I tried to play Skyrim, I really did! However I just couldnt get into it because I am an RPG horder. I grab everything and anything that is not nailed down. I saw this video and laughed pretty hard.

After having it for a while I am going to do a review of Google’s development phone the Nexus S 4G from Sprint.

I nabbed one of these puppies off of ebay in December for about $175USD and the phone itself is worth much more. The hardware in this phone almost makes it a miniature tablet with a 4″ curved glass AMOLED touch screen and its 1GHz  Hummingbird ARM7 processor. The phone has 16Gb of built in flash storage although about 13 is available to the user. Two cameras on the phone, the back being 5 megapixels and the front being .3 megapixels. The device itself is very sleek and thin though it can take a fall. Reported its battery can only hold a 6Hr charge although through flashing it can go longer. It comes shipped with Android 2.3 although it has the capability of using 4.0 Google has yet to release the official update.

The Goods:

4″ AMOLED Touch screen

1GHz  Processor

2 Cameras

Development phone

The cons:

No MicroSD card slot. (No you cannot expand the memory of this phone.)

WiMax 4G

No Android 4.0 on ship.

All in all, I would surly  recommend this phone to anyone who is looking for a good android powered phone. It is powerful, sleek, and is not riddled with manufacture bloatware.

Rating: 9.7/10

For awhile now I have been wanting to do video tutorials on console modification, well now I can. So without further ado I give you my tutorial on moding the Playstation 3

Please give feedback. (Also The video is being re-encoded to be the correct orientation please bare with me.)

The PS Vita is dead.

Thanks for reading Gamingghouls.com

What you want more?

Fine I’ll put this in simple terms everyone can understand.

Call me an XBot or fanboy, I was a loyal Sony supporter since PlayStation 1. They have lost their way with since PlayStation 2 in more ways than I care to mention (if you want to get into the nitty gritty add me on twitter @gamingghouls)

It’s beautiful looking, it’s got HUGE potential to be a game changer in the handheld market but it is dead!

The hardware is overprcied

The SDK (Software development kit) is over priced

The 3g version is probably going to be killed in North America, and its terribly restrictive if it does arrive

Sony still needs an “App” store

Sony refuses to listen to its own customers

Sony has a history of bad handheld support with the PSP

1 PSN account on the Vita

No way to transfer your PSP games free of charge

Limited internal storage

Internet required to update, failure to update locks out all data

Expensive proprietary memorystick

Sincerly Demonicmember, Psychic Tech Analyist

Regular readers of this blog will know that I have been excited about this phone ever since I found out it was going to be available in my region. I went so far as to try and cancel my account early and pay the fee just to get the phone. However in the end after a bunch of misinformation and hoop jumping I was able to get this phone from my current provider Rogers, tho I’m not sure I would recommend them to anyone else after my most recent interaction.

Now you may be asking yourself, why all the fuss over a phone? Why is it so special? I like toys!

This phone will run you on Rogers with a 3 year plan $179.99 or $649.99 with no term contract, that is after the $50 (yet another hoop!) mail in rebate, and $35 account/activation management fee.

Now to understand why I have been so excited about this phone you have to know the history of my last few phones. My most recent phone before this was a Apple iPhone 3gs running iOS 3 thru 5, which I bought to jailbreak and run some NES emulators on it between bus transfers on the way to work. Prior to that I had a Samsung Black Jack 2 running Windows mobile, it was purchased so I could stream shoutcast radio while on the go. Anything prior to that is so antiquated we shouldn’t even mention them.

Lets discuss the phone itself:

The Specific Model is SGH-1727R it comes pre-loaded with the Android 2.3.5 Gingerbread, and is slated to receive Ice Cream Sandwich later.

Dual Core 1.5GHz Processor, 1 Gigabyte RAM, 8MP Camera with flash, a 2MP Front Facing Camera, HD Video Recording and playback, GPS, 16 Gigabyte memory expandable with upto 32 Gigabyte Micro SD card, and a 4.5” Super AMOLED Plus display

Now after a week using it I like this phone, but it is not without its faults, from a physical standpoint using the screen with one hand does pose some difficulty for all options, the screen is just too big to navigate without difficulty (tho NBA players will probably not have a problem). The speaker phone leaves a lot to be desired, at high volumes it is distorted. Tthe few times I have attempted to use speakerphone the person on the other end had quality issues, which is a big negative for me as I use it frequently. I also noticed a few times the need to reboot the device in order to use data, can’t quite figure out whats causing it to stop functioning. To get data to work at all in the beginning I had to change a setting in the phone for data to function on Rogers regular network because LTE isn’t available in my neighbourhood, nor do I feel like paying extra for 75MB on a cellphone, utterly pointless for a mobile device.

What this phone does right is give you a beautiful coloured 400×800 pixel display encased in a very light weight form that is only 132 grams,  you will feel like you forgot to put it in your pocket. So powerful it allows Android to do what it was built to do, everything you want. It’s blazing fast from boot to power down, everything is responsive. The Android live wallpaper is a very nice feature, there are many options but I decided to go with the a weather one. At a glace of my phone I know what the weather is like outside, sunny, cloudy, wet or dry. I looked at my phone and thought the screen was messed up, it was just the live wallpaper showing me it was stormy outside.

To say I am not satisfied with this phone right now would be lying, it is not perfect but no gadget ever is, there is always something better or more shiny just around the corner or available for a few dollars more. Coming from an iPhone there have been some learning curves, like the first phone call I received I tried to tap the green button instead of swiping it. Nor have I rooted this device yet, and that is something I usually do when I first get it home. Custom roms are not available for it yet, as the hardware is different from most other phones out there, tho I suspect it will be developed for sooner rather than later. The specifications are just too good to ignore playing with it.

In conclusion, I would recommend this phone to anyone who wants a powerful device in their pocket able to handle just about anything you could throw at it. If your a bleeding edge, run custom hacks on it just because you can, pick up the Bell non-LTE version and root away and load your roms today, because waiting for tomorrow can be a very long time in the dead of winter in Canada.

Apparently Mathieulh was helping someone out and they decided to pay him back by releasing his Metldr exploit, and he is PISSED!

Because some ungrateful person leaked my metldr exploit files I will now be explaining how it actually works, see this as my ultimate release of all times for an ungrateful scene (and scenes in the future)

That’s about how I am pissed off right now, because of course the person that leaked these files has no idea of how they actually work.

How to pwn metldr the “easy” way: This is most likely how geohot exploited it in the first place, this takes (give or take) about 10 minutes to be performed. (yeah, not so much of a “I hacked the ps3 all on my own work”, especially not when it partially relies on Segher’s work, one of the reason geohot never shared the way he exploited metldr to anyone)

I will assume here, that you do not have the loader keys that were made readily available by geohot. This little tutorial also assumes that you have a working .self generating tool

Now You want to gain code execution to metldr, you know that metldr loads loaders to its own space, but you cannot run a loader because the loader needs to be signed and even though you know about the sign fail that Segher introduced at the CCC, you cannot use it because you don’t have decrypted signatures to calculate a private key and to get signatures you need keys which you are currently trying to dump, so far you are stuck in a chicken and egg scenario.

The question is, do you really need keys to get a decrypted signature ? Well the real answer is no, thanks to a nifty fail that sony left in in metldr (and the bootloader), you can have the ldr to decrypt the metadata for you, isn’t that neat ?

Here’s how it works:

STEP I)
In a self file, at address 0x0C a value is used to calculate where the metadata is going to be decrypted, the “offset” is at self header + 0x0C its the “meta header offset” in the SCE structure, it takes the SCE offset + that value, so what you have to do is to have a calculation that is equal to 0x3E01F0 which happens to be where metldr copies over the shared metadata from the mailbox (which is sent over by the ppu), the trick is to have metldr to decrypt the metadata located at. So basically you have to 1) set the offset += 0×2000 dump shared lsa and keep increasing 0×2000 until somewhere in the shared lsa changes 0×40 byte 2) when it changes 0×40 bytes, you can add/subtract the proper amount to make it decrypt the proper locations 3) then dump shared lsa and we have decrypted header knowing that metldr uses SCE header 0xECF0, you could calculate it knowing the address 0x3E01F0 – 0xECF0 = the value you would patch at SCE header + 0x0C

ROM:0000F6C0 D2 68 87 E6 metadata_erk: .int 0xD26887E6 ; DATA XREF: ROM:0000F178o for example in CECHA , the address you want to decrypt it to is 0x3E1F0 so it should be 0x3E1F0 – 0xF6C0
Once you get the decrypted header, you have the key to decrypt the rest of the metadata. Here you go, you have your decrypted signature.

So far so good, now what’s next ?

STEP II)

Contrary to popular beliefs, you do not need to know the public key to calculate the private key, you just need two decrypted signature, you now know how to dump these, so let’s assume you just did, now all you have to do is to bruteforce the curve type by constantly reloading a self to metldr, the curve type being only 1 byte, that would be 64 possibilities.

CONGRATULATION, you just signed a loader !

Now what ?

Well Your first reflex would be to sign a loader and use it to dump whatever is in your Isolated Local Store, the first thing you will notice is that you have a bit of metldr’s code as a leftover, after a few seconds of disassembly you will figure it’s actually some piece of code that clears metldr’s code and registers and jumps to some address which is matches your signed loader’s entrypoint.

This seems like a more than likely candidate to exploit, as in your goal would be to overwrite that piece of code with your own, that way you would have the whole metldr code right before the point where everything gets cleared out.

Let’s try to do just that, from your previous dump, you obviously know that the clear code is located from 0×400 to 0×630, (0×410 being where metldr jumps when it clears) your first attempt would naturally be to have a loader section to load at 0×400, well not so surprisingly, it fails, because you are not without a brain (at least you aren’t supposed to be if you’re reading and understanding this), you will assume that it is likely that metldr checks if you aren’t loading your loader/self section below a certain address, which considering you know the loaders’ entrypoint is most likely to be 0x12C00, this assumption is in fact correct as metldr will make sure you cannot load any loader at 0x12BFF and below, seems like a huge let down…

Well, maybe not, because yet again, you are not without a brain, you check out the hardware properties for the Local Store, and you find out that the memory wraps around (memory is a donut as someone once said at some ccc conference).

So what happens when you load your loader at let’s say from 0x3F000 to 0×40000+some address? (like 0×40410 for example) ?

Well, it WORKS! You could put the section at 0x3F000, if you made the length 0×1414 and the last instruction branches “up” to the dump code

ROM:000008AC 33 7F 6C 80 brsl lr, cleanup_and_jump_entry ROM:000008B0 32 00 11 80 br loc_93C ROM:00000410 cleanup_and_jump_entry: ; CODE XREF: main+4Cp ROM:00000410 32 7F FF 80 br sub_40C this is what the exploit that got leaked (yeah that’s not really their work eh but you figured that much by now did you not? ) does. It overwrites from 0×000 to 0×480 because I originally loaded the section o size 0×880 to 0x3FC00

So now you get code execution on metldr at the best time possible because your code executes right after metldr copies the root keys from 0×00 to 0×30, which means you get to dump these too. (Although they are hardcoded in metldr’s code anyway)
Here you go, you have a metldr dump !

Now as a final line, I’d like to say screw leakers, screw the scene, and this is my last contribution to it EVER. It seems I can’t even trust fellow developers to keep my work safe and not leaking it. (Not like any of them would have been able to tell you how all this even works in the first place)

So long, everyone. Remember, don’t ever bite the hands that feed you.

P.S. Oh! and btw, if you talented enough to make hardware to dump the shared lsa, you can decrypt any lv0 using this technique.

Now I do not claim to understand all of that, but what I do know is that if this actually opens up metldr we will have root control over the ps3 again, and shy of a hardware change, they will not be able to close it this time.

I have been looking forward to the Samsung Galaxy S2 LTE from Rogers since I found out about it.  I knew I was due for a my 24 month hardware renewal in November so I started poking around trying to find out the release date and how much it was going to cost me. Rogers was being quiet on the subject and sparse about the details.

I started poking around the other companies looked at Bell who had the S2 just not the LTE version. I called Rogers to inquire about cancelling my contract to go with Bell who had the phone I wanted, after lots of talk I was told (apparently insider information) the phone would be releasing in October on the 17th or 18th. You can read more about that conversation if you click here.

The 18th came and went, there was no phone. I had agreed to stay on as a customer until the end of the month. The 31st came and went, and there was no phone.

Finally on Thursday they posted the phone up on their website I called in to order one on Friday. “I’m sorry Sir, you cannot order your phone with us you have to go in to the store” WTF? Your a phone company and I  can’t call you to order a phone?

Ok, So the phone is available in stores now then? “Yes Sir, you can go in and pick it up in store now.” OK!

“Hi Welcome to Rogers, how can I help you?” I want a SSGS2 LTE! “I’m sorry Sir we don’t have those in the store yet, probably Monday”

Here we are Monday November 7th, 21 days after I was told it would launch, and and a few days since I was told I could get it in store immediately, and still nothing.

I call Rogers,  to cancel my account, I have had my limit of false promises and out right misinformation.

“Thank you for calling Rogers how can I help you” I would like client retention services please.

“No Problem Sir, can I ask why?” I would like to cancel my account and know the fees involved

“Ok Sir, The cost to cancel your account is…” This is client retention services?

“No sir I am trained to handle this call, I can answer your questions” I didn’t ask any questions I asked for client retention services so I Can file a complaint about an ongoing issue and cancel my account.

the representative went on again trying to answer the question I didn’t ask and refuses to send me to client retention services, so I ask for a Supervisor. I am placed on hold, 10minutes later, I am asked by her if I want to continue to hold. I told her I don’t have much of a choice if I want to speak to a supervisor now do I? 20minutes goes by before I finally speak to a supervisor.

He handles my call and tells me he has corrected the customer service rep to do as a customer requests when asking for specific departments, I thank him and we move on to my issue of cancelling my account.

He tells me he can find me a phone that I can pick up a few kilometres away from where I am if I still want it. I figure all this headache I might as well take him up on the offer and go get the phone from this other location.

I go I get the phone, I find out it’s not $199 its $249 with a mail in rebate, I don’t really care I’m charging it to my bill anyways I’ll deal with it at the end of the month.

Oh also there is a $35 administration fee for them to enter my account and scan a barcode off a box.

Then here comes the real piss off. “Sir you are renewing your agreement early, so there is a $90 fee.” I am shocked, I said for renewing like 1 week early you want me to pay $90? I thought like 20 tops.
Oh no…..

Apparently, the guy who sold me my last phone, who told me I can upgrade in 24 months, and the girl I spoke to at the store who told me I was due November (I think she said 22nd) were wrong. They decided to extend the length of a hardware renewal. Apparently a verbal contract is not binding to them and neither is a written contract, apparently they claim they can change these terms at any time and without need for my approval (I also believe that is wrong, I believe I have the right to refuse the new terms, but i need to investigate further) any time they wish, and without notice.

So the final total for everything was *drum roll*

Hardware Charge $249.99

Administration Fee $35.00

Early Upgrade Fee $90.00

Sales Tax $48.75

Total $423.74 minus $50 mail in rebate for a grand total off $373.74 + the cost of lube!

I was reasonably happy with the last 2 years of service I have had with Rogers, this interaction alone has sealed the deal for me with regard to future dealings.

Side note: THE PHONE IS AMAZING! More on that later.

The D.R.M. Fairy has paid yet another visit to consumers, this time in a change in policy from Sony and how many devices you are allowed to have software activated on. This new stance is a complete reversal on the policy Sony handed down by S.C.E.A. President Jack Tretton right before the Playstation 3 launch.

In this Wired article he says “You can send that content to four other friends for that initial investment,” said Tretton. “We want to get the game in as many hands as possible.” “It’s not about generating profits at each and every interaction with the consumer,” he said. “I think that really offsets the argument that says, ‘Wow, that’s a really pricey system.”

The Playstation blog

We’d like to inform you of some upcoming changes to the usage policies for PlayStation Network game content. As of November 18, 2011, the number of devices that can be activated on one PlayStation Network account for game content purchased from the PlayStation Store will be updated as follows:

For game content purchased after November 18, 2011, a new policy will apply and the number of devices that can be activated will be as follows:

• PS3: Users will be able to play the game on up to 2 activated PS3 systems.
• PSP: Users will be able to play the game on up to 2 activated PSP systems.

Please note that this update will not affect game content purchased before November 18. The PSP rights include PSP-1000/2000/3000 series as well as the PSPgo system.

PlayStation Network users are able to change the activation setting through each device, and Sony Computer Entertainment plans to provide a new PlayStation Network account management website where users will be able to deactivate particular devices attached to their PlayStation Network account via their PC.

In the end, those who are going to steal the software anyway have ways to do so and will continue to. Digital Rights Management is not going to stop this process it will generate more of it, making the process more complicated and involved will frustrate and annoy the consumer and push them to the free world of piracy. I mean if I am going to be jumping through hoops it might as well be free hoops right?

Source

I came across this little gem in a feed bposted by an rss bot I run on an IRC server, it is a parody about the medic role in Battlefield 3. It is possible to avoid the problem presented here in the video in Battlefield 3, it was a frequent problem in Battlefield 2.

Source

It does not tell us much, but the official announcement trailer for GTA V was released today by Rockstar Games and it appears we are heading back to San Andreas.

wf