Endless Paradigm

BrandonW Wrote:PS3JB v0.08.0001

Brandon Wilson



>What is it?

This is a FLASH application for the TI-84 Plus and TI-84 Plus Silver Edition that exploits the Playstation 3 console. By connecting a USB cable between a PS3 and your calculator and running the application, you can trigger the PSGroove exploit or downgrade your PS3 from your graphing calculator.



>How do I use it?

First, back up any important variables on your calculator that you want to keep to your computer just in case something goes wrong. I'm not responsible if your RAM is reset by using this program!



Next, transfer the "PS3JB.8XK" FLASH application to your TI-84 Plus or TI-84 Plus Silver Edition using the link software appropriate for your platform:

Mac OS X: TI Connect

Windows : TI Connect or TiLP

Linux   : TiLP



For TI Connect under Windows, for example, you can run "TI DeviceExplorer" and drag-and-drop the file into the window, or right-click the file and choose "Send to TI Device."



Once transferred, you should see "PS3JB" in your APPLICATIONS menu (by pressing the [APPS] key). Run the application by highlighting "PS3JB" and pressing [ENTER].



After the splash screen is displayed, press a key to get to the main menu:



1) PS3 Jailbreak

2) Install

3) Uninstall

4) View Log

5) Options

6) About



To jailbreak the PS3 with the PSGroove exploit, download and transfer a payload AppVar to your calculator, select it as the "stage 1 payload" in "5) Options", and then select "1) PS3 Jailbreak."



Next, make sure your PS3 is OFF (as in unplugged/switched off in the back) and that no other USB devices are connected, and connect one end of a USB cable to your PS3 and the other end to your calculator.



Then switch on or plug back in your PS3, and tap the POWER button quickly followed by the EJECT button. This causes the PS3 to look for USB devices, specifically the calculator.



If you selected option 1, the calculator should display the current status at the bottom of the LCD and then "Done" to indicate the exploit was successful.



If jailbreaking your PS3 with the PSGroove exploit (meaning "Emulate Jig?" is set to "No" in "5) Options"), you should see an "Install Package Files" option under Game in the XMB.

If the exploit is NOT successful and "Done" isn't displayed, press [ON] to exit the application and try the above steps again.



>Do I have to run the application every time I want to apply the jailbreak?

You do have to trigger the exploit every time the PS3 boots, but you don't have to run the application.

By selecting option 2 ("Install") and exiting the application, the exploit will automatically trigger no matter where you are in the calculator's OS. The PS3 will automatically power on the calculator if necessary, and the calculator will turn off after about 5 minutes of inactivity (configurable through the options).

Note that while the jailbreak OS "hook" is installed, you will not be able to link to your computer using a direct USB cable; uninstall it first by selecting option 3 ("Uninstall")!



>It didn't work!

You may need to try a couple of times before it works. Make sure the PS3 is powered completely off first and that you press POWER and then EJECT immediately afterward (within 200ms of each other).



>Do I have to keep the calculator connected once it says "Done"?

No, you can disconnect it once you're at the XMB.



>How do I specify the payload I want to use?

Obtain a TI-84 Plus/Silver Edition AppVar containing the payload's data and transfer it to your calculator. (It can either be in RAM or you can archive it; it doesn't matter.)

Once on the calculator, specify you want the jailbreak to use that external payload (known as the "stage 1" payload) by going into the 5) Options menu and using [LEFT] and [RIGHT] arrows to select it, then choose "Save."

These options are stored in an AppVar called "PS3JBOPT". It would be wise to archive this so you don't have to re-apply the options whenever your RAM resets.



>How do I create one of these payload AppVars?

You can use the converter at http://brandonw.net/poo poo/to8xv.zip to encapsulate a binary file of payload data in an AppVar variable for tansferring to your calculator.

This is a command-line VB.NET 2.0 program; if you don't like it, create your own using the file format specification on ticalc.org.



>How do I make this work on a different firmware version?

In addition to using a different payload, you'll also have to use a "firmware compatibility" AppVar full of settings that make the jailbreak work on versions other than the default 3.41. Details for this are at http://brandonw.net/ps3jb/ .



>What about the source code?

The source code is included in the /source/ folder. The latest version can also be found at http://brandonw.net/svn/calcstuff/PS3JB/trunk/.



>What do I do with this /source/ folder?

If you don't know, nothing.



>What if I have questions about any of this?

First, try the FAQ at http://brandonw.net/ps3jb/ and see if your question is answered there.

If not, try e-mailing me at brandonlw@gmail.com or looking for me on IRC as "BrandonW" on EFNet.



>Version History

v0.08.0001 - Added firmware download capability (technically Sony jig stick emulation, switchable from the "Emulate Jig" option.)

v0.07.0001 - Minor bug fixes:

               The graph screen is no longer blank upon exiting the application.

               The hook was being automatically installed when selecting 1) PS3 Jailbreak and exiting; this has been fixed.

               It's just generally more likely to work.

v0.06.0001 - Added support for "firmware compatibility" AppVars that have firmware-independent settings to make the jailbreak work on firmware versions other than 3.41.

             Added the ability to automatically turn off the device after a certain number of seconds, configurable from the options menu.

             Added the ability to disable connection of the last device (device 6) during the jailbreak, configurable from the options menu.

v0.05.0001 - Added Install/Uninstall options for jailbreak hook, enabling use within the TI-OS and outside the application itself.

             Added external payload support and an options menu to select a custom payload ("stage 1").

             Added AsbestOS support and a custom stage 1/2 payload from the options menu.

             Miscellaneous bug fixes.

v0.02.0001 - Increased homebrew compatibility.

v0.01.0002 - initial release.

BrandonW Wrote:PS3JB is a FLASH application for the TI-84 Plus and TI-84 Plus Silver Edition that helps to exploit the Playstation 3 console. By connecting a USB cable between a PS3 and your calculator and running the application, you can trigger the PSGroove exploit or downgrade your PS3 from your graphing calculator.

Looking for the TI-89 Titanium port instead? Check here.

The latest version brings about a couple of changes:

    * To save space, the application no longer comes with a default payload. To jailbreak the PS3 using the PSGroove exploit, you MUST use an external payload. Most people already do this anyway. You can find more information about this below or here.
    * You can now downgrade the PS3 by emulating the Sony official jig stick. You can enable this in the options menu:

      Once enabled, just select "1) PS3 Jailbreak" or install the hook as usual.

The application includes the following features:

    * Current status is displayed at the bottom of the LCD:
    * In addition to the usual jailbreak method, you can now install and uninstall a "hook" that allows the jailbreak to work at any point in the calculator's OS:

      This even works when the calculator is off; the PS3 will turn it on as it enumerates USB devices, and the calculator will shut off after about 5 minutes of inactivity (configurable through the options menu).
      Now you can shove the calculator and the USB cable behind the PS3 and forget it's there!
    * External payloads are supported.
      These payloads are stored as calculator AppVars and selected through PS3JB's options menu:

      These options are stored in an AppVar called PS3JBOPT, which can be archived to keep it safe from RAM resets.
      To convert from a binary file containing the payload data to an AppVar, you can use To8XV (a VB.NET 2.0 program) found here, or you can create your own.
    * AsbestOS is now supported. The stage 1 and stage 2 payloads are specified in the options menu as above. To use the standard jailbreak exploit, select "None" as the stage 2 payload (which is the default).
    * Other firmware versions below 3.41 are now supported through the use of "firmware compatibility AppVars", which are external files that override specific behavior in the jailbreak to make it function under different firmware versions:

      Select an AppVar appropriate for your firmware version along with a payload appropriate for your version and you can now use the jailbreak on 3.01, 3.15, and potentially others (below 3.41).
      A basic list of these AppVars as well as their format (for creating your own) can be found here.
    * The calculator will now automatically turn off after a specified time (default 5 minutes, the same as the calculator's APD (Automatic Power Down) feature):

      This is configurable anywhere from 5 seconds to 300 seconds (5 minutes).
    * The connection of device 6 during the jailbreak can now be enabled/disabled in the options:

      This is enabled by default, and useful with payloads that no longer use device 6. If you don't know what to do with it, leave it alone.

There is no need to use modified versions of the application; everything is configurable through options, and if there's something you think a user (or developer) should be able to change, feel free to let me know.

To all the people that thanked me for creating this: you're welcome! Your comments are very much appreciated.

This application is open source and has no license attached to it, so you're free to do whatever you want with it; but please don't slap your name on it and call it your own, it's just rude.

I had to purchase a rather expensive, but useful USB hardware analyzer to make this work. Any and all donations go toward paying off the analyzer, so if you donated to me, thank you very much, and I hope this application saved you some time and/or money.
Frequently Asked Questions

Will I still be able to use my calculator like normal after this? Can this cause damage to my calculator?
This is just a FLASH application like any other you would download off education.ti.com or ticalc.org and has no impact on other functionality. There is always the potential that the application could reset RAM, so back up anything important on your calculator to your computer before running this. I'm not responsible for anything that happens from you choosing to run this application.

Do I need a special cable for this?
No, you just need a standard A«>mini-B USB cable (this is what you use to connect a calculator to a computer and comes with the calculator, it's also used to charge/sync PS3 controllers). You have one of these.

What firmware version does my PS3 need to be on for this to work?
You must be on 3.41 or below to jailbreak with the PSGroove exploit (DO NOT update beyond this if you want to use this or similar exploits). You can downgrade from firmware version 3.50 or earlier by entering factory/service mode and using .self and .pup files elsewhere (don't ask me for them). The application has built-in support for 3.41; there are payloads that work on 3.01, 3.10, 3.15, etc. which require "firmware compatibility AppVars."

Well, I'm on firmware 3.55 (or higher), when are you going to update the application to support it?
First off, the exploit that this application uses was fixed in firmware version 3.42. Downgrading was fixed in firmware version 3.50, so if you're on 3.55 or higher, you can't use this. The only way you can jailbreak your PS3 is by using another exploit, if and when it's found. Second, I'm not a PS3 developer, so I have no ability whatsoever to find any new exploits. But rest assured, if a new exploit comes out by somebody else that I have the opportunity to implement, I will jump on it.

What OS version does my calculator need to be on for this to work?
OS 2.30 or above. You can get the latest version (currently 2.53MP) at education.ti.com.

I get "ERR:VERSION" when I run it from the calculator! What's wrong?
Upgrade to OS 2.30 or above.

How do I get this on my calculator?
Do some reading and/or googling. You will need link software like TI Connect (Windows/Mac OS X) or TiLP (Windows/Linux) and a cable to connect your calculator to your computer.

What do I do after running the application?
Select option 1 "PS3 Jailbreak") and do what the calculator's LCD tells you to do, and read the included readme.

Can I disconnect the calculator from the PS3 once it has booted to the XMB?
Yes, though you need to use it on every boot.

It didn't work! What's wrong?!
Be patient with it. It may take multiple tries for it to work correctly. Make sure the PS3 is powered completely off first and that you press EJECT immediately after POWER. You'll know it worked when you see the calculator's LCD say "Done" at the bottom and you see an "Install Package Files" option under Game in the XMB of the PS3. Also make sure that no other USB devices are attached before booting to the XMB.

It worked and all, but when I select "Install Package Files", I don't see anything.
The "Install Package Files" option lets you select .pkg files from a connected USB storage device. If you don't have one connected with such files, then you're not going to see anything.

It worked and all, but when I select this mysterious "/app_home/PS3_GAME/" menu item, I get an error.
This is normal behavior.

Will this work on my TI-84 Plus (non Silver Edition)?
Yes.

Even the pink model?
Yes. Colors are irrelevant.

Will this work on the TI-83 Plus or TI-83 Plus Silver Edition or [xyz]? It has a cable that's USB on one end, so it can work, right?
No. The calculator must have a USB controller in it, and the only two calculators with USB controllers that this application supports is the TI-84 Plus and TI-84 Plus Silver Edition.

Will this work on the Voyage 200? It can have USB with this silver-looking cable I have.
No. What don't you understand about "It only works on the TI-84 Plus and the TI-84 Plus Silver Edition"?

Can this be ported to the TI-89 Titanium?
Why yes, as a matter of fact, it has been! See this.

Can this be ported to HP or Casio calculators?
Maybe, I don't know. I'm not an HP or Casio person. I can't possibly do it.

Will this work on my TI-Nspire or TI-Nspire CAS? My TI-Nspire can emulate the TI-84 Plus Silver Edition.
No. The Nspire's 84+SE emulator doesn't accurately emulate all the USB controller hardware necessary for this to work.

Which version of the PSGroove payload does this have built into it?
It does NOT have any payload built into it; you must supply your own in the form of an AppVar.

What tools did you use to assemble/build this?
You can build the project with Zilog Development Studio 3.68, downloadable from zilog.com (or here if you can't find the buried link on their site). You can sign the application by using Wappsign for Windows, which comes bundled with the TI-83 Plus SDK from education.ti.com.

Can I use this to play backups?
Backup support is specified in the payload, which I do not provide. External payloads found elsewhere on the internet can be transferred to your calculator and specified in the options menu to provide a myriad of features, including that one.

What's the main purpose of this?
To run unsigned homebrew code on the PS3 that you own, and hopefully, to eventually re-enable OtherOS support on it with the help of the PS3 homebrew community.

Is there a collection of existing payload AppVars somewhere that I can just download and use?
Yes. Some googling reveals this, for example.

How do I create these payload AppVars you're talking about?
See this.

Why didn't you include backup support? I have a legitimate right to play my own backups, you know.
You're right, you do. You and I both know that. However, Sony and the US legal system disagrees with us, and so I'm forced to protect myself first. If you can't understand that, I'm sorry, but that's all I can say on the subject. You can't really know what you'd do unless you were in my shoes and you were actually the target. There are many out there that know how to play backups with this method, so I suggest you bug them instead of me. I'm afraid I just can't help you.

You realize you're going to burn in hell and/or rot in jail for releasing this, right? You're hurting legitimate game sales by releasing this.
No, I'm really not. The intention here is to run our own code on a device wee all own, and restore the Linux support forcibly taken away from us. I've done the best I can to prevent this from being used for illegal backups, but it just comes with the territory. See the history of every other console community for examples. Complain to the people downloading games, not me.

I go to play a backed-up game with Backup Manager and it just takes me back to the XMB and I see the actual disc, not the game I backed up. What's wrong?
Ask somebody else. I wrote this to run unsigned code and restore OtherOS/Linux support, not help you play backups. Read above; if you're experimenting with this, google for answers.

How can I scream at you / profess my undying love / throw money at you via PayPal / give a simple thanks / etc.?
brandonlw@gmail.com.

Quote:Over the months there has been a lot of inaccurate information circulating in regards to how exactly the PlayStation 3's Service Mode works, and as promised in our previous Dev updates here are some of the facts to help separate the rumors and speculation.

It is a fairly simple process as follows.. For starters, the PS3 is powered off, and a special USB dongle, known as the Jig, is connected. The PS3 is then turned on, and then off, once it has detected the Jig.

After this occurs, the PS3 is then turned back on, into "Service" Mode. From here, the PS3 is re-flashed using a Firmware Update on a USB stick, specifically designed to only install from the Service Mode. Once the PS3 is re-flashed with the software, it is then used in conjunction with a PC running customized software, specifically the DEX.exe and CEX.exe's.

There are a multitude of special PS3 firmwares, basically three major ones. The first is a Core System, followed by the Service System, then finishing it off with the Final Software.. usually Retail.

From the CEX/DEX PC side software, just about anything can be done: Copying, transfer and resigning of box-specific items like PSN games, user profiles, etc.

Furthermore, the systems can be re-flashed to any software version as well. The system's keys can also be "rearranged", such as the marrying of the PS3's BD-ROM Drive (or controller) with the mainboard. Needless to say, this can do a lot more than a simple "Recovery Menu", as it can change firmware and more.

Over the last few months wee have also compared the flash dumps (pictured below) done by our very own courier of a PS3 in Service Mode with a Retail (and a Debug) and found that the systems are primarily alike, however the Bootloader 1 of the Service Mode PS3 differs than that of the other systems. Work is still being done by the resident PS3 Devs in trying to pinpoint exactly why this is the case.

remainnameless@PSX-Scene Wrote:HOW TO DOWNGRADE:

1. Install the PS3JB App (v. 0.08.0001)

2. Open the PS3JB App on your calculator. (APPS»PS3JB)

3. Choose Option "5" (Options)
4. Make sure "Stage 1 and Stage 2 Payloads" is set to "none". Make sure "FW. Compat. Opts" is set to "none". Make sure "Use Device 6" is set to "No".

5. MAKE SURE "EMULATE JIG" IS SET TO YES

6. Save your configuration.

7. Connect your calculator to your PS3 and press option "1" (PS3 Jailbreak) on your calculator.

8. Do the power cycle like you normally would to jailbreak your PS3.

9. You may see some screen flickers. You will not have a picture on your screen. The PS3 will shut itself off.

10. Format a USB flash drive. Make sure there is nothing left on the flash drive.

11. Copy over the modified 3.41 update (PS3UPDAT.PUP) and the first Lv2diag.self file onto the root of your flash drive. There should be nothing else but these two files on your flash drive.

12. Plug the flash drive into the right-most USB port if your PS3 is laying down, or the top USB port if it is standing up.

13. Power on the machine. Don't do the normal Jailbreak power cycle. Just power it on. You will get no picture. You will have to wait until it shuts itself off agin, which took me about 10 minutes. DO NOT get antsy and think it froze on you and shut it off prematurely. Give it up to an hour before doing anything drastic.

14. Once the PS3 shuts itself off again, plug your flash drive back into your computer again and delete the "PS3UPDAT.DAT" and the "Lv2diag.self" files. Once deleted, copy over the second Lv2diag.self file to the root of your flash drive. Again, this should be the only file on your flash drive.

15. Once the file is on your flash drive, plug it into the same port you had it in before in your PS3 and turn the power on. Again, just a normal power on, no Jailbreak power cycle.

16. It will stay at a black screen until it is ready and then shut itself off. Once that is done, remove your flash drive.

Congratulations! You are now done!