Sponsored Links

Sponsored Links

PS3 Lv0ldr / Bootldr Exploit Reverse-Engineering Details by Naehrwert


Sponsored Links
101w ago - Following up on the previous PS3 Lv0ldr / Bootldr clarifications by marcan42 and wololo, today PlayStation 3 hacker naehrwert has shared some details based on reverse-engineering the exploit used to dump it.

To quote from his blog: The Exploit

As the exploit that was used to dump lv0ldr/bootldr/howeveryouliketocallit is public now, let's have a closer look at it to understand what's going on. Here is what I have reversed from lv0 (it shares the syscon portion of the code with its SPU counterpart):

[Register or Login to view code]

The syscon library implements some high level functions, e.g. to shutdown the console on panic or to read certain configuration values. Every of this functions internally uses another function to exchange packets with syscon and the exchange function uses the read_cmpl_msg one to get the answer packet. The top-level function will pass a fixed size buffer to the exchange function.

So if we are able to control syscon packets, e.g. by emulating MMIO (and thanks to IBM we are), we can change the packet size between the two packet readings and overwrite the caller stack. And if we first copy a little stub to shared LS and let the return address point to it, we can easily dump the whole 256 kB.

Nothing more left to say now, let's wait and see if this is going to be fixed in future firmware versions (we just have to check lv0 fortunately).




Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!

Comments 246 Comments - Go to Forum Thread »

• Please Register at PS3News.com or Login to make comments on Site News articles. Thanks!

G Sus's Avatar
#211 - G Sus - 103w ago
i believe that now all keys are known , it means you could technically make a cfw that could be installed on any ps3 ofw. however. its not really as simple as that. the keys only mean you can decrypt it all. it dont mean you will understand what your seing or even be able to find a flaw or weakness in it. (per console keys)

What it effectively means is now that it can all be decrypted there is the possibility that someone will find out how the fw and ps3 gos about the verification of per console keys etc. and then copy the process, and make a new cfw that will update on ofw above 3.55.

it don't mean it will happen , it just means it could be possible if someone is smart enough to work it out. or at least thats how i understood it, ive been wrong before though. what is more likely is. now you'll just get a 4.31 cfw that installs only on 3.55 or below.

I bet theres a hell of a lot of code to read for devs. look how many files theyve been given access too in just a few months. The PS3s life will have ended before anyone gets round to making cfw install above 3.55 ofw. I reckon the few people that probably could do it aint even working on it, (they have no need) and the rest wouldn't know where to start.

but like i say, I'm often wrong, and this is highly likely to be one of those times.

Blade86's Avatar
#210 - Blade86 - 103w ago
Installable CFW 4.31 on OFW4.30- ? Or did I missunderstood it?

Please could someone enlighten me what you can do with this two? And priv-key is still missing? Or Could we we "just" decrypt the 4.31 update and make a new 4.31cfw installable on 3.55?

Thank you soo much

PS3 News's Avatar
#209 - PS3 News - 103w ago
I have now added the the PS3 4.31 isoldr and lv2ldr keys from anonymous (via pastie.org/private/avbxlh6jg7089sh5m4bg) posted below to the main article as well for those following, hopefully with these final keys a PS3 MFWBuilder 4.31 update will arrive soon.

[Register or Login to view code]


Portalcake's Avatar
#208 - Portalcake - 103w ago
bootldr keys to decrypt lv0 are the same for all firmwares.

eXpo1s0nHD's Avatar
#207 - eXpo1s0nHD - 104w ago
I have 4.31 lv0 Keys.

Sponsored Links

Sponsored Links
Sponsored Links

Sponsored Links







Advertising - Affiliates - Contact Us - PS3 Downloads - Privacy Statement - Site Rules - Top - © 2014 PlayStation 3 News