[ModIt]

Originally Posted by j89 this has been explained in bits and pieces in this thread but here goes: Up to 3.55: First thing that's run is the bootldr which is encrypted at factory with your per console key. This means that everyone's bootldr dump will look different because it uses a different key. Before this exploit, there was no public method to get this key. bootldr then decrypts lv0 using a public key. This means that this key is the same for everyone and thus everyone's lv0 dump will look the same. after the hardware is setup, bootldr and lv0 essentially don't do much else. One important thing to note is the bootldr cannot be updated, while the lv0 is the lowest possible code that can be updated by sony. After lv0, you have the imfamous metldr that is run. Think of the metldr as a second bootldr as they are similar. They use the same encryption key(per console key) so, like the bootldr, this means two things: 1. It is different for each console 2. Since there was no public method to get this key, it was only able to be decrypted by select few people (e.g. geohot) After it is decrypted, its job is to load lv1ldr(hypervisor),lv2ldr(gameos),appldr(where the 3.6+ EBOOT keys are ) and isoldr. Of course all of these loaders are encrypted with a public key (one key decrypts all). These keys are stored inside the metldr. So then what happened? Well, Geohot found an exploit in metldr which allowed him to obtain the per console key. Instead of releasing how to obtain your own, he decrypted his own metldr, obtained the public keys for the rest of the loaders and released them. This allowed complete control over hypervisor(lv1), gameos(lv2) and the EBOOT keys up to 3.55(appldr) which basically is enough for cfw. How sony patched it: Since geohot never released how to obtain the per console key(the key that decrypts metldr and bootldr), or the bootldr public key the bootldr was still not able to be decrypted by the normal person. This means that everything contained inside the bootldr (which is only the lv0) was still secure. so with 3.60+, they moved all the loaders(lv1ldr,lv2ldr,appldr,isoldr) into lv0 (because as i said before lv0 is the very first code that can be updated). If you haven't figured it out yet: This leak allows us to get your own per console key. The first thing that needs to be done with this key is actually obtain a bootldr and lv0 dump. This isn't as easy as it sounds because when the hypervisor is loaded, it hides these two from gameos. This would require a full dump of the NOR using a hardware programmer (what math was talking about) containing the bootldr and lv0 (you could also patch the hypervisor to not hide the bootldr, would be easier). Then it's just as simple as decrypting bootldr->lv0>lv1ldr/lv2ldr/appldr->cfw/3.6+ eboot keys. And no sony can't patch this because there's no where else to hide these encrypted loaders as lv0 was the last place that could be updated via firmware update.

Thanks you sorting this out into understandble words

So the big questions is , are you able to patch the hypervisior and decrypt the loaders? :D