Post: 3.56 Firmware Encryption Keys Found! UPDATE: Possible 3.56 Downgrade!
Options
01-27-2011, 03:19 AM
#1
*SCHAOS*
ILLUMINATUS
It seems as though PS3 Dev's KakaRoTo, Rms and Adrianc have already located the new encryption keys Sony implemented in an attempt to combat Homebrew.
UPDATE 1 (1/26): The keys have been pushed to KaKaRoTo's git repository and are now available for download.
UPDATE 2 (1/27): More Good News; It looks as though PS3 Dev Mathieulh has began work on the new FW and gives insight into downgrading back to 3.55!
Here's a snippit of their IRC converstion:
KaKaRoTo: nice... it's full of spkg files now .. probably a new crypted pkg format
KaKaRoTo: possibly with a new signature that only ps3swu.self can read, but without the ecdsa fail
KaKaRoTo: humm.. seems I was misled, there's no spkg files in 3.56
KaKaRoTo: ok, so they added a new .self file in the PUP
KaKaRoTo: and it seems it contains a key that we don't know about
KaKaRoTo: yeah, probably a newer ps3swu.self that is more secure
KaKaRoTo: but they kept the old one for people upgrading from older firmwares
KaKaRoTo: the new ps3swu.self probably decrypts and uses the new self
KaKaRoTo: ok, so we need new keys for everything now You must login or register to view this content.
KaKaRoTo: I just pushed to ps3tools and ps3utils, fixes to allow pup/puppack/pupunpack to identify the new files in the pup
rms: 000130e0 22 62 8a 9e c4 c4 14 d5 b3 2f 2b 4b a4 92 60 89 |"b......./+K..`.|
rms: 000130f0 de 9a 46 1b 19 0f b3 e4 39 2d 05 7c 52 55 35 de |..F.....9-.|RU5.|
rms: 00013100 d5 d4 b8 ed 62 b6 cc a0 24 9a 79 77 6e 13 69 75 |....b...$.ywn.iu|
rms: 00013110 51 75 1b 9f 1d a5 86 38 d2 d9 9f 67 e2 0a 1d 4a |Qu.....8...g...J|
rms: 00013120 45 4c 5b 04 2c d1 d0 a4 49 a2 98 98 08 00 2b a6 |EL[.,...I.....+.|
rms: 00013130 8f b5 b7 f4 b5 b4 e6 3b 00 00 00 00 00 00 00 00 |.......;........|
rms: try it.
KaKaRoTo: rms, what's that blob you pasted ?
adrianc: the new key
KaKaRoTo: ha, cool
KaKaRoTo: rms, if you know how and can extract all the new keys, please do and send them to me so I can upload to my ps3keys repo
adrianc: the new keys are all in there
rms: KaKaRoTo: i believe it's a lv2ldr key
rms: erk/riv/pub its all in one block
rms: i forgot the order its in though, it should be in that, its been a while
KaKaRoTo: I don't even know how you did to find those keys You must login or register to view this content.
adrianc: its in the data section of the elf usually
rms: its really simple
adrianc: after that look for references for blocks of data
rms: really KaKaRoTo, i think even you could do it
rms: adrianc: or something out of place
adrianc: helps to compare to older versions where you already know the key position
rms: and has a set of 8 00s
adrianc: KaKaRoTo 3.56 key works?
KaKaRoTo: adrianc, didn't try, not planning on trying atm
KaKaRoTo: not until I have ~/.ps3/ files prepared for me by someone
KaKaRoTo: possibly with a new signature that only ps3swu.self can read, but without the ecdsa fail
KaKaRoTo: humm.. seems I was misled, there's no spkg files in 3.56
KaKaRoTo: ok, so they added a new .self file in the PUP
KaKaRoTo: and it seems it contains a key that we don't know about
KaKaRoTo: yeah, probably a newer ps3swu.self that is more secure
KaKaRoTo: but they kept the old one for people upgrading from older firmwares
KaKaRoTo: the new ps3swu.self probably decrypts and uses the new self
KaKaRoTo: ok, so we need new keys for everything now You must login or register to view this content.
KaKaRoTo: I just pushed to ps3tools and ps3utils, fixes to allow pup/puppack/pupunpack to identify the new files in the pup
rms: 000130e0 22 62 8a 9e c4 c4 14 d5 b3 2f 2b 4b a4 92 60 89 |"b......./+K..`.|
rms: 000130f0 de 9a 46 1b 19 0f b3 e4 39 2d 05 7c 52 55 35 de |..F.....9-.|RU5.|
rms: 00013100 d5 d4 b8 ed 62 b6 cc a0 24 9a 79 77 6e 13 69 75 |....b...$.ywn.iu|
rms: 00013110 51 75 1b 9f 1d a5 86 38 d2 d9 9f 67 e2 0a 1d 4a |Qu.....8...g...J|
rms: 00013120 45 4c 5b 04 2c d1 d0 a4 49 a2 98 98 08 00 2b a6 |EL[.,...I.....+.|
rms: 00013130 8f b5 b7 f4 b5 b4 e6 3b 00 00 00 00 00 00 00 00 |.......;........|
rms: try it.
KaKaRoTo: rms, what's that blob you pasted ?
adrianc: the new key
KaKaRoTo: ha, cool
KaKaRoTo: rms, if you know how and can extract all the new keys, please do and send them to me so I can upload to my ps3keys repo
adrianc: the new keys are all in there
rms: KaKaRoTo: i believe it's a lv2ldr key
rms: erk/riv/pub its all in one block
rms: i forgot the order its in though, it should be in that, its been a while
KaKaRoTo: I don't even know how you did to find those keys You must login or register to view this content.
adrianc: its in the data section of the elf usually
rms: its really simple
adrianc: after that look for references for blocks of data
rms: really KaKaRoTo, i think even you could do it
rms: adrianc: or something out of place
adrianc: helps to compare to older versions where you already know the key position
rms: and has a set of 8 00s
adrianc: KaKaRoTo 3.56 key works?
KaKaRoTo: adrianc, didn't try, not planning on trying atm
KaKaRoTo: not until I have ~/.ps3/ files prepared for me by someone
KaKaRoTo: lv2 3.56 decrypted You must login or register to view this content.
rms: keyset?
KaKaRoTo: pushing to github.com/kakaroto/ps3keys
KaKaRoTo: pushed
rms: ok
rms lv1 is also new
rms lv0 also
rms and also the spu stuff apparently
KaKaRoTo: humm.. I wonder who has the lv0 key
adrianc: i dont think lv0 is available
rms: keyset?
KaKaRoTo: pushing to github.com/kakaroto/ps3keys
KaKaRoTo: pushed
rms: ok
rms lv1 is also new
rms lv0 also
rms and also the spu stuff apparently
KaKaRoTo: humm.. I wonder who has the lv0 key
adrianc: i dont think lv0 is available
KaKaRoTo: iso keys are now pushed
KaKaRoTo: also, now, if we want to repackage things (unless they screwed up the ecdsa *again*), we'd have to change the keys in all the loaders... which means repackaging all the *ldr and iso selfs...
KaKaRoTo: so even more risk of bricking :tongue:
KaKaRoTo: pushed spp keys
KaKaRoTo: the missing keys are for 'app', 'ldr' and 'rvk'
KaKaRoTo: btw.. where is that 'ldr' coming from ?
KaKaRoTo: and I can't figure out who decrypts lv0
KaKaRoTo: it can't be metldr since that one can't be changed
KaKaRoTo: and there's no lv0ldr
eussNL: bootldr decrypts lv0 afaik
KaKaRoTo: there's no bootldr either
adrianc: bootldr and lv0ldr arent in the pup
Matt_P: not part of coreos
Matt_P: and theres no such thing is lv0ldr
KaKaRoTo: also, now, if we want to repackage things (unless they screwed up the ecdsa *again*), we'd have to change the keys in all the loaders... which means repackaging all the *ldr and iso selfs...
KaKaRoTo: so even more risk of bricking :tongue:
KaKaRoTo: pushed spp keys
KaKaRoTo: the missing keys are for 'app', 'ldr' and 'rvk'
KaKaRoTo: btw.. where is that 'ldr' coming from ?
KaKaRoTo: and I can't figure out who decrypts lv0
KaKaRoTo: it can't be metldr since that one can't be changed
KaKaRoTo: and there's no lv0ldr
eussNL: bootldr decrypts lv0 afaik
KaKaRoTo: there's no bootldr either
adrianc: bootldr and lv0ldr arent in the pup
Matt_P: not part of coreos
Matt_P: and theres no such thing is lv0ldr
adrianc: apparently sony removed recovery mode
UPDATE:
Mathieulh: Sorrowuk I suppose modchip manufacturers will start shipping nor/nand programmer soon..
IceKiller: Mathieulh why? just get a at90 based thing
IceKiller: i already told you about that Mathieulh :tongue:
Mathieulh: SLC the bootchain is pwned, no matter what
Mathieulh: you can always downgrade the coreos
Mathieulh: 3.56 has nice new stuffs in there
Mathieulh: like remote code execution upon login
Mathieulh: I assume they probably added some syscalls for lv2 integrity checks
Sorrowuk: Who wants to resign lv2diag.self for 3.56 so it works again ? I would do it but I dont know how to rebuild the signature after I change the authid . Some people are stuck in service mode in 3.56 lol
Mathieulh: Sorrowuk you can't
Sorrowuk: so people are stuck in service mode?
Mathieulh: they force updaters and lv2diags to be signed with the new 3.56+ app key
Mathieulh: and of course we don't have the private key for that
Mathieulh: if they want to get out of service mode they have to downgrade first by reflashing the nor externally
Sorrowuk: Sony should release a new lv2diag.self for everyone to get out of service mode. thats not very nice of them XD
Mathieulh: btw interestingly enough
Mathieulh: it seems the new signature check for the updater (and supposedly lv2diag) is skipped on DEX consoles
Mathieulh: I assume that's to allow debugs to downgrade
Sorrowuk: so if you used a nand flasher and flashed the nand of a retail with a debug nand, you would have a debug console
IceKiller: Sorrowuk no
IceKiller: won't work.
Mathieulh: You must login or register to view this content.
About 3.56 if the updater/lv2diag application keyset revision is lower than 0x0D, lv2 will refuse to run it.
Mathieulh: the fail is the following anyway, decrypt your hdd cache partition /dev_hdd1 using the hdd decryption trick right after the 3.56+ updater starts (but before it updates) (just use the back switch), then replace the coreos package, with one you resigned which has 3.55 coreos but 3.56+ in info0 (or the value 0xA0 at offset 0x2C) then reencrypt the hdd partition and put the hdd back, because the
Mathieulh: update status flag will be set, the updater will start and flash the resigned 3.55 coreos package (the fail works because they haven't changed the packages signatures, not like they can)
Mathieulh: then you can use service mode again and flash whatever crap
Mathieulh: doesn't work on slims cause the hdd decryption trick is fixed there
Mathieulh: they btw can't fix it in the fat ones because it's hardware related
Mathieulh: (encdec device)
Mathieulh: also it's not the decryption that's the issue
Mathieulh: appldr decrypts those selfs fine
Mathieulh: the problem is lv2 wont run them
Mathieulh: lv2 checks the app revision
Mathieulh: if it's lower than 0x0D it wont run it
Mathieulh: and of course you can't change an old one to 0x0D or higher
Mathieulh: cause then appldr will check the signature with the new pub key
Mathieulh: and you lack the private key
Mathieulh: of course if anyone manages to pack a new PUP properly, then you don't need to do the hdd crypto shit to
Mathieulh: but I haven't looked at the new pup format
Mathieulh: rofl I am looking at the new appldr
Mathieulh: and they hardcoded/revoked tons of new auth_ids in there
Mathieulh: how much do you want to guess that those are the ones of the previously signed homebrews ? xD
Mathieulh: oh ! wait
Mathieulh: those aren't auth_id
Mathieulh: those are hashes
Mathieulh: 20 bytes each
Mathieulh: sha1 considering the lenght
Mathieulh: selfs
Mathieulh: that has defintely something to do with why npdrm homebrews stopped working
Mathieulh: in fact I am running the new appldr in You must login or register to view this content.
Mathieulh: and it wont decrypt these demos
Mathieulh: I mean homebrews
Mathieulh: well you get the idea
naehrwert: so new demos need new firmware version then, but what if they want to release a new demo and don't want to update fw?
Mathieulh: naehrwert they just have to encrypt/sign it with new keys
IceKiller: Mathieulh why? just get a at90 based thing
IceKiller: i already told you about that Mathieulh :tongue:
Mathieulh: SLC the bootchain is pwned, no matter what
Mathieulh: you can always downgrade the coreos
Mathieulh: 3.56 has nice new stuffs in there
Mathieulh: like remote code execution upon login
Mathieulh: I assume they probably added some syscalls for lv2 integrity checks
Sorrowuk: Who wants to resign lv2diag.self for 3.56 so it works again ? I would do it but I dont know how to rebuild the signature after I change the authid . Some people are stuck in service mode in 3.56
lol Mathieulh: Sorrowuk you can't
Sorrowuk: so people are stuck in service mode?
Mathieulh: they force updaters and lv2diags to be signed with the new 3.56+ app key
Mathieulh: and of course we don't have the private key for that
Mathieulh: if they want to get out of service mode they have to downgrade first by reflashing the nor externally
Sorrowuk: Sony should release a new lv2diag.self for everyone to get out of service mode. thats not very nice of them XD
Mathieulh: btw interestingly enough
Mathieulh: it seems the new signature check for the updater (and supposedly lv2diag) is skipped on DEX consoles
Mathieulh: I assume that's to allow debugs to downgrade
Sorrowuk: so if you used a nand flasher and flashed the nand of a retail with a debug nand, you would have a debug console
IceKiller: Sorrowuk no
IceKiller: won't work.
Mathieulh: You must login or register to view this content.
About 3.56 if the updater/lv2diag application keyset revision is lower than 0x0D, lv2 will refuse to run it.
Mathieulh: the fail is the following anyway, decrypt your hdd cache partition /dev_hdd1 using the hdd decryption trick right after the 3.56+ updater starts (but before it updates) (just use the back switch), then replace the coreos package, with one you resigned which has 3.55 coreos but 3.56+ in info0 (or the value 0xA0 at offset 0x2C) then reencrypt the hdd partition and put the hdd back, because the
Mathieulh: update status flag will be set, the updater will start and flash the resigned 3.55 coreos package (the fail works because they haven't changed the packages signatures, not like they can)
Mathieulh: then you can use service mode again and flash whatever crap
Mathieulh: doesn't work on slims cause the hdd decryption trick is fixed there
Mathieulh: they btw can't fix it in the fat ones because it's hardware related
Mathieulh: (encdec device)
Mathieulh: also it's not the decryption that's the issue
Mathieulh: appldr decrypts those selfs fine
Mathieulh: the problem is lv2 wont run them
Mathieulh: lv2 checks the app revision
Mathieulh: if it's lower than 0x0D it wont run it
Mathieulh: and of course you can't change an old one to 0x0D or higher
Mathieulh: cause then appldr will check the signature with the new pub key
Mathieulh: and you lack the private key
Mathieulh: of course if anyone manages to pack a new PUP properly, then you don't need to do the hdd crypto shit to
Mathieulh: but I haven't looked at the new pup format
Mathieulh: rofl I am looking at the new appldr
Mathieulh: and they hardcoded/revoked tons of new auth_ids in there
Mathieulh: how much do you want to guess that those are the ones of the previously signed homebrews ? xD
Mathieulh: oh ! wait
Mathieulh: those aren't auth_id
Mathieulh: those are hashes
Mathieulh: 20 bytes each
Mathieulh: sha1 considering the lenght
Mathieulh: selfs
Mathieulh: that has defintely something to do with why npdrm homebrews stopped working
Mathieulh: in fact I am running the new appldr in You must login or register to view this content.
Mathieulh: and it wont decrypt these demos
Mathieulh: I mean homebrews
Mathieulh: well you get the idea
naehrwert: so new demos need new firmware version then, but what if they want to release a new demo and don't want to update fw?
Mathieulh: naehrwert they just have to encrypt/sign it with new keys
[/COLOR]
Looks like the Dev's win again. Ill try to keep this thread up to date as I find more news.
Last edited by
*SCHAOS* ; 01-28-2011 at 12:18 AM.
The following 179 users say thank you to *SCHAOS* for this useful post:
-Skyline, -Syed-, Alt, 04jberry, 3nduser, Accurs0, adam9897, Adam™, Agent Wolf, ahacker234, air6199, allant, AlphaPoppy, Ander$on, Andr3wM, Asmel, Axiom, azhar101, Bad Luck Brian, baitz4, bcb, bigboybobby14, billionk, Bloodstaind, Bomber1614ModZ, brad_, brookboy98, BuLlDoZeR_2014, Car Lover, chat912, ChefHOU, ChillChiefly96, CHuRCHYx, Clutch Hunterr, CmDeR, commander2000, Como's Hoe #1, Cooliohoolio, courtjester51, cozmo195, Dan21392, DarkLiightz, DaRKnEzZ-, david9602, DemonPaladin, DG-K95, divybc, dkfallen, eekndot, effinTyler, Eggy551, egonadrian, Elementt, Eltrickster977, fatboyfry, forumjunkie, FourzerotwoFAILS, frag06, Fuser's Hoe, galanoth, Geigers, get_fukedup, Gold Star, Grandad Trotter, hacker103, Hakaan, Hawkeslayer, HeadHunterM7, hofpint, Hx1, I Got Cookies, ibombo, ii-ownaged-iixx, iiFaMoUzZ-, iMAGEi, ipodtouch44, iRobert, ismael91, italianboss, IX_BloodBath_XI, J.V., j0ker666, j0nny, jakenbake, Jakob, Janiboy, jeffers07, joejn27, kiddblaze18, Kohnt101, krazyfoolof2010, lawford, Ledet, lubu772, markinatorz, Max21, maxrox and 79 other users.
01-27-2011, 01:35 PM
#65
Crystallis
Haxor!
Originally posted by Riau
You are soooo incorrect.. Sony can not be sued for bricking you. It's in their terms of use that you can't modify it. The first damn paragraph. You're violating their ToU by modifying your PS3 system and they can stop it.
Oh really? Show me.
01-27-2011, 02:05 PM
#67
Grandma
Join Date: 10-26-2010
Originally posted by Crystallis
Oh really? Show me.
This is in almost EVERY user agreement you see today. Not just gaming consoles, but DVD players aswell and everything in between.
From the user agreement.
Evidence #1
"You may not modify or attempt to modify the online client, disc, save file, server, client-server communication, or other parts of any game title, or content"
Evidence #2
"You may not cause disruption to any account, system, hardware, software, or network connected to Sony Online Services for any reason, including for the purpose of gaining an unfair advantage in a game"
^ "gaining an unfair advantage in a game"
Right there too, is challenge lobbies not an unfair advantage? When you're across the map and he's 200 feet in the air doing 1080 no scopes when you're hiding? Let alone he has for say, Commando or sitrep?
Lastly, evidence numero trois. (#3)
"You may not use, make, or distribute unauthorized software or hardware, including Non-Licensed Peripherals, in conjunction with Sony Online Services, or take or use any data from Sony Online Services to design, develop or update unauthorized software or hardware, including cheat code software or devices that circumvent any security features or limitations included on any software or devices. "
Is creating custom firmware and what not, unauthorized software? Did sony create this? No. You are using data (as seen above with the keys) to find exploits and create custom firmware.
Just because you have paid for the system does not mean you can do what ever you want to it. There are conditions to follow.. But hey, once you get it bricked for not following these conditions you can go sue them and face A LOT of lawyers.
P.S, When it stops working, you can use it as a door stump, or maybe you can decorate it a bit and put it on your desk as a paper weight.
01-27-2011, 02:09 PM
#68
Crystallis
Haxor!
Originally posted by Riau
This is in almost EVERY user agreement you see today. Not just gaming consoles, but DVD players aswell and everything in between.
From the user agreement.
Evidence #1
"You may not modify or attempt to modify the online client, disc, save file, server, client-server communication, or other parts of any game title, or content"
Evidence #2
"You may not cause disruption to any account, system, hardware, software, or network connected to Sony Online Services for any reason, including for the purpose of gaining an unfair advantage in a game"
^ "gaining an unfair advantage in a game"
Right there too, is challenge lobbies not an unfair advantage? When you're across the map and he's 200 feet in the air doing 1080 no scopes when you're hiding? Let alone he has for say, Commando or sitrep?
Lastly, evidence numero trois. (#3)
"You may not use, make, or distribute unauthorized software or hardware, including Non-Licensed Peripherals, in conjunction with Sony Online Services, or take or use any data from Sony Online Services to design, develop or update unauthorized software or hardware, including cheat code software or devices that circumvent any security features or limitations included on any software or devices. "
Is creating custom firmware and what not, unauthorized software? Did sony create this? No. You are using data (as seen above with the keys) to find exploits and create custom firmware.
Just because you have paid for the system does not mean you can do what ever you want to it. There are conditions to follow.. But hey, once you get it bricked for not following these conditions you can go sue them and face A LOT of lawyers.
P.S, When it stops working, you can use it as a door stump, or maybe you can decorate it a bit and put it on your desk as a paper weight.
From the user agreement.
Evidence #1
"You may not modify or attempt to modify the online client, disc, save file, server, client-server communication, or other parts of any game title, or content"
Evidence #2
"You may not cause disruption to any account, system, hardware, software, or network connected to Sony Online Services for any reason, including for the purpose of gaining an unfair advantage in a game"
^ "gaining an unfair advantage in a game"
Right there too, is challenge lobbies not an unfair advantage? When you're across the map and he's 200 feet in the air doing 1080 no scopes when you're hiding? Let alone he has for say, Commando or sitrep?
Lastly, evidence numero trois. (#3)
"You may not use, make, or distribute unauthorized software or hardware, including Non-Licensed Peripherals, in conjunction with Sony Online Services, or take or use any data from Sony Online Services to design, develop or update unauthorized software or hardware, including cheat code software or devices that circumvent any security features or limitations included on any software or devices. "
Is creating custom firmware and what not, unauthorized software? Did sony create this? No. You are using data (as seen above with the keys) to find exploits and create custom firmware.
Just because you have paid for the system does not mean you can do what ever you want to it. There are conditions to follow.. But hey, once you get it bricked for not following these conditions you can go sue them and face A LOT of lawyers.
P.S, When it stops working, you can use it as a door stump, or maybe you can decorate it a bit and put it on your desk as a paper weight.
Can't see anywhere where it says that they have the rights to brick your console, all they can do is ban you from PSN and other services such as Netflix and so on.
P.S, I'm cool btw, got more PS3s.
01-27-2011, 02:17 PM
#70
PlayDude77
Gym leader
Originally posted by D
i really think they should make a CFW that cant ghet patched, like sometng like "9.99" sony cant possible ghet over that, something like they will take much time to ghet that high Firmware :/
I don't think it's that simple... :carling:
The following user thanked PlayDude77 for this useful post:
01-27-2011, 02:18 PM
#71
mental_taliban
Brute
I understand all the hate mails and - rep i'll get but i have to say this.
STOP MAKING NEW WAYS TO DO CL'S. ITS ****ING ANNOYING
STOP MAKING NEW WAYS TO DO CL'S. ITS ****ING ANNOYING
The following 2 users say thank you to mental_taliban for this useful post:
01-27-2011, 02:24 PM
#72
econg
Bounty hunter
That is Not possible. If it is that possible you Could use something like a custom Firmware server where you can update to a New custom firmware simple by pressing x. You have to modify the firmware that it s looking like the original current One . A higher or older Firmware would Disable you from connecting to Psn. The Best would Be to develop something to stay connected to Psn without updating to current Firmware
01-27-2011, 02:26 PM
#73
Grandma
Join Date: 10-26-2010
Originally posted by Crystallis
Can't see anywhere where it says that they have the rights to brick your console, all they can do is ban you from PSN and other services such as Netflix and so on.
P.S, I'm cool btw, got more PS3s.
P.S, I'm cool btw, got more PS3s.
Brick, Ban, whatever. They have tons of lawyers. I'm not their company. I'm sure they can find ways around this. Maybe banning is their "bricking." Anywho, i'm gonna go play Call of Duty. Enjoy your single player games! (L) You and your cousin can play split screen or something.
Copyright © 2024, NextGenUpdate.
All Rights Reserved.
