ps3xploit / pett

PS3 Exploitation Tutorial Template

PS3 Exploitation Tutorial Template (PETT)

• Official WebSite: ps3xploit.com
• Official PS3 WebKit ROP Tutorial Thread at: psx-place.com
• Current PETT Live Version: ps3xploit.github.io/pett (Alert: This domain not yet work on PS3 Web Browser)

Preview Images

SELECT YOUR LANGUAGE AND THEN SET YOUR INDEX PAGE TO PS3 HOMEPAGE FOR BEST RESULTS!!!

Multi-Language Translator Credits

Language	Code	Translators
Arabic	ar	@Azooz_yos
Spanish (Catalan)	ca	@minicm94123
German	de-DE	@FlatracerMod
Spanish (Latin American)	es-419	@Ripp3RkoS
Spanish	es-ES	@Ivoyko
French	fr-FR	@valentinbreiz / @humanshield85
Dutch	nl-NL	@CompanyFart
Hindi	hi	@minicm94123
Italian	it-IT	@neno20115 / @Alexandersss
Polish	pl	@Roxu14
Portuguese (Brazil)	pt-BR	@HollowChris / @Caio99BR
Russian	ru	@ErikPshat
Turkish	tr	@yanealaka

Version History

v0.2.3

• Added 4.82 DEX, 4.83 CEX, 4.84 CEX, and 4.84 DEX Offsets (must use 4.82 silk_webkit.sprx for 4.83+)
• Updated All Language Files

v0.2.2

• Fixed Search
• Updated Language Revision To 0016
• Added New Mount Paths and Parameters

v0.2.1

• Added Mount USB as BDVD and Other Preset Chains
• Updated Offset Verification To Eliminate Random Freezing
• Added USB Pointer Toggle For Mounting Options
• Added New Paths For Source and Destination Presets
• Updated Some Testing Stuff

v0.2.0

• Updated Offset Search Again. Cleaned Up Loader JS
• Fixed Path Convert Issues
• Added Get FileSize Chain To File System Presets
• Added Package Options To Paths
• Added A Test Chain Default For Devs on DEX
• Updated All Languages From en_us Base (thanks @Caio99BR)

v0.1.9

• Added WebKit String Search Area To Dumping Chains
• Added Message After Exec Button Clicked, and Before Success/Done Message
• Updated pt_BR Language (thanks @Caio99BR)

v0.1.8

• Fixed StackFrame Verify. All Offsets Are Now Verified Automatically
• Added Ready Message as Default Before Chain or Options are Selected
• Removed Custom Search Tweaks From GUI (no longer needed)
• Updated Offset Search

v0.1.7

• Updated Language Base Files and Fixed Missing Variables (thanks @Caio99BR)
• Updated "Fun" Preset Chains
• Added "Create New User" under File Directory Chains
• Added several gadget addresses to test
• Updated Mount Options

v0.1.6

• Added Mount Options
• Updated Language Index and Misc GUI Tweaks (thanks @Caio99BR)
• Added Türkçe TR Translation (thanks @yanealaka)
• Updated Search Functions

v0.1.5

• Updated Found and Verify Offset Colors
• Added new variables for verify and a few others
• Updated pt_br messages.js (thanks @Caio99BR)
• Fixed size in last arg in minver chain (only 1st 4 bytes read though for alert) (thanks @hexcsl)
• Added Hindi India Translation (thanks @minicm94123)
• Added Arabic Translation (thanks @Azooz_yos)
• Updated Language Selection Layout (thanks @ErikPshat)

v0.1.4

• Added Català Espanya Translation (thanks @minicm94123)
• Added German Translation (thanks @FlatracerMod)
• Updated Spanish LA (thanks @Ripp3RkoS)
• Updated Nederlands label on Language Selection index (thanks @CompanyFart)
• Misc Fixes In All Language Strings (thanks @ErikPshat)

v0.1.3

• Updated Português label on Language Selection index (thanks @gustavo1617)
• Added Dutch NL Translation (thanks @CompanyFart)
• Added French Translation (thanks @valentinbreiz)
• Fixed Typo In messages.js [pt_br]
• Updated GUI For Russian
• Fixed Memory Dump Options On Load
• Fixed Alert Message Text Not Loading Value From JS

v0.1.2

• Added Polish (thanks NiHuShu @Roxu14)
• Updated Multi-Language Files
• Pushed 1st Commit To GitHub

v0.1.1

• Fixed fail message if strings not found
• Updated HTML and JS for GUI
• Removed Default Settings option from GUI
• Fixed Misc Bugs

v0.1.0

• Cleaned Up and Fixed GUI (thanks @ErikPshat)
• Added New Strings To Multi-Language Files (@neno20115,@Ivoyko,@Ripp3RkoS,@HollowChris,@Caio99BR)
• Updated All Multi-Language Files (@ErikPshat)
• Updated File Size & TitleID Functions

v0.0.9

• Added Russian to languages (thanks @ErikPshat)
• Added Spanish Spain (thanks @Ivoyko)
• Updated Brazilian Portuguese (thanks @Caio99BR)
• Updated CSS and HTML meta tag (thanks @ErikPshat)
• Added Dump LV2 Syscall Table to chains (not working)
• Updated Behavior if no chain selected to autofocus on dropdown box

v0.0.8

• Moved Firmware Display to top of page
• Organized chains a bit more
• Added Debugging Chains Support
• Updated Preset Chains

v0.0.7

• Updated strings in messages.js
• Updated Debug Output colors
• Fixed a few typos
• Added Stackframe Verify option
• Updated GUI layout
• Updated String Output Messages
• Updated Multilanguage Files

v0.0.6

• Added Multi-Language Front-End GUI (thanks @neno20115)
• Added sys_storage_get_device_info and sys_storage_report_devices syscall chains

v0.0.5

• Added Brazilian Portuguese (thanks @HollowChris)
• Updated default register placeholder values (example: gadget 10 register 22 / 0x80141022)
• Added Stackframe Test to Default Chains

v0.0.4

• Fixed TitleID not checking full path length when replacing values
• Fixed 4.66 IDPS Offset
• Added sys_net Chains For Testing
• Added SysNet Dump Chain

v0.0.3

• Added Italian (thanks @neno20115), Spanish (thanks @Ripp3RkoS) Languages
• Added sys_net chains
• Added 4.66 IDPS VSH Offset (thanks @bqgcw8prJLtRJrb)
• Added Title ID Set In GUI
• Updated Paths

v0.0.2

• Added Multi-Language Support
• Updated Offset Search
• Added Beep Options
• Fixed Read/Write File Chain
• Merged most text from JS into messages.js

v0.0.1

• Initial Release Using 2.0 Exploit Base
• Full 4.xx Firmware Support
• Added Several Test Chains and Other Syscall Chains

pett's Issues

Is Filesize limited ??

Issue checklist

Note: these are not necessarily requirements

• [yes ] Tested with latest version of GitHub
• [no ] Reported on Twitter or Official Thread

PS3 FirmWare: 4.82 OFW

PS3 Model : CECH-2001A

i have try to copy files that have size of : 1-15 mb

and its worked perfect but when try to copy 1GB file the console freeze

The memory size for the memory dump is incorrect.

In the text of the page you ask to enter the start and end address, but in the function saveMemdumpValues() you use the end address as the size of the dump.

<b><span class="white" id="gui_txt_memdump_address_end"></span></b>
<textarea id="marked_memdump_size_edit" name="marked_memdump_size_edit" cols="10" rows="1"></textarea>&nbsp;
<button id="memdump_save_new_values" onclick="saveMemdumpValues();"><span id="gui_txt_btn_memdump_set_values"></span></button>

function saveMemdumpValues()
{	
	var x;
	memdump_addr=parseInt(marked_memdump_addr_edit.value);
	memdump_size=parseInt(marked_memdump_size_edit.value);

The simplest way to fix the function is saveMemdumpValues() and calculate the size.

system to usb

Issue checklist

Note: these are not necessarily requirements

• Tested with latest version of GitHub
• Reported on Twitter or Official Thread

PS3 FirmWare 4.82

PS3 Model cech43008a

How do these colors work in nl_nl?

pett/files/js/api/lang/nl_nl/messages.js

Line 64 in 0231c46

// Fail Search Messages

// Fail Search Messages
var msg_string_search_fail="<h3><b><font color = '# 7700DA'> Niet alle offsets gevonden! </ font> <font color = '# 7700DA'> Als Zoeken opnieuw mislukt, pas dan de zoekinstellingen of de RESTART-browser aan! </b></font></h3>";
var msg_string_search_fail_max="<h3><b><font color = '# 7700DA'> Niet alle offsets gevonden! </font> <font color = '# 7700DA'> Max opnieuw geprobeerd pogingen! Gelieve de browser opnieuw te starten! </B></font></h3>";

// Verify Strings Fail
var msg_string_verify_fail="<h3><b> <font color = '# 7700DA'> heeft niet alle offsets gecontroleerd! </font> <font color = '# 7700DA'> Als Verifiëren opnieuw mislukt, browser RESTART! </b></font></h3>";
var msg_string_verify_fail_max="<h3><b> <font color = '# 7700DA'> heeft niet alle offsets gecontroleerd! </font> <font color = '# 7700DA'> Max opnieuw geprobeerd pogingen! Gelieve de browser opnieuw te starten! </B></font></h3>";

// Init Success
var msg_success_init="<h3><b> <font color = '# 386E38'> SUCCESS! </font> <font color = '# 7700DA'> <br> U kunt nu uw keten uitvoeren! </font></b></h3>";

// Exec Success
var success_chain_exec="<h3><b> <font color = '# 386E38'> Chain met succes uitgevoerd! </font></b></h3>";
var success_chain_exec_press_again="<h3> <b> <font color = '# 386E38'> Druk nogmaals op de knop Execute </font></b></h3>";
var success_chain_exec_psid="<h3><b> <font color = '# 386E38'> PSID is met succes gedumpt! </font> </b> </h3>";
var success_chain_exec_idps="<h3><b> <font color = '# 386E38'> IDPS met succes gedumpt! </font></b></h3>";
var success_chain_exec_memdump="<h3><b> <font color = '# 386E38'> Geheugen gedumpt met succes! </font></b></h3>";
var success_chain_exec_read_write_file="<h3><b> <font color = '# 386E38'> bron naar bestemming geslaagd! </font></b></h3>";
var success_mount_device="<h3> <b> <font color = '# 386E38'> succesvol gemonteerd /dev_hdd1/! Start de browser opnieuw en voer de R/W-bestandsketen uit om te dumpen. </Font></b></h3>";

...

// String Matching
var verify_fail="<font color = '# 7700DA'> FAAL: Strings komen niet overeen in het geheugen! </font>";
var verify_success="<font color = '# 2a1003'> SUCCESS: Strings Match in Memory! </font>";
var verify_skip="<font color = '# 2a1003'> SUCCESS: Geen strings in het geheugen! </font>";

Github pages - https://ps3xploit.github.io/pett

Hi.

ps3 (browser) probably does not support new encryption methods (TLS 1.2) and for this reason can not open the page https://ps3xploit.github.io/pett. If you want it to work on ps3, then you need to turn off the page support for https, but you can do this if you specify your domain (subdomain) in the repository settings. An example of a working reference http://pett.hexcsl.com which leads to the fork of your project.

"Read/Write" File "form/to" dev_flash

Issue checklist

Note: these are not necessarily requirements

• Tested with latest version of GitHub
• Reported on Twitter or Official Thread

PS3 FirmWare 4.82 OFW

PS3 Model CECH-2001A

I have tested read/write from dev_flash but it didnt work the file on usb showes size of 0 byte
and when try to write file form usb to dev_flash it didnt write anything plz guys explain what to modify to make it work.

PS3 Freeze

Issue Description

Latest Master Checkout make my PS3 CHECH3004A Freeze

iam trying (for test purposes of course) to load my backup lic.edat to the new ps3
the rop is found but when I execute it, I see that my usb drive is flashing up, so it tries to read the file.
then its just freezes, nothing happens again.
while the usb drive is flashing up, its freezing...

i don't know if it fails to read the file or copying it, but I used the drive to backup my ps3.

source is of course my usb root lic file.
destination is game/GAMEID/LICDIR

NOR Chip selected of course.

Issue Checklist

Note: these are not necessarily requirements

• [y ] Tested with latest version of GitHub
• [ n] Reported on Twitter or Official Thread

PS3 FirmWare

4.80

PS3 Model

CHECH3004A

Mount not working?

Issue checklist

Hi. I tried to use the mount chain (device: CELL_FS_IOS:USB_MASS_STORAGE000, fs: CELL_FS_FAT, path: /dev_hdd0/photo) via PETT and no mount occurred. The photos were still saved in hdd0 and were not displayed from the flash drive. Is this even possible and will it work?

• Tested with latest version of GitHub
• Reported on Twitter or Official Thread

PS3 FirmWare

CEX 4.82

PS3 Model

CECH-4208C