PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!

Home PS4 News - Latest PlayStation 4 and PS3 News

December 29, 2010 // 9:51 am - Update: As planned, today Marcan42 has showed a Fail0verflow live demo (videos below) of him booting up a PS3 Slim to a Linux Kernel during the Lightning Talks as part of Day 4 at the 27C3 PS3 Exploit Hacker Conference.

Below are the fail0verflow PS3 exploit details along with related 27C3 (Chaos Communication Congress) Hacker Conference 2010 PlayStation 3 highlights.

Currently it includes an outline and details on PS3 SELF Crypto and PS3 SELF File Format and Decryption, and will be updated throughout the day as new details and video footage (full video now HERE- Thanks zeromx) arrive.

As previously reported, the PS3 hacking segment took place today at 16:00 (local time) in Saal 1 and a live stream was available in the following formats:

PS3 27C3 Hacker Conference 2010 Summary:

  • Fail0verFlow is Coming: and (Dongle-less PS3 JailBreaking, overflow by replacing PS3 revoke list with a large one at bootup due to Sony's flawed implementation of ECDSA in not having a random K value)
  • Fail0verflow Tweets: Yes, we'll release all our tools as soon as we cleaned them up in January or so. Myth: Geohot -> Sony pulls OtherOS -> JB -> Fail. Fact: Slim had no OtherOS -> Geohot -> ... . Geohot started his work due to the Slim. There is absolutely no doubt in our mind that the PS3 lasted as much as it did due to OtherOS. The security really is terribly broken. Note: we won't be working long-term on CFW or similar. We'll release tools and a PoC, someone else can take over. The fun part is done we only started looking at the ps3 after otheros was killed. the website will launch when it launches. Almost certainly not tomorrow. fail0verflow is the name of our 'group'. We are a bunch of curious hackers who have been working on a bunch of things over the last 3 years. Our goal is to have linux running on all existing PS3 consoles, whatever their firmware versions. Our current PS3 goal: AsbestOS.pup. For all those out there that think has been hacked - it hasn't. We're just busy working on a demo for tomorrow. Patience!
  • Marcan42 Tweets: Clarification #4: The random number isn't 4, it's more like 007eabbb79360e14df1457a4194b82f71a0dc39280 (example). But it's still constant. Clarification #3: The private keys refer to keys that Sony HQ uses. PS3s don't have these keys (but we calculated them due to the fail). It's Sony not knowing WTF they're doing when making signatures, and thus mathematically leaking their keys. This is also why we didn't use the term "exploit" or "bug". The PS3 signature fail is neither an exploit nor a bug (in the PS3 firmware). The XKCD "return 4" function that we showed is (essentially) part of the code that Sony HQ runs to sign games, it's not in the PS3 FW. No one can create a new metldr (for an existing console). Not even Sony (unless they have that console's key stashed somewhere).
  • Marcan42 Tweets cont'd: We don't have the game signing key but the same epic fail applies to it. Once someone dumps appldr they can calculate it too. They actually CAN change keys for LV2/LV1, isolated modules, rvklists, spp, but that's useless because you can just downgrade the loaders. Myth #2: Sony can change keys. No, they can't. These aren't encryption keys, they're signing keys. If they change them GAMES STOP WORKING. Myth #1: It took us 3-4 years to do this. Negative, this exploit only took a few months after we started working. We weren't trying before.
  • Marcan42 Tweets cont'd: FWIW lightning talks tomorrow are at 11:30-13:45. PS3 demo will be 4 minutes _somewhere_ within that range (to be determined). They can try to whitelist every existing piece of official PS3 code... but good luck with that. IOW they CANNOT change keys or fix this in a new firmware, because stuff we sign is every bit as good as existing official software. Wii fakesigning vs. PS3 epic fail: Wii issue is a BUG in console code (fixable), PS3 issue is a FAIL in THEIR secret signer (not fixable).
  • Marcan42's PS3 NOR Flash 40-50 Wire Mod (more pictures HERE)
  • Public Private Keys Calculated, Current PS3 Firmware vulnerable and downgradeable
  • Signing (SELF Packages) - Not Games (No Apploader Keys), PS3 SELF Decryption Code by ooPo (GIT)
  • Live Demo by Marcan42 (confirmed above via Twitter) during Lightning Talks tomorrow- Day 4, Room Saal 3, Start time 11:30, Duration 02:15.
  • MPlayer port to PS3 in the works, confirmed by lantus on IRC.
  • From sven via IRC: Although only PS3 keys up to 3.15 are currently available, it is now possible to build an AsbestOS.PUP. There is an overflow with the revocation lists, we could have put a huge revocation list on the NOR which lv1 will happily load and then use that to break lv2ldr and patch out the signature check but then we found the private key. We don't have lv1 yet because we don't have the lv1 loader key.
  • phiren on IRC states: Well, all currently released ps3's are broken forever. With a bit of effort they could update it to take a new private key, but then they would have to release 2 packages, one signed with the old key and one signed with the new key and their security model is still fundamentally flawed.
  • 27C3 Console Hacking 2010 Presentation Slides (PDF) are now available.

Updates from PS3 Wiki (

PS3 SELF Crypto: Here is a small summary on how the self cryptography works.

Basically here are the steps being involved by the loaders:

Loaders all have a static key and iv called respectively erk and riv, those are keys for the first decryption step which are used to decrypt the very first 0x40 bytes of the self's metadata using AES256CBC

Then the result is used as a key and iv to decrypt the rest of the metadata using AES128CTR, finally the decrypted metadata contains the keys and iv for each data sections which are still decrypted through AES128CTR. This security model is based on the fact that the first 0x40 bytes of the self's metadata once decrypted by the static AES256CBC key in the loader should never be the same from one binary to the other. The same goes for any other value used as an AES128CTR key or iv.

Loaders are also involved with deflating the binaries using zlib.

The self authenticity is based on other independent steps, HMAC-SHA1 (which I believe to be possible leftovers from the playstation portable's kirk engine code) and ECCDSA for the actual signature.

PS3 SELF File Format and Decryption:

File Format

- Numbers are stored in big endian format.

SELF Header

[Register or Login to view code]

Program Info

[Register or Login to view code]

Control Information

[Register or Login to view code]

Metadata Information

[Register or Login to view code]

- The key and ivec fields are encrypted using AES256CBC.

Metadata Header

[Register or Login to view code]

- The metadata header is located after the metadata info in the SELF file.
- It is decrypted using AES128CTR with the key and ivec entries from the metadata information.

Metadata Section Headers

[Register or Login to view code]

- The metadata section headers are located after the metadata header in the SELF file.
- The number of sections is indicated by the sectionCount entry in the metadata header.
- They are decrypted using AES128CTR with the key and ivec entries from the metadata information.
- Section data is decrypted using AES128CTR with the key and ivec from the metadata keys specified by keyIndex and ivecIndex.
- Section data will also need to be uncompressed using zlib.

Metadata Keys

[Register or Login to view code]

- The metadata keys are located after the metadata section headers in the SELF file.
- The number of keys is indicated by the keyCount entry in the metadata header.
- They are decrypted using AES128CTR with the key and ivec entries from the metadata information.
- Some keys are 160-bit SHA-1 and span two consecutive keys.

Extracting an ELF

ELF Header

[Register or Login to view code]

Section Data

- Unknown, manually copying the data over works for now.
- There should be a section data offset somewhere.

Program Headers

[Register or Login to view code]

Program Data

- Load the metadata information and decrypt the key and ivec entries using AES256CBC using erk and riv.
- Load the metadata header and decrypt it using AES128CTR with the key and ivec entries from the metadata information.
- Load sectionCount metadata section headers and decrypt them using AES128CTR with the key and ivec entries from the metadata information.
- Load keyCount metadata keys and decrypt them using AES128CTR with the key and ivec entries from the metadata information.
- For each metadata section:
- In the SELF file, fseek to dataOffset and read in dataSize bytes.
- Decrypt the data using AES128CTR with the key and ivec from the metadata keys specified by keyIndex and ivecIndex from the metadata section header.
- Uncompress the data using zlib.
- Write it to the ELF file as the program section specified by sectionIndex in the metadata section header.

Fail0verflow: 27C3 PS3 Exploit Hacker Conference 2010 Highlights

PlayStation Follow us on Twitter, Facebook and join us at our new site WWW.PSXHAX.COM!

#83 - Mbb - December 30, 2010 // 9:37 am
Mbb's Avatar
Hackers don't care about games they bring linux back on FW3.55 and beyond, it means they don't do anything for games but im sure someone else who does care is going to do that for games, its how the scene works.

#82 - THCIV - December 30, 2010 // 9:24 am
THCIV's Avatar
as for cfw what would be the point other than otheros reapearing as a option? what i mean is if we have keys upon keys and whatever key we don't have is only a matter of putting the work in to get wouldn't it be easiest to just sign the backup managers as official along with the games on the hard drive and any other app one might want to use like an xbmc like program or emulators?

that would allow instant acess to any firmware version aka homebrew on 3.55 no exploit needed as everything is now "official".

#81 - condorstrike - December 30, 2010 // 9:11 am
condorstrike's Avatar
Either you're Sony and don't like what you saw yesterday, or you're a kid who can't comprehend what happened yesterday... either way, most of us are not in it for the piracy, just fyi...

#80 - TesterZERO - December 30, 2010 // 8:57 am
TesterZERO's Avatar
Oh, so what's the point for this then just to bring back Linux on the ps3.. well no one used Linux in the first place lol and thanks for the answer.

#79 - oVERSoLDiER - December 30, 2010 // 8:24 am
oVERSoLDiER's Avatar
Quote Originally Posted by TesterZERO View Post
so what can i do with this? can i play games on 3.55 online or no ?

Yes of course you can, if you buy the game original !

Thats nice informations we got here in Germany . Think one of the public PS3 hackers like KaKaRoToKS will do very interesting things with this. Also the team roundabout CFWProphet can be profit from this.

They are working on bring Linux to every PS3 - doesn't matter which Firmware is installed. They are currently working on AsbestOS.PUP, so no direct connect to Jailbreak and piracy.

#78 - TesterZERO - December 30, 2010 // 8:06 am
TesterZERO's Avatar
so what can i do with this? can i play games on 3.55 online or no ?

#77 - Transient - December 30, 2010 // 7:19 am
Transient's Avatar
Quote Originally Posted by Preceptor View Post
People, lemme ask a little question here and I want an answer from a person with some actual knowledge of crypto and that really watched through the whole video. I didn't get if they actually said it and I didn't catch or if it's trivial, but how did they come to the conclusion that sony was using the same random number for signing?

It all comes down to math and they show the formula to solve it in the video. The crypto is a known type, so we already know ahead of time what makes up the formula. Since the random number was in fact a static number, it is now possible to rewrite the formula to discover the unknown value when comparing calculations. Once the the "random" number is discovered, it is then possible to rewrite it again and discover the private key.

So how did they figure out that the random number wasn't random in the first place? They didn't actually say, but it's not hard to imagine that someone with a good understanding of cryptography might try to see if the number is truly random, or if perhaps it's always the same random number on the first boot up. I imagine there wouldn't be many steps from there before they realized the random number wasn't random at all.

It does seem amazing that Sony would miss this as random number generation is fairly trivial. I imagine it comes down to something like inginear suggests and they didn't properly seed the random number generator. A common seed is to use time (since it's always changing), but what if they used that and the clock hasn't initialized yet? Just a guess, but probably not far off.

#76 - inginear - December 30, 2010 // 6:36 am
inginear's Avatar
most likely sony didn't seed the rng that they used for the keys with a random number. [ex: srand(time(0)) in c++] therefore every time the rng is called, it will produce the same "random" numbers in the same order. since this is in sony's code, they obviously can't show us the code because of legal reasons.

unless someone leaks the plain text file of the code, or you dump it yourself, you'll have to take their word that it is not random.

#75 - segobi - December 30, 2010 // 6:25 am
segobi's Avatar
sure you can't sign games right now.

#74 - IndyColtsFan84 - December 30, 2010 // 5:37 am
IndyColtsFan84's Avatar
Be patient, questions will be answered soon after fail0verflow has launched & is filled with documentation of the ps3 related information from the conference.

Come on guys/gals, we waited 4 years for this now its finally here, I'm sure most of you know the old saying: "Good things come to those who wait". Same ole story in this situation, WAIT! LoL

Forgive me if i seem irrelevant, I'm a bit drunk at the moment. The new year celebration has begun a bit early for me!