Mathieulh Explains The Loader Exploit To Obtain 3.60 Application Keys
Mathieulh probably just let the cat out of the bag with his obvious hint to the much talked bug that practically owned future PS3 firmware updates and also the mass growth of warez leechers with the help of 3.60 app keys. Yes, we’re talking about the unstoppable 3.60+ CFWs, you. Provided that Sony won’t release unhackable PS3 consoles in the near future, of course.
X nah, not a single line of code, at least not for the implementation but finding the exploit itself is EASY except no one has gone looking I’ve seen lots of askings and whining, very little looking
if someone who remotely knows spu reversing starts looking he’ll find it at the very worse in a matter of hours the bug is retardly stupid to begin with LV0, EID0, anything with coreOS imo should not be done without a hardwareflasher. Atleast with that you can undo the mess.
yeah I am a bit of a red head here xD you keep saying that, but I suck at SPU assembly
you’d find it even if you fail at it you just need to know where to look just look at how selfs are processed by ldrs and you’ll find it
hell, I’ll help you, it’s about overflowing a certain buffer yes, that is what defyboy and I tried to document in the ps3devwiki : bootprocess and loader locations etc.
well if you know how selfs are processed by loaders, it’s easy
another hint it happens before the ecdsa check my earlier guess btw was that it was a header overflow, which gave access to the local storage
It’s a retarded exploit if you want to know what it is, I’ll tell you the function that copies the SCE header from the shared LS to the isolated Local Store doesn’t check the header’s size \o/
it’s just THAT retarded implementing it isn’t easy though cause loaders have failsafes and header size fail lol but now that you know, you can try it on your own
X1 yes you craft a self with a HUGE header so it overwrites ldr code as it gets copied to the isolated LS and you wait the loader to jump to it lolol must try heh
X1 it’s a total to implement but feel free xD if someone pwns the bl with this and gets the keys, he’ll have my kudos cause finding the exploit is the easy part
Sony’ll fix it now, but it’s not like I care much their “unhackable” ps3s are probably already on the way
Some of the tidbits explaining how big the exploit is in the eyes of SONY’s M.I.B. why would they care about bootldr keys? ps3devnews etc. host metldr keys, appldr keys etc.
X1 cause you can get lv0 decrypted once you get lv0 decrypted you get appldr
once you get appldr you get 3.60 application keys once you get that you warez
also, with those keys you can sign your own lv0, no ps3 fw update can beat you then yah you can have your 3.60+ custom firmware then and warez even more and mess with the psn again and so on
Before you bashing out on me, you need to understand that this could help in some way for those who are still trying to pwn the ldrs and eventually sharing the actual hacks in the process. We know how important the keys are to Sony, so expect an anon release in the future. Hopefully, it can be done.
Mathieulh Explains The Loader Exploit To Obtain 3.60 Application Keys 
yes, file managers and FTP should work fine.
