PS3 need help

deejayg

Member
Hello everyone, seeking your guidance.
I had a broken flex power cable and my fat PS3 was turning on and off randomly, not even loading the CFW. That is now fixed, but before realizing that was the issue, I thought the disk was bad and I connected it to my PC. I think I have initialized, can't remember if I chose MBR or GPT.
Then I said, OK, let's take a dump of this exact disk into a .VHDX (using HDD RAW Copy 1.20 app). I know, I should have used DMDE and a .bin file. All wrong! :(
My SSD is 120GB and I think (can't remember) that either I selected fixed size 150GB or dynamically expand for the .VHDX. Problem is now I have a 150GB .VHDX which doesn't fix back into my 120GB SSD.
I found Berion guides and I'm still unable to recover the data.
Does someone think I still have a chance to recover them or should I forget about it?

At some point I took the current SSD (after having that dump into the .VHDX) and wiped it with my PS3 Evilnat 4.92.
My intention was to check the first sector of that wiped drive, which I compared to the first sector of the .VHDX (after mounting) and the data was the same.
I didn't understand how an initialized drive could have the same info on first sector as the recently FS formatted SSD.
Last thing I've tried was using DMDE to copy all sectors from the .VHDX into the SSD, but only to cover all sectors until fit the 120G.
That didn't work either.

I think the main issue is that I dumped it into a .VHDX.
Any feedback is appreciated.
Thanks,

sharing these images, perhaps are helpful
upload_2025-4-4_20-14-28.png

and sorry to tag you @Berion , your opinion here is appreciated.
thanks,

@Berion I've tried your tools, this is what i get:

Code:
PS3 HDD Mounter (Missing PS3PT) v1.0 by Berion
Script allows to mount UserData and 3rd VFlash partitions.

This script is only for people which overwritten PS3PT by MBR/GPT in Windows.
In other words: disk initialized by Windows.

Confirm root permissions everytime You will be asked for!


STEP 1: Devices
Choose your HDD from PS3 (type eg: /dev/sdx) from below device list:

MODEL                       SIZE NAME
                              4K /dev/loop0
                           63.8M /dev/loop1
                           63.8M /dev/loop2
                           73.9M /dev/loop3
                           66.8M /dev/loop4
                          246.3M /dev/loop5
                          246.4M /dev/loop6
                           73.9M /dev/loop7
                           11.1M /dev/loop8
                          505.1M /dev/loop9
                           11.1M /dev/loop10
                           91.7M /dev/loop11
                          618.3M /dev/loop12
                          290.8M /dev/loop13
                            516M /dev/loop14
                           10.8M /dev/loop15
                           10.8M /dev/loop16
                           49.3M /dev/loop17
                           50.8M /dev/loop18
                            568K /dev/loop19
                            576K /dev/loop20
                          227.3M /dev/loop21
                            210M /dev/loop22
                              0B /dev/loop90
APPLE SSD SM128E            113G /dev/sda
                            200M ├─/dev/sda1
                          112.8G └─/dev/sda2
APPLE HDD HTS541010A9E662 931.5G /dev/sdb
                          931.5G └─/dev/sdb1
EMTCE X150 240GB          223.6G /dev/sdd

/dev/sdd
Ok, so You've chose: "/dev/sdd".

Press any key to continue.

STEP 2: Mounting
Choose WISELY:
 1. Mount HDD came from Fat with NAND memory.
 2. Mount HDD came from Fat with NOR memory.
 3. Mount HDD came from Slim with NOR memory.

1

Choose sector of "dev_hdd0" partition:
 a. user defined LBA
 b. LBA 32

b

WARNING: Using default options for cipher (bswap16-ecb, key size 256 bits) that could be incompatible with older versions.
For plain mode, always use options --cipher, --key-size and if no keyfile is used, then also --hash.
WARNING: Device /dev/sdd already contains a 'dos' partition signature.

WARNING!
========
Detected device signature(s) on /dev/sdd. Proceeding further may damage existing data.

Are you sure? (Type 'yes' in capital letters): YES
mount: /home/gus/ps3/storage/hdd/dev_hdd0: wrong fs type, bad option, bad superblock on /dev/loop41, missing codepage or helper program, or other error.
       dmesg(1) may have more information after failed mount system call.
NAME
sdd
└─ps3hdd-bs
  └─ps3hdd

NAME   MOUNTPOINT
loop41
"/dev/loop41":
00000000  31 99 fd 04 bf 15 b8 45  b1 02 7b f1 51 1d bf 33  |1......E..{.Q..3|
00000010  20 93 70 ac a8 cb 72 89  a5 01 48 3e 7a 38 5b 67  | .p...r...H>z8[g|
00000020  92 cc 1e 9b 23 39 c4 16  22 4c ab 11 47 06 bc 3a  |....#9.."L..G..:|
00000030  be d8 ac 7d d6 de db 85  54 03 d2 f3 6d 8c 4c a2  |...}....T...m.L.|
00000040  c4 96 7c 53 be 66 08 d2  46 33 11 71 c3 71 d1 cb  |..|S.f..F3.q.q..|
00000050  1a a3 d2 cd 49 c2 7b 80  c1 f1 52 49 44 66 40 8f  |....I.{...RIDf@.|
00000060  25 5c 0d e9 f7 63 b8 99  38 80 14 0b f2 31 70 97  |%\...c..8....1p.|
00000070  2a 0b e0 52 b6 20 91 92  e5 cf 69 7e 2a c0 dc 93  |*..R. ....i~*...|
00000080  27 15 c9 f1 ed 99 1b 57  5c ec a8 4e 6e 00 ee c1  |'......W\..Nn...|
00000090  c5 ae f3 e3 cf 0c ee 75  99 83 0d 95 94 1f cd ce  |.......u........|
000000a0  93 fa 7e bd c2 59 b4 bb  7f 84 61 37 4e f4 c0 1d  |..~..Y....a7N...|
000000b0  07 84 17 90 53 91 26 95  3f b5 6c 93 04 7f c7 f9  |....S.&.?.l.....|
000000c0  a8 10 7a 61 68 a0 45 91  70 ab 72 0a ce 98 26 29  |..zah.E.p.r...&)|
000000d0  d9 85 cb 3e 23 31 38 ba  07 bf f7 19 98 d6 6d 5c  |...>#18.......m\|
000000e0  fa eb 45 80 15 59 18 38  6f 28 8b e7 15 b2 f5 ec  |..E..Y.8o(......|
000000f0  49 9b c0 90 5f 84 3e 64  1f 53 4e 7b af 3f 6a 8f  |I..._.>d.SN{.?j.|

All done. Press any key to exit.
gus@gus-macmini6-2:~/ps3$ lsblk
NAME        MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
loop0         7:0    0     4K  1 loop  /snap/bare/5
loop1         7:1    0  63.8M  1 loop  /snap/core20/2582
loop2         7:2    0  63.8M  1 loop  /snap/core20/2599
loop3         7:3    0  73.9M  1 loop  /snap/core22/2045
loop4         7:4    0  66.8M  1 loop  /snap/core24/1055
loop5         7:5    0 246.3M  1 loop  /snap/firefox/6700
loop6         7:6    0 246.4M  1 loop  /snap/firefox/6738
loop7         7:7    0  73.9M  1 loop  /snap/core22/2111
loop8         7:8    0  11.1M  1 loop  /snap/firmware-updater/167
loop9         7:9    0 505.1M  1 loop  /snap/gnome-42-2204/176
loop10        7:10   0  11.1M  1 loop  /snap/firmware-updater/147
loop11        7:11   0  91.7M  1 loop  /snap/gtk-common-themes/1535
loop12        7:12   0 618.3M  1 loop  /snap/gnome-46-2404/125
loop13        7:13   0 290.8M  1 loop  /snap/mesa-2404/912
loop14        7:14   0   516M  1 loop  /snap/gnome-42-2204/202
loop15        7:15   0  10.8M  1 loop  /snap/snap-store/1248
loop16        7:16   0  10.8M  1 loop  /snap/snap-store/1270
loop17        7:17   0  49.3M  1 loop  /snap/snapd/24792
loop18        7:18   0  50.8M  1 loop  /snap/snapd/25202
loop19        7:19   0   568K  1 loop  /snap/snapd-desktop-integration/253
loop20        7:20   0   576K  1 loop  /snap/snapd-desktop-integration/315
loop21        7:21   0 227.3M  1 loop  /snap/thunderbird/791
loop22        7:22   0   210M  1 loop  /snap/thunderbird/769
loop41        7:41   0 223.6G  1 loop
loop90        7:90   0     0B  0 loop
sda           8:0    0   113G  0 disk
├─sda1        8:1    0   200M  0 part  /boot/efi
└─sda2        8:2    0 112.8G  0 part  /
sdb           8:16   0 931.5G  0 disk
└─sdb1        8:17   0 931.5G  0 part  /home
sdd           8:48   0 223.6G  0 disk
└─ps3hdd-bs 252:0    0 223.6G  0 crypt
  └─ps3hdd  252:1    0 223.6G  0 crypt

this is the content of apps dir
Code:
./apps:
bswap16-ecb.ko  source  ufs.ko

this is the content of the keys dir
Code:
./keys:
ata_data_key.bin  ata_data_seed.bin  ata_key_1.bin  ata_key_2.bin  ata_key.bin  ata_tweak_key.bin  ata_tweak_seed.bin  eid_root_key.bin  encdec_data_key.bin  encdec_data_seed.bin  encdec_tweak_key.bin  encdec_tweak_seed.bin  flash_key.bin

my model is CECHA00
bs and ufs modules were compiled and loaded OK
i'm running ubuntu 24.04 on a late 2012 mac mini

here is the reporter output (some scripts i deleted them because my model is NAND)
Code:
PS3 Reporter v1.6 by Berion
Script helping troubleshooting.

Confirm root permissions everytime You will be asked for!


STEP 1: Devices
Choose your HDD from PS3 (type eg: /dev/sdx) from below device list:

MODEL                       SIZE NAME
                              4K /dev/loop0
                           63.8M /dev/loop1
                           63.8M /dev/loop2
                           73.9M /dev/loop3
                           66.8M /dev/loop4
                          246.3M /dev/loop5
                          246.4M /dev/loop6
                           73.9M /dev/loop7
                           11.1M /dev/loop8
                          505.1M /dev/loop9
                           11.1M /dev/loop10
                           91.7M /dev/loop11
                          618.3M /dev/loop12
                          290.8M /dev/loop13
                            516M /dev/loop14
                           10.8M /dev/loop15
                           10.8M /dev/loop16
                           49.3M /dev/loop17
                           50.8M /dev/loop18
                            568K /dev/loop19
                            576K /dev/loop20
                          227.3M /dev/loop21
                            210M /dev/loop22
                          223.6G /dev/loop41
                              0B /dev/loop90
APPLE SSD SM128E            113G /dev/sda
                            200M ├─/dev/sda1
                          112.8G └─/dev/sda2
APPLE HDD HTS541010A9E662 931.5G /dev/sdb
                          931.5G └─/dev/sdb1
EMTCE X150 240GB          223.6G /dev/sdd
                          223.6G └─/dev/mapper/ps3hdd-bs
                          223.6G   └─/dev/mapper/ps3hdd

/dev/sdd
Ok so You've chose: "/dev/sdd".

Done. Press any key to continue.

STEP 2: Reporting

System informations:
Operating System: Ubuntu 24.04.2 LTS
          Kernel: Linux 6.14.0-29-generic

Devices:
MODEL                       SIZE NAME
                              4K /dev/loop0
                           63.8M /dev/loop1
                           63.8M /dev/loop2
                           73.9M /dev/loop3
                           66.8M /dev/loop4
                          246.3M /dev/loop5
                          246.4M /dev/loop6
                           73.9M /dev/loop7
                           11.1M /dev/loop8
                          505.1M /dev/loop9
                           11.1M /dev/loop10
                           91.7M /dev/loop11
                          618.3M /dev/loop12
                          290.8M /dev/loop13
                            516M /dev/loop14
                           10.8M /dev/loop15
                           10.8M /dev/loop16
                           49.3M /dev/loop17
                           50.8M /dev/loop18
                            568K /dev/loop19
                            576K /dev/loop20
                          227.3M /dev/loop21
                            210M /dev/loop22
                          223.6G /dev/loop41
                              0B /dev/loop90
APPLE SSD SM128E            113G /dev/sda
                            200M ├─/dev/sda1
                          112.8G └─/dev/sda2
APPLE HDD HTS541010A9E662 931.5G /dev/sdb
                          931.5G └─/dev/sdb1
EMTCE X150 240GB          223.6G /dev/sdd
                          223.6G └─/dev/mapper/ps3hdd-bs
                          223.6G   └─/dev/mapper/ps3hdd

Mappers:
lrwxrwxrwx  1 root root       7 Sep  2 19:34 ps3hdd -> ../dm-1
lrwxrwxrwx  1 root root       7 Sep  2 19:34 ps3hdd-bs -> ../dm-0

Sectors preview:

mini dump from "/dev/sdd":
00000000  33 c0 8e d0 bc 00 7c 8e  c0 8e d8 be 00 7c bf 00  |3.....|......|..|
00000010  06 b9 00 02 fc f3 a4 50  68 1c 06 cb fb b9 04 00  |.......Ph.......|
00000020  bd be 07 80 7e 00 00 7c  0b 0f 85 0e 01 83 c5 10  |....~..|........|
00000030  e2 f1 cd 18 88 56 00 55  c6 46 11 05 c6 46 10 00  |.....V.U.F...F..|

mini dump from "/dev/mapper/ps3hdd-bs":
00000000  c0 33 d0 8e 00 bc 8e 7c  8e c0 be d8 7c 00 00 bf  |.3.....|....|...|
00000010  b9 06 02 00 f3 fc 50 a4  1c 68 cb 06 b9 fb 00 04  |......P..h......|
00000020  be bd 80 07 00 7e 7c 00  0f 0b 0e 85 83 01 10 c5  |.....~|.........|
00000030  f1 e2 18 cd 56 88 55 00  46 c6 05 11 46 c6 00 10  |....V.U.F...F...|

mini dump from "/dev/mapper/ps3hdd":
00000000  f4 3a 22 b1 61 69 fa 16  4a 15 2b c8 0b 22 ad e7  |.:".ai..J.+.."..|
00000010  cf 49 4e 5b 9f a4 77 ed  5d d2 05 34 08 ed 15 38  |.IN[..w.]..4...8|
00000020  f5 9e f6 28 a7 9d e1 fc  f6 c4 3f 17 b4 67 4e fb  |...(......?..gN.|
00000030  92 bc 90 62 04 c9 07 dc  0c 77 d7 6a cd 86 f9 8f  |...b.....w.j....|

mini dump from "/dev/mapper/ps3vflash":
hexdump: /dev/mapper/ps3vflash: No such file or directory
hexdump: all input file arguments failed
head: cannot open 'Unattended PS3 HDD Mounter (Fat-NOR).sh' for reading: No such file or directory
head: cannot open 'Unattended PS3 HDD Mounter (Fat-NOR, Read Only).sh' for reading: No such file or directory
head: cannot open 'Unattended PS3 HDD Mounter (Slim).sh' for reading: No such file or directory
head: cannot open 'Unattended PS3 HDD Mounter (Slim, Read Only).sh' for reading: No such file or directory
head: cannot open 'Unattended PS3 HDD Mounter (Fat-NOR).sh' for reading: No such file or directory
head: cannot open 'Unattended PS3 HDD Mounter (Fat-NOR, Read Only).sh' for reading: No such file or directory
head: cannot open 'Unattended PS3 HDD Mounter (Slim).sh' for reading: No such file or directory
head: cannot open 'Unattended PS3 HDD Mounter (Slim, Read Only).sh' for reading: No such file or directory

Scripts:
Activator Maker                          1.3
PS3 HDD & NAND Keygen                    2.1
PS3 HDD Backuper                         1.2
PS3 HDD Dumper                           1.3
PS3 HDD Expander                         0.8
PS3 HDD Mounter                          1.9
PS3 HDD Mounter (Read Only)                     1.9
PS3 HDD Mounter (Decrypted)                     1.0
PS3 HDD Mounter (Missing PS3PT)                 1.0
PS3 HDD Tasker                           1.7
PS3 HDD Umounter                         1.6
PS3 HDD Umounter (Decrypted)                    1.0
PS3 HDD Umounter (Missing PS3PT)                1.0
PS3 KO Manager                           1.2
PS3 LV1 & LV2 Crawler                    0.4
PS3 NAND Mounter                         0.8
PS3 NAND Umounter                        1.2
PS3 ODD Keygen                           0.9
Unattended PS3 HDD Mounter (Fat-NAND)           1.0

Unattended PS3 HDD Mounter (Fat-NAND, Read Only)        1.1



Unattended PS3 HDD Umounter                     1.2

Done. Press any key to exit.

by the way, I bought a 240GB SSD and did a sector by sector copy from the 157GB .VHDX into this new SSD.
all previous outputs are from this sector by sector copy into SSD. the SSD is connected as external usb disk into the ubuntu.
 
Last edited by a moderator:
If Your VHDX is made as dynamic type in the first place, then all data unwritten to known partition table and knows filesystems are preserved. At least that's what I thinking it works. However, 150GiB size suggesting it is fixed size, so there are still chances. To do something with it, you must convert it to RAW (sector by sector dump form) first (i.e mount is as read only in diskmgmt.msc and in DMDE or whatever tool you prefer, dump it to normal binary form (no, not from letter of course but via disk0, disk1 etc. or UNC Paths because you need low level access, without parsing logic structure which is unknown (overwritten by MBR/GPT still be ;]))). Or just use real disk as you did for VHDX restoration.

If you initialized disk, then you need use script for missing PS3PT, not normal (as you did). There will be few guess work for start LBA but after few tries you should find correct one for your case. And of course, you need your EID Root Key to calculate disk decryption keys for that specific console model series.

For data recovery, you don't need custom ufs module (which isn't compilling properly anyway using my toolkit, stick to bswap16-ecb only). Default UFS module in every Linux kernel is fine for reading user partition.

"Sectors preview:" output garbage if you overwritten PS3PT, that's normal for that case.

loop41 not mounted so UFS2 parsing failed, due to nothing there, or wrong start LBA you chose, or wrong ata key (wrongly generated due to wrong eid root key or wrong model chosen in keygen).

Remember also to use Umounter script after failed read attempt. Because that script also removing mappers and loops. Otherwise, you can poison your results.

Let's assume that disk dump is usable, so let's back to square one. Your ERK came from the exact same console from which this disk (disk content) was encrypted, right? And Your model is which one exactly? CECH->>?


Sorry for late answer. ;]
 
Last edited:
ERK was dumped with evilnat 4.92. we are talking always of the same console, PS3 FAT NAND CECHA00.
I always selected LBA 32 because I'm not sure if I should use another value.
I suspect this is my issue...LBA might be different, but i'm unsure how to scan to find the correct one.
By the way, I have this .VHDX on the cloud, I have no problem to share with you and my eid_root_key, if you want to take a look.
I understand if you don't want to do it, no problem.

No worries about late answer, I really appreciate your help :)

About dumping sector by sector from VHDX, this is what I did.
- attached VHDX with diskmgmt.msc
- copied sector by sector using DMDE from attached VHDX (no letter, just selected the drive from DMDE options, check screenshot example) to external disk SSD 240GB
upload_2025-9-8_14-21-27.png


- then i plugged this external SSD 240GB with the sector by sector copy into ubuntu 24.04 and used your tools.
 
I cannot download so much data, there is even not much sense in that. You can make part of disk, lets say first 128MiB and attach it along with ERK on eg. mediafire, then I can look at that (from disk, not from VHDX).
Code:
sudo dd if=/dev/sdx of=${HOME}/sample.img bs=128M count=1 status=progress

You can try increasing LBA by 8 (and so on; or decreasing but 32 was lowest I ever seen and in the same time most common). For some reason, n*8 sectors is the padding Sony using in partition table (but I never figure out why).

If that VHDX was fine, then your procedure described is fine too.
 
Last edited:
:santa1::santa1::santa1:

WHAT!!! you are a wizard!!!
i been trying to find any info via hexdump after using script "PS3 HDD Mounter (Missing PS3PT).sh" and failed miserably...
I suspect I'm not decrypting the disk properly. What trickery you did?
 
Try this:
Code:
hexdump -C ata_key.bin

00000000  54 2a e0 04 03 e2 6b 6b  5b 15 dc ec 11 74 a8 42
00000010  3a 0e 32 27 ee f9 56 66  1c f3 68 f6 10 c9 e2 3d
00000020  9c fd 33 23 4c 35 9b b5  d6 16 8d 54 e7 9c 58 ff
Code:
sudo insmod ${HOME}/ps3/apps/bswap16-ecb.ko
sudo cryptsetup create -c bswap16-ecb -d /dev/zero ps3hdd-bs /dev/sdx
sudo cryptsetup create -c aes-cbc-null -d ata_key.bin -s 192 ps3hdd /dev/mapper/ps3hdd-bs

# 13000h = 77824d
sudo losetup /dev/loop0 --offset=77824 -P /dev/mapper/ps3hdd
sudo mount -t ufs -o ufstype=ufs2,ro /dev/loop0 /mnt/ramdisk/test
13K seems wrong, should be 10000 AFAIR +/- 8 sectors (8*512). But that's what I've got from sample. I didn't looked at that for ages so I could be wrong.
 
Last edited:
BOOM

with AI help had to modify the bswap.c and rebuild
here is the code
Code:
#include <linux/module.h>
#include <linux/init.h>
#include <linux/scatterlist.h>
#include <crypto/internal/skcipher.h>

static int bswap16_setkey(struct crypto_skcipher *tfm,
                          const u8 *key,
                          unsigned int keylen)
{
        return 0;
}

static int bswap16_crypt(struct skcipher_request *req)
{
        struct skcipher_walk walk;
        unsigned int nbytes;
        int err;

        /* Ensure cryptlen is a multiple of 2 */
        if (req->cryptlen % 2)
                return -EINVAL;

        err = skcipher_walk_virt(&walk, req, false);

        while ((nbytes = walk.nbytes)) {
                u8 *src = walk.src.virt.addr;
                u8 *dst = walk.dst.virt.addr;
                unsigned int bytes_to_process = nbytes & ~1;

                while (bytes_to_process >= 2) {
                        u8 tmp = src[0];
                        dst[0] = src[1];
                        dst[1] = tmp;
                        src += 2;
                        dst += 2;
                        bytes_to_process -= 2;
                }

                err = skcipher_walk_done(&walk, nbytes & 1);
        }

        return err;
}

/* Base cipher algorithm */
static struct skcipher_alg bswap16_alg = {
        .base.cra_name           = "bswap16",
        .base.cra_driver_name    = "bswap16-generic",
        .base.cra_priority       = 100,
        .base.cra_blocksize      = 2,
        .base.cra_ctxsize        = 0,
        .base.cra_module         = THIS_MODULE,
        .min_keysize             = 0,
        .max_keysize             = 256,
        .setkey                  = bswap16_setkey,
        .encrypt                 = bswap16_crypt,
        .decrypt                 = bswap16_crypt,
};

/* ECB mode wrapper */
static struct skcipher_alg bswap16_ecb_alg = {
        .base.cra_name           = "ecb(bswap16)",
        .base.cra_driver_name    = "ecb-bswap16-generic",
        .base.cra_priority       = 100,
        .base.cra_blocksize      = 2,
        .base.cra_ctxsize        = 0,
        .base.cra_module         = THIS_MODULE,
        .min_keysize             = 0,
        .max_keysize             = 256,
        .setkey                  = bswap16_setkey,
        .encrypt                 = bswap16_crypt,
        .decrypt                 = bswap16_crypt,
};

static int __init bswap16_init(void)
{
        int ret;

        ret = crypto_register_skcipher(&bswap16_alg);
        if (ret)
                return ret;

        ret = crypto_register_skcipher(&bswap16_ecb_alg);
        if (ret) {
                crypto_unregister_skcipher(&bswap16_alg);
                return ret;
        }

        return 0;
}

static void __exit bswap16_exit(void)
{
        crypto_unregister_skcipher(&bswap16_ecb_alg);
        crypto_unregister_skcipher(&bswap16_alg);
}

module_init(bswap16_init);
module_exit(bswap16_exit);

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Byte swap pseudo-cipher");
MODULE_AUTHOR("Decaf Code <[email protected]>");
MODULE_ALIAS_CRYPTO("bswap16");
MODULE_ALIAS_CRYPTO("ecb(bswap16)");

this worked in ubuntu 6.14.0-37-generic

i'll keep with the task and let you know any news.
thanks!!!
 

Attachments

  • Screenshot 2025-12-21 004511.png
    Screenshot 2025-12-21 004511.png
    14.2 KB · Views: 15
Last edited:
Umm, but why? It works fine for me unmodified on 6.14.0-36-generic. You need to use option no. 4-a in "PS3 KO Manager.sh". ;)
 
Right, I totally forgot about it... I remember I used it in the past, but I had to recompile due to some upgrade.
I just did it and this is the outcome... still something is off
Code:
PS3 HDD Mounter (Missing PS3PT) v1.0 by Berion
Script allows to mount UserData and 3rd VFlash partitions.

This script is only for people which overwritten PS3PT by MBR/GPT in Windows.
In other words: disk initialized by Windows.

Confirm root permissions everytime You will be asked for!


STEP 1: Devices
Choose your HDD from PS3 (type eg: /dev/sdx) from below device list:

MODEL                       SIZE NAME
                              4K /dev/loop0
                          250.8M /dev/loop1
                           63.8M /dev/loop2
                             74M /dev/loop3
                           73.9M /dev/loop4
                           66.8M /dev/loop5
                           66.8M /dev/loop6
                          226.4M /dev/loop7
                          250.4M /dev/loop8
                           16.4M /dev/loop9
                           18.5M /dev/loop10
                            516M /dev/loop11
                          516.2M /dev/loop12
                            395M /dev/loop13
                          618.3M /dev/loop14
                           91.7M /dev/loop15
                          669.8M /dev/loop16
                          290.8M /dev/loop17
                           17.5M /dev/loop18
                           50.8M /dev/loop19
                           10.8M /dev/loop20
                           50.9M /dev/loop21
                            568K /dev/loop22
                            576K /dev/loop24
                          226.3M /dev/loop25
                           63.8M /dev/loop26
APPLE SSD SM128E            113G /dev/sda
                            200M ├─/dev/sda1
                          112.8G └─/dev/sda2
APPLE HDD HTS541010A9E662 931.5G /dev/sdb
                          931.5G └─/dev/sdb1
EMTCE X150 240GB          223.6G /dev/sdc

/dev/sdc
Ok, so You've chose: "/dev/sdc".

Press any key to continue.

STEP 2: Mounting
Choose WISELY:
 1. Mount HDD came from Fat with NAND memory.
 2. Mount HDD came from Fat with NOR memory.
 3. Mount HDD came from Slim with NOR memory.

1

Choose sector of "dev_hdd0" partition:
 a. user defined LBA
 b. LBA 32

a

Type sector number:
152
WARNING: Using default options for cipher (bswap16-ecb, key size 256 bits) that could be incompatible with older versions.
For plain mode, always use options --cipher, --key-size and if no keyfile is used, then also --hash.
WARNING: Device /dev/sdc already contains a 'dos' partition signature.

WARNING!
========
Detected device signature(s) on /dev/sdc. Proceeding further may damage existing data.

Are you sure? (Type 'yes' in capital letters): YES
mount: /home/gus/ps3/storage/hdd/dev_hdd0: wrong fs type, bad option, bad superblock on /dev/loop41, missing codepage or helper program, or other error.
       dmesg(1) may have more information after failed mount system call.
NAME
sdc
└─ps3hdd-bs
  └─ps3hdd

NAME   MOUNTPOINT
loop41
"/dev/loop41":
00000000  4e 26 e0 7b ef 11 b6 18  9e ee e9 d4 f9 d1 08 62  |N&.{...........b|
00000010  29 5b 09 2c 4b d6 0a da  50 34 be f1 da 28 a9 4f  |)[.,K...P4...(.O|
00000020  15 ca 22 12 17 d4 56 17  17 1b fb f8 f2 4a 81 b8  |.."...V......J..|
00000030  57 b9 b6 9d 45 58 c1 3f  12 60 b2 04 c8 6c c3 a2  |W...EX.?.`...l..|
00000040  dc cb 06 b2 8e 04 fb 34  06 87 26 71 26 93 de 13  |.......4..&q&...|
00000050  6d 22 8b 7b 98 bb 91 fb  12 7e 41 bb 3a 9a 56 d1  |m".{.....~A.:.V.|
00000060  7d 29 8c 12 03 66 76 df  40 f7 a0 40 b2 78 e3 be  |})...fv.@[email protected]..|
00000070  77 ed 65 93 0d b7 b0 19  76 88 cf bc 92 ea fa 63  |w.e.....v......c|
00000080  a4 8d e5 d2 ab 58 de 58  5e bc 6d 0d 92 45 f1 e9  |.....X.X^.m..E..|
00000090  bd 51 e7 ef d1 e4 7d 90  62 b2 a3 0e 0d 6d 47 06  |.Q....}.b....mG.|
000000a0  dc 1a 39 2b 3b bc eb 92  ab 3f c6 45 42 f4 cf a0  |..9+;....?.EB...|
000000b0  a3 aa af 25 08 db f7 bf  cf 31 9f 3b 41 d0 ea 9d  |...%.....1.;A...|
000000c0  4a 88 bf 5a 82 00 af c0  26 4c 3b 8e 91 cd 29 99  |J..Z....&L;...).|
000000d0  71 b7 5f 3d 11 83 01 6f  48 e7 db 52 f5 f0 8c 8f  |q._=...oH..R....|
000000e0  11 b5 05 bd 81 52 b9 ce  60 1b 69 83 21 54 6a d8  |.....R..`.i.!Tj.|
000000f0  d8 6c bd 58 1f d6 03 ee  8e 35 1a af 9b cb d3 5e  |.l.X.....5.....^|

All done. Press any key to exit.
gus@gus-macmini6-2:~/ps3$ lsblk
NAME        MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
loop0         7:0    0     4K  1 loop  /snap/bare/5
loop1         7:1    0 250.8M  1 loop  /snap/firefox/7559
loop2         7:2    0  63.8M  1 loop  /snap/core20/2682
loop3         7:3    0    74M  1 loop  /snap/core22/2163
loop4         7:4    0  73.9M  1 loop  /snap/core22/2139
loop5         7:5    0  66.8M  1 loop  /snap/core24/1237
loop6         7:6    0  66.8M  1 loop  /snap/core24/1225
loop7         7:7    0 226.4M  1 loop  /snap/thunderbird/919
loop8         7:8    0 250.4M  1 loop  /snap/firefox/7477
loop9         7:9    0  16.4M  1 loop  /snap/firmware-updater/216
loop10        7:10   0  18.5M  1 loop  /snap/firmware-updater/210
loop11        7:11   0   516M  1 loop  /snap/gnome-42-2204/202
loop12        7:12   0 516.2M  1 loop  /snap/gnome-42-2204/226
loop13        7:13   0   395M  1 loop  /snap/mesa-2404/1165
loop14        7:14   0 618.3M  1 loop  /snap/gnome-46-2404/125
loop15        7:15   0  91.7M  1 loop  /snap/gtk-common-themes/1535
loop16        7:16   0 669.8M  1 loop  /snap/gnome-46-2404/145
loop17        7:17   0 290.8M  1 loop  /snap/mesa-2404/912
loop18        7:18   0  17.5M  1 loop  /snap/snap-store/1300
loop19        7:19   0  50.8M  1 loop  /snap/snapd/25202
loop20        7:20   0  10.8M  1 loop  /snap/snap-store/1270
loop21        7:21   0  50.9M  1 loop  /snap/snapd/25577
loop22        7:22   0   568K  1 loop  /snap/snapd-desktop-integration/253
loop24        7:24   0   576K  1 loop  /snap/snapd-desktop-integration/315
loop25        7:25   0 226.3M  1 loop  /snap/thunderbird/915
loop26        7:26   0  63.8M  1 loop  /snap/core20/2686
loop41        7:41   0 223.6G  1 loop
sda           8:0    0   113G  0 disk
├─sda1        8:1    0   200M  0 part  /boot/efi
└─sda2        8:2    0 112.8G  0 part  /
sdb           8:16   0 931.5G  0 disk
└─sdb1        8:17   0 931.5G  0 part  /home
sdc           8:32   0 223.6G  0 disk
└─ps3hdd-bs 252:0    0 223.6G  0 crypt
  └─ps3hdd  252:1    0 223.6G  0 crypt
gus@gus-macmini6-2:~/ps3$ sudo losetup /dev/loop50 --offset=79184 -P /dev/mapper/ps3hdd
gus@gus-macmini6-2:~/ps3$ sudo mount -t ufs -o ufstype=ufs2,ro /dev/loop50 /mnt/ps3_final
mount: /mnt/ps3_final: wrong fs type, bad option, bad superblock on /dev/loop50, missing codepage or helper program, or other error.
       dmesg(1) may have more information after failed mount system call.
gus@gus-macmini6-2:~/ps3$
 
BOOM

with AI help had to modify the bswap.c and rebuild
here is the code
Code:
#include <linux/module.h>
#include <linux/init.h>
#include <linux/scatterlist.h>
#include <crypto/internal/skcipher.h>

static int bswap16_setkey(struct crypto_skcipher *tfm,
                          const u8 *key,
                          unsigned int keylen)
{
        return 0;
}

static int bswap16_crypt(struct skcipher_request *req)
{
        struct skcipher_walk walk;
        unsigned int nbytes;
        int err;

        /* Ensure cryptlen is a multiple of 2 */
        if (req->cryptlen % 2)
                return -EINVAL;

        err = skcipher_walk_virt(&walk, req, false);

        while ((nbytes = walk.nbytes)) {
                u8 *src = walk.src.virt.addr;
                u8 *dst = walk.dst.virt.addr;
                unsigned int bytes_to_process = nbytes & ~1;

                while (bytes_to_process >= 2) {
                        u8 tmp = src[0];
                        dst[0] = src[1];
                        dst[1] = tmp;
                        src += 2;
                        dst += 2;
                        bytes_to_process -= 2;
                }

                err = skcipher_walk_done(&walk, nbytes & 1);
        }

        return err;
}

/* Base cipher algorithm */
static struct skcipher_alg bswap16_alg = {
        .base.cra_name           = "bswap16",
        .base.cra_driver_name    = "bswap16-generic",
        .base.cra_priority       = 100,
        .base.cra_blocksize      = 2,
        .base.cra_ctxsize        = 0,
        .base.cra_module         = THIS_MODULE,
        .min_keysize             = 0,
        .max_keysize             = 256,
        .setkey                  = bswap16_setkey,
        .encrypt                 = bswap16_crypt,
        .decrypt                 = bswap16_crypt,
};

/* ECB mode wrapper */
static struct skcipher_alg bswap16_ecb_alg = {
        .base.cra_name           = "ecb(bswap16)",
        .base.cra_driver_name    = "ecb-bswap16-generic",
        .base.cra_priority       = 100,
        .base.cra_blocksize      = 2,
        .base.cra_ctxsize        = 0,
        .base.cra_module         = THIS_MODULE,
        .min_keysize             = 0,
        .max_keysize             = 256,
        .setkey                  = bswap16_setkey,
        .encrypt                 = bswap16_crypt,
        .decrypt                 = bswap16_crypt,
};

static int __init bswap16_init(void)
{
        int ret;

        ret = crypto_register_skcipher(&bswap16_alg);
        if (ret)
                return ret;

        ret = crypto_register_skcipher(&bswap16_ecb_alg);
        if (ret) {
                crypto_unregister_skcipher(&bswap16_alg);
                return ret;
        }

        return 0;
}

static void __exit bswap16_exit(void)
{
        crypto_unregister_skcipher(&bswap16_ecb_alg);
        crypto_unregister_skcipher(&bswap16_alg);
}

module_init(bswap16_init);
module_exit(bswap16_exit);

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Byte swap pseudo-cipher");
MODULE_AUTHOR("Decaf Code <[email protected]>");
MODULE_ALIAS_CRYPTO("bswap16");
MODULE_ALIAS_CRYPTO("ecb(bswap16)");

this worked in ubuntu 6.14.0-37-generic

i'll keep with the task and let you know any news.
thanks!!!

And now nobody can know what changes were made, or why, because there is no indication of where the problem is as the AI criteria is based on probabilities based on the trained data.

The code works without changes, as @Berion already told you before.
 
@GuilloteTesla on my last comment I apologized and used the KO manager script. and yes it worked, so dismiss that comment about the AI assisted code.

after recompiling using KO manager, i thought it was OK, but either i'm doing something wrong or the module is not working as expected on my kernel.

here the steps:
Code:
gus@gus-macmini6-2:~/ps3$ sudo cryptsetup create -c bswap16-ecb -d /dev/zero ps3hdd-bs /dev/sdc
WARNING: Using default options for cipher (bswap16-ecb, key size 256 bits) that could be incompatible with older versions.
For plain mode, always use options --cipher, --key-size and if no keyfile is used, then also --hash.
WARNING: Device /dev/sdc already contains a 'dos' partition signature.
WARNING!
========
Detected device signature(s) on /dev/sdc. Proceeding further may damage existing data.
Are you sure? (Type 'yes' in capital letters): YES
gus@gus-macmini6-2:~/ps3$ sudo cryptsetup create -c aes-cbc-null -d keys/ata_key.bin -s 192 ps3hdd /dev/mapper/ps3hdd-bs
gus@gus-macmini6-2:~/ps3$ sudo losetup /dev/loop50 --offset=79184 -P /dev/mapper/ps3hdd
gus@gus-macmini6-2:~/ps3$ sudo mount -t ufs -o ufstype=ufs2,ro /dev/loop50 /mnt/ps3_final
mount: /mnt/ps3_final: wrong fs type, bad option, bad superblock on /dev/loop50, missing codepage or helper program, or other error.
       dmesg(1) may have more information after failed mount system call.

check the image attached, on hex 000130d0 there's no /cell_mw_cfs
this was appearing when i used the AI assisted code, at least until that, then I was getting the same issue about not being able to mount because bad magic number:
[Sun Dec 21 14:04:12 2025] ufs: ufs_fill_super(): bad magic number

and again, i followed these steps with the AI code:
Code:
gus@gus-macmini6-2:~/ps3/apps/source$ make clean
make -C /lib/modules/6.14.0-37-generic/build M=/home/gus/ps3/apps/source clean
make[1]: Entering directory '/usr/src/linux-headers-6.14.0-37-generic'
make[2]: Entering directory '/home/gus/ps3/apps/source'
make[2]: Leaving directory '/home/gus/ps3/apps/source'
make[1]: Leaving directory '/usr/src/linux-headers-6.14.0-37-generic'
gus@gus-macmini6-2:~/ps3/apps/source$ ls
bswap16.c  bswap16-ecb.tar  bswap16-ecb.tar_original  dkms.conf  Makefile
gus@gus-macmini6-2:~/ps3/apps/source$ cat bswap16.c
#include <linux/module.h>
#include <linux/init.h>
#include <linux/scatterlist.h>
#include <crypto/internal/skcipher.h>

static int bswap16_setkey(struct crypto_skcipher *tfm,
                          const u8 *key,
                          unsigned int keylen)
{
        return 0;
}

static int bswap16_crypt(struct skcipher_request *req)
{
        struct skcipher_walk walk;
        unsigned int nbytes;
        int err;

        /* Ensure cryptlen is a multiple of 2 */
        if (req->cryptlen % 2)
                return -EINVAL;

        err = skcipher_walk_virt(&walk, req, false);

        while ((nbytes = walk.nbytes)) {
                u8 *src = walk.src.virt.addr;
                u8 *dst = walk.dst.virt.addr;
                unsigned int bytes_to_process = nbytes & ~1;

                while (bytes_to_process >= 2) {
                        u8 tmp = src[0];
                        dst[0] = src[1];
                        dst[1] = tmp;
                        src += 2;
                        dst += 2;
                        bytes_to_process -= 2;
                }

                err = skcipher_walk_done(&walk, nbytes & 1);
        }

        return err;
}

/* Base cipher algorithm */
static struct skcipher_alg bswap16_alg = {
        .base.cra_name           = "bswap16",
        .base.cra_driver_name    = "bswap16-generic",
        .base.cra_priority       = 100,
        .base.cra_blocksize      = 2,
        .base.cra_ctxsize        = 0,
        .base.cra_module         = THIS_MODULE,
        .min_keysize             = 0,
        .max_keysize             = 256,
        .setkey                  = bswap16_setkey,
        .encrypt                 = bswap16_crypt,
        .decrypt                 = bswap16_crypt,
};

/* ECB mode wrapper */
static struct skcipher_alg bswap16_ecb_alg = {
        .base.cra_name           = "ecb(bswap16)",
        .base.cra_driver_name    = "ecb-bswap16-generic",
        .base.cra_priority       = 100,
        .base.cra_blocksize      = 2,
        .base.cra_ctxsize        = 0,
        .base.cra_module         = THIS_MODULE,
        .min_keysize             = 0,
        .max_keysize             = 256,
        .setkey                  = bswap16_setkey,
        .encrypt                 = bswap16_crypt,
        .decrypt                 = bswap16_crypt,
};

static int __init bswap16_init(void)
{
        int ret;

        ret = crypto_register_skcipher(&bswap16_alg);
        if (ret)
                return ret;

        ret = crypto_register_skcipher(&bswap16_ecb_alg);
        if (ret) {
                crypto_unregister_skcipher(&bswap16_alg);
                return ret;
        }

        return 0;
}

static void __exit bswap16_exit(void)
{
        crypto_unregister_skcipher(&bswap16_ecb_alg);
        crypto_unregister_skcipher(&bswap16_alg);
}

module_init(bswap16_init);
module_exit(bswap16_exit);

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Byte swap pseudo-cipher");
MODULE_AUTHOR("Decaf Code <[email protected]>");
MODULE_ALIAS_CRYPTO("bswap16");
MODULE_ALIAS_CRYPTO("ecb(bswap16)");
gus@gus-macmini6-2:~/ps3/apps/source$ make
make -C /lib/modules/6.14.0-37-generic/build M=/home/gus/ps3/apps/source modules
make[1]: Entering directory '/usr/src/linux-headers-6.14.0-37-generic'
make[2]: Entering directory '/home/gus/ps3/apps/source'
warning: the compiler differs from the one used to build the kernel
  The kernel was built by: x86_64-linux-gnu-gcc-13 (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0
  You are using:           gcc-13 (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0
  CC [M]  bswap16.o
  MODPOST Module.symvers
  CC [M]  bswap16.mod.o
  CC [M]  .module-common.o
  LD [M]  bswap16.ko
  BTF [M] bswap16.ko
Skipping BTF generation for bswap16.ko due to unavailability of vmlinux
make[2]: Leaving directory '/home/gus/ps3/apps/source'
make[1]: Leaving directory '/usr/src/linux-headers-6.14.0-37-generic'
gus@gus-macmini6-2:~/ps3/apps/source$ sudo insmod
bswap16.ko        bswap16.mod.o     bswap16.o         .module-common.o
gus@gus-macmini6-2:~/ps3/apps/source$ sudo insmod bswap16.ko
gus@gus-macmini6-2:~/ps3/apps/source$ lsmod | grep bswap16
bswap16                12288  0
gus@gus-macmini6-2:~/ps3/apps/source$ sudo cryptsetup create -c bswap16-ecb -d /dev/zero ps3hdd-bs /dev/sdc
WARNING: Using default options for cipher (bswap16-ecb, key size 256 bits) that could be incompatible with older versions.
For plain mode, always use options --cipher, --key-size and if no keyfile is used, then also --hash.
WARNING: Device /dev/sdc already contains a 'dos' partition signature.

WARNING!
========
Detected device signature(s) on /dev/sdc. Proceeding further may damage existing data.

Are you sure? (Type 'yes' in capital letters): YES
gus@gus-macmini6-2:~/ps3/apps/source$ sudo cryptsetup create -c aes-cbc-null -d ../../keys/ata_key.bin -s 192 ps3hdd /dev/mapper/ps3hdd-bs
gus@gus-macmini6-2:~/ps3/apps/source$ sudo losetup /dev/loop50 --offset=79184 -P /dev/mapper/ps3hdd
gus@gus-macmini6-2:~/ps3/apps/source$ sudo mount -t ufs -o ufstype=ufs2,ro /dev/loop50 /mnt/ps3_final
mount: /mnt/ps3_final: wrong fs type, bad option, bad superblock on /dev/loop50, missing codepage or helper program, or other error.
       dmesg(1) may have more information after failed mount system call.
gus@gus-macmini6-2:~/ps3/apps/source$ sudo hexdump -C /dev/mapper/ps3hdd | head -10000 | grep cell_mw_cfs
000130d0  00 00 00 80 2f 63 65 6c  6c 5f 6d 77 5f 63 66 73  |..../cell_mw_cfs|
gus@gus-macmini6-2:~/ps3/apps/source$
 

Attachments

  • Screenshot 2025-12-21 141009.png
    Screenshot 2025-12-21 141009.png
    108 KB · Views: 19
Last edited by a moderator:
Few things needs clarification:
  • First Warning is related to cipher but it is not really used and can be ignored. This module only converting Big Endian to Little Endian, no encryption/decryption involving at this stage.
  • Your sample image isn't VHD or VHDX file. So either you unwrap it to disk before made a sample, or wasn't VHD or VHDX since the beginning. VHD header starting from "conectix" string, and VHDX from "vhdxfile".
  • Sample have MBR leftovers which is quite mysterious but possible. I had disk with that before but every time later when I use different or the same disk on the same model (in my case CECHL04), it wasn't left. Mysterious is that, disk is encrypted by AES CBC or XTS (depend of model), which both are block ciphers, which means sector based. It is not possible to left partially sector not encrypted and partially encrypted. But my early case and your case proves that something strange happening in unknown circumstances.
  • And because of MBR leftovers, they are enough for eg. cryptsetup to warning user that he probably made a human mistake and trying use wrong device. But that's not our concern because we knows that PS3 HDD.
  • Another thing I don't get it is I did not get sample decrypted fully. So I doubt it is usable anyway until you will have huge luck and only beginning of disk has been malformed. However if something would overwritten it, then we could saw plain sectors, while your sample is fully encrypted/scrambled.
  • I using Mint which is Ubuntu LTS, actually we can saying that we using the same Ubuntu. And the same kernel branch version, which means all working the same on both our computers. Which also means that bswap16-ecb normally compiled via KO Manager (it modifying module src before compiling) should result in the same LE-BE sectors conversion. Reason why you did got different results is I believe, during experiments, you didn't lifted previously created (wrongly) mappers which lead to wrong output.
 
Last edited:
  • First Warning is related to cipher but it is not really used and can be ignored. This module only converting Big Endian to Little Endian, no encryption/decryption involving at this stage.
    OK
  • Your sample image isn't VHD or VHDX file. So either you unwrap it to disk before made a sample, or wasn't VHD or VHDX since the beginning. VHD header starting from "conectix" string, and VHDX from "vhdxfile".
    My VHDX is backed up in cloud. I mounted it on Windows via Disk Management and then I used DMDE for a sector by sector copy to a 240G ssd harddrive. This is now /dev/sdc on my mac-mini (which in fact is ubuntu 24.04)
    The sample image I shared comes from this /dev/sdc.
    I have no problem on sharing the VHDX with you if you want.
  • Sample have MBR leftovers which is quite mysterious but possible. I had disk with that before but every time later when I use different or the same disk on the same model (in my case CECHL04), it wasn't left. Mysterious is that, disk is encrypted by AES CBC or XTS (depend of model), which both are block ciphers, which means sector based. It is not possible to left partially sector not encrypted and partially encrypted. But my early case and your case proves that something strange happening in unknown circumstances.
    OK
  • And because of MBR leftovers, they are enough for eg. cryptsetup to warning user that he probably made a human mistake and trying use wrong device. But that's not our concern because we knows that PS3 HDD.
    OK
  • Another thing I don't get it is I did not get sample decrypted fully. So I doubt it is usable anyway until you will have huge luck and only beginning of disk has been malformed. However if something would overwritten it, then we could saw plain sectors, while your sample is fully encrypted/scrambled.
    At some point I managed to find some random "readable" data, e.g.

    Code:
    00696ef0  00 00 00 00 00 00 00 08  00 00 00 00 00 00 00 00  |................|
    00696f00  00 00 00 ad 00 00 00 01  00 00 00 00 00 00 00 02  |................|
    00696f10  00 00 00 00 00 03 61 a8  00 00 00 00 00 02 61 a8  |......a.......a.|
    00696f20  00 00 00 00 00 00 00 40  00 00 00 00 00 00 00 00  |.......@........|
    00696f30  00 00 00 00 00 00 00 04  00 00 00 00 00 00 00 00  |................|
    00696f40  00 00 00 c1 00 00 00 01  00 00 00 00 00 00 00 03  |................|
    00696f50  00 00 00 00 00 04 00 00  00 00 00 00 00 03 00 00  |................|
    00696f60  00 00 00 00 00 00 00 10  00 00 00 00 00 00 00 00  |................|
    00696f70  00 00 00 00 00 00 00 04  00 00 00 00 00 00 00 00  |................|
    00696f80  00 00 00 c8 00 00 00 01  00 00 00 00 00 00 00 03  |................|
    00696f90  00 00 00 00 00 04 00 10  00 00 00 00 00 03 00 10  |................|
    00696fa0  00 00 00 00 00 00 00 10  00 00 00 00 00 00 00 00  |................|
    00696fb0  00 00 00 00 00 00 00 04  00 00 00 00 00 00 00 00  |................|
    00696fc0  00 00 00 cf 00 00 00 01  00 00 00 00 00 00 00 03  |................|
    00696fd0  00 00 00 00 00 04 00 20  00 00 00 00 00 03 00 20  |....... ....... |
    00696fe0  00 00 00 00 00 00 00 04  00 00 00 00 00 00 00 00  |................|
    *
    00697000  00 00 00 04 4c 43 48 4b  00 00 00 64 00 00 01 75  |....LCHK...d...u|
    00697010  3b 54 e4 85 00 00 00 08  00 00 00 08 63 6f 75 6e  |;T..........coun|
    00697020  74 72 79 5f 00 00 00 02  45 53 00 00 00 01 00 00  |try_....ES......|
    00697030  01 75 3b 55 0f a7 00 00  00 09 65 76 65 6e 74 73  |.u;U......events|
    00697040  55 72 6c 00 00 00 2d 68  74 74 70 73 3a 2f 2f 73  |Url...-https://s|
    00697050  66 2e 70 72 6f 64 2e 73  6f 6e 79 65 6e 74 65 72  |f.prod.sonyenter|
    00697060  74 61 69 6e 6d 65 6e 74  6e 65 74 77 6f 72 6b 2e  |tainmentnetwork.|
    00697070  63 6f 6d 2f 00 00 00 01  00 00 01 75 3b 55 12 74  |com/.......u;U.t|
    00697080  00 00 00 0a 66 65 61 74  75 72 65 5f 69 64 00 00  |....feature_id..|
    00697090  00 13 30 2e 30 37 39 33  38 37 39 38 39 31 32 38  |..0.079387989128|
    006970a0  30 30 38 34 38 00 00 00  01 00 00 01 75 38 71 a3  |00848.......u8q.|
    006970b0  fe 00 00 00 09 6c 61 6e  67 75 61 67 65 5f 00 00  |.....language_..|
    006970c0  00 02 65 73 00 00 00 01  00 00 01 75 3b 55 0f b9  |..es.......u;U..|
    006970d0  00 00 00 0b 6c 61 73 74  56 65 72 73 69 6f 6e 00  |....lastVersion.|
    006970e0  00 00 04 31 39 34 30 00  00 00 01 00 00 01 75 38  |...1940.......u8|
    006970f0  71 a0 77 00 00 00 15 70  64 70 4f 76 65 72 76 69  |q.w....pdpOvervi|
    00697100  65 77 4c 61 79 6f 75 74  44 61 74 61 00 00 2f cc  |ewLayoutData../.|
    00697110  7b 22 64 6f 77 6e 6c 6f  61 64 50 44 50 22 3a 7b  |{"downloadPDP":{|
    00697120  22 70 61 72 65 6e 74 22  3a 7b 22 6e 6f 50 44 50  |"parent":{"noPDP|
    00697130  4c 69 6e 6b 22 3a 7b 22  73 63 72 65 65 6e 73 68  |Link":{"screensh|
    00697140  6f 74 22 3a 7b 22 6c 61  79 6f 75 74 73 22 3a 5b  |ot":{"layouts":[|
    00697150  7b 22 76 66 69 64 22 3a  22 32 37 41 22 2c 22 63  |{"vfid":"27A","c|
    00697160  6f 6e 66 69 67 75 72 61  74 69 6f 6e 22 3a 5b 7b  |onfiguration":[{|
    00697170  22 69 64 22 3a 31 2c 22  74 79 70 65 22 3a 22 73  |"id":1,"type":"s|
    00697180  63 72 65 65 6e 73 68 6f  74 22 2c 22 77 69 64 74  |creenshot","widt|
    00697190  68 22 3a 31 7d 2c 7b 22  69 64 22 3a 32 2c 22 74  |h":1},{"id":2,"t|
    006971a0  79 70 65 22 3a 22 64 65  73 63 72 69 70 74 69 6f  |ype":"descriptio|
    006971b0  6e 22 2c 22 77 69 64 74  68 22 3a 33 7d 5d 7d 2c  |n","width":3}]},|
    006971c0  7b 22 76 66 69 64 22 3a  22 32 37 42 22 2c 22 63  |{"vfid":"27B","c|
    006971d0  6f 6e 66 69 67 75 72 61  74 69 6f 6e 22 3a 5b 7b  |onfiguration":[{|
    006971e0  22 69 64 22 3a 31 2c 22  74 79 70 65 22 3a 22 73  |"id":1,"type":"s|
    006971f0  63 72 65 65 6e 73 68 6f  74 22 2c 22 77 69 64 74  |creenshot","widt|
    00697200  68 22 3a 31 7d 2c 7b 22  69 64 22 3a 32 2c 22 74  |h":1},{"id":2,"t|
    00697210  79 70 65 22 3a 22 64 65  73 63 72 69 70 74 69 6f  |ype":"descriptio|

    No clue if this means I can still have hope...
    Another example:

    Code:
    00711c10  61 67 3d 22 38 38 64 62  30 37 62 38 66 62 38 30  |ag="88db07b8fb80|
    00711c20  33 35 36 64 36 38 66 33  63 33 30 61 38 30 63 36  |356d68f3c30a80c6|
    00711c30  66 31 30 61 3a 31 35 34  31 36 33 33 38 30 35 22  |f10a:1541633805"|
    00711c40  0a 2e 2f 6a 73 2f 61 70  70 2f 43 6f 6d 70 6f 6e  |../js/app/Compon|
    00711c50  65 6e 74 73 2f 54 4c 58  2f 63 68 65 63 6b 6f 75  |ents/TLX/checkou|
    00711c60  74 5f 73 65 6c 65 63 74  62 6f 78 2e 78 6d 6c 2e  |t_selectbox.xml.|
    00711c70  73 64 61 74 3a 6c 61 73  74 2d 6d 6f 64 69 66 69  |sdat:last-modifi|
    00711c80  65 64 3d 77 65 64 2c 20  30 37 20 6e 6f 76 20 32  |ed=wed, 07 nov 2|
    00711c90  30 31 38 20 32 33 3a 33  36 3a 34 35 20 67 6d 74  |018 23:36:45 gmt|
    00711ca0  0a 2e 2f 6a 73 2f 61 70  70 2f 43 6f 6d 70 6f 6e  |../js/app/Compon|
    00711cb0  65 6e 74 73 2f 54 4c 58  2f 63 68 65 63 6b 6f 75  |ents/TLX/checkou|
    00711cc0  74 5f 73 65 6c 65 63 74  62 6f 78 5f 69 74 65 6d  |t_selectbox_item|
    00711cd0  2e 78 6d 6c 2e 73 64 61  74 3a 63 6f 6e 74 65 6e  |.xml.sdat:conten|
    00711ce0  74 2d 74 79 70 65 3d 74  65 78 74 2f 70 6c 61 69  |t-type=text/plai|
    00711cf0  6e 0a 2e 2f 6a 73 2f 61  70 70 2f 43 6f 6d 70 6f  |n../js/app/Compo|
    00711d00  6e 65 6e 74 73 2f 54 4c  58 2f 63 68 65 63 6b 6f  |nents/TLX/checko|
    00711d10  75 74 5f 73 65 6c 65 63  74 62 6f 78 5f 69 74 65  |ut_selectbox_ite|
    00711d20  6d 2e 78 6d 6c 2e 73 64  61 74 3a 65 74 61 67 3d  |m.xml.sdat:etag=|
    00711d30  22 34 33 62 34 37 33 36  32 38 31 34 33 31 39 62  |"43b47362814319b|
    00711d40  33 37 39 33 63 34 64 32  66 64 30 38 36 38 66 30  |3793c4d2fd0868f0|
    00711d50  61 3a 31 35 34 31 36 33  33 38 30 35 22 0a 2e 2f  |a:1541633805"../|
    00711d60  6a 73 2f 61 70 70 2f 43  6f 6d 70 6f 6e 65 6e 74  |js/app/Component|
    00711d70  73 2f 54 4c 58 2f 63 68  65 63 6b 6f 75 74 5f 73  |s/TLX/checkout_s|
    00711d80  65 6c 65 63 74 62 6f 78  5f 69 74 65 6d 2e 78 6d  |electbox_item.xm|
    00711d90  6c 2e 73 64 61 74 3a 6c  61 73 74 2d 6d 6f 64 69  |l.sdat:last-modi|
    00711da0  66 69 65 64 3d 77 65 64  2c 20 30 37 20 6e 6f 76  |fied=wed, 07 nov|
    00711db0  20 32 30 31 38 20 32 33  3a 33 36 3a 34 35 20 67  | 2018 23:36:45 g|
    00711dc0  6d 74 0a 2e 2f 6a 73 2f  61 70 70 2f 43 6f 6d 70  |mt../js/app/Comp|
    00711dd0  6f 6e 65 6e 74 73 2f 54  4c 58 2f 63 6f 6d 6d 65  |onents/TLX/comme|
    00711de0  72 63 65 2f 5f 63 6f 6e  66 69 72 6d 2e 78 6d 6c  |rce/_confirm.xml|
    00711df0  2e 73 64 61 74 3a 63 6f  6e 74 65 6e 74 2d 74 79  |.sdat:content-ty|
    00711e00  70 65 3d 74 65 78 74 2f  70 6c 61 69 6e 0a 2e 2f  |pe=text/plain../|
    00711e10  6a 73 2f 61 70 70 2f 43  6f 6d 70 6f 6e 65 6e 74  |js/app/Component|
    00711e20  73 2f 54 4c 58 2f 63 6f  6d 6d 65 72 63 65 2f 5f  |s/TLX/commerce/_|
    00711e30  63 6f 6e 66 69 72 6d 2e  78 6d 6c 2e 73 64 61 74  |confirm.xml.sdat|
    00711e40  3a 65 74 61 67 3d 22 39  39 64 34 65 35 35 39 66  |:etag="99d4e559f|
    00711e50  38 33 37 38 66 35 64 36  61 39 37 64 38 34 37 34  |8378f5d6a97d8474|
    00711e60  35 31 38 31 33 65 32 3a  31 35 34 31 36 33 33 38  |51813e2:15416338|
    00711e70  31 34 22 0a 2e 2f 6a 73  2f 61 70 70 2f 43 6f 6d  |14"../js/app/Com|
    00711e80  70 6f 6e 65 6e 74 73 2f  54 4c 58 2f 63 6f 6d 6d  |ponents/TLX/comm|
    00711e90  65 72 63 65 2f 5f 63 6f  6e 66 69 72 6d 2e 78 6d  |erce/_confirm.xm|
    00711ea0  6c 2e 73 64 61 74 3a 6c  61 73 74 2d 6d 6f 64 69  |l.sdat:last-modi|
    00711eb0  66 69 65 64 3d 77 65 64  2c 20 30 37 20 6e 6f 76  |fied=wed, 07 nov|
    00711ec0  20 32 30 31 38 20 32 33  3a 33 36 3a 35 34 20 67  | 2018 23:36:54 g|
    00711ed0  6d 74 0a 2e 2f 6a 73 2f  61 70 70 2f 43 6f 6d 70  |mt../js/app/Comp|
    00711ee0  6f 6e 65 6e 74 73 2f 54  4c 58 2f 63 6f 6d 6d 65  |onents/TLX/comme|
    00711ef0  72 63 65 2f 61 64 64 41  63 63 6f 75 6e 74 46 75  |rce/addAccountFu|
    00711f00  6e 64 73 2e 78 6d 6c 2e  73 64 61 74 3a 63 6f 6e  |nds.xml.sdat:con|
    00711f10  74 65 6e 74 2d 74 79 70  65 3d 74 65 78 74 2f 70  |tent-type=text/p|
    00711f20  6c 61 69 6e 0a 2e 2f 6a  73 2f 61 70 70 2f 43 6f  |lain../js/app/Co|
    00711f30  6d 70 6f 6e 65 6e 74 73  2f 54 4c 58 2f 63 6f 6d  |mponents/TLX/com|
  • I using Mint which is Ubuntu LTS, actually we can saying that we using the same Ubuntu. And the same kernel branch version, which means all working the same on both our computers. Which also means that bswap16-ecb normally compiled via KO Manager (it modifying module src before compiling) should result in the same LE-BE sectors conversion. Reason why you did got different results is I believe, during experiments, you didn't lifted previously created (wrongly) mappers which lead to wrong output.
    Indeed, I just made a new attempt by cleaning everything and starting from scratch using only your scripts.
    I can now see it:
    Code:
    gus@gus-macmini6-2:~/ps3$ sudo hexdump -C /dev/mapper/ps3hdd | head -100000 | grep cell
    000130d0  00 00 00 80 2f 63 65 6c  6c 5f 6d 77 5f 63 66 73  |..../cell_mw_cfs|
    Sorry about that @Berion, @GuilloteTesla
 
Last edited by a moderator:
My VHDX is backed up in cloud. I mounted it on Windows via Disk Management and then I used DMDE for a sector by sector copy to a 240G ssd harddrive.
That's fine, best/safest you could do to get rid of VHDX encapsulation. Otherwise you can toy with qemu-nbd and nbd server/client to convert it on the fly to raw.
This is now /dev/sdc on my mac-mini (which in fact is ubuntu 24.04)
The sample image I shared comes from this /dev/sdc.
Is that mean that you overwritten PS3 data to install Ubuntu?
No clue if this means I can still have hope...
Another example:
Looks fine. "Missing PS3PT" script should work (be sure that you don't have occupied /dev/loop's which script using, because what I saw on some earlier screenshots, on your machine you have a lot of them), you can try also do that manually, but not from 13000 address but 10000. Or something around. UFS2 starting from nearly zeroed super block.
 
Last edited:
No, its an SSD plugged via USB as external hard drive.
UFS2 magic number should be 19 54 01 19, right?
I see it twice:
Code:
gus@gus-macmini6-2:~/ps3$ sudo hexdump -C /dev/mapper/ps3hdd | head -1000000 | grep '19 54 01 19'
00013550  00 00 00 00 00 00 00 00  00 00 00 00 19 54 01 19  |.............T..|
00017550  00 00 00 00 00 00 00 00  00 00 00 00 19 54 01 19  |.............T..|

I'm starting to think that I might need to run fsck on this drive after being decrypted.
Idea would be to get another 240G SSD, do sector by sector copy to this new drive, connect this drive into FREEBSD and run fsck on it.
what do you think?

#########################################################

MERRY F'N CHRISTMAS!!!
upload_2025-12-22_19-42-34.png


thank you so so much guys!!! I'm crying.
:santa1::santa1::santa1::santa1::santa1:
:home::home::home::home::home:
 

Attachments

Last edited:

Similar threads

Back
Top