PS2 HDD Dumps

[krHACKen]

WOW THANKS A MILLION !!! I'm downloading it. Thank you so very much for dumping and uploading it !
Indeed, a dump of your 0.30 would be very useful to us, as our backup is incomplete.


The cdvdKey is calculated by the console mechanic controller (MechaCon), with data that is pressed on the CD-ROM/DVD-ROM. This data cannot be replicated to a blank disc. Sony uses the cdvdKey as part of the anticopy protection scheme in all Utility Discs. It indicates the physical position (LBA) of installable MC files. When you try to install the DVD Player with a CDR copy, installation fails; because CDR copies don't have a cdvdKey, so the DVD Player installer cannot find the files to install. But if I know the cdvdKey of the original disc, I can build a hacked backup which has the DVD Player upgrade option working.

If you have interest in hacking stuff, this long and boring video shows you the DVD Player 2.14 upgrade disc being cracked.


By the way, I will compile your PSBBN 0.30 and 0.32 dumps in my next SUDC release. I always credit contributors for their hard work, unless they tell me to not credit them (some people don't like to see their name in pirate things). Would you like me to add your username in credits of my next compilation (as dumper of PSBBN 0.30 & 0.32) ?


@AKuHACK :
I'll rebuild the 0.10 for DVD-R as soon as I can. Got some things to do before, it may take awhile...


EDIT : I ran SUD wobble finder v0.01 against the PSBBN 0.32 dump. It couldn't find where the MC files are located. Perhaps Sony did change the obfuscation algo on that one, but I'm pretty sure it's because my program is a piece of shit that needs some serious update. So, SUD Mutilator (MUTILITE.ELF) report is my last hope.
Going to sleep.

[krHACKen]

Yep. SUD wobble finder v0.01 only supports BitSet 07h (DecSet 72h) and BitSet 05h (DecSet 53h). I found a firmware wobble in the PSBBN 0.32 disc. It's BitSet 03h obfuscated :

Цитата: kHn's SUD wobble finder v0.02 (WIP) 2048 bytes per sector Dump size is 654796800 bytes Analyzing Sectors... Unscrambler [BitSet : 0x03, DecSet : 0x33] reports the following firmware package size : 1275840 bytes Obfuscation algorithm seems to be v2 (as seen on most Utility Discs) This possible wobble has been found at offset 0x1A311000 (LBA 214562)

So, a possible cdvdKey would be 03 22 46 03 00 00 01...
Generally, JAP Utility Discs have 2 wobbles. Couldn't find the second one :( . I'm gonna MagicGate decrypt and unpack that package to see if it contains both DVD and OSD files...


EDIT1 :
/BIEXEC-DVDPLAYER/dvdplayer.elf
/BIEXEC-DVDPLAYER/dvdplayer.irx
/BIEXEC-DVDPLAYER/dvdplayer.id
/BIEXEC-DVDPLAYER/dvdplayer-j.ver
/BIEXEC-DVDPLAYER/dvdplayer-e.ver
/BIEXEC-DVDPLAYER/icon.sys
/BIEXEC-DVDPLAYER/dvdplayer.ico
/BIEXEC-DVDPLAYER/dvdplayer.dmy
/BIEXEC-SYSTEM/osdsys.elf
/BIEXEC-SYSTEM/osdsys-j.ver
/BIEXEC-SYSTEM/osdsys-e.ver
/BIEXEC-SYSTEM/icon.sys
/BIEXEC-SYSTEM/sysdrv.ico
Just like I expected, the wobble lacks the OSD update (that one has DVD Player update and the Kernel Patch for early JAP consoles). It means that there's another wobble in the disc and I didn't find it. The possible cdvdKey I've mentioned above might be wrong too. So, I'll hunt for the other wobble but before, I'm gonna mess up with DVD Player 3.04 files hehehehe.
By the way, the MG DISK signature of the firmware package is :
A7 11 35 1B D2 B0 C9 5B AF 62 0E 0B 7B 1E 3A 06
FB 00 16 ED F7 DE 06 46 51 33 B8 BE E3 74 09 4F


EDIT2 :
Hmm, wait, I'm retarded. I didn't read the whole DOS terminal hahaha, the second wobble is here :

Цитата: Unscrambler [BitSet : 0x03, DecSet : 0x33] reports the following firmware package size : 1951456 bytes Obfuscation algorithm seems to be v2 (as seen on most Utility Discs) This possible wobble has been found at offset 0x1C0D2000 (LBA 229796)

EDIT3 : Aaah, the joy of hacking an Utility Disc, I'm creaming myself.
/BIEXEC-SYSTEM/osdsys.elf
/BIEXEC-SYSTEM/osd110.elf
/BIEXEC-SYSTEM/osd130.elf
/BIEXEC-SYSTEM/icon.sys
/BIEXEC-SYSTEM/sysdrv.ico
/BIEXEC-SYSTEM/SNDIMAGE
/BIEXEC-SYSTEM/TEXIMAGE
/BIEXEC-SYSTEM/UMEIMAGE
MagicGate DISK signature of the package :
13 47 5C 02 88 17 EE 72 A7 B8 A0 51 26 3A DC BC
74 06 8C 16 FB 53 09 1C 5A 4A DD 80 79 0B 55 9A


EDIT4 :
I'm about to release a new version of the RPC patcher. Now I'm logging scans and I did one against 3.04J :

Цитата: PS2 DVD Player RPC Patcher Version 0.03 Reading input file `3.04J.BIN'... assuming FAT DVDELF... DONE ! == Now performing RPC scans == By searching the pattern CD 01 00 00 ?? FF 00 10, I found the `Sabotage Routine' The `break' instruction should be located at output file offset 0x255C0 (EE RAM Addr 0x002255C0) The call to the memory wiping function should be 0x0C089518, located at output file offset 0x255B0 (EE RAM Addr 0x002255B0) Patch for this firmware (fnc call) -> _sw(0x00000000, 0x002255B0); Patch for this firmware (break instr) -> _sh(0x0000, 0x002255C0); Other memory wiping function calls : None. By searching the pattern 01 00 ?? 3C 04 ?? ?? 00, I found the `GetDVDVzone' function which should start at output file offset 0x3CD60 (EE RAM Addr 0x0023CD60) The region code of the inserted DVD-Video should be buffered at EE RAM Addr 0x0126B8E8... Patch for this firmware -> _sw(0x24020000, 0x0023CD68); -- All RPC scans done -- == Now performing additional scans == -- All additional scans done -- Writing the hacked firmware to `BUFFER.BIN'... DONE ! :) All Done

EDIT5 : I've published PS2 DVD Player RPC Patcher Version 0.03 :

Этот текст скрыт

Вы должны зарегистрироваться чтобы увидеть скрытый текст. После регистрации и активации аккаунта нажмите кнопку 'Спасибо', чтобы увидеть скрытый текст содержащейся здесь. Регистрация возможна через e-mail и OpenID. Если Вы испытываете проблемы с регистрацией, пожалуйста свяжитесь с Администратором volgame@gmail.com

EDIT6 : The RPC cracked DVD Player 3.04J as ELF :

Этот текст скрыт

Вы должны зарегистрироваться чтобы увидеть скрытый текст. После регистрации и активации аккаунта нажмите кнопку 'Спасибо', чтобы увидеть скрытый текст содержащейся здесь. Регистрация возможна через e-mail и OpenID. Если Вы испытываете проблемы с регистрацией, пожалуйста свяжитесь с Администратором volgame@gmail.com

I don't add it to the DVD Player firmware thread because I want to repack them all with my new loader.

MG DISK keys...
osdsys.elf :
B9 FB 55 01 5E A6 AD 63 E3 55 5E 5C F3 C0 AD A6
09 17 0E 6F 68 E6 B9 F4 E7 CB 47 C2 57 94 13 91
dvdplayer.elf :
0B 36 1D 41 B0 5F 46 74 B2 BE 1E C4 AC 2F E2 52
F4 35 E1 0F 1E EC 07 52 8F 6B 7D E8 00 D8 4F 52
dvdplayer.irx :
83 1E 4E 4B 42 CA 7F 39 0C B7 C5 FB 81 B1 10 DA
D2 C6 8F C2 EB A0 5B 63 3F 0B F8 7B 46 0E 0D 93

[bb_neo]

Цитата: Сообщение от krHACKen WOW THANKS A MILLION !!!

My pleasure. You helped me so I help you in return! And thanks for the your explanation about the cdvdKey.

Цитата: Indeed, a dump of your 0.30 would be very useful to us, as our backup is incomplete.

It is currently uploading... Will post the link very soon. (My upload speed sucks!)

Цитата: I always credit contributors for their hard work... Would you like me to add your username in credits of my next compilation (as dumper of PSBBN 0.30 & 0.32) ?

Yeah sure, no problems with me.


Ok here is the cdvdKey for 0.32 CD : 03 22 46 03 00 00 01
and here the one for 0.30 CD : 07 22 46 03 00 00 01

Scans coming soon...

[bb_neo]

Ok finally! Here is the PSBBN 0.30 dump: http://depositfiles.com/files/evjo3ttj9

And as promised here are the high definition scans: (Front, back and CD of 0.32 and 0.30)
http://depositfiles.com/files/8y5lou4un

[AKuHAK]

bb_neo big big thanks!!! Just one question - please provide me ring codes. They are placed on the CD disk near its center and is smth like IFPI and some numbers (for example "IFPI 456B", "SCPN-60101 1 IFPI L274"). In your scans this codes its difficult to recognize :)

[bb_neo]

That's normal that you do not see the ring codes on my scans. The codes are only visible on the back side of the CD

Here is the code for the 0.32 : IFPI 457B SCPN 60160 IFPI L274
Here is the code for the 0.30 : IFPI 454E SCPN 60140 IFPI L274

[krHACKen]

Thanks very much for your time dumping, scanning and uploading your discs. I greatly appreciate your help here.

Owners of JAP units wanting to install the DVD Player or the Kernel Patch without using the PSBBN disc, here are the files I did decrypt off bb_neo's disc dumps :

Этот текст скрыт

Вы должны зарегистрироваться чтобы увидеть скрытый текст. После регистрации и активации аккаунта нажмите кнопку 'Спасибо', чтобы увидеть скрытый текст содержащейся здесь. Регистрация возможна через e-mail и OpenID. Если Вы испытываете проблемы с регистрацией, пожалуйста свяжитесь с Администратором volgame@gmail.com

My archive is full of hacker crap and things you'll probably not need, so I'm pointing out what files are to be signed for your Memory Card :

DVD Player 3.00J from PSBBN 0.30 :
SCPN-60140/214562/BIEXEC-DVDPLAYER
Sign dvdplayer.elf and dvdplayer.irx, then copy the BIEXEC-DVDPLAYER folder to your MC. You may delete dvdplayer.dmy to save some space.

DVD Player 3.04J from PSBBN 0.32 :
SCPN-60160/214562/BIEXEC-DVDPLAYER
Sign dvdplayer.elf and dvdplayer.irx, then copy the BIEXEC-DVDPLAYER folder to your MC. You may delete dvdplayer.dmy to save some space.

The OSDSYS update and the Kernel Patch are the same files in both 0.30 and 0.32 :
SCPN-60160/229796/BIEXEC-SYSTEM
Patch osd110.elf and osd130.elf as indicated in Post #182
Sign osdsys.elf, osd110.elf and osd130.elf, then copy the BIEXEC-SYSTEM folder to your MC. NOTE : osd110.elf and osd130.elf signatures are the same (because the fwo files are identical).


Quoting a PM I sent to someone recently...

Цитата: Сообщение от krHACKen [...] The tool which signs kelf files for your MC is sign_dvdelf.elf. Hmmm, that's old stuff and it lacks a readme so I can't remember exactly how it works; but I think this is how to use it : - Copy osdsys.elf to the root of your USB drive and rename it as DVDELF.bin (IIRC, bin have to be lowercase) - Insert your PS2 Memory Card to Slot 1, your USB drive and launch sign_dvdelf.elf. It will create the MC signature file in your USB drive (mcid.bin) - Open osdsys.elf and mcid.bin in an hex editor, and paste the MC signature to the osdsys.elf header (from offset 28h to 48h, see the picture below) Redo all the operations with osd110.elf. Once you have the mcid.bin of osd110.elf, you can paste it to both osd110.elf and osd130.elf (the two files are the same) : Copy the "BIEXEC-SYSTEM" folder (which should contain your hexedited elfs, icon.sys, SNDIMAGE, sysdrv.ico, TEXIMAGE and UMEIMAGE) to the Memory Card

... but I guess you guys have better CARD signing solutions (like the ps3mca tool for example).

As a bonus in the RAR archive :
SCPN-60140/HACKED_STUFF/PACKED_3.00J.ELF
SCPN-60160/HACKED_STUFF/PACKED_3.04J.ELF
RPC patched DVD Players as standalone ELFs. Should play NTSC movies of any region (as long as the inserted DVD-Video isn't RCE protected)... ... but a wonderful software may be released to the PS2 homebrew scene within a few days...

Thanks again for contributing, bb_neo.

[AKuHAK]

Ну вот получен дамп версии 0.10. На первый взгляд ничего в нём интересного нет. Функционал убог до невозможности, да и вообще. Однако есть кое-какие интересные новшества. Как и предполагалось внутрнний номер версии bnux_ver_001-001-020. Фото, видео и игровой канал. Функционал везде урезан по минимуму. По прежнему есть возможность выйти в обрубок линукса. Настроек тоже почти никаких нет. Однако есть одна очень интересная вещь - удалось обновить ПСП канал штатными средствами )))) Появился так называемый So-Net канал. Разумеется канал не открывается, но сам факт того, что удалось его поставить весьма воодушевляет.
Вот дамп с уже обновлённым контентом. Есть возможность подключится через Putty к командной строке навигатора с компа по сети (протокол telnet, computer name: bn.mshome.net). Кодовое имя у этого навигатора SCN, то есть существуют три кодовых версии навигаторов:
system-SCN_top.xml линейка 0.1x
system-AII_top.xml линейка 0.2x
system-ETC_top.xml линейка 0.3x

[djbba]

"Look here is my simple PSX_for_PS2 builder:

• copy your .bin or .iso file into bishibuilder folder and rename it in psx.bin
• launch ECC/ECCRegen.exe and check ecc errors (if they are)
• launch getmd5.exe for trimming image (if it is not proper dump) and looking for some information
• launch build.cmd and wait
• output file will be placed into bishibuilder\COPY_TO_PSXEMU\disc\ directory"

• wrong
• wen i try build.cmd
• output file will be placed into bishibuilder\COPY_TO_PP.PSX\disc\ directory
• there i get file disc0
• and folders create by your self COPY_TO_PP.PSX\disc\

Right? wait for correction?

[krHACKen]

vash32's bootleg is filthy. Don't install it unless you want to loose your data of your 48-bit HDD. Also, be aware that POPS project maintainers are going to ban vash32's installations in the next release (... if they don't cancel the project within the next few days). I personally left the development team.