Sponsored Links

Sponsored Links

PS3 LV2_Kernel Exploit Sample Implementation By Naehrwert


Sponsored Links
100w ago - Following up on his PS3 SCETool update and PS3 Dump_Rootkey code, today Sony PlayStation 3 hacker Naehrwert has posted some details on exploiting the PlayStation 3 lv2_kernel and has made available a sample 3.41 implementation below.

To quote from his blog: Exploiting (?) lv2

A long while ago KaKaRoTo pointed me to a stack overflow he found while reversing lv2_kernel. But there are two problems:

1. The vulnerability is in a protected syscall (the SELF calling it got to have the 0x40... control flags set). So you’d first need to find a suitable usermode exploit (don’t ask us), that gives you code execution with the right privileges.

2. The payload data is copied to lv2 heap first and the function will do a free call on it before the payload has any chance to get executed. This might not sound like a problem but it looks like lv2′s heap implementation will overwrite the free’ed space with 0xABADCAFE and thus destroy the payload.

Here (pastie.org/4755699) is my sample implementation for 3.41 lv2_kernel (although the vulnerability should be present in all versions of lv2 up to the latest firmware), maybe someone of you will find a way to overcome problem (2.) and can get something nice out of it because right now it’s only good to crash lv2.

From Mathieulh (via pastebin.com/naxXkv3M):

The footer signature is still not checked upon npdrm self files execution as of 4.21.

Because kakaroto says something that doesn't make it true. Basically he found a check in 3.55 that was not even called and assumed they used it in 3.60+.

Of course they do whitelist npdrm now so even if the footer isn't checked you cannot run your own npdrm selfs signed with keyset lower than 0x0D making the whole debate rather pointless. Aditional checks are now performed on the actual file format as well such as the segment counter flag that needs to be set to 0x01 except for the very last segment.

Finally, from KDSBest (via twitlonger.com/show/jcmh80): Since naehrwert posted an lv2 exploit I will do so too . The stack pointer points to lv2 and if we do a syscall, the syscall saves register to the stack HAHA.

Btw. It just crashes the console for now, since I totally overwrite dump the lv2 or some memory addresses I don't know. Feel free to try around, adjust the address of the stackpointer and so on. If you managed to get the panic payload executed. Tell me!!! ^^

I didn't managed to make it work on 4.21 so I just did on 4.20






Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!

Comments 234 Comments - Go to Forum Thread »

• Please Register at PS3News.com or Login to make comments on Site News articles. Thanks!

elser1's Avatar
#49 - elser1 - 96w ago
great news but wheres the 4.30 cfw. that be the one we want!

Please upload to mediafire or some thing that works without all the garbage that goes along. so sick of trying to download and need this livid crap etc, mediafire is best. should be the only one allowed i think!

PS3 News's Avatar
#48 - PS3 News - 96w ago
Following up on the previous update by Naehrwert and yesterday's PS3 LV0 Keys leak, today Chinese developer Rain fish (aka JjKkYu) has released a 4.21 EBOOT Resigner PS3 SCETool (aka TrueAncestor EBOOT Resigner) script which allows the resigning of 3.55 or decrypted EBOOT.BIN files for use with PlayStation 3 4.21 CFW.

Download: [Register or Login to view links] / [Register or Login to view links] (Mirror) / [Register or Login to view links] (Mirror #2) / [Register or Login to view links] (Mirror #3) / [Register or Login to view links] / [Register or Login to view links] by haz367

To quote, roughly translated: Update: I renamed my resigner to TrueAncestor EBOOT Resigner and add DEX support. Enjoy.

This is a script of SCETool to resign the 3.55- or decrypted EBOOT.BIN for 4.21CFW use.

Tutorial:

1. Extract the 4.21 EBOOT Resigner.zip.
2. Put EBOOT.BIN into the extracted folder.
3. Run resigner.bat to resign EBOOT, you may need to choose encrypt type.
4. If you chose NPDRM type, you need to enter Content-ID.
5. The original EBOOT.BIN will be renamed to EBOOT.BIN.BAK.

This script is tested on BD4.21 CFW, and it should work on Rogero 4.21. Some game also contains decrypted self or sprx file, you need to resign them manually.

Credit to badzbb.

Note: This script uses 3.60 keys to encrypt the EBOOT, no new keys.

TrueAncestor EBOOT Resigner Oldschool 3.55 Resign Added by haz367:

All credits to JjKkYu, badzbb, aldostools, Asure and everybody else... added 2 more options to it for 3.55 users:

5. Disc t/m 3.7X Backup EBOOT Auto-resign (Oldschool 3.55 CFW)
6. NPDRM Game/Update t/m 3.6X EBOOT Auto-resign (Oldshcool 3.55 CFW)

Only add the "keys" file to it.

From danixleet comes some PS3 homebrew ports as follows: 4.XX CFW Homebrew (In theory these should all work on OFW 3.6+)






From Condorstrike also comes Solar 4.2 for CFW 3.55-4.XX and PS3LoadX_4.XX for 4.XX CFW with details on the latter below:

Here's an updated and repacked PS3LoadX for 4.xx CFW’s, did some minor code cleanup, and bug removal, also reduced application size and replaced the loading method. Also replaced ICON0 and PIC1 for better aesthetics. Enjoy...

  • Repacked for use with 4.xx CFWs.
  • Replaced loading method.
  • Fixed minor bug with Temporary Folder.

Features:

  • You can load SELF files using the net.
  • You can load applications from USB/ HDD devices
  • You can install applications to the USB or HDD devices from one .zip file
  • You can copy applications from USB devices to HDD
  • Also you can delete installed applications.

Installing and launching programs and .zip files:

  • You can load .ZIP files via tcp using the network, just like the SELFs.
  • An “install” folder will be built into your [USB/HDD root: Homebrew] Folder and contents shadow copied to PSL145310/homebrew/install.
  • The “install” folder can be added manually as-well, if no network loading is to be used.
  • Programs will be displayed in PS3LoadX and buttons commands will be available accordingly.

Finally, from samson: I ran windos eboot through all options in the resigner, if my guess works right you should be able to install windos final for 3.55 on 4.xx cfw's/dex and just replace the eboot. Also some should work for my other dos games/toys.

More PlayStation 3 News...

dalmatianu's Avatar
#47 - dalmatianu - 100w ago
Great news

xrayglasses's Avatar
#46 - xrayglasses - 100w ago
again.. it can write HTAB entries..

One you get a stable execution (hint ROP) you can glitch HTAB entries and do anything except persistent root because bootldr couldn't even be figured out by fa1loverflow team..

If you're looking for a lv1 exploit you'll never get anywhere unless you get a talented RE person with a lot of time, and since it's obvious Linux means less than piracy is PS3 scene that isn't likely to happen..

Tidusnake666's Avatar
#45 - Tidusnake666 - 100w ago
stack overflow... so 199X-th.... but still works!! Haha!

I still prefer to use 0xFACEBOOC instead of 0xABADCAFE lol

Sponsored Links

Sponsored Links
Sponsored Links

Sponsored Links







Affiliates - Contact Us - PS3 Downloads - Privacy Statement - Site Rules - Top - © 2014 PlayStation 3 News