PS Jailbreak Finally Hacks PS3 (allegedly)

[Ex-Cyber]

The exploit currently being used was fixed in 3.42. There's a possibility that someone will find a different exploit, but it's not guaranteed by any means. Most likely what will happen is that we'll end up with a way to chainload or fake later firmwares from 3.41. There's already an app to boot Game OS from a USB drive, but for now there's no way to install a newer version (right now you have to copy the already-installed Game OS files to the USB drive).

edit: I could be mistaken, but I don't think marcan's post is about an lv1 escalation exploit. It seems more like he's running his own lv2 kernel instead of hooking Game OS (which is fairly impressive in its own right).

[Luriden]

I went ahead and updated. My PS3 controller keypad that I bought for Home came today, and with no jailbreak for 3.42 in sight yet, I bit the bullet. I just got my PS3 about a week ago and want to put it to good use and enjoy the online features for a bit before jumping into hack oblivion like with my PSP. Now watch, they'll crack 3.42 tomorrow...

Speaking of PSP, people are talking about a possible jailbreak coming for PSP... What's the difference between a jailbreak on the PSP and a normal mod? I'm assuming that would be strictly software and no Pandora battery involved?

[Skynet]

Anyone done the iPhone method? I have a 3G and that's the only device I have access to that can mod a PS3 right now. But I don't really want to go through the process of installing Android on the phone or whatever you need to do just to mod my PS3. I want an actual iPhone port of it

I'm seriously thinking about buying a Dingoo off Deal Extreme just for the mod.

[melancholy]

I so hope that we can get something to hack demo PS3's. I acquired an old display unit, but every time you turn it off it jumps back into demo mode. If they make custom firmware that will bypass that, I will be thrilled.

[DanteJay]

Yeah can't wait. I still have my launch PS3 (60GB) sealed in a box. I already have the little USB device that's required. Now I just need time...

[Luriden]

Can now boot into service mode, downgrade from firmware 3.50 to whatever and remarry blu-ray drives and motherboards.

Basically, if your logic board ever fucks up, you wont have to call Sony <3

I'm assuming you're talking about the Master Key... Which turned out to be wrong. PS3Key is now compatible, but as of now, you still need to buy one of the specialized USB sticks to do anything with the firmware. Which sucks, because I have an iPhone 2G that's begging to let it help me jailbreak my PS3, but I'm still on 3.50.

[Luriden]

I was talking about the E3 card reader, but the PS3YES downgrader is comptible with most ATMEL based solutions and they're releasing source soon, which should port to other boards.

Be warned though, the iPhone is usually one of the last to the party when there's a new payload out.

Ugh. Lame. If I were able to get on PSN and play online with certain... games while jailbroken, I wouldn't hesitate at all to buy a downgrade device. But I hesitate to buy a specialized device to downgrade it in case I jailbreak it, then I suddenly miss being able to log on to PSN and end up "un-jailbreaking" and updating my firmware shortly afterward. At least since I already have an iPhone there wouldn't be a huge loss besides time and effort if I decide to go back.

That's actually the #1 thing that stops me from modding my 360, come to think of it. Online interactivity is useless for me on Wii, but completely necessary on 360 and PS3.

[Luriden]

Well, it looks like the real key is out. Again. We'll see what happens with this one.

[melancholy]

I'm just wondering if they will ever make a complete custom firmware that would work with demo unit PS3's. I have one sitting in my closet that is just begging to be hacked into a normal functioning unit as opposed to being stuck in a demo firmware.

[Eviltaco64X]

I'm just wondering if they will ever make a complete custom firmware that would work with demo unit PS3's. I have one sitting in my closet that is just begging to be hacked into a normal functioning unit as opposed to being stuck in a demo firmware.

PS3 Kiosk/Demo Jailbreak Guide

Disclaimer

I am not responsible if you fail to follow simple instructions and somehow bricked your ps3, or your own hand etc etc

What this is?

Its a quick starter guide for those who currently, have bought or given a ps3 demo unit and have no idea on jailbreaking it.
It also applies to normal ps3 owners who has no idea how to jailbreak and wants more info on this subject but this guide is specifically focused on PS3 demo units alone due to its different nature from retail and there are A LOT more guides out there for a standard ps3 console compared to the demo units.

I hope you enjoy reading from starting to finish and found it helpful

There are four simple steps involving lots of reading and understanding to becoming a successful ps3 kiosk/demo jailbreaker

Step 1

Understanding the concept of PS3 Jailbreaking

Summary:

If the user understands the concept of jailbreaking an iphone, or rooting an Android phone, then it should be easy to grasp immediately. It basically gives us a sort of "superuser" access to the system to run and install custom files that aren't approved by Sony. The most popular function of a jailbroken ps3 is the ability to rip your ps3 game and force the console to run the game fully from the harddrive, whether internally or externally. However, PS3 Jailbreaking is NOT PERMANENT and must be jailbroken again after every power cycle.

There are 3 most prominent forms of ps3 jailbreak that I know of,

PS3 Jailbreak, which was the original release, sold in a nice usb stick under its household name - PS3 Jailbreak. The development and updates are in-house and this company aims to provide a good and straightforward solution for a price.

PS Groove, which is an open source project borrowing the same concept applied from the original release and enables more flexibility in terms of hardware choices and gives the user the ability to program a jailbreak device themself. No one is SUPPOSE TO profit from this project but theres no stopping any company from trying.

PS Freedom, another major port from PSGroove headed by Kakaroto, which aims to support a lot more household electronic gadgets (mainly smartphones) that one may own, eg. iPod Touch, iPhone, Android phone etc.

For both PS Groove and PS Freedom, we rely on either of two different payloads that inject the exploit into the ps3 via the USB port,

Hermes or PL3

Both function the same but might offer different compatability with certain games (some games might not load from the HDD if the user is using a PL3 jailbreak)

The Teensy USB Development Board (pjrc.com/teensy/) is the most popular choice for homemade PS Groove device to inject either of the payloads mentioned above. There are many other clones out there but these are the main ones that most people obtain. They are easily re-programmable.

Step 2

Hardware and sofware requirements

Hardware

1 - PS3 Demo console
2 - USB Development Board
3 - Windows XP computer/laptop
4 - USB flash drive or hard drive with FAT32 partition

|-=IMPORTANT=-|
1. a ps3 demo unit with firmware 3.41 or below
|-=IMPORTANT=-|

*how to tell if its demo or retail and version?*
when you power on your ps3 from the switch at the back of the console, it will go to standby mode and only a red light should appear. Demo ps3 units will always automatically turn green and boot up immediately. After boot up on the main screen, at the bottom right, there will always be a message box saying "Playstation 3 Demonstration Firmware x.xx" where x.xx is the current firmware.

|-=STOP=-| right here, if your ps3 demo is 3.42 and above as I cannot help you at the moment. There are no jailbreaks at the moment that can go beyond 3.41, especially on demo ps3 units.

2. a choice of different USB development boards that YOU WILL NEED to obtain on your own.

http://www.ps3news.com/forums/ps3-ha...ds-112429.html

Here's a list of boards that will work with the 3.41 demo ps3 exploit (courtesy of Mark Webber):

bentio at90usb162 16mhz
blackcat at90usb162 16mhz
maximus at90usb162 16mhz
minimus at90usb162 16mhz
olimex at90usb162 8mhz
teensy at90usb162 16mhz
teensy at90usb646 16mhz
teensy at90usb1286 16mhz
teensy atmega32u4 16mhz
usbkey at90usb1287 8mhz
usbkey atmega16u4 8mhz
usbtinymkii at90usb162 16mhz
xplain at90usb1287 8mhz

ok the above list looks horrible and confusing for anyone that is new. Basically, teensy, olimex, blackcat etc. just treat them like branded items that is using similar components sourced from the same manufacturer.

(If anyone is familiar with smartphones, here's my analogy again: blackcat, olimex, teensy = HTC, Motorola, Samsung and at90usb162 = Qualcomm Snapdragon QSD8250)

So lets streamline it to the most common models,

• AT90USB162
• AT90USB646
• AT90USB647
• AT90USB1286
• AT90USB1287
• ATMEGA32U4

the letters AT depict a company name called Atmel followed by the model number. If you have a browse at the immense number of modchip suppliers, they will always have one of the above. If not, shoot them an email asking if they have any of the above (and it is ok to pick the cheapest one and any brand name is fine). As an example, I did not manage to find a Teensy board but a different brand from an online supplier,

*refer to the picture attached below*

|-=IMPORTANT=-|
I have no idea what the differences are in mhz but just keep in mind that there are only 2 known variants, 8mhz or 16mhz and these specs are important for you to remember. So for e.g. the device that I purchased shown in the picture, it is known as a AT90USB162 8mhz. It is imperative that you know your board model and type immediately, if not ask anyone here to identify for you.
|-=IMPORTANT=-|

3. a computer to program the USB board. I DO NOT recommend a windows 7 machine clearly because it did not allow me to install my USB board. If you have a laptop or netbook with windows xp, that would be the best.

|-=IMPORTANT=-|
In Windows XP, go to any folder, Tools->Folder Options->View and uncheck the box "Hide extensions for known file types"
|-=IMPORTANT=-|

why laptop? in my experience of flashing phones and other gadgets, the experts always warn of a power surge or failure from your main outlet and that may cause a "brick" on your poor device if it failed to flash completely, a laptop with a charged battery will prevent that from happening. Anyways, its not a necessary step, it is up to you.

4. USB flash drive or hard drive

USB flash drives are so dirt cheap these days theres no excuse for no access to one, 250mb or 512mb is more than enough.

|-=IMPORTANT=-|
Make sure it is FAT 32 partition
|-=IMPORTANT=-|

if you're not sure, plug it in, go My Computer and right click on your device and go Properties to check. You can format it to the correct partition from the right click menu as well.

Moving on to collecting all the software needed.

Software

1 - 3.41 kiosk firmware
2 - Atmel FLIP software
3 - PL3 Payloads by Mark Webber
4 - Gaia Backup Manager (to rip and load ps3 games)

1. First and most important is the rare 3.41 demo firmware update file for your ps3 demo. Why is it rare? Sony stopped hosting old demo firmwares, and most jailbreaking sites hardly talked about demo units,

only retail units get the limelight. If you do not believe me, you wouldn't be bothered reading this guide

so here it is, in multiple hosting sites of your choice (courtesty of 100x100playstation.it, love them guys i could kiss them),

PS3 Demo 3.41 firmware: http://www.multiupload.com/2RMGONVY91

Extract the zip file. The folder structure will be IDU_IDU341\PS3\UPDATE

Inside the update folder will be a file called PS3UPDAT.PUP , which is similar to retail update pups. Do not worry, this firmware has a completely different MD5 checksum

To make sure that you have downloaded the file completely, it should unzip with no errors.

*Optional*
If you have a MD5 checker, the checksum of the PUP is 561B924D2B388FB920F3F7AB12C679CA

Copy or cut the PS3 folder into your USB Flash drive/hard drive.

2. Next is getting the Atmel software for your USB board. All Atmel chipsets, the ones beginning with AT can use this software called FLIP. It is available from Atmel themselves,

Atmel FLIP software: http://www.atmel.com/dyn/products/tools ... ol_id=3886

To be thorough, pick the one with JAVA runtime included and install it on your windows XP computer/laptop.

3. The PL3 payload edited by Mark Webber for various usb boards, specifically made for PS3 demo units (courtesy of Mark Webber),

PL3 Kiosk 3.41 payloads: http://www.multiupload.com/SALSJ3CWX6

extract it and you will get a main folder called "kiosk 3.41 PSGroove hex files". Inside this folder will be a lot of .hex files. Don't worry about it for now.

4.Gaia Manager 1.02 RC 3

This back up manager works immediately the moment I tested it, you can argue theres better ones out there, but I am merely providing this as a start, the choice is completely yours as I have not tested the other managers.

GAIA Manager 1.02: http://www.ps3news.com/forums/attach...chmentid=25678

extract it and you'll get a file named UP0001-GAIA01985_00-7679866932773369-BDRIPS.pkg
copy and paste this .pkg file in your USB flash drive.

Step 3

Installation and setup process

Place the PS3 folder inside the root of any usb flash drive. So in your usb drive main screen, there should be a PS3 folder and its structure should be PS3\Update\PS3UPDAT.PUP

In your demo ps3 unit, I assume you know your unlock code for its current firmware version, if not look here: PS3 demo unlock codes

Fire up the ps3 demo, unlock it and insert your usb flash drive containing the ps3 folder.

Go to settings tab and on top select system update and pick update from storage media, it should detect the new firmware immediately and asks whether you would like to update to 3.41, yes on everything and

wait till it is complete (don't go crazy and switch off the ps3 or something lol)

Once the PS3 restarts, it should be on demo mode again and at the bottom it should say "Playstation 3 Demo Firmware 3.41"

Alright, half the puzzle is completed.

Next is programming your USB board.

Fire up the Atmel software and follow the excellent guide here

Atmel USB PSGroove guide: http://www.dukio.com/ps3-jailbreak/tuto ... llers.html
Quote:
You are looking on how to create your own PS Jailbreak? Well, i have found a tutorial to install this little piece of greatness in Atmel USB PCB Controllers, credit to grecomafioso.

So when you want to install the devil, you need download it. Just go to the official download site for PSGroove http://github.com/psgroove/psgroove and download the PS Groove HEX file, psgroove.hex

Done? Ok, so we need one of these USB pcb controllers, it is very easy to find it online, just use your favorite search engine. You know what is search engine right?

• AT90USB162
• AT90USB646
• AT90USB647
• AT90USB1286
• AT90USB1287
• ATMEGA32U4

Alright, so lets get started.

Device Firmware Upgrade
When you received your very own AtMel USB PCB Controller, the first thing to do is to load the HEX file into the on-chip flash memory of your microcontroller. The “Flip” Software is the tool been used to upgrade the device firmware (you can get it for free at USB CD-ROM or Atmel Website).

You must follow these steps carefully and should be completed to allow the device starting DFU (Device Firmware Upgrade) mode and then it will load the HEX file:

1. Install Flip software (Flip Version 3.0 or above is required).
2. Push the RST (Reset) button.
3. Connect the board to the PC using the USB Cable (Standard Ato Mini B)
4. Push the HWB (Hardware Bootloader) button.
5. Release the RST button.
6. Release the HWB button.
7. If your hardware conditions explained above are correct, a new device detection wizard will be displayed. This will happen if you are using Flip for the first time. Please follow the instructions (the INF file is located in the USB sub directory from Flip installation: (“install path:\ATMEL\FLIP\FLIPx.x.x\usb”)

New Device Detection Wizard
Now, on your PC screen, the New Device Detection Wizard will automatically open.

Select “Install from a specific location (Advanced)” and click on Next>
Select “Search for the best drivers in this locations.” and click on “Include this location in the search:”. Now Browse to the path C:\Program Files\ATMEL\FLIP 2.4.2\usb and click on Next>

Then, check your Device Manager. There should be a new icon with the description AT90USBxxx (where xxx is the number of your USB PCB Controller). If there is no icon show, you must start the procedure again.
Ok, now your Device is in DFU Mode. Launch the program Flip to proceed with the flashing process.

Click the chip-icon in the upper left corner and select your device from the up-poping list.
Now click on the USB-Cable icon in the upper left corner to select the communication mode. Select “USB”. In the up-poping window click on “Open” to open the communication port.
Now click on “File” “Load HEX File…” and browse to your ready psgroove.hex file.
Now Load the HEX File (in the Operations Flow Tab Check Erase,Program and Vertify,then Push Run button) A window will pop-up that shows the processes.
After all the processes are done click on the “Start Application” button in the right down corner.

The AT90USB boot loader will detach and jump into the user application when “Start Application” button is pressed.

Congratulations, now your very own PS Jailbreak clone is ready (It is without the Backup Manager support though)

PS: I know this tutorial is not perfect, will update it when neccessary. Thanks to grecomafioso for this.
read it carefully and understand it, once you have done it the first time, it will be peanuts. When you reach the part where it says "Load a hex file", remember to go to the folder that you extracted earlier that contains different .hex files. Select the CORRECT MODEL VERSION for your device.

|-=IMPORTANT=-|
Your USB board can be re-flashed with newer/different .hex files, just follow the same process again!
|-=IMPORTANT=-|

Once thats done, the hardest parts are completed, CONGRATS!

*RECOMMENDED*
You can also build the latest (and future) version of .hex payloads by yourself for your own specific usb board using the site linked here:

http://www.ps3news.com/PS3-Hacks/psg...now-available/

Mark Webber has mentioned that KaKaRoTo has ported his code to the latest PL3 .hex payloads. I have not tested them so it will be up to you to experiment with it.

Step 4

Running and maintaining a JB'ed Demo PS3

Running the jailbreak

Alright, jailbreaking a ps3, i think by now, everyone knows about it from youtube and stuff, off, unplug, plug in usb device, turn on, eject etc.

Ok here's the main twist for demo ps3s.

Remember they auto turn everytime you flip the switch? This is a very annoying limitation on the demo ps3 jailbreaking but the benefits still outweigh it so it won't matter, you'll get used to it.

so here's the coldbooting guide provided by Mark Webber,

- Put a disc into the drive (it can be ANY disc, also works with a blank CD-R)
- Turn the power switch off (the flip switch behind the left corner of the console)
- Turn it back on until you see the disc read blue light flash 1-2 times then turn the power off again

|=-IMPORTANT=-|
Nows the best time to insert the freshly made USB Development board into the USB slot. Please make sure there is NO OTHER USB devices connected
|=-IMPORTANT=-|

- Turn the power on one more time and the light should remain red.
- Now press the power button on the front, then the eject button and hold it until the disc comes out. A quick press of the eject button can stop it working for some reason.

OK ALL DONE. But wait! once you're on main screen, there seems to be NO DIFFERENCES in game tab. Go to settings -> security settings and unlock your ps3 again with the 3.41 unlock code 2998

Now go back to Game tab and you'll see 2 new options below!

/app_home/ps3_game/

install package files

Now insert your USB flash/hard drive again and select "install package files" and select the GAIA manager.pkg file. It should install in one second. In Game tab again there will be a new program called GAIA and it will be permanently there.

Insert a PS3 game disc and run GAIA to test it out. In Gaia manager you should be able to see the name of the game and you will have some options on the right to rip it to hdd0 (which is your internal ps3 drive).

Maintaining the PS3 demo JB

When you decide to turn off the ps3, the jailbreak will be gone and you need to do it again. This applies for ALL ps3 consoles not just demo units. To simplify the method, you can leave a disc inside the drive before turning it off and repeat the steps above. Its crappy and time consuming I know, plus those options only appear after putting the unlock code.

But heres some tips, GAIA manager will always appear there without needing to input the 4 digit code. Just press your controller PS button and launch it immediately after jailbreak.
Secondly, the unlock code can be changed to something easier, like 0000, just go to security settings and select "change password", this setting is permanent until you decide to update the firmware.

HAVE FUN!

Current limitations

- Current Jailbreak limitations on the retail ps3 ALSO applies on demo units
- Android phones with PS Freedom does not seem to work on demo units
- Must have a disc in the drive to JB a ps3 demo on booting up
- Only PL3 payloads updated with Mark Webber's code works with ps3 demo
- Option to install new .pkg files only appear after unlocking with 4 digit code
- Loading ps3 back up still require a disc in the drive (this could be a back up manager or payload limitation as I have only tested Killzone 2 on GAIA 1.02 using PL3)

credits to:

dukio.com
100x100playstation.it
Mark Webber from psx-scene
project0.de


Read more: http://www.ps3news.com/forums/ps3-guide ... z17U9QvzBJ

[Ex-Cyber]

Word is that 3.55 is live on update servers and blocks downgrades.

[Luriden]

Just a warning to anyone about to downgrade, several people have confirmed that Blu Ray movies are NOT working after the downgrade, even after upgrading again. This is a definite deal breaker for me, I won't be going near the downgrade until this shit is straightened out.

[Luriden]

Yeah, just seen that. Weird how it didn't come up from last weeks PSJailbreak downgrade.

Blu Ray support still works fine for previous downgraders, and that includes the E3 stick. The only people affected by this are the people that used PSGrade, or whatever it was that came out of the USB key that came out today. Luckily I couldn't get my iPhone to downgrade the PS3 and gave up before the word was out that Blu Ray support is killed with it.

[melancholy]

I'm just wondering if they will ever make a complete custom firmware that would work with demo unit PS3's. I have one sitting in my closet that is just begging to be hacked into a normal functioning unit as opposed to being stuck in a demo firmware.

PS3 Kiosk/Demo Jailbreak Guide
snip

You have no idea how long I was searching for a guide on how to update the demo firmware to 3.41, let alone jailbreak it. It's still not exactly what I want, but it's a start.

[wizrdeye]

I hate to sound like a noob, but I have been searching for a few days on many forums, maybe I am using the wrong search words. I bought a PS# that did not read disks thinking I could just get a new laser and fix it. Come to find out the guy before me bought it broken and tried to fix it, unknown if the guy before hime did anything. Long story short, I am not sure if the BR controller board is the original. Is there any way to tell? Are there numbers on the board that match the mother board or anything? Is there any way to marry a new board as of yet? I got the new laser it did not fix it. bad laser? not sure I sent it back and have another on the way. When I called to return it, they did not sound surprised that I might have a bad one. Any help would be greatly appriciated, or some better wording to do more searches. Thank you all very much in advance.

[DanteJay]

I hate to sound like a noob, but I have been searching for a few days on many forums, maybe I am using the wrong search words. I bought a PS# that did not read disks thinking I could just get a new laser and fix it. Come to find out the guy before me bought it broken and tried to fix it, unknown if the guy before hime did anything. Long story short, I am not sure if the BR controller board is the original. Is there any way to tell? Are there numbers on the board that match the mother board or anything? Is there any way to marry a new board as of yet? I got the new laser it did not fix it. bad laser? not sure I sent it back and have another on the way. When I called to return it, they did not sound surprised that I might have a bad one. Any help would be greatly appriciated, or some better wording to do more searches. Thank you all very much in advance.

1) Welcome to the forums
2) Thank you for not trying to sell us something
3) I'm not to sure if you can marry a new BD controller board as of yet. Could you get in contact with the first guy? Why did he swap BD drives in the first place? Here are a few things you could do:

- When the new lens arrives, test to see if the system will read a game, a dvd movie, and a cd.
- If the game boots, but does not play movies then the lens is fine, and the system was jailbroken/downgraded and needs to be downgraded to an earlier firmware than 3.41, and then re-upgraded to 3.41.
- If it plays DVDs or CDs and not games, then it could be unmarried. However, this I am unsure of, because I know with the 360 an unmarried DVD drive will still read movies/cds, but I'm not sure if the PS3 will do the same.
- If all those fail, then the BD controller is probably defective or unmarried to the main-board.
- What firmware version do you have? If you're system is hackable, you may decide to wait until a hack allows for remarrying the drive and main-board. I would post about this on the xbox-scene forums under the PS3 section. You may find more useful tips there.

[Juan]

yo mel

[Ex-Cyber]

PS3 security over. Homebrew = very yes.

CFW is possible, but PS3's "security" is so broken that you won't even need it.

[BlueCrab]

PS3 security over. Homebrew = very yes.

CFW is possible, but PS3's "security" is so broken that you won't even need it.

Hilarity. That's all I have to say about it. Even worse is that it appears that the psp's security has fallen with it, since the kirk engine key on that is apparently now known.

[melancholy]

yo mel

YES! Now it's time to actually get one of these jailbreaking devices, not to mention find the stuff that he says I need in that article. I've not actually messed with it yet mainly because I had no reason to do it yet.