It seems that more and more often stuff gets leaked by anonymous persons. It’s still unconfirmed but it looks like that a anonymous person leaked a Metldr exploit to the web.
To quote:
We here at our PS3 Crunching news desk, have been going thru all our emails as we do each morning over our daily large dose of coffee, and suddenly had to take a ‘step-back’ and get our heads in order, as we received an ‘an0nymous email’ from some random one-time dropbox, containing a weird little attachment, with a simple note:
Program: metldr838exploit
Author: Unknown
Usage: Unknown
Reason: UnknownBefore posting we had one our PS3 Crunching Developers look it over, and it seems to be a set of ‘C’ code and headers and an compiled ELF and SELF that exploits the ‘chain of trust’ to dump an ‘unecrypted’ version of your PS3 ‘metldr’.
It’s still unconfirmed if this is a real working Metldr exploit and for now this isn’t very useful for the end user, but might bring us closer to a more open Playstation 3! We will keep you up-to-date as soon some developers have some time to play with it and confirm if it’s usable. But for now exciting new developments!
Thanx to PS3Hax member himshie for the submit!
Source: PS3Crunch
Download: http://bit.ly/tP9myU
UPDATE
Here is a statement from PS3 Developer Mathieulh
Because some ungrateful person leaked my metldr exploit files I will now be explaining how it actually works, see this as my ultimate release of all times for an ungrateful scene (and scenes in the future)
That’s about how I am pissed right now, because of course the person that leaked these files has no idea of how they actually work.
How to pwn metldr the “easy” way:
This is most likely how geohot exploited it in the first way, this takes (give or take) about 10 minutes to be performed. (yeah, not so much of a “I hacked the ps3 all on my own work, especially not when it partially relies on Segher’s work, one of the reason geohot never shared the way he exploited metldr to anyone)I will assume here, that you do not have the loader keys that were made readily available by geohot. This little tutorial also assumes that you have a working .self generating tool
Now You want to gain code execution to metldr, you know that metldr loads loaders to its own space, but you cannot run a loader because the loader needs to be signed and even though you know about the sign fail that Segher introduced at the CCC, you cannot use it because you don’t have decrypted signatures to calculate a private key and to get signatures you need keys which you are currently trying to dump, so far you are stuck in a chicken and egg scenario.
The question is, do you really need keys to get a decrypted signature ?
Well the real answer is no, thanks to a nifty fail that sony left in in metldr (and the bootloader), you can have the ldr to decrypt the metadata for you, isn’t that neat ?Here’s how it works:
STEP I)
In a self file, at address 0x0C a value is used to calculate where the metadata is going to be decrypted, the “offset” is at self header + 0x0C
its the “meta header offset” in the SCE structure, it takes the SCE offset + that value, so what you have to do is to have a calculation that is equal to 0x3E01F0 which happens to be where metldr copies over the shared metadata from the mailbox (which is sent over by the ppu), the trick is to have metldr to decrypt the metadata located at.
So basically you have to
1) set the offset += 0×2000
dump shared lsa
and keep increasing 0×2000
until somewhere in the shared lsa changes 0×40 byte
2) when it changes 0×40 bytes, you can add/subtract the proper amount to make it decrypt the proper locations
3) then dump shared lsa and we have decrypted header
knowing that metldr uses SCE header 0xECF0, you could calculate it knowing the address 0x3E01F0 – 0xECF0 = the value you would patch at SCE header + 0x0CROM:0000F6C0 D2 68 87 E6 metadata_erk: .int 0xD26887E6 ; DATA XREF: ROM:0000F178o
for example in CECHA , the address you want to decrypt it to is 0x3E1F0
so it should be 0x3E1F0 – 0xF6C0Once you get the decrypted header, you have the key to decrypt the rest of the metadata. Here you go, you have your decrypted signature.
So far so good, now what’s next ?
STEP II)
Contrary to popular beliefs, you do not need to know the public key to calculate the private key, you just need two decrypted signature, you now know how to dump these, so let’s assume you just did, now all you have to do is to bruteforce the curve type by constantly reloading a self to metldr, the curve type being only 1 byte, that would be 64 possibilities.
CONGRATULATION, you just signed a loader !
Now what ?
Well Your first reflex would be to sign a loader and use it to dump whatever is in your Isolated Local Store, the first thing you will notice is that you have a bit of metldr’s code as a leftover, after a few seconds of disassembly you will figure it’s actually some piece of code that clears metldr’s code and registers and jumps to some address which is matches your signed loader’s entrypoint.
This seems like a more than likely candidate to exploit, as in your goal would be to overwrite that piece of code with your own, that way you would have the whole metldr code right before the point where everything gets cleared out.
Let’s try to do just that, from your previous dump, you obviously know that the clear code is located from 0×400 to 0×630, (0×410 being where metldr jumps when it clears) your first attempt would naturally be to have a loader section to load at 0×400, well not so surprisingly, it fails, because you are not without a brain (at least you aren’t supposed to be if you’re reading and understanding this), you will assume that it is likely that metldr checks if you aren’t loading your loader/self section below a certain address, which considering you know the loaders’ entrypoint is most likely to be 0x12C00, this assumption is in fact correct as metldr will make sure you cannot load any loader at 0x12BFF and below, seems like a huge let down…
Well, maybe not, because yet again, you are not without a brain, you check out the hardware properties for the Local Store, and you find out that the memory wraps around (memory is a donut as someone once said at some ccc conference).
So what happens when you load your loader at let’s say from 0x3F000 to 0×40000+some address? (like 0×40410 for example) ?
Well, it WORKS!
You could put the section at 0x3F000, if you made the length 0×1414 and the last instruction branches “up” to the dump codeROM:000008AC 33 7F 6C 80 brsl lr, cleanup_and_jump_entry
ROM:000008B0 32 00 11 80 br loc_93C
ROM:00000410 cleanup_and_jump_entry: ; CODE XREF: main+4Cp
ROM:00000410 32 7F FF 80 br sub_40C
this is what the exploit that got leaked (yeah that’s not really their work eh but you figured that much by now did you not? ) does.
It overwrites from 0×000 to 0×480 because I originally loaded the section o size 0×880 to 0x3FC00So now you get code execution on metldr at the best time possible because your code executes right after metldr copies the root keys from 0×00 to 0×30, which means you get to dump these too. (Although they are hardcoded in metldr’s code anyway)
Here you go, you have a metldr dump !
Now as a final line, I’d like to say screw leakers, screw the scene, and this is my last contribution to it EVER. It seems I can’t even trust fellow developers to keep my work safe and not leaking it. (Not like any of them would have been able to tell you how all this even works in the first place)
So long, everyone.
Remember, don’t ever bite the hands that feed you.
Source lan.st
Via Mathieulh’s Twitter
#UPDATE 2
It seems that PS3Hax member lunuxx made a tutorial if you want to grab they key yourself. But remember when installing otheros++ you will get trophy errors and you can’t do anything with the key yet.
ohai ill tell you guys howto use mathldr
(i like to call it that, its kinda catchy)
this is pretty safe
just dont go crazy with it, your only gonna mess your eid up if you attemp to rehash it and flash or attempt in any way to replace your eid
you can decrypt eid with root keys and static keys in the wiki key pageprerequisites:
1. otheros++ with ss patches (yes the ones that cause trophy errors, just update when you wanna play games again and dont complain)
2. linux on your ps3 (im using ubuntu 10.10)
3. a unpacked copy of your flash (which you can obtain by using glevands dumpflash.pkg gitbrew.org/~glevand/ps3/pkgs/dump_flash.pkg) and an unpacked copy of ofw you will need the following files from these:
metldr
isoldr
RL_FOR_PROGRAM.img
EID0 (you will need to split eid from your flash http://www.ps3devwiki.com/index.php?…s#dump_EID0.sh)
spp_verifier.self
default.spp
and obviously appldr-metldrexploit350.self from the files
3. latest gitbrew linux kernel
4. a desire to quit *****ing and complaining and get off your ass.
************************************************************************************************************you can do this over ssh or on console I prefer ssh because my girlfriend likes to watch tv alot.
1. ssh into the ps3
2. download the files
a. wget http://gotbrew.org/metldr838exploit.tar.gz
3. untar the files
a. tar -xvf metldr838exploit.tar.gz
4. enter the directory and compile
a. cd metldr838exploit.tar.gz; make
5 run the following commands now:
insmod ./metldrpwn.ko
cat metldr > /proc/metldrpwn/metldr
cat appldr-metldrexploit350.self > /proc/metldrpwn/mathldr
cat RL_FOR_PROGRAM.img > /proc/metldrpwn/rvkprg
cat eid0 > /proc/metldrpwn/eid0
echo 1 > /proc/metldrpwn/run
cat /proc/metldrpwn/debug
there now you have a dump check it out:
hd /proc/metldrpwn/dump | less
now copy the dump somewhere or youll lose it:
cp /proc/metldrpwn/dump /home/username/
now you have a copy in your home directory for safe keeping
congrats youve completed about < 10 mins of actual workthere you go keys are in 0×00 to 0×20 (first 3 lines)
So now you get code execution on metldr at the best time possible because your code executes right after metldr copies the root keys from 0×00 to 0×30, which means you get to dump these too. (Although they are hardcoded in metldr’s code anyway)
example:
erk: #
00000000 66 4d ee 51 65 6f 68 28 38 98 83 ea df ea 90 04 |fM.Qeoh(8…….|
00000010 01 f3 79 09 d6 a6 52 d9 ea 6d ef 04 51 69 ec 7b |..y…R..m..Qi.{|
riv:
00000020 7d 6a 3a e5 37 ba 48 4c fe bd 26 5c f5 b1 28 1f |}j:.7.HL..&..(.|
the first 2 lines are erk the 3rd is riv
and together they are eid0 like captain ****in planetbtw this does not mean you get 3.60 keys etc or newer games but it will help you get some nifty things to do some new stuff…. also please be advised that if you are on 3.60+ you will need to downgrade with a flasher to do this, also if you have a unit that shipped from the factory with the metldr.2 (new metldr) your sol at the moment
oh thanx math
thanx anon leakersome good reading on the subject:
http://www.ps3devwiki.com/index.php?title=Boot_Order
http://www.ps3devwiki.com/index.php?title=Dev_Tools
http://www.ps3devwiki.com/index.php?title=Flash
http://www.ps3devwiki.com/index.php?title=Talk:Flash
http://www.ps3devwiki.com/index.php?title=IDPS
http://www.ps3devwiki.com/index.php?title=Talk:IDPS
http://www.ps3devwiki.com/index.php?…r_Console_Keys
http://www.ps3devwiki.com/index.php?…r_Console_Keys
http://www.ps3devwiki.com/index.php?…se_Engineering
http://www.ps3devwiki.com/index.php?title=Talk:Keys
http://www.ps3devwiki.com/index.php?…Unit_%28SPU%29
http://www.ps3devwiki.com/index.php?…Unit_%28SPU%29
http://www.ps3devwiki.com/index.php?…se_Engineering
http://www.ps3devwiki.com/index.php?…se_Engineering
11-08-2011
10:20 AM
If your going to post news, at least make an effort :/
11-08-2011
10:22 AM
sorry dude i thought the news team would do that
11-08-2011
10:24 AM
so wait it s meaning?
11-08-2011
10:25 AM
Until someone makes something out of this, it's useless IMO.
11-08-2011
10:27 AM
11-08-2011
10:33 AM
so what is meanning? what can we wait now?
11-08-2011
10:41 AM
11-08-2011
10:45 AM
I had a further look and it shows that its says 3.50 exploit no too sure if I am right or wrong but since I'm not a dev don't take this too seriously.
here is a screen shot of the image.
Don't know if this makes any sense or not. But yeah.
11-08-2011
10:51 AM
for what I know the per_console_key_0 is in metldr, so take your conclusions...
11-08-2011
11:02 AM
yes the files are from august but not very many have seen them....
you can get eid root key from metldr
11-08-2011
11:03 AM
in readme it says eid0 so i hope that is the real thing
time will tell
11-08-2011
11:10 AM
yes maybe the end of waiting
11-08-2011
11:13 AM
I heard the per_console_key_0 is the trickiest to get. True?
11-08-2011
11:17 AM
yes thats what makes all thinks work.
11-08-2011
11:22 AM
well the per_console_key_0 is in the 'metldr'
11-08-2011
11:24 AM
can this value
94D100BE6E24991D65D93F3DA938858CEC2D133051F47DB4287AC86631719B31573EF7CCE071CA8A
be associated with this exploit?
11-08-2011
11:25 AM
Sweet. Can only mean good things. Eventually
11-08-2011
11:26 AM
So a new exploit will be possible?
11-08-2011
11:28 AM
Lets hope this leads to something good.
11-08-2011
11:33 AM
11-08-2011
11:37 AM
The fact is dont get excited before the results.
In 10 months of this scene we have seen soooo many fake news.
11-08-2011
11:50 AM
You should be happy there has been 10 months of people working on the console.
11-08-2011
11:55 AM
You gotta love metldrpwn.c
11-08-2011
11:57 AM
so now what will happen?! you will know to the next numero!
11-08-2011
11:57 AM
11-08-2011
12:04 PM
It'd great if someone can explain what this is for, in detail.
Sent from my iPhone using Tapatalk
11-08-2011
12:05 PM
There's been some great news lately, namely Uncharted 3, let's hope this is another great step towards playing +3.60 games.
11-08-2011
12:07 PM
i say wait and not get exited over this too early coz you may be disappointed,if this is known from august and no one managed to do anything with it in 4 months........i just go with the flow and dont expect much out of this or anything that gets leaked to the public,the good stuff is released when is released and BUM! will bring back the whole Ps3 scene back to life, then you can get exited and not just yet.
11-08-2011
12:09 PM
wasnt known publicly in august, the files are dated august. someone just leaked it
11-08-2011
12:10 PM
If I were $ony I would get a real big headache with all the news, exploits, PSN cracks and dongles lately
11-08-2011
12:11 PM
11-08-2011
12:12 PM
just opened the .C file and damn, I'm ****ing amazed, if that stuff actually does what is supposed to do... ****!
too bad I can't go any further but the peeps who can actually go have some serious **** here.
11-08-2011
12:13 PM
theres a dangerous way to do cex-dex
just sayin
11-08-2011
12:14 PM
According to Matieulh, he already has the 3.60 keys and has already given us clues on how to get them.
So, it could already have been of some use to some people, but only now they came in broad daylight.
But this is just a hunch
11-08-2011
12:15 PM
hopefuly this is true and some devs can make something out of it, makeing us end cfw users better off. all we can do is wait and hope
11-08-2011
12:15 PM
Well, I do not very much about C, but it mentions glevand, linux kernel, level 1, SPU, that it 's GNU and EID0.
It's structure needs of some libraries I do not know at all, I suposse they are in PS3 system.
11-08-2011
12:16 PM
So in advance before it gets asked...
THIS DOES NOT MEAN CFW.
THIS IS NOT FOR THE END USER.
11-08-2011
12:18 PM
[MENTION=7151]Pockets69[/MENTION] is correct.
All this amounts to is a ton of useless speculation. Until one of our "scene professionals" denounces this "leak", you all best keep quiet!
11-08-2011
12:19 PM
I didn't say it wasn't real...
11-08-2011
12:22 PM
Oh, I only expect this will help in some way to get profit from the rsx driver and better distros of linux (if only i had not my awfull 160 GB int hdd wich always gives me the incability of making the hdd partition
, even with the alternative sh_region) CFW with dual OS please¡¡¡¡¡
11-08-2011
12:25 PM
11-08-2011
12:36 PM
"According to Matieulh, he already has the 3.60 keys and has already given us clues on how to get them".
Math also knows the meaning of life, can time travel & knows the answer to all questions, but ofc he wont share these findings with mere mortals such as ourselves
11-08-2011
12:48 PM
wierd to actually front page this ... but anyway cool development
11-08-2011
12:50 PM
11-08-2011
12:52 PM
this is good news. see what magic the devs can do with this.
11-08-2011
12:52 PM
an email from anonymous person LOL. hopefully isnt fake... again.
11-08-2011
12:55 PM
11-08-2011
12:56 PM
can someone explain something like...
this could lead to cfw
this could lead to psn hax
this could lead to a new multiman
this could lead to brick your ps3 lol..
or wut.. ??? we should expect about this how big it is.. if it is.. anything of importance...
11-08-2011
12:58 PM
According to this:
11-08-2011
01:00 PM
11-08-2011
01:06 PM
11-08-2011
01:06 PM
told ya
11-08-2011
01:06 PM
bloddy thing messed up ignore this message
11-08-2011
01:07 PM
11-08-2011
01:08 PM
module_init(metldrpwn_init);module_exit(metldrpwn_exit);MODULE_LICENSE("GPL");MODULE_DESCRIPTION("SPP verifier direct");MODULE_AUTHOR("glevand");
GLEVAND... this is good or bad?
11-08-2011
01:10 PM
Isn't this what geohot leaked and eventually led to CFW? Here's hoping it's real
11-08-2011
01:10 PM
p78ch201
or someone renamed some things that isnt anything but crap
like take any file on your pc, rename it and then post it :D
11-08-2011
01:11 PM
11-08-2011
01:12 PM
11-08-2011
01:13 PM
So real or fake?
11-08-2011
01:16 PM
11-08-2011
01:16 PM
11-08-2011
01:18 PM
@ All
we all have the METLDR Keys!
this thing cant bring us the METLDR Keys! because we have the Keys!
but the problem is the METLDR is decrypted with LV0! because of this the METLDR Keys arent useful! we need to get the real Root key!(lv0)!
then we have everything
11-08-2011
01:18 PM
Maybe someone fixed his work to working, or its completely fake.
Noone knows yet!
11-08-2011
01:19 PM
11-08-2011
01:20 PM
It's incomplete, also it looks like it borrows stuff from appldr exploits...
11-08-2011
01:22 PM
up.... down.... up..... down.... = mood of PS3 scene followers :P
Have a little (bit more) patience
11-08-2011
01:22 PM
[1:15pm] <Mathieulh> leakers gotta leak
[1:15pm] <Mathieulh> I am actually explaining how it works
[1:15pm] <Mathieulh> and put a big screw to the scene with it
[1:15pm] <Mathieulh> cause the ****ing leaker wouldn't be able to tell you how it ****ing works
So who knows
11-08-2011
01:23 PM
http://lan.st/showthread.php?p=22446
11-08-2011
01:24 PM
it's on every scene forum/site, so it's big news, even bigger then then true blue, and even we thought that was fake, but apparently it's not, so just wait and see.
11-08-2011
01:26 PM
http://lan.st/showthread.php?p=22446 what's this
11-08-2011
01:26 PM
Moddified work obviously != (not equal) fake.
11-08-2011
01:26 PM
11-08-2011
01:27 PM
http://lan.st/showthread.php?p=22446
11-08-2011
01:30 PM
Enough with that tactic, I know how to do it but I won't tell you, I'll just guide you how you can do it yourself ignoring the fact that you may not have enough knowledge to do it taking all of the rest people who are in need of such exploit on my graveyard.
He cannot just be mad when something leaks, if he doesn't want it to leak, he is an adult, he should know by now that if you don't want a secret to leak, you just don't share it, which proves that if you do share it, you have atleast a bit of ''that poser'' characteristic inside you. It's not importantly bad to be a bit of poser but you cannot be mad or think that people are going to be sorry or respect you to a full extenct.
I am in the music industry and leaks happen, and these are serious, like I could lose my job or get sued.
I cannot be mad when I shared something with some people I trust more or some less, because I myself chosen it to leak in a context.
He must just learn to manage how things get released, leak and their timing.
No releases or no leaks cause to this situation and as long he is in this scene, he should expect this to happen more often.
11-08-2011
01:34 PM
11-08-2011
01:39 PM
well, he may be pissed at the leak but the solution to the problem is not to give it out in the first place.
as much as i would like to give him credit for this work i cant due to the fact he was never going to release it.....
11-08-2011
01:41 PM
I think the news page has to be update
11-08-2011
01:43 PM
This exploit also the lv0 key.
Matthieulh twiter:Oh and btw, if you talented enough to make hardware to dump the shared lsa, you can decrypt any lv0 using this technique/exploit
11-08-2011
01:45 PM
Front page updated.
11-08-2011
01:53 PM
oh it seems that the end of of 3.6x and 3.7x is coming!
11-08-2011
01:58 PM
at least we know that this isnt fake and its gonna take us to something, right?
so now we wait! :D
11-08-2011
01:59 PM
So guys let us Drink Tea and Wait :D
11-08-2011
02:10 PM
so we can have a cfw for the ofw 3.7x ? , because for install the cfw in the latest fw we need decrypt lv0 rigth?, and mathieulh said you can decrypt any lv0 using this technique/exploit
11-08-2011
02:14 PM
if this let me play portal 2, i'll be happy AND SO i'll say thx to math :D
11-08-2011
02:17 PM
11-08-2011
02:18 PM
11-08-2011
02:24 PM
so the Metldr expolit so ps3 3k gonna downgrade now right ???
11-08-2011
02:25 PM
thx math....u rock
11-08-2011
02:27 PM
Ok seriously. Is this about the guy who leaked/didnt leak the exploit or is it about the exploit itself and what it means for the scene?
11-08-2011
02:31 PM
well, the scene of hacking ps3 is done because master key is found.
however, cfw scene and homebrew scene will be active still.
11-08-2011
02:32 PM
Somehow I feel sorry this got leaked (don't start a flame war). I would rather have one of the smartest PS3 developers still on board of the scene than this in the open...
and to the people who say he never releases anything.... he did more for the PS3 scene than you will ever know. He also helped with a lot more things than you will ever know. But most people only look at his behavior and call it arrogance etc. without even knowing him in real life. Maybe he is arrogant, but looking at what he wrote in the explanation he has somehow (to my feeling) the right to be.
Mathieu, I will miss your talent in the future. I hope this masterpiece will lead to an unstoppable (by $ony) CFW so you won't have left for nothing. Like Graf_chokolo isn't around anymore, if you aren't I will always remember your contribution to make my life more happy
Don't bother to flame me about this comment, I won't answer to any flame post. call it arrogance, I call it a waste of time
11-08-2011
02:55 PM
Now this is the last off topic post
@ Everyone
NO MORE MATHIEULH FLAMING
NO MORE OFF TOPIC POSTS
NO MORE INSULTS
Now i don't give a crap about your home problems, about your mid life crisis, about your male menopause or whatever retarded real life crap any of you have, keep it the f*ck off the forum, any more violations will result in infractions and bans, simple as that.
11-08-2011
03:00 PM
So, finally comes the time to register.
I want to thank Mathieulh for his work on the exploit.
I follow the news and the discussions since over a year now and I know that he is sometimes kind of arrogant, but so what?
Somehow he remembers me on Rodney Mc Kay of Stargate Atlantis, a genuis, always arrogant but deep inside alwys try to help.
Don't believe me? So why Meth wrote a tutorial how to use that stuff? Without the tutorial it would be useless.
so, thanks Math!
11-08-2011
03:00 PM
Hehe maybe what i said earlier was right Math developed a split personality and hes trolling himself !
Thanks to Math for figuring it out and thanks to whomever leaked it (probably math ) :P
Now if the Rebug Masters come along.....(wishful thinking)
11-08-2011
03:01 PM
11-08-2011
03:02 PM
Math we are all happy here, Thanks!
11-08-2011
03:26 PM
Great news! Now that Math made a tutorial, all we have to do is wait so that Devs make something usable for the end users.
and pleeease stop flaming, insulting people because of their behaviour. "yeah, math this.. math that!" come on!
I agree to him when he says that people are ungrateful (well, not all of us, but some people just can't get enough and want more and more, without ever appreciating what they already have and thanking for that.. :/ )
if math really leaves, the ps3 scene loses a skilled dev.
11-08-2011
03:37 PM
Umm... this is more a trick/technique. How did this get labeled as an exploit? And why would math need to explain something so simple(if not just for the credit)?
11-08-2011
03:39 PM
So my first newspost on PS3Hax is Math's biggest leak. I'm away for 2 hours and all hell broke lose. It great that this exploit is out, but don't like the way how this happend.
Math could have chosen to keep his mouth shut and let people figure everything out, but he decided to explain the whole exploit and I think we should be grateful for that.
This wasn't meant to get out, but got leaked (like many stuff nowadays) anyway, and Math explained it all.
11-08-2011
03:45 PM
let's hope something good comes outa this .
11-08-2011
03:48 PM
on twitter
math saying :
By the way, in that post of mine, I released 2 exploits, that leak only uses one.
11-08-2011
03:49 PM
11-08-2011
03:54 PM
People!!!
Let's create a dedicated thread to just thank and compliment "Math". I think he deserves that level of attention for all the significant contributions he has done for the scene.
(And if that's successful, create other threads for the other 'Hall of Fame' devs!)
Howz that for an idea?!!
11-08-2011
04:01 PM
I do agree that would be a good idea, but then i would only have to infract people(the ones who hate him) for insulting him.
BTW we have one for deank and graf_chokolo
11-08-2011
04:05 PM
11-08-2011
04:12 PM
It is unfortunate that Math is leaving imo. I am no dev, so he could very well be blowing smoke up my ass, but he seems to know his stuff and based off of hear say it is my understanding that he has contributed to the scene via his own work and through various collaborations. I personally have never thanked you Math so here I would like to do so. Thank you for your efforts.
I understand what it is like to be devoted to your work. Although the "scene" to which my work contributes is too massive for me to make a name for myself, I imagine I would still release my work in the situation that the scene showed animosity towards me. Thus I understand why you provided the tut and thank you.
It is my understanding that in all reality the masses who make up the scene may have less to offer you personally in comparison with what you have to offer for them (to include me). However, with all due respect, I can understand you leaving but I think it is important to recognize that you cannot fight fire with fire. You are clearly intelligent and have nothing to prove so stooping down to their level is only going to exacerbate the problem and reel in more hating. Thus your relationship with the scene is just as much your fault as it is theirs.
I hope you realize that your work is very much appreciated by those who understand it's significance but it will be vastly shadowed by the reputation you have built by denouncing the masses which make up the scene. I can imagine I would react the same way you have if I were in your shoes but take it from an outside perspective who has not received countless insults, your work would be that much more respected if you were to simply ignore those who hate and denounce them in that manner as opposed to insulting them. Although on account of the insults you have received I do not hold it against you and wish you luck on whatever it is you intend to do. Take care.
11-08-2011
04:14 PM
i agree he does deserve some thanks just wish he wouldn't leave at the slightest betrayal :\ the scene is already on shaky ground don't need more people leaving
11-08-2011
04:25 PM
Thanks Math.Hope you change your mind and keep contributing to the scene.There are many of us who are not haters.
Anyway now can anyone please confirm if this method is working and what implications it will have in future?
Thanks
11-08-2011
04:26 PM
[MENTION=81039]meth[/MENTION]ieulh
How to pwn metldr the "easy" way
--------------------------------------------------------------------------------
Because some ungrateful person leaked my metldr exploit files I will now be explaining how it actually works, see this as my ultimate release of all times for an ungrateful scene (and scenes in the future)
That's about how I am pissed off right now, because of course the person that leaked these files has no idea of how they actually work.
How to pwn metldr the "easy" way:
This is most likely how geohot exploited it in the first place, this takes (give or take) about 10 minutes to be performed. (yeah, not so much of a "I hacked the ps3 all on my own work", especially not when it partially relies on Segher's work, one of the reason geohot never shared the way he exploited metldr to anyone)
I will assume here, that you do not have the loader keys that were made readily available by geohot. This little tutorial also assumes that you have a working .self generating tool
Now You want to gain code execution to metldr, you know that metldr loads loaders to its own space, but you cannot run a loader because the loader needs to be signed and even though you know about the sign fail that Segher introduced at the CCC, you cannot use it because you don't have decrypted signatures to calculate a private key and to get signatures you need keys which you are currently trying to dump, so far you are stuck in a chicken and egg scenario.
The question is, do you really need keys to get a decrypted signature ?
Well the real answer is no, thanks to a nifty fail that sony left in in metldr (and the bootloader), you can have the ldr to decrypt the metadata for you, isn't that neat ?
Here's how it works:
STEP I)
In a self file, at address 0x0C a value is used to calculate where the metadata is going to be decrypted, the "offset" is at self header + 0x0C
its the "meta header offset" in the SCE structure, it takes the SCE offset + that value, so what you have to do is to have a calculation that is equal to 0x3E01F0 which happens to be where metldr copies over the shared metadata from the mailbox (which is sent over by the ppu), the trick is to have metldr to decrypt the metadata located at.
So basically you have to
1) set the offset += 0x2000
dump shared lsa
and keep increasing 0x2000
until somewhere in the shared lsa changes 0x40 byte
2) when it changes 0x40 bytes, you can add/subtract the proper amount to make it decrypt the proper locations
3) then dump shared lsa and we have decrypted header
knowing that metldr uses SCE header 0xECF0, you could calculate it knowing the address 0x3E01F0 - 0xECF0 = the value you would patch at SCE header + 0x0C
ROM:0000F6C0 D2 68 87 E6 metadata_erk: .int 0xD26887E6 ; DATA XREF: ROM:0000F178o
for example in CECHA , the address you want to decrypt it to is 0x3E1F0
so it should be 0x3E1F0 - 0xF6C0
Once you get the decrypted header, you have the key to decrypt the rest of the metadata. Here you go, you have your decrypted signature.
So far so good, now what's next ?
STEP II)
Contrary to popular beliefs, you do not need to know the public key to calculate the private key, you just need two decrypted signature, you now know how to dump these, so let's assume you just did, now all you have to do is to bruteforce the curve type by constantly reloading a self to metldr, the curve type being only 1 byte, that would be 64 possibilities.
CONGRATULATION, you just signed a loader !
Now what ?
Well Your first reflex would be to sign a loader and use it to dump whatever is in your Isolated Local Store, the first thing you will notice is that you have a bit of metldr's code as a leftover, after a few seconds of disassembly you will figure it's actually some piece of code that clears metldr's code and registers and jumps to some address which is matches your signed loader's entrypoint.
This seems like a more than likely candidate to exploit, as in your goal would be to overwrite that piece of code with your own, that way you would have the whole metldr code right before the point where everything gets cleared out.
Let's try to do just that, from your previous dump, you obviously know that the clear code is located from 0x400 to 0x630, (0x410 being where metldr jumps when it clears) your first attempt would naturally be to have a loader section to load at 0x400, well not so surprisingly, it fails, because you are not without a brain (at least you aren't supposed to be if you're reading and understanding this), you will assume that it is likely that metldr checks if you aren't loading your loader/self section below a certain address, which considering you know the loaders' entrypoint is most likely to be 0x12C00, this assumption is in fact correct as metldr will make sure you cannot load any loader at 0x12BFF and below, seems like a huge let down...
Well, maybe not, because yet again, you are not without a brain, you check out the hardware properties for the Local Store, and you find out that the memory wraps around (memory is a donut as someone once said at some ccc conference).
So what happens when you load your loader at let's say from 0x3F000 to 0x40000+some address? (like 0x40410 for example) ?
Well, it WORKS!
You could put the section at 0x3F000, if you made the length 0x1414 and the last instruction branches "up" to the dump code
ROM:000008AC 33 7F 6C 80 brsl lr, cleanup_and_jump_entry
ROM:000008B0 32 00 11 80 br loc_93C
ROM:00000410 cleanup_and_jump_entry: ; CODE XREF: main+4Cp
ROM:00000410 32 7F FF 80 br sub_40C
this is what the exploit that got leaked (yeah that's not really their work eh but you figured that much by now did you not? ) does.
It overwrites from 0x000 to 0x480 because I originally loaded the section o size 0x880 to 0x3FC00
So now you get code execution on metldr at the best time possible because your code executes right after metldr copies the root keys from 0x00 to 0x30, which means you get to dump these too. (Although they are hardcoded in metldr's code anyway)
Here you go, you have a metldr dump !
Now as a final line, I'd like to say screw leakers, screw the scene, and this is my last contribution to it EVER. It seems I can't even trust fellow developers to keep my work safe and not leaking it. (Not like any of them would have been able to tell you how all this even works in the first place)
So long, everyone.
Remember, don't ever bite the hands that feed you.
P.S. Oh! and btw, if you talented enough to make hardware to dump the shared lsa, you can decrypt any lv0 using this technique.
11-08-2011
04:28 PM
[MENTION=201050]seang[/MENTION] that was posted on the front page over an hour ago......
11-08-2011
04:32 PM
OK this is confirmed real... NOW is the PS3 busted wide open forever and for always?
11-08-2011
04:32 PM
[MENTION=201050]seang[/MENTION] your a bit slow on that ,
11-08-2011
04:39 PM
for me if this stuff actually works and if is 100% confirmed real,it would be more than enough to see only signed eboots,dont care about psn or new cfw just way to play my games on my 3.55 cfw
11-08-2011
04:41 PM
Imho sony is screwed now... Hahaha
11-08-2011
04:42 PM
11-08-2011
04:43 PM
*Random rant about Math and completely unrelated to the leak. ALSO USING CAPS LOCK TO MAKE MY POST SEEM MORE IMPORTANT!!!
But seriously, farewell Mathieulh and thanks for all the fish. Hopefully something good emerges from this leak.
EDIT
Wow [MENTION=165859]consaw[/MENTION] great material for your first post. :/
11-08-2011
04:46 PM
******* my kid seen that picture
11-08-2011
04:48 PM
[MENTION=165859]consaw[/MENTION] you well mature , u must be the other way to even search for that . u dont need to spread on how u feel agaist pocket and greg just cos u want them and they dont want u . keep you fansty in you head . there are kid that read this site
11-08-2011
04:49 PM
ban this [MENTION=165859]consaw[/MENTION] character now, we dont need this kind of sh1t here,and btw delete that idiotic pic he posted,focking retard
11-08-2011
04:50 PM
consaw you should be banned for pornography
it s not legal on this forum
you read the chart a little?
11-08-2011
04:50 PM
That picture needs removing, seriously!
11-08-2011
04:51 PM
WTF? consaw whats wrong with you man?
11-08-2011
04:52 PM
why is he posting his hollydays pics here?
11-08-2011
04:52 PM
11-08-2011
04:53 PM
Dude, you should be banned from the internet..IDIOT!
11-08-2011
04:53 PM
Sorry [MENTION=98976]ginnza[/MENTION] the retard has been banned.
11-08-2011
04:58 PM
so except the drama is the information provided enough for good pancakes?
do we still need blue dongle to play fifa12
11-08-2011
05:00 PM
Yep. Great, big pancakes. Sh.. happens KADO. No pancakes for them. I hope JB2 is dead for good.
11-08-2011
05:05 PM
I'm hoping for a nice, big, juicy news header within the next 10 hours spelling out the 3.72 keys
.
11-08-2011
05:09 PM
BUT I WANT TO BELIEVE!!
11-08-2011
05:15 PM
I wonder what the hardware aspect of this exploit involves? I mean is it of the shelf thats been modified, or complete bespoke for this task.... ?
11-08-2011
05:15 PM
lets wait and see !!!
ps3 is coming to an end
11-08-2011
05:18 PM
I refuse to believe that we are near the end of this dark tunnel. I am in complete denial.
11-08-2011
05:30 PM
its more like ps3 seeing the light after many months in dark
11-08-2011
05:39 PM
My two cents on what this thread was about before it went crazy.
I'm not even sure I should dignify your posts by answering them. And I'm not saying that because of some imaginary French superiority complex !!! 
1st: thanks to Math and to anyone who ever contributed to this exploit if as it sounds it turns out to be a major step in making the ps3 a more open system.
2nd: thanks in advance to the other talented devs who will undoubtedly continue this work.
Lastly, to those who for some reason want to make this about Math's supposed nationality, I mean please, come on, you guys are twelve or what...??
And by the way, I don't care if this was meant to be released or leaked, should have been, shouldn't have been... Now it's out so let's move on.
11-08-2011
06:01 PM
Ok the wheels are back on the scene and we have gotten a push start. Who here knows how to drive ?
Very interested to see where this goes
11-08-2011
06:02 PM
if you get what i mean,
but hopefully somebody can. hopefully.
11-08-2011
06:10 PM
Not gonna get involved in the drama of this thread, Just gonna say Thanks to Math for the method and the explanation, and also for everything that he has done for the scene, argue amongst yourselves whether it's a load or a little, I care not either way, he contributed to the scene and I for one am grateful.
11-08-2011
06:11 PM
Wow, I been trying to find something relevant to the main topic (metldr) but I find lot of insults, non-sense, bs, even religion (wtf?!...what religion has to do with a piece of hardware?!)...
Anyway, I just hope to see more results from this exploit sooner or later (I hope people stop being so ignorant and disrespectful as well, this is why I have been away from the scene lately, Im focusing on my previous project FB Alpha).
SeeYa!
^^
11-08-2011
06:21 PM
Yay, another advancement to the scene which will be discussed for 3-4 days and then join the rest of the useless advancements.
11-08-2011
06:52 PM
This stuff is hard. He is doing what he can.
11-08-2011
07:11 PM
well it works
go get your root key
http://pastebin.com/8ZCqqsQq
im just verifing it works and is safe to use...
thats the dump i got from it fyi
11-08-2011
07:18 PM
but what if you dont have cfw IE i have 3.73
11-08-2011
07:20 PM
11-08-2011
07:23 PM
11-08-2011
07:23 PM
hmmmmm the blame game, devs giving up, sully something doesn't smell right, this could lead to a big treasure.......
)
i dunno if i could speak for the people that silently watches from the side that appreciates all the devs work and test it all out to make it better, but i can speak for myself.
I am a loyal .....firmware user, play games i always wanted and most of all have allot of fun playing (that's what we all want, to play good fun beautiful games at little or no expense, right!!), so lets lay low and see what it coming out for Christmas, okay people :-).
Games i recommend playing (if they work):
-Uncharted 1, 2 and 3
-Batman Arkham Asylum and Arkham City
-Final Fantasy 7 (psx burnt game, use multiman to play)
-Call of Duty 3 (don't like fps games much, but its ok)
-Bionic Commando + both PSN versions :-)
-Hokuto No Ken (Fist of The North Star)
-Castlevania lord of shadows (also play the nes, genesis and snes versions)
-Metal Gear Solid 4 (also try the ps1 version) this is the game i bought my ps3 for, i got it original :-))))))))
-Cursed Crusade (please someone get this to work
-Dark Souls (same as above)
I think that's a hand full and if you like old skool rpg's try Suikoden 2, the first game is a bit of a drag but 2 is better.
Good luck and happy playin guys :-))))
Remember, there are allot of good games that work that you can play in the meantime :-))
God bless y'all
11-08-2011
07:50 PM
11-08-2011
07:54 PM
its just a dump using the exploit, just proving it works
11-08-2011
07:58 PM
(i hope i dont get in trouble for this, but i really wanted to post it)
11-08-2011
07:59 PM
11-08-2011
08:08 PM
So what's next? finding the keys?
11-08-2011
08:10 PM
1 step closer
. credits to math
11-08-2011
08:13 PM
11-08-2011
08:13 PM
was wondering when his e-fame boost was comeing lol, hopefuly this will bring great things for us and boost the ps3 scene. thanks for the realse bro i love you too lololol
dont think youll ever leave us, youd miss us to much lol
11-08-2011
08:16 PM
11-08-2011
08:25 PM
Can't say I am all that sorry to see him go. Whatever he would have made in the future would not influence us all that much as he would probably never release it. Like the past year or so he has hardly released anything of value.
11-08-2011
08:29 PM
guys dont wanna give you the bad news but there will be no pkg to use this stuff its impossible to do in gameos, besides its really not that hard to do just follow the directions. hell theres even a shell script in there..... (i mean some of it is commented out but use common sense and play with it)
in the dump the 1st 3 lines are really important
11-08-2011
08:30 PM
Now back to the topic, hopefully we will have a nice big Christmas/Hanukkah/whatever you celebrate present this year from the devs that are working on this thing.
11-08-2011
08:46 PM
11-08-2011
08:47 PM
guys we need to stop this if this keeps up were going to lose the people that helps us to have a better more expirience about ps3 community we need to help each other
11-08-2011
08:49 PM
yes per console
11-08-2011
08:51 PM
guys dont wanna give you the bad news but there will be no pkg to use this stuff its impossible to do in gameos, besides its really not that hard to do just follow the directions. hell theres even a shell script in there..... (i mean some of it is commented out but use common sense and play with it)
in the dump the 1st 3 lines are really important
11-08-2011
08:52 PM
im just a simple leacher i dont know programing or anything like that so im gratefull for anything that comes to the scene Thx math
11-08-2011
08:53 PM
I am very grateful for what math has done for the scene till now, including this release but seriously dude ur dumb. I mean if this leads to something big you bet ur ass that sony is gona come after you, hard. You could have just let the release be anonymous and even the instructions anonymous but now since you spoke out you are risking a legal battle and maybe jail all for what? for the scene? I dont think being the superman of the ps3 scene is worth all that..
11-08-2011
08:56 PM
whatutalkinboutwillis?
11-08-2011
08:58 PM
11-08-2011
08:59 PM
Basically he is saying if he didn't want to get in any trouble with sony why acknowledge that release of the leaked information as his -_- why not remain silent on the subject and just quietly leave the scene but now if this leads anywhere he pretty much acknowledged it to be his information that was leaked
11-08-2011
09:01 PM
11-08-2011
09:02 PM
I've also heard that root keys are system-specific (i.e. your keys are different than mine), is that the case? What do these keys allow access to? Other keys?
11-08-2011
09:03 PM
Correct me if I am wrong but PCK doesn't really allow singning eboots OUTSIDE of your own console.
You will be able to sign things but specifically for your own system, right?
So in theory everyone who wants newer games will have to dump his root key?
11-08-2011
09:06 PM
11-08-2011
09:08 PM
11-08-2011
09:10 PM
for signing stuff there are other keys which may be hidden somewhere in the ps3.
11-08-2011
09:11 PM
11-08-2011
09:12 PM
^^Idea nothing more thats what i gathered reading the code
11-08-2011
09:16 PM
we will see where the wind takes us, but good things ahead
11-08-2011
09:17 PM
ubuntu 10.10
11-08-2011
09:23 PM
11-08-2011
09:51 PM
This is great news, though an unfortunate way to receive it. I'm sure Mathieulh won't see this, but I'm thankful for what he's done. Despite that people complain that he didn't really release anything, he did give some very helpful information.
I guess I'll have to put linux back on my ps3 so I can get my keys
11-08-2011
09:54 PM
Thank you Math.
lunuxx:
Been using Ubuntu for over 5 years. Using bash and perl daily. What you gonna do with the dump? Never got into decompiling or assembly, but I wanted recently to try ida pro. Also can you upload the dump in raw format rather than a hexdump?
If this dump is system specific could we maybe get two dumps and do a diff?
Glad to see there's a single intelligent person in this thread. Congrats on your intelligence, you're 1 in a million literally.
Also... I'm skilled enough with bash that I could turn that hexdump into binary in less than a minute probably.
Edit: Had to do it just for the challenge...
tail -n +2 dump.txt | cut -b 11-58 | tr -d " \n" | xxd -r -p > output.txt
Screen: http://dl.dropbox.com/u/42660376/Screenshot.png
I has your dumps.
11-08-2011
10:21 PM
http://www.ps3hax.net/showpost.php?p...&postcount=154
Edit: PS, next time use the words "vote for" in stead of "want"
************* [ - Post Merged - ] *************
Nice job to dump it so soon
11-08-2011
10:47 PM
really why not?
and really anyone with a ps3 could run this as well my grandma could prolly run it
11-08-2011
11:03 PM
lunuxx:
Great work doing that dump. To be honest I still don't understand much about this stuff even with the tons of pages I've read. Probably forgot it all after reading some of the incoherent rambling idiots on the various forums crying when there's this great news, but I really should know more with how much I've read.
You're not gonna do anything with the dump you say? Just posting it is huge, maybe someone can make some sense of it. I'm gonna see if I can setup ida pro and maybe use some plugins from ps3devwiki to decompile/disassemble it. It should be ppc code I think. Or maybe that's ppu.
I'm sure I won't be of any help, but maybe I can post something for the regular humans reading forums.
Edit: Can not make anything from this dump. Was hoping I could get some pseudocode from it, but I really don't know what I'm doing. Failed.
11-08-2011
11:57 PM
Soooo, bootloader decryption is possible now???
11-09-2011
12:25 AM
11-09-2011
12:59 AM
keep up the work guys
11-09-2011
01:03 AM
I agree. great work!!
11-09-2011
01:04 AM
The ball's in your court now, ''developers''.
11-09-2011
01:12 AM
Same avatars everywhere...
WHAT IS THIS SORCERY?!
11-09-2011
01:15 AM
11-09-2011
01:31 AM
Ladies and gents can we please give this to the DEV of all time for modern consoles commodore for eva aka c4eva and he will deliver to this scene which noone ever has seen before since geo and math hit the scene....altho many thanks to all their contributions no disrespect there....I am just sayin lets let the elder god of dev work do the final touches instead of his two sons haha :-P
11-09-2011
01:33 AM
hacking drive fw and hacking an entire game system is two different things, if you are going to talk about 360 devs at least talk about ones who do real hacks like gligli or team free60, im no saying he is a bad dev but all he does is drive firmware
11-09-2011
01:44 AM
also, my ps3 has 4 cell processors overclocked to 10 GHZ each, 50gb of ram,
a 500TB hard drive, and can literally make it rain (it shoots flames out the
back too, but i dont want to brag)
11-09-2011
01:46 AM
:D............:D.......:D Thanks Contributors :D
11-09-2011
02:47 AM
So it seems the biggest ****storm is over. Have we decided yet if this (the leaking, and explanation by math) was a good thing or not? :P
11-09-2011
02:58 AM
11-09-2011
03:36 AM
OK. On-topic question:
Can anyone explain what this exploit does and what does it lead to? Simple question.
11-09-2011
03:40 AM
11-09-2011
03:47 AM
11-09-2011
03:51 AM
11-09-2011
04:34 AM
And where it will lead us... Don't think anyone can tell you yet.. just wait and see.
There's a site that explains a lot about the security maybe that will help you (and me) to understand it a bit better.
http://www.edepot.com/playstation3.html#PS3_Security and look for the part about metldr.
11-09-2011
06:11 AM
Now that I think about it, this probably explains how people got Uncharted and Battlefield to work. I see a new CFW in time for xmas
11-09-2011
06:19 AM
And before you ask... no you can't access the dev network without a real Sony developers licence anymore.
11-09-2011
06:28 AM
Also this can't be done with GameOS... start installing OtherOS++ first because the key is console specific. Without OtherOS++ you won't get the key and you need to build the CFW yourself.
[MENTION=12889]Ginko[/MENTION] You are forgetting Linux/OtherOS got removed by $ony? For me this was the reason to hack my PS3. All I wanted was to get back what $ony stole from me, no matter the costs...
I have no problem if someone pirates because of the lack of money btw if they are in a bad situation. But people earning 2ooo+ euro/dollar a month should just buy their games...
11-09-2011
06:28 AM
The price of True Blue on cool2deal just dropped from 99$ to 89$ and now they call it a SALE :D . I believe a few asses are on fire right now.
11-09-2011
06:40 AM
True blue whats that lol
11-09-2011
06:44 AM
a) has the new 3.56+ games;
b) has a PS3 with OtherOS and has the key from Math exploit;
c) will decrypt the 3.56+ games eboots and encrypt them back with 3.55 keys;
d) publishes the eboots.
Am I close or not rly?
11-09-2011
07:13 AM
Would this method work? as long as there is one pwned PS3 out there couldnt we use it to grab the keys from any future OFW ?
11-09-2011
07:25 AM
Never a truer word spoken. Piracy\leechers have been around as long as hackers\crackers - and in the same ratio -
11-09-2011
07:39 AM
Have you ever though that due to what happened to Holtz that he dose not want to give it away under his name. Maybe he has got people thinking it was leaked to keep his name clean.
Food for thought.
11-09-2011
08:20 AM
But what most hackers want to do is to run homebrew applications, and as stated one of the results of that is and always will be piracy; there is nothing a dev can do to stop it, apart from not release.
So yes this leak may enable piracy on almost all consoles, but it will also allow those hackers who want their own homebrew apps to work on newer firmwares, to work. (assuming this leads to unlocking the ps3 completely or even anything at all)
If math is serious about not increasing piracy, he should stop developing hacks, or just keep it to himself and not boast about having done something first. It's not helpful at all, makes everyone hate him.
Just remember that if someone does create something nice with this exploit to still thank math for making it, even though he wasnt going to release it anytime soon
11-09-2011
08:22 AM
11-09-2011
08:23 AM
It sure would be nice if we could get a good ps3 Linux installation guide. I know there probably is one on this site somewhere but there has been lots of improvements lately and could use one that is fully up to date.
11-09-2011
08:29 AM
I wonder why people call my post a tutorial, it's not, it's a technical writeup on how to exploit metldr, with several (brand new) now documented exploits and the explanation on how the leaked .self file works.
It's not some guide on how to use the leaked files themselves (that's just compiling the leaked spp_verifier_direct port and using it to load the self as a loader), It's really about how the exploit works (something only the author of the leaked files would be able to explain) and also about how metldr could be entirely exploited from scratch even without knowing the loader keys with the help of another exploit I disclosed in my post (one the leaked files did not use).
Source
11-09-2011
08:50 AM
Is anyone aware that actually someone (which is also a ps3hax member) already managed to use this stuff successfully and get his root key? Of course not, everyone seem much more interested in flaming and discussing useless stuff..
Props to you [MENTION=190741]lunuxx[/MENTION]
11-09-2011
09:05 AM
As far as I've followed the scene:
1) geohot is the biggest talent, hands down
2) all devs have pirated IDA (it costs about 10k Euro) but only Matieulh was hypocritical enough, to ***** about being oh so against piracy while actually pirating
11-09-2011
09:11 AM
11-09-2011
09:17 AM
:troll:
11-09-2011
09:17 AM
Well Fu***ing done lunuxx
11-09-2011
09:26 AM
11-09-2011
09:31 AM
Wait until it leads to any kind of stuff for the end user... Cause now it means nothing yet for us simpletons.
11-09-2011
09:31 AM
11-09-2011
09:33 AM
349 comments of NOTHING USEFUL!!!!
the exploit is trivial, you need a Pre 3.56 console to have OtherOS++ and linux on it, you only get your UNIQUE key, it does NOT apply to everyone, if you have a 3.56 console your pretty much Fudged at the moment.
11-09-2011
09:33 AM
Ok all the junk/off topic/arguments have been cleared out of this thread.
Any more off topic/fighting or thread derailment will result in a one month suspension, with zero warning, make sure you read this and understand.
You want to talk about math, use this thread:
http://www.ps3hax.net/showthread.php?t=29852
But keep it the hell off the news articles....
To be clear.
THIS THREAD IS ABOUT "Metldr Exploit" NOT MATHIEUL
11-09-2011
09:50 AM
11-09-2011
09:52 AM
I'm quite confused on how exploiting metldr once again (geohot did it ages ago, we even have public keys, what's the point?) could lead to decrypting lv0 / getting boot loader keys. Could somone comment on this.
11-09-2011
09:58 AM
Sent from my iPhone using Tapatalk
11-09-2011
10:07 AM
I cant belive someone has used this already and it works, thats sweet! what hardware was involved? and now you have your console keys, what do you do with them?
11-09-2011
10:08 AM
11-09-2011
10:09 AM
ohai ill tell you guys howto use mathldr
(i like to call it that, its kinda catchy)
this is pretty safe
just dont go crazy with it, your only gonna mess your eid up if you attemp to rehash it and flash or attempt in any way to replace your eid
you can decrypt eid with root keys and static keys in the wiki key page
prerequisites:
1. otheros++ with ss patches (yes the ones that cause trophy errors, just update when you wanna play games again and dont complain)
2. linux on your ps3 (im using ubuntu 10.10)
3. a unpacked copy of your flash (which you can obtain by using glevands dumpflash.pkg gitbrew.org/~glevand/ps3/pkgs/dump_flash.pkg) and an unpacked copy of ofw you will need the following files from these:
metldr
isoldr
RL_FOR_PROGRAM.img
EID0 (you will need to split eid from your flash http://www.ps3devwiki.com/index.php?...s#dump_EID0.sh)
spp_verifier.self
default.spp
and obviously appldr-metldrexploit350.self from the files
3. ps3tools (latest stuff that was for npdrm should work)
4. latest gitbrew linux kernel
5. a desire to quit *****ing and complaining and get off your ass.
6. motivation (see prerequisite #5)
************************************************************************************************************
you can do this over ssh or on console I prefer ssh because my girlfriend likes to watch tv alot.
1. ssh into the ps3
2. download the files
a. wget http://gotbrew.org/metldr838exploit.tar.gz
3. untar the files
a. tar -xvf metldr838exploit.tar.gz
4. enter the directory and compile
a. cd metldr838exploit.tar.gz; make
5 run the following commands now:
insmod ./metldrpwn.ko
cat metldr > /proc/metldrpwn/metldr
cat appldr-metldrexploit350.self > /proc/metldrpwn/mathldr
cat RL_FOR_PROGRAM.img > /proc/metldrpwn/rvkprg
cat eid0 > /proc/metldrpwn/eid0
echo 1 > /proc/metldrpwn/run
cat /proc/metldrpwn/debug
there now you have a dump check it out:
hd /proc/metldrpwn/dump | less
now copy the dump somewhere or youll lose it:
cp /proc/metldrpwn/dump /home/username/
now you have a copy in your home directory for safe keeping
congrats youve completed about < 10 mins of actual work
there you go keys are in 0x00 to 0x20 (first 3 lines)
erk: #
00000000 66 4d ee 51 65 6f 68 28 38 98 83 ea df ea 90 04 |fM.Qeoh(8.......|
00000010 01 f3 79 09 d6 a6 52 d9 ea 6d ef 04 51 69 ec 7b |..y...R..m..Qi.{|
riv:
00000020 7d 6a 3a e5 37 ba 48 4c fe bd 26 5c f5 b1 28 1f |}j:.7.HL..&\..(.|
the first 2 lines are erk the 3rd is riv
and together they are eid0 like captain ****in planet
btw this does not mean you get 3.60 keys etc or newer games but it will help you get some nifty things to do some new stuff.... also please be advised that if you are on 3.60+ you will need to downgrade with a flasher to do this, also if you have a unit that shipped from the factory with the metldr.2 (new metldr) your sol at the moment
oh thanx math
thanx anon leaker
some good reading on the subject:
http://www.ps3devwiki.com/index.php?title=Boot_Order
http://www.ps3devwiki.com/index.php?title=Dev_Tools
http://www.ps3devwiki.com/index.php?title=Flash
http://www.ps3devwiki.com/index.php?title=Talk:Flash
http://www.ps3devwiki.com/index.php?title=IDPS
http://www.ps3devwiki.com/index.php?title=Talk:IDPS
http://www.ps3devwiki.com/index.php?...r_Console_Keys
http://www.ps3devwiki.com/index.php?...r_Console_Keys
http://www.ps3devwiki.com/index.php?...se_Engineering
http://www.ps3devwiki.com/index.php?title=Talk:Keys
http://www.ps3devwiki.com/index.php?...Unit_%28SPU%29
http://www.ps3devwiki.com/index.php?...Unit_%28SPU%29
http://www.ps3devwiki.com/index.php?...se_Engineering
http://www.ps3devwiki.com/index.php?...se_Engineering
11-09-2011
10:10 AM
amazing...:3
11-09-2011
10:18 AM
WOW...what a thread!
Thanks to [MENTION=9827]mathieulh[/MENTION] for the TUT!
Thanks to [MENTION=190741]lunuxx[/MENTION] for the supplemental TUT!
11-09-2011
10:21 AM
so lunuux if this doesnt get you 3.xx key at least we can trick (patch) eboots ( for the sake to play newer games) with it ?
this should be the master key too so dev can start do everything they want with the ps3 on 3.55 i guess too ?
11-09-2011
10:28 AM
In the original post "decrypting lv0" is mentioned:
11-09-2011
10:39 AM
Perfect, thank you!
I am more than happy to have a go at this, in fact, I would Like to have a go at this, as well as other stuff on my ps3 rather than relying on, and pressuring others to do it for me all the time. (although I personally have never asked anyone for anything, just waited until they are ready to release)
Now, I'm obviously not a "Dev", I'm no programmer, I am pretty confident with certain software aspects, very good at following guides, great with hardware, ie soldering etc..
So for the "normal" person like myself, what can I do, once I have followed this guide, and obtained my root keys, myself? can I use these to sign my own games which are meant for 3.60+? I wouldnt know how to yet, but again, eager to learn more so I'm not being spoon fed all the time.
(i see you say it wont allow new games?, what nifty stuff are we talking about?)
Thanks to Math for his hard work, his tut, lunuxx with his layman's tut, and everyone else that is constantly tinkering behind closed doors providing me with the required tools, and knowledge I am not capable of obtaining / creating myself yet.
Rob
11-09-2011
10:48 AM
11-09-2011
10:49 AM
So wait, is the only way to get your per console key via otherOS because i really don't want to spend time fighting to try and install linux on this PS3 for a second time, it didn't work the first time and i have little patience for it, is there not just a .pkg to run that can grab it?
11-09-2011
10:49 AM
no we cant patch eboots, we can already sign for 3.55, but we cant decrypt 3.6x+ eboots (no public method anyway)
root keys or master keys as you refer to them were made public by geohot at the beggining of the year, 3.55 is about as good as it gets for now hence why we have a multitude of homebrew and backup managers amongst other things like the great CFW from the rebug team etc etc
this is probably the same way geohot pwnd metldr the first time round but he never released the method (which is based off glevands spp_verifier and the work from fail0verflow)
as lunuxx said, if your ps3 shipped with 3.56+ and the metldr.2 your SOL!
lvl0 is the next step! lets see who pwns it!
11-09-2011
10:53 AM
Keep up the good work lunuxx!! I am going to try This Weekend Woot..
11-09-2011
11:26 AM
Really wish some people would stick to less technical forums instead of asking ridiculous questions. I can understand the question being asked once or twice...but If one more person asks if this gives cfw or 3.60 keys im going to bite my nails off and knit a jersey with them
How the crap would this exploit bring about the recently released 3.55 signed eboots???
http://www.edepot.com/playstation3.html#PS3_Security
I think someone posted this link earlier (kudos to you dude) and I recommend you read it its an eye opener and a very good solid information source with regards to the ps3 security and what this metldr is and its purpose
11-09-2011
12:00 PM
so, Geohots keys were the public and now are no longer fw356+ good.
can these private per console keys be able to generate a new still usable keyset to tag maybe the newer firmwares after an fw update with a per console keyset based app/dump/keystealer thingamajhu installed prior?
11-09-2011
12:06 PM
so if i (end user) use lunuxx's method to get my own personal key,what do i benifit from?
and how would i use the key?
11-09-2011
12:11 PM
11-09-2011
12:14 PM
Can someone please elucidate what they know regarding eid0 please? I asked this last time we discussed metldr but with no answer. I understand metldr decrypts eid0 and before this we had per_console key 1&2 but what exactly is accomplished, that we are sure of, by decrypting eid0? I understand the answer may be unclear or yet to be determined but what is the speculated role of eid0 and what's the next step in our newly lit path?
Any info is better than none. Thank you. I am speculating devoting a lot of my time to see if I'm capable of learning and contributing to this aspect of the scene but I certainly have a ways to go. Thanks guys.
11-09-2011
12:16 PM
thanks for the reply annelies but i wasnt planning on doing it,im not clever enough for that,i just wanted to know what benifits having my personal key would be.and what i could do with the key.
11-09-2011
12:44 PM
11-09-2011
12:45 PM
*Claps* gratz lunuxx, this one is much easier eh? :P
*/me feels sad for not having the ps3 right now*
11-09-2011
12:53 PM
I agree with annelies on this i will take the wait and see approach until i start doing anything wait until there is an actual goal behind doing this >.<
11-09-2011
01:01 PM
First of all, forgive me for my English.
Obviously, some of you guys (with knowledge of what's going on here) have been pissed off by nonsense questions/comments by users however by the looks of how it is going, I am sure the questions will continue to come. I mean come on, this news is all around the net or at least to those who has been stock with 3.55 CFW. The questions from non devs that rise after this news is pointless to those who knows but with all due respect, end users are so much curious and have no idea what is going on and what to expect. So if one could explain and shed some light in as much details in noob language, things will be much better.
jm2cents
Rgrds
11-09-2011
01:14 PM
freestylemaster: from what I understood so far these keys are not the answer but they lead to the answer (the more important keys). Correct me if I'm wrong anyone.
11-09-2011
01:21 PM
Im just looking on ps3devwiki, looking at security and boot sequence.
I can see from the diagram why people are saying this will not lead to 3.60+ keys..
Is this completely useless? Is it only bootldr and lvl0 that we really want?
oh.. whilst reading, I found this, could somebody please explain it in full detail, it sounds promising, but I'm unsure?
11-09-2011
01:23 PM
[MENTION=204816]freestylemaster[/MENTION]
As you see on the picture we now have access to the metldr. With this, I think if you figure out how, you also have access to all stuff below, so rvkldr, isoldr, appldr, lv2ldr and lv1ldr and with this the next stuff below. If the picture is right, the only thing we don't have access to is bootldr and lv0.
With some time maybe some devs will find some nice things with this access now, because the metldr is above the most other ldrs.
I personally like the fact that it's not possible yet to play 3.56+ games with this or have another cfw. Not because I don't want to play Games which need 3.56+, I want to buy some games which are 3.56+, but just because of the fact that everyone annoy the devs when they can't play the newest games here and now or don't have the newest cfw here and now. I think it's a good way for THIS people to learn that you just can't have everything here and now, and to learn that they shouldn't ever bite the hands that feed them (and also me). And that's a fact because we don't know how it works! I can wait years for this if i have to.
the laughter against Math now sticks in their throat after they have nothing yet, and Math now won't help anymore.
11-09-2011
01:27 PM
PS3 devs = Indiana Jones
3.60+ keys = The Lost Ark
This 'news' = We've just met that bird in her cafe and she's got her dads headpiece.
Oh and Sony = Major Toht
In other words, there's still a lot of story to tell before this is all 'useful' to us mere spectators
11-09-2011
01:29 PM
Yes, absolutely. I think .. I'm sorry .. I KNOW that the quote you put on is the answer to all our questions. The SECH part is not as important, but SEX/SHOP will enable playing even 5.0 FW games (even without the traditional way of jailbreaking). This is also confirmed by a guy I know who works for Sony (PS Security).
Thanks for sharing !!
11-09-2011
01:32 PM
you need 3.55 console
you need on that console otheros++
then install Linux (ubuntoo or whatever)
use the guides to get your unique key
do nothing with that key because at the moment, there is nothing to be done with it.
also* if you have a newer metldr2 machine, dont even bother,
also** if you have a 3.56+ firmware, dont bother. unless you want to progskeet it and downgrade back, then do start at step 1
good?
11-09-2011
01:37 PM
11-09-2011
01:43 PM
11-09-2011
01:49 PM
11-09-2011
01:59 PM
or why not call IBM customer services and ask for the cell root key?
11-09-2011
02:09 PM
11-09-2011
02:41 PM
11-09-2011
02:54 PM
This thread's a mess, can't go through all the posts - can anyone sum up the leak and what it means for the scene in three sentences or less?
11-09-2011
02:58 PM
Ghehe I hope you people know that I was just kiddin :D
[MENTION=100711]Maajid[/MENTION], you don't have to look that hard to find it. Just look at the previous posts ..
11-09-2011
02:59 PM
so i have read the hole comments and i have a question. My ps3 is on firmware 3.72 .i was jailbreak my ps3 in the pass but the psn is a part of my life so i was update my system...now if something new like cfw 3.72 or 3.73 came out one day,im i will be able to install it i mean just like the 3.55 and 3.41 or something like that is not possible ? Somebody that knows something pls let me know. sry for any mistakes guys..haha thts sony when he read this
hahaha nic smile!!
11-09-2011
03:04 PM
Damnit. Doublepost. Delete please ..
11-09-2011
03:08 PM
...
also* if you have a newer metldr2 machine, dont even bother,
also** if you have a 3.56+ firmware, dont bother. unless you want to progskeet it and downgrade back, then do start at step 1"
11-09-2011
03:26 PM
Don't hope for new CFW because it won't happen in a long time, especially with access to PSN.
However we are not so far (in theory at least, if everything goes just as planned) from making signed eboots and thus playing new games on CFW 3.55.
11-09-2011
03:31 PM
ive put the guide on here:
http://www.ps3devwiki.com/index.php?...Dumping_Metldr
if it ever disappears ive put it here as well:
http://gotbrew.org
11-09-2011
03:35 PM
nice guide
11-09-2011
03:36 PM
So am I correct in saying, for the end user, this MAY end up similar to the xbox360 jtag exploit i.e:
Install Linux (xell, xellous) boot to system, extract cpu keys (per console keys)
Open and drop keys into your favorite bootmaker on pc
Flash the nand with said image tailored to the specific system? (pkg or whatever)
Or am I WAY off?
11-09-2011
03:36 PM
Maybe this is what Math was talking about???? :O
11-09-2011
03:37 PM
"P.S. Oh! and btw, if you talented enough to make hardware to dump the shared lsa, you can decrypt any lv0 using this technique. "
I think that will take some time...
11-09-2011
03:40 PM
i total agree with you Albert Wesker
what really needs to be investigated is this tweet: http://twitter.com/#!/Mathieulh/stat...22170719436800
// verify metadata offset is not too big //if (data->self_header->metaOffset >= 0x800) //return 0x20; // (cont) http://tl.gd/e2te63
and this tweet: http://twitter.com/#!/Mathieulh/stat...76434690621441
Oh and btw, if you talented enough to make hardware to dump the shared lsa, you can decrypt any lv0 using this technique/exploit
both of these hints are very interesting. with another self fail we could get later keys. if we dump a decrypted lv0 we get later keys. two ways right there to get later public keys.
11-09-2011
04:18 PM
are bootldr and metldr not encryted with the same key eg the per console key so would this mean once i have my per console key from metldr could i use it to decrypt bootldr ? also from what i can fathom u need hardware to dump bootldr but gitbrew already has a dump of it is it public ? would my key decrypt there dump ? lol that just sounds awesome i know
11-09-2011
04:51 PM
cool so what kinda hardware would i need would it be possible with e3 as my soldering skills are non existant
11-09-2011
04:56 PM
anyways, here is hoping some permanent solution comes out of this.
11-09-2011
05:18 PM
Just a quick question;
I've compiled hex2key (attached) and tried the first 3 hex line lunuxx posted above @231 and basically all I get is the ANSI code converted from hex code. Is this really what hex2key supposed to do? I mean we could easily get this with an hex editor or am I doing something wrong?
Anyone have any idea?
Rgrds
11-09-2011
05:29 PM
i cant do very much on the tv sometimes and id rather not bore everyone in the room by having the tv sit on a black screen fyi
about the hex2key i fixed one and left a note on the wiki so there are 2 links to hex2key the edit is the one i slightly repaired all credit for the app goes to anon for creating it
its supposed to make a binary file
11-09-2011
05:32 PM
11-09-2011
05:39 PM
Can anyone explain what this actually brings? If not for the end user, then the developer. What is now more open that wasn't before. If the flow chart a nice member posted a couple of pages back is to be believed, then nothing?
Slightly confused, as this was talked about as the jewel of PS3 hacking, Not by ignorant people who can't hack like myself, but in news articles on here, psx-scene. (Arguable over if they are any less ignorant than myself but not the point)
So this is nothing then?
11-09-2011
06:28 PM
11-09-2011
06:37 PM
11-09-2011
07:07 PM
Questions (please don't laugh if I sound funny):
1. To what I understand, this could lead to having kernel access to PS3 right?
Since ps2 emu self rely on kernel wouldn't we be able to do exactly what Cobra did in a more ''native way''? Also wouldn't this actually tackle with a hack the checks PS3 does on PS3/PSOne games if the disc you insert is an original disc or a backup?
2. Also since metldr is the head of the whole chain of trust procedure, wouldn't we be able to make modified firmwares with stuff like modified (and funtional) vsh.self and pre-vsh stuff like the PSP plugin loader, without breaking the chain of trust of PS3?
3. Aren't we now able to enable the 8th SPU of PS3 and use it on GameOS?(Don't tell me that it's too dangerous and that by default Sony had dissabled it to tackle production failures, it's not an answer to my question and I already know that)
11-09-2011
07:36 PM
Okay guys, just registered to post this...
". He mentioned this, because if the metldr encryption key is known, then the soft keys can be decrypted. If the soft keys can be decrypted you can exploit the appldr, and have all your backup managers etc, on any firmware.
Metldr (meta loader) is one of the lowest level functions of the P$3. It is a per console, unique, hardware based code... Meaning the one for your console, is only for your console. Each one has its own. I will refer to this as your 'hard key'.
Now, if you remember, back before geohot got sued, he released a set of keys, most important of which (for all your pirates out there), was the appldr (application loader) key. These are public keys, meaning that every P$3 made uses the SAME keys... This is how your P$3 decides whether the .pup (a firmware file [3.55 for example]) is genuine, or fake. These keys are decided by software, and therefore don't physically exist. This means that they can be updated whenever $ony see's fit, and is the reason modern games won't run on old firmwares.
Now, if you also cast your mind back, you'll remember that when geohot was about to get sued, he posted a comment similar to, "So no one STILL knows how I got the metldr keys????
What makes this metldr key so special, is that, unlike the 'soft' keys, no update can be brought out to modify your metldr key. And, so long as you always know your metldr key (which you can do now), you will ALWAYS know your 'soft' keys, which are what 99% of you are here to try and find out.
Put simply:
metldr key = soft keys = cfw
This is why it's taken so long to get past 3.55. Geohot released the 'soft' keys, using his own metldr exploit (one would imagine was very similar, if not identical to this piece of C), but never released the method with which to obtain the metldr key itself. So the soft keys released could be updated, and, as we all know they were, and the system re-secured... Now however, we have full access to decrypt the soft keys, effectively continuing where geohot left off.
I hope that this makes sense to at least a couple of you, and sheds some light as to what this means for the scene, and also why people like math and geo were so reluctant to release these exploits.
Peace...
11-09-2011
07:55 PM
11-09-2011
08:07 PM
I WAS WAITING FOR "THAT ONE POST" WHERE SOMEONE MAKES SENSE ON EXPLAINING WHAT THIS MEANS!
+9001 internets to you. Lurk here more please.
11-09-2011
08:07 PM
There's quite a bit of usefull information beeing shared around here, you just gotta look past the whole mathieu flames.
BTW, thanks master_teee been searching the whole thread for some information of what could be expected from the metldr leak.
11-09-2011
08:08 PM
11-09-2011
08:16 PM
Shoutout to the devs:
If you're working on this now,
be
the ****
careful
This is like asking to be sued.
11-09-2011
08:59 PM
Are you n00bs doing it on purpose or what?? Seems like the 800x109 header isn't big enough. It's really depressing seing those "HAZ CFW 3.7x?" comments every time a new intelligent comment is made.
By the way, props to Master_Teeee for the lamens terms explanation, it really sheds light on Metldr.
11-09-2011
09:09 PM
Does anyone know if this could lead to a 3.72/3.73 Downgrader?
11-09-2011
09:16 PM
11-09-2011
09:39 PM
true but he still owns
11-09-2011
10:04 PM
guys calm down
i just wanna let you all know that all the answers you want are in my post
just read it and also check the links for suggested reading material they will put all your questions to rest
here is everything updated and right:
or on the devwiki:
http://www.ps3devwiki.com/index.php?...Dumping_Metldr
so chill sit back relax open your mind up and read
11-09-2011
10:17 PM
11-09-2011
10:44 PM
this is what Mathieulh said on nother site
and when he says decrypt lv0 is he talking about per console key lv0 or somthing?
11-09-2011
10:47 PM
11-09-2011
10:47 PM
No
11-09-2011
10:58 PM
So the question is how long is it going to take before someone posts 3.60+ decrypted firmware files. That would be the next step to unsigned code on 3.60+ not that it matters much if you try to go online sony will ban you and all we really need is the keys.
11-09-2011
11:20 PM
11-09-2011
11:23 PM
11-09-2011
11:23 PM
11-09-2011
11:53 PM
No I don't work for sony but think about this:
For 3.55 cfw anyone could switch to cfw even people who don't own the ps3 (roomates, kids, friends) so sony wasn't too willing to ban its users when they had a "fix" in the works and once the user is on 3.56+ the issue is gone. Someone dumping their flash and manually modding, resigning, and reflashing is more in depth and a sign that some one was serious about hacking thier ps3 and "should be" banned. (I believe that psn belongs to those who don't have modded games and cheats)
Now if we are talking about a fresh exploit and not true CFW I don't see sony banning
11-10-2011
12:07 AM
Actually that would be cool:
http://www.ps3devwiki.com/index.php?...are#Bootloader
Do you think that this now could get materialized?
11-10-2011
12:20 AM
11-10-2011
12:45 AM
Why can we change it and not sony? doesn't make sence either neither of us can change it or both of us can or am I missing somthing, Is it behind e-fuses but acessible through jtag?
I thought the whole point was once we get the keys from the beginning of the boot process that NO ONE can change we can alter everything from there on which is the entirety of the firmware updates.
11-10-2011
12:56 AM
Maybe i am wrong but i saw here :
That metldr "connects" to appldr.
Appldr has the keys for the eboot fixes.
Then here is the deal:
Someone "hack"/dump/decrypt it, get the keys and releasing eboots.
No need to release keys and get sued by sony, just the eboots.
(i dont think anyone who was releasing only eboots got sued).
And we can play our games, and leave some devs alone to work more.
Maybe i am telling bu********, but thats my poor logic.
11-10-2011
12:56 AM
If noobs cannot understand that post - GTFO! He couldn't have made it clearer than what he wrote. Awesome post.
11-10-2011
01:01 AM
11-10-2011
01:40 AM
So we know the bootldr is encrypted at the factory with the unique per console keys, what is the chance of the decrypted bootldr being the same for each console with the only difference being the keys used to encrypt it? Could if it was ever released by someone with the required hardware to dump it and decrypt it with their matching per console keys be patched and re-encrypted with your own dumped per console key?
11-10-2011
01:46 AM
Think of it like a super advanced with more features Pandora Battery of PSP but for PS3 instead.
11-10-2011
01:51 AM
Hmm, this is super exciting, I don't get much of it now but I have been doing further research into similar things as this, hopefully I will eventually completely understand the whole thing., although I doubt I will ever be able to contribute to something so complex (or at least that's how I see it now). Really really great and exciting stuff. Man I wish I was born in a more technically educated place......FML.
11-10-2011
02:02 AM
whats stopping sony from reading the per console key during an update and changing bootloader? bootloader is on the flash memory so it can be changed and if we can use software to read the key why can't sony?
I love when people say can't because in life almost allways you can no matter what it is as long as your smart and try.
11-10-2011
02:15 AM
[MENTION=13236]VIRGIN KLM[/MENTION] I agree it would be helpful, in fact after posting I realized the easiest way for us to get the 3.6x+ keys safely could be to enable dual booting because we'll have the ability to explore the 3.60 side of the boot from 3.55 side. Thus skipping the need to solder and edit from that end. Also if I'm not mistaken waninkoko released a flash creator that will create a dev_fflash (that will not conflict with dev_flash), I'm guessing that would be a great place to start
11-10-2011
02:48 AM
Lets hope we still have talented people (who havent been pushed away by stupid comments and small children) who can get us somewhere....
11-10-2011
03:37 AM
11-10-2011
03:42 AM
lol [MENTION=205304]hackeyking[/MENTION] and [MENTION=203592]nzie[/MENTION], the user [MENTION=206779]zaeReiroh2[/MENTION] is a spam bot.
11-10-2011
03:44 AM
Must get to grips better with this place!
11-10-2011
03:47 AM
and i was liking his post.lol
11-10-2011
05:21 AM
Quote from PS3Crunch
11-10-2011
05:59 AM
There is most likely a bootrom or a crypto engine that decrypts and load the bootloader/metldr.
another from math
11-10-2011
06:51 AM
So the new thing in this was:
a) how geohot COULD have cracked metldr
b) a hint of "if you're smart enough, you could use this approach to get boot leader keys", something that Matieulh has already said a while ago on a different occasion
11-10-2011
06:52 AM
Original Post from Asure:
There are two exploits released by Math. One is in source code, and dumps metldr. The keys to old-style 3.55 & 3.56 stuff are inside mtldr. If Sony did not go the 'lv0 vault' route, this exploit would still hold true and allow us to decrypt 3.56+. Except, they didn't, and they moved all into LV0. So the first exploit is cool to know how, but fail for us, Sony changed stuff.
From your pictures, did you deduct LV0 replace metldr? If so, do so now. Then, our goal becomes on 3.6x and 3.7x to decrypt lv0.
Since lv0 is encrypted with the same key0 used to encrypt metldr in 3.56+.. we need a second trick to get that private key they used on metldr.
This second trick i don't see in math's .c examples. But he explains it..
STEP II)
Contrary to popular beliefs, you do not need to know the public key to calculate the private key, you just need two decrypted signature, you now know how to dump these, so let's assume you just did, now all you have to do is to bruteforce the curve type by constantly reloading a self to metldr, the curve type being only 1 byte, that would be 64 possibilities.
The explanation Math made before, about how there are two exploits in one, that's about the meta-sploit as he calls it, and the one where you bruteforce a private key.
I was merely pointing out the need for skeet to get bootloader dumped. If we can dump bootloader already by software, i must have missed that. If you can dump it, do so now
You see, if both bootldr and metldr are same key, what prevents us from say, using the same exploit with a dumped bootldr?
We need the two meta results back, to start calculation/brute force. So the original exploit should be modified to also print out the meta data.
If all we need is meta results, we don't even need to run the bootldr. Math explained it all allready, but nobody is reading and i lack C skills
Just get load the ldr, and dump the meta results. All we need to do recycle the exploit example code for metldr. We don't even need execute the code, the bug is in the loading routing which does not check the length.
Once we have dumped metadata for bootldr and metldr, it seems Sony fail in the key0 too, right Math? Otherwise it would not be possible to bruteforce?
11-10-2011
07:09 AM
this is worthless like my penis. im going to find 3.6+ keys by myself.
11-10-2011
07:42 AM
11-10-2011
08:08 AM
No information is worthless, there are only people who cannot use said information.
11-10-2011
08:49 AM
there's new intel floating aroung provided by [MENTION=9827]mathieulh[/MENTION] that surely is extremely helpful..
11-10-2011
09:01 AM
from ps3crunch HERE
Mathieulh post #233
Crunching Developers!
.........................................................................................................................
Originally Posted by TheFrogEater
math do you think ur exploit can be use to get the keys for cfw ?
salut mat il est impossible de t'envoyer un mp donc je te le dis ici, je trouve que t'es vraiment fort et je te remercie pour ton travail aussi bien que récent que passé (psp etc).
tu penses que ca pourrait apporter quoi a plus ou moins long terme ?
.........................................................................................................................
The first one I published can be used in conjunction to a hardware hack to get the bootloader to decrypt lv0 for you, you can also calculate lv0's private key through this, this means you can decrypt lv0, encrypt lv0 using the existing decrypted metdata keys, and sign lv0, you just need to use a ps3 to go through the process of decrypting each lv0 revision though. Know that if you sign lv0 you can also use yet another exploit to gain code execution on the bootloader and dump the keys and be able to decrypt lv0 straight on pc.
Mathieulh post #234
Crunching Developers!
..........................................................................................................................
Originally Posted by Beharii
Math if all the loaders are loaded by lv0 since 3.56+ what's the use of metldr anymore, and is the per_console_key that is obtained from metldr the same as the one from bootldr since in the wiki it is only stated as per console key. I hope you don't mind answering these two questions since I couldn't figure them out in the wiki.
..........................................................................................................................
They are not loaded by lv0 they are simply embeded inside one of the lv0 segment in self format, lv0 copies them to the lv1 loaders' table on the xdr and then lv1 fetches them from ram and loads them through metldr just like on earlier firmwares.
There is a new distinction though, each ldr has its .2 such as appldr.2 which is a new metadata for the loader, if your console happens to have metldr.2, lv1 will feed it the .2 metadata generated with the metldr.2 keysets and private key with the original ldr data sections, metldr.2 will decrypt the *ldr.2 metadata and will use it to decrypt the matching *ldr data sections (so the data section keys match the ones from the original *ldr metadata)
Note that because the signature fail from Segher doesn't work for metldr.2 you cannot use the donut fail to pwn it because you cannot sign your own loader, making the new metldr.2 extreamly hard to exploit (though not impossible, to cut with the suspense it's just the good old metldr with a new keyset, a hardcoded 3.60 min version, compiled with a newer gcc, not much worth exploiting in the first place).
Last edited by Mathieulh; Today at 12:27 PM.
(((((DONT THANK THIS POST AS ITS NOT MY POST. I'M JUST PASSING IT ON)))))
11-10-2011
09:02 AM
[MENTION=177623]baileyscream[/MENTION]
it seems u have been faster then me lol we posted this quotes from Math at same time.
so i will remove my.
Thx again Math for all this great information
11-10-2011
11:14 AM
If Math is the all-seeing oracle of the scene, why don't he just create a PKG file which extracts a per console key to a file that everyone can use?
11-10-2011
11:15 AM
Duplex have just released a proper of MW3. It's not fixed for 3.55 though...Meaning...That they more than likely have NOT found the keys\circumvention method for 3.60+ firmware, and that since they have cracked NPDRM just used the PSN version eboot as a source. So, with this news as METLDR being useless for 3.60 keys...It seems the last few weeks news is all for nothing.
Thought it was kinda relevent in here?
11-10-2011
11:26 AM
************* [ - Post Merged - ] *************
Im a noob but i think im right.
11-10-2011
11:37 AM
to the scene:-
if we all calm down on the math flaming and asking for things from him then we might just see him getting envolved more (myself included)
11-10-2011
12:19 PM
so we can use this to get the key for our ps3
then dump lv0 with hardware and decrypt using the key
as we now have the key we can update
dump lv0 decrypt
then add keys to cfw 3.55
done
now duel boot is neede
11-10-2011
12:37 PM
11-10-2011
12:46 PM
11-10-2011
12:48 PM
y math is still explaning how to use this thing on TWITTER ?
didn t he leave the scene ?
11-10-2011
01:03 PM
11-10-2011
01:04 PM
Apparently since 3.60, the keys have been moved out of METLDR.
11-10-2011
01:09 PM
Its obvious he can talk the talk, but can he walk the walk?
11-10-2011
01:32 PM
11-10-2011
01:38 PM
11-10-2011
01:48 PM
hope u get what i mean .
if anyone else think im wrong then please correct me
11-10-2011
01:51 PM
so why is that hard to get that new cfw?
11-10-2011
01:58 PM
but from all the news recently, all i have been able to gather is once we have that key then we're sorted.
i by no means understand the technical side of things and am not pushing for a release, just trying to gain some knowledge..
so.. if there are already cfws... now we have a key, why can't another be made already?
even if we have to make our own dump and stuff that's cool with me, would love to get more involved, but hey, just wondering what else we actually are waiting for?
11-10-2011
02:01 PM
11-10-2011
02:03 PM
11-10-2011
02:05 PM
we know how to get them but not what to do with them?
11-10-2011
02:10 PM
11-10-2011
02:13 PM
some dev need to step up and make a cfw using that method but no one is brave enough
after what happened with geo hot
11-10-2011
02:20 PM
11-10-2011
02:29 PM
I don't think that people realize the potential power that has been leaked. eventually, people will come to understand it. I know a lot of people want to play online as well as have cfw but why keep pushing for cfw when the ability to be able to play any game regardless of the FW is at our fingertips? Knowledge is power. We need to keep this in mind as we go forth. IMO, making cfw just for the purpose of going online is a waste of time. the possibility of dual booting gives me hope and hopefully soon, finding a way to dual boot otherOs and GameOs would be the stuff.
11-10-2011
02:37 PM
its strange how math said that it was leaked but then explaning how to use it
11-10-2011
02:44 PM
11-10-2011
02:48 PM
From what I've read from one of the devs here it seems that we are able to play 3.56+ games knowing the metldr keys. I mean it leads somehow to 3.55 eboot fixes. Everyone seems to be concentrating on getting the PS3 fully open through bootldr and is not keen on getting those fixes. However I can understand that. If I'm mistaken please correct me.
11-10-2011
02:49 PM
What needs to happen:
1) Get console key on 3.55 (easy to do now that we have a tut). Must be done on 3.55 since we cannot get it in 3.60.
2) Dump bootldr (Now this is something gitbrew managed to do with software(?) this can probably be done in gameOS or otherOS if so). This file is maintained every update and is unaltered to best of my knowledge so if we perform any kind of modification it will carry from FW to FW.
3) Decrypt bootldr with console key.
4) Modify it (create your own, use Math's code as a basis) so it will execute code and dump the lv0 metadata keys. The lines which those are on are within the SELF/SCE Header. (Abuses chain of trust and therefore gives us private keys)
If we can get this far then we can do some damage.
[MENTION=149378]depblkman[/MENTION] We'd run into the private keys along the way so it would lead to CFW. We may be able to decrypt a game faster than making a CFW but key wise we're getting them at the same time.
11-10-2011
03:59 PM
Anyone already see this:http://pastebin.com/8ZCqqsQq
Sorry if it double post.
11-10-2011
04:01 PM
Link fixed...
11-10-2011
04:03 PM
Excuse my "noob" comments and questions, I'm just still a liitle confused.
I'm reading lots of different theories, but some make no sense to me.
According to the diagram on ps3wiki the bootldr, and lvl0 are completely separate from the metldr, surely this exploit does not help us get any closer to bootldr or lvl0?
As for higher firmware cfw, or modified eboots, metldr gives us lv1ldr, lv2ldr, appldr etc...
Ofw 3.55 and below are as above, and we already have the public keys released by geohot, possibly using this exact exploit, allowing us to sign eboots cfw etc.
However, in future firmwares lv1ldr, appldr etc have been moved And weneed lv0ldr / bootldr.
So without those, and without otherOS on higher firmwares surely we can still do nothing without lv0ldr or bootldr?
The way im reading it, and please correct me if I'm wrong, I hope I am, we have gained nothing other than to learn how geohot did what he did, or a similar method, but without any progress from that being possible with this exploit?
11-10-2011
04:17 PM
11-10-2011
04:28 PM
That's the dump that user lunnux has made with the new exploit.
11-10-2011
04:37 PM
11-10-2011
04:38 PM
thats my opinion, i can be wrong, correct me if i am but thats the way i see this whole stuff.
people really need to understand that cfw is no on the horizon, but great things are coming..
11-10-2011
04:40 PM
Not meaning to stray off topic, but eboots have nothing to do with piracy, many people buy the games and hope for an eboot fix.
11-10-2011
04:53 PM
For example 3.72 added a new kernel function for PS2 Classics that would be epicly wanted by everyone and could allow us to play every PS2 game on non-BC consoles.
There are more reasons like the new PSP emu with antialiasing on 960x540 on 3.70 but my point is that there will be firmwares with nice features why not take potential of them? It's sad and a pitty not to... :/
The reason that we hack our PS3 (if we are not pure pirates) it's because we want to push it's functionality off limmits right?
11-10-2011
05:07 PM
[MENTION=13236]VIRGIN KLM[/MENTION] I believe that's true for about 5% of the scene give or take. (Am I lying?) Though I'd personally be a lot happier if I could play some of my PS2 and PSP games on my PS3 through backups
11-10-2011
05:12 PM
The ability is all that matters and being on 3.72 CFW would allow us to...
Or atleast if Math wants to help us without releasing anything, just lead us how we can decrypt the contents of a PS2 classic game so we can acquire the optimized self emu file to understand to keep us busy to understand how it works.
Is that such a big deal?
11-10-2011
06:05 PM
offlimits would be to use your console at its full power gaining control a 100% of your hardware, and this exploit is the tip of that because with the other missing key (i know you know is stored in the bootldr) you would gain control of the chain of trust, letting you run any code that you want after bootldr, how cool is that!
btw in order to build a 3.7x cfw new keys are needed, and as far as i know or at least no one has made it public, no one has succeeded doing that.
so no, no cfw in the near future
11-10-2011
06:25 PM
11-10-2011
06:25 PM
what is it?
11-10-2011
06:30 PM
************* [ - Post Merged - ] *************
11-10-2011
07:34 PM
11-10-2011
07:58 PM
eussNL key:
ERK+RIV:
[eussNL] Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
[eussNL] 0000C740 C0 CE FE 84 C2 27 F7 5B D0 7A 7E B8 46 50 9F 93
[eussNL] 0000C750 B2 38 E7 70 DA CB 9F F4 A3 88 F8 12 48 2B E2 1B
[eussNL] 0000C760 47 EE 74 54 E4 77 4C C9 B8 96 0C 7B 59 F4 C1 4D
[eussNL] 0000C770 04 05 06 07 80 80 80 80 0C 0D 0E 0F 80 80 80 80
[eussNL] 0000C780 FF FF FF FF FF FF FF E0 00 00 00 00 00 00 00 00
PUBLIC:
[eussNL] Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
[eussNL] 0000EC30 C2 D4 AA F3 19 35 50 19 AF 99 D4 4E 2B 58 CA 29
[eussNL] 0000EC40 25 2C 89 12 3D 11 D6 21 8F 40 B1 38 CA B2 9B 71
[eussNL] 0000EC50 01 F3 AE B7 2A 97 50 19 00 00 00 00 00 00 00 00
geohot key :
erk: C0 CE FE 84 C2 27 F7 5B D0 7A 7E B8 46 50 9F 93 B2 38 E7 70 DA CB 9F F4 A3 88 F8 12 48 2B E2 1B
riv: 47 EE 74 54 E4 77 4C C9 B8 96 0C 7B 59 F4 C1 4D
pub: C2 D4 AA F3 19 35 50 19 AF 99 D4 4E 2B 58 CA 29 25 2C 89 12 3D 11 D6 21 8F 40 B1 38 CA B2 9B 71 01 F3 AE B7 2A 97 50 19
R: 80 6E 07 8F A1 52 97 90 CE 1A AE 02 BA DD 6F AA A6 AF 74 17
n: E1 3A 7E BC 3A CC EB 1C B5 6C C8 60 FC AB DB 6A 04 8C 55 E1
K: BA 90 55 91 68 61 B9 77 ED CB ED 92 00 50 92 F6 6C 7A 3D 8D
Da: C5 B2 BF A1 A4 13 DD 16 F2 6D 31 C0 F2 ED 47 20 DC FB 06 70
The mail was sent to ps3crunch on purpose (it is my opinion)
The question is why that value is obtained using a similar result?
Or am I wrong?
11-10-2011
08:11 PM
Sony scrapped the internal emulator on the ps2_emu, they just left it for BC consoles and for a couple stability reasons.
It bundles games with a profile-specificated emulator.
If what you said was true PS3 would recognise the installed PS2 Classics on 3.55 as PS2 Classics or worst case scenario it would say the typical message about PS2 Format Discs on non BC models, but it can't since the important function for recognising PS2 Classics (for advanced users also known as P2 Data Type) is missing on 3.55.
3,55 Has NO CLUE what the hell is this type of data.
Think of it like, let's say 1.35 OFW would recognise a PSP Mini or a game with trophies...
You can't play any game you want on OFW on non-BC consoles, and the ones on PSN are lame.
Also I have zero plans on buying AGAIN a game I own because Sony just decided that it's just ok to milk the cow over and over.
Secondly, I have no plans on giving a peny again to Sony, either if this is a brand new console (not even used, I want to discourage the idea of people buying Sony products in any way) either paying for a PSN game, no way. 3rd, I cannot buy anything from PSN even if I had a second PS3 on OFW because I DO NOT agree with it's TOS.
Now you see why I'm correct.
11-10-2011
09:13 PM
11-10-2011
09:55 PM
http://www.ps3hax.net/showthread.php?t=29763
You may find it interesting! Peace.
11-10-2011
10:18 PM
I have also (well had since it YLOD) a BC machine without the EE and my cousin has one with both EE and GS.
So har I haven't experienced even a tiny difference in emulation between them, the ones that failed on one of them failed on the other one too... SSX for example.
I'm gonna post in your thread some answers on the case since I researched them and I found out why some of these stuff you experienced occured.
I still pray somebody in this scene reallise that there are people who have brain, have heart, and are able to love and thank without being scammers/haters or sucking up.
I hope Math could hear that.
************* [ - Post Merged - ] *************
Also I remember a developer saying that Sony's elf encryption is a joke, this could be what he means...!
11-11-2011
12:43 AM
I would like to make a bootldr but I'm completely against soldering my PS3 (trial and error, could brick PS3 with a bug in bootldr code, so I would have to have a dump to restore to when I screw up and a way for which to do it). I hope someone has steadier hands than I do and a little bit of knowledge in C (one of the easiest languages
).
11-11-2011
01:07 AM
this has been explained in bits and pieces in this thread but here goes:
) and isoldr. Of course all of these loaders are encrypted with a public key (one key decrypts all). These keys are stored inside the metldr.
Up to 3.55:
First thing that's run is the bootldr which is encrypted at factory with your per console key. This means that everyone's bootldr dump will look different because it uses a different key. Before this exploit, there was no
public method to get this key. bootldr then decrypts lv0 using a public key. This means that this key is the same for everyone and thus everyone's lv0 dump will look the same. after the hardware is setup, bootldr and lv0
essentially don't do much else. One important thing to note is the bootldr cannot be updated, while the lv0 is the lowest possible code that can be updated by sony.
After lv0, you have the imfamous metldr that is run. Think of the metldr as a second bootldr as they are similar. They use the same encryption key(per console key) so, like the bootldr, this means two things:
1. It is different for each console
2. Since there was no public method to get this key, it was only able to be decrypted by select few people (e.g. geohot)
After it is decrypted, its job is to load lv1ldr(hypervisor),lv2ldr(gameos),appldr(where the 3.6+ EBOOT keys are
So then what happened?
Well, Geohot found an exploit in metldr which allowed him to obtain the per console key. Instead of releasing how
to obtain your own, he decrypted his own metldr, obtained the public keys for the rest of the loaders and released
them. This allowed complete control over hypervisor(lv1), gameos(lv2) and the EBOOT keys up to 3.55(appldr) which
basically is enough for cfw.
How sony patched it:
Since geohot never released how to obtain the per console key(the key that decrypts metldr and bootldr), or the bootldr public key the bootldr was still not able to be decrypted by the normal person. This means that everything contained inside the bootldr (which is only the lv0) was still secure. so with 3.60+, they moved all the loaders(lv1ldr,lv2ldr,appldr,isoldr) into lv0 (because as i said before lv0 is the very first code that can be updated).
If you haven't figured it out yet:
This leak allows us to get your own per console key. The first thing that needs to be done with this key is actually obtain a bootldr and lv0 dump. This isn't as easy as it sounds because when the hypervisor is loaded, it hides these two from gameos. This would require a full dump of the NOR using a hardware programmer (what math was talking about) containing the bootldr and lv0 (you could also patch the hypervisor to not hide the bootldr, would be easier). Then it's just as simple as decrypting bootldr->lv0>lv1ldr/lv2ldr/appldr->cfw/3.6+ eboot keys. And no sony can't patch this because there's no where else to hide these encrypted loaders as lv0 was the last place that could be updated via firmware update.
11-11-2011
01:10 AM
Just thought I'd add it, but in regards to that eussNL key and geohot key, the same values exist in the exact same offsets in the pastebin link to 'root @ alexus hexdump'.
So, this could indeed be epic fail.
11-11-2011
02:48 AM
[MENTION=206886]j89[/MENTION] you can dump lv0 using gameOS or otherOS. In addition I believe gitbrew managed to dump bootldr from otherOS (this was back in July, and most likely done through a hypervisor patch as you said). But since I haven't really found solid proof that it was done through otherOS or an explanation from them other than a post saying it was accomplished.
Waiting game, lets hope someone has some steady hands to solder and enough intelligence to create a custom bootldr.
11-11-2011
04:16 AM
i just checked pastebin and i saw something
http://pastebin.com/HwkP0Bfg
11-11-2011
05:26 AM
Everything of use has been taken out of METLDR apart from the per console key.
11-11-2011
05:30 AM
11-11-2011
05:43 AM
32.[04:46:01] <Mathieulh> now we just have to load them and fetch the data from the shared LS or the mailbox
sounds like you might just need software to get the ls not hardware after all !!
11-11-2011
07:11 AM
Thanks you sorting this out into understandble words
So the big questions is , are you able to patch the hypervisior and decrypt the loaders? :D
11-11-2011
11:20 AM
Great post j89! That cleared up a lot of confusion for a newb like me.
So we need to patch lv1ldr (hypervisor) so that lv2ldr (gameos) is able to read and dump the bootldr and then decrypt them using the per console key.
I see there is loads of information about hypervisor reverse engineering in the wiki:
http://ps3devwiki.com/index.php?titl...se_Engineering
Where can I download a decrypted hypervisor dump? My PS3 is OFW 3.72 so I can't dump my own
11-11-2011
11:23 AM
if anyone else wants to take a look at the physical dump (not the pastie, the binary file)
http://gotbrew.org/dump
11-11-2011
11:28 AM
so we are near the goal?
11-11-2011
11:30 AM
question does this mean we can now play modern games on cfw ?? =)
11-11-2011
11:32 AM
why ask? if it was so then it would be front paged everywhere, nows the time to get up and start trying to contribute
11-11-2011
11:32 AM
no we must wait before to play modern game
we are maybe near the goal
but we must wait a little more
they are working very hard
11-11-2011
11:33 AM
11-11-2011
11:37 AM
************* [ - Post Merged - ] *************
11-11-2011
12:08 PM
Dudes im waiting too, it´s very hard but with time everything it´s possible, so stop complaining and acting like childs, just wait and suport the devs, don´t ask stupid questions, with lv0 everything it´s unlocked, and btw read the muther****a thread before you muther****a posting!
11-11-2011
12:49 PM
Dear Dev's,
Go further to achieve our goals, push your brain to the limit until "THE FAT and SLIM LADY SING" and than only than all the NOOB's of the scene will see, maybe, how hard is to break those fu...ing codes.
So, my friends, my dear noob's like I am : BE PATIENT, STAY CALM and let them to work, because it is a VERY, VERY, VERY, HARD WORK.
Let's support them.
HOOAH Dev's ! YOU
11-11-2011
01:00 PM
Just think, this is for all the noobs, this will be like the ultimate Christmas gift. Just be patient like a lot of us has been saying for the longest of time and good things will happen.
Sent from my PC36100 using Tapatalk
11-11-2011
01:30 PM
men im truly grateful to GOD that the dev are making a lot of effort so that gamers like us will be given a chance to enjoy the true potential of the ps3 thank you devs =)
11-11-2011
01:45 PM
I hate to burst everyone's bubble but this means nothing. The chain of trust was fixed by moving loaders into lv0.
Until lv0 is either dumped or decrypted, the loaders, and therefore the keys will remain just out of reach. Cold boot exploits are not possible because lv0 sets up the loaders table before passing execution to lv1. Decrypting lv0 requires pwning the bootloader_PE, which is very difficult.
If you could sniff the flexio you might be able to dump it that way. Or you could use what is known about the CBE secure boot to preempt bootldr. I suggest the IBM docs as reading material.
-adrianc
11-11-2011
01:48 PM
....
************* [ - Post Merged - ] *************
11-11-2011
02:02 PM
Metldr has no involvement with decrypting bootldr, for that you require a root key.
-adrianc
11-11-2011
02:19 PM
You've got me curious here as Math seems to be saying that his leaked hack can be applied in principle to a dump a decrypted bootldr\lv0. Does his leaked hack actually provide any practical help with that or is it merely in a philosophical sense in your opinion?
Cheers,
11-11-2011
02:34 PM
you know the one you told us all said you had to remove everything about yourself from the net (inc your twitter acc)
also i thought you were banned from ps3hax for ripping ppl off over the ps3 development unit.
very strange to see you back !!
11-11-2011
02:34 PM
[MENTION=189561]adrianc[/MENTION] is the metldr and bootldr not encrypted with the same key? If so isn't it not entirely possible to sign and encrypt your own bootldr?
[MENTION=177623]baileyscream[/MENTION] Don't start that crap again. That is a completely off topic post take it up somewhere else kthxbye.
[MENTION=101611]baargle[/MENTION] someone needs to explain how the general misconception is wrong first =/ In the case that is, the metldr exploit should still be a good basis for how to make a bootldr exploit. The issue with the bootldr exploit is you need a hardware hack unless there's a way to overwrite the bootldr software wise that I'm not thinking of (entirely possible I guess).
11-11-2011
02:49 PM
[QUOTE=Elegant;280387]
[MENTION=177623]baileyscream[/MENTION] Don't start that crap again. That is a completely off topic post take it up somewhere else kthxbye.[QUOTE]
i'm sorry i thought with this being a news post i was free to greet devs and also inform anyone who doesnt know just what sort of person he is.
that way when he starts contradicting math they know weather or not to trust him.
if thats so wrong than sorry
11-11-2011
03:13 PM
Metldr and bootldr use the same exact console key and this has been the same since the start. If you can Get your per console key(this exploit) you can decrypt the metldr, if you can decrypt the metldr you can decrypt the bootldr(and the lv0 and every other ldr).
11-11-2011
04:53 PM
j89 ,
youre sure ?
11-11-2011
05:10 PM
11-11-2011
05:12 PM
Also your post is off topic and you could receive an infraction for thread derailment, if you want to discuss any thing with [MENTION=189561]adrianc[/MENTION], email him, keep it of this thread.
11-11-2011
07:17 PM
Now adrianc, do you really think clock glitching will work?
lol, smartcards all over again
11-11-2011
11:21 PM
[MENTION=189561]adrianc[/MENTION] But Math did state the keys are in fact hard coded in the metldr.
Also, you said you managed to do a bootldr dump, was this done through GameOS/OtherOS or were you left with no choice but to do a hardware NAND dump? If you managed to do it through GameOS/OtherOS would you be willing to share your secret? I have a NAND console myself and am quite curious how it was done.
11-12-2011
08:04 AM
Lots of conflicting statements from people who all sound plausible...
Someone is talking out their bottom.
11-12-2011
11:51 AM
I wonder if there's anyone working on this right now?
Seems that all the fuss raised up by Matieulh was, after all, unnecessary.
I hope anything will come out of this, but I'm not sure if there's anyone willing to "get their hands dirty" and there's a discussion going on about the utility of this.
A lot of arguments but no test results so far...
11-12-2011
11:56 AM
math has left the scene finnaly
the scene is not big enought for his ego
11-12-2011
03:44 PM
so until we derypt lv 0 were at a standstill again well we can wait
11-12-2011
06:42 PM
[MENTION=186714]rafa11[/MENTION] Someone did test it. It's on the front page. It's what comes next which involves soldering that becomes an issue.
11-12-2011
06:48 PM
and check this out , please :
PS3 bootldr key
http://pastebin.com/pWVav1qK
dont know if its true or not ...
11-12-2011
06:57 PM
11-12-2011
08:52 PM
[MENTION=104132]luqi[/MENTION] [MENTION=139681]bost7[/MENTION]
Each bootldr key is different. It is makes no difference if you find a bootldr key online since it belongs to someone else's console. It will in no way help you. Why? It's a root key belonging to that specific console. That also does not make it fake, it's just useless to you.
Someone did test Mathieulh's exploit that's how someone got their metldr key which is also the bootldr key. I really wish people read. It's what comes after. Knowing the key allows you to decrypt the bootldr and also encrypt a different one. The issue is that you need to solder your PS3 to perform a NAND or NOR dump for the bootldr AFAIK and then replace the bootldr and begin experimenting.
11-13-2011
01:17 AM
11-13-2011
02:35 AM
I actually I take that back... if adrianc is really right then we only got a partial if anything of the real root key and it is mostly hidden from us. Which would mean we use the metldr exploit as a basis for a bootldr exploit. That would take even more fiddling.
11-13-2011
03:28 AM
Edit: just ignore this post.
11-13-2011
07:48 AM
you are totaly wrong do you guys remember ? winocm u know it omg omg omg omg omg omg its jailbroken guy ?
he did jailbreak 3.6.0 with this personal rootkey. but if we want one rootkey for all of us we need to go straight after lv0 becouse this is the deepest we can go.
i cant speak for the new consoles from sony that are not hackable but our consoles with lv0 would be free even for firmware 3.8.0
11-13-2011
11:32 AM
lv0 can be changed its bootldr we need to get control of.
This way we can just tell the system to dump lv0 unencrypted to the usb this way sony cant stop it and we can get the keys from every update
this will still not give you cfw 3.73 ect unless some clever person can put back the exploit.
but you will be able to play games above the 3.55
11-13-2011
12:27 PM
so we have to wait till some dev who is not "selfish'' to do something with this thing
nice good buy present math
thanks and do us all a favor by not coming back
11-13-2011
12:57 PM
@Topic: i'm sure there are some dev's who are working on it at the moment. A higher custom firmware wouldn't be a bad thing, also because Sony announced a 4K update for PS3 but we will see in the future what we will get. I have trust in the devs.
11-13-2011
01:13 PM
didn t understand much
+
nothing really change with him going cuz he doesn t release anything
but there is a lot of smart in the world
11-13-2011
02:19 PM
The so called "root key" that is inside metldr is actually key_1, which is the EID_root_key.
key_0, aka the secure loader key is what is used to encrypt/decrypt metldr and bootldr. This key never leaves the pervasive logic in the cell.
-adrianc
11-13-2011
02:26 PM
So math's exploit doesnt help us at all?
11-13-2011
03:06 PM
-adrianc
11-13-2011
03:20 PM
but the exploit will work on bootldr but we need to hard mod to do it and if we have control of that we have control of lv0 and the keys
correct me if im wrong
11-13-2011
04:20 PM
11-13-2011
04:49 PM
The first exploit I explained in Step I which I called the "meta exploit" is used to trick metldr into decrypting the self metadata in the shared Local Store (which can be accessed from the ppu as it's not isolated)
This exploit works on the bootloader (provided that you can read the shared local store at boot time)
The second exploit explained in step 2 (and used in the leaked files) which I called the "donut exploit" relies on wrapping around the memory to trick metldr into loading a self section onto its own code (and gain code execution), this exploit only works on metldr and doesn't work on metldr.2 because it relies on signing a loader. There is yet another ldr exploit that works on metldr (and metldr.2) and allows to gain code execution but it relies on an hardware implementation flaw and cannot easily be found, because it's not a software exploit (even though it can entirely be triggered by software so long as you at least have code running on the ppu with lv2 privileges)
Mathieulh in ps3crunch
11-13-2011
05:57 PM
first tell me why the hell adrianc is back here ?
then why does maths exploit dosent help us at all ?
11-14-2011
06:23 AM
Just don't get over the guy. If I knew something and couldn't release due to lawsuits I'd just tell someone leaked my work and talk about it. The problem here is you ppl that DON'T understand this and keep calling him drama-queen or something like that. For now, I'm just pissed I got a PS3 as a "surprise" gift and can't put it to CFW 3.55 because it came with OFW 3.66. I can only dual boot now, and I'm not sure I wanna mess with solder and stuff.
11-14-2011
06:51 AM
Happy Birthday PS3
11-14-2011
07:09 AM
I asked PS3 hax in an email the same thing but no reply about adrianc only because I donated
11-14-2011
09:48 AM
think i derail a thread?? i think adrianc is doing just that but as you love dev's (and i say that about this 13 year old lightly) then you wont see him as being in the wrong even if he is contradicting your best bud math! lool your funny sometimes!
11-29-2011
09:35 PM
http://pastie.org/2941787
12-02-2011
03:17 PM
************* [ - Post Merged - ] *************
"Mateulhs exploit" is ONE ****ING YEAR too late. Geohot got us metloader key ONE YEAR AGO.
And no, metloader key is not "the same as bootloader key", WHERE DID YOU GET THAT CRAP?!?!? What you say makes on fluxing sense, why don't you ****ing get a clue before spreading ****ing FUD newb?
12-02-2011
03:27 PM
He actually got it ELEVEN MONTHS AGO, so not quite the year yet, oh and calm down....
12-02-2011
03:32 PM
12-02-2011
03:35 PM
12-02-2011
03:37 PM
12-02-2011
03:40 PM
12-02-2011
03:57 PM
12-02-2011
04:04 PM
Yep, 11 month is not one year and it makes such a difference in this context and is not nitpicking at all...
Actually, nobody, but geohot, did. It took mateulh a year to figure how it could have been obtained originally (and we don't even know if that was based on cluses from hotz) and that is the only alternative finding we know.
Oh, and regarding Matieulh's "lv0 decryptor", note that that is NOT direct evidence of having the key. (build string) He could have named _first byte_ of the _hash_ of the real key, and that would have been really hard proof. However version string is the only "proof" he released, but there are number of other ways of obtaining that.
12-02-2011
04:06 PM
Dongle makers are hardcore.
Everyone else not so hardcore.
12-02-2011
04:16 PM