Sony PlayStation 3 Hacker KaKaRoToKS JailBreaks 3.73 PS3 FW?


126w ago - To follow-up on the previous article where Sony PlayStation 3 hacker KaKaRoToKS stated "A solution for 3.60+ will be available soon, so no worries - people just need to be patient" comes some more Tweets today on JailBreaking 3.73 PS3 Firmware.

Below are some of the recent announcement Tweets from KaKaRoToKS on JailBreaking PS3 3.73 Firmware, as follows:

  • I will reply.. but I didn't read... yes, file managers and FTP should work fine.
  • and I'm all for competition, no worries. I do this for fun, not for race or whatever. Also, 3.73 cfw is not possible
  • i dont know yet about emulators... All in good time. There s no rush
  • yes, that's the point, to run homebrew.. showtime should work fine. not tested yet.
  • Nope, completely software based.. I won't say anything more than that for now to avoid them blocking it before release.
  • The "kind of" meant I need to fix NPDRM algo for it to run. And no, this will not allow backup managers. And no, it's not a CFW
  • 1 - I won't share it until it's ready to use (still a bit complicated + some missing components), 2 - don't update if you're on 3.55.
  • Updated my ps3 to 3.73... oh and THEN I jailbroke it! (kind of)

Here is to hoping this is indeed the working solution PS3 scene users have been waiting for, as previously KaKaRoToKS jumped the gun confirming the PS3 Downgrade Success from 3.55 to 3.41 Firmware and then Tweeted "sad news.. downgrade worked, but not reliable, only works with one of Xtse's ps3s, but can't reproduce it.. I'm going to look for another way. nope, it only works on one machine, even if same model, it doesn't work on it. No idea what's different about it..."

Since then, KaKaRoToKS has released a PS3 Expedite Benchmark Tool and Engine Ports, an Eskiss PS3 Homebrew Game and a PlayStation Move Support update for the Eskiss PS3 homebrew game though.

Finally, from IRC on the PlayStation 3 Firmware 3.73 hacking developments:

[KaKaRoTo] heri, docpaul showtime would work fine
[sandungas] kakaroTo, this means new tcl patches for mfw and some changes to manage 3.73 ?
[KaKaRoTo] ddoo, and no I didn't fix the npdrm algo, that's what I'm missing (hence the "kind of") but I'm not
working on that, that's someone else's job
[middleman] gonna debut it at ccc kakaroto or before?
[KaKaRoTo] ddoo, and even if npdrm signing worked.. how do you install your pkg on an OFW 3.73 ?
[heri] so KaKaRoTo, once the NPDRM algo is fixed, a release will come?
[KaKaRoTo] heri, another missing bit, but once that's fixed, yes
[KaKaRoTo] but I'll probably be off country for the next 2 weeks
[KaKaRoTo] so all work will have to be paused
[heri] oh, fair enough. we can all wait 2 weeks hey we have waited months anyways
[KaKaRoTo] ddoo, that might work.. you could also just install your pkg on 3.55 then upgrade
[KaKaRoTo] ddoo, upgrading doesn't delete any of your packages
[KaKaRoTo] ddoo, issue is, you're lost if you didn't do it before upgrading
[ddoo] but they fail because the npdrm algo is spoted by the checks in 3.56+
[KaKaRoTo] heri, also note, I "announced" it because I was excited to see it work as expected
[KaKaRoTo] doesn't mean it's ready for release
[KaKaRoTo] ddoo, exactly
[heri] yeh thats what we were saying just before you came
[KaKaRoTo] so you need : 1 - npdrm algo fixed, 2 - a way to install stuff
[heri] you only announce when you are confident it works
[KaKaRoTo] 1 has been done by someone else (don't know if he'll share it), and 2.. well, I just did it
[KaKaRoTo] heri, well, I was testing on 3.60 and it worked, but yes, I did upgrade to 3.73 to test that it still
works just to make sure I don't tweet any false hopes
[middleman] but you cant run what you installed until 1 is fixed correct?
[KaKaRoTo] middleman, exactly
[middleman] interesting
[docpaul] nice, thx KaKaRoTo
* KaKaRoTo needs to hide now if he wants to get any work done
[KaKaRoTo] ttyl

In summary, KaKaRoToKS upcoming PS3 3.73 Firmware JailBreak will be able to install homebrew .PKG files but unfortunately PlayStation 3 backup managers will not work as they require lv1/lv2 patches that won't be included.

From ps3devwiki.com/index.php?title=KaKaRoTo_Kind_of_%C2%B4Jailbreak%C2%B4#Q.26A:

KaKaRoTo PS3 JailBreak Q&A

Q: Will I need special hardware (e.g. flasher, dongle, modchip etc.)?
A: No.

Q: Will homebrew work?
A: With NPDRM fixed, yes. Showtime would certainly be possible.

Q: Will recent games play correct?
A: Yes, its 3.7x, sure it plays all 1.00 - 3.7x games.

Q: Will PSN work?
A: Yes, its 3.7x, sure goes online without problems.

Q: Does it have Peek & Poke?
A: No. Peek & Poke require modifying lv1 and lv2.

Q: Do Backup manangers (e.g. MultiMAN, Rogero etc.) work?
A: No, see previously answer about Peek & Poke.

Q: Will my old homebrew still work?
A: No. All homebrew need the fixed NPDRM. Homebrew that relies on specific other patched functions/syscalls (e.g. Peek&Poke, BDemu etc.) will not work either, see previously answer about Peek & Poke.

Q: Does it gets us keys?
A: No.

Q: Does it gets us "CFW"/MFW?
A: No.

Q: Does OtherOS++ (Linux/FreeBSD) work?
A: No. Sony removed OtherOS feature after 3.15 and OtherOS++ relies on modifying the firmware. See previous "CFW"/MFW question.

Q: Will it allow downgrade?
A: No.

Q: Does it work on all PS3 models?
A: Yes. all current models.

Q: Are there brick risks?
A: No (standard disclaimer: It will be tested rigorously before release as you can expect from anything that KaKaRoTo has put his name on).

Q: Will this only work on 3.7x?
A: No. It was pretested on 3.60 and again confirmed on 3.73 before any public Tweet about it.

Q: What if Sony releases 3.74/3.80 before release
A: In that case it will be pretested on that version.

Q: So why are all the newssites hyping this that it does give CFW?
A: Because they don't read wiki's/blog's xD Besides, every minor news gets 'prolly CFW soon!' tagged by the bad ones.

Q: Is there a release date?
A: No, besides KaKaRoTo not able to work on it for 2 weeks, it also relies on (other people) fixing NPDRM.

The Road beyond... (or what can you and others do to expand the useability of it)

What is missing Prerelease (current state)?

Fixing NPDRM

  • Make PKG's install and run the SELFs.

What is missing after release?

Peek & Poke

  • lv1/lv2 dumping/patching
  • Payloader3
  • Backup Managers

Downgrade (already possible with Hardware flashing.

  • 3.56+ keys / lv0 decrypted dump
  • Modifying firmware files
  • OtherOS++

Finally, from his page he states the following in attempt to clear things up:

Hi all, I've been flooded with questions on twitter and I've read many posts on news sites and I've seen some stuff being said on IRC and I thought I needed to clarify a few things

First of all, I didn't expect to see my tweet front paged on all ps3 hacking news sites.. although I should have expected it.. but anyways, the "jailbreak" is not ready to be used, at all. I only tweeted that because I was excited having it working and I wanted to share my excitement with everyone. But this is a bit equivalent to the day I released that create_cfw.sh script that created the very first CFW/MFW but it still took a couple of months before a real, easy, multiplatform and fully fledged solution was released : PS3MFW.

We are currently at the same state, I have the proof of concept, it works, but a solution that anyone can use where they just click a button and their PS3 gets jailbroken is still far from ready.

I've seen people say (and even write it in their front page news) that I'll release it in two weeks after I come back from vacation. That is not true and I never said that. What I said was that for the next 2 weeks, the project is on hold until I get back.. but when I get back, then I will continue working on it, and it will then take some more time before it's ready and released.

Some asked if it's based on what gitbrew was doing/suggesting or if I used someone else's exploit or work. No, this solution is my own idea and 100% my own implementation. However, the actual solution for the full jailbreak involves some components on which I will not work, and I expect/hope that someone else will provide the solution for that.

Some speculated it might be what I spoke about back in March which I later said I wasn't pursuing by lack of motivation.. and yes, you are right. The same hack I had in March is still valid today, I told a few people about it (rms, Mathieulh, an0nym0us, and a couple more), but no one was interested in pursuing it further and actually exploiting that flaw (mainly because it requires a huge amount of work to get a proof of concept working). 10 days ago (I started on the 11th), I got bored and decided to start poking at it again, and yesterday (a lot faster than I thought it would take), I got my first pkg installed on 3.73 firmware.

On twitter, I said "do not update if you are on 3.55″, I said that in response to someone who said he would update. Because of that, people speculated that you need to be on 3.55 first, and then install something before doing the upgrade. No, that's not it, that would be useless. The purpose of my solution is to jailbreak a ps3 that is already on 3.73 firmware and which had never been jailbroken before. I told people not to update because, first of all, it's not yet ready, and second of all, the 3.55 firmware gives you a lot more possibilities than what can be achieved on 3.73.

So what is this jailbreak? I won't say because I don't want Sony to block it in a firmware update (and yes, they potentially could) before it's even released (and yes, I will release it when it's ready). But I will explain this to you : in order to run your homebrew apps, you need two things. First, to be able to install them on the ps3, and second to be able to run it once installed. I did only one of these two things.

Some may say it's not a real jailbreak, but the way I see it, there are three 'jails' on the ps3, I broke the first one which prevents you from installing anything, so now you can install your .pkg, great, but it won't run, that's the second jail. The third jail is being able to modify the firmware (peek&poke).

The second jail (running apps) is something that can be done, but it's not my area of expertise (npdrm algo), so I will not be working on that. I am waiting for someone else to achieve it (some have succeeded but do not wish to release it, at least not for now) then I will release.

The third jail (modifying the firmware) is not possible with my method, this means that you will not have a "CFW", you will run your homebrew applications and games on an official firmware. This also means that without peek&poke support, none of the backup managers will work. So, again, my solution is piracy-free, and as always, I do not plan on working on a way to enable piracy (or even legal backups).

Overall, the purpose will be to allow people who are on 3.73 firmware to enjoy the homebrew games that were released, to play a bit with Eskiss, and to use Showtime for playing their movies. This should be more than enough for everyone.




Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!

Comments 381 Comments - Go to Forum Thread »

Quick Reply Quick Reply

kreus's Avatar
#356 - kreus - 115w ago
oh I thought they found a way to decrypt the eboot and unsign. That way it would be possible to reverse engineer. Then all hope is lost hehe

Congrats Cfwprophet and nabnab, I know youre trying hard to make a better place for the scene.

cfwprophet's Avatar
#355 - cfwprophet - 115w ago
We know how it works and have explained a lot of times. The dongle puts your con into debugger mode. In this special mode you can debug games and thats what they do. They use the system embended debugger to let you play those games.

They take the official game selfs from disk and dump out the elf via the sdk, then re-encrypt them as debug selfs and on a special way thats it.

But it takes a bit more work to get this for free for every one done. The keys have nothing to do with it. They use drm just to hide and to be able to milk us all a bit longer till a free version is done.

kreus's Avatar
#354 - kreus - 115w ago
And if someone finds how it works, it should be possible of doing the same thing comparing the eboots without the keys with the ones with keys.

In cryptography, a timing attack is a side channel attack in which the attacker attempts to compromise a cryptosystem by analyzing the time taken to execute cryptographic algorithms. Every logical operation in a computer takes time to execute, and the time can differ based on the input; with precise measurements of the time for each operation, an attacker can work backwards to the input.

elser1's Avatar
#353 - elser1 - 115w ago
its a shame they all think its such a big deal.. its only video games not cure for cancer.. sure it would be great and mean a lot to alot of us but in reality its not that big of a deal, but the way they act gives them a feeling of power i guess.. i don't really understand such behavior, myself i get most enjoyment out of trying to help others..

i wish i bought an xbox when i had the spare cash.. but i love psn too much so ill stick to my ps3 and grin and bare it.. LOL

kreus's Avatar
#352 - kreus - 115w ago
sorry if it sounds stupid, but we seem to already have the equation ecds uses, cant we extrapolate the variables using multiples ps3 on ofw 4.00 and HFW 4.00?

For what i saw the ECDS encryption only works fine if there is only one or a few machines with the same key. With multiple ps3's its possible to extrapolate, and the higher the number the easier it is.













Affiliates - Contact Us - PS3 Downloads - Privacy Statement - Site Rules - Top - © 2014 PlayStation 3 News