Hey there.

So... you use an ad blocker. That's cool. Sometimes we do too.

But without ad revenue, we wouldn't even be here. And we might not be here much longer.

Please disable your ad blocker and click to continue.

Page 1 of 3 12 ... Last
  1. #1
    Mantagtj Guest

    PS3 LV2 Loader, METLDR, Application Keys and SHA1 Hashes!

    Today the PS3 LV2 Loader (lv2ldr), METLDR, Application / IV (initialization vector) keys and SHA1 hashes used to verify the keys have been publicly released by various PlayStation 3 developers. Below they are all listed, as follows:

    Fail0verflow released the SHA1 hashes of the different PS3 keys:

    http://pastie.org/private/0unla7m2kxdlehmepzkktw <-- sha1 hashes for some keys

    [Register or Login to view code]

    Mathieulh posted the PS3 LV2, PKGs, RVK, ISO, and Application keys (also crediting RichDevX, Graf_Chokolo, N_D_T, and TitanMKD) that can be used to decrypt via the PS3 SELF Crypto / PS3 SELF File Format and Decryption algorithm:

    PS3 0.80 / 3.15 Lv2ldr keys:

    erk: 94303F69513572AB5AE17C8C2A1839D2C24C28F65389D3BBB1 1894CE23E0798F
    riv: 9769BFD187B90990AE5FEA4E110B9CF5

    Decrypts all the External lv2 versions from pre 1.00 to anything below 3.40.

    PS3 3.40 / 3.41 lv2 keys:

    erk (12AB0): 57 5B 0A 6C 4B 4F 27 60 A0 3F E4 18 9E BA F4 D9 47 27 9F D9 82 B1 40 70 34 90 98 B0 8F F9 2C 10
    riv (12AD0): 41 1C B1 8F 46 0C E5 0C AF 2C 42 6D 8F 0D 93 C8

    PS3 0.80 / 3.15 Application loader keys:

    erk-315 79481839C406A632BDB4AC093D73D99AE1587F24CE7E69192C 1CD0010274A8AB
    riv-315 6F0F25E1C8C4B7AE70DF968B04521DDA

    erk 4F89BE98DDD43CAD343F5BA6B1A133B0A971566F770484AAC2 0B5DD1DC9FA06A
    riv 90C127A9B43BA9D8E89FE6529E25206F

    erk AAC20B5DD1DC9FA06A90C127A9B43BA9D8E89FE6529E25206F 8CA6905F46148D
    riv 7D8D84D2AFCEAE61B41E6750FC22EA43

    erk-080 95F50019E7A68E341FA72EFDF4D60ED376E25CF46BB48DFDD1 F080259DC93F04
    riv-080 4A0955D946DB70D691A640BB7FAECC4C

    erk D91166973979EA8694476B011AC62C7E9F37DA26DE1E5C2EE3 D66E42B8517085
    riv DC01280A6E46BC674B81A7E8801EBE6E

    erk F9EDD0301F770FABBA8863D9897F0FEA6551B09431F6131265 4E28F43533EA6B
    riv A551CCB4A42C37A734A2B4F9657D5540

    PS3 0.80 to 0.92 Revision 0 Application loader keys:

    erk-rev0 95F50019E7A68E341FA72EFDF4D60ED376E25CF46BB48DFDD1 F080259DC93F04
    riv-ev0 4A0955D946DB70D691A640BB7FAECC4C

    PS3 0.95 to 3.31 Revision 1 Application loader keys (from and in updaters):

    erk-rev1 79481839C406A632BDB4AC093D73D99AE1587F24CE7E69192C 1CD0010274A8AB
    riv-rev1 6F0F25E1C8C4B7AE70DF968B04521DDA

    PS3 Unknown keys, seem not to be in use:

    4F89BE98DDD43CAD343F5BA6B1A133B0A971566F770484AAC2 0B5DD1DC9FA06A
    riv-unk1 90C127A9B43BA9D8E89FE6529E25206F

    erk-unk2 AAC20B5DD1DC9FA06A90C127A9B43BA9D8E89FE6529E25206F 8CA6905F46148D
    riv-unk2 7D8D84D2AFCEAE61B41E6750FC22EA43

    erk-unk3 D91166973979EA8694476B011AC62C7E9F37DA26DE1E5C2EE3 D66E42B8517085
    riv-unk3 DC01280A6E46BC674B81A7E8801EBE6E

    erk-unk4 F9EDD0301F770FABBA8863D9897F0FEA6551B09431F6131265 4E28F43533EA6B
    riv-unk4 A551CCB4A42C37A734A2B4F9657D5540

    He also tweeted the following: In fact it decrypts most of the application selfs the 3.15 appldr key decrypts updaters too Looks like the isolated secure loaders aren't that secure anymore eh ? Looking for the curve list now. Ok so now if you can calculate K You'll also need to use a pre 3.40 lv2ldr but that's kinda obvious. By your lv2 I obviously mean custom firmware (for instance replace lv2_kernel) with a linux kernel. (of course you still need to flash it) Just one last thing, if you decrypt 2 lv2_kernel, you can calculate m then k, if you get k, and the keys I tweeted, you can have your lv2. btw those keys also happen to decrypt the ps2_emu binaries if anyone cares.

    P.S. The self revision is located at 0x00000009 in the self header, it defines the key set in use.

    GeoHot released the PS3 METLDR keys:

    PS3 3.41 METLDR keys:

    GG SONY!!!!!

    I'm in your console borrowing your metldr keys

    3.41 kernel keys as semi proof, more to come

    erk(12AB0): 57 5B 0A 6C 4B 4F 27 60 A0 3F E4 18 9E BA F4 D9 47 27 9F D9 82 B1 40 70 34 90 98 B0 8F F9 2C 10
    riv(12AD0): 41 1C B1 8F 46 0C E5 0C AF 2C 42 6D 8F 0D 93 C8

    Finally, GeoHot also shared geoldr, to quote:

    Happy New Year!

    Run this as a 2nd stage from metldr. Listen for mail

    As usual, there are no release dates ever. But pretty cool eh? It's a real loader.

    More PlayStation 3 News...

  2. #2
    boybergamo76 Guest
    there are the real keys? O___O

  3. #3
    brill Guest
    Quote Originally Posted by boybergamo76 View Post
    there are the real keys? O___O
    Nah, they are the hash signatures of the keys in hex form. I suppose to prove to everyone that they have them without actually releasing them.

    They seem to match the signatures of the publicly known ones (lv2 and pkg) Since they aren't salted I suppose it's feasible to run the ivs through a 0-9 A-F 16 byte rainbow table but I'm not so sure about the 64 byte key.

    Either way, anyone knowledgeable enough about this kind of stuff would just find it easier to grab the keys themselves using the techniques described during the conference rather than bruteforcing them from a SHA-1 signature which, funnily enough, would take a lot more effort and computing power.

  4. #4
    talruum Guest
    Geohot posted this right now
    GG SONY!!!!!

    I'm in your console borrowing your metldr keys

    3.41 kernel keys as semi proof, more to come
    erk(12AB0): 57 5B 0A 6C 4B 4F 27 60 A0 3F E4 18 9E BA F4 D9 47 27 9F D9 82 B1 40 70 34 90 98 B0 8F F9 2C 10
    riv(12AD0): 41 1C B1 8F 46 0C E5 0C AF 2C 42 6D 8F 0D 93 C8
    I'm quite almost sure that debug -> retail must be a metldr change... and we can't do that yet

  5. #5
    Ossi Guest
    here is the decrypted lv2_kernel.self from the 3.41 : http://www.ps4news.com/forums/attach...chmentid=27093

    I decrypted it with ooPo's PS3 SELF Decryption Code and the the keys by Geohot :

    [Register or Login to view code]

    Output :

    [Register or Login to view code]

  6. #6
    Moegames Guest
    wow things are really starting to roll.. it puts a smile on my face for sure. Good work and love how everything is chipping in ..reminds me of the old xbox original days in ways.

  7. #7
    sensi Guest
    Is it possible to change the firmware version this way? for PSN access?

  8. #8
    Pcsx2006 Guest
    Now that is the best gift of new year for developers not for the common users, thanks to failoverflow team.

    And yeah thanks to GeoHot too after all its all possible bcz of him.

  9. #9
    Join Date
    Apr 2005
    Moved to the main page now, and +Rep to Mantagtj as well.

  10. #10
    tjay17 Guest
    This is great I wonder how long before I can get pack to the psn now.

Page 1 of 3 12 ... Last

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts

Log in