53w ago - This weekend PlayStation 3 hacker an0nym0us has released a PS3 homebrew utility called MemDump v0.01 which allows end-users to dump LV1, LV2, NAND / NOR Flash and eEID from the GameOS, with the details below as follows:
From the PS3 Dev Wiki (linked above) and included ReadMe file:
For all of you out there intereseted in, or already in the process of reverse engineering the PS3, this new tool will make your life a whole lot easier! Now you can dump LV1, LV2, NAND/NOR Flash and eEID from one tool!
There have been methods in the past that accomplished the same goals, but certainly the ease of use and speed hindered many. Of course, none had such a beautiful user-interface either.
Place the necessary pkg file in the root of an empty USB flash dongle, and install like any other pkg.
1. Place pkg on USB flash dongle.
2. Select "memdump" icon.
3. Select type of dump to perform once loaded.
The following buttons are mapped in the user interface:
PS3 memory dumping tool that can dump lv1, lv2, NAND/NOR Flash, and eEID from GameOS.
FW lv1 lv2 Flash eEID 0.01 FINAL Logs Notes
<=2.60 CEX/Retail NA NA NA NA Not available as target version atm
<=2.60 DEX/Debug NA NA NA NA
2.70 CEX/Retail Yes Yes Yes Yes
2.70 DEX/Debug Yes Yes Yes Yes
2.76 CEX/Retail Yes Yes Yes Yes
2.76 DEX/Debug Yes Yes Yes Yes
2.80 CEX/Retail Yes Yes Yes Yes
2.80 DEX/Debug Yes Yes Yes Yes
3.00 CEX/Retail Yes Yes Yes Yes
3.00 DEX/Debug Yes Yes Yes Yes
3.01 CEX/Retail Yes Yes Yes Yes
3.01 DEX/Debug Yes Yes Yes Yes
3.10 CEX/Retail Yes Yes Yes Yes
3.10 DEX/Debug Yes Yes Yes Yes
3.15 CEX/Retail Yes Yes Yes Yes
3.15 DEX/Debug Yes Yes Yes Yes
3.20 DEX/Debug Yes Yes Yes Yes
3.21 CEX/Retail Yes Yes Yes Yes
3.21 DEX/Debug Yes Yes Yes Yes
3.30 CEX/Retail Yes Yes Yes Yes
3.30 DEX/Debug Yes Yes Yes Yes
3.40 CEX/Retail Yes Yes Yes Yes
3.41 CEX/Retail Yes Yes Yes Yes
3.41 DEX/Debug Yes Yes Yes Yes
3.42 CEX/Retail Yes Yes Yes Yes
3.50 CEX/Retail Yes Yes Yes Yes
3.50 DEX/Debug Yes Yes Yes Yes
3.55 CEX/Retail Yes Yes Yes Yes
3.55 DEX/Debug Yes Yes Yes Yes
3.56 CEX/Retail Pending Pending Pending Pending
3.56 DEX/Debug Pending Pending Pending Pending
=>3.60 CEX/Retail NA NA NA NA Not available as target version atm
=>3.60 DEX/Debug NA NA NA NA
NA : Not Available as target version (mostly because of missing lv1: mmap114 or lv2: peek/poke patches)
Yes: Fully supported
No: Not supported
Partial: Some functions work, others might not be complete
Pending: No reports yet (help out by sending in your logs and dumps in a ZIP/RAR/7z!)
buttons do not come back up after pressing -> to be fixed in v0.02 (button handler thread)
exit app gives rightscreen black triangle -> to be fixed in v0.02 (cleanup RSX buffer)
when free space is 0 bytes when dumping, application will halt -> to be fixed in v0.02 (check freespace first)
Needs mmap114+peek/poke as minimal patches
Can be buggy with strange spoofs
No reports yet on Kiosk/SEX & Tool/DECR models
Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!
Download: http://uploadmirrors.com/download/RCGKYZC5/eEID_RKDumper.pkg / http://www.ps3devwiki.com/files/devtools/Cex2Dex/eEID_RKDumper/eEID_RKDumper.pkg (Mirror) / http://www.mediafire.com/?k571sldae85y583 / http://www.mediafire.com/?vxta63h7d2ds620 by jarmster (eid4, not eid4d.bin)
To quote: eEID_RKDumper (from GameOS) by flatz
Install package and run it
It will then black screen (no GUI) and restart the console automatically
FTP (other otherwise) retrieve your eid_root_key / PCK1 from /dev_hdd0/tmp/eid_root_key
Unplug all USB devices
Run eEID_RKDumper from XMB
It will show a black screen (no GUI) for 10-15 seconds, then 3 beeps and restart the console automatically
FTP (other otherwise) retrieve your eid_root_key / PCK1 from /dev_hdd0/tmp/eid_root_key (48 bytes)
Before starting the eEID_RKDumper from XMB, remove ALL your USB devices. Otherwise, it will freeze in a black screen and you will have to unplug the power cord from the PS3 (or turn it off using the power switch in back of the PS3 phat).
PlayStation 3 developer aldostools compared the eid_root_key (48 bytes) with the first 48 bytes of his dump_eid0.bin (obtained via linux & metldrpwn), and they are the same.
From haz367: The eEID dumper works perfect, could not get eid_root_key working on 4.21 with "dispath settings" ticked in Rebug's Toolbox(runs boot hangs after loading with the symbol on the right upper corner" = hard rest, anyone knows correct settings for eid_root_key dumper... no required here but for anyone wanted to test... let me be the noob here asking some stuff
eid4 is the bd drive part (offset 303A0 > 303CF) the 3k3y_keydumper dumps the "eid4+root_key" as "3Dump.bin" = Disc key = eid4+root_key
when using the manual way using zecoxao's tool we get an "eid3" error because of missing sha etc..correct?! on the provided 5KB "eid" then end up with "eid4&eid4d.bin" > eid4 identical as "3k3y dumper+added root_key" = Disc key?
EID4 0x0303A0 0x0303CF 0x30 (48 bytes)
so anyone can skip all this ^ if u have the root_key and a dump of the flash? add the "eid4+root_key" in 1 file = disc key?
1st key, 0x10-0x1f - 2nd key, 0x20-0x2f
first 16 bytes is nothing?
offset 10>1f = for encrypting data key1
offset 20 - 2f = for decrypting data key2
rest = rootkey
updating the linux atm.. gonna waste some time on the wiki later on.. let's how long my patience lasts.
Finally, zecoxao who has created a PS3 HDD / eEID decryption repository stating the following:
You only need the eEID and the eid_root_key. entire flash is not needed. and i don't have the slightest idea why the heck they made a pkg that only dumps eid4 (someone talked about hash comparison and they said eid4 from the program and the dump from the pkg match in comparison)
The first key is used for encrypting data sent from host to BD drive. The second key is used for decrypting data sent from BD drive to host. Two keys infact (via ps3devwiki.com/wiki/BD_Drive_Reverse_Engineering#Information_about_EID4)
0x0-0xf bytes = 1st key, 0x10-0x1f - 2nd key
Basically, the first 16 bytes contain a key, the second 16 contain another, and the last 16 are the hash check from OMAC1. you get that by "digesting" the two keys. that's a hash function.
So, I decided to create a ps3 hdd/eEID decryption repository, just for the gist of it. Bear in mind that the code is adapted from naehrwert’s code, so it’s not 100% my code, but i did modify some things and made it so that it’d be more user-friendly. for now, it only runs on linux, and people who want to use it on windows or mac have to adapt the code (the cygwin zip i have also works for windows, but i want to improve it a bit)
Here's my repository: github.com/zecoxao/ps3_decrypt_tools
That should work on linux if you have build-essential, openssl, and libpolarssl-dev installed. just read the readme, and you're good to go. Note: gitorious didn't seem to work for me, so i decided for github instead.