PS3 [TUTORIAL] Unlock up to 8% extra total space on the PS3 internal hard drive

x23are · Oct 16, 2018

Berion said:
@Agoni212 It is NOT dangerous to the console itself and it CANNOT brick it. In worst scenario You'll lost Your user data...

@x23are If You need step by step guide with many things explained in details, You need to wait a little longer (one or two weeks). My tutorial is not for fs table manipulation but for write access to the partitions on Linux, outside PS3 environment, but it will definitely cover up the step where You stuck. I have almost completed, ten pages.

View attachment 13499

cool
when this tutorial is ready?

Berion · Oct 18, 2018

When it's done.

armorsnake · Oct 31, 2018

Berion said:
@fresh You will get this error in cases of:

when bswap somehow is incompatible with nbd-server/linux distro

when You have occupied loop0 slot (it needs to be empty for nbd0 mapping... somehow )

Solution:

compile bswap by Yourself from source (You need as I remember g++ to be installed)

use Linux Mint 18.1 .2 or .3 and do not update it (just install newest available nbd-server)

install it where ever You want, even on deadly slow pendrive, just don't use Live session as this one using loop0 slot for SquashFS mount

Author said it works on Ubuntu 16.04 with precompiled binaries. I didn't test it so I mentioned only about Mint which is enough stupid-proof for me and have normal GUI (I hate Unity and Gnome3).

Which exactly version aru u using? Linux Mint 18.1 "Serena" Cinnamon (64-bit) will be good?
On Ubuntu 16.4 and some Mint ive got:

Code:

" Requested offset is beyond real size of device /dev/nbd0 "[code]

Berion · Oct 31, 2018

@armorsnake I made an tutorial:
https://forum.cdrinfo.pl/f106/poradnik-montowanie-pamieci-wewnetrznej-ps3-na-linuksie-97569/
You can also download precompiled binaries and scripts from there.

Linux Mint 18.3 with nbd-server v3.13-262-g69a15c0-dirty (on i.e v3.16.2 doesn't work, also doesn't work on 19.0 v2). I don't know why. Tried 18.1 and 18.2 and still good to go.

PS: I didn't translate it yet to English because I'm still trying solve the FAT mysteries and looking a better way to UFS write support than ufs.ko.

armorsnake · Oct 31, 2018

@Berion Thank you so much and its in my native language

I will try this for sure.

aceballzdeep · Nov 26, 2018

very interesting and usefull, change from time to space only affects writes correct, your mod could fix the issues with running a true SSD harddrive if set to space and allocated more space for frag. ive had issues running SSDs using every brand under the sun, most SSDs trim/frag themself but the ps3 doesnt no its a SSDs and tries to frag it resulting in file system corrupt every couple wks

ill run som tests if i evr get time most of my SSDs r 3/4s full or r in my main devices

oleguer · Dec 13, 2018

Finally anyone have a video tutorial?? I'm interesting in unlock 8% but I'm not sure how can do this (easy method? =))

einsteinx2 · Jan 25, 2019

oleguer said:
Finally anyone have a video tutorial?? I'm interesting in unlock 8% but I'm not sure how can do this (easy method? =))

No need for a video tutorial, I'm currently working on a homebrew app that will run on the PS3 itself to do this. This method was really just a proof of concept to see if could even be done at all.

I was delayed a while due to problems getting PS3 homebrew code compiling (and work getting in the way), but I've resolved the issues I had and am working on a proof of concept app now. No ETA, but I'll post here when I have it finished.

einsteinx2 · Jan 25, 2019

aceballzdeep said:
change from time to space only affects writes correct

Yep exactly. Reads work the same either way.

And that change can be made independently of the reserved space change. I'll probably include a toggle for that separately in the homebrew app I'm working on.

oleguer · Jan 26, 2019

THANKS einsteinx2!!! for your work!! I wait your app!! Thank you show much!!

einsteinx2 · Jan 26, 2019

oleguer said:
THANKS einsteinx2!!! for your work!! I wait your app!! Thank you show much!!

Thanks! However, I do need to temper expectations a bit before anyone gets too excited...

I did a lot of investigative work last night trying to get the proof of concept working that would just show the current reserved space setting (assuming that once I can get that working, writing to it should be relatively simple).

However, I immediately ran into some serious roadblocks. To get a bit technical, it appears I'm not able to open the /dev_hdd0 mount point using the standard read() syscall or fread() c function (though I can open other files, so my code is written correctly), and I've tried various ways to access the underlying drive path with no success so far.

I'm working a bit blind as I have limited experience with the PS3 operating system and homebrew development, but there is a possibility that this either may not be possible to accomplish (due to restrictions on homebrew app permissions or some other reason) or that it may be possible but just much more complicated than I thought and outside of my ability to write.

In any case, I'm still early in the investigative stage, so I definitely haven't tried everything yet and I still have some hope it'll be possible. If I end up getting completely stuck, I'll upload my work in progress code and try and solicit help from developers more experienced with the PS3's operating system.

I'll hold off reporting back here again until I either make some progress, or reach an impassible road block.

Berion · Jan 26, 2019

However, I immediately ran into some serious roadblocks. To get a bit technical, it appears I'm not able to open the /dev_hdd0 mount point using the standard read() syscall or fread() c function (though I can open other files, so my code is written correctly), and I've tried various ways to access the underlying drive path with no success so far.

<trying summon PS3 elder spirits> ^^"
@aldostools @Zar @zecoxao @deank @bguerville @esc0rtd3w @sandungas

einsteinx2 · Jan 26, 2019

Specifically if anyone knows the hard drive device paths, that would potentially be very helpful (for example I tried the standard FreeBSD format of /dev/adas1a and other variations, as well as /dev/hdd0 without success, though I need to look into how to list the directories on the base filesystem if it's possible so I'm not poking around in the dark).

Also if anyone knows whether it's possible to directly access the actual partitions at all without manually decrypting them, that would be very helpful as well. /dev_hdd0 seems to be just the mount point for the decrypted partition, so I'm not sure if it can be used to manipulate raw bytes on the partition or if it only allows for accessing files.

I need to modify the partition header, which is simple enough to do on Linux once the drive is mounted, but it's done using the hard drive device paths directly not from the mount points, so I think it's unlikely /dev_hdd0 will give me the access I need. However, if I do find the device paths but still need to manually decrypt the partition again before accessing the partition table, that would probably be outside of my ability to code.

I'm also looking into the PS3 specific lvl2fs filesystem syscalls, to see if that's what I need to use, as I'm very unfamiliar with all this, so I'm learning as a I go.

I'm going to keep tinkering with this in my free time, and will get my work in progress up on Github soon so others can take a look.

Zar · Jan 26, 2019

I'm ont an elder spirit but it feels good you think I am. lol.

I'm not sure...
to access to /dev_hdd0 you must set the correct capability and control flags, for example : https://github.com/Zarh/ManaGunZ/blob/master/Makefile#L53

I'm not sure too, i didn't test it.
To access to raw data.. You can use sys_storage syscalls.

Code:

#define FLASH_NAND            0x100000000000001ULL
#define FLAS_NAND_EXT        0x100000500000001ULL
#define FLASH_NOR            0x100000000000004ULL
#define FLASH_NOR_EXT        0x100000200000004ULL

#define ATA_HDD                    0x101000000000007ULL
#define BDVD_DRIVE                0x101000000000006ULL
#define PATA0_HDD_DRIVE            0x101000000000008ULL
#define PATA0_BDVD_DRIVE        BDVD_DRIVE
#define PATA1_HDD_DRIVE            ATA_HDD
#define PATA1_BDVD_DRIVE        0x101000000000009ULL
#define CARDCTRL                0x101000000000010ULL  // ?
#define BUILTIN_FLASH            0x100000000000001ULL
#define MEMORY_STICK            0x103000000000010ULL
#define SD_CARD                    0x103000100000010ULL
#define COMPACT_FLASH            0x103000200000010ULL

#define USB_MASS_STORAGE_1(n)    (0x10300000000000AULL+(n)) // For 0-5
#define USB_MASS_STORAGE_2(n)    (0x10300000000001FULL+((n)-6)) // For 6-127
#define USB_MASS_STORAGE(n)        (((n) < 6) ? USB_MASS_STORAGE_1(n) : USB_MASS_STORAGE_2(n))

#define    HDD_PARTITION(n)    (ATA_HDD | ((uint64_t)n<<32))
#define FLASH_PARTITION(n)    (BUILTIN_FLASH | ((uint64_t)n<<32))

typedef struct
{
    char   Label[8];
    u32    unknown02;
    u32    zero01;
    u32    unknown03;
    u32    unknown04;
    u8     zero02[16];
    u64    sector_count;
    u32    sector_size;
    u32    unknown05;
    u8     writable;
    u8     unknown06[3];
    u32    unknown07;
} __attribute__((packed)) device_info_t;


s32 sys_storage_open(u64 device_ID, u32* fd)
{
    lv2syscall4( 600, device_ID, 0, (u64)fd, 0 );
    return_to_user_prog(s32);
}

s32 sys_storage_close( u32 fd)
{
    lv2syscall1( 601, fd );
    return_to_user_prog(s32);
}

s32 sys_storage_read( u32 fd, u64 start_sector, u64 nb_sector, const void* buffer, u32 *number_byte_read, u64 flags )
{
    lv2syscall7( 602, fd, 0, start_sector, nb_sector, (u64)buffer, (u64)number_byte_read, flags );
    return_to_user_prog(s32);
}

s32 sys_storage_write( u32 fd, u64 start_sector, u64 nb_sector, const void* buffer, u32 *number_byte_wrote, u64 flags )
{
    lv2syscall7( 603, fd, 0, start_sector, nb_sector, (u64)buffer, (u64)number_byte_wrote, flags );
    return_to_user_prog(s32);
}

s32 sys_storage_get_device_info(u64 device_id, device_info_t *device_info)
{
    lv2syscall2( 609, device_id, (u64)device_info );
    return_to_user_prog(s32);
}

void DumpRawData()
{
    u32 source;
    u32 read;
    int ret=-1;
    u64 device_id = HDD_PARTITION(1);
 
     
    device_info_t device_info;
    ret = sys_storage_get_device_info(device_id, &device_info);
    if( ret != 0 ) {
        free(info);
        return;
    }
 
    ret = sys_storage_open(device_id, &source );
    if( ret != 0 ) {
        free(info);
        return;
    }
 
    u8 *sector = (u8 *) malloc(device_info.sector_size);
    if(sector==NULL) {
        free(info);
        return;
    }
 
    char temp[64];
    if(strcmp(info[i].mount_point, "/")==0) strcpy(temp, "/dev_hdd0/tmp/rawdata_root.bin");
    else sprintf(temp, "/dev_hdd0/tmp/rawdata_%s.bin", &info[i].mount_point[1]);
 
    FILE *f;
    f = fopen("/dev_usb000/raw.bin, "wb");
    if(f==NULL) {
        free(info);
        free(sector);
        return;
    }
 
    u64 count = device_info.sector_count;
 
    for(i=0x0; i < count; i+=0x1) {
        sys_storage_read( source, i, 1, sector, &read, 0);
        fwrite(sector, sizeof(sector), 1, f);
    }
 
    fclose(f);
    sys_storage_close(source);    
    free(sector);
}

einsteinx2 · Jan 26, 2019

@Zar Thanks, that helps a ton! I had a feeling I may have been using the wrong syscall. I'll try this out and see how it goes. I'm only trying to read/write single bytes to 2 locations in the partition inside the superblock, and I can confirm from the read whether I'm getting the correct location or not.

sandungas · Jan 27, 2019

Hmmm, there was a tool/app made by gitbrew team named "dump ptab pkg" (a bit confusing name, because is not explicit enought)
That tool was making a copy of the first 2 sectors of the hdd

In it you could see the partition table, with the offsets and the ACL's (access control lists) for every partition/region, etc...

I dont know how it was made, but the tool was running in gameOS, and was made for 3.40 custom firmware (way before the custom firmwares implemented other complex patches)
So... i guess it should work to read any sector of the hdd
For writing... dunno, but hopefully is the same... most probably is going to be needed to write a full sector, or a page/block (after backuping it so most of the data writen is the same before writing, you just change the 2 bytes)

einsteinx2 · Jan 27, 2019

Thanks @sandungas that's great to hear and really gives me confidence that this can work! And as you said, reading/writing sectors/blocks at a time instead of bytes shouldn't be an issue.

I'm going to try and squeeze in a few hours
this week to play with the proof of concept. I have some friends that just came into town, so it may be next week, but I'll report back once I either have a prototype or hit a wall again.

Thanks everyone for all the help so far, I couldn't do this without the community!

kadorna2 · Jan 27, 2019

sandungas · Jan 27, 2019

Found it, it dumps the first 2 sectors of flash though, and uses syscalls: lv2_storage_open, lv2_storage_read, lv2_storage_close
https://github.com/sguerrini97/psl1ghtv2_ports/blob/master/dump_flash_ptab/source/main.c

einsteinx2 · Jan 29, 2019

You rock! That's for taking the time to look into this!

BEFORE	AFTER
BEFORE	AFTER

PS3 [TUTORIAL] Unlock up to 8% extra total space on the PS3 internal hard drive

x23are

Berion

armorsnake

Berion

armorsnake

aceballzdeep

oleguer

einsteinx2

einsteinx2

oleguer

einsteinx2

Berion

einsteinx2

Zar

einsteinx2

sandungas

einsteinx2

kadorna2

sandungas

einsteinx2

Similar threads

Featured content

Trending content

Latest posts