and Cobra use different config files (i think webMAN loads Cobra config too).

I think the problem is the checksum in config.c of Cobra payload. I removed that check in my fork & Mamba, because it cause conflicts with legacy applications that write to cobra config file but use an old structrure.

// if (config.size > 4096 || checksum(&config) != config.checksum)
// memset(&config, 0, sizeof(config));
// else
check_and_correct(&config);

jcorrea · Feb 12, 2021

Evilnat said:
Do you have webMAN MOD Control FAN enabled? If so try disabling it and try again. This happened to me before with payload mode with both Control FAN enabled

I had the same behavior here, but after disabling webMan MOD Control FAN, everything is fine. I already test QA Toggle, and it works well. I will test CFW2OFW tomorrow.

DeViL303 · Feb 12, 2021

Evilnat said:
I want to reproduce this issue in my PS3, can you tell me what steps did you do? Installed CFW with webMAN MOD enabled/fan control? Maybe i need to delete my Cobra config and install CFW after that

Yeah that was it basically, I has the latest webMAN MOD 1.47.34 running and set to auto fan control, then I installed the 4.87.3 PUP, first boot up it went to 100% speed.

In webMAN cpursx page it was still showing 27% speed, but I could hear it was at 100%. Then I chose manual in your custom firmware settings and it was fine after that.

Brandon Stump · Feb 12, 2021

I as well had the latest webMAN MOD 1.47.34 set to Dynamic to maintain a 65c degrees CPU/RSX temperature, with the min. fan speed set at 30% and PS2 fan speed set @ 35%. I installed 4.87.3 Evilnat Cobra [CEX] [BETA v6] via normal usb update method, first boot up and every boot up after fan went to 100% speed, it would even change to 100% fan speed when the CPU/RSX temperature would reach 64c. Going and turning off Dynamic Control in webMAN did fix the issue.

Evilnat · Feb 12, 2021

Brandon Stump said:
I as well had the latest webMAN MOD 1.47.34 set to Dynamic to maintain a 65c degrees CPU/RSX temperature, with the min. fan speed set at 30% and PS2 fan speed set @ 35%. I installed 4.87.3 Evilnat Cobra [CEX] [BETA v6] via normal usb update method, first boot up and every boot up after fan went to 100% speed, it would even change to 100% fan speed when the CPU/RSX temperature would reach 64c. Going and turning off Dynamic Control in webMAN did fix the issue.

If you disable webMAN Dynamic Fan Control and install the CFW, the fan speed is setted to max speed too? I wil ltest it tomorrow,
I need a rest tonight.

Thank so much to all who have tried it

OPUS · Feb 12, 2021

When it says SEN/PSN enabled, does that mean that you don't need to use PSN Patch?

Or does it mean that you can use PSN while the CFW is running, if you get what I mean

Coro · Feb 12, 2021

OPUS said:
When it says SEN/PSN enabled, does that mean that you don't need to use PSN Patch?

Or does it mean that you can use PSN while the CFW is running, if you get what I mean

it onlys means that you can connect to psn. it does not provide any anti-ban measures. you still need psnpatch (or something) to protect your PS3.

Evilnat · Feb 13, 2021

Issue found and fixed, it was a bad patch while i was researching with IDA, now is working as expected. I will send the CFW via PM in a few minutes.

EDIT: Sent

SpyroMancer · Feb 13, 2021

can't wait for the final release. all this sounds so promising.

jcorrea · Feb 13, 2021

I downgraded to Rebug Lite 4.86 to try CFW2OFW and see the problem happening with a disc in tray, but the CFW2OFW worked flawlessly even on Rebug. Is this the correct procedure to try to reproduce the problem?

Edit: Nevermind, I found how to reproduce the problem. Thanks.

aldostools · Feb 13, 2021

jcorrea said:
I downgraded to Rebug Lite 4.86 to try CFW2OFW and see the problem happening with a disc in tray, but the CFW2OFW worked flawlessly even on Rebug. Is this the correct procedure to try to reproduce the problem?

Some CFW2OFW seem to work with another game mounted, while others don't. Maybe you're testing one of the games that don't suffer of this issue (e.g. I tried Uncharted and it also worked). The problem was originally reported by @UFC3 in this thread:
https://www.psx-place.com/threads/w...folder-mounted-cfw2ofw-games-dont-work.30312/

@Evilnat I'm not sure if you're interested in implement the spoof ISO as PNG as explained in this PoC:
https://www.psx-place.com/threads/messing-with-cobra.32592/page-7#post-277855

The change basically involves the use of a new variable base_offset in storage_ext.c, psp.c and ps2emu_stage2\common\common.c
https://github.com/aldostools/COBRA/blob/master/487/REX/stage2/storage_ext.c#L147
https://github.com/aldostools/COBRA/blob/master/487/REX/stage2/psp.c#L23
https://github.com/aldostools/COBRA/blob/master/487/REX/ps2emu_stage2/common/common.c#L16

The variable is set to 0 and when a .PNG is mounted, the value changes to 0x10000 (64KB).
So every cellFsLseek will read 0x10000 ahead of the original position when the .PNG is detected.

The idea is to skip the first 64KB of the PNG/ISO (like LIMG does in .BIN.ENC), In that 64KB we store the ICON and optionally CONFIG, CUE Sheet, PARAM.SFO,etc. As the header of the file is a PNG, the XMB recognize the file as such allowing use to copy, rename, delete and view the file directly on XMB as a picture but that can be mounted using PhotoGUI feature.

PS3 4.88.2 Evilnat Cobra (8.3) Custom FirmWare (CFW-CEX) Released

Evilnat

aldostools

Evilnat

jcorrea

Brandon Stump

Evilnat

DeViL303

Brandon Stump

Evilnat

aldostools

jcorrea

DeViL303

Brandon Stump

Evilnat

OPUS

Coro

Evilnat

SpyroMancer

jcorrea

aldostools

Similar threads

Featured content

Trending content

Latest posts