PS3 [UPDATE] IDPS Dumper (PS3 NAND / NOR ) - 4.81/4.82 OFW Compatible by Team PS3Xploit

{UPDATE v0.2.3 Released(See tab)}
Following the official announcement of the PS3Xploit news (4.81 OFW Exploit), the devs behind the project have fulfilled the promises of releasing the IDPS Dumper for OFW 4.81/4.82 as this release is ready for the public. Now there is many more things being worked surrounding the overall project but this IDPS Dumper works on all models of the PS3 (NOR and NAND, note 12 GB EMMC will be supported soon in an updated release) and no reason not to release this tool. Since PS3 firmware 4.70 Sony had blocked flatz IDPS extracting tool (IDPS Stealer) and there has not been a known way to obtain the IDPS on OFW (4.70 +) consoles , but now this tool can now obtain your PS3's ID, which can have various uses, the tool has been confirmed to work on SuperSlim models by the team. . If you have not read the previous details about the PS3Xploit project, then checkout this official thread to get the firsthand information about this ambitious PS3 project.


capture_0.2.3.jpg

(UPDATE v0.2.3)


  • UPDATE v0.2.3- IDPS Dumper for 4.82 OFW
    • Added 4.82 Support
    • Removed all extra requirements like JQuery..
    • Removed the need for string relocations to improve the initial memory search process & overall trigger times.

  • UPDATE v0.2.3- IDPS Dumper for 4.81 OFW

    • Removed all extra requirements like JQuery..
    • Removed the need for string relocations to improve the initial memory search process & overall trigger times.



  • UPDATE v0.2.1a- IDPS Dumper for 4.81 OFW

    we have some more exciting news to bring you!! :cheerful:

    We have been working very hard to bring eMMC support for the newest SuperSlims CECH-40xxA, CECH-42xxA , CECH-43xxA and that has happened. :D

    The team would like to present a nice little update to the 4.81 IDPS Dumper now supporting eMMC hardware revision consoles!!

    Please report any issues you have while using this new version on any of the flash types, NAND, NOR, and eMMC.

    Thank You to all :cool:

    v0.2.1a
    • Added eMMC SuperSlim Support (CECH-40xxA, CECH-42xxA , CECH-43xxA)
    • Misc Tweaks To Exploit
    • Small typo on index.html pointed out by @Turranius - Fixed

    How to use this:
    *** MAKE SURE TO RUN AS ADMINISTRATOR ***
    install python to use server.py or another HTTP server of your choosing on both Windows and Linux!​

    On windows - Install any of these optional HTTP servers:

    On linux:
    • install python for your distribution using apt-get, yum, and similar commands.
    • make script executable using "chmod a+x server.py" or "chmod 775 server.py" or "chmod 777 server.py"
    • execute python script using "/usr/bin/python $exploitFolder/server.py" or "./server.py"

    Update
    on Android: (
    instructions from @No0bZiLLa)
    • I can confirm this does work if using an http server on Android. what i did was downloaded the zip (on my phone) and extracted it and then download something like Simple HTTP Server and point the server to the folder that contains index.html. once you do that just reload the server and make a note of what the ip:port is. then just go to ps3, type in ip:port (eg 192.168.2.7:12345) as specified in simple http server and then select the appropriate button for your system.


    Then run (for python):

    • On windows - windows.bat
    • On linux - linux.sh


    Usage Tips:

    1) Try using a LAN connection or a solid WiFi connection during exploitation. A weak signal can cause problems.
    2) If the exploit takes more than 5 minutes to work, reload page, browser, or restart console and try again.
    3) If you are using a LAN connection and experience network issues, make sure all cables to router are in working order.​



  • IDPS Dumper Release (v0.2 - After Leak Release)
    ok....the moment all of you have been waiting for......i assume :cheerful:
    • File: ps3_481_idps_dumper-PS3XPloit.zip
    • MD5 Hash: FFDA70AB2D1677886083F99185C54FE3
    • SHA-256 Hash: 852BDB301753C4F4A7E946188E850D3D325EEAA259B61AE2B5AE31320B2F292B

    enjoy this release from our team :victorious: we will be working hard to add eMMC support as soon as possible!!


    The documentation will be updated as time goes on. There is a readme.txt file included with basic setup and usage instructions.

    Please stay tuned for future tools and releases :D

    and once again, THANK YOU to everyone involved bringing this all together, without all of you, none of this would have happened!!!

    Additional details from @bguerville
    "The idps dumper will create a file on usb000 then beep 3 times & shutdown in all cases, even if flash memory read fails. emmc should not make a difference to this. You will get garbage in idps.bin in that case.

    Js errors with a black page message on ps3 should not happen. If ever it did, just report & in the meantime keep relaunching the exploit. Nobody has had this issue in dozens of tests though.

    And clearing cache or cookies is totally unnecessary with the exploit & the wk js interpreter. Between runs garbage collection will take care of cleaning up what is needed, the job it does is always sufficient".


It's essential not to flood the browser memory with junk before running the exploit. The reason for this is that due to javascript core memory usage limitations we are scanning several times a small range of browser memory (a few Mb) to find some essential data in RAM, if the memory is flooded then the range to scan becomes much larger & the probabilities that our data is found in the smaller range decrease dramatically....

So in short, never use the browser or set a homepage you cancel before running the exploit!
If you need to, set the homepage to 'blank', close the browser then reopen it to start the idps dumper.

Set-up Steps:
  1. Setup a small Web server on pc or smartphone. The Python http server is not required for most users, it was provided for developers. Since v0.2.3, all other extra requirements have been removed. Don't come to us for explanations about how to run a http server though. Google it.
  2. Extract the files in your http server root folder.
  3. Put a fat32 USB key in port closest to BD Drive (/dev_usb000).
  4. Open the ps3 browser & write the ip address of your server (and the port if not 80).
  5. Run until ps3 beeps & shutdown. The idps should be on your USB drive as idps.bin.
- Downloads -
  • MD5 Hash: 3c2e1582f52e1002a12ad280f426d0c6
  • SHA-256 Hash: 1c49eabd64275171a60c90f0f06f503b7055f4ff863f87e7960d41464d127443
  • MD5 Hash: 71dd906e585bf470f84f9d4fb10c1f37
  • SHA-256 Hash: d4bffe2b7d08c1dda275590229f86903f1db487e9a78364d6a025c3734cd8f68
 
Last edited:
So many issues you can't imagine (better to rape than to cry). I tryed many web servers, localhost, local network with NAS, hosted on différents places... But all failed every times.

Please let me know about how to guarente CEX vsh.
I'm on clean Rebug REX 4.81.2 (not moded)
Cobra activ
WebMAN activ
"XMB operational mode: Retail"
 
So many issues you can't imagine (better to rape than to cry). I tryed many web servers, localhost, local network with NAS, hosted on différents places... But all failed every times.

Please let me know about how to guarente CEX vsh.
I'm on clean Rebug REX 4.81.2 (not moded)
Cobra activ
WebMAN activ
In Rebug Toolbox Selector column, Rebug mode/Retail/CEX QA.
If you choose Normal mode, no matter what else you select, you will always use DEX vsh. You must use Rebug Mode!

To be sure, look in /dev_flash/vsh/module there are 3 vsh. 2 of them are DEX & 1 is CEX. The CEX vsh is the smallest of the 3.
The currently used one is named vsh.self so check its size.
 
@bguerville , @esc0rtd3w theoretically could someone work on a ROP chain for something and after its done he give you guys that ROP chain and you implant it in your exploit so that way some developers or the community may help and contribute in developing the project even more and ease things up a little bit.
 
@bguerville , @esc0rtd3w theoretically could someone work on a ROP chain for something and after its done he give you guys that ROP chain and you implant it in your exploit so that way some developers or the community may help and contribute in developing the project even more and ease things up a little bit.
No need.
If you are good enough to modify a ROP chain, you will also be good enough to insert it in the exploit. Then you would be free to publish your work. With credits obviously...

Everything we release belongs to the community & anyone can modify the released files as they wish. As far as we are concerned, the more development there is, the better... We are not s#ny... LOL
 
No need.
If you are good enough to modify a ROP chain, you will also be good enough to insert it in the exploit. Then you would be free to publish your work. With credits obviously...

Everything we release belongs to the community & anyone can modify the released files as they wish. As far as we are concerned, the more development there is, the better... We are not s#ny... LOL
You are the best guys i mean even among other developers you guys are the only team that i actually felt that they are working hard for the community and the scene not for anything else.
 
To be sure, look in /dev_flash/vsh/module there are 3 vsh. 2 of them are DEX & 1 is CEX. The CEX vsh is the smallest of the 3.
The currently used one is named vsh.self so check its size.
I stay normal, and CEX QA in selector column
I got
vsh.self 3125Ko
vsh.self.cexsp 3081Ko
vsh.self.swp 3125Ko
Pls confirm me
I rename vsh.self.cexsp (smallest size) to vsh.self and I replace/overwrite the existing vsh.self with the new one? Is tha right?
 
You are the best guys i mean even among other developers you guys are the only team that i actually felt that they are working hard for the community and the scene not for anything else.
Nice of you to say... Thanks. :)

But it's not entirely true...
Sure, there is a fair number of arseholes in our community, past & present, but there are also many devs that are not interested in money/fame or whatever...
I could make a long list but in past couple of years for example we have seen Zar offering Managunz to the community, deank releasing a lovely sMan, aldostools contributed heavily too with wMM & various other things, KW with psnpatch, EvilNAT with SEN Enabler and many more...
All those guys deserve just as much respect as we do from our community for their long standing contributions, some of them probably even more than we do. ...
 
Last edited:
I stay normal, and CEX QA in selector column
I got
vsh.self 3125Ko
vsh.self.cexsp 3081Ko
vsh.self.swp 3125Ko
Pls confirm me
I rename vsh.self.cexsp (smallest size) to vsh.self and I replace/overwrite the existing vsh.self with the new one? Is tha right?
Yes, vsh.self.cexsp should be renamed vsh.self but make sure you rename the current dex vsh.self correctly or the Rebug Toolbox Selector will be not be able to work anymore.
And reboot after making any changes.
 
Yes, vsh.self.cexsp should be renamed vsh.self but make sure you rename the current dex vsh.self correctly or the Rebug Toolbox Selector will be not be able to work anymore.
And reboot after making any changes.
Work perfecly at fisrt time LOL idps is correct Thanks
 
It dont work for me ps3 just searches the web for ip but for what ever reason my android phone connect fist time lol
 
It dont work for me ps3 just searches the web for ip but for what ever reason my android phone connect fist time lol
If your ps3 can't find your Web server, the issue isn't related to the exploit but most likely with your network (or server) setup.
 
Last edited:
Ok thanks man ill mess about wih it :) both ps3 and phone are on same network.........
Being on the same network does not guarantee that there is nothing wrong.
Obviously, if the problem was exploit related, you would be able to load the page into your browser & the code would start running before encountering issues.
 
If your ps3 can't find your Web server, the issue isn't related to the exploit but most likely with your network (or server) setup.
Actually, when I set up a server on my android mobile I could reach it from PC but not from ps3..
When I set up another server (online, some free webhost) it worked perfectly fine..
Ps3 connected to the same router (and lan) as PC and mobile..
I didn't get it why but as there's a workaround, I didn't care anymore :D
Might have been some setting on my server :sem blush:
The only other difference I could think of was trying to reach a server via IP vs via name :confused3:
 
@lord3490 so what are my best steps to get it working im still in same boat every device other than the ps3 will connect np
 
Last edited by a moderator:
So many issues you can't imagine (better to rape than to cry). I tryed many web servers, localhost, local network with NAS, hosted on différents places... But all failed every times.

Please let me know about how to guarente CEX vsh.
I'm on clean Rebug REX 4.81.2 (not moded)
Cobra activ
WebMAN activ

I think you meant to say "rage" 0_obewan not rape...I know you're learning english (and doing a good job)...but believe me, you don't ever want to say you want to rape....anything lol just take my word for it

I think when i tried it on my rebug 4.81.2 CEX it wouldn't do it either, twice it just froze my console... but you can get id from modded ps using other ways in like 10 seconds so i didn't try it on my system anymore...but all the OFW consoles i had...all worked , usually right on the first try and usually in around like 2 or 3 minutes or less
 
I think you meant to say "rage" 0_obewan not rape...I know you're learning english (and doing a good job)...but believe me, you don't ever want to say you want to rape....anything lol just take my word for it

I think when i tried it on my rebug 4.81.2 CEX it wouldn't do it either, twice it just froze my console... but you can get id from modded ps using other ways in like 10 seconds so i didn't try it on my system anymore...but all the OFW consoles i had...all worked , usually right on the first try and usually in around like 2 or 3 minutes or less
You had exactly the same problem with vsh. You were using the patched DEX vsh running in CEX mode. A freeze was normal as 80% of the gadget offsets were wrong for the vsh you were using.
 
You had exactly the same problem with vsh. You were using the patched DEX vsh running in CEX mode. A freeze was normal as 80% of the gadget offsets were wrong for the vsh you were using.

yeah when i saw your reply earlier i kinda figured it had to be the same thing as 0_obewan but it was just a test... im not worried about using this method on a modded system... the ofw systems...now thats where its at!! you guys Fn rock
 
Back
Top