PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!

Home PS4 News - Latest PlayStation 4 and PS3 News

January 1, 2011 // 10:37 pm - Today the PS3 LV2 Loader (lv2ldr), METLDR, Application / IV (initialization vector) keys and SHA1 hashes used to verify the keys have been publicly released by various PlayStation 3 developers. Below they are all listed, as follows:

Fail0verflow released the SHA1 hashes of the different PS3 keys: <-- sha1 hashes for some keys

[Register or Login to view code]

Mathieulh posted the PS3 LV2, PKGs, RVK, ISO, and Application keys (also crediting RichDevX, Graf_Chokolo, N_D_T, and TitanMKD) that can be used to decrypt via the PS3 SELF Crypto / PS3 SELF File Format and Decryption algorithm:

PS3 0.80 / 3.15 Lv2ldr keys:

erk: 94303F69513572AB5AE17C8C2A1839D2C24C28F65389D3BBB11894CE23E0798F
riv: 9769BFD187B90990AE5FEA4E110B9CF5

Decrypts all the External lv2 versions from pre 1.00 to anything below 3.40.

PS3 3.40 / 3.41 lv2 keys:

erk (12AB0): 57 5B 0A 6C 4B 4F 27 60 A0 3F E4 18 9E BA F4 D9 47 27 9F D9 82 B1 40 70 34 90 98 B0 8F F9 2C 10
riv (12AD0): 41 1C B1 8F 46 0C E5 0C AF 2C 42 6D 8F 0D 93 C8

PS3 0.80 / 3.15 Application loader keys:

erk-315 79481839C406A632BDB4AC093D73D99AE1587F24CE7E69192C1CD0010274A8AB
riv-315 6F0F25E1C8C4B7AE70DF968B04521DDA

erk 4F89BE98DDD43CAD343F5BA6B1A133B0A971566F770484AAC20B5DD1DC9FA06A
riv 90C127A9B43BA9D8E89FE6529E25206F

erk AAC20B5DD1DC9FA06A90C127A9B43BA9D8E89FE6529E25206F8CA6905F46148D
riv 7D8D84D2AFCEAE61B41E6750FC22EA43

erk-080 95F50019E7A68E341FA72EFDF4D60ED376E25CF46BB48DFDD1F080259DC93F04
riv-080 4A0955D946DB70D691A640BB7FAECC4C

erk D91166973979EA8694476B011AC62C7E9F37DA26DE1E5C2EE3D66E42B8517085
riv DC01280A6E46BC674B81A7E8801EBE6E

erk F9EDD0301F770FABBA8863D9897F0FEA6551B09431F61312654E28F43533EA6B
riv A551CCB4A42C37A734A2B4F9657D5540

PS3 0.80 to 0.92 Revision 0 Application loader keys:

erk-rev0 95F50019E7A68E341FA72EFDF4D60ED376E25CF46BB48DFDD1F080259DC93F04
riv-ev0 4A0955D946DB70D691A640BB7FAECC4C

PS3 0.95 to 3.31 Revision 1 Application loader keys (from and in updaters):

erk-rev1 79481839C406A632BDB4AC093D73D99AE1587F24CE7E69192C1CD0010274A8AB
riv-rev1 6F0F25E1C8C4B7AE70DF968B04521DDA

PS3 Unknown keys, seem not to be in use:

riv-unk1 90C127A9B43BA9D8E89FE6529E25206F

erk-unk2 AAC20B5DD1DC9FA06A90C127A9B43BA9D8E89FE6529E25206F8CA6905F46148D
riv-unk2 7D8D84D2AFCEAE61B41E6750FC22EA43

erk-unk3 D91166973979EA8694476B011AC62C7E9F37DA26DE1E5C2EE3D66E42B8517085
riv-unk3 DC01280A6E46BC674B81A7E8801EBE6E

erk-unk4 F9EDD0301F770FABBA8863D9897F0FEA6551B09431F61312654E28F43533EA6B
riv-unk4 A551CCB4A42C37A734A2B4F9657D5540

He also tweeted the following: In fact it decrypts most of the application selfs the 3.15 appldr key decrypts updaters too Looks like the isolated secure loaders aren't that secure anymore eh ? Looking for the curve list now. Ok so now if you can calculate K You'll also need to use a pre 3.40 lv2ldr but that's kinda obvious. By your lv2 I obviously mean custom firmware (for instance replace lv2_kernel) with a linux kernel. (of course you still need to flash it) Just one last thing, if you decrypt 2 lv2_kernel, you can calculate m then k, if you get k, and the keys I tweeted, you can have your lv2. btw those keys also happen to decrypt the ps2_emu binaries if anyone cares.

P.S. The self revision is located at 0x00000009 in the self header, it defines the key set in use.

GeoHot released the PS3 METLDR keys:

PS3 3.41 METLDR keys:

GG SONY!!!!!

I'm in your console borrowing your metldr keys

3.41 kernel keys as semi proof, more to come

erk(12AB0): 57 5B 0A 6C 4B 4F 27 60 A0 3F E4 18 9E BA F4 D9 47 27 9F D9 82 B1 40 70 34 90 98 B0 8F F9 2C 10
riv(12AD0): 41 1C B1 8F 46 0C E5 0C AF 2C 42 6D 8F 0D 93 C8

Finally, GeoHot also shared geoldr, to quote:

Happy New Year!

Run this as a 2nd stage from metldr. Listen for mail

As usual, there are no release dates ever. But pretty cool eh? It's a real loader.

PS3 LV2 Loader, METLDR, Application Keys and SHA1 Hashes!

PlayStation Follow us on Twitter, Facebook and join us at our new site WWW.PSXHAX.COM!

#2 - brill - January 1, 2011 // 7:33 pm
brill's Avatar
Quote Originally Posted by boybergamo76 View Post
there are the real keys? O___O

Nah, they are the hash signatures of the keys in hex form. I suppose to prove to everyone that they have them without actually releasing them.

They seem to match the signatures of the publicly known ones (lv2 and pkg) Since they aren't salted I suppose it's feasible to run the ivs through a 0-9 A-F 16 byte rainbow table but I'm not so sure about the 64 byte key.

Either way, anyone knowledgeable enough about this kind of stuff would just find it easier to grab the keys themselves using the techniques described during the conference rather than bruteforcing them from a SHA-1 signature which, funnily enough, would take a lot more effort and computing power.

#1 - boybergamo76 - January 1, 2011 // 6:46 pm
boybergamo76's Avatar
there are the real keys? O___O