Help with DTL exploits

Discussion in 'Sony Programming and Development' started by AgentClank636, Sep 11, 2012.

  1. AgentClank636

    AgentClank636 Active Member

    Joined:
    Sep 5, 2012
    Messages:
    34
    Likes Received:
    0
    Hi there

    I recently got a DTL-10000S TEST PS2 from eBay for £25, as it was listed in the wrong category!

    Anyway, I'd like to make some sort of exploit for it, as at the moment I'm using a Master-patched uLE CD to launch OPL etc. off the USB hard disk; but I don't want to use whats left of the laser any more. Would anyone like to assist me in getting FMCB or similar onto DTL-H10000s? In return I'll help you put it onto yours.

    I'll speak to Dlanor too later.
     
  2. SilverBull

    SilverBull Site Supporter 2010,2011,2013,2014,2015.SitePatron

    Joined:
    Jun 12, 2008
    Messages:
    385
    Likes Received:
    6
    I may be mistaken here, but I think to remember that the early TEST consoles do not implement the necessary MagicGate commands... If this was indeed the case, you would never be able to boot from memory card, as the machine would simply hang while trying to decrypt the OSD update.

    On a related note: according to the documentation I have, the special SCPH-10020 TDB memory card (that converts a TEST into a "Lite" version of a TOOL) is also supported only on the DTL-H10100, DTL-H3010x and DTL-H50000. Maybe the documentation is too old and the card does work on the slimline TESTs as well, but I think there is a reason it explicitly mentions the DTL-H10100 and not the DTL-H10000.

    Anyway, I'm expecting my SCPH-10020 soon and will let you know if it works.
     
  3. unclejun

    unclejun Site Supporter 2011-2014

    Joined:
    Nov 12, 2005
    Messages:
    1,912
    Likes Received:
    120
    You won one of the cards that were on ebay, nice!
    I considered bidding on the second one, but in the end I didn't, still haven't paid for the shipping of my T15k yet...I don't think I'll need another piece of PS2 dev hardware after that.

    On the subject of the DTL-H10000, it's not compatible with the Browser2.0/PSBBN either (wich boots from the memory card on the retail unit SCPH-10000 and works fine on the DTL-H3010x), so if you intend to use a softmod, the only way is to get another model, or a fat retail.
     
  4. AgentClank636

    AgentClank636 Active Member

    Joined:
    Sep 5, 2012
    Messages:
    34
    Likes Received:
    0
  5. AgentClank636

    AgentClank636 Active Member

    Joined:
    Sep 5, 2012
    Messages:
    34
    Likes Received:
    0
    Upon starting FreeMcBoot.elf on the USB disk via Master-Patched uLE, I got a black screen with an error:

    ERROR: Cannot load xsio2man: -203
    FreeMcBoot Init failed....

    I have a hunch (desperate hope) that it may be the the FMCB files to blame. Will put FMCB on the disk again now and see.


    __________________________________

    FMCB Configurator works....

    ______________________________________

    Could the following mean that the PS2 can run a virtual machine of itself?

    1. Launched uLE
    2. Launched OPL using uLE
    3. Launched Agent Under Fire exploit-disc ISO via OPL
    4. I opened the driving level to get uLE again <-- will call it uLE2

    Now if its like: uLE2 is loaded inside OPL, which is loaded inside uLE1, doesnt that mean I'm VMing?

    And also the CDFS in uLE is of the ISO, not the disc in my PS2. And Mass:/ doesnt show. And MC0 could have been a virtual one if I set it in OPL.

    Mindf**kery:D or maybe I'm just stupid
     
    Last edited: Sep 11, 2012
  6. unclejun

    unclejun Site Supporter 2011-2014

    Joined:
    Nov 12, 2005
    Messages:
    1,912
    Likes Received:
    120
    You need to put the following modules (XSIO2MAN, XMCMAN, XMCSERV, XPADMAN) in the same directory as the FMCB installer.
     
  7. AgentClank636

    AgentClank636 Active Member

    Joined:
    Sep 5, 2012
    Messages:
    34
    Likes Received:
    0
    I think I'll give up and sell the PS2 sometime in the near future. The BIOS dumping tool just hangs on a blank screen, after two re-installations, so I can't even get the modules to start FMCB, never mind the specific ones that people are struggling to get.

    Thanks for your help though guys:D
     
  8. unclejun

    unclejun Site Supporter 2011-2014

    Joined:
    Nov 12, 2005
    Messages:
    1,912
    Likes Received:
    120
  9. l_oliveira

    l_oliveira Officer at Arms

    Joined:
    Nov 24, 2007
    Messages:
    3,879
    Likes Received:
    245
    That's not true (anymore) ;)


    (ELFs have been made out of the content of the KELFs and can be launched from something such as uLE...)

    So while the PS2 cannot auto boot the program, it can still boot the program with some minor hacking.

    I have a decrypted launcher for PSBBN in .ELF format, but for it to work as a standalone ELF it need to be launched from another ELF with correct argvs. Which calls for some hacking, sadly.


    Ah I am really curious about the contents of the dev boot memory card.
     
  10. AgentClank636

    AgentClank636 Active Member

    Joined:
    Sep 5, 2012
    Messages:
    34
    Likes Received:
    0
    So it reaches Decrypting DVDELF and fails, now its the main stumbling block


    Am I right in thinking that the issue here is that there is no DVDPLJ for the DTL consoles, because there is no need for one? And that if there was one, only Sony would have it?
     
    Last edited: Sep 17, 2012
  11. Keberasky

    Keberasky Spirited Member

    Joined:
    Mar 18, 2009
    Messages:
    102
    Likes Received:
    2
    All PS2 Test units do not have the ability to play back DVD movies. That's probably the shortest answer I can come up with as to why FMCB doesn't work on a DTL.

    I believe the more technical answer is that either the BIOS itself or the mechacon (Mechanics controller which is primarily responsible for the DVD drive and memory cards.) doesn't have the appropriate magic gate keys to decrypt the retail DVD Player on the card, which FMCB exploits to boot on normal retail units.

    The only real possible exploit that I can think that doesn't use the drive is the start-up card mentioned above, and it doesn't work with your specific PS2 test model. So at the moment the only units that don't require use of the DVD-drive are retail units (up the SCPH-7000) and debug units that have the 1 in their model (example DTL-30101) number.
     
  12. AgentClank636

    AgentClank636 Active Member

    Joined:
    Sep 5, 2012
    Messages:
    34
    Likes Received:
    0
    So the keys to decrypt FMCB and run it as a KELF are different for a DTL unit.

    The only way forward would be to flash / replace the mechacon EEPROM which is this chip, with that of an SCPH-10000. This would also prevent the reading of master discs.

    [​IMG]

    I won't do it to my PS2 as it would break the warranty seal.


    Thanks for your help guys- its been interesting to learn about my DTL unit, as well as working with you. Shame that we could get no further, but at least the information is there now as to how to run such an exploit.
     
    Last edited: Sep 17, 2012
  13. l_oliveira

    l_oliveira Officer at Arms

    Joined:
    Nov 24, 2007
    Messages:
    3,879
    Likes Received:
    245
    If you do that, the PS2 will no longer power on. It has a different Syscon (System Controller, another MCU) and if the mechacon and syscon type mismatch the mechacon sends a shutdown command to the syscon, causing the PS2 to shut down right after it powered on.
     
  14. AgentClank636

    AgentClank636 Active Member

    Joined:
    Sep 5, 2012
    Messages:
    34
    Likes Received:
    0
  15. l_oliveira

    l_oliveira Officer at Arms

    Joined:
    Nov 24, 2007
    Messages:
    3,879
    Likes Received:
    245
    I tested it myself. -_-;
     
sonicdude10
Draft saved Draft deleted
Insert every image as a...
  1.  0%

Share This Page