Sponsored Links

Sponsored Links

Page 1 of 2 12 LastLast
Results 1 to 10 of 18



  1. #1
    Senior Member Preceptor's Avatar
    Join Date
    Apr 2008
    Posts
    146
    Sponsored Links

    Graf Chokolo Releases PS3 SELF Decrypter PSGroove Payload

    Sponsored Links
    As a follow-up to his previous work, today graf_chokolo has done it again and posted his code for decryption of PS3 SELF files using appldr.

    Looks like he still can't decrypt game or NPDRMs selfs but soon pehaps.

    Download: Graf Chokolo PS3 SELF Decrypter PSGroove Payload

    To quote from xorloser's blog (linked above): Guys, i promised to you to make my SELF decrypter public. I just uploaded it Let me first explain how it works.

    I used only HV calls in my code because i wanted to learn how to decrypt SELFs without GameOS. The decryption and decompression of SELFs is done by isolated module appldr which is prepared and loaded by lv1_undocumented_function_99. After appldr is loaded it sends a message and waits for your instructions to decrypt some encrypted segments. When the message arrives i pass encrypted segment data to appldr through shared memory and it decrypts the passed data. When the decryption is done the payload sends the decrypted data over network to my PC and i capture it with tcpdump

    I’m using IDA to analyze the decrypted code. First i extract the decrypted segments from pcap dump and load them at right addresses into IDA. I created a shell script to make segment extraction from pcap dumps easier. Virtual addresses of decrypted segments you will find in ELF header.

    The target group of this release are again advanced programers among you. The goal of this release is not to give you a tool for SELF decryption but to show you how it can be done So, feel free to ask me any questions about my code. I will support everyone who wants to port my code and create more user-friendly GameOS applications for SELF decryption because i do not intend to write any GameOS tools I’m more interested in HV reversing.

    My SELF decrypter is not able to decrypt games and NPDRMs yet but i’m working on it I think you will have enough SELFs now to reverse

    I will document my findings about SELF decryption on my HV page in the next days.


    More PlayStation 3 News...
    Attached Files Attached Files
    Last edited by Preceptor; 12-02-2010 at 05:53 PM

  2. #2
    Forum Moderator PS3 News's Avatar
    Join Date
    Apr 2005
    Posts
    28,373
    Sponsored Links
    Sponsored Links
    Thanks for the news Preceptor and +Rep!

  3. #3
    Banned User
    Join Date
    Apr 2007
    Posts
    351
    Sponsored Links
    Sponsored Links
    Damn, lol had similar article nearly written up, then just went looking for a link and seen this, nice one preceptor, you beat me to it!

  4. #4
    Contributor tjay17's Avatar
    Join Date
    Apr 2010
    Posts
    421
    very nice, I can't wait untill it can do games then hopefully I can play my 3.50 games.

  5. #5
    Junior Member solrac1974's Avatar
    Join Date
    Aug 2010
    Posts
    203
    Yeah, Graf Chokolo is running the show right now, keep up the great work!

  6. #6
    Senior Member cfwprophet's Avatar
    Join Date
    Jul 2008
    Posts
    1,815
    German Quality product

    That's one of the interesting things the last days have come out. It's highly possible that this could leak in some intersting modds.

  7. #7
    Banned User corolla0305's Avatar
    Join Date
    Sep 2010
    Posts
    3
    graf_chokolo says: Guys, EBOOT.BINs are SELFs

    Looks like he can decrypt more than Just selfs!!!!

  8. #8
    Senior Member cfwprophet's Avatar
    Join Date
    Jul 2008
    Posts
    1,815
    Thats the problem. Self´s and EBOOT´s are the same. Just renamed from .self to .bin.

  9. #9
    Forum Moderator PS3 News's Avatar
    Join Date
    Apr 2005
    Posts
    28,373
    More graf_chokolo updates: [Register or Login to view links]
    The hardware doesn’t use these ProtectionPages. It’s used only by HV.
    There is still a page table for HV procs that is used by hardware when HV procs accesses memory.

    HV uses these ProtectionPages to copy data to/from HV procs, to translate HV proc address to physical memory addresses because HV procs use virtual memory. HV doesn’t use HTAB of LPAR 1, it’s only used by hardware.

    HV procs use HV syscalls and pass LPAR 1 addresses to HV. But HV use a different memory address apce, so it have to translate passed addresses in order to be able to use it.

    It’s just like copy_from_user on Linux Or copyin and copyout on BSD. Unix rules

    I also extracted all segments from HV dump and imported them at right addresses into IDA.

    The RTOC can be found very easily in code
    E.g. Process 6, look at this snippet of code, RTOC is loaded here

    [Register or Login to view code]

    I don’t know if you know it or not but you can set RTOC in IDA and IDA calculates all the references automatically for you

  10. #10
    Senior Member Mantagtj's Avatar
    Join Date
    Feb 2008
    Posts
    294

    Graf Chocolo Can Now Decrypt PS3 EBOOT.BIN Files

    Reading xorloser's blog tonight this has just appeared: [Register or Login to view links]
    graf_chokolo says:

    Guys, i’m able now to decrypt games, EBOOT.bins I will make my findings public very soon

    Here is a snippet of a game i decrypted:

    [Register or Login to view links]

    Guys, how can i install NP-DRMs on my PS3, i have no clue
    This weekend is just sooo good Congratulations Dude
    Attached Files Attached Files
    Last edited by Mantagtj; 12-04-2010 at 01:55 PM

 

Sponsored Links
Page 1 of 2 12 LastLast
Advertising - Affiliates - Contact Us - PS3 Downloads - Privacy Statement - Site Rules - Top - © 2014 PlayStation 3 News