Sponsored Links

PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!
Sponsored Links
Sponsored Links
Home PS4 News - Latest PlayStation 4 and PS3 News

PS3 Lv0ldr / Bootldr Exploit Reverse-Engineering Details by Naehrwert


Sponsored Links
123w ago - Following up on the previous PS3 Lv0ldr / Bootldr clarifications by marcan42 and wololo, today PlayStation 3 hacker naehrwert has shared some details based on reverse-engineering the exploit used to dump it.

To quote from his blog: The Exploit

As the exploit that was used to dump lv0ldr/bootldr/howeveryouliketocallit is public now, let's have a closer look at it to understand what's going on. Here is what I have reversed from lv0 (it shares the syscon portion of the code with its SPU counterpart):

[Register or Login to view code]

The syscon library implements some high level functions, e.g. to shutdown the console on panic or to read certain configuration values. Every of this functions internally uses another function to exchange packets with syscon and the exchange function uses the read_cmpl_msg one to get the answer packet. The top-level function will pass a fixed size buffer to the exchange function.

So if we are able to control syscon packets, e.g. by emulating MMIO (and thanks to IBM we are), we can change the packet size between the two packet readings and overwrite the caller stack. And if we first copy a little stub to shared LS and let the return address point to it, we can easily dump the whole 256 kB.

Nothing more left to say now, let's wait and see if this is going to be fixed in future firmware versions (we just have to check lv0 fortunately).


PS3 Lv0ldr / Bootldr Exploit Reverse-Engineering Details by Naehrwert

Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter, Facebook and drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene and PlayStation 4 scene updates and fresh homebrew PS3 Downloads. Enjoy!

Comments 252

• Please Register at PS4News.com or Login to make comments on Site News articles.
 
#242 - Rhynodry - 91w ago
Rhynodry's Avatar
Good morning, I think it failed on the slim. We are working on this, or else it has stopped working? Rumor has it takes a private key that is not in the console

#241 - yllan - 91w ago
yllan's Avatar
thank you aldostools

[Register or Login to view code]


#240 - ripplar - 91w ago
ripplar's Avatar
Nice. Thank you for this. Now let me play around and see what i can mess up now.

#239 - niwakun - 92w ago
niwakun's Avatar
it will lead to make MFW app to work again like you can create your own PUP CFW. But it won't lead to CFW on PS3 uses lv0.2 (3k/4k PS3 models)

#238 - shummyr - 92w ago
shummyr's Avatar
This is awesome news, very excited to see where this leads

Also from Abkarino: Also now i confirm that SPU ERK and RIV are found in decrypted lv1ldr file.. see my prove here:

s3nint3!SPU Erk/Riv keys as a Data Xref in IDA pro (4.46 lv1ldr):

s3nint3!SPU appldr keys unscrambling function in IDA pro (4.46 lv1ldr):


#237 - sguerrini97 - 92w ago
sguerrini97's Avatar
Quote Originally Posted by natex View Post
Hi, i have a PS3 Fat CECHL-01 board VER-001, it is Full Bricked, nor erased...

It is possible to recover the LV2 from HDD with this tool and rebuild the NOR?

You need your eid_root_key do decrypt your HDD.

Anyway I don't think you can fix your NOR with this...

#236 - fantopoulos - 92w ago
fantopoulos's Avatar
very helpful, thank you.. unbricked my console much app

#235 - natex - 92w ago
natex's Avatar
Hi, i have a PS3 Fat CECHL-01 board VER-001, it is Full Bricked, nor erased...

It is possible to recover the LV2 from HDD with this tool and rebuild the NOR?

#234 - PS4 News - 92w ago
PS4 News's Avatar
Following up on the previous PS3 SDAT / EDAT v3 and v4 Keys, today PlayStation 3 developers flat_z and naehrwert have shared some PS3 3.60+ Loader Keys and Phat HDD Encryption tools (including a full EncDec Emulator to encrypt or decrypt game discs) with details below followed by the Lv1ldr Crypto Keys as well.

Download: fckscramble_421.7z / lv1ldr_rsk_crypto.7z / slim_phat_encdec.7z / slim_phat_encdec.7z (Mirror) / Lv1ldr Crypto Test Files by Abkarino / ps3hdd_poc.7z by NiceShot / ppu erks and rivs.zip / tables.zip / lv0_patch.zip by zecoxao / LV0 Extractor/Injector / LV0 Extractor/Injector (Mirror) / LV0 Extractor/Injector (Mirror #2) / LV0 Extractor/Injector Source Code by TehUnkn0wn / PS3 4.46 Keys by Acid Burn1 / franzes80

Key Scrambling

Starting with firmware version 3.60 loader keys have been encrypted. Look here for a tool that decrypts them. Besides that, there is an implementation of the cryptographic algorithm which is used to encrypt/decrypt lv1ldr from lv0 and root scramble key at the SPU side.

Root scramble keys

[Register or Login to view code]

Scramble keys

[Register or Login to view code]

Scrambled keysets

[Register or Login to view code]

EDAT keys

[Register or Login to view code]

From flat_z (via ps3devwiki.com/index.php?title=HDD_Encryption):

Phat Consoles

  • On the PHAT consoles AES-CBC-192 is used for HDD encryption and AES-CBC-128 for VFLASH encryption.
  • So no tweak and tweak key here. Each sector is encrypted with the same zeroed IV.
  • VFLASH is encrypted once with ENCDEC key and zeroed IV!
  • Data key is of size 32 bytes but only the first 24 bytes are used for HDD and 16 bytes for VFLASH.
  • See also http://www.multiupload.nl/6PIFV4GKSH (contains scripts of ENCDEC emulator for both types of consoles).

From naehrwert (cdn0.meme.li/instances/600x600/39151418.jpg): The "Y U NO" picture I posted before

Btw. this means we might know now how cobra and 3k3y got their drive emulators working on latest consoles..

From zecoxao: First thing are the scrambled keys. Sony obfuscated the keys in order to make hard our access to them. those are called scrambled keys. Second thing is hdd encryption by glevand was incomplete. partially because he only had a slim and not a phat. now it's complete. Third thing is supposedly how cobra and 3k3y takes care of the drive keys on newer consoles. they basically don't even grab the keys, and all that's needed are sv_iso keys.

naehrwert already knows how that works. hence that meme. all you need is sv_iso keys lol

The keys should be these ones:
[code]
2A F9 18 23 CE 38 59 8E 8D 66 24 5F 69 8A B5 72

#233 - Ps3scener - 95w ago
Ps3scener's Avatar
found these but not sure, 3.60 and 3.61 Private keys

if you grabbed all the keys from gitorious. including 4.40 and 4.41 you should be able to make some sort of a jailbreak. unfortunately i can't patch lv 1 on 4.41. so anyone who can, feel free to try.

dunno why its a little bit bigger in size but these are lv 1 private keys by the way

 

Sponsored Links

Sponsored Links

Advertising - Affiliates - Contact Us - PS4 Downloads - PS4 Forums - Privacy Statement - Site Rules - Top - © 2015 PlayStation 4 News