Sponsored Links

Sponsored Links

Page 1 of 3 123 LastLast
Results 1 to 10 of 23



  1. #1
    Senior Member Mantagtj's Avatar
    Join Date
    Feb 2008
    Posts
    294
    Sponsored Links

    PS3 LV2 Loader, METLDR, Application Keys and SHA1 Hashes!

    Sponsored Links
    Today the PS3 LV2 Loader (lv2ldr), METLDR, Application / IV (initialization vector) keys and SHA1 hashes used to verify the keys have been publicly released by various PlayStation 3 developers. Below they are all listed, as follows:

    [Register or Login to view links] released the SHA1 hashes of the different PS3 keys:

    [Register or Login to view links] <-- sha1 hashes for some keys

    [Register or Login to view code]

    [Register or Login to view links] posted the PS3 LV2, PKGs, RVK, ISO, and Application keys (also crediting RichDevX, Graf_Chokolo, N_D_T, and TitanMKD) that can be used to decrypt via the PS3 SELF Crypto / PS3 SELF File Format and Decryption algorithm:

    PS3 0.80 / 3.15 Lv2ldr keys:

    erk: 94303F69513572AB5AE17C8C2A1839D2C24C28F65389D3BBB1 1894CE23E0798F
    riv: 9769BFD187B90990AE5FEA4E110B9CF5

    Decrypts all the External lv2 versions from pre 1.00 to anything below 3.40.

    PS3 3.40 / 3.41 lv2 keys:

    erk (12AB0): 57 5B 0A 6C 4B 4F 27 60 A0 3F E4 18 9E BA F4 D9 47 27 9F D9 82 B1 40 70 34 90 98 B0 8F F9 2C 10
    riv (12AD0): 41 1C B1 8F 46 0C E5 0C AF 2C 42 6D 8F 0D 93 C8

    PS3 0.80 / 3.15 Application loader keys:

    erk-315 79481839C406A632BDB4AC093D73D99AE1587F24CE7E69192C 1CD0010274A8AB
    riv-315 6F0F25E1C8C4B7AE70DF968B04521DDA

    erk 4F89BE98DDD43CAD343F5BA6B1A133B0A971566F770484AAC2 0B5DD1DC9FA06A
    riv 90C127A9B43BA9D8E89FE6529E25206F

    erk AAC20B5DD1DC9FA06A90C127A9B43BA9D8E89FE6529E25206F 8CA6905F46148D
    riv 7D8D84D2AFCEAE61B41E6750FC22EA43

    erk-080 95F50019E7A68E341FA72EFDF4D60ED376E25CF46BB48DFDD1 F080259DC93F04
    riv-080 4A0955D946DB70D691A640BB7FAECC4C

    erk D91166973979EA8694476B011AC62C7E9F37DA26DE1E5C2EE3 D66E42B8517085
    riv DC01280A6E46BC674B81A7E8801EBE6E

    erk F9EDD0301F770FABBA8863D9897F0FEA6551B09431F6131265 4E28F43533EA6B
    riv A551CCB4A42C37A734A2B4F9657D5540

    PS3 0.80 to 0.92 Revision 0 Application loader keys:

    erk-rev0 95F50019E7A68E341FA72EFDF4D60ED376E25CF46BB48DFDD1 F080259DC93F04
    riv-ev0 4A0955D946DB70D691A640BB7FAECC4C

    PS3 0.95 to 3.31 Revision 1 Application loader keys (from and in updaters):

    erk-rev1 79481839C406A632BDB4AC093D73D99AE1587F24CE7E69192C 1CD0010274A8AB
    riv-rev1 6F0F25E1C8C4B7AE70DF968B04521DDA

    PS3 Unknown keys, seem not to be in use:

    erk-unk1
    4F89BE98DDD43CAD343F5BA6B1A133B0A971566F770484AAC2 0B5DD1DC9FA06A
    riv-unk1 90C127A9B43BA9D8E89FE6529E25206F

    erk-unk2 AAC20B5DD1DC9FA06A90C127A9B43BA9D8E89FE6529E25206F 8CA6905F46148D
    riv-unk2 7D8D84D2AFCEAE61B41E6750FC22EA43

    erk-unk3 D91166973979EA8694476B011AC62C7E9F37DA26DE1E5C2EE3 D66E42B8517085
    riv-unk3 DC01280A6E46BC674B81A7E8801EBE6E

    erk-unk4 F9EDD0301F770FABBA8863D9897F0FEA6551B09431F6131265 4E28F43533EA6B
    riv-unk4 A551CCB4A42C37A734A2B4F9657D5540

    He also tweeted the following: In fact it decrypts most of the application selfs the 3.15 appldr key decrypts updaters too Looks like the isolated secure loaders aren't that secure anymore eh ? Looking for the curve list now. Ok so now if you can calculate K You'll also need to use a pre 3.40 lv2ldr but that's kinda obvious. By your lv2 I obviously mean custom firmware (for instance replace lv2_kernel) with a linux kernel. (of course you still need to flash it) Just one last thing, if you decrypt 2 lv2_kernel, you can calculate m then k, if you get k, and the keys I tweeted, you can have your lv2. btw those keys also happen to decrypt the ps2_emu binaries if anyone cares.

    P.S. The self revision is located at 0x00000009 in the self header, it defines the key set in use.

    [Register or Login to view links] released the PS3 METLDR keys:

    PS3 3.41 METLDR keys:

    GG SONY!!!!!

    I'm in your console borrowing your metldr keys

    3.41 kernel keys as semi proof, more to come

    erk(12AB0): 57 5B 0A 6C 4B 4F 27 60 A0 3F E4 18 9E BA F4 D9 47 27 9F D9 82 B1 40 70 34 90 98 B0 8F F9 2C 10
    riv(12AD0): 41 1C B1 8F 46 0C E5 0C AF 2C 42 6D 8F 0D 93 C8

    Finally, [Register or Login to view links] also shared geoldr, to quote:

    Happy New Year!

    Run this as a 2nd stage from metldr. Listen for mail

    As usual, there are no release dates ever. But pretty cool eh? It's a real loader.

    PS3 LV2 Loader, METLDR, Application Keys and SHA1 Hashes!

    More PlayStation 3 News...
    Attached Files Attached Files

  2. #2
    Contributor boybergamo76's Avatar
    Join Date
    Sep 2007
    Posts
    7
    Sponsored Links
    Sponsored Links
    there are the real keys? O___O

  3. #3
    Registered User brill's Avatar
    Join Date
    Nov 2005
    Posts
    1
    Sponsored Links
    Sponsored Links
    Quote Originally Posted by boybergamo76 View Post
    there are the real keys? O___O
    Nah, they are the hash signatures of the keys in hex form. I suppose to prove to everyone that they have them without actually releasing them.

    They seem to match the signatures of the publicly known ones (lv2 and pkg) Since they aren't salted I suppose it's feasible to run the ivs through a 0-9 A-F 16 byte rainbow table but I'm not so sure about the 64 byte key.

    Either way, anyone knowledgeable enough about this kind of stuff would just find it easier to grab the keys themselves using the techniques described during the conference rather than bruteforcing them from a SHA-1 signature which, funnily enough, would take a lot more effort and computing power.

  4. #4
    Contributor talruum's Avatar
    Join Date
    Nov 2007
    Posts
    37
    Geohot posted this right now
    GG SONY!!!!!

    I'm in your console borrowing your metldr keys

    3.41 kernel keys as semi proof, more to come
    erk(12AB0): 57 5B 0A 6C 4B 4F 27 60 A0 3F E4 18 9E BA F4 D9 47 27 9F D9 82 B1 40 70 34 90 98 B0 8F F9 2C 10
    riv(12AD0): 41 1C B1 8F 46 0C E5 0C AF 2C 42 6D 8F 0D 93 C8
    I'm quite almost sure that debug -> retail must be a metldr change... and we can't do that yet

  5. #5
    Contributor Ossi's Avatar
    Join Date
    Sep 2010
    Posts
    5
    here is the decrypted lv2_kernel.self from the 3.41 : http://www.ps3news.com/forums/attach...chmentid=27093

    I decrypted it with ooPo's PS3 SELF Decryption Code and the the keys by Geohot :

    [Register or Login to view code]

    Output :

    [Register or Login to view code]

    Attached Files Attached Files

  6. #6
    Contributor Moegames's Avatar
    Join Date
    Oct 2010
    Posts
    10
    wow things are really starting to roll.. it puts a smile on my face for sure. Good work and love how everything is chipping in ..reminds me of the old xbox original days in ways.

  7. #7
    Contributor sensi's Avatar
    Join Date
    Jun 2010
    Posts
    24
    Is it possible to change the firmware version this way? for PSN access?

  8. #8
    Senior Member Pcsx2006's Avatar
    Join Date
    Feb 2009
    Posts
    326
    Now that is the best gift of new year for developers not for the common users, thanks to failoverflow team.

    And yeah thanks to GeoHot too after all its all possible bcz of him.

  9. #9
    Forum Moderator PS3 News's Avatar
    Join Date
    Apr 2005
    Posts
    28,078
    Moved to the main page now, and +Rep to Mantagtj as well.

  10. #10
    Contributor tjay17's Avatar
    Join Date
    Apr 2010
    Posts
    421
    This is great I wonder how long before I can get pack to the psn now.

 

Sponsored Links

Page 1 of 3 123 LastLast
Advertising - Affiliates - Contact Us - PS3 Downloads - Privacy Statement - Site Rules - Top - © 2014 PlayStation 3 News