Following up on his PS3 Disc Key Dumper, Klicensee Dumper and Secure File ID Dumper and PS3 eEID RKDumper, today PlayStation 3 hacker Flat_z has released an EID Root Key Dumper for PS3 4.50 CFW alongside Dump_EEID and Flash_EEID (NOR and NAND) by zecoxao and sguerrini97 with details below.
Download: UP0001-FLTZ00010_00-ERKDUMPER0000000.pkg / EID Root Key Dumper for PS3 4.50 CFW (Updated) / flatz_stuff.7z / erkdumper_spu.7z / eid_root_key dumper (4.46.pkg) / rootkey_446.zip (Source) / 446_usb.pkg / eid_root_key dumper (4.50.pkg) / eid_root_key dumper (4.53.pkg) / rootkey_453.zip (Source) / eid_root_key dumper (4.21.pkg) / rootkey_421.zip (Source) / eid_root_key dumper (4.65.pkg) / rootkey_465.zip / erkdumper_new.7z / rootkey_pack.7z by zecoxao / rootkey_421.zip by haxxxen / rootkey_466.rar by flatz via Fnon / 3.55_DEX_checkoff.rar via ruroni / EID_Root_Key_Dumper_for_470.port_by_Joonie.v1.0.pk g / SRC_022515_rootkey_470.rar / eid_root_key_dumper_470dex.v1.0.pkg (EID Root Key Dumper for 4.70D / eid_root_key_dumper_470dex.pkg (Mirror) / rootkey_470dex.zip by Joonie
For those unaware, eid_root_key is needed for these tasks:
- View & Copy PS3 Internal HDD on a PC
- CEX to DEX conversion
- Obtaining Drive keys to use with an ODE
How to use EID Root Key Dumper:
- Install package and run it
- The utility will then black screen (no GUI) and restart the console automatically
- Now in a File Manager or FTP retreive your eid_root_key in /dev_hdd0/game/FLTZ00010/USRDIR/...
To quote: Simply install pkg on 4.50 (CEX) CFW and run and your PS3 will beep 3 times and restart.
Find your root key in dev_hdd0/GAME/FLTZ00010/USRDIR
Tested & working by me
This is only for 4.50 (CEX)CFW
Update: Here is a small update which prevents displaying of warning message after reboot.
From aldostools: Beside the features mentioned by harryoke, this tool let you get the "eid_root_key" of your PS3.
The "eid_root_key" is needed if you plan to convert your PS3 from retail (CEX) to debug (DEX).
You will also need the "eid_root_key" to be able to read the content of your PS3 HDD on the PC (eg. to recover some files if your PS3 doesn't turn on).
If you want to get the key of your Blueray Drive to use an ODE device, the "eid_root_key" is needed too.
Before this release for CFW 4.50 (CEX), it was only possible on CFW 3.55 GameOS or through a tedious process using OtherOS.
On a side note: I released this PS3 HDD Hex Viewer (aldostools.org/temp/ps3_hdd_hexviewer.rar) based on a new version of 3141card's ps3 hdd tool with debug function.. this tool also requires the "eid_root_key".
As promised, you version with debug function.
ps3 hdd print <sector number> (show a sector in a simply hex-view)
[Register or Login to view code]
ps3 hdd dump <start sector> <sector count> <dump file name> (self-explaining)
Linked above are flat_z's sources (via zecoxao) with the IRC log below as follows:
[22:33:57] flatz: share this with the community
[22:34:31] flatz: it contains all my dumpers, two payload frameworks and linux syscon stuff
From zecoxao (via THIS update) on eid_root_key dumper 4.46 (linked above): I'll now take care of 4.53
U'll now take care of 4.53
I couldn't do this without the help of haxxen, playerkp420, harryoke and flatz. Props to them for the help and testing.
4.53, confirmed working: https://dl.dropboxusercontent.com/u/...30/pkg/453.pkg
PKG and source for 4.21:
If you guys want to help me with 4.65, just port symbols.h and i'll take care of the rest
Just a warning. in case you haven't noticed, i left a readme in each of the source links i distributed. That readme explains how to port to the different firmwares. once you follow it it'll work for other firmwares such as 4.65 or even a dex firmware like 4.46 DEX.
Just ported to 4.65:
I'm done porting. you can get through this yourselves Also, cobra might interfere. don't use it
Could you pack them all together, with sources, as soon you finished porting?
Yes, i can sinsizer. i'm done porting.
To dump to /dev_usb000/ : pastie.org/private/n8hxkaikdpiihljfluenw
From haxxxen: The built pkg for 4.21 does not work, that i can confirm. thus i have made new ones for cex and dex kernel.
Dump_EEID and Flash_EEID (NOR and NAND) by zecoxao and sguerrini97
Dump_eeid dumps eeid to a file called eeid.bin (if there's a usb stick in the ps3 it'll copy from the hdd to there, if not it'll stay in the hdd). Flash_eeid flashes a file called eeid.bin (the eEID) to your flash. The code is universal, meaning it works in any mfw with enough permissions.
BRICK RISK WARNING WITH FLASH_EEID! BE CAREFUL!
It says BUILD_4.46 but the packages are universal.. be free to test on any mfw and see for yourself. NOR and NAND supported.
I forgot to mention that without sguerrini's help i wouldn't have gotten very far. kudos to him
Props to glevand for the original sources. Kudos to the authors of PSL1GHT for making such a great working environment. Props also to 3141card for finding the right offsets and sizes of eeid (3 simple rule )
From Fnon: eid_root_key dumper (4.66) by Flatz (linked above)
eid_root_key dumper ported for the latest normal custom firmwares (4.66). Tested and working on CECH-2008A, CEH-A01, CECH-B01, PS3 consoles. Thanks a bunch to Flatz for making it possible.
Finally, Joonie has updated EID Root Key Dumper ported for CFW 4.70 (linked above).
How to port Eid root key dumper
It was already written in readme, but it took me a while to learn how to port it , so I added a little detail and added extra batch for bin2c, hope this helped for other people who are interested in learning how to.
1. Tools required
- PS3 SDK
- msys and minGW -- available via mingw.org/wiki/msys
- gcc ppu tool chain
- Lv2 kernel dumps/ lv1 kernel dumps (use multiMAN or REBUG TOOLBOX to obtain them)
- Hex editor -- available via mh-nexus.de/en/hxd/
- Getsymbol -- available via ps3tools.aldostools.org
- IDA Pro (both Getsymbol and IDA Pro are optional but recommended)
2. Files needed to port/edit for different FW version
The most work needs done in payload, You need to find and compare offsets in LV2 dumps between older / newer versions, and source folder does not need much changes unless LV1 is different
dumper.c was supposed to be done from SPU project, but it seems like not needed so far, it worked with original file.
3. Files needed compiled and HOW-TO
- payload.bin from payload folder
- payload.shellcode.inc from source folder (converted c code from payload.bin, use my batch for bin2c after compile payload.bin from payload folder) and then build source to compile EBOOT.ELF/self. Then launch build.bat from main folder it will look for eboot.elf from source folder to generate EBOOT.BIN. Don't forget to edit build.sh to change app version 4.65/4.66/4.70 and etc)
- Edit PARAM.SFO and build pkg with EBOOT.BIN
4. Install PKG and run it
More PlayStation 3 News...