QA Flags discussion

[demize]

Seeing as the other thread was closed due to disagreements and "flaming" I figure we should have a "flame free" discussion about the matter as it seems to be one of the most important discussions in the past couple of weeks. Let's use this thread to discuss what has been achieved and what need's to be achieved in order to successfully tackle this valuable piece of useful information.

UPDATE: Here's some of the useful things taken from the many pages of information on this thread. I will continue to update this so stay tuned.

A breakdown from Slync-Things we need:
Quote:
1) QA Flag -- Already known how to do
2) Generate Valid Token -- Can already generate dummy token with grafs tools that don't do much but *might* be able to be altered.
3) Button Combo -- We have someone working on it.

The token has a similar structure to user_token which is already documented. We're going to try and use update manager to generate the token seed, make a valid un-encrypted token, send it through the token encrypter, and write it to eeprom.
Offsets from xwolfi:
Quote:
LEFT 128 0x80
DOWN 64 0x40
RIGHT 32 0x20
UP 16 0x10
START 8 0x08
R3 4 0x04
L3 2 0x02
SELECT 1 0x01

SQUARE 128 0x80
CROSS 64 0x40
CIRCLE 32 0x20
TRIANGLE 16 0x10
R1 8 0x08
L1 4 0x04
R2 2 0x02
L2 1 0x01
Here is a decrypted 3.41 VSH file from stallion83
http://www.mediafire.com/download.php?jjfc9c0c1jn39b1

The new chan is #qa-flag on efnet

A little help from Math:
<@Mathieulh>
Quote:
instead of looking for the combo
[16:35] <@Mathieulh> I looked for something else associated to it
[16:36] <@Mathieulh> ok, I'll help you a LOT
[16:36] <@Mathieulh> instead of looking for the combo
[16:36] <@Mathieulh> look for whatever checks the token
[16:36] <@Mathieulh> it'd also give you what value you need to set
[16:37] <@Mathieulh> the function that enables the combo in vsh.self also happens to check the token value
[16:37] <Slynk> spu_token_processer? I'm not sure if it handles verification or just encryption/decryption
[16:37] <@Mathieulh> the decrypted token is stored in ram
[16:37] <@Mathieulh> somewhere :P
[16:38] <@Mathieulh> and I REALLY helped you there

More info:

Alright, I got a bit sick and tired of this little game - 84 pages ongoing and still no progress.

So since this QA thing is worthless anyway - here is the button combo -

you need to have the cursor on 'Network Settings' - (it needs to be 3.55 OFW BTW - Rebug won't work - I've already established that) - and do the following button combo -

L2 + L1 + R1 + R2 + L3 + D-pad Down.

There's your button combo.'Edy Viewer' will pop up - Debug Settings will pop up - Install Package will pop up (but it's kinda useless anyway since only retail packages will install, and only the first PKG on the root of the USB stick - yes - seriously). Now you only need to figure out the rest. Yes, this one works - don't worry about it - just go figure out the rest.

BTW - in case some people immediately start trying this out and telling me 'Hey Square - this doesn't bleepin* work' - remember - there are still some pieces of the puzzle missing - the 'community' needs to figure these out. But the button combo is in the bag - don't worry about it anymore, don't go fruitlessly reversing anymore looking for a possible sign of life of this 'button combo' - you've got it. Now figure out the rest.

For those of you interested in flagging your console here is a link to the guide over at PSGroove: http://psgroove.com/content.php?1157...n-and-Tutorial

Enjoy! Thank you devs for all your work. I and many others greatly appreciate it. See what the community can do once combined?

[sabin1981]

We're watching this thread. Very closely. The last one was closed due to it being flame-bait -- the instant any flaming, of any kind, takes place; the thread will be deleted and the instigators will receive infractions.

[xPreatorianx]

EDIT: NVM I see a mod beat me too it.

@OP Well I know we have to reverse vsh.self in order to get the button combo, than we have to figure out how to actually enable the QA model as well as find the required token. So while we can enable QA mode through linux, we still need the token for it to have full effect. Well than we need the button combo for GamOS side.

[AlexDC22]

EDIT: NVM I see a mod beat me too it.

@OP Well I know we have to reverse vsh.self in order to get the button combo, than we have to figure out how to actually enable the QA model as well as find the required token. So while we can enable QA mode through linux, we still need the token for it to have full effect. Well than we need the button combo for GamOS side.

will this be possible on a non linux ps3? i have no plan to install linux at all on it.
just wondering cus i would then have to figure out how to go about installing it.

[demize]

will this be possible on a non linux ps3? i have no plan to install linux at all on it.
just wondering cus i would then have to figure out how to go about installing it.

I would like to know this as well. Seeing as I dont have linux on mine now. Not that I wont install it if needed. Now how exactly do we go amongst creating the token on the linux side? This was taken from Grafs side of the PS3Wiki:

Setting QA Mode

'''This section is in development anyone feel free to share and edit this section'''

First you have to dump your Flash -> Extract EID -> Extract EID0 and EID4 -> put them on eid.c

To do this you can use Hardware_flashing, Linux with graf_chokolo kernel with acces to /dev/ps3nflasha Links_to_precompiled_stuff or using this payload uncommenting dump_dev_flash()

More info in Flash

Once you are set

Use the payloads in the following order uncommenting the required function

Set the QA flag
update_mgr_qa_flag()
Calculate the token
update_mgr_calc_token()
Verify token
update_mgr_verify_token()
Set the calculated and verified token in update_mgr_set_token.c
update_mgr_set_token()

You should use wireshark or tcpdump to capture the responses.

Here also an excerpt of what I am assuming to be are commands or a spot to peek to look for creating/tinkering with tokens:

QA flag and token

update_mgr_qa_flag
update_mgr_get_token_seed <---This one seemed interesting. Anyone know what it does?
update_mgr_set_token
update_mgr_calc_token
update_mgr_verify_token

[L0YD]

[00:37:37]	<Mathieulh>	the token is also stored in syscon
[00:37:44]	<Mathieulh>	it's 0x50 bytes long
[00:37:49]	<Mathieulh>	and of course it's encrypted
[00:37:55]	<Mathieulh>	the token is tied to the EID0
[00:38:52]	<Mathieulh>	Graf's stuff contain some of the update manager protocol for the token and spu_token_processor protocol
[00:38:57]	<Mathieulh>	but it's nowhere near enough
[00:39:00]	<Mathieulh>	to QA flag the box
[00:39:06]	<Mathieulh>	the tokens you get from UM are no good
[00:39:23]	<Mathieulh>	they are what I would call "dummy tokens"
[00:39:28]	<Mathieulh>	with no privileges whatsoever
[00:39:38]	<dospiedra>	we will not have piracy
[00:39:47]	<Mathieulh>	the token itself has a series of flags which control various aspects of the console

check #ps3dev or logs here for more info.

[Digital-Spooker]

will this be possible on a non linux ps3? i have no plan to install linux at all on it.
just wondering cus i would then have to figure out how to go about installing it.

accessing hte menu yes, but from what I remember of hte last thread, everything else must be done through linux (though Asbestos was said to work)

Also, for any flaming Sabin, why not just remove/edit the flame posts and give warnings to the offenders, seems better, in case some developments come from this.

Being a nub in everything on the dev side of the PS3, if anyone points me to what I'd need to poke through the vsh, I'll spend some time pouring through it..

[sabin1981]

Also, for any flaming Sabin, why not just remove/edit the flame posts and give warnings to the offenders, seems better, in case some developments come from this.

Because, sadly, it's a chain reaction. Once one person starts, someone else joins in, then another, then another, until eventually you have a shitload of mess that none of the mods feel like spending their free time clearing up after everyone. It's easier to just warn the instigators and close the thread.

"This is why we can't have nice things"

Idiots ruin it for the rest of us.

[Digital-Spooker]

Because, sadly, it's a chain reaction. Once one person starts, someone else joins in, then another, then another, until eventually you have a shitload of mess that none of the mods feel like spending their free time clearing up after everyone. It's easier to just warn the instigators and close the thread.

"This is why we can't have nice things"

Idiots ruin it for the rest of us.

lol, Id spend the time to clean it up every time /sad/


I'm a Cleaner

[demize]

Because, sadly, it's a chain reaction. Once one person starts, someone else joins in, then another, then another, until eventually you have a shitload of mess that none of the mods feel like spending their free time clearing up after everyone. It's easier to just warn the instigators and close the thread.

"This is why we can't have nice things"

Idiots ruin it for the rest of us.

Well said. So now everyone has their warning. Post useful information on the topic and most importantly STAY on topic or face the consequences. We dont need any flaming to begin with. all we need is to come together as a team and tackle this for the well being of future "scene" support beams. Flaming will only smear the point.