PS3 Lv0ldr / Bootldr Exploit Reverse-Engineering Details by Naehrwert
Following up on the previous PS3 Lv0ldr / Bootldr clarifications by marcan42 and wololo, today PlayStation 3 hacker naehrwert has shared some details based on reverse-engineering the exploit used to dump it.
To quote from his blog: The Exploit
As the exploit that was used to dump lv0ldr/bootldr/howeveryouliketocallit is public now, letís have a closer look at it to understand whatís going on. Here is what I have reversed from lv0 (it shares the syscon portion of the code with its SPU counterpart):
The syscon library implements some high level functions, e.g. to shutdown the console on panic or to read certain configuration values. Every of this functions internally uses another function to exchange packets with syscon and the exchange function uses the read_cmpl_msg one to get the answer packet. The top-level function will pass a fixed size buffer to the exchange function.
So if we are able to control syscon packets, e.g. by emulating MMIO (and thanks to IBM we are), we can change the packet size between the two packet readings and overwrite the caller stack. And if we first copy a little stub to shared LS and let the return address point to it, we can easily dump the whole 256 kB.
Nothing more left to say now, letís wait and see if this is going to be fixed in future firmware versions (we just have to check lv0 fortunately).
I think this means good news for PS3 Slim 3k users if it is not fake. I really do think there are people who are willing to leak out information just to help people. I have a PS3 Slim 120GB serial CECH-3001A. Originally it came with 3.72 and I accidentally upgraded it to 4.31 which is the current one. I already know that my console cannot be downgraded to 3.55 to use CFW using the current methods.
I hope someone will make some progress with this to help people like me
PS3 3K and 4k series using lv0.2 and this exploit is based on old one which is lv0 (or bootldr as it says)
Here is my official topic about the keys because you have missing keys or because the older version has misstypes. i'm using real legit keys fresh from the ps3 dev wiki 100% working on scetool !!! Thanks all readers
MISSING KEYS !!! CANNOT HAVE THE CFW INSTALLABLE ON 4.XX IF THOSE KEYS ARE MISSING!!!
OK here is list: Lv1-priv-431!!! and all spu_pkg_rvk_verifier keys also missing !!! PLZ IF U FOUND OR HAVE THEM , SEND THEM TO ME AND THE CFW WILL BE MADE IN NO TIME!!!
I tried to make a beta and got error at the msg.xml so i tried to fix it ... then back on ps3 this time dosen't scans it ... i've been extracting-n-pacting on and off 4 you guys ... till it works
OKAY GUYS DOWNLOAD THIS AND PUT IT IN THE MFW KEYS FOLDER