[Флудилка] По поводу взлома PlayStation 3™

[HauB]

Обсуждение взлома PS3
holidayjoy_redribbon.png
Здесь обсуждаем только взлом PS3, выкладываем свои идеи, находки и только достоверную информацию.

Никаких фейков!
Никаких холиваров!
Никаких оскорблений собеседников!

Поддержите тёплую дружественную атмосферу в этой прекрасной теме.



Общий Faq, ориентация по важным темам.

[maggot666x]

Сообщение от akela1979 games 3.60- and 'some' games 3.60+

я б убрал эту строчку, чтобы не вводить людей в заблужбение...

ибо какие нафиг 3.60+ если даже вы пишете, что даже старые игры не пашут

[akela1979]

Despite being reverse engineered by hardcore PS3 developers, the team behind the new jailbreak dongle has released version 2.2, which adds support for playing 3.60+ required games from the HDD -- no longer are you limited to BD-R discs for backups. And if you look at the PS3 Dev Wiki you'll see the True Blue 2.2 update has been ripped apart and analyzed as well. I've attached said update below if you care to poke around yourself ... or if you have True Blue and want to update it.

v2.2 User's Guide: --> TrueBlueUserGuide2_2.pdf (133.9kb)
v2.2 Updater PKG: --> TrueBlueUpdate2_2.zip (544.2kb)
v2.2 Dongle CFW: --> TrueBlue-3.55-CFW.ZIP (170.37mb)
-----------------------------------------------------------------------------
Вытащили Payload (2.2) из True Blue.

Payload (2.2)

located in unself'ed eboot.bin @ offset:

eboot payload Offset(h) Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00008690 00000000 09 02 12 00 01 00 00 80 FA 09 04 00 00 00 FE 01 .......€ú.....þ. ... 0007B588 00072EF0 99 0A 4C 65 2A CE DE D6 0D C8 D2 73 FC B3 85 E2 ™.Le*ÎÞÖ.ÈÒsü³…â

payload2-2.bin (459.75 KB)

SHA1: 69953C9CF60E67E798A22C1016ABCB44A1D42CDF // MD5: F0826BA059B352BC6100647DB7EFDE5F // CRC32: 4B3C2132 // CRC16: 8181

ps3devwiki.com

[Acid_Jack]

На Сцене уже появились первые релизы для TB:
Dirt_3_WORKING_TB_READNFO_PS3-PARADOX
Portal_2_WORKING_TB_READ_NFO_PS3-PARADOX

[akela1979]

ЦИТАТА: @Mathieulh

By the way, I won’t be posting keys, I won’t be posting dumps and I won’t be saying how it was done, time to work gentlemen. ------------------------------------------------------------------------------------------------------------------------------------------------------------- Кстати, я не буду выкладывать ключи, дампы, и не скажу как я этого добился, время поработать джентльмены.

D U P L E X -

bmx11
P R O U D L Y P R E S E N T S :

Driver San Francisco (c) Ubisoft

Date : November 2011 Languages: English
Platform : PS3 CFW 3.55
Genre : Racing

1.) copy files to FAT32 USB Key/USB Disk
2.) install game DUPLEX..install.1.pkg and install.2.pkg
3.) install game DUPLEX..install.3.and.Crack.pkg
4.) run game from xmb

DU P L E X - Notes Since we don't use twitter posting makeself screenshots to brag about our "work", those interested may check out our release Happy Mathieulh ? Oh, and PARADOX please stop rereleasing 100tb of games, when you could only release the needed eboots for the True Blue stick ... ----------------------------------------------------------------------------------------------------------------------- Так как мы не используем twitter для размещения скриншотов makeself, чтобы хвастатьса нашей "работой", заинтересованные лица могут проверить наши релизы Счастлив Mathieulh? А, и PARADOX пожалуйста, прекратите выкладывать 100TB игр, вы моглибы выкладывать только необходимый eboot для True Blue ...

Enjoy This Fine DUPLEX Release

group-DUPLEX

NFO-Скриншот

[IMG]http://img3.**************/img3/6018/nforenderhtmlq.png[/IMG]

-------------------------------------------------------------------------------
Мысли вслух:
Что-то серьезное назревает, чувствую скоро будет долгожданный релиз!!!!...

[maggot666x]

Сообщение от akela1979 Мысли вслух: Что-то серьезное назревает, чувствую скоро будет долгожданный релиз!!!!...

а чего ждем то?

---

з.ы. еще ответ метью

Comix.Zone.PSN.PS3-DUPLEX
Altered.Beast.PSN.PS3-DUPLEX
Golden.Axe.PSN.PS3-DUPLEX
Magic.The.Gathering.Duels.of.the.Planeswalkers.PSN.PS3-DUPLEX
Sega.Rally.Online.Arcade.PSN.PS3-DUPLEX

[akela1979]

Сегодня на ps3hax.net была опубликована интересная новость, но спустя несколько часов была удалена по просьбе автора.
Мне удалось сохранить офлайн версию новости, предоставляю статью разработчикам, ПОВТОРЯЮ РАЗРАБОТЧИКАМ!
Please keep in mind these tools are really only for devs/experienced users

Статья

We just got a very exciting email this morning from anon0 (not to be confused with anonymous group). The email sums up what this leak was very well:

To quote:

Hello PS3 Scene, this is another anonymous leak!

I would like to be called: anon0 to prevent confusion with all the other ‘anonymous’ members

2 months ago, a CEX-to-DEX came out which needed the request-idps.txt

It was all accomplished by .SIG files and ObjectiveSuites, they are encrypted files which carry out specific commands to the PS3

We are now bringing THREE new .SIG files which can be used with 3.73 FW to carry out certain ‘tasks’
Figure what it can do by yourself… And samples of many files can be found there which can aid in 3.73 getting hacked…
To use ObjSuites: Put PS3 in service mode, connect PS3 to PC by ethernet cable, IP Address to 192.168.0.100

Copy files from objcon to root of your usb drive
Start ObjectiveSuites, then power the PS3
All info necessary will be in the temp folder in objectivesuites…

This is a part-of-the-equation of hacking the 3.73

Some notes: I can guarantee something: There are many exploits present when ObjSuites connects to PS3, it forms a trusting bond… ObjSuites gets LV0/LV1 access
Use this with care…

I also bring more detail from an0n, the leaker himself bringing more information and clarification on this leak:

10:44 anonym0us – Okay
10:44 anonym0us – let me explain
10:44 anonym0us – ObjectiveSuites is used in combination with a jig
10:45 anonym0us – It allows more things to be done while PS3 is in service mode
10:45 anonym0us – something like 2 months ago
10:45 anonym0us – There was a leak
10:45 anonym0us – that allowed Retail->Debug
10:45 anonym0us – but it required a person getting request_idps.txt
10:45 anonym0us – from Sony
10:45 anonym0us – It was accomplished by a .SIG file
10:46 anonym0us – .SIG files carry out commands to the PS3
10:46 anonym0us – So
10:46 anonym0us – I got hands on 3 more .SIG files
10:46 anonym0us – Which report all kinds of things about the PS3
10:46 anonym0us – But, there is another thing
10:46 anonym0us – When ObjSuites is used with the PS3 in service mode
10:46 anonym0us – We can exploit the PS3
10:47 anonym0us – Sony never bothered fixing bugs between the ObjSuites-PS3 connection
10:47 anonym0us – Reason?
10:47 anonym0us – The original ObjSuites required a membership to SCEDevNet
10:48 anonym0us – this is cracked
10:48 anonym0us – So
10:48 anonym0us – yeha
10:48 anonym0us – yeah
10:48 anonym0us – thats pretty much it
10:48 anonym0us – When PS3 connects to ObjSuites
10:48 anonym0us – you get LV0/LV1 access
10:48 anonym0us – you get LV0/LV1 access
10:48 anonym0us – So with a bit of tinkering
10:48 anonym0us – You can be sure that you can get the PS3 to do what you want ot
10:48 anonym0us – to*
10:48 anonym0us – And thats pretty much it

Now an0n is claiming that these tools can lead to the holy grail of CFW (which seems to be at version 3.7x currently). Please keep in mind these tools are really only for devs/experienced users and not knowing what you are doing can result in a PS3 brick.

Download Links provided (download n mirror before they are gone!):
o3sig:
ps3/2_mecha:
http://depositfiles.com/files/g2zkn5quc

We got you covered on all the latest scene news, don’t let the other slow places around the scene drag you down! Same tuned for more exclusive news only at PS3Hax

Read more: http://www.ps3hax.net/#ixzz1dzdBeTAy

Насколько я понял нашелся способ полного доступа к 3.73 FW LV0/LV1.
Кстати ps3hax.net в дауне.

[Wes64]

Сообщение от akela1979 Сегодня на ps3hax.net была опубликована интересная новость, но спустя несколько часов была удалена по просьбе автора. Мне удалось сохранить офлайн версию новости, предоставляю статью разработчикам, ПОВТОРЯЮ РАЗРАБОТЧИКАМ! Please keep in mind these tools are really only for devs/experienced users Статья We just got a very exciting email this morning from anon0 (not to be confused with anonymous group). The email sums up what this leak was very well: To quote: Hello PS3 Scene, this is another anonymous leak! I would like to be called: anon0 to prevent confusion with all the other ‘anonymous’ members 2 months ago, a CEX-to-DEX came out which needed the request-idps.txt It was all accomplished by .SIG files and ObjectiveSuites, they are encrypted files which carry out specific commands to the PS3 We are now bringing THREE new .SIG files which can be used with 3.73 FW to carry out certain ‘tasks’ Figure what it can do by yourself… And samples of many files can be found there which can aid in 3.73 getting hacked… To use ObjSuites: Put PS3 in service mode, connect PS3 to PC by ethernet cable, IP Address to 192.168.0.100 Copy files from objcon to root of your usb drive Start ObjectiveSuites, then power the PS3 All info necessary will be in the temp folder in objectivesuites… This is a part-of-the-equation of hacking the 3.73 Some notes: I can guarantee something: There are many exploits present when ObjSuites connects to PS3, it forms a trusting bond… ObjSuites gets LV0/LV1 access Use this with care… I also bring more detail from an0n, the leaker himself bringing more information and clarification on this leak: 10:44 anonym0us – Okay 10:44 anonym0us – let me explain 10:44 anonym0us – ObjectiveSuites is used in combination with a jig 10:45 anonym0us – It allows more things to be done while PS3 is in service mode 10:45 anonym0us – something like 2 months ago 10:45 anonym0us – There was a leak 10:45 anonym0us – that allowed Retail->Debug 10:45 anonym0us – but it required a person getting request_idps.txt 10:45 anonym0us – from Sony 10:45 anonym0us – It was accomplished by a .SIG file 10:46 anonym0us – .SIG files carry out commands to the PS3 10:46 anonym0us – So 10:46 anonym0us – I got hands on 3 more .SIG files 10:46 anonym0us – Which report all kinds of things about the PS3 10:46 anonym0us – But, there is another thing 10:46 anonym0us – When ObjSuites is used with the PS3 in service mode 10:46 anonym0us – We can exploit the PS3 10:47 anonym0us – Sony never bothered fixing bugs between the ObjSuites-PS3 connection 10:47 anonym0us – Reason? 10:47 anonym0us – The original ObjSuites required a membership to SCEDevNet 10:48 anonym0us – this is cracked 10:48 anonym0us – So 10:48 anonym0us – yeha 10:48 anonym0us – yeah 10:48 anonym0us – thats pretty much it 10:48 anonym0us – When PS3 connects to ObjSuites 10:48 anonym0us – you get LV0/LV1 access 10:48 anonym0us – you get LV0/LV1 access 10:48 anonym0us – So with a bit of tinkering 10:48 anonym0us – You can be sure that you can get the PS3 to do what you want ot 10:48 anonym0us – to* 10:48 anonym0us – And thats pretty much it Now an0n is claiming that these tools can lead to the holy grail of CFW (which seems to be at version 3.7x currently). Please keep in mind these tools are really only for devs/experienced users and not knowing what you are doing can result in a PS3 brick. Download Links provided (download n mirror before they are gone!): o3sig: ps3/2_mecha: http://depositfiles.com/files/mfgbyu0qq We got you covered on all the latest scene news, don’t let the other slow places around the scene drag you down! Same tuned for more exclusive news only at PS3Hax Read more: http://www.ps3hax.net/#ixzz1dzdBeTAy Насколько я понял нашелся способ полного доступа к 3.73 FW LV0/LV1. Кстати ps3hax.net в дауне.

LOL это вирус

[ErikPshat]

Да, я тоже подумал, что тему удалили, потому что в архиве троян.

Хотя нет, тему не удалили, они и щас жива: http://www.ps3hax.net/2011/11/exclus...g-to-3-73-cfw/

[Wes64]

Сообщение от ErikPshat Да, я тоже подумал, что тему удалили, потому что в архиве троян. Хотя нет, тему не удалили, они и щас жива: http://www.ps3hax.net/2011/11/exclus...g-to-3-73-cfw/

Ха все таки не вирус

[ErikPshat]

Только я не пойму, что они там выложили ссылку на [Virus Scan], которая ведёт на проверку файла ObjectiveSuites.exe

Хотя заражённый файл совсем другой определяется: PS2_mecha_adj.exe - Trojan.Win32.Inject.bufx

[IMG]http://img257.**************/img257/5489/os3sigps32mecharar.png[/IMG]

Вот новый [Virus Total]

[akela1979]

У меня нет никаких троянов, я даже пытался запустить, не запустился.

[IMG]http://img42.**************/img42/8834/ps2mechaadjexe.jpg[/IMG]

[ErikPshat]

akela1979, а почему у тебя на скриншоте название программы уже другое: PS2E_mecha_adj, когда программа называется PS2_mecha_adj

Мда, опять:

Website Offline, No Cached Version Available The website you are trying to access is currently offline. The most likely causes are the server is down for maintenance, there may be a network problem, or the site may be experiencing excessive load. The site uses CloudFlare in order to help keep it online when the server is down by serving cached copies of pages where they are available. Unfortunately, a cached copy of the page you requested is not available, but you may be able to reach other cached pages on the site. If you continue to receive this error after you believe the site is back online, you can retry a live version of the site.

UPD
Нет, опять заработал )))

[akela1979]

ErikPshat, что то я совсем запутался

[ErikPshat]

Сообщение от ErikPshat Вот новый [Virus Total]

Что-то ваще странное происходит, там показывает:

Kaspersky	9.0.0.837	2011.11.16	-

Хотя у меня на компе тоже Kaspersky, только 12.0.0.374 показывает трояна и сразу без спросу удаляет его прямо из двух архивов RAR и ZIP, т.к. этот экзешник упакован дважды, сначала в ZIP, а потом в RAR.

---

Кстати, по поводу этой ссылки:

Сообщение от akela1979 Download Links provided (download n mirror before they are gone!): o3sig: ps3/2_mecha: http://depositfiles.com/files/mfgbyu0qq

Они оказывается уже удалили трояна и выложили другой архив. Вот что пишут в конце шапки:

These files may harm your PS3. Do not even bother downloading if your a noob and play with these tools at your own risk. The files were originally packaged with a Trojan, which is why as explained here we pulled the story originally. However there still is some legitimacy in these leaked files so we are putting them out there. The files have been cleaned and Trojan has been removed.

А вот новая ссылка: [Download Files Here]

[akela1979]

[IMG]http://img843.**************/img843/73/info01y.jpg[/IMG] [IMG]http://img207.**************/img207/7770/info03.jpg[/IMG]

akela1979 добавил 18.11.2011 в 14:34
нет никаких троянов

[ErikPshat]

akela1979, копирайт я могу в любом экзешнике сменить и иконку логотипа так же.

Ну собственно они сами пишут, что там был троян(может я не правильно понял) и перезалили архив.
Смотри последнюю цитату выше.

Ну и возможно, что это ложное срабатывание, если это действительно оригинальный файл SONY, хотя он мог бы и заразиться на заражённом компьютере пользователя, который его выложил.

[akela1979]

Попытка развязать язык Mathieulh

[22:18:29] <Mathieulh> though I am totally not interested in pwning it
[22:18:37] <Apocalyps> @TECH Send it to me
[22:18:42] <zecoxao> Mathieulh, quick question
[22:18:47] <zecoxao> syscon, owned or not?
[22:18:51] <Mathieulh> luis353, does it look like I code for the money ?
[22:19:00] <Apocalyps> Yes...
[22:19:03] <luis353> no math just asking
[22:19:07] <Mathieulh> zecoxao, yah I pwned that
[22:19:11] <zecoxao> kk
[22:19:20] <zecoxao> i asked Pockets69 to ask you that
[22:19:29] <zecoxao> but he didn't tell me so...
[22:19:32] <Apocalyps> One question
[22:19:35] <randuev> Mathieulh: i undestand why you feel so about this whole ps3 thing, with people like that
[22:19:36] <Mathieulh> easy when sony leave their sc fw key lying around
[22:19:42] <Apocalyps> Can we switch **** loader with Boot loader?
[22:19:44] <zecoxao> :P
[22:19:51] <zecoxao> thanks for the hint
[22:20:02] <Mathieulh> Apocalyps, not if you want to brick
[22:20:07] <Apocalyps> damn
[22:20:11] <Mathieulh> not if you don't want to brick *
[22:20:27] <randuev> Mathieulh: is HW key stored in e-fuses unique in each console?
[22:21:03] <TechnoDon> only xbox has e-fuses
[22:21:25] <Apocalyps> I wish the PS3 scene was as fast and progressing as the 360 scene
[22:21:29] <Mathieulh> randuev, obviously yes
[22:21:42] <Mathieulh> TechnoDon, the ps3 has some too
[22:21:47] <Mathieulh> but they can only be programmed once
[22:21:50] <randuev> Mathieulh: but it's only 48 bits
[22:22:07] <randuev> 2^48 is enough?
[22:22:10] <Mathieulh> randuev, what makes you say that ?
[22:22:25] <randuev> well, i've read in cell docs
[22:22:39] <Mathieulh> it's more than that
[22:22:51] <Mathieulh> and cell docs does not reference everything
[22:22:56] <Mathieulh> that part is NDAed
[22:23:15] <Apocalyps> Wouldn't cell docks only reference the proccessor itself?
[22:23:27] <randuev> that's unfortunate
[22:23:59] <TechnoDon> i have sony 3.73 ofw if that helps..
[22:24:10] <TechnoDon> at Xbo
[22:24:11] <Apocalyps> It doesn't
[22:24:16] <TechnoDon> meh
[22:24:33] <randuev> Mathieulh: did you end up making that hw device to read local storage or 3 exploits were pure software?
[22:24:34] <luis353> math LV2Diag/ObjectiveSuite leaked lead to 3.73 CFW ?
[22:24:39] <randuev> luis353: no
[22:24:51] <Mathieulh> seriously wtf with the noobish questions?
[22:24:55] <Apocalyps> objectivesuite useless without jig
[22:24:56] <TechnoDon> how many times has that been asked now?
[22:25:02] <Mathieulh> randuev, softwate
[22:25:06] <Mathieulh> software*
[22:25:23] <zecoxao> i was more interested in the syscon key
[22:25:26] <Mathieulh> though randuev I suggest you to go the hardware root
[22:25:31] <zecoxao> since i know it's hanging around
[22:25:42] <randuev> Mathieulh: yeah, i am more keen on that as well
[22:25:43] <Mathieulh> zecoxao, then look for it xD
[22:25:54] <randuev> Mathieulh: i like soldering
[22:25:57] <zecoxao> nah, i'm stupid and mentally ill xD
[22:26:00] <Mathieulh> randuev, the sw approach is not easy
[22:26:17] <Mathieulh> it relies on tricking the bl to load more than once
[22:26:31] <zecoxao> that's what xxxxxx said
[22:26:35] <randuev> Mathieulh: no doubt. i was hoping to spy on the bus, but clock is bit too fast for me
[22:26:39] <Mathieulh> xxxxxx ?
[22:26:49] <zecoxao> http://pastebin.com/xkXxk8fM
[22:26:57] <zecoxao> but it wasn't for hw
[22:27:01] <zecoxao> it was for bootldr
[22:27:02] <Mathieulh> randuev, which bus are you looking at
[22:27:04] <Mathieulh> ? *
[22:27:19] <zecoxao> so he's probably wrong
[22:27:37] <randuev> Mathieulh: ram/cell
[22:27:48] <Mathieulh> rofl no wonder then
[22:27:56] <Apocalyps> Another Stupid Question: What exactly is Runtime Secure Boot?
[22:28:01] <Mathieulh> you are messing with the wrong bus
[22:28:09] <Mathieulh> also the xdr clock speed can be descreased
[22:28:12] <Apocalyps> Not really asking for an explanation, but what will it give us
[22:28:33] <Mathieulh> Apocalyps, it allows to load metldr at runtime
[22:28:39] <Mathieulh> it gets decrypted by the crypto engin
[22:28:42] <Mathieulh> and authenticated
[22:28:47] <Mathieulh> and then runs in a secure context
[22:28:50] <Mathieulh> in isolation mode
[22:28:53] <Apocalyps> So we still need to exploit that also, amirite?
[22:28:56] <randuev> heh, i don't have sufficient docage for syscon
[22:29:00] <zecoxao> so, underclock xdr...
[22:29:08] <Mathieulh> Apocalyps, you need to exploit the isolated process
[22:29:21] <Mathieulh> zecoxao, that's a way
[22:29:23] <Mathieulh> there are others
[22:29:36] <DarukBot> (title) [16:41] I think it works [16:41] I mean this is what I th - Pastebin.com
[22:30:07] <Apocalyps> After exploiting the isolated process, we follow up to the authenticatation and decryption of the crypto engine?
[22:30:48] <Apocalyps> In other words, would we need to exploit the process before the isolation?
[22:30:58] <randuev> TechnoDon: you are wasting your time with this dh crap
[22:31:01] <Mathieulh> if you want to go the hw route
[22:31:10] <Mathieulh> do not try to read the shared LS directly
[22:31:56] <randuev> Mathieulh: i am kinda confused about getting reliable readings out of cell cpu especially if local storage indeed is local
[22:32:19] <Apocalyps> but shouldn't hardware authentication step go before it can execute on an isolated SPE? Why not just exploit the hardware unthentication?
[22:32:21] <randuev> without removing covers off the cpu )
[22:32:28] <Mathieulh> randev the LS is only interconnected to the EIB
[22:32:40] <Mathieulh> and the EIB can only be accessed from the ppu
[22:33:07] <randuev> yeah, that's the problem, what to capture if it's all internal
[22:33:08] <Mathieulh> Apocalyps, go for it then
[22:33:21] <Mathieulh> it's not all internal
[22:33:33] <Apocalyps> It would require modifying the hardware. :/
[22:33:37] <Mathieulh> the shared LS can be accessed from the ppu
[22:33:40] <Apocalyps> Useless
[22:33:51] <Mathieulh> but hell, I am saying too much
[22:33:54] <Mathieulh> figure the rest yourselves
[22:34:05] <randuev> Apocalyps: nothing is wrong with hardware tinkering
[22:34:12] <zecoxao> hold on a sec
[22:34:18] <zecoxao> THE Raziel?
[22:34:19] <Apocalyps> Basically the hardware anthentication is just telling the spe that the hardware is tack?
[22:34:23] <randuev> Mathieulh: thanks for tips, i'll try this way
[22:34:29] <Apocalyps> *in tack
[22:34:32] <MajorPSP1> lol
[22:34:34] <_Raziel_> ops
[22:34:41] <_Raziel_> not they but math
[22:34:46] <zecoxao> the one that makes that emu?
[22:34:58] <zecoxao> oh rly?
[22:34:59] <Mathieulh> Apocalyps, there are freaking docs about it written by IBM, I suggest you read them
[22:35:26] <Apocalyps> I'll read them... later
[22:35:47] <MajorPSP1> not jk lol
[22:36:03] <randuev> Mathieulh: about software route, can this all be done from otheros withour reboots of the system?
[22:36:18] <Mathieulh> you need lv1 privs
[22:36:29] <randuev> yeah, that can be patched
[22:36:36] <Mathieulh> not really
[22:36:47] <randuev> i mean in flash with nor flasher
[22:36:54] <Mathieulh> yeah
[22:37:08] <Mathieulh> you can update to a patched lv1
[22:37:10] <zecoxao> nor or nand xD
[22:37:13] <Mathieulh> that is ****ing easy
[22:37:46] <Mathieulh> also the bl fetches lv0 straight from nor
[22:37:49] <Apocalyps> http://www.ibm.com/developerworks/po...y/image002.gif
[22:37:50] <Mathieulh> so you need to write your own
[22:37:57] <Mathieulh> at least on a temporary basis
[22:38:03] <Mathieulh> and the check has to fail
[22:38:05] <randuev> no problem with temporary bricks
[22:38:11] <Mathieulh> otherwise it will overwrite lv1
[22:38:32] <Mathieulh> that is if you get to reload it
[22:38:41] <Mathieulh> which is HARD
[22:39:03] <randuev> yeah, i am not that far into software side unfortunately
[22:39:33] <Apocalyps> So this is secure runtime boot: http://www.ibm.com/developerworks/po...y/image2-3.gif
[22:39:59] <randuev> i was hoping that by malforming lv0 in the right way i could make it write needed info to flash
[22:40:37] <randuev> but if i understand diagrams correctly, everything interesting gets wiped before passing on next lvl
[22:40:53] <Apocalyps> Yes
[22:41:13] <Mathieulh> lv0 "destroys" the spu at some point
[22:41:44] <MajorPSP1> fr rly? lol
[22:42:04] <Mathieulh> well it has to be terminated from ppu side
[22:42:09] <Mathieulh> so err.... yeah
[22:42:16] <Mathieulh> it is done quite early btw
[22:42:43] <Apocalyps> ...
[22:42:52] <randuev> ok, it seems that i have to look at lv0 in ida again
[22:43:08] <Mathieulh> dumped it?
[22:43:09] <randuev> last time it went over head
[22:43:38] <randuev> or maybe it wasn't decrypted
[22:43:58] <Mathieulh> how did you do the dump?
[22:44:17] <Mathieulh> if it's straight from nor, it is encrypted
[22:45:24] <randuev> that must be it
[22:46:11] <zecoxao> TechnoDon, go get the keys lol
[22:46:38] <Apocalyps> Ok?
[22:48:12] <Apocalyps> crack37
[22:48:28] <Mathieulh> CV >>>>>>>>>>> terminate_isolated_spu
[22:48:28] <Mathieulh> CV : error : already normal state
[22:48:28] <Mathieulh> CV : error : stop isolated spu fail
[22:48:28] <Mathieulh> CV >>>>>>>>>>> terminate_isolated_spu finished.
[22:48:28] <Mathieulh>
[22:48:29] <TechnoDon> ?
[22:48:40] <Mathieulh> that's when the bootloader spu is "destroyed"
[22:48:59] <zecoxao> is that on RAM? i believe i saw that on a peek poker once
[22:49:06] <Mathieulh> no way
[22:49:12] <Mathieulh> that's from lv0
[22:49:16] <zecoxao> oh ok
[22:49:24] <zecoxao> i saw something else then
[22:50:22] <Apocalyps> crypto isolation process
[22:51:37] <DarukBot> (title) [C++] #include int main(int argc, char *argv[]){ printf( "n" "break - Pastebin.com
[22:52:31] <Mathieulh> my code had a little more lines (and keys) than that one
[22:52:54] <Apocalyps> How about you post a code? :P
[22:53:46] <Mathieulh> Apocalyps, don't make me look for a hello world
[22:53:55] <Apocalyps> ish dat guy geohotz
[22:54:29] <zecoxao> deroad, Math has posted the lv0 version
[22:54:30] <Apocalyps> Mathieulh, no one is telling you to look for hello world. just something labeled "3.73 keys here"

[maggot666x]

Сообщение от akela1979 Попытка развязать язык Mathieulh [22:18:29]а вот нету тут этого копи-пейста, его смотри выше

трололо разводят

вот, кста еще трололо на логик-санрайс

гугл-перевод+исправления, оригинал по ссылке выше

Известная команда fail0verflow может сделать свое возвращение на 28C3 (Chaos Communication Congress в своем 28-м издании) в Берлине, Германия, которая состоится с 27 по 30 декабря 2011 года. На предыдущем конгрессе, то есть 27C3 (состоялся в декабре), команда fail0verflow сломала безопасность PS3 и впоследствии опубликованы инструменты, которые позволили состоятся появлению CFW. Впоследствии Sony преследовала команду и мы больше ничего не слышал о них ... Пока. По данным последних твитов с командой fail0verflow, можно было бы поэтому думать, что сцена готовися испытать новые PS3 потрясения.

Небольшое напоминание, CCC (Chaos Решения Конгресса речи) является большим собранием хакеров, происходящих в течение 3-4 дней, у них есть все последние сведения для взлома с объяснениями и демонстрациями в форме лекций.

Их первые твиты направляются MathieuLH:

Fail0verflow @ MathieuLH: Успокойся, дорогая, это просто игровая консоль!
MathieuLH @ Fail0verflow: я запомню это, я не люблю ненужные драмы.
Fail0verflow @ MathieuLH: xoxoxoxo <3

Затем через час, новый твит окно:
Не беспокойтесь, мы всего лишь пытаемся "разогреть" двигатель Twitter, чтобы подготовиться к Tweets в декабре ;-)


Случайно ли, что число твитов, по их словам, растет в геометрической прогрессии, месяц пройдет 28C3? Именно поэтому мы подумали, об их участии в 28C3.


Кроме того, не было бы подтверждение MathieuLH об участии команды fail0verflow в 28C3, с твитом обратился к ним:


MathieuLH @ Fail0verflow: В любом случае я не буду присутствовать на CCC, слишком занят в последнее время. : /


Поэтому мы должны ждать, пока онлайн график конгресса, будет ли команда будет участвовать fail0verflow в 28C3, но одно можно сказать наверняка: на PS3 сцене будут проходить потрясения.

[akela1979]

После грозы обычно осторожно выглядывает солнце : )
[IMG]http://img651.**************/img651/962/mis.png[/IMG]

This is the new Metldr dump made by darkvolt dev.
Декриптованный Metldr, естественно по этой инструкции.

[IMG]http://img143.**************/img143/1725/mtdq.th.png[/IMG]

This is what he said

as I work Ill be realeasing more stuff.

saying this is not worthy... hehehe explanation :

We have a decrypted metldr here , if u see it a little u will see is an normal elf without the header.

it contains the root keys that geohot publiseh and a couple of 0x30 addead from 3.50 and ahead , and it STILL USES IT

having the metldr in elf we can put it the header and upload it in anergistic using it as unselfer for loaders!

the metldr is still used in 3.74 ( already exist a dubug ) and 3.73 retail too

the difference of charge is thar before the metldr used to take the files from coreos and now it deliveres them to lv0 via ram and close us the acces to the file BUT WE CAN DECRYPTED IT with the root keys from the metldr added if we have the file....

the lv0 can be decrypted if we fix the of math exploit to charge the bootldr and decrypte the metadata from the header from lv0 and with this decrypte the rest of the spaces with their loaders..

it isn't worthy? hehe

edit to add , if u compare a ISOLDR from 3.55 with the metldr u will realize that they are almost the same , I mean the isoldr contains the updates for the metldr ( virtuals of course )
and that in 3.60+ it also is inside of the lv0 so it can update every time the initial metldr boots with the new couple of keys the already have....

uploading the metldr in anergistic...http://pastie.org/private/2kijry6y7jwoiwsepqqcbq

these are the keys extracted from the Metldr:

erk: CE C0 FE 84 D0 C2 27 F7 5B 7A 46 50 B8 7E 93 B2 9F 38 9F E7 70 F4 DA CB F8 A3 88 E2 1B 2B December 48 riv: 47 EE 74 54 C9 E4 B8 77 4C 96 0C 7B 59 F4 4D C1 pub: C2 D4 AA F3 19 35 50 19 AF 99 D4 4E 2B 58 CA 29 25 2C 89 12 3D 11 D6 21 8F 40 B1 38 CA B2 9B 71 01 F3 AE B7 2A 97 50 19 R: 80 6E 07 8F A1 1A 90 EC 52 97 AE 02 AA BA DD 6F A6 AF 74 17 n: E1 7E BC 3A 3A CC 1C EB C8 60 B5 6C 6A 04 FC 8C DB AB 55 E1 K: BA 90 55 91 68 61 B9 77 ED CB ED F6 92 00 6C 50 92 3D 8D 7A Da: C5 B2 13 DD A4 A1 BF 16 C0 31 6D F2 F2 47 20 DC FB ED June 70

Source

[Rankin]

Это все значит что спецы по безопасности прошивок сони облажались опять?