Sponsored Links

Sponsored Links

Details and Payloads for Dumping PS3 Per Console Keys Surface


Sponsored Links
143w ago - PlayStation 3 developers have been busy recently working on payloads for dumping the PS3 per console keys, as once the per_console_key_0 is obtained with full EID decryption dongles and burned BR-D's may be a thing of the past.

Below are details from sphinxkoma and the PS3 Wiki (ps3devwiki.com/index.php?title=Talk:Per_Console_Keys) on dumping the per_console_key_1 via Kaz... it's only a matter of time for per_console_key_0 which unlocks everything we need.

To quote: PS3 Per Console Keys

EID crypto is very complicated, it is done so on purpose. first of all EID0 isn't decrypted with one key, and one algorithm alone. it is decrypted in several parts which use different algos and keys. the keys are all derivations of a per console key (per_console_key_1) which is stored inside metldr and copied by it to sector 0 and never leaves isolation. that same key is a derivation of the per console key (per_console_key_0) used to encrypt metldr and the bl in the first place as well.

isoldr clears that key from sector 0 before jumping to the isolated module. but before doing so it encrypts it with another keyset and stores it in a buffer so that the isolated module can use the new crafted key. since the operation is AES, if you know that keyset you can decrypt the crafted key and get the eid root key without pwning a loader or metldr through an isolated module.

that is not like you really need it because you can already use the crafted key to decrypt some of eid0, but not all of it. and the crafted key also uses the first elf section to be built as in your isolated module will have a small section which only contains a key. and that key is used as another layer by isoldr to encrypt the buffer with it. so basically you have 2 encryption layers over the root key. the final key then decrypts a specific part of the EID.

eid crypto is actually done smart. that is because most of it originally comes from the cell bootrom, as in they reuse the same algo used for metldr binaries and bl in the eid crypto, including some of the keys and the steps. and you cannot decrypt all of the eid sections unless you gathered every single keys and steps. and there are a lot then you still have to figure out wtf it is you decrypted because eid is actually full of keys.

1. payloader3 create new possible source of or precompiled:

payloader3-341.pkg: [Register or Login to view links]
payloader3-315.pkg: [Register or Login to view links]

2. Install payloader3 pkg on the ps3

3. export in the terminal set
a. export PS3LOAD = tcp: ipaddress.of.ps3
b. start socat (socat tcp-recv: 18194 stdout)

4. payloader3 pkg start on ps3

5. It is quite likely to see is not the picture (black screen) but you will hear a distinct sound (like C64) Now things are different feasible:

a. X 4eck then starts with ps3load ethdebug
b. then you will want to circle back to the xmb and invites ethdebug (for Debuging pkg files)

6. Use your ps3load the mode used to send your ps3 dump_eid_root_key.self (ps3load dump_eid_root_key.self) Now you should see debug Terminal in your debugging and then hopefully you'll find the PCK .. (theoretically)

The per console key is used to derive other keys, some of which Sony can't change as this appears to be the bottom of their encryption chain. It's also important to note that this method is intended for dumping per_console_key_1 and per_console_key_n while per_console_key_0 is currently still required.

However to speculate, in future PS3 CFW updates users may need to be on a Custom Firmware to begin with (or downgrade to one first) and then run a .PKG to get their per console encryption key, followed by using it in a PS3 MFW Builder and installing the resulting modified PS3 Firmware on their PlayStation 3 console.

From ps3devwiki.com/index.php?title=Per_Console_Keys#per_console_root_key_0:

  • metldr is decrypted with this key
  • bootldr is decrypted with this key
  • might be obtained with per_console_root_key_1? (largely speculative, not nec. true - need more looked into, only based on the behavior of the other derivatives known to be obtained through AES)

Finally, from the PlayStation 3 Wiki (ps3devwiki.com/index.php?title=Per_Console_Keys and ps3devwiki.com/index.php?title=Boot_Order#Chain_of_Trust for the PS3 boot order) pages:

Per Console Keys

per_console_root_key_0

  • metldr is decrypted with this key
  • bootldr is decrypted with this key
  • might be obtained with per_console_root_key_1? (largely speculative, not nec. true - need more looked into, only based on the behavior of the other derivatives known to be obtained through AES)

per_console_root_key_1 / EID_root_key

  • derived from per_console_key_0
  • stored inside metldr
  • copied to sector 0 by metldr
  • cleared by isoldr
  • Used to decrypt part of the EID
  • Used to derive further keys
  • can be obtained with a modified isoldr that dumps it
  • can be obtained with a derivation of this key going backwards

obtaining it

launch the patched isoldr with your prefered method

Option 1 - dumper kernel module

  • modify glevands spp_verifier_direct to dump the mbox to wherever_you_want and then (use the payload below as an example)
  • the example code on how to dump the mbox can be found on the Option 2 - dumper payload below

Option 2 - dumper payload

[Register or Login to view links]


  • patched isoldr to dump it
  • DO NOT CREATE AN MFW USING THIS IT WOULD BRICK
  • patched isoldr: [Register or Login to view links]
  • this can be loaded as the payload stage2 in the payload marcan used to load linux
  • [Register or Login to view links]
  • [Register or Login to view links]
  • this can also be loaded as with lv2patcher and payloader3
  • [Register or Login to view links]

Comments

  • What this selfs do is dump your ISOLATED SPU LS through your mbox, so you only need a way to cach this info with PPU code in lv2 enviroment aka a dongle payload or linux kernel
  • This has been tested and proven to work on 3.55 MFW
  • In the dump the remaining dump is the metldr clear code. metldr clears itself and all the registers an jumps to isoldr.
  • Overwriting that code lets you dump your key + metldr
  • Consider that per_console_key_1 and per_console_key_n are in fact still in need decryption.
  • per_console_key_0 particularly needs to be dumped once revived from per_console_key_1.

per_console_root_key_2 / EID0_key

  • this key can be obtained through AES from EID_root_key
  • EID can be partially decrypted by setting this key in anergistics and fireing aim_spu_module.self
  • Load aim_spu_module.self + EID0 + EID0_key in anegistics = decrypted EID0
  • This code is to decrypt your EID0 on your PC [Register or Login to view links]
  • The prerequisites are:
  • dump your EID0 from your ps3 and save it in the same folder as EID0
  • dump your EID0_key from your ps3 and put it on the code above where the key is needed
  • load all of them in anergistic
  • EID0_key could also be obtained with EID_root_key directly in the following manners:
  • knowing the algorithm (located in isoldr)and applying it to the EID_root_key
  • letting isoldr apply that algorithm directly in anergistic
  • the process is exactly as the one above (modifing anergistic to feed isoldr with EID_root_key

obtaining it

  • patched aim_spu_module to dump it
  • DO NOT CREATE AN MFW USING THIS IT WOULD BRICK
  • [Register or Login to view links]

per_console_root_key_n

  • these are further derivations of the per_console_key_1/EID_root_key

Documentation

  • polarssl.org/trac/browser/trunk/library/aes.c

From VenomousX: How to obtain this EID_root_key?

  • Patch isoldr to dump the local storage of sector 0
  • Load the patched isoldr
  • Dump the local storage
  • You will find eid_root_key
  • Use it to decrypt the eid0.

How to load back the isoldr:

  • Use glevand's tools, spp_verifier_direct to be specific: "spp_verifier_direct is a kernel module which shows you how to run isolated SPE modules on OtherOS++ Linux by using metldr directly.
  • It decrypts default.spp profile.
  • Once you get the eid rootkey, load aim_spu_module.self with eid0 and the eid root key within anergistics it will decrypt it.
  • You can modify it easily to run other SPE modules.
  • Has been done and tested on 3.41 and 3.55 (not by myself)

So yes, you can obtain the eid rootkey and partially decrypt the eid0, but the problem if you want to modify the eid0 (say... to get a DEX idps to convert CEX=>DEX (which doesnt have much got use for end-users, only devs)) then you'd need to re-encrypt the EID0, which you can't. Not with those keys at least.

Oh, and while PS3 rootkeys are per console, and usually FW independent. However I dont know about 3.6+ because I didn't test it on it. But it might be true that 3.6+ eid rootkey have changed since $ony changed a load of keys with 3.6+. So using the 3.55 eid_root_key on 3.6+ to decrypt anything probably wont work.

Sony PlayStation 3 hacker [Register or Login to view links] states the following on this via Twitter: "There are 3 per console keys. it tells you how to obtain 2 (per console key 1 and per console key n) not THE root key. It will not lead to a new CFW, it is fun for devs, you can decrypt a lot of eid and reverse it.. it is not newb friendly at all."

PlayStation 3 hacker defyboy has also added the following: "I don't think this is a step closer to discovering the per-console root key. The EID root key is generated at factory and incorporated into metldr. metldr is encrypted with your per-console root key and stored on flash. Please note that while it is speculated that the EID root key is a derivative of the root key, that does not mean that it can be used to calculate the root key. Infact, being able to do so is idiotically counter-intuitive of the purpose of having two separate keys.

The per-console root key is likely burnt into the CPU via One Time Programming over the JTAG port, of which is disabled after programming. There is a hardware decryption routine that uses this key called Runtime Secure Boot, you cannot access or invoke this routine because it only runs when you load an encrypted image into an isolated SPU.

This is IBM's design, not sony's. This was designed to be a very secure multi-purpose processor and it was designed by a company that designs security and military systems for governments and large organizations, not a company that mostly makes consumer grade TV's and DVD Players. It was Sony's implementation of the secure chain of trust that failed but I don't see IBM's part failing anytime soon.

This paper explains everything: [Register or Login to view links]

Anyway, Sony cannot change metldr or bootldr on current hardware so they no longer have control of those, we only need to dump bootldr to get the lv0 key, this is the highest level sony can change. If we get the lv0 key we can generate a private key where we will be able to decrypt/re-encrypt the entire chain of firmware for current/future firmware."

The Per Console Key in the Cell decrypts bootldr, which is encrypted with the PCK. Bootldr decrypted is the same in EVERY console to date (except possibly the 3K series). When bootldr decrypts lv0, bootldr will be as if it were nowhere to be found. Then you go from there to the Chain of Trust.

Below is Gitbrew's feedback on the PS3 Per Console Key and future developments from them, as follows:

what do you think about the new method of getting the per_console_key?

Durandal: Glevand and many others have been working feverishly to develop methods of obtaining this key. It's nice to see it's paid off. I'm looking forward to a day when the PS3 is as open a development as the PSP.

Snowy: One step closer, sooner or later ibm is going to finally send a cease and desist. We'll put that right up next to dasmoovers sign.

Do you have anyone working on an easy to use tool for the key? we are already used to gitbrew pkgs

Durandal: If we weren't, we'd have to quit gitbrew and join PS360...

Snowy: I'm pretty sure anything related to the rootkey, we might leave out just so that people actually learn how to get their own keys. As a sort of accomplishment type thing, but eventually there will be simple pkg files released to do it.

What next projects are we going to see from gitbrew regarding the ps3 scene? can we see some sort of "one day one announcement", like you did a couple of weeks ago?

Durandal: Well RSX is taken care of, NPDRM is getting very close to being irrelevant, and I've heard there's almost usable versions of psl1ght floating around. I guess the next really big thing you'll see is the release of the gitSkeet flasher.

We teamed up with progskeet and rebug to create a special edition of the progskeet2 that will have solderless clips and the kind of support and documentation only gitbrew is capable of providing. It also gives us an opportunity to branch out into the actual hardware exploitation as well. As far as having announcement a day weeks, expect to see more of them in the not so distant future.

What is your thought on the recent discoveries on the ps3 scene?

The new jb2 dongle AKA true blue.

Durandal: I'm always very wary of dongles. Usually they're just a ploy to make a buck, and these days it doesn't take long for someone to reverse what the software they're trying to hide does. Expect to see the same happen here. If we want to deter others from trying to peddle their software in a dongle form, we should make a point of reversing a dongle's functionality
and implementing it in a package. I'm sure that group paid a lot of money to get all those dongles made, and they'd hate to see that money go to waste.

Snowy: Yet again as durandal said, dongles are dongles, regardless someone is going to take a crack at them and release a free version of it. Cobra hasn't even been touched by most of the developers, and those who have touched it don't really care for piracy. I would like to thank dean for taking the first step in making psx backups working though, a small step but none the less towards the proper direction for the scene.

Finally, FiniteElement via ps3devwiki.com/index.php?title=Special:Contributions/FiniteElement states the following hint for those interested, to quote: "(you have all you need already just read carefully (compare option2 code with the kernel module code))

He also updated the PS3 SPU Isolated Modules Reverse Engineering page with the changes documented here: ps3devwiki.com/index.php?title=SPU_Isolated_Modules_Reverse_Engineering&diff=prev&oldid=6328





Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!

Comments 860 Comments - Go to Forum Thread »

• Please Register at PS3News.com or Login to make comments on Site News articles. Thanks!

PS3 News's Avatar
#860 - PS3 News - 90w ago
Recently and_fis reports that the PS3 Slim 3K series of PlayStation 3 consoles are surfacing on 3.55 Custom Firmware (CFW), leading to speculation of a new DRM-infected JailBreak Software Tanpa dongle or service from Indonesia.

To quote (via ps3crunch.net/forum/threads/5321-3K?p=58294&viewfull=1#post58294) on the (tokoteknologi.com/home/browse/25-consolemesin.html?sef=hc):

For some Indonesian rupies according to the site above you can purchase A 3K console with a Seri CFW 3.55 (RFW Version) installed! Which also comes with a JAILBREAK SOFTWARE TANPA DONGLE as they call it... If this site is real then someone has found a new exploit that allows 300X version ps3 consoles to downgrade to 3.55 cfw. They have also locked this to a new drm dongle... Let the games begin again!

Rp 3.700.000,00 or about $320 usa, for a base model 160 gb ps3

The only way this would be possiable is if they used hardware to somehow reflash the syscon. that is where the hash checks are that determine the lowest firmware you can have...or they were able to use a hardware flasher and a cfw that had all the hash checks removed.

Or changed and reflashed a cfw that the ps3 "thought" was the right firmware... IDK there is nothing on wiki about either processes

From Abkarino: I know this seller and i talked with him and have a deal 1 and half month ago, they offer me a pre-moded 3K console and they does not sell the modchip/method used to do that. Also he claim that this console uses a special modified CFW based on Rogero CFW.

Also they had used some kind of modchip/flasher to do that. Also he told me that there is a modchip under development for hacking 3K console and it must be released around this month, but till now no new news from him.

From and_fis: I found this info (lan.st/showthread.php?t=3313&page=2) from back in 2010 when 3.41 had alot of access and workings... So if it is true that syscon can be written to with a pkg BUT, it would have to be offically signed or a hardware flasher of some sorts would have to be used if a pkg could not. So in theory, it would be possiable to reflash a syscon from a factory install of 3.60 to 3.55

He is talking about the syscon's eeprom, we can already (at least in private) read and write to it, in fact I am trying to find a way to contact graf_chokolo (he has been absent from irc lately) since he seems somewhat interested in it, at worse I'll add this the wiki's private sections. The syscon's eeprom doesn't seem to be touched on a debug console though, I dumped mine on 3.41, then downgraded to 3.40 and it was still untouched.

I don't know about retail though, I only have one and it's already on 3.41 so I rather not touch it, but I didn't see anything that looks like hashes. Flags are there though. (like the product mode flag, QA flag, debug support flag etc etc...) There are also factory informations stored in there (such as the first firmware flashed at factory) but no hash that I could see, though maybe I overlooked something.

Of course the bootloader wouldn't be in any eeprom, lv0 probably starts and talks to syscon through a vuart in order to read the eeprom content (if the hashes are there) and look at the hashes (to compare them to the digests from the other coreos selfs)

Thanks Abkarino I posted this at the same time you did.. So my suspicions were true about a hardware flasher.. Thank you for the info

From Abkarino: Yea may be they had found a way to reprogram Syscon EEPROM may be they had used an SPI Flasher since SysCon conect to Cell/BE using SPI Bus. I think that they had used a hardware method not a software (sure if this is legit and not a fake, until some one get this console and confirm this news).

PS3 News's Avatar
#859 - PS3 News - 98w ago
Below is a video from dantezteam (via twitter.com/dantezteam/status/244856386469638144) demonstrating what appears to be PSN back online for PS3 3.55 TB CFW using a ppoof method.

The video shows today's date (September 9, 2012) with him downloading files from Sony's PS Store while being connected to PlayStation Network using a new PSN passphrase that has surfaced in encrypted and decrypted format (via ps3devwiki.com/wiki/Online_Connections#Online_Connections).

3.55 / 3.56: saktdlMapxsbsghmq5dhlwrmtsicyijmzntqaLcpgd8ybbetdmsha=jm


3.60 / 3.61 / 3.65 / 3.66: c4ce4023bd7e0345feeb0dca80caf487a03b4545a8230a5d41fe9855

3.70 / 3.72 / 3.73 / 3.74 / 4.00: f81c4c14a0cd2c2dc566a885136fd5b51ca847cbb70fcc296b24ec20

4.10 / 4.11: 0e444f4dbd92145de39ab5bff3a23071f9d44db7bcf13e8c455c81f1


4.20 / 4.21: t2wSyoqasqb_wndpmdmbhputnokghlupgtpighyrsygfbmrsectfkqOb


From Twitter: TB dongle is not needed works on rebug or kmeaw etc .. The method is turn on fake plus go to store and buy plus free games

From hellsing9: Games, PSTORE. (Someone signs out) Borderlands downloading. Closes PSSTORE.

He is on DEX, uses FAKE PLUS and points the finger showing is ON with a CFW (according to him) 3.55 TB spoof.

In short: He bought borderlands in the video via DEX with PLUS option ON... For me is just another attemp to troll or to give some life to TB, since he says he is using CFW TB 3.55 Spoof. And in the part description he says later I will add the Web.

So he avoided so far any download link and surveys because he knows what happens next: youtube.com/user/dantezteam

From dantezteam comes a FckPSN revision by Chinese developer Luckystar (via bbs.duowan.com/thread-28656355-1-1.html): [Register or Login to view links] / [Register or Login to view links] (Mirror) / [Register or Login to view links] (Mirror #2)

Here is the upstreams and video for those interested: ustream.tv/recorded/25308408 and ustream.tv/recorded/25328218





Finally, below is what redcfw claims is a real TB2 LV2 dump for those interested:

Download: [Register or Login to view links]

ALL TB2LV2 DUMPs posted before were FAKE!! tb2.51 lv2 dumped on Mar 2012. folks, feel free to study it.

some IDA list


how to hook decKey?


PS3 News's Avatar
#858 - PS3 News - 98w ago
Today /GriFFin reports that OxweB has apparently leaked the True Blue PS3 disc BCA codes (although curiously a source wasn't specified), however, they are now conveniently deemed useless as the DRM-infected USB dongle itself.

To quote: When the True Blue dongle first launched last year, it was originally using 'special' blu-ray discs to play games, instead of just DRMencoded eboots on the HDD.

But even after all the Paradox releases, there was a few games that only were available still on 'special' blu-ray discs. Over the course of last year, various groups try to figure out how to copy these discs, as they were sadly pirate stores that wish to sell them to their customers. Finally have much research the BD-Rom marks called 'BCA Codes' were figured out so they could by copied on normal blu-ray burner.

And now an person by the name 'OxweB' has leaked them onto the 'net, as basically they are useless now, but still it is part of sad scene PS3 history!

These are BCA codes off the TB discs (the barcode on the inner part of the disc).

You to can read them off the disc yourself with a scanner or magnifying glass, they are in binary format (skinny line = 0, Fat line = 1). Binary to HEX and there you go, a code almost ready to be stamped on to a BD-R.

*Note - It's not that simple for regular retail games as there is still the PIC Zone to contend with.
**Note - I realize these aren't overly useful but it's information which is all worth it in the long run.

RESISTANCE 3


DISGEA 4


FIFA2012


PES2012


XMEN DESTINY


BATMAN ARKHAN CITY


Finally, in related news from GoD]oF[WaR (via nextgenupdate.com/forums/playstation-3-exploits-hacks/583397-bca.html#post4685403) to quote:

I have done more research on BCA codes, they seem to be the new protection put on games, meaning with these values they can be cracked, and possibly pirated to even non-jailbroken systems.

For those unaware, BCA is the new protection utilized in newer games and with a future editor you can have the BCA codes to use with the a loader which can patch games to run without the needed keys.

There will be a patch released for each game, which is basically 64 bytes of BCA data in the form of a separate text file, that will come with the ISO file (this obviously only applies to scene releases)

IF you have access to a retail copy of the game, then you can obtain the BCA code yourself to patch the game.

Changelog, roughly translated:

  • New IOS 38 base. dev/mload with powerful features and EHCI driver based in interruptions and more stable
  • Support for DVD USB Devices: It can run only DVD backups from .iso (original don't work because DVD drivers don't support the Wii format). Remember you must insert a DVD to work at start the program.
  • Support for BCA datas. You can add it from .ISO offset 0x100 (64 bytes). If this area is filled with zeroes it use one BCA by default (NSMB compatible).
  • New ioctl 0xda function supported in dip_plugin and new option added for
  • DVD mode to read the BCA Datas from the original DVD
  • Support to load games from DVD with alternative DOL (press '2' without
  • USB device or press the DVD icon from the upper-right corner in the selection game screen)
  • Support for SD and USB FAT/FAT32: Now you can use cheats codes and loads alternative .dol from the USB 2.0 device (FAT partition is required)
  • Added alternative dol loader (now support for 5+ dols) for games as Red Steel and othrers (see readme.txt) , New error 002 patch and videomode autodetection patch (for PAL2NTSC, NTSC2PAL and NTSC2PAL60 (use F. PAL60 for this))
  • Added direct access for Dol Alternative selection
  • You can load differents ehcmodule.elf from sd:/apps/uloader/
  • Parental control added: by default the password is 00000 (the last 0 is the 'ENTER', so you can program as new password as XXXX0 ). You can change it from special menu pressing HOME. You can exits from the password box pressing B. Parental control list the last 8 games launched with date/time, enables the password box and fix a new password. Now 00000 disables the Parental Control
  • Support for covers (less than 200KB 160x224). You can download from internet or adquire covers from the curren tfolder in the SD automatically
  • Added one option to delete PNG icons/covers
  • Some bugs fixed (bug with no modchip game instal, for examplel)
  • Support for multiples WBFS partitions (max 4).
  • Possiblity to use the alternative cIOS 223 (only to launch games)
  • Added one option to rename games
  • Added one option to record the cheats selected from txt files
  • New usb code and more!

The above thread gives information on BCA codes for the Wii, which could also apply to PS3 games in the same way. Meaning these BCA codes could lead to easily pirating games on all consoles who utilize the BCA algorithm.

After further research, I am under the suspicion that these BCA codes are in fact a lead to playing pirated games (3.60+ games burned to BD/Launched via USB or external HDD - played on 3.55 WITHOUT CFW) possibly on current firmwares with a real developer at hand.

Basically these BCA codes could lead to playing these burned ISO images on 3.55 (No CFW; without 3.60+ keys) and possibly current firmwares.

The BCA codes that True Blue "leaked" are actually the codes to games that have been tested and work on 3.55 OFW. With the use of a new true blue dongle (JB2/Jailbreak2), games played off the BD without 3.60+ keys.

The games that have been tested are the ones listed below;

  • Fifa 2012
  • Pes 2012
  • Driver san Fransisco
  • God of war Origin
  • X-men Destiny
  • Sniper ghost warrior

Games that are in process of being tested;

  • Resistance 2
  • Disgaea 2
  • Batman Arkham City

POC:




More PlayStation 3 News...

StanSmith's Avatar
#857 - StanSmith - 100w ago
I just tried V2 and it doesn't work.

I load up Multiman, select Ghost Recon FS and it goes backt o XMB like normal.
I try to run GRFS and it black screens and locks up.
I reboot and load up multiman and it also black screens and locks up.
I reboot WITHOUT the dongle and it finally loads MM.
I copy the file over to the PC, convert from ELF to BIN, put it in GRFS folder.
I reboot WITH the dongle. goto MM select GRFS go back to XMB.
I run GRFS from DVD. It loads up Multiman.

I tried this 3 times and each time its the dump of Multiman NOT GRFS. And the file DOESN'T go, 00, 01, 02 etc, there is only 1 file and its 00. At least v1 gave multiple files but I couldn't get GRFS to work without the tb patched files.

imajei's Avatar
#856 - imajei - 100w ago
Can you do ghost recon eboot? please

Sponsored Links

Sponsored Links
Sponsored Links

Sponsored Links







Affiliates - Contact Us - PS3 Downloads - Privacy Statement - Site Rules - Top - © 2014 PlayStation 3 News