PS3 4.89 Jailbreaking - PS3 CFW (Custom Firmware Capable Models) Status + Warnings

[GuilloteTesla]

I'm guessing soft modding Metldr2 will be impossible for a long while after discovery on hard modding? @aldostools @GuilloteTesla

Softmodding metldr.2 is not possible because there are no known flaws in the security.

The only hope would be to use MikeM64's MITM exploit and try to get the private keys from lv0ldr. With those keys, it could then be possible to resign any update PUP and bypass the security checks on the PS3 system update feature (the console would think that the signed PUP is legit).

Here is a drawing of the 3.60 bootchain: https://www.psdevwiki.com/ps3/Boot_Order#Changes_in_firmware_3.60

And here is a very nice and thorough explanation from one of the cracks himlself, Marcan from team fail0verflow: https://wololo.net/2012/10/25/clarifying-the-confusion-on-the-ps3-development/comment-page-1/

 

[STLcardsWS]

Regarding metldr2
Software is no go as mentioned above, if there was a software solution we would not be having people try with a hardware solution.
Which in the current state is only a theory that has not been confirmed and a theory that is not new at all just has never been
put into practice at least in the public
@zecoxao and ZeroTolerance have been working and detailing the progress. There has been some hiccups and learning from it
but it still has to be proven to be viable. That is what the research being done by them is providing. It could prove to be right or proved to be wrong.That is what they are trying to figure out.

 

[NiQ]

Regarding metldr2
Software is no go as mentioned above, if there was a software solution we would not be having people try with a hardware solution.
Which in the current state is only a theory that has not been confirmed and a theory that is not new at all just has never been
put into practice at least in the public
@zecoxao and ZeroTolerance have been working and detailing the progress. There has been some hiccups and learning from it
but it still has to be proven to be viable. That is what the research being done by them is providing. It could prove to be right or proved to be wrong.That is what they are trying to figure out.

Even if it does turn out to be viable I doubt it'd justify the price. HEN is probably good enough for 90% of the people and the other 10% can get a cheap 21xx from eBay.

 

[NiQ]

You're wrong about that. If you add "README.md" to the URL of the russian site you will find the README from your github.
View attachment 39301

They only personalized your dump for 4.89, translated the text to Russian and replaced the QR codes with ones for their pockets.

That site only has the nofsm for 4.89 and removed the checks for other previous FW versions. Making that site extremely dangerous.

You did it wrong... but what Russians did (and other cloners) is worse -one year later. You at least didn't put the code as a public service.

It is valiant from you to recognize that you did it wrong. However, removing the repository now doesn't solve the damage already made.

Well imho I do believe that ajgon had good intentions when took that dump. He never claimed that he wrote this and he even encouraged people to donate to ps3xploit. I don't think it's the public service or not that makes what the Russians did worse but rather the fact that they removed all credits to bguerville and take donations into their own pockets - And I don't think ajgon thought about that possibility (although retroactively one may consider it to be obvious).
Also mind that bgtoolset was still until October using custom DNS tricks to even if that dump wasn't available on github they could've dumped it themselves.

P.S.
I know it's a bit unrelated but I'm puzzled why they'd keep only the 4.89 nofsm patch and make their clone even more dangerous than it needs to be, seeing that the original dump has all the patches.

 

[aldostools]

Well imho I do believe that ajgon had good intentions when took that dump. He never claimed that he wrote this and he even encouraged people to donate to ps3xploit. I don't think it's the public service or not that makes what the Russians did worse but rather the fact that they removed all credits to bguerville and take donations into their own pockets - And I don't think ajgon thought about that possibility (although retroactively one may consider it to be obvious).
Also mind that bgtoolset was still until October using custom DNS tricks to even if that dump wasn't available on github they could've dumped it themselves.

P.S.
I know it's a bit unrelated but I'm puzzled why they'd keep only the 4.89 nofsm patch and make their clone even more dangerous than it needs to be, seeing that the original dump has all the patches.

I agree with you in parts. @ajgon had good intentions, made a good job dumping the tool and documented what doesn't work.
But still there were bad decisions: dumped bgtoolset without ask permission (technically it was stolen), made the repository public.
We must remember that bgtoolset doesn't has a copyleft license. Therefore it is a private asset, even if it is free software.

On the other hand, the Russians acted in a deceiving and irresponsible way:
made public an INCOMPLETE service, removed security checks making the tool DANGEROUS, changed QR and credits as THIEVES, refused to shutdown the service resulting in immeasurable DAMAGE to the community. Even worse is that ignorant people still sell them as the "saviors".

I don't understand why you're puzzled: these Russian kids don't know what they are doing. They are just looking for profits from the hard work of others (ajgon's work included).

 

[NiQ]

I don't understand why you're puzzled: these Russian kids don't know what they are doing. They are just looking for profits from the hard work of others (ajgon's work included).

Well the only thing that puzzles me is that they did extra work removing the 4.80 - 4.88 nofsm patches and safety checks, making the tool a lot more dangerous, whereas if they just hadn't touched it at all and kept it the way it was in the dump it would've been a lot safer.

 

[STLcardsWS]

Well the only thing that puzzles me is that they did extra work removing the 4.80 - 4.88 nofsm patches and safety checks, making the tool a lot more dangerous, whereas if they just hadn't touched it at all and kept it the way it was in the dump it would've been a lot safer.

That is what you are not understanding, they did not remove the security.
The dump did not contain those aspects and other's things, that is why we have always called it INCOMPLETE and DANGEROUS.
That is why bguerville warned us.

 

[RoboKing's Cosmos]

Metldr = Heavy Cannon Tiger Tracks
Metldr2 = Tank Killer Panther Hover

 

[kostirez1]

Well the only thing that puzzles me is that they did extra work removing the 4.80 - 4.88 nofsm patches and safety checks, making the tool a lot more dangerous, whereas if they just hadn't touched it at all and kept it the way it was in the dump it would've been a lot safer.

That is pretty easy to explain - they had to. As to what exact changes they made between August and today, that is impossible to know, as they made them silently and regularly. It basically comes down to the fact that 4.89 was not around at the time that clone was made. That meant it could not recognize that version, nor it had the proper noFSM patch. What does a smart Russian kid do in that case? Well, they told it that versions below 4.89 are the same as 4.89, finally making it possible to hit that "load patch" button - with noFSM patches made for older firmwares. Hurray, the day is saved! Except that writing old patches to a newer firmware causes the console to fail at the very start of the boot sequence. You can't even get to the recovery/safe mode to partially restore the flash contents in that case, a total brick. Lots of consoles died that way. Most, if not all of them, won't be recovered ever again. But they don't care, as Russians say "nas mnogo" / "нас много" (there's enough of us - we don't fear death).

Later, they obtained the right noFSM patch for 4.89, and made it to use that instead. That still wasn't enough, however. Post 4.88 versions of the code contain lots of new features, that are not present in their old clone. Also keep in mind that there are custom per-visit per-firmware version flash player scripts, and they are encrypted. BGToolset has enough information at that point, that it can customize the contents. All the offsets and searched patterns are of course wrong if you load it on a different console, running a completely different firmware version. And, of course, with unexpected changes to the checks that are executed both before and after the exploit part. That's the reason why you can never do a proper dump of the code, nor you can patch it yourself later. You are only changing its behavior in unexpected ways in that case, adding new and unknown variables into the mix.

If all of that isn't bad enough, keep in mind that they also have full access to your hardware. You are always at their mercy, always praying they won't send you somehow modified code. But we know for a long time that they do...

 

[Impaler]

I wonder what prevents BG from taking his creation back online and end this stolen russian nonsense once and for all?

Don't get me wrong, I'm thankful for that tool and I'm happy I managed to CFW my both consoles. But how many months has it been? Guess its not a priority for him. Fingers crossed for 2023.

 

[NiQ]

I wonder what prevents BG from taking his creation back online and end this stolen russian nonsense once and for all?

Don't get me wrong, I'm thankful for that tool and I'm happy I managed to CFW my both consoles. But how many months has it been? Guess its not a priority for him. Fingers crossed for 2023.

He said he has family issues. He did not elaborate any further but mind that

 

[PeterPetrelli19]

As I am currently waiting for the tool to get back online, I hope this gets solved soon. I recognize that everyone wants to keep a copy and not rely on a website that can go down any minute. At least it bothers me with Hen.
If they changed QR, and everything it is clearly stealing.
But keep in mind that right know they or other sites that have dangerous clones are the only alternative and some of us are not willing to buy a new PS3, we just wanna use ours. Not everyone is willing to wait so much time without any news.
Hope eveything with family turns right and he comes back soon.

.

 

[atreyu187]

As I am currently waiting for the tool to get back online, I hope this gets solved soon. I recognize that everyone wants to keep a copy and not rely on a website that can go down any minute. At least it bothers me with Hen.
If they changed QR, and everything it is clearly stealing.
But keep in mind that right know they or other sites that have dangerous clones are the only alternative and some of us are not willing to buy a new PS3, we just wanna use ours. Not everyone is willing to wait so much time without any news.
Hope eveything with family turns right and he comes back soon.

.

If it was a simple and easy as everyone thinks then why haven't you all done it yet. There is a TON of stuff that happens outside of the end users sight. It is a pretty thankless job if you ask me. If you worked hundreds of hours to develop something and share with the community free of charge only to hear or see ETA WEN over and over again would bring my development to a crawl.


People have lives & this isn't a one man show. Takes time to get even the best laid plans done. You all have options same ones we had when it first happened a hardware flashers which we had to use for 6+ years. I understand it isn't free so in the case they were nice enough to update HEN which let's be honest does what 98% of the end users need asode from a persistent hack. Much like the PS4, PSP & until recently the Vita as well if over 3.65.


So it isn't that bad I think your expectations are what needs to be worked on. They will do it when they can but it is things like this why Rebug isn't doing the PS3 anymore and has driven away quite a few other devs. If people think it is as easy as just hosting the info needed for you all to do this for the community is and has been public for ages. If not again a hardware flasher & HEN will do what you need. Maybe not a perfect as you had hoped but we live in an imperfect world. You can also use the other sites and risk your system if you need CFW & do not want to spend $60.


So EVERYONE has plenty of options more so then most of the PS3's past. I mean we thought above the 2500 was a pipe dream but here we are. I understand it isn't ideal but thems the breaks folks. You and the 2500 other guys before you get you want the quality that comes with BG Toolset but no one is helping consistently asking. So chill a bit, enjoy what you have or do something about it yourself. The ONLY life we have control of is our own. So if it isn't going your way it's up to you and you alone to find out what works for you. Not trying to be rude just this is beyond beating a horse to death. Quality & quick never go in the same sentence. This is why the Russian sites pose a risk.

 

[PeterPetrelli19]

I recognize the comunity work, and that is why I'm not taking my chances with them. My PS3 was resting from long time ago, and I don't mind waiting, it works for me but as I say everybody has a limit.
I'm chill honestly, just expressing my concern that there's been a few months and few news... just that. I know everybody has issues, and I wish everything turns out ok, can't say it louder.
I'm a programmer and I know how "end users" are. I wish I could help somehow but C is not my area...

 

[atreyu187]

I recognize the comunity work, and that is why I'm not taking my chances with them. My PS3 was resting from long time ago, and I don't mind waiting, it works for me but as I say everybody has a limit.
I'm chill honestly, just expressing my concern that there's been a few months and few news... just that. I know everybody has issues, and I wish everything turns out ok, can't say it louder.
I'm a programmer and I know how "end users" are. I wish I could help somehow but C is not my area...

Not trying to lay it all at your feet. The reason it taking so long is life, coordinating all the private testing for each model ensuring it is as safe as possible. It's very disheartening to a lot of the devs and seen quite a few gravitate away from the PS3 scene. He has always been a man of his word but life enebr goes as planned. There's been some pretty snide people not saying you by any means but I assure everyone they're not just holding it back to hold it back.

 

[NewCat]

Not to undermine any of BG's hard work but personally I think in an outdated scene like ps3 it's proven to be really hard to get a perfect solution with everything/all model tested out by themselves. It puts a huge burden on his back given there're tons of different scenario out there I'm not even sure if it's possible to cover everything like he wants to.

I wouldn't mind a more community approach, where BG could put his tool back up in 2 packages, one is perfectly safe and tested which would get updated slowly depend on his own private testing and community testing, and the other would have some risk but if the user is willing and capable of unbrick their ps3 they can still use it and report back. Given right now ppl in the second group can simply use the russian site (and unbrick their console if it happens), but none of their finding would help BG's testing effort whatsoever, and ppl who can't risk it would have to keep waiting with no update for months (and this is what I think would drive ppl away from the scene even more)

 

[kostirez1]

where BG could put his tool back up in 2 packages, one is perfectly safe and tested which would get updated slowly depend on his own private testing and community testing, and the other would have some risk but if the user is willing and capable of unbrick their ps3 they can still use it and report back

Releasing software in "long-term support" / "stable" and "testing" / "beta" versions is pretty common for most projects. You can look at web browsers like Chrome or Firefox, where you can get some features months or years before it makes it to the stable release. And maybe it's not a huge issue if your browser crashes once or twice a week, making it a good compromise.

What makes this not optimal for projects like this one are the risks involved with the hardware crashing unexpectedly. It's statistically very likely to cause a brick, given that you spend a large portion of the time manipulating flash contents. Unfortunately, giving warnings isn't enough for this community (language barriers, kids that overlook risk, etc.). A good example of this are BGToolset clones, where it came from "this is an unsafe dump" to "don't worry, this is a fully working mirror" in just a few weeks. Then there are people who make videos about this stuff, where you are motivated to be the first one who posts it to get the most views. Obviously, it always ends up with users doing stuff they shouldn't have, and filling support threads with calls for help - resulting in the exact opposite of what the developer intended.

Given right now ppl in the second group can simply use the russian site

From my experience and observations, there wasn't a single person in this group who had a hardware flasher... And even if they did, it doesn't make much sense to run unknown code on the console when you can do a dump, patch and flash it manually. It may just be my opinion, but I don't think this group as described actually exists.

but none of their finding would help BG's testing effort whatsoever, and ppl who can't risk it would have to keep waiting with no update for months (and this is what I think would drive ppl away from the scene even more)

Now imagine how heartbreaking it must be for the developers. Nothing in this world is free, so if you get some service for no payment, it means that someone else must have paid for it. Some developers do it to get experience, so they can then offer similar work for money. Others can get at least some of the costs back from donations. One thing is common, however - no one had ever received enough to make it even remotely profitable.

What would be the motivation for Bguerville to continue developing it at this point? It's not like he gets any value out of it (compared to caring for his family and/or working for money), especially after so many people made clones and tried to get credit for his masterpiece. Would he continue the development just so others could steal his work again? That wouldn't make any sense.

Personal opinion: I don't consider people who are in just to pirate stuff as a part of the community, or that they provide any value for the scene. Keep in mind that this is the same group that betrays you at the first opportunity they get. "There is no honor among thieves" describes this perfectly. That said, they do real damage for everyone involved, unfortunately.

 

[PeterPetrelli19]

Nothing in this world is free

Strongly disagree, just look arround.

What would be the motivation for Bguerville to continue developing it at this point?

Interesting question, but I think is another topic as the software is already done, so maintaining is (should) not (be) as hard. I know there's many models and everything.
I think people that made the clones are not here... anywhay I'm new so I don't know much...
One thing is for sure, people who already donated do not have the tool either.

 

[NiQ]

Strongly disagree, just look arround.
Interesting question, but I think is another topic as the software is already done, so maintaining is (should) not (be) as hard. I know there's many models and everything.
I think people that made the clones are not here... anywhay I'm new so I don't know much...
One thing is for sure, people who already donated do not have the tool either.

"The people who made the clones" is actually not a single entity.
There was some dude who dumped the website initially and posted it on GitHub (removed since). That was done without consulting or asking permission from Bguerville and there was a chance of it not working or resulting in a brick because he did not know the code inside out like the original author. Still, at least he did not remove any credits, donation links etc. and made it very clear that it might not be safe to use in all cases, so you could say it was done in good faith but nevertheless it was done without permission. That dude was here about a month ago. He got scolded a little but afaik he's not banned from the forum.
Then there are those Russian guys, who just took the dump from GitHub, changed the donation links so donations go to their own pockets, made the clone even riskier by keeping only the 4.89 ROS patch and removing safety check that were there for a reason (with one result being that any attempt to flash a console on a FW version other than 4.89 results in a brick) and uploading their clone to a public website. Obviously they never made their identities known.