PS3 [UPDATE] IDPS Dumper (PS3 NAND / NOR ) - 4.81/4.82 OFW Compatible by Team PS3Xploit

{UPDATE v0.2.3 Released(See tab)}
Following the official announcement of the PS3Xploit news (4.81 OFW Exploit), the devs behind the project have fulfilled the promises of releasing the IDPS Dumper for OFW 4.81/4.82 as this release is ready for the public. Now there is many more things being worked surrounding the overall project but this IDPS Dumper works on all models of the PS3 (NOR and NAND, note 12 GB EMMC will be supported soon in an updated release) and no reason not to release this tool. Since PS3 firmware 4.70 Sony had blocked flatz IDPS extracting tool (IDPS Stealer) and there has not been a known way to obtain the IDPS on OFW (4.70 +) consoles , but now this tool can now obtain your PS3's ID, which can have various uses, the tool has been confirmed to work on SuperSlim models by the team. . If you have not read the previous details about the PS3Xploit project, then checkout this official thread to get the firsthand information about this ambitious PS3 project.
​

(UPDATE v0.2.3)

​

UPDATE v0.2.3 - 4.82 UPDATE v0.2.3 - 4.81 UPDATE v0.2.1a IDPS Dumper Release (v0.2 After Leak Release)

• 
  
  UPDATE v0.2.3- IDPS Dumper for 4.82 OFW​
  • Added 4.82 Support
  • Removed all extra requirements like JQuery..
  • Removed the need for string relocations to improve the initial memory search process & overall trigger times.
• 
  
  UPDATE v0.2.3- IDPS Dumper for 4.81 OFW​
  
  
  • Removed all extra requirements like JQuery..
  • Removed the need for string relocations to improve the initial memory search process & overall trigger times.
  
  
• 
  
  
  UPDATE v0.2.1a- IDPS Dumper for 4.81 OFW​
  
  we have some more exciting news to bring you!!
  
  We have been working very hard to bring eMMC support for the newest SuperSlims CECH-40xxA, CECH-42xxA , CECH-43xxA and that has happened.
  
  The team would like to present a nice little update to the 4.81 IDPS Dumper now supporting eMMC hardware revision consoles!!
  
  Please report any issues you have while using this new version on any of the flash types, NAND, NOR, and eMMC.
  
  Thank You to all
  
  ​
  v0.2.1a
  
  • Added eMMC SuperSlim Support (CECH-40xxA, CECH-42xxA , CECH-43xxA)
  • Misc Tweaks To Exploit
  • Small typo on index.html pointed out by @Turranius - Fixed
  
  
  How to use this:
  *** MAKE SURE TO RUN AS ADMINISTRATOR ***
  install python to use server.py or another HTTP server of your choosing on both Windows and Linux!​
  
  On windows - Install any of these optional HTTP servers:
  
  • MiniWeb: https://sourceforge.net/projects/miniweb/files/latest/download
  • Python (for server.py): https://www.python.org/ftp/python/2.7.14/python-2.7.14.msi
  • XAMPP: https://downloadsapachefriends.glob....1.11/xampp-win32-7.1.11-0-VC14-installer.exe
  
  On linux:
  
  • install python for your distribution using apt-get, yum, and similar commands.
  • make script executable using "chmod a+x server.py" or "chmod 775 server.py" or "chmod 777 server.py"
  • execute python script using "/usr/bin/python $exploitFolder/server.py" or "./server.py"
  
  Update on Android: (instructions from @No0bZiLLa)
  
  • I can confirm this does work if using an http server on Android. what i did was downloaded the zip (on my phone) and extracted it and then download something like Simple HTTP Server and point the server to the folder that contains index.html. once you do that just reload the server and make a note of what the ip:port is. then just go to ps3, type in ip:port (eg 192.168.2.7:12345) as specified in simple http server and then select the appropriate button for your system.
  
  
  Then run (for python):
  
  • On windows - windows.bat
  • On linux - linux.sh
  
  
  Usage Tips:
  
  1) Try using a LAN connection or a solid WiFi connection during exploitation. A weak signal can cause problems.
  2) If the exploit takes more than 5 minutes to work, reload page, browser, or restart console and try again.
  3) If you are using a LAN connection and experience network issues, make sure all cables to router are in working order.​
  
  
• 
  
  
  IDPS Dumper Release (v0.2 - After Leak Release)
  ​
  ok....the moment all of you have been waiting for......i assume
  
  • File: ps3_481_idps_dumper-PS3XPloit.zip
  • MD5 Hash: FFDA70AB2D1677886083F99185C54FE3
  • SHA-256 Hash: 852BDB301753C4F4A7E946188E850D3D325EEAA259B61AE2B5AE31320B2F292B
  
  enjoy this release from our team we will be working hard to add eMMC support as soon as possible!!
  
  
  The documentation will be updated as time goes on. There is a readme.txt file included with basic setup and usage instructions.
  
  Please stay tuned for future tools and releases
  
  and once again, THANK YOU to everyone involved bringing this all together, without all of you, none of this would have happened!!!
  
  Additional details from @bguerville
  "The idps dumper will create a file on usb000 then beep 3 times & shutdown in all cases, even if flash memory read fails. emmc should not make a difference to this. You will get garbage in idps.bin in that case.
  
  Js errors with a black page message on ps3 should not happen. If ever it did, just report & in the meantime keep relaunching the exploit. Nobody has had this issue in dozens of tests though.
  
  And clearing cache or cookies is totally unnecessary with the exploit & the wk js interpreter. Between runs garbage collection will take care of cleaning up what is needed, the job it does is always sufficient".
  

It's essential not to flood the browser memory with junk before running the exploit. The reason for this is that due to javascript core memory usage limitations we are scanning several times a small range of browser memory (a few Mb) to find some essential data in RAM, if the memory is flooded then the range to scan becomes much larger & the probabilities that our data is found in the smaller range decrease dramatically....

So in short, never use the browser or set a homepage you cancel before running the exploit!
If you need to, set the homepage to 'blank', close the browser then reopen it to start the idps dumper.​

Set-up Steps:​

1. Setup a small Web server on pc or smartphone. The Python http server is not required for most users, it was provided for developers. Since v0.2.3, all other extra requirements have been removed. Don't come to us for explanations about how to run a http server though. Google it.​
2. Extract the files in your http server root folder.​
3. Put a fat32 USB key in port closest to BD Drive (/dev_usb000).​
4. Open the ps3 browser & write the ip address of your server (and the port if not 80).​
5. Run until ps3 beeps & shutdown. The idps should be on your USB drive as idps.bin.​

​

- Downloads - ​

Download: (4.82) ps3_idps_dumper-v0-2-3-ps3xploit-4-82-zip​

• MD5 Hash: 3c2e1582f52e1002a12ad280f426d0c6
• SHA-256 Hash: 1c49eabd64275171a60c90f0f06f503b7055f4ff863f87e7960d41464d127443

Download: (4.81) ps3_idps_dumper-v0.2.3-PS3XPloit.zip​

• MD5 Hash: 71dd906e585bf470f84f9d4fb10c1f37
• SHA-256 Hash: d4bffe2b7d08c1dda275590229f86903f1db487e9a78364d6a025c3734cd8f68

 

Nice =)

I tried to fix the python server on Win10 x64. Installed Python as per the link above.
Grabbed "Python module for Windows - Binaries" from http://www.capstone-engine.org/download.html and installed into the python installation dir.

Added the python folder to path and tried running. I now get passed the capstone error but now I just get

C:\PS3\ps3_idps_dumper-v0.2.1-PS3XPloit>python.exe server.py
Starting server on 192.168.101.79:8080
Traceback (most recent call last):
  File "server.py", line 243, in <module>
  server = SocketServer.TCPServer(('', PORT), PS3WebServer)
  File "c:\ps3\python27\lib\SocketServer.py", line 417, in __init__
  self.server_bind()
  File "c:\ps3\python27\lib\SocketServer.py", line 431, in server_bind
  self.socket.bind(self.server_address)
  File "c:\ps3\python27\lib\socket.py", line 228, in meth
  return getattr(self._sock,name)(*args)
socket.error: [Errno 10013] An attempt was made to access a socket in a way forbidden by its access permissions

That is running cmd as administrator.

 

Nice =)

I tried to fix the python server on Win10 x64. Installed Python as per the link above.
Grabbed "Python module for Windows - Binaries" from http://www.capstone-engine.org/download.html and installed into the python installation dir.

Added the python folder to path and tried running. I now get passed the capstone error but now I just get

C:\PS3\ps3_idps_dumper-v0.2.1-PS3XPloit>python.exe server.py
Starting server on 192.168.101.79:8080
Traceback (most recent call last):
  File "server.py", line 243, in <module>
  server = SocketServer.TCPServer(('', PORT), PS3WebServer)
  File "c:\ps3\python27\lib\SocketServer.py", line 417, in __init__
  self.server_bind()
  File "c:\ps3\python27\lib\SocketServer.py", line 431, in server_bind
  self.socket.bind(self.server_address)
  File "c:\ps3\python27\lib\socket.py", line 228, in meth
  return getattr(self._sock,name)(*args)
socket.error: [Errno 10013] An attempt was made to access a socket in a way forbidden by its access permissions

That is running cmd as administrator.

Try another port...

 

Hi! I got my ps3 idps. What will be the next step?

 

A simple explained tuto will be a great help for boobies like me please

Sent from my LG-H818 using Tapatalk

 

@emilzago

i will quote straight from the article itself.

Update on Android: (instructions from @No0bZiLLa)

• I can confirm this does work if using an http server on Android. what i did was downloaded the zip (on my phone) and extracted it and then download something like Simple HTTP Server and point the server to the folder that contains index.html. once you do that just reload the server and make a note of what the ip:port is. then just go to ps3, type in ip:port (eg 192.168.2.7:12345) as specified in simple http server and then select the appropriate button for your system

to use it on pc, it is pretty much the exact same tut. just either use server.py or download your own http server and host the files locally yourself. then go to ps3, and type in ip:port to server and click the link that is appropriate for your system.

 

Try another port...

That worked. So yes, you need the "Python module for Windows - Binaries" from http://www.capstone-engine.org/download.html
as well. Install it into the same dir as Python was installed to.

Running it now. No go so far, but this is the first web server where I see the debug text on the PS3 screen.

Also testing on a 4004c

 

@noobzilla
Ok i used my android phone and i am here now on the ps3 browser

DIRECTORY INDEX
Html/
Index.html
Linux.sh
Server.py
Windows.bat


What should i selec now in my ps3 browser?

Sent from my LG-H818 using Tapatalk

 

My problems does not seem to web server related anyway. Tried Apache (Fedora 25), MiniWeb (Win10x64), Python (Win10x64) and IIS (Win Server 2016 x64)

Both PS3s tested are on OFW 4.81, LAN (same switch tested).

 

Thanks a lot @nOobZILLA
and thanks the team it worked on my cech4004a

Sent from my LG-H818 using Tapatalk

 

thats a zero '0' in my nick. no'0'bzilla. but anyways, seems you have gotten it working. good job!

 

Doesn't work for me, 4004C console. I have a shitty Wi-Fi (150Kb/s) tho and the server seemed to try to get the POC without failing anywhere. At a moment it asked me to leave the browser so I did, but I have no idps

Used the NOR exploit

 

try rebooting or closing the browser and going back to the link. if it doesnt work within 5 min or less then retry

 

@noobzilla
Ok i used my android phone and i am here now on the ps3 browser

DIRECTORY INDEX
Html/
Index.html
Linux.sh
Server.py
Windows.bat


What should i selec now in my ps3 browser?

Sent from my LG-H818 using Tapatalk

Click the "index.html".

Sent from my Zenfone Max using Tapatalk

 

Could people with poor WiFi bypass their router with "ad hoc" to their phones? Maybe helpful if router and PS3 are far apart.

 

you can locally host the files from quite literally ANY device that supports the HTTP protocol and can serve files to the PS3


THE ACTUAL BOX THAT SEALED THE FATE OF THE PS3!!!!

SHOUT OUT TO ALLIED RECORDS....YOU WERE OPEN LATE!!!

 

It worked idps is valid. Dump worked

Sent from my SCL-L02 using Tapatalk

How will you know if you have a valid idps?

 

There is a update

Sent from my SCL-L02 using Tapatalk

 

What should Sony realeased 4.82

Sent from my SCL-L02 using Tapatalk

 

PS update 4.82 is now out, Not installing it but, This does not seem to be working on either of my CECHE01's, using either the Python version I get server and the like but, I have reset many times let it run upwards of 30 mins each run and nothing. even with my own webserver still never gets a IDPS.

 

4.82 is out ????

i just downloaded from $ony now and MD5 Hash of PUP is B2483B4ABC157494447C9C409C036041 which matches 4.81 OFW

if this is true....turn off auto-updates!!


EDIT #1:

ok it is true!!!

TURN OFF AUTO-UPDATES!!!