Dongless Cobra CFW arrives.. Cobra 7.00 (unofficial ) · Dongless Cobra CFW arrives.. Cobra 7.00 (unofficial ) Written by STLcards Sunday, 03 November 2013 19:51 - Last Updated Sunday,

Dongless Cobra CFW arrives.. Cobra 7.00 (unofficial )

Written by STLcardsSunday, 03 November 2013 19:51 - Last Updated Sunday, 03 November 2013 20:52

Here is some great news for Custom Firmware users on the PS3. You may remember backsome weeks ago, when i made a simple request to CobraODE Support to release the CobraUSB source, so the community can benefit from it and to my complete shock they released thesource. Well the Lead Developer of Cobra USB has now released a Cleaner version of theSource Code and also implement Cobra into Rogero v4.46 v1.00 CFW, and also added tons ofinformation for developers

The Lead Developer of Cobra USB states this is an unofficial release from not from Cobra andjust a personal release from himself, as he was not contacted before the source was released.So in this release he removed all the security features, so that developers could just see thegoodies in cobra and not all the security layers. So here you go a DONGLE-LESS Cobra CFW, Checkout all the details and ALWAYS REMEMBER, USE ANY CFW AT YOUR OWN RISK.DashHacks is not responsible for any damages .

1 / 10



Unofficial COBRA 7.00 - w/ Cobra-Rogero 4.46 CFW by Lead CobraUSB Developer

Hello, I'm Cobra USB main developer. First of all, this is an unofficial personal release from me,and not something from Team Cobra. Don't contact them for anything related with this release. Second, no, no USB reqired, it can be used by anyone on any hackable ps3. That's why Icalled this mess of a release COBRA 7.00 and not Cobra USB 7.00.

Why this release?

Mainly because I can't stand things not done properly. The original source code of Cobra USB5.X was released, and yes, all PS3 functionality is there, but also a lot of unnecesary things. Had I been contacted before the release of the source code, I would have prepared somethingbetter. And rather than seeing someone coming with a bad or incomplete release of a CFW or payloadusing the source, I prefer to lead the way with a first clean release. I don't think I will do anyother.

Second, I wanted to have in a CFW both the functionality of Cobra and a regular CFW, andwithout that slow device delaying each lv2 boot by several seconds, which caused some sideeffects in version 6.00 (4.30) on pads, and that I had to fix with one of those uglyhacks/incomplete workarounds that I tend to hate.

Lastly, but no less, I was bored, lot of free time lately, that kills your brains...

WHAT IS COBRA 7.00

2 / 10



What is not? COBRA 7.00 is not a CFW "per se". COBRA 7.00 is a set of 7 files: lv2_kernel.self, ps2_emu.self, ps2_gxemu.self,ps2_netemu.self, stage2.bin, ps2hwemu_stage2.bin and ps2gxemu_stage2.bin, from those 7,the first 4 are mix of 4.46 CEX OFW files and COBRA code, the others being new and notpresent in OFW.

Those 7 files are expected to be mixed with existing regular 4.46 CEX based (totally CEX)CFW, to make a CFW that would mainly mix the functionality of both, except for any thing thatthe regular CFW may do in lv2_kernel. About "theoretical" compatibility, check the readme in BIN/CFW_BUILDS. Theoretical becauseonly one has been tested. This is, Rogero 4.46 1.00. A sample PUP of mix of COBRA 7.00 and Rogero 4.46 1.00 is there as well. Mainly includedfor convenience, for having something end-user friendly. This CFW has been tested by me on three very different models, a CECHA, a CECHC, and aSLIM. But because it has only been tested by a single person, caution is to be expected. You are theonly responsable of what you install in your machine.

Additionally, there are other parts, like netiso.sprx or cobralib, that are not technically part ofCOBRA 7.00. They are things expected to be used by managers. No real change was done to them, just removed something unnecessary in netiso.

There are also some PC tools, the only one relevant to users being ps3netsrv, which has beenupdated with a new feature (see CHANGELOG). Although there is no manager that uses that feature atm of writing this.

The source code of components is in SRC folder. The main components of Cobra expect thetoolchain found at BSC page, with gcc 4.1.1.http://www.bsc.es/projects/deepcompu...K-Open-Fedora/ -> install all ppu* files for your

architecture.

Extra things expect either Sony SDK or psl1ght. PC tools expect gcc. Some of the tools may not compile under mingw32 or won't work in win32.Some tool could give compilation warnings in 32 bits systems, not compile or binary may notwork, this wasn't tested. (watch out ps2netemu_gen446)

WHY 4.46 AND NOT 4.50

1) I had already most symbols from 4.46 from some time ago, lazyness.2) Because there was no good reason to update to 4.50. COBRA does the sfo version patch

and sdk version patch on RAM, games for 4.50 are expected to work without changes.3) Because new versions of 4.46 CFW's are unlikely to appear, then current release would

support almost all of them. Minimal modification on some files causes COBRA not to detectsome modules, see the readme in BIN/CFW_BUILDS.4) An OFW bug causes pad synchronization problems when playing PS2 games in

3 / 10

http://www.bsc.es/projects/deepcompu...K-Open-Fedora/



CECHA/CECHB in 4.50. I didn't want this one to be endorsed to me.

INSTRUCTIONS

Install a 4.46 CEX cfw mixed with the 7 files of COBRA 7.00. A sample of a mix of Rogero 4.46 1.00 and Cobra is provided in BIN/CFW_BUILDS/ Check the txt there for compatibility with other cfw.

Install mmCM_04.18.pkg, which has been included here for convenience (it has only beenrepackaged to avoid version error with multiman). This won't delete your current version of multiman (if any), it will instead add mmCM to it. After installation of this package, multiman can run in two modes, "multiman" and "mmCM", bydefault it will run in "mmCM" mode under Cobra. Check CHANGELOW below about how to force COBRA 7.00 to run multiman in "multimanmode", this only makes sense if you installed both, mutiman and mmCM.

CHANGELOG

Changes from Cobra USB 6.0->COBRA 7.0:

Cobra USB device related functions removed. Syscall sys_cobra_usb_command is still therefor compatibility reasons, but it will do nothing.

Code cleared from encrypted functions, data and other security measures like therandomization of data or code not longer needed. Stage 1.5 removed from both, lv2 and ps2emu. There is still a stage 1.5 lan -compiles asstage2.bin-, but that is for developers only. Stage 1 security garbage removed, now the code can be easily understood Support for cobra encrypted sprx/self is still kept for compatibility reasons, but security thatwould protect them from easy methods of dumping has been removed. drm.c file is still kept for compatibility with already existing compiled versions of netiso.sprxused by mmcm.

(Dirty patch improved) Text section of vsh.self was made writable by a patch. This indeed made the memory writable by direct access, but functions like copy_to_user orcopy_to_process would still think the section was read only. The patch has been replaced with a better one that fixes this issue.

PSP mode selection will not longer take effect. Although it was not told to user at that moment,mode 2 made Cobra to use the psp emulator taken from 4.00 OFW (decrypted long ago beforekeys were released, with a lv2 kernel exploit I discovered) and hidden in the last version of psplauncher. This made sense for 3.55, since the compatibility of both emu was different (including some

4 / 10



regressions in 4.00), but it doesn't makes sense to use 4.00 emulator now. Maybe it would be a better idea to package the 3.55 one, but not done. Technical details: cobra syscall sys_psp_set_emu_path will return success, but it will donothing.

Support for PS2 isos in non BC consoles was removed in 4.30, due to ps2_softemu missing. Ithas been reenabled now by hacking of ps2_netemu. You can use it in the same way as before, just load an iso and launch from disc icon, Cobracore takes care of rest. No need for encrypted isos, isos patched with limg sectors, etc. Just your normal PS2 isosdumped from discs or taken from somewhere. However, there is no support for optical discs in ps2_netemu. Don't forget to set the memorycards in XMB, in the old memmory card utility for PS/PS2, as ps2_netemu won't let you assignthem in game. BC consoles will still use their respetive emulators (ps2_emu, ps2_gxemu), which have muchbetter compatibilty and also support optical discs, original or backup.

Support for setting fake version was removed in 4.30, since it was permenanetly faked as 4.31.It has been readded, but it will need update on mmcm to use that again.

Cobra USB read its configuration from spi flash. COBRA 7.00 reads it from"/dev_hdd0/vm/cobra_cfg.bin". When no setting has ever been written, the file will not exist and configuration will have defaultvalues. Due to the different timing in which Cobra USB and COBRA 7.00 read the configuration,some others changes in code were needed.

Added partial emulation of READ TRACK INFORMATION command and updated the READTOC/PMA/ATIP and READ CD commands partial emulation (LV2 only). This fixes a bug when playing CDDA tracks of psx/ps2 bin/cue images in the XMB player. Thisdidn't happen in 3.55, but Sony changed the code of the audio player at some point after that.

The patches to force XMB load psp launcher, which is a total invalid psp mini package, hadsome side effects on DRM content, such as ps2 classics. Now the patches are only done after loading a psp iso, and they will be undone once themanager unloads the psp iso. Note to users: Don't run any DRM content while there is a psp iso loaded (psp launcher iconnot black), it may not work and it may cause the XMB to delete the rif data!

Added support for plugins at boot time. The number of vsh plugins has been increased from 1to 7. Slot 0 is reserved for use for iso plugins (netiso.sprx and rawseciso.sprx). Slots 1-6 are for boot plugins. Plugins are loaded in the following way: text file /dev_hdd0/boot_plugins.txt shall contain aplugin path per line. Some currently developed plugins like the test one from prxloader don't work (they actuallyload, but don't work), because they expect that network is already prepared, which is not thecase at boot time.

5 / 10



Note for plugin developers: when making a boot plugin for Cobra, if your plugin requiressomething that is not up yet (like network), just do some waiting at main thread (NEVER inmodule start, or you'll delay the whole system!), 3 seconds should be enough. Or just check that network is ready, which is the proper way.

Because of the posibility of a boot plugin crashing the system and causing a pseudo-brickexists, a safety system has been designed: Enter ps3 recovery mode and select the option "Rebuild database". The recovery process,emer_init.self, will mount dev_hdd0 for a short moment, Cobra core will detect that and it willdelete boot_plugins.txt. Cobra core won't load vsh plugins when there is not VSH: like for example, in recovery andupdate modes.

Note to developers: please design plugins in such a way that they can be unloaded and theyfree all resources when that happens. A sample boot plugin called "testplugin.sprx" is included here. It is a simple plugin that willpoweroff the ps3 when L3+R2+X is pressed, or reboot it if L3+R2+O. Plugin uses an internal vsh function, which does a clean powerroff/reboot, unlike directly callingsys_sm_shutdown. If you are in a game, enter PS menu to make the combination work.

Added peek, poke, lv1_peek (partial, continue reading), lv1_poke and lv1 call syscalls. Cobra core wasn't originally developed to coexist with other payloads. As soon as I enabled allthese syscalls, a lot of incompatibility problems and payloads and applications destroying somepatches that Cobra needs, happened. So I decided to add a compatibility layer. This is, a custom implementation of all of thesesyscalls, where Cobra core detects the most common problems. For example, Iris Manager would temporally load its syscall8, removing the Cobra one. Cobracore is now aware of this, and instead of letting Iris Manager change the syscall address, itconcatenates both syscalls: cobra syscall 8 will call Iris syscall 8 when the opcode is not forCobra. That was just one of the incompatibilities. Some other incompatibilities have been resolved forthe following 3 programs: Iris Manager, Multiman (in multiman mode, see below), and vsh prxloader. The relevant parts of the compatibility layer are in stage2/main.c I didn't test all features of those programs, therefore, it is possible that something in themcauses problem to Cobra core or that Cobra core causes problems to them. If you see something odd happening, just reboot the ps3.

After installation of mmCM over Multiman, Multiman will have two modes: "Multiman" and"mmCM". The first one for regular cfw, the second one for cobra cfw. Multiman detects which cfw is in,and loads the proper self. Now the problem: when I enabled those syscalls, multiman thought it was in a regular cfw andwouldn't launch mmcm. So I made a workaround: if multiman is launched from its original location,

6 / 10



/dev_hdd0/game/BLES80608/USRDIR/EBOOT.BIN, cobra will block lv2_peek access for theprocess, to force multiman detect Cobra. Now, because I also wanted to have a way of launching multiman in its normal mode, there aretwo ways: 1) Install multiman in a different location (untested). Then, BLES80608 would be mmCM, andthe other would be multiman. 2) If L2+cross is kept pressed while launching multiman from BLES80608, Cobra won't blockaccess to lv2_peek, and multiman will load in "multiman mode". The relevant parts of the code for this are in stage2/modulespatch.c

lv1_peek syscall VS Cobra syscall 8. Because lv1_peek syscall in lv2 is also syscall 8, the support of Cobra for lv1_peek is partial. If the address queried is >= 0xA000, Cobra core will do a normal lv1_peek. If its below 0xA000,it will run the specific cobra sub syscall. Now, this would still cause problems, as some programs -lv1 dumpers- would soon or latercrash the system while dumping 0-0xA000, by accidentally calling a Cobra subsyscall. Cobra core is now aware of this and will temporally block a process from using syscall 8 if itdetects it is a possible lv1 dumper, only until some condition is met (like reading from >=0xA000).

For developers, a proper way to guess if you are in a Cobra cfw is this (if my memory doesn'tfail me, this piece of code would work even in Cobra USB 1.0!)

Code: static inline int sys_get_version(uint32_t *version) { system_call_2(8,SYSCALL8_OPCODE_GET_VERSION, (uint64_t)(uint32_t)version); return (int)p1; } intam_i_in_cobra(void) { uint32_t version = 0x99999999; if (sys_get_version(&version) < 0) return 0; if (version != 0x99999999) // If value changed, it is cobra return 1; return 0; }

(Other code changes) SELF/SPRX patch offsets are now in modulespatch.h instead of modulespatch.c. Also, theself/sprx offsets in storage_ext.c (video mode patch) and psp.c has been moved as well to thatfile. There shouldn't be any self/sprx offset/address left that is not in modulespatch.h. config.ps2softemu set value ignored now. Cobra will always do those patches in non BCconsoles. Added cobra syscall sys_sm_ext_send_poweroff_event, which allows Cobra to send apoweroff/reboot event to VSH (cleaner poweroff than sys_sm_shutdown). Usage is simple: syscall8(SYSCALL8_OPCODE_SEND_POWEROFF_EVENT,reboot_boolean); Now pad can be read from kernel mode (lv2/pad.h) "laboratory.c/h": File unused in compiled version of stage2. It is there just in case someonewants to do tests...

EXTRA things

7 / 10



ps3netserver, the pc server for netiso.sprx, has been updated with support of games injailbreak directory format, so it is not longer restricted to isos. Bad thing is that there is currently no program using this feature, just wait for someone to do it.

For developers, usage of this new feature is amazingly easy, as it is all done at server side. Nonew opcode added, no change of netiso.sprx was needed at all. If in the remote server you have a game in jailbreak directory format whose path is"/GAMES/BLES00635", just pass this path to netiso.sprx instead:/***PS3***/GAMES/BLES00635" And thats it. Upon receiving the open command from netiso, the server will understand thepath, and it will create a "virtual iso", this is, it will scan the directory /GAMES/BLES00635, and itwill build in RAM the structure of the iso9660 and joliet filesystems. For the client side, the folder would be just like another PS3 iso file.

For no-ps3 content, you can use "/***DVD***/". For example, for remote PC directory"/my_dvd_video", just pass "/***DVD***/my_dvd_video". Note that no UDF FS is created, therefore this woudn't be apropiated for blu ray video contentiirc.

Limitations:

1) if the folder has way too many files, the server will need sometime to scan the full content andbuild the virtual iso. The time is only proportional to the number of directories and files, not the actual size of thegame. You should be aware of this, and that netiso may take its time in mounting the game in thosecases.2) Only the open command is aware of /***PS3***/ and /***DVD***/. All other commands that

pass a path are not. That includes the stat command, which would be the only other one thatmakes sense to have this for.

ntfs_ext_iso.self and rawseciso.sprx

Recently developer Estwald ported libntfs to the ps3 (good job!). Inmediatelly, it came to mymind, that mixing that and Cobra sys_storage_ext_mount_discfile_proxy would lead toinmediate support of ps3, psx, dvd and bd isos in ntfs volumes. libntfs_ext was modified to add a new function "ps3ntfs_file_to_sectors". This function willlocate all the sectors sections ("parts") of a file in the disk. The modified source code of libtntfs_ext is at /SRC/EXTRA/libntfs_ext. Changes are explainedin "Changes (COBRA).txt"

ntfs_ext_iso is a program that is expected to be launched by another program, it is not astandalone program, it doesn't show any gui (it only prints to stdout), you will have to wait forsomeone to make such app.

8 / 10



ntfs_ext_iso expects three params (third is optional): 1) path of iso within the ntfs volume. 2)One of "EMU_PS3", "EMU_PSX", "EMU_BD", "EMU_DVD". 3) An optional cue path for psxgames. If no cue is passed for psx game or if cue can't be parsed, a single data track isassumed.

Example usages:

Code: char *argv[3]; argv[0] = malloc(N); strcpy(argv[0], "/******/tequen6.iso"); argv[1] =malloc(8); strcpy(argv[1], "EMU_PS3"); argv[2] = NULL; sysProcessExitSpawn2(ntfs_ext_iso_self_path, (const char**) argv, NULL, NULL, 0, 1001,SYS_PROCESS_SPAWN_STACK_SIZE_1M); char *argv[4]; argv[0] = malloc(N); strcpy(argv[0], "/PSXISO/Last Fantasy VII.bin"); argv[1] = malloc(8); strcpy(argv[1],"EMU_PSX"); argv[2] = malloc(N); strcpy(argv[2], "/PSXISO/Last Fantasy VII.cue"); argv[3] =NULL; sysProcessExitSpawn2(ntfs_ext_iso_self_path, (const char**) argv, NULL, NULL, 0,1001, SYS_PROCESS_SPAWN_STACK_SIZE_1M);

rawseciso.sprx file must be put in same directory that ntfs_ext_iso.self

Explanation of how it works: using the modified libntfs_ext, the program will scan all usbdevices. When a ntfs volume is found, it will check if the iso file exists, and get all disk sectorregions of it. It will pass these regions to the iso vsh plugin rawseciso.sprx. rawseciso.sprx will use Cobra sys_storage_ext_mount_discfile_proxy functions to request thatall disc reads are passed to it. rawseciso.sprx will feed the kernel with the iso data by rawly accesing the external storagedevice. rawseciso.sprx itself is totally fs-agnostic, it just reads raw sectors. It is ntfs_ext_iso.self whichtells him where the iso file is.

Limitations: although libntfs_ext supports ext2/3/4 partitions, I only added the file_to_sectorsfunctions to the ntfs code, so this won't work on said partitions. If the file has more than 8188 fragments (that's a heavy fragmentation), this thing won't work.Defragment the file or the whole partition in those cases. Drives with more than 2TB: if the parts of the files goes over 2TB offset, this won't work. rawseciso is not optimized, maybe it would have been a better idea to implement it in core, but Ididn't plan this feature at the beginning, it was just a test.

KNOWN PROBLEMS

The PSX video problem. When the psx emulator is launched "naturally" by vsh.self, it sets thevideo mode parameters. This would cause NTSC games work badly on PAL, and viceversa. But COBRA does a patch to avoid that, by forcing the video mode to be the same of the current

9 / 10



psx game. Now the problem: in 3.55 this worked OK for everyone. But in 4.30, a tester andsome users reported problems. The patch still works for me though. The tester and me had same ps3 models, I used hisxRegistry.sys file for testing, and yet I couldn't reproduce the issue. Only thing different was theTV... Homebrew that launch directly PSX games don't suffer this problem, because this problem iscaused by vsh. But mmCM returns to XMB after mounting a PSX iso game.

Sometimes, PSX CD-R and PS2 CD-R/DVD+-R are not detected by Cobra. This happensmainly on bad media and bad drives. Try to reboot with the disc inside, it may be detected.

Download: Cobra 7.00 (Includes Rogero/Cobra PUP / Cleaned CobraUSB Source Code)MD5: F3254148447185B19F06DEC1A0BE00F0 / PUP MD5: D6721344ED0CDC2E8A054A68B7EBC365

Source: tortuga-cove

USE AT YOUR OWN RISK, Always use caution when installing any CFW. If you can notrecover from a brick its best to see reports before you blindly install.

10 / 10

http://www.sendspace.com/file/kh07bp

http://www.tortuga-cove.com/forums/viewtopic.php?f=129&t=5663&sid=18d48d68da899c931ad40a48318908be

Documents

Dongless Cobra CFW arrives.. Cobra 7.00 (unofficial ) · Dongless Cobra CFW arrives.. Cobra 7.00 (unofficial ) Written by STLcards Sunday, 03 November 2013 19:51 - Last Updated Sunday,