[PsDev]

First i will be explaining this in a way anyone with basic PS3 knowledge will be able to understand, lets get started.(hehe)

Click here to see full text

the bootldr holds the lv0 yes, the lv0 encapsulate the other ldrs (lv1, lv2, appldr, rvkldr, isoldr, ect.); sense 3.56^. But usually the chain of trust would go like metldr>other ldrs, and the metldr would run the loaders. But after 3.55 the lv0 has been copy the ldrs to the Ram then they are given to the metldr to exucute with out ever being held by the metldr. Now if you use a kernal module you can map out the ps3 real memory Using hardware you can dump Ram. By dumping the ram your getting a decrypted version of lv0 with all the ldrs in it. And you got keys.

Concept in boot order.

Cell INIT-> get encrypted bootldr off NAND/NOR flash, then the Ram will Initialises. This is when it will load the bootldr into a isolated spu, secure boot will decrypt the bootldr and verifies and executes. Now this is where the magic happens. Now the bootldr will decrypt the lv0 and it will get copy to the Ram (With loaders) before the Ram will run the loaders to the metldr


The metldr will always have to boot the ldrs too cause it is per console encrypted sony cant go change that out of no where.

Follow me on twitter at RealPsDev

[autechre]

What the hell ? Is this for real ? Its decrypted to the ram ? Need confirmation as this is holy **** ..... If this is for real ... then you deserve a prize.

[PsDev]

Originally Posted by autechre What the hell ? Is this for real ? Its decrypted to the ram ? Need confirmation as this is holy **** ..... If this is for real ... then you deserve a prize.

well yeah all the ldrs are copy to the ram then gave to the metldr.

[autechre]

then how to dump the ram, through /dev/fmem or other linux software ?

[PsDev]

Originally Posted by autechre then how to dump the ram, through /dev/fmem or other linux software ?

Hardware. You will need skills

[autechre]

Originally Posted by PsDev Hardware. You will need skills

Ah both of which I regrettably lack. But this is very interesting indeed. Excellent work my friend.

[yozh]

well thats the tricky part, the hardware must be sniffin the RAM when th PS is off then when you turn the ps3 on itll dump the data stored on RAM, i guess that process take a few seconds or less.

a lot of skills are needed,

[Pockets69]

ok i will have to apologize for saying its bull... since i have spoken to him i have more of a clear idea of his attempts... and he is no random guy popping out and saying hey look at me... now with that being said... i don't know if that concept is perfect... i mean the ldrs in the ram part and the kernel module to map the ram... what kernel module are you talking about?
if you can elaborate on that??

[PsDev]

Originally Posted by Pockets69 ok i will have to apologize for saying its bull... since i have spoken to him i have more of a clear idea of his attempts... and he is no random guy popping out and saying hey look at me... now with that being said... i don't know if that concept is perfect... i mean the ldrs in the ram part and the kernel module to map the ram... what kernel module are you talking about? if you can elaborate on that??

KaKaRoToKS made one a while back when the ram had the lv1 and lv0 in it. used from same purpose as what I am talking about but know using it (Would need to be changed) would help a little more but still need hardware to dump ram after the real memory is mapped out though. I know there is a much easier way of dumping the lv0 (still hard) But i dont know it
************* [ - Post Merged - ] *************

Originally Posted by Pockets69 ok i will have to apologize for saying its bull... since i have spoken to him i have more of a clear idea of his attempts... and he is no random guy popping out and saying hey look at me... now with that being said... i don't know if that concept is perfect... i mean the ldrs in the ram part and the kernel module to map the ram... what kernel module are you talking about? if you can elaborate on that??

you should move this to news

[TizzyT]

No this shouldn't be moved to news as this is still un-verified. I see that you are trying and open about the method and how its "supposed" to work but I will continue to call bull (no offense just a figure of speech) as using hardware to dump ram from the console is crazy since the XMC controls the clock and I'd figure you would need to somehow sync with that to get a proper dump if one at all. I only did some searching but your method either seems very difficult or almost impossible. Can you go into more detail??? I mean I really would like you to in a sense school me right now lol.