Bruteforce KLicense Tools Discussion

[JLM]

@Attila,
It's not really installed but has added a file association. You can change that in windows explorer (the file manager) with the menu item: tools-->folder options, in the pop up, click on the file types tab, in the filetype list box, scroll to bin and click edit if you want to change it to something else, the same with sprx, or instead of all that simply right click a bin or sprx file and click "open with" in the popup, choose the file to open with (click no for windows checks online).

[aldostools]

removed post

[PatrickBatman]

TIP: This can be handy: In Windows 7, create a new folder and rename it as: God Mode.{ED7BA470-8E54-465E-825C-99712043E01C}

The problem is no new features or settings are exposed. Only a list of tasks that can be accomplished within Control Panel that Windows 7 and Vista use for start menu and control panel search.

The feature is not actually even called God Mode but All Tasks. Since the All Tasks feature is simply a shell folder you can access it a few different ways. In reality its just another shell folder.

Although if you are the kind of person that likes to navigate through a list of 279 tasks instead of simply typing in what you need try out this even better backdoor secretly created by the president of the Windows division. Create a new folder and name it: SinofskyBackdoor.{ED7BA470-8E54-465E-825C-99712043E01C}.

[catalinnc]

@aldostools thanks for the new FixELF.exe

i found a problem...lets say we have a self with checks for fw 3550...with this line:

FixELF.exe EBOOT.elf "24 13 BC C5 F6 00 33 00 00 00 35" "24 13 BC C5 F6 00 33 00 00 00 34"

we get the fw check edited from 3550 to 3450! can you tweak it so we can get 3400?
_

[deank]

There is no way such thing can happen. The value you change is part of a data structure (magic id 0x13BCC5F6 where the SDK version is used as second field (not firmware revision).

So the values are always 00 34 00 01 or 00 35 00 01 or 00 36 00 01 ... 00 40 00 01...

sys_process_param_t structure:
00 00 00 24 ->	uint32_t size;
13 BC C5 F6 ->	uint32_t magic;
00 33 00 00 ->	uint32_t version; (of sys_proc_param structure)
00 34 00 01 ->	uint32_t sdk_version;
.. .. .. .. ->	int32_t primary_prio;
.. .. .. .. ->	uint32_t primary_stacksize;
.. .. .. .. ->	uint32_t malloc_pagesize;
.. .. .. .. ->	uint32_t ppc_seg;
.. .. .. .. ->	uint32_t crash_dump_param_addr;

[aldostools]

removed post

[deank]

Yes, actually scetool reports the address of that section in the Program Headers, so there is no need to search:

scetool -i EBOOT.BIN
...[*] ELF64 Program Headers:
... (some LOAD/TLS/PRX and the one you need -> PARAMS)
 006 PARAMS   0018D500 0019D500 0019D500 00000028 00000028 --- --- --- 00000008
...

In the example above at offset 0x18D500 of the extracted ELF you find the structure (00 00 00 24 13 BC C5 F6 ...).

The search/replace is done additionally for:
24 13 BC C5 F6 00 00 90 00 00 xx ?? --> 24 13 BC C5 F6 00 00 90 00 00 34 00

There are 4 sys_proc_param_versions:

00 00 00 01
00 00 84 00
00 00 90 00 (you covered that one)
00 33 00 00 (and that one, too)

[aldostools]

removed post

[catalinnc]

@deank thanks for the info...

@aldostools thanks for the new version of scetool_0.2.8_bruteforce...it finally works for me (i am on win xp sp3 uptodate)...

i did a run test with a self with klic=00000000000000000000000000000000

and i found that bruteforce+scetool found the key instant but bruteforce+testklic did not found it!!! (is listed first in tried_keys file)...may be something wrong with testklic and its .ps3 keys?
_

L.E. one klic i found myself:

1193590B4DDE4F5B8E44F5F14877D0B6 Assassins Creed Brotherhood [BLES00909] [NPUB30522]
_

[aldostools]

removed post