Post: MW3 patch_mp.zone
Options
11-04-2011, 10:24 PM
#1
BuC-ShoTz
TeamMvKâ?¢
there is a rsa signature in the ff, which means the self is going to have be modded, in order to run a custom patch.
but there isnt gsc's either, lol
You must login or register to view this content.
You must login or register to view this content.
The following 26 users say thank you to BuC-ShoTz for this useful post:
04jberry, aerosoul94, AMNE, bnader, Brentdevent, BvB-09r-_-N!c0, Correy, Demmonnixx, FAKA_ELITE, iMCSx, legitmod, lovebros, max88, Officer Laggy, Pauly, PryZeex, Sn0wb0arder245, Solid Snake, Stack0verfl0w, TEXAS24_ReStEr, TheFallen, ThereThatGuy, x-Roniie-x., xChronicModz, xMrCheatVisionx, xXQUiiCKNiiCKXx
The following 2 users groaned at BuC-ShoTz for this awful post:
11-12-2011, 07:54 AM
#74
Blackstorm
Veni. Vidi. Vici.
Originally posted by Team
How will we use the hacks cause from what i understand the only way to transfer the patches is through jailbroken PS3. Unfortenetly there is no new jailbreak therfore no challenge lobbies just solo hacks so how will this all work
Bro you're getting way ahead of yourself. We can't even run a modded patch yet.
The following user thanked Blackstorm for this useful post:
11-13-2011, 11:02 AM
#75
pcfreak30
>> PCFreak30.com 
<<
<<
Jesus Christ. Can all the people who know nothing past what a bind and a "patch" file is please kindly leave this thread so others who know things can talk about this...
Now i will say i have already done alot of detective work on MW3 and IW have FINALLY learned a few things.
On a side note, its good to see you zy0n around here. Never thought I would see you on NGU bro
. As to the guy who doesn' know what decrypted means, just stop programming 
...
Here is what I can say. MW3 may be using a different compression or none at all. The GSC's are compiled to assembly, or at-least the main ones.
The PC version uses double-zlib (MW2 style), and only CFG files are viewable.
The PC version removed all useful CFG's, so we can exec any for mods. The SP code has a developer cfg, but only binds to PC controls. Thats fine for PC, but knowing IW its the same in console...
No one has gotten RSA removed on either console. TU1 took out any useful spots to inject bind strings on xbox, and I have not checked TU2, but I imagine its even less.
Now what I find very funny is the fact that wii is equiv to MW2. It uses double-zlib AND the scripts are NOT compiled. Granted one bad thing is they are checking all files some how as if I mod the common or codepost, it freezes on loading a map. This is mainly due to the fact that wii oddly loads ff's as-needed and not all at once like XBOX/PS3.. I even tried putting the bytes at the original count and no dice. The ODD thing is the files were un-signed Iwffu100 files.
The only thing I see possible is GPD modding, savegaming modding, MPDATA file modding, and modding the EBOOT, SELF/XEX. I must admit IW got their asses in gear this year....
Seems that GPD modding on XBOX got patched in TU2 though...
Also some interesting information. it seems the _dev.gsc in MW3 has unlock all, ufo, AND noclip GSC-based mods that are controlled by dvars and game controls...
It also has mods for host for modding xp, rank, and gun xp. Also has something related to the host hurting all player but bots, but not to sure about that...
Well hope you enjoy my findings... Buc-shotz,do im me when you can. Its been a while.
Sorry for not being around but I am more on xbox and have other business to do. FYI got a second PS3 now...
Peace..
Now i will say i have already done alot of detective work on MW3 and IW have FINALLY learned a few things.
On a side note, its good to see you zy0n around here. Never thought I would see you on NGU bro
. As to the guy who doesn' know what decrypted means, just stop programming ...Here is what I can say. MW3 may be using a different compression or none at all. The GSC's are compiled to assembly, or at-least the main ones.
The PC version uses double-zlib (MW2 style), and only CFG files are viewable.
The PC version removed all useful CFG's, so we can exec any for mods. The SP code has a developer cfg, but only binds to PC controls. Thats fine for PC, but knowing IW its the same in console...
No one has gotten RSA removed on either console. TU1 took out any useful spots to inject bind strings on xbox, and I have not checked TU2, but I imagine its even less.
Now what I find very funny is the fact that wii is equiv to MW2. It uses double-zlib AND the scripts are NOT compiled. Granted one bad thing is they are checking all files some how as if I mod the common or codepost, it freezes on loading a map. This is mainly due to the fact that wii oddly loads ff's as-needed and not all at once like XBOX/PS3.. I even tried putting the bytes at the original count and no dice. The ODD thing is the files were un-signed Iwffu100 files.
The only thing I see possible is GPD modding, savegaming modding, MPDATA file modding, and modding the EBOOT, SELF/XEX. I must admit IW got their asses in gear this year....
Seems that GPD modding on XBOX got patched in TU2 though...
Also some interesting information. it seems the _dev.gsc in MW3 has unlock all, ufo, AND noclip GSC-based mods that are controlled by dvars and game controls...
It also has mods for host for modding xp, rank, and gun xp. Also has something related to the host hurting all player but bots, but not to sure about that...
Well hope you enjoy my findings... Buc-shotz,do im me when you can. Its been a while
.Sorry for not being around but I am more on xbox and have other business to do. FYI got a second PS3 now
...Peace..
The following 3 users say thank you to pcfreak30 for this useful post:
11-16-2011, 12:52 AM
#76
NGU???
Banned
Originally posted by C0mplex
Ok no more responses ok I don't need eboot decrypted. anyways I've talked to Theunkn0wn about which file he wan't me to obtain anyways. Also it none of your concern you will not get a decrypted copy.
Focus on this thread not what "I'm doing personally"
Focus on this thread not what "I'm doing personally"
First of all;
The NPDRM Keys aren't easy to find, you have to have knowledge of the PS3 Plate design aswell as the Cryptochain. You with your basic knowledge on the Ps3 will NEVER accomplish this task. You probably have no idea where to begin. I would start with trying to find an exploit in the Lv1 where you can dump decrypted Lv0. This means you will require a PS3 with access to the Read/Write Exec in the Lv1 on a lower firmware then updating to the latest and somehow dumping the Lv0 through the update process...But that alone is difficult, you then have the task of trial an error to dump the part where the decrypted Lv0 is stored, that is IF they haven't patched that exploit in the first place which knowing Sony, they have.
Second;
There will be checks in the self aswell as the eboot. So you will need to be in Jailbroken Mode on the PS3 system as the only way it would be possible to accomplish this is to remove the checks in the eboot after decrypting to an eboot.elf. Which as you know cannot be re-encrypted to an .bin if the checks are removed. .elf is unsigned code, so has to be Jailbreak Mode. Mw3 only runs on 3.70+, there is currently no mount on the HDD to allow it to be played on Firmwares below 3.70. Since the oversize headers exploit required to enable Jailbreak mode is fully patched since 3.65, I would say your pretty screwed.
The following user thanked NGU??? for this useful post:
11-16-2011, 01:03 AM
#77
Stack0verfl0w
Computer engineer
Originally posted by NGU
First of all;
The NPDRM Keys aren't easy to find, you have to have knowledge of the PS3 Plate design aswell as the Cryptochain. You with your basic knowledge on the Ps3 will NEVER accomplish this task. You probably have no idea where to begin. I would start with trying to find an exploit in the Lv1 where you can dump decrypted Lv0. This means you will require a PS3 with access to the Read/Write Exec in the Lv1 on a lower firmware then updating to the latest and somehow dumping the Lv0 through the update process...But that alone is difficult, you then have the task of trial an error to dump the part where the decrypted Lv0 is stored, that is IF they haven't patched that exploit in the first place which knowing Sony, they have.
Second;
There will be checks in the self aswell as the eboot. So you will need to be in Jailbroken Mode on the PS3 system as the only way it would be possible to accomplish this is to remove the checks in the eboot after decrypting to an eboot.elf. Which as you know cannot be re-encrypted to an .bin if the checks are removed. .elf is unsigned code, so has to be Jailbreak Mode. Mw3 only runs on 3.70+, there is currently no mount on the HDD to allow it to be played on Firmwares below 3.70. Since the oversize headers exploit required to enable Jailbreak mode is fully patched since 3.65, I would say your pretty screwed.
The NPDRM Keys aren't easy to find, you have to have knowledge of the PS3 Plate design aswell as the Cryptochain. You with your basic knowledge on the Ps3 will NEVER accomplish this task. You probably have no idea where to begin. I would start with trying to find an exploit in the Lv1 where you can dump decrypted Lv0. This means you will require a PS3 with access to the Read/Write Exec in the Lv1 on a lower firmware then updating to the latest and somehow dumping the Lv0 through the update process...But that alone is difficult, you then have the task of trial an error to dump the part where the decrypted Lv0 is stored, that is IF they haven't patched that exploit in the first place which knowing Sony, they have.
Second;
There will be checks in the self aswell as the eboot. So you will need to be in Jailbroken Mode on the PS3 system as the only way it would be possible to accomplish this is to remove the checks in the eboot after decrypting to an eboot.elf. Which as you know cannot be re-encrypted to an .bin if the checks are removed. .elf is unsigned code, so has to be Jailbreak Mode. Mw3 only runs on 3.70+, there is currently no mount on the HDD to allow it to be played on Firmwares below 3.70. Since the oversize headers exploit required to enable Jailbreak mode is fully patched since 3.65, I would say your pretty screwed.
I'm currently working on lv0, What you stated is not a logical approach. Please take time to look at You must login or register to view this content. and look at boot loader and metdlr.
11-16-2011, 01:21 AM
#78
NGU???
Banned
Originally posted by C0mplex
Kid you insult me providing links to the Boot Process. I know EXACTLY how it works and my approach is logical, it's been done on lower firmwares.
As you/very few have little knowledge of the Cryptology beyond 3.60. I wouldn't question theories and approaches that have been found correct previous.
MetLdr will be encapsulated inside the Lv0, The MetLdr keys cannot be updated, as you SHOULD know, you only need to re-establish the chain of trust to the MetLdr. This requires decrypting the Lv0 as ALL Loaders except the bootloader are inside (not the right word for this, but you get the point) the Lv0.
The following user thanked NGU??? for this useful post:
11-16-2011, 01:36 AM
#79
Stack0verfl0w
Computer engineer
Originally posted by NGU
Kid you insult me providing links to the Boot Process. I know EXACTLY how it works and my approach is logical, it's been done on lower firmwares.
As you/very few have little knowledge of the Cryptology beyond 3.60. I wouldn't question theories and approaches that have been found correct previous.
MetLdr will be encapsulated inside the Lv0, The MetLdr keys cannot be updated, as you SHOULD know, you only need to re-establish the chain of trust to the MetLdr. This requires decrypting the Lv0 as ALL Loaders except the bootloader aka OSLdr are inside (not the right word for this, but you get the point) the Lv0.
As you/very few have little knowledge of the Cryptology beyond 3.60. I wouldn't question theories and approaches that have been found correct previous.
MetLdr will be encapsulated inside the Lv0, The MetLdr keys cannot be updated, as you SHOULD know, you only need to re-establish the chain of trust to the MetLdr. This requires decrypting the Lv0 as ALL Loaders except the bootloader aka OSLdr are inside (not the right word for this, but you get the point) the Lv0.
syscon pulls the reset of Cell high -> Cell INIT
Cell INIT: CELL boots from it's internal ROM *2
+ Initialises I/O
+ fetches encrypted bootldr off NAND/NOR flash (at address 0xFC0000)
+ Initialises RAM
+ loads bootldr into Isolated SPU (SPE0)
+ Runtime Secure Boot decrypts and verifies bootldr and executes
+ bootldr decrypts lv0 which runs on PPU -> loaders INIT
11-16-2011, 01:41 AM
#80
NGU???
Banned
Originally posted by C0mplex
You can decrypt lv0 with the hw root key. Obtaining it is trivial with reason hints it possible. Since we have a new available metdlr exploit.Were have some where to start. New accrued info aside from Math (you can load the bootloader more than once). I find highly interesting, atm my guessing figure what stop it. Also a logical exploit would be You must login or register to view this content. with repeating
syscon pulls the reset of Cell high -> Cell INIT
Cell INIT: CELL boots from it's internal ROM *2
+ Initialises I/O
+ fetches encrypted bootldr off NAND/NOR flash (at address 0xFC0000)
+ Initialises RAM
+ loads bootldr into Isolated SPU (SPE0)
+ Runtime Secure Boot decrypts and verifies bootldr and executes
+ bootldr decrypts lv0 which runs on PPU -> loaders INIT
syscon pulls the reset of Cell high -> Cell INIT
Cell INIT: CELL boots from it's internal ROM *2
+ Initialises I/O
+ fetches encrypted bootldr off NAND/NOR flash (at address 0xFC0000)
+ Initialises RAM
+ loads bootldr into Isolated SPU (SPE0)
+ Runtime Secure Boot decrypts and verifies bootldr and executes
+ bootldr decrypts lv0 which runs on PPU -> loaders INIT
Typical, I've been off the scene for a month and all the good stuff arrives. What do you mean by new Metldr exploit? is this to do with the firmware spoofing or is it a new exploit?
11-16-2011, 01:43 AM
#81
Stack0verfl0w
Computer engineer
The following user thanked Stack0verfl0w for this useful post:
11-16-2011, 01:43 AM
#82
xiiBomberHD
Banned
Originally posted by C0mplex
You can decrypt lv0 with the hw root key. Obtaining it is trivial with reason hints it possible. Since we have a new available metdlr exploit.Were have some where to start. New accrued info aside from Math (you can load the bootloader more than once). I find highly interesting, atm my guessing figure what stop it. Also a logical exploit would be You must login or register to view this content. with repeating
syscon pulls the reset of Cell high -> Cell INIT
Cell INIT: CELL boots from it's internal ROM *2
+ Initialises I/O
+ fetches encrypted bootldr off NAND/NOR flash (at address 0xFC0000)
+ Initialises RAM
+ loads bootldr into Isolated SPU (SPE0)
+ Runtime Secure Boot decrypts and verifies bootldr and executes
+ bootldr decrypts lv0 which runs on PPU -> loaders INIT
syscon pulls the reset of Cell high -> Cell INIT
Cell INIT: CELL boots from it's internal ROM *2
+ Initialises I/O
+ fetches encrypted bootldr off NAND/NOR flash (at address 0xFC0000)
+ Initialises RAM
+ loads bootldr into Isolated SPU (SPE0)
+ Runtime Secure Boot decrypts and verifies bootldr and executes
+ bootldr decrypts lv0 which runs on PPU -> loaders INIT
When will you ever stop copying other's information? At least give credit >.>. When did this thread turn into PS3 Exploits & Hacks?
Copyright © 2026, NextGenUpdate.
All Rights Reserved.
