Post: Naehrwert releases SCETool and Friday package
Options
11-28-2011, 05:31 AM
#1
YnO
~♣°Yamata no Orochi°♣~
Note: The current SCETool is for SPU versions of .SELF.
## scetool
scetool 0.0.1 (C) 2011 by naehrwert
[*] Keys loaded.
[*] Loaded keys:
Name Type SDK-Type Version
isoldr 3.50 SELF 0x0000 0x0003005000000000
isoldr 3.41 SELF 0x0000 0x0003004100000000
isoldr 1.00 SELF 0x0000 0x0001000000000000
metldr SELF 0x0000 0x0000000000000000
spp 0x00 SPP 0x0000 0x0000000000000000
pkg 0x00 PKG 0x0000 0x0000000000000000
[*] File decrypted.
[*] SCE Header:
Magic 0x53434500 [OK]
Version 0x00000002
SDK Type [Type 0]
Header Type [SELF]
Metadata Offset 0x000001B0
Header Length 0x0000000000000480
Data Length 0x0000000000012BF4
[*] Metadata Info:
Key 00000000: AC 0E 35 E4 A9 22 07 C7 09 2C 38 66 69 45 34 31
IV 00000000: 1C 7D C8 A3 EB B9 C8 9C BB E4 B6 A6 A6 49 61 C2
[*] Metadata Header:
Signature Input Length 0x0000000000000450
unknown_0 0x00000001
Section Count 0x00000003
Key Count 0x00000016
Signature Info Size 0x00000030
unknown_1 0x00000000
unknown_2 0x00000000
[*] Metadata section headers:
Idx Offset Size Type Index unk_1 SHA1 Encrypted Key IV Compressed
000 00000500 00011C20 02 00 02 00 [YES] 06 07 [NO ]
001 00012120 000000A0 02 01 02 08 [YES] 0E 0F [NO ]
002 00012EE4 00000190 01 03 02 10 [NO ] [NO ]
[*] SCE File Keys:
00000000: F9 A1 54 8A A2 E3 12 FE 3B 67 CB 5E 02 03 66 82
00000001: EF E2 22 82 00 00 00 00 00 00 00 00 00 00 00 00
00000002: F4 06 C9 67 46 0F 09 C3 54 E5 0F DB BD 63 74 A6
00000003: A9 00 9B 0D 53 B4 4E 3E F2 EB 3D 7A C3 0A 79 C3
00000004: 6A 55 C9 6F 72 DE 4E 7E 7A 0D C2 CB 27 F8 C9 9A
00000005: C3 08 9E 65 A9 DF 80 B1 7E 66 DF 6B 9D 10 33 99
00000006: 2A 3C 73 80 C6 1B 85 24 9F 95 3D BE A9 A5 63 38
00000007: CB 41 E6 46 F8 B2 6E 06 D4 1A 5B F5 08 48 28 D3
00000008: 13 07 A2 4F 1C 32 3F D7 15 47 D9 50 BF E4 11 04
00000009: 18 7F EC 72 00 00 00 00 00 00 00 00 00 00 00 00
0000000a: F4 06 C9 67 46 0F 09 C3 54 E5 0F DB BD 63 74 A6
0000000b: A9 00 9B 0D 53 B4 4E 3E F2 EB 3D 7A C3 0A 79 C3
0000000c: 6A 55 C9 6F 72 DE 4E 7E 7A 0D C2 CB 27 F8 C9 9A
0000000d: C3 08 9E 65 A9 DF 80 B1 7E 66 DF 6B 9D 10 33 99
0000000e: 2A 3C 73 80 C6 1B 85 24 9F 95 3D BE A9 A5 63 38
0000000f: CB 41 E6 46 F8 B2 6E 06 D4 1A 5B F5 08 48 28 D3
00000010: 2A AE E7 5C 8C EB 44 4A 62 F4 DF EF 77 5B 02 42
00000011: C7 5C 2D 5C 00 00 00 00 00 00 00 00 00 00 00 00
00000012: F4 06 C9 67 46 0F 09 C3 54 E5 0F DB BD 63 74 A6
00000013: A9 00 9B 0D 53 B4 4E 3E F2 EB 3D 7A C3 0A 79 C3
00000014: 6A 55 C9 6F 72 DE 4E 7E 7A 0D C2 CB 27 F8 C9 9A
00000015: C3 08 9E 65 A9 DF 80 B1 7E 66 DF 6B 9D 10 33 99
[*] SELF Header:
unknown_0 0x0000000000000003
App Info Offset 0x0000000000000070
ELF Offset 0x0000000000000090
PH Offset 0x00000000000000D0
SH Offset 0x0000000000012EE4
Section Info Offset 0x0000000000000110
SCE Version Offset 0x0000000000000150
Control Info Offset 0x0000000000000160
Control Info Size 0x0000000000000070
[*] Application info:
Auth ID [isoldr]
Vendor ID 0xFF000000
SELF Type [Secure loader]
Version 0x0003004100000000
[*] Elf32 Header:
Type [EXEC]
Machine [SPU]
Version 0x00000001
Entry 0x000259E0
PH Offset 0x00000034
SH Offset 0x00012A64
Flags 0x00000000
PH Count 0x0002
SH Count 0x000A
SHStr Idx 0x0009
[*] Elf32 Section Headers:
Idx Name Type Flags Address Offset Size ES Align LK
000 00000000 NULL ... 00000 00000 00000 00 00000 00
001 0000000B PROGBITS .AE 25800 00080 001DC 00 00001 00
002 00000022 PROGBITS .AE 259E0 00260 0F1D0 00 00008 00
003 00000028 PROGBITS .A. 34BB0 0F430 02870 00 00010 00
004 00000030 PROGBITS WA. 374A0 11CA0 00070 00 00010 00
005 00000036 PROGBITS WA. 37510 11D10 0001C 00 00004 00
006 0000003D PROGBITS WA. 3752C 11D2C 00014 00 00004 00
007 00000044 NOBITS WA. 37540 11D40 039B0 00 00010 00
008 00000049 PROGBITS ... 00000 11D40 00CD2 00 00001 00
009 00000001 STRTAB ... 00000 12A12 00052 00 00001 00
[*] Elf32 Program Headers:
Idx Type Offset VAddr PAddr FileSize MemSize Flags Align
000 LOAD 00080 25800 25800 11C20 11C20 W.E 00080
001 LOAD 11CA0 374A0 374A0 000A0 03A50 .AE 00080
Originally posted by another user
friday (C) 2011 by naehrwert
This is a POC for a isolated spu binary. Generate a self encrypted+signed with the metldr keys out of friday.elf.
Then use friday.h to write a PPU application that loads the self by utilizing metldr and DMAs your console’s EID2 to the shared SPU LS.
It will generate the P and S block from it, that is used to pair the BD drive to the specific console.
You can then DMA the blocks out from the LS and send them to the drive to remarry it to the console.
Communication with the SPU is done over in_mbox and out_mbox. MSG_OUT_* is send from the SPU code to out_mbox.
MSG_IN_* should be written from the PPU to in_mbox.
When MSG_OUT_READY arrives the PPU should DMA the EID2 to EID2_START and send MSG_IN_READY.
When MSG_OUT_GEN_DONE arrives the PPU should DMA the blocks out from BLOCKS_START and send MSG_IN_DIE.
Note: this is UNTESTED but should just work
DOWNLOADS thanks to jailbreakscene
You must login or register to view this content.
You must login or register to view this content.
note*** if you dont know what is this or how to use it, dont ask.
The following 2 users say thank you to YnO for this useful post:
The following user groaned YnO for this awful post:
11-30-2011, 01:42 AM
#3
TechMemphis
< ^ > < ^ >
Im interested in the SCETool once kakaroto releases his 3.73 jb maybe we can figure out how to get this tool to run on it..... would be interesting... nm it works on pc I was thinking the tool would allow you to view it on the ps3 itself... boo.... oh well still awsome thanks again for the info YnO actually I think there is already tools similar too this scetool... if im not mistaken? ehh doesn't matter I guess...
Copyright © 2026, NextGenUpdate.
All Rights Reserved.
