Team Duplex Releases 20+ PSN Games, PS3 3.66 Encryption Beat
Shortly following the release of NoPDRM for PS3 to re-enable PSN content, PlayStation 3 scene release group Duplex have released 20+ new PSN games including at least one PS3 3.66 encrypted title - God of War: Chains of Olympus.
Those seeking the related PS3 download links can view THIS ongoing thread, and below is a quote from the notes in the God.of.War.Chains.of.Olympus.HD.PSN.PS3-DUPLEX release PS3 NFO File:
Notes: Enjoy another PSN Classic Hit working on CFW 3.55
Due to its size we split the installer package into 2 files suitable for fat32 filesystems ...
1.) copy files to FAT32 USB Key/USB Disk
2.) install game *DUPLEX.*.Install1.pkg
3.) install game *DUPLEX.*.Install2.and.Crack.pkg
4.) install crack *DUPLEX.*.Crack.pkg
Booting of games from v3.6+ (up to v3.73) from special BD-R discs available from official resellers
Runs games up to v3.56 from HDD in conjunction with 'backup managers'
Does not require the Power/Eject trick
Custom v3.55 Dongle firmware behaves like OFW when 'True Blue' is not inserted
Manufactured from highest grade components and Actel based
Durable and high quality metal case design
Tough and durable plastic packaging
Further features to be added as they are developed
On board 2 MBytes SPI flash
Supports Fat and Slim consoles currently running any firmware up to v3.55
And any PS3 which can be downgraded from v3.6+ to v3.55 (NOTE: Requires other tools, 'True Blue' currently can't downgrade a Console)
Supports all regions of consoles
Supports all regions of ISO’s to be released
Rock solid crystal oscillator on board for flawless timing
The 'True Blue' dongle allows booting of the latest the ISO’s (3.6+) from special BD-R discs which can be purchased from all official resellers.
The discs can be burned by any BD-R recorder and there are no special requirements on either PC or BD burner types.
Другие консоли: PSP1004, PS2 (70008), PS3 (80gb), PS3Slim (250gb)
Регистрация: 16.04.2007
Возраст: 40
Сообщений: 2,781
Вы сказали Спасибо: 66
Поблагодарили 599 раз(а) в 427 сообщениях
Сила репутации: 1
Репутация: 601 (луч света в тёмном царстве)
Сообщение от ErikPshat
Team Duplex Releases 20+ PSN Games, PS3 3.66 Encryption Beat
Shortly following the release of NoPDRM for PS3 to re-enable PSN content, PlayStation 3 scene release group Duplex have released 20+ new PSN games including at least one PS3 3.66 encrypted title - God of War: Chains of Olympus.[/url]
Уже почти неделя как все это лежит на трекерах...
сегодня еще появились:
Daytona.USA.PSN.PS3-DUPLEX
OutRun.Online.Arcade.PSN.PS3-DUPLEX
утилита тоже появилась до этого... с десяток своих игр "крякнул" ей... в тех что защита примитивная...
Сообщение от Wes64
Ну в до гонку говорят все таки JB2 правда
да... но писать диски как то не вариант... (только БД диски пашут)
лицуха на донгле на этм не пашет (та что 3.60+) - просит обновить прошивку...
вся фича(как уже писал) в модефецированных eboot-ах.... донгл это в какойто спепени просто "защита" (часть кода в cfw - часть в донгле)
мож найдется кто-нить, кто прикрутит это добро к CFW...
а пака жду завтра бетмана как придет... затем батлу... ну и анчартед 3 на закуску
С чего вдруг привод убиваться будет? о_О
В этом плане,такой привод полностью аналогичен DVD - но DVD же не убивается болванками обычными...
Привод дольше проживет, если его вообще не использовать - это факт)
Другие консоли: PSP1004, PS2 (70008), PS3 (80gb), PS3Slim (250gb)
Регистрация: 16.04.2007
Возраст: 40
Сообщений: 2,781
Вы сказали Спасибо: 66
Поблагодарили 599 раз(а) в 427 сообщениях
Сила репутации: 1
Репутация: 601 (луч света в тёмном царстве)
Сообщение от Spuner
С сторонними BD-дисками, можно быстро убить привод..... Лучше все в HDD заливать - привод дольше проживет.....
в курсе... но тот донгл не поддерживает загрузку с ХДД игр 3.60+
по этой же причине не играю в пс1 игры на пс3... жалко привода... жду и надеюсь пока исо прикрутят или типа того
Сообщение от Allander
С чего вдруг привод убиваться будет? о_О
В этом плане,такой привод полностью аналогичен DVD - но DVD же не убивается болванками обычными...
Привод дольше проживет, если его вообще не использовать - это факт)
современные приводы (для ПК) заточены под работы с болванками - поэтому живут долго. На консолях все с точностью да наоборот...
Сегодня новость прочитала, что выложили документацию на ps3devwiki, как получить ключи per console key 1/n, правда на сайте я не нашла. Может фейк а может и нет. Пишут мол если расшифруют, то 3.70+ кастом не за горами.
http://www.ps3hax.net/2011/10/how-to...-key-released/ - вот эта новость.
Не думаю, что фейк - ибо там же есть ссылки на PS3WikiDev. Другое дело, что пока не могут получить ключи per console key 0 - и не факт, что получится - они сами это пишут. Так что радоваться пока рано.
Похоже что ан0нимы выложили эксплоит Metldr в интернет.
ЦИТАТА
Мы спокойно сидели у компьютера и читали нашу почту, как и каждое утро. Мы спокойно пили кофе, но нам пришлось прервать этот процесс, так как мы получили письмо от "an0nymous" со случайной одноразовой почты, содержащий странную программу прикреплённую к письму, с простым текстом:
Прежде чем размещать эту новость, мы показали данное приложение всем своим разработчикам с сайта PS3Crunch.net, и они сказали, что там находится 'C' код для HEX редактора скомпилированный в ELF и SELF, который использует эксплоит "chain of trust" чтобы сделать dump "незашифрованной" версии metldr на PS3.
Metldr Предполагается что именно там находится волшебный ключ (per_console_key_0)
Похоже что ан0нимы выложили эксплоит Metldr в интернет.
ЦИТАТА
Мы спокойно сидели у компьютера и читали нашу почту, как и каждое утро. Мы спокойно пили кофе, но нам пришлось прервать этот процесс, так как мы получили письмо от "an0nymous" со случайной одноразовой почты, содержащий странную программу прикреплённую к письму, с простым текстом:
Прежде чем размещать эту новость, мы показали данное приложение всем своим разработчикам с сайта PS3Crunch.net, и они сказали, что там находится 'C' код для HEX редактора скомпилированный в ELF и SELF, который использует эксплоит "chain of trust" чтобы сделать dump "незашифрованной" версии metldr на PS3.
"Metldr" Предполагается что именно там находится волшебный ключ (per_console_key_0)
Because some ungrateful person leaked my metldr exploit files I will now be explaining how it actually works, see this as my ultimate release of all times for an ungrateful scene (and scenes in the future)
That's about how I am pissed right now, because of course the person that leaked these files has no idea of how they actually work.
How to pwn metldr the "easy" way:
This is most likely how geohot exploited it in the first way, this takes (give or take) about 10 minutes to be performed. (yeah, not so much of a "I hacked the ps3 all on my own work, especially not when it partially relies on Segher's work, one of the reason geohot never shared the way he exploited metldr to anyone)
I will assume here, that you do not have the loader keys that were made readily available by geohot. This little tutorial also assumes that you have a working .self generating tool
Now You want to gain code execution to metldr, you know that metldr loads loaders to its own space, but you cannot run a loader because the loader needs to be signed and even though you know about the sign fail that Segher introduced at the CCC, you cannot use it because you don't have decrypted signatures to calculate a private key and to get signatures you need keys which you are currently trying to dump, so far you are stuck in a chicken and egg scenario.
The question is, do you really need keys to get a decrypted signature ?
Well the real answer is no, thanks to a nifty fail that sony left in in metldr (and the bootloader), you can have the ldr to decrypt the metadata for you, isn't that neat ?
Here's how it works:
STEP I)
In a self file, at address 0x0C a value is used to calculate where the metadata is going to be decrypted, the "offset" is at self header + 0x0C
its the "**** header offset" in the SCE structure, it takes the SCE offset + that value, so what you have to do is to have a calculation that is equal to 0x3E01F0 which happens to be where metldr copies over the shared metadata from the mailbox (which is sent over by the ppu), the trick is to have metldr to decrypt the metadata located at.
So basically you have to
1) set the offset += 0x2000
dump shared lsa
and keep increasing 0x2000
until somewhere in the shared lsa changes 0x40 byte
2) when it changes 0x40 bytes, you can add/subtract the proper amount to make it decrypt the proper locations
3) then dump shared lsa and we have decrypted header
knowing that metldr uses SCE header 0xECF0, you could calculate it knowing the address 0x3E01F0 - 0xECF0 = the value you would patch at SCE header + 0x0C
ROM:0000F6C0 D2 68 87 E6 metadata_erk: .int 0xD26887E6 ; DATA XREF: ROM:0000F178o
for example in CECHA , the address you want to decrypt it to is 0x3E1F0
so it should be 0x3E1F0 - 0xF6C0
Once you get the decrypted header, you have the key to decrypt the rest of the metadata. Here you go, you have your decrypted signature.
So far so good, now what's next ?
STEP II)
Contrary to popular beliefs, you do not need to know the public key to calculate the private key, you just need two decrypted signature, you now know how to dump these, so let's assume you just did, now all you have to do is to bruteforce the curve type by constantly reloading a self to metldr, the curve type being only 1 byte, that would be 64 possibilities.
CONGRATULATION, you just signed a loader !
Now what ?
Well Your first reflex would be to sign a loader and use it to dump whatever is in your Isolated Local Store, the first thing you will notice is that you have a bit of metldr's code as a leftover, after a few seconds of disassembly you will figure it's actually some piece of code that clears metldr's code and registers and jumps to some address which is matches your signed loader's entrypoint.
This seems like a more than likely candidate to exploit, as in your goal would be to overwrite that piece of code with your own, that way you would have the whole metldr code right before the point where everything gets cleared out.
Let's try to do just that, from your previous dump, you obviously know that the clear code is located from 0x400 to 0x630, (0x410 being where metldr jumps when it clears) your first attempt would naturally be to have a loader section to load at 0x400, well not so surprisingly, it fails, because you are not without a brain (at least you aren't supposed to be if you're reading and understanding this), you will assume that it is likely that metldr checks if you aren't loading your loader/self section below a certain address, which considering you know the loaders' entrypoint is most likely to be 0x12C00, this assumption is in fact correct as metldr will make sure you cannot load any loader at 0x12BFF and below, seems like a huge let down...
Well, maybe not, because yet again, you are not without a brain, you check out the hardware properties for the Local Store, and you find out that the memory wraps around (memory is a donut as someone once said at some ccc conference).
So what happens when you load your loader at let's say from 0x3F000 to 0x40000+some address? (like 0x40410 for example) ?
Well, it WORKS!
You could put the section at 0x3F000, if you made the length 0x1414 and the last instruction branches "up" to the dump code
ROM:000008AC 33 7F 6C 80 brsl lr, cleanup_and_jump_entry
ROM:000008B0 32 00 11 80 br loc_93C
ROM:00000410 cleanup_and_jump_entry: ; CODE XREF: main+4Cp
ROM:00000410 32 7F FF 80 br sub_40C
this is what the exploit that got leaked (yeah that's not really their work eh but you figured that much by now did you not? ) does.
It overwrites from 0x000 to 0x480 because I originally loaded the section o size 0x880 to 0x3FC00
So now you get code execution on metldr at the best time possible because your code executes right after metldr copies the root keys from 0x00 to 0x30, which means you get to dump these too. (Although they are hardcoded in metldr's code anyway)
Here you go, you have a metldr dump !
Now as a final line, I'd like to say screw leakers, screw the scene, and this is my last contribution to it EVER. It seems I can't even trust fellow developers to keep my work safe and not leaking it. (Not like any of them would have been able to tell you how all this even works in the first place)
So long, everyone.
Remember, don't ever bite the hands that feed you.
PS3 DOORS ARE NOW OPEN!
[IMG]http://img194.**************/img194/97/ps3cryptochain.png[/IMG]
ПОШАГОВАЯ ИНСТРУКЦИЯ
ohai ill tell you guys howto use mathldr
(i like to call it that, its kinda catchy)
prerequisites:
1. otheros++ with ss patches (yes the ones that cause trophy errors, just update when you wanna play games again and dont complain)
2. linux on your ps3 (im using ubuntu 10.10)
3. a unpacked copy of your flash (which you can obtain by using glevands dumpflash.pkg gitbrew.org/~glevand/ps3/pkgs/dump_flash.pkg) and an unpacked copy of ofw you will need the following files:
metldr
isoldr
RL_FOR_PROGRAM.img
EID0 (you will need to split eid from your flash http://www.ps3devwiki.com/index.php?…s#dump_EID0.sh)
spp_verifier.self
default.spp
and obviously appldr-metldrexploit350.self from the files
3. latest gitbrew linux kernel
4. a desire to quit *****ing and complaining and get off your ass.
******************************************************************************** **************************************************
you can do this over ssh or on console I prefer ssh because my girlfriend likes to watch tv alot.
1. ssh into the ps3
2. download the files
a. wget http://gotbrew.org/metldr838exploit.tar.gz
3. untar the files
a. tar -xvf metldr838exploit.tar.gz
4. enter the directory and compile
a. cd metldr838exploit.tar.gz; make
5 run the following commands now:
insmod ./metldrpwn.ko
cat metldr > /proc/metldrpwn/metldr
cat appldr-metldrexploit350.self > /proc/metldrpwn/mathldr
cat RL_FOR_PROGRAM.img > /proc/metldrpwn/rvkprg
cat eid0 > /proc/metldrpwn/eid0
echo 1 > /proc/metldrpwn/run
cat /proc/metldrpwn/debug
there now you have a dump check it out:
hd/proc/metldrpwn/dump | less
now copy the dump somewhere or youll lose it:
cp /proc/metldrpwn/dump /home/username/
there you go root keys are in 0×00 to 0×20 (first 3 lines)
example:
root erk: #
00000000 66 4d ee 51 65 6f 68 28 38 98 83 ea df ea 90 04 |fM.Qeoh(8…….|
00000010 01 f3 79 09 d6 a6 52 d9 ea 6d ef 04 51 69 ec 7b |..y…R..m..Qi.{|
root riv:
00000020 7d 6a 3a e5 37 ba 48 4c fe bd 26 5c f5 b1 28 1f |}j:.7.HL..&..(.|
btw this does not mean you get 3.60 keys etc or newer games but it will help you get some nifty things to do some new stuff…. also please be advised that if you are on 3.60+ you will need to downgrade with a flasher to do this, also if you have a unit that shipped from the factory with the metldr.2 (new metldr) your sol at the moment
oh thanx math
Внимание:
Эта инструкция пригодна только разработчикам, простому пользователю она бесполезна.
**WARNING** This will not give you CFW, this is only for advanced users! If you mess up your EID your Playstation 3 will end up as a brick **WARNING**
leal, в конечном итоге получим или новую прошивку или способ запуска новых игр на старых прошивках... в лучшем случае... в худшем громкий скандал в прессе, разбирательства в суде, уход некоторых людей со сцены...
16.07.2008, 12:29
[Флудилка] По поводу взлома PlayStation 3™
(40)
Линейный вид
![C чего начать? ⇒ ⇒ ⇒ [ЧАВО] - ответы на ЧАсто задаваемые ВОпросы](../forum/images/panel_start.png "C чего начать? ⇒ ⇒ ⇒ [ЧАВО] - ответы на ЧАсто задаваемые ВОпросы")
