PS3 I did it! Offline HTML from the Browser

Wow!
What is that? Seems like the AOL browser. How do we get to it though?

@sandungas , there is a ton of CEMenu and CEDialogs now for reversing. One of the CeMenus has debug strings, Dump DOM Document... hah neat!!

The file:// protocol will not work with the standard browser. I told you guys already, the protocol is disabled by default.
To enable local file support, you must first

1. init the browser using the web browser utility through homebrew or ROP
2. create a browser config structure which includes the param for local file support
3. pass the config to the browser object
4. start the browser in browser/js compatible mode

All the info can be found in the Web Technology section of the SDK documentation.
Where could we find the info? It's possible that file: can be enabled somehow in debug mode. In fact, I am certain the the web browser has another hidden test menu somewhere (just like ps2emu has) but I do not know how to access it.

EDIT: Found some debug loggin, JS logging, certificate checking...
Edit2: Save webpage...
 
Where could we find the info? It's possible that file: can be enabled somehow in debug mode. In fact, I am certain the the web browser has another hidden test menu somewhere (just like ps2emu has) but I do not know how to access it.
its in sdk docs, which we cannot link to. but i was browsing them and as @bguerville said, there is a whole section that does explain that part in detail for developers :)

debug mode i am not sure...we tested this before and someone even posted something about dumping logs to usb, before exploit was released...but my mind is foggy!

EDIT:

we may be able to enable debug mode on browser similar to how the Debug Settings and HAN installers work, by replacing with DEX files, but not sure if these files are actually available for replacement
 
debug mode i am not sure...we tested this before and someone even posted something about dumping logs to usb, before exploit was released...but my mind is foggy!
Oh yeah, that was me lol , http://www.psx-place.com/threads/ps3-browser-debugmenu.15134/

EDIT:

we may be able to enable debug mode on browser similar to how the Debug Settings and HAN installers work, by replacing with DEX files, but not sure if these files are actually available for replacement
Seems like a nice idea, to try and swap with DEX files but I wonder my I did not see
CEHTMLBrowserApp.bin
CEHtmlBrowserAppXaiWidget.bin
In silk in Rebug 4.82. Have they been deleted?
 
Im wondering if the CEHtmlBrowserAppXaiWidget.bin with the CEMenu added in firmware 4.82 are there because they was trying to debug how the ps3exploit published for 4.81 was working... but after the debugging they forgot to disable/remove all this files and menues and published 4.82 with it (thx, nice new feature, just in time)

It looks like the web configuration menu of a router with lot of checkboxes that can be enabled/disabled
But most probably is a debug config menu for the web browser (or more than one, made with several pages)
 
Im wondering if the CEHtmlBrowserAppXaiWidget.bin with the CEMenu added in firmware 4.82 are there because they was trying to debug how the ps3exploit published for 4.81 was working... but after the debugging they forgot to disable/remove all this files and menues and published 4.82 with it (thx, nice new feature, just in time)

It looks like the web configuration menu of a router with lot of checkboxes that can be enabled/disabled
But most probably is a debug config menu for the web browser (or more than one, made with several pages)
But how do we access it? From the extracted images we can see how it looks, but again , how do we access such a thing?

Btw, nice theory. It's possible that they disabled logigng to .txt aswell.
 
I think are files that existed long time ago, is just never was included in official CEX firmwares (not sure if in others)
If is the AOL browser, do you think they was going to add it for first time in 4.82 with an icon with the logo and everything ?... i dont think
Most probably is very old (like the other weird icon esc0rtd3w posted the other day of a guy with a key made in "windows 95" 16 colors resolution), is ancient stuff, lol

I cant imagine how to make it appear though


Edit:
I meant, look at the quality of the image of the guy with the key:
upload_2018-9-25_22-49-26-png.13413

Most probably is from year 2006 or so, and is not supposed to be visible in the modern versions of the PS3 web browser (because looks like crap)
Probably was added since firmware... dunno 1.00... and never was used or updated, so they "forgot" to remove it (not exactly forgetting, this is very typicall, they doesnt likes to delete stuff just incase they needs it later at some point)

Same stuff with the AOL logo, are very old images
 
Last edited:
I think are files that existed long time ago, is just never was included in official CEX firmwares (not sure if in others)
If is the AOL browser, do you think they was going to add it for first time in 4.82 with an icon with the logo and everything ?... i dont think
Most probably is very old (like the other weird icon esc0rtd3w posted the other day of a guy with a key made in "windows 95" 16 colors resolution), is ancient stuff, lol

I cant imagine how to make it appear though


Edit:
I meant, look at the quality of the image of the guy with the key:
upload_2018-9-25_22-49-26-png.13413

Most probably is from year 2006 or so, and is not supposed to be visible in the modern versions of the PS3 web browser (because looks like crap)
Probably was added since firmware... dunno 1.00... and never was used or updated, so they "forgot" to remove it (not exactly forgetting, this is very typicall, they doesnt likes to delete stuff just incase they needs it later at some point)

Same stuff with the AOL logo, are very old images
True, but how come we got only those 2 extra .bins in the 4.82? Are they trolling us?
These could very well be placeholders for something. We have to keep digging.
 
screenshot from CEX FW 1.02 under /vsh/resource/silk/data

upload_2018-9-29_20-20-19.png


EDIT #1:

ill post the other FW bins just for research purposes

EDIT #2:

2.17 was last version to find CEHtmlBrowserApp.bin and CEHtmlBrowserAppXaiWidget.bin

CEHtmlBrowserApp.bin and CEHtmlBrowserAppXaiWidget.bin removed in 2.20

silk_nas was added in 2.20

EDIT #3:

those files (CEHtmlBrowserApp.bin and CEHtmlBrowserAppXaiWidget.bin) are NOT in 4.82 @sandungas @NewFile @Joonie , i must have put them there or something while testing lmao....sorry about that :)

ill fix 4.82 zips also and post others

silk_data_102_cex.zip
silk_data_217_cex.zip <- last to have extra 2 bins
silk_data_220_cex.zip <- first to have silk_nas
silk_data_401_cex.zip <- last to not have silk_webkit

EDIT #4:

interestingly, there is another file (CEHtmlBrowserAppXaiWidget.xmi) that accompanies the bins found in "/vsh/resource/silk/bin/" under 1.02, presumably until 2.17.

its an XML file

yNtJ8QT.png

4a4Y70b.png
 
Last edited:
There is an small detail related with how the files are updated, it can be seen in webcoreapp.bin 4.82
Most probably... webcoreapp.bin was updated (at least) one time for every group of languages added to the firmware
http://www.psdevwiki.com/ps3/Languages
So we have updates of webcoreapp.bin in 1.50, 1.60, 3.10, 4.00, 4.30

More interesting... look at the second string of webcoreapp.bin where appears a long list of the languages with the "letter codes":
en, ja, de, es, fr, it, nl, pt, ru, ko, zh-tw, zh-cn, fi, sv, da, no, pl, en-uk, pt-br, tr

And compare it with the order of the languages in the table in wiki, doesnt matches

Is because the new entries added in webcoreapp.bin are always cummulated at the bottom of the file (so the position of the older entries is respected)
But the language groups (an update adding several languages in the same firmware) are ordered alphabetically

The first languages added to the web browser was "en" and "ja" in firmware 1.00
And the next language that was added in firmware 1.50 should be french (because is number 02 in the firmware)... but inside webcoreapp.bin the third language is "de"
Because alphabetically "de" goes before "fr"

The language group that was added in firmware 1.50 was: de, es, fr, it, nl, pt, ru (ordered alphabetically inside webcoreapp.bin)

I did not checked this much to be completly sure that what im saying is right, but is something like this
And it seems this way can be identifyed which language is the owner of every string
If i remember right, there are other files where you have the same string with all the language codes located in the top positions of the list (entry number 2 or 3 usually)
The order of the language codes in that string indicates the order of all other text strings of the file (and indirectly the order of how the file was updated)
 
Last edited:
Most probably is from year 2006 or so, and is not supposed to be visible in the modern versions of the PS3 web browser (because looks like crap)
Probably was added since firmware... dunno 1.00... and nev
Based on @esc0rtd3w m firmware 1.02 and around 2006 we can say that they were used early on.

EDIT #2:

2.17 was last version to find CEHtmlBrowserApp.bin and CEHtmlBrowserAppXaiWidget.bin

CEHtmlBrowserApp.bin and CEHtmlBrowserAppXaiWidget.bin removed in 2.20

silk_nas was added in 2.20
So these files were merged and out of it came silk_nas? What does nas stand for?

interestingly, there is another file (CEHtmlBrowserAppXaiWidget.xmi) that accompanies the bins found in "/vsh/resource/silk/bin/" under 1.02, presumably until 2.17.
Some of the settings in there can be found in CEMenu of those bin files. So that xmi files was supposed to be changed from within the browser.

More interesting... look at the second string of webcoreapp.bin where appears a long list of the languages with the "letter codes":
en, ja, de, es, fr, it, nl, pt, ru, ko, zh-tw, zh-cn, fi, sv, da, no, pl, en-uk, pt-br, tr

And compare it with the order of the languages in the table in wiki, doesnt matches
It does not match because webcoreapp is sorting them based on the ID value starting from 0 to 34050 and not by the two digit language code.

The first languages added to the web browser was "en" and "ja" in firmware 1.00
And the next language that was added in firmware 1.50 should be french (because is number 02 in the firmware)... but inside webcoreapp.bin the third language is "de"
Because alphabetically "de" goes before "fr"
de does go before fr but like I said abov,e they are ordered by the 5 digit code. They are not sorted alphabetically because "da" should be close to "de" and yet it's aftr zh-tw/
 
here are the updated Silk Data dumps from 1.02 - 4.82. this way it should be easy to see changes, additions, deletions, etc.

silk_data-multi-102-401-cex.zip <-- Pre-Webkit Files
silk_data-multi-410-482-cex.zip <-- Webkit Exploit Supported

Full Dump w/Everything: silk_data-multi-102-482-full-cex.zip

Shared Folder: http://www.mediafire.com/folder/uu6g12228jbij/silk_data


EDIT #1:

Great job @NewFile on updated SILKPAD Editor, the extraction works well :)

Samples from 1.02 fw
CEPhWeb
EfmY9d5.png


CEFramework
3u8StoI.png


CEHtmlApi
pZgNfdL.png


CEHtmlBrowserApp
gIF6tuZ.png


CEHtmlBrowserAppXaiWidget
myVzCI3.png


CEHtmlUI
jdyRBny.png

also, kudos on the menu and dialog extraction :-p
 
Last edited:
A brainstorming i just had... im going to write the deductive process that took me to this idea because otherway, if i only write a single line with the theory you are going to be a bit like "wtf, you build that theory from smoke" (and you would be correct), but i want to explain it a bit

I was thinking in the pages in wiki if creating one with the name "silk container", and the name SILKPADD
One thing im sure you agreee with me is the name SILKPADD is composed by 2 parts, we know "silk" is a codename, and the "magic" names are usually 4 bytes too... so ok, lets remove the SILK and think about what means PADD
While thinking if the new wiki page could be grouped with other "containers" formats it came an question to mind

Why there is not a "C" in the "PADD" ?
Most containers have one, i know this is not a golden rule, but then the next idea came to mind... what if SILKPADD is not a container ?
The SILKPADD fileformat is simple, doesnt even allows for any type of compression like most other containers

Ok... lets follow that road from the beggining... so SILKPADD is not a container... and SILKPADD is the PADD of SILK (SILK owns the PADD)... but what is "the PADD" ?

And then... i had a transcendental experience where mr. sony told me the truth

PADD is composed by 2 words, there are 3 ways to dedicate characters for 2 words:
-PAD D
-PA DD
-P ADD !!! Is typical in composed codenames to use only the first character of the first word, and severals characters of the second (as example, for "sandungas brainstormings" in 4 characters SBRA)

P = program
ADD = address

So... SILKPADD is the Program ADDress of SILK (the web browser)
So... the IDs associated with the entries in the index of the SILKPADD fileformat are the addressess ?
Addresses of the program memory ?


---------------
Edit:
Ok... lets follow that road from the beggining... so SILKPADD is not a container
Lets complete the conspiracy from this point and asume for a moment that SILKPADD is not a container
The concept of what is a "container" is a bit subjetive i guess, we cant be sure

But the way i see at it now is better defined as a "memory map", not an exact 1:1 copy of memory, but a list that indicates where the datas are going to be "copypasted" to memory
This is why some of the datas (CEMenu, CEdialog) are very complex


-------------------
Edit2:
Hmmm, as i mentioned in other post before (but i was not explicit enought, sorry) every "children" of the CEDialog have an unique ID
This is an additional ID (not located in the index like the others shown in the "silkpadd editor" made by NewFile)

Lets say... we have a CEDialog, with an ID in the index (lets call this one the "main ID")
And CEDialog have 2 childrens named CEButton
What i was trying to explain is this CEButton has his own unique ID
Incase it had more childrens, all them would have unique IDs, without exception. It can be said that everything under the CEDialog hierarchy seems to be accuratelly mapped using unique IDs

Maybe this IDs are used also as "memory address positions" where every one of them needs to be copypasted
As far i remember for the few time i was looking at this... all this IDs are consecutive, and increases in a amount of 1 each
As example... 234, 235, 236, and so on
 
Last edited:
duh..i totally forgot about this lmao :rolleyes:

we can enable browser debug with CEX Debug Settings

Actually those settings seem to be do nothing more than setting the value of a xsetting in xRegistry.sys
It seems to be the XMB, or whatever responsible that allows us to change the engine, Silk and Webkit.
Webkit is the normal browser that we have all used. No changes whatsoever, other than DEBUG text in the bottom right and option of selecting Engine and User Agent.

Browser Debug sets /setting/browser/debugMenu to 1 (enable)
/setting/browser/browserType can have either 0 or 1 where:
0 - Webkit
1 - Silk

Setting:
/setting/browser/ifilter set to 1
/setting/browser/trendEnable set to 1
/setting/browser/trendEula set to 1
/setting/browser/trendRegistered set to 1
/setting/browser/trendTtl set to 1

Will force the browser to go to TrendMicro website for further registration. However, another logo appears in the top right. TrendMicro is indeed activated.

Next up is:
/setting/browser/heapSize , which is currently set to 0x00000080, you could probably used this in the future.

And the log webbrowser.txt for some reason seem to be disabled(at least on 4.82. It worked on 4.20 so perhaps we can swap modules and test until which OFW version it was possible.)

I have attached a new version of the editor which has fixed a few bugs and it should now support up to 196095 bytes. Not sure if it will work or not. Please give it a try!
 
Last edited:
A brainstorming i just had... im going to write the deductive process that took me to this idea because otherway, if i only write a single line with the theory you are going to be a bit like "wtf, you build that theory from smoke" (and you would be correct), but i want to explain it a bit
Your brainstorming is like a real storm lol :adoration:

I was thinking in the pages in wiki if creating one with the name "silk container", and the name SILKPADD
One thing im sure you agreee with me is the name SILKPADD is composed by 2 parts, we know "silk" is a codename, and the "magic" names are usually 4 bytes too... so ok, lets remove the SILK and think about what means PADD
While thinking if the new wiki page could be grouped with other "containers" formats it came an question to mind
Most of the time, it's bytes and in readable ASCII, however they are plenty of expections. I would prefer for it to be 8 bytes, SILKPADD, with the PADD added because SILK only could have been mixed with another file. Or maybe they just want to shift everything by 4 bytes (yeah, I know crazy idea, ignore me)

Why there is not a "C" in the "PADD" ?
Why should there be a "C" in PADD?

Most containers have one, i know this is not a golden rule, but then the next idea came to mind... what if SILKPADD is not a container ?
What should containers have one? And SILKPADD is without doubt a simple container.

The SILKPADD fileformat is simple, doesnt even allows for any type of compression like most other containers
Perhaps there was no need for compression, and it's not that simple, it is obviously tweaked a bit. And we still do not fully know some details, especially in the header.

And then... i had a transcendental experience where mr. sony told me the truth
But... why didn't you ask him about the latest private keys?! :eek:

PADD is composed by 2 words, there are 3 ways to dedicate characters for 2 words:
-PAD D
-PA DD
-P ADD !!! Is typical in composed codenames to use only the first character of the first word, and severals characters of the second (as example, for "sandungas brainstormings" in 4 characters SBRA)
I get your point but but it could still be that each letters represents something. P would be interesting. Packed? D - Data?

P = program
ADD = address
Possible but not probable. ADD seems good but P for program does not really convince me to be honest. I see no program inside this container.

So... SILKPADD is the Program ADDress of SILK (the web browser)
So... the IDs associated with the entries in the index of the SILKPADD fileformat are the addressess ?
Addresses of the program memory ?
That sounds good but again, highly unlikely. Doubt them to be memoery address. They are certainly ID for getting the proper entries. The corresponding string for that ID can be found inside silk***,sprx files.

But the way i see at it now is better defined as a "memory map", not an exact 1:1 copy of memory, but a list that indicates where the datas are going to be "copypasted" to memory
This is why some of the datas (CEMenu, CEdialog) are very complex
Imo, it is simplier than that. It just takes the proper entry and parses it. CEMenu and CEDialog are a bit complex but overall simple. They just keep the needed info about a dialog.

Edit2:
Hmmm, as i mentioned in other post before (but i was not explicit enought, sorry) every "children" of the CEDialog have an unique ID
This is an additional ID (not located in the index like the others shown in the "silkpadd editor" made by NewFile)
Each children has a unique children and this children is linked to the main object. But the editor has nothing ot do with this since it solely edits the container and not further parses stuff(although we do it)

Lets say... we have a CEDialog, with an ID in the index (lets call this one the "main ID")
And CEDialog have 2 childrens named CEButton
What i was trying to explain is this CEButton has his own unique ID
Incase it had more childrens, all them would have unique IDs, without exception. It can be said that everything under the CEDialog hierarchy seems to be accuratelly mapped using unique IDs
I have done some reversing to this and CEDialog and CEMenu as quite similiar. Hovever, it is certainly needed to actually display a Dialog and Menu and tweaked some values to confirm what they are. Right now, it has type of entry, width, size, component type, hotkey string and probably more.

Maybe this IDs are used also as "memory address positions" where every one of them needs to be copypasted
As far i remember for the few time i was looking at this... all this IDs are consecutive, and increases in a amount of 1 each
As example... 234, 235, 236, and so on
The id can in fact even be the height, or position. These items are linked in a strange way together. But we need to actually show a Menu or dialog to see what happens.


Eitherway, I have my own theory of all this. Our first problem, is the webrowser itself. In regards to say, I am going to say:
The PS3 has no web browser.

Before you crucify me(dude what the hell, we can surf the net with it) you should read till the end.

The PS3 has only a browser engine, a browser object, control. This object seems to be used by games and the system itself for different purposes.
It contains two versions: Silk and WebKit.
Silk is a rather "limited" version but more powerful as it allows more controller by the programmer. Silk does have Javascript enabled.
Webkit is more advanced and with more options.

When we open the web browser in the PS3 we are not launching an app by no means. We are doing the same thing that developers do when they launch the browser ingame.
We are launching a web engine in a "box" with parametrs taken form xRegistry.sys and other places. We later control that "box" by sending commands to it, again, just like the developers do it.

PADD mostly stand form the PAD, the screen, the view, the real box when the page is displayed when surfing the net. The extra D could had been added to fill the 4 bytes. Or if you follow google:
http://memory-alpha.wikia.com/wiki/PADD (ignore the random site, it gave a good idea)

Personal Access Display Device , hence the "box"

What proof do I have for this:

Well for a start none of the user options(addres bar, Menu settings) is inside it, but they are added in top or to left of it.
SILKPADD contains only strings and resources which display only inside ths box. Boomarks, Size, File, Save As, etc,... such string we never find in any of the SILKPADD files.
This means that SILKPADD is indeed a container for the engine itself!

The pseudo browser wokrs by launching this "box" just like in a game and communicating with it, again just like game developers. The Menu: Vien, Size, etc.. is in fact found in webrowser.rco and webbrowser.rco. Anything you see outside the box, icons of browser setting, the SSL icon, the trendmicro icon is in fact located in these rco files and not in SILKPADD files.

The bookmarks, settings etc are never treated by a browser. The XMB or whatever plugin is reading all these things stored in the hdd and registry file and is communicated back and forth with the "browser", aka the box.

I do not know if we can mod these rcos. My theory of another debug menu somewhere was correct, inside the rco you can find
Code:
<Item name="opt_debug_item_selftest_localfile"
Hehe,
Plus a dozen other debug options. There is an entire page for debugging, but I do not know how to active it. Those decrypted rcos are so text lengthy that I can get lost in it, @sandungas , we need your brainstorming here.

We can attack the engine from the inside SILKPADD and from the outside RCO and other commands. From the inside can prove cool enough. You can use a game which launches it and then replace the error code with a HTML/JS trainer for modding, cheats.

From outside we have to explore further, but I have a dozen of things in mind.
 
I have attached a new version of the editor which has fixed a few bugs and it should now support up to 196095 bytes. Not sure if it will work or not. Please give it a try!
the new tool does make correct files, but the PS3 seems to have a 64kb max for parsing each field.

my test environment for triggering error is with and without internet connected or disconnecting python server and opening "browser". i do not know if the 12037 does no longer get triggered because the ID was wrong in older tools or the 12036 error is now the one that gets tripped initially from my environment.

anyways, here are the test results:

creating an entry that is exactly 65535 bytes will display correctly when parsed.

creating an entry that is 65536 bytes will not parse (have not checked memory in debugger) and will display another error with the same ID 12036 in the CEHtmlUI.bin

creating an entry any size larger than 65535 bytes will result in triggering the error in CEHtmlUI.bin

if the 64kb of bytes that were from the original overflowed entry are fully in memory and the next error triggered also dumps its 64kb to memory in full, maybe this can work, but overall, the size limit will be a problem IMHO

I do not know if we can mod these rcos. My theory of another debug menu somewhere was correct, inside the rco you can find
Code:
<Item name="opt_debug_item_selftest_localfile"
Hehe,
Plus a dozen other debug options. There is an entire page for debugging, but I do not know how to active it. Those decrypted rcos are so text lengthy that I can get lost in it, @sandungas , we need your brainstorming here.

We can attack the engine from the inside SILKPADD and from the outside RCO and other commands. From the inside can prove cool enough. You can use a game which launches it and then replace the error code with a HTML/JS trainer for modding, cheats.

From outside we have to explore further, but I have a dozen of things in mind.
yeah, we can mod rco's, so this is also interesting lol :)

The PS3 has no web browser.

Before you crucify me(dude what the hell, we can surf the net with it) you should read till the end.

The PS3 has only a browser engine, a browser object, control. This object seems to be used by games and the system itself for different purposes.
It contains two versions: Silk and WebKit.
Silk is a rather "limited" version but more powerful as it allows more controller by the programmer. Silk does have Javascript enabled.
Webkit is more advanced and with more options.

When we open the web browser in the PS3 we are not launching an app by no means. We are doing the same thing that developers do when they launch the browser ingame.
We are launching a web engine in a "box" with parametrs taken form xRegistry.sys and other places. We later control that "box" by sending commands to it, again, just like the developers do it.
this is pretty accurate :-p

EDIT #1:

here is a snaphost of everything loaded on "browser" start, from COBRA/Socat output

wSPPShI.png


curiously, we can add mimetypes and change key configs, here and directly in flash. also the sidebar.xml is not present, but ps3 is looking for it...

EDIT #2:

can confirm that swapping webrender sprx/rco (4.81 DEX swapped 2 files with 4.10 for test) does dump a webbrowser.txt to dev_usb000, although system crashes with just those 2 files replaced

0OCOYVx.png
 
Last edited:
the new tool does make correct files, but the PS3 seems to have a 64kb max for parsing each field.
Actually tying to read back the newly output file by the editor will osmetimes work and sometimes not, so I guess guess hope is not lost yet. If the size and metadata are not properly calculated then the browser goes to the next error in line or something like that. I need to investigate further.

my test environment for triggering error is with and without internet connected or disconnecting python server and opening "browser". i do not know if the 12037 does no longer get triggered because the ID was wrong in older tools or the 12036 error is now the one that gets tripped initially from my environment.
Interesting, again, my editor needs checking on this. What you say about the 64KB limit can still be possible though.

creating an entry that is exactly 65535 bytes will display correctly when parsed.

creating an entry that is 65536 bytes will not parse (have not checked memory in debugger) and will display another error with the same ID 12036 in the CEHtmlUI.bin

creating an entry any size larger than 65535 bytes will result in triggering the error in CEHtmlUI.bin
Right now, I check the range of the size like that:
f_size <= 255
f_size > 255 And f_size <= 65535
f_size > 65535 And f_size <= 130815
f_size > 130815 And f_size <= 196095

Te hfrist two cases work well but for the two last intervals there either is a problem only mend on how it's calculated or it really does not support more than 65535. My theory is that the first two 00 00 bytes of metadata for size calculation can also be used, but there is no official use for this so I am walking in the dark here.

yeah, we can mod rco's, so this is also interesting lol :)
webrender_plugin.rco has it! Right under Tools section, under the Discontinue trendimcro crap, there should be an entry for Debug Menu!!! The <MItem> is there!

this is pretty accurate :-p
Good to know that I seem to be in the good path.We probably have to figure out how the engine communicates with the system. The documentation states that :
window.external.user(msg)
window.external.system(????)
can be used for communicating. However, I run a test page and got all the function and methods of the window object and external was missing :/ Furthermore switching the engine to Silk, there were no objects and methods for the window object, or maybe the window object was not available at all.
One more interesting thing. Using JS we can checked the loaded plugins and only flashplayer is loaded. Apparently, the silk_npflashplayer9.sprx (a dummy 0 kb file) in silk_webkit/lib/Plugins folder has a usage. IF we rename it it will not load the plugin. Seeing the file is a dummy, then it's propably loaded from the dev_flash/vs/resource/module folder. This most likely is done to save space in case of more needed modules.

here is a snaphost of everything loaded on "browser" start, from COBRA/Socat output
Neat, this is what we needed. Your debugging expertise can really give us some light here. I guess we can focus on webrender_plugin.rco for now. The other directories are also silk/debug/ aswell. But I do not know how it's used. Plus it;s also supposed to save .txt and load different xml from dev_usbxxx and dev_ms aswell.

curiously, we can add mimetypes and change key configs, here and directly in flash. also the sidebar.xml is not present, but ps3 is looking for it...
What cool thing can be do with the mimetypes? Sadly there is no available sample for sidebar.xml Still, window,sidebar/menubar/topbar/scrollbar.visible will all return true and setting them to flase does nothing, they still remain as true.

can confirm that swapping webrender sprx/rco (4.81 DEX swapped 2 files with 4.10 for test) does dump a webbrowser.txt to dev_usb000, although system crashes with just those 2 files replaced
Try with just webrender for now.

Right now, I think our next step is to find the way to access that debug menu, form there we should get:

Debug Features
Send tURL
Send cURL
Debug Core
HeapMemory -> This should be heapMemory in xregistry
Debug UI
qql background
item move type
googleshortcut
contenxtmenu
Debug SelfTest
SelftTest local file (BINGO)
item highlight
Test Page
Stress Page
autoload page profiler
item programmable walk
capture debug
capture debug wait
Debug TrendMicro
Trendmicro service
Trendmicro last date
Trendmicro ttl
Trendmicro debug ???

I have tried RCOMage and compling fails to add the images, the layout looks really strange and many icons are missing.

the MItem page is named "opt_debug_tool" and the text="nothing." Text attribute to nothing is the main problem in here

@sandungas , your genius brainstorming is really needed here! You are the only one I know who understands that RCP format.
 
Last edited:
Furthermore switching the engine to Silk, there were no objects and methods for the window object, or maybe the window object was not available at all.
yeah, the Silk engine does not use JavaScript

One more interesting thing. Using JS we can checked the loaded plugins and only flashplayer is loaded. Apparently, the silk_npflashplayer9.sprx (a dummy 0 kb file) in silk_webkit/lib/Plugins folder has a usage. IF we rename it it will not load the plugin. Seeing the file is a dummy, then it's propably loaded from the dev_flash/vs/resource/module folder. This most likely is done to save space in case of more needed modules.
from what i have experimented with this, it is indeed a placeholder. If this stub is removed, the "browser" loses flash support and will be replaced with Adobe Flash logo to get flash. The actual silk_npflashplayer9.sprx gets loaded from /vsh/modules/silk_npflashplayer9.sprx, and cannot be removed without crashing. Also, if we remove the silk_npflashplayer.sprx from /vsh/modules/, the PS3 still runs flash fine.

Interestingly, we can modify the 0 byte stub in silk_webkit/lib/Plugins/silk_npflashplayer9.sprx and the PS3 does not seem to care, although trying to find added bytes in memory from new stub to see where loaded, proves to not be there!

I also tried putting other stubbed sprx in that directory to see if module would load from /vsh/modules/ and it does not work exactly like that, i guess lol

EDIT:

how do you check loaded plugins with JS?
 
Last edited:
Back
Top