PS3 [UPDATE] IDPS Dumper (PS3 NAND / NOR ) - 4.81/4.82 OFW Compatible by Team PS3Xploit

{UPDATE v0.2.3 Released(See tab)}
Following the official announcement of the PS3Xploit news (4.81 OFW Exploit), the devs behind the project have fulfilled the promises of releasing the IDPS Dumper for OFW 4.81/4.82 as this release is ready for the public. Now there is many more things being worked surrounding the overall project but this IDPS Dumper works on all models of the PS3 (NOR and NAND, note 12 GB EMMC will be supported soon in an updated release) and no reason not to release this tool. Since PS3 firmware 4.70 Sony had blocked flatz IDPS extracting tool (IDPS Stealer) and there has not been a known way to obtain the IDPS on OFW (4.70 +) consoles , but now this tool can now obtain your PS3's ID, which can have various uses, the tool has been confirmed to work on SuperSlim models by the team. . If you have not read the previous details about the PS3Xploit project, then checkout this official thread to get the firsthand information about this ambitious PS3 project.


capture_0.2.3.jpg

(UPDATE v0.2.3)


  • UPDATE v0.2.3- IDPS Dumper for 4.82 OFW
    • Added 4.82 Support
    • Removed all extra requirements like JQuery..
    • Removed the need for string relocations to improve the initial memory search process & overall trigger times.

  • UPDATE v0.2.3- IDPS Dumper for 4.81 OFW

    • Removed all extra requirements like JQuery..
    • Removed the need for string relocations to improve the initial memory search process & overall trigger times.



  • UPDATE v0.2.1a- IDPS Dumper for 4.81 OFW

    we have some more exciting news to bring you!! :cheerful:

    We have been working very hard to bring eMMC support for the newest SuperSlims CECH-40xxA, CECH-42xxA , CECH-43xxA and that has happened. :D

    The team would like to present a nice little update to the 4.81 IDPS Dumper now supporting eMMC hardware revision consoles!!

    Please report any issues you have while using this new version on any of the flash types, NAND, NOR, and eMMC.

    Thank You to all :cool:

    v0.2.1a
    • Added eMMC SuperSlim Support (CECH-40xxA, CECH-42xxA , CECH-43xxA)
    • Misc Tweaks To Exploit
    • Small typo on index.html pointed out by @Turranius - Fixed

    How to use this:
    *** MAKE SURE TO RUN AS ADMINISTRATOR ***
    install python to use server.py or another HTTP server of your choosing on both Windows and Linux!​

    On windows - Install any of these optional HTTP servers:

    On linux:
    • install python for your distribution using apt-get, yum, and similar commands.
    • make script executable using "chmod a+x server.py" or "chmod 775 server.py" or "chmod 777 server.py"
    • execute python script using "/usr/bin/python $exploitFolder/server.py" or "./server.py"

    Update
    on Android: (
    instructions from @No0bZiLLa)
    • I can confirm this does work if using an http server on Android. what i did was downloaded the zip (on my phone) and extracted it and then download something like Simple HTTP Server and point the server to the folder that contains index.html. once you do that just reload the server and make a note of what the ip:port is. then just go to ps3, type in ip:port (eg 192.168.2.7:12345) as specified in simple http server and then select the appropriate button for your system.


    Then run (for python):

    • On windows - windows.bat
    • On linux - linux.sh


    Usage Tips:

    1) Try using a LAN connection or a solid WiFi connection during exploitation. A weak signal can cause problems.
    2) If the exploit takes more than 5 minutes to work, reload page, browser, or restart console and try again.
    3) If you are using a LAN connection and experience network issues, make sure all cables to router are in working order.​



  • IDPS Dumper Release (v0.2 - After Leak Release)
    ok....the moment all of you have been waiting for......i assume :cheerful:
    • File: ps3_481_idps_dumper-PS3XPloit.zip
    • MD5 Hash: FFDA70AB2D1677886083F99185C54FE3
    • SHA-256 Hash: 852BDB301753C4F4A7E946188E850D3D325EEAA259B61AE2B5AE31320B2F292B

    enjoy this release from our team :victorious: we will be working hard to add eMMC support as soon as possible!!


    The documentation will be updated as time goes on. There is a readme.txt file included with basic setup and usage instructions.

    Please stay tuned for future tools and releases :D

    and once again, THANK YOU to everyone involved bringing this all together, without all of you, none of this would have happened!!!

    Additional details from @bguerville
    "The idps dumper will create a file on usb000 then beep 3 times & shutdown in all cases, even if flash memory read fails. emmc should not make a difference to this. You will get garbage in idps.bin in that case.

    Js errors with a black page message on ps3 should not happen. If ever it did, just report & in the meantime keep relaunching the exploit. Nobody has had this issue in dozens of tests though.

    And clearing cache or cookies is totally unnecessary with the exploit & the wk js interpreter. Between runs garbage collection will take care of cleaning up what is needed, the job it does is always sufficient".


It's essential not to flood the browser memory with junk before running the exploit. The reason for this is that due to javascript core memory usage limitations we are scanning several times a small range of browser memory (a few Mb) to find some essential data in RAM, if the memory is flooded then the range to scan becomes much larger & the probabilities that our data is found in the smaller range decrease dramatically....

So in short, never use the browser or set a homepage you cancel before running the exploit!
If you need to, set the homepage to 'blank', close the browser then reopen it to start the idps dumper.

Set-up Steps:
  1. Setup a small Web server on pc or smartphone. The Python http server is not required for most users, it was provided for developers. Since v0.2.3, all other extra requirements have been removed. Don't come to us for explanations about how to run a http server though. Google it.
  2. Extract the files in your http server root folder.
  3. Put a fat32 USB key in port closest to BD Drive (/dev_usb000).
  4. Open the ps3 browser & write the ip address of your server (and the port if not 80).
  5. Run until ps3 beeps & shutdown. The idps should be on your USB drive as idps.bin.
- Downloads -
  • MD5 Hash: 3c2e1582f52e1002a12ad280f426d0c6
  • SHA-256 Hash: 1c49eabd64275171a60c90f0f06f503b7055f4ff863f87e7960d41464d127443
  • MD5 Hash: 71dd906e585bf470f84f9d4fb10c1f37
  • SHA-256 Hash: d4bffe2b7d08c1dda275590229f86903f1db487e9a78364d6a025c3734cd8f68
 
Last edited:
Wow @esc0rtd3w i just dumped my idps on my eMMc console checked it its good its my real idps my question is how did you guys find the eMMc deviceid did you use the table at psdevwiki of unknown deviceids and tested all of them till one of them matched? Sorry i didnt complete the search cause my internet was out i just experinced a 7.3 earthquake i went back to usa
 
During dumping process you have it in most right usb connector? Is formatted FAT32? Also there can be compatibility issue with some rare USB3.0 drives, or with some multi partition added by manufacturers like Sandisk, etc.

To make sure USB is recognized, put it to right port, and check in xmb that is recognized. For example in Movies, or Music column.
Wow, I repeated the process. This time, I monitored the process in my PS3 and in my Android. It beeps 3 times and shut down. Boom, there's my idps.bin in my USB. It only took me a minute. Now, I could inject games in my PS3. Thanks a lot for your time and patience. Keep up the good work. More power...

Sent from my Zenfone Max using Tapatalk
 
Wow @esc0rtd3w i just dumped my idps on my eMMc console checked it its good its my real idps my question is how did you guys find the eMMc deviceid did you use the table at psdevwiki of unknown deviceids and tested all of them till one of them matched? Sorry i didnt complete the search cause my internet was out i just experinced a 7.3 earthquake i went back to usa
It's NAND type device id
I'm also working on webkit stuff.
Stay tuned for I might provide some surprises too
 
Edit: Maybe I'm an idiot. If i'm using miniweb, I don't need python and the contents of
ps3_idps_dumper-v0.2.1-PS3XPloit is all I need. Hehe Never mind.

---------

Getting the same error in windows.

Code:
C:\PS3\miniweb\htdocs>python.exe server.py
Traceback (most recent call last):
  File "server.py", line 12, in <module>
  from capstone import Cs, CS_ARCH_PPC, CS_MODE_BIG_ENDIAN
ImportError: No module named capstone

What I did.

Installed MiniWeb
Installed Python
cleared out MiniWeb\htdocs
moved all of ps3_idps_dumper-v0.2.1-PS3XPloit into htdocs (I can reach the webpage OK).
Added python to path and, as you see from the screenshot, just ran: python.exe server.py
 
Fedora 25 error.

Code:
# ./server.py
Traceback (most recent call last):
  File "./server.py", line 12, in <module>
  from capstone import Cs, CS_ARCH_PPC, CS_MODE_BIG_ENDIAN
ImportError: No module named capstone

python-2.7.13-2.fc25.x86_64 is installed and can run other python scripts no problem.

Tried installing capstone-3.0.4-6.fc25.x86_64.rpm but no difference.
make sure you have the latest python2 release (didnt try with python 3). the version i ended up with was 2.7.14 and also try installing capstone - http://www.capstone-engine.org/download.html
 
make sure you have the latest python2 release (didnt try with python 3). the version i ended up with was 2.7.14 and also try installing capstone - http://www.capstone-engine.org/download.html

Thanks for the tips. Had that but did not work. But its a moot point more or less as you can just use any webserver. Already have Apache on linux and IIS on windows, so I just read the instructions a little too hard =)
Should just say "Toss these files into any old webserver and browse to it from the PS3. If that sounds like gibberish, here are some example webservers for you to use..."

Currently testing on a CECH-3004B with OFW 4.81. Been running for an hour or so and I've restarted the PS3 3-4 times. Still no go but It'll get there eventually I guess =)
 
Thanks for the tips. Had that but did not work. But its a moot point more or less as you can just use any webserver. Already have Apache on linux and IIS on windows, so I just read the instructions a little too hard =)
Should just say "Toss these files into any old webserver and browse to it from the PS3. If that sounds like gibberish, here are some example webservers for you to use..."

Currently testing on a CECH-3004B with OFW 4.81. Been running for an hour or so and I've restarted the PS3 3-4 times. Still no go but It'll get there eventually I guess =)
Why not try the Android method? It is more easier than the other methods...IMHO....

Sent from my Zenfone Max using Tapatalk
 
And as a rule of thumb if it takes more than 4 or 5 poc restarts to trigger, you have a problem with your setup. It should never take an hour!

The exploit scans Mb of the ps3 memory & the connection must be flawless for this to take place ok.
PS3 WiFi is not well suited to this...
 
And as a rule of thumb if it takes more than 4 or 5 poc restarts to trigger, you have a problem with your setup. It should never take an hour!

The exploit scans Mb of the ps3 memory & the connection must be flawless for this to take place ok.
PS3 WiFi is not well suited to this...

Currently its running Miniweb from a workstation. No wifi used. I can try a server on the same switch and see if it improves.
 
I guess this is the issue.. Looks like its working but it does not find the below

Code:
580] request path: html/include/ps3_check.js
[580] 233 bytes sent (233 KB/s)
[580] 1899 bytes sent (1899 KB/s)
[580] socket closed after responded for 1 requests
Connected clients: 1
[580] connection accepted
[580] IP: 192.168.101.220
Connected clients: 1
[580] request path: Debug?dbg=Found+usb_fp_rosdump+at%3A+0x802920d2
[580] Http file not found
[580] socket closed after responded for 1 requests
Connected clients: 1
[496] connection accepted
[496] IP: 192.168.101.220
Connected clients: 1
[496] request path: Debug?dbg=0x802920d2+was+added+to+used_offsets+array.
[496] Http file not found
[496] socket closed after responded for 1 requests
Connected clients: 1
[564] connection accepted
[564] IP: 192.168.101.220
Connected clients: 1
[564] request path: Debug?dbg=Searching+memory+range+for+gadgets+string+offset....
[564] Http file not found
[564] socket closed after responded for 1 requests
Connected clients: 1
[496] connection accepted
[496] IP: 192.168.101.220
Connected clients: 1
[496] request path: Debug?dbg=Restarting+POC...+Please+wait...
[496] Http file not found
[496] socket closed after responded for 1 requests
Connected clients: 1
[580] connection accepted
[580] IP: 192.168.101.220

Then it just refreshes and starts another loop.

But perhaps that is just debug, as it says, for you too see what its doing and has nothing to do with it.

Now testing on a machine on the same switch as the PS3 instead.
 
Last edited:
File not found error message, there is indeed something wrong with your server setup or with file permissions...
Check everything and/or try running as Admin...
 
There is no file called "debug" or similar. Guessing it just outputs that so that you can see that what it does while debugging the code.

Testing on an apache server on the same switch as the ps3 and I get a lot of these every so often.

Code:
192.168.101.220 - - [13/Nov/2017:15:33:25 +0100] "GET /ps3/html/idps_nor.html HTTP/1.1" 200 12879
192.168.101.220 - - [13/Nov/2017:15:33:25 +0100] "GET /ps3/html/include/jquery.js HTTP/1.1" 304 -
192.168.101.220 - - [13/Nov/2017:15:33:25 +0100] "GET /ps3/html/include/utils.js HTTP/1.1" 304 -
192.168.101.220 - - [13/Nov/2017:15:33:25 +0100] "GET /ps3/html/include/exploit.js HTTP/1.1" 304 -
192.168.101.220 - - [13/Nov/2017:15:33:25 +0100] "GET /ps3/html/include/ps3_check.js HTTP/1.1" 304 -
192.168.101.220 - - [13/Nov/2017:15:33:26 +0100] "GET /Debug?dbg=Found+usb_fp_rosdump+at%3A+0x80298de2 HTTP/1.1" 404 1659
192.168.101.220 - - [13/Nov/2017:15:33:26 +0100] "GET /Debug?dbg=0x80298de2+was+added+to+used_offsets+array. HTTP/1.1" 404 1659
192.168.101.220 - - [13/Nov/2017:15:33:26 +0100] "GET /Debug?dbg=Searching+memory+range+for+gadgets+string+offset.... HTTP/1.1" 404 1659
192.168.101.220 - - [13/Nov/2017:15:33:33 +0100] "GET /Debug?dbg=Restarting+POC...+Please+wait... HTTP/1.1" 404 1659
 
You know what, I'm gonna stop spamming this thread for now. In reality, I have no use for this right now, until it.. .develops so no need to keep taking up your time =)
 
You know what, I'm gonna stop spamming this thread for now. In reality, I have no use for this right now, until it.. .develops so no need to keep taking up your time =)
Those debug messages will be removed eventually so they won't cause problems in the future.
The Debug messages are using jquery, it must be the only thing that does in the project. So jquery must lack some permissions most likely...
Another option is to comment every line starting with dbg(.... in the html file and in exploit.js. The error won't occur & that might do the trick... However you won't get any status output anymore unless you add something yourself using DOM to write to page but you will still see the page hourglass reloading stopping/reloading...
The files were made to run on python server run as admin and I never tested on other servers so I can't help with setup.

Don't worry about my time, I am answering you like this especially because I would like to clarify your issue for everyone else's sake.
 
Last edited:
Ok, testing. Removed all debug messages. Running now.

Found an error. Before you have selected your system:
Code:
192.168.101.220 - - [13/Nov/2017:16:07:13 +0100] "GET /ps3/ HTTP/1.1" 200 2510
192.168.101.220 - - [13/Nov/2017:16:07:14 +0100] "GET /ps3/include/jquery.js HTTP/1.1" 404 1659
192.168.101.220 - - [13/Nov/2017:16:07:14 +0100] "GET /ps3/include/utils.js HTTP/1.1" 404 1659
192.168.101.220 - - [13/Nov/2017:16:07:14 +0100] "GET /ps3/include/exploit.js HTTP/1.1" 404 1659

I get a 404 on the js files. The path is wrong. Its actually /ps3/html/include/ so its missing the /html/ part. This is correct once you've selected your system and it starts scanning so I doubt it has any effect.

Edit: No go after 10 minutes on an apache server. dgb removed so it only goes on like this

Code:
Loading page:
192.168.101.220 - - [13/Nov/2017:16:07:13 +0100] "GET /ps3/ HTTP/1.1" 200 2510
192.168.101.220 - - [13/Nov/2017:16:07:14 +0100] "GET /ps3/include/jquery.js HTTP/1.1" 404 1659
192.168.101.220 - - [13/Nov/2017:16:07:14 +0100] "GET /ps3/include/utils.js HTTP/1.1" 404 1659
192.168.101.220 - - [13/Nov/2017:16:07:14 +0100] "GET /ps3/include/exploit.js HTTP/1.1" 404 1659

Clicking system:
192.168.101.220 - - [13/Nov/2017:16:09:37 +0100] "GET /ps3/html/idps_nor.html HTTP/1.1" 200 12615
192.168.101.220 - - [13/Nov/2017:16:09:37 +0100] "GET /ps3/html/include/jquery.js HTTP/1.1" 200 95790
192.168.101.220 - - [13/Nov/2017:16:09:37 +0100] "GET /ps3/html/include/utils.js HTTP/1.1" 200 5813
192.168.101.220 - - [13/Nov/2017:16:09:37 +0100] "GET /ps3/html/include/exploit.js HTTP/1.1" 200 3082
192.168.101.220 - - [13/Nov/2017:16:09:37 +0100] "GET /ps3/html/include/ps3_check.js HTTP/1.1" 200 1666
192.168.101.220 - - [13/Nov/2017:16:09:46 +0100] "GET /ps3/html/idps_nor.html HTTP/1.1" 200 12615
192.168.101.220 - - [13/Nov/2017:16:09:46 +0100] "GET /ps3/html/include/jquery.js HTTP/1.1" 304 -
192.168.101.220 - - [13/Nov/2017:16:09:46 +0100] "GET /ps3/html/include/utils.js HTTP/1.1" 304 -
192.168.101.220 - - [13/Nov/2017:16:09:46 +0100] "GET /ps3/html/include/exploit.js HTTP/1.1" 304 -
192.168.101.220 - - [13/Nov/2017:16:09:46 +0100] "GET /ps3/html/include/ps3_check.js HTTP/1.1" 304 -

.. and so on for 10 minutes

Now testing with miniweb from a machine on the same switch again...

Edit2: No go after another 9 minutes or so. Testing on an IIS server now then.. Restarting PS3 in between tests.

Edit3: Does not seem like it likes IIS. Probably something missing as that is barebone. Does one retry and then just stands there so we can probably ignore that webserver.
 
Last edited:

Featured content

Trending content

Back
Top