THREAD: BluePrints for ps3 exploit. All series for the PS3 (including BD-Drive/PSP/PS3)
  1. 04-11-2011, 02:21 AM
    Si1entDev's Avatar
    Si1entDev
    Bounty hunter
    Si1entDev's Avatar
    Si1entDev
    Bounty hunter
    156
    Posts
    577
    Reputation
    Apr 2011
    NextGenUpdate
    shouldn't this be a stickied thread? Because you can pretty much jailbreak all future an now firmwares

    MINE AN MATHIEULH's TALK IS AT BOTTOM!
    PLEASE DO NOT ASK ME QUESTIONS ABOUT HOW TO DO THIS FOR YOUR PS3. IF YOU DONT KNOW THEN DONT DO IT I RECCOMEND FOR THE PEOPLE WHO HAVE 3 PS3's OR THEY CAN BUY ANOTHER.

    Here it is. I am hoping by now the mods have closed my other thread.
    I have added more to the blue prints.
    1. BD-Drive BluePrint
    2. PS3 Model BluePrints: CECHA00, A01, CECHG, CECHC02, C03, C04, C08, CECHE01, E05, E11
    3. Also included the PSP-2000 TA-085

    Download for BluePrints: You must login or register to view this content.
    File Size is 108MB
    VIRUS SCAN AT BOTTOM!

    Your welcome I hope you guys are happy that I released this but I am sure a few of you have itSmile Also IF YOU ARE WANTING TO TRY EXPLOITING 3.60 YOURSELF THIS IS REQUIRING 2 PS3's AN KNOWLEDGE OF SOLDERING.

    @xShadow125 You can update from your pwn pup only from 3.55 or lower, unless you have an exploit.

    @xShadow125 Of course that should be fixed in upcoming lv0 revisions anyway (By moving the ldrs to the top of lv0)

    @xShadow125 You run the 3.60 lv0, then you switch the nor, and pull the cell reset line, and you dump the extra KBs where the loaders are.

    @xShadow125 Basically you have a nor with 3.55 (or lower) lv0 and your own small lv1 code that does the dump, and 3.60 lv0 on the other.

    @xShadow125 You wont get all of lv0 but the part with the loaders shouldn’t be overwritten.

    @xShadow125 You can actually get all the 3.60 keys/loaders without knowing lv0 keys by dumping lv0 from ram with dual nor and signed lv1.

    To those planning on building a 3.56+ pup for whatever reason, the files attributes changed, the group and user ids for the files as well.

    The new 3.56+ values for tarballs are the following: owner_id, “0000764″ group_id, “0000764″ owner, “tetsu” group, “tetsu” ustar, “ustar “

    You can use fix_tar to use those new values. Use with caution.

    By comparison, those are the pre-3.56 values. owner_id, “0001752″ group_id, “0001274″ owner, “pup_tool” group, “psnes” ustar, “ustar “

    @Ps3WeOwnYoU You need to either decrypt or dump lv0, then you can get the encrypted loaders and decrypt them with the metldr key. Good luck.



    LV0 Console security by RMS

    Anyway, let’s really discuss something PS3 instead of my PC , let’s start with Lv0, the most unknown level of the PS3. Lv0 initializes PS3 base hardware such as PowerPC/PPU portion of Cell/BE, SPU isolation for asecure_loader, and gelic ethernet/WLAN device. Lv0 also proudly proclaims itself as the “Cell OS Bootloader”. In older firmwares, 0.80-ish to 3.56, Lv0 initialized SPU isolation on one of the SPUs, then it loaded and decrypted asecure_loader. Asecure_loader or metldr then decrypts the isolated loader, in this case, lv1ldr, then lv1ldr decrypts lv1.self. In 3.60 this changed. Lv0 now has all of the loaders integrated into it as one large fat binary. All the keys one needs such as Public ECDSA key/AES CBC key and Initialization Vector and ECDSA curve type are in there. Just go ahead and grab them if you can get the ldrs out of the binary.

    So, unless you can decrypt Lv0, no 3.60 “CFW” for you . Is there any need for it anyway?


    Mathieulh's facts about LV0

    1. lv0 isn’t a loader it’s a ppu binary

    2. Lv0 isn’t encrypted per console and can be updated with the rest of the coreos

    3. Lv0 is decrypted by the bootloader, there is no such thing as a lv0ldr.

    4. The bootloader keys cannot be updated/modified on EXISTING hardware

    5. lv0.2 is NOT a binary, it’s a new metadata for lv0 which is to be decrypted and verified by a new bootloader (which is to be available on future ps3s), it is NOT used by the current bootloader (and thus in current playstation 3 consoles)
    But wait, messing with this thing could lead to the YLOD tragedy, unless you have those expensive NOR flasher you might want to proceed, and that’s according to rms again.



    RMS

    Lv0 also does some more interesting stuff such as SPU mailbox handling, and eEID integrity checks. Lv0 also used to check for QA flag and proper token, that is now in a spu isolated self in Core OS. Now, if you did tamper with eEID, lv0 will panic out, and your console will then “YLOD”, and you’d need a flasher for your PS3 to recover
    There you go, with all the information available out there i just wonder why didn’t anyone found the solution to the exploit that Mathieulh (and maybe some people we didn’t know) discovered weeks ago. Maybe instead of *****ing why the guy did not release anything, try listening to what he said this time.


    MINE AN MATHIEULH's TALK!

    SilentDev> Mathieulh , i'm stucked i read and read your post's with 3.60+ exploit , and no have idea to first step , i already installed a teensy ++ to flash nor for brick risk , you have any hint to me? :-D
    <rms> nope
    <Mathieulh> you need dual nor/nand
    <rms> no hints :P
    <Mathieulh> lol
    <Mathieulh> the first step
    <Mathieulh> is to clone your existing nor/nand
    <Mathieulh> to another
    <Mathieulh> and solder it with a switch
    <Mathieulh> you also need to solder on the cell reset line
    <Mathieulh> (look at those leaked service docs to see where it's at)
    <igor242> holy shit
    <igor242> what a exploit
    <Mathieulh> it's more of a trick
    <Mathieulh> than an exploit
    <Mathieulh> at least to me it is
    <Mathieulh> and all it lets you do is to get 3.60 keys
    <igor242> ah
    <Mathieulh> the interest is quite limited
    *** cooled [~cooledef@pool-98-116-134-86.nycmny.fios.verizon.net] has joined #ps3dev
    *** mode/#ps3dev [+v cooled] by hyprvisor
    <igor242> so this is for future cfw's then?
    <Mathieulh> igor242 that's not the loaders exploit I tweeted about
    <Mathieulh> it's something else entirely
    <Mathieulh> the loader exploit is actually easier to use xD
    <igor242> then what use are 3.60 keys?
    <rms> shhhhh. don
    <Mathieulh> but it's still a mess to implement
    <Mathieulh> ok rms xD
    <rms> don't leak our hard work :P
    <Mathieulh> lol
    <rms> </windows8>
    <Mathieulh> I even lol more at "hard" xD
    <rms> lol
    *** WiiSpacem [~Spiff@190.50.18.129] has joined #ps3dev
    <Mathieulh> I mean that bug is so stupid xD
    <rms> yea
    <Link0> rate it
    <Link0> on a scale of one to blueberry
    <rms> but its painful to implement
    <igor242> i thought your trick was for pulling the keys to sign cfw with
    <Mathieulh> rms it's still ****ing dumb xD
    *** lyntoo [~manitoo@64.235.204.179] has joined #ps3dev
    <rms> Mathieulh true
    <Link0> im curious
    SilentDev> oh , i need another ps3 to extract nor , soldering look easily , ? any schematics to put switch released ?
    <Mathieulh> igor242 of course not, you can't get 3.60 private keys
    <Link0> bottomline it
    *** mode/#ps3dev [+l 404] by NNNnc1
    <GayMan> Hey could you send to me? I am getting my 2 other ps3's in a few days
    <GayMan> I cant test?
    *** GomGom left #ps3dev [19 01 b2 b3 78 d3 74 5a 10 e0 99 6b 3e c1 12 5d]
    <Mathieulh> SilentDev you need to switch between the 2 nor/nand
    <Mathieulh> at runtime
    <igor242> i see
    <dospiedra> switch all points????
    <GayMan> mathieulh could yoiu?
    <Mathieulh> SilentDev yes
    <SilentDev> lol ....
    <SilentDev> 40+ switchers
    <SilentDev> look great :-D
    <GayMan> dos that sounds like fub
    <Mathieulh> SilentDev I said it works, I didn't say it was easy xD
    <Mathieulh> you'd also need to code the ppu dumper
    <Mathieulh> the one you want to replace lv1 with
    <SilentDev> ok , i now search other nor chip and desolder already installed to put switchers


    VIRUS SCAN:

    0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
    File name: index.html
    Submission date: 2011-04-11 23:22:24 (UTC)
    Current status: finished
    Result: 0/ 41 (0.0%)
    VT Community

    not reviewed
    *Safety score: -*
    Compact
    Print results
    Antivirus Version Last Update Result
    AhnLab-V3 2011.04.12.00 2011.04.11 -
    AntiVir 7.11.6.53 2011.04.11 -
    Antiy-AVL 2.0.3.7 2011.04.11 -
    Avast 4.8.1351.0 2011.04.11 -
    Avast5 5.0.677.0 2011.04.11 -
    AVG 10.0.0.1190 2011.04.12 -
    BitDefender 7.2 2011.04.12 -
    CAT-QuickHeal 11.00 2011.04.11 -
    ClamAV 0.97.0.0 2011.04.11 -
    Commtouch 5.2.11.5 2011.04.06 -
    Comodo 8307 2011.04.11 -
    DrWeb 5.0.2.03300 2011.04.12 -
    eSafe 7.0.17.0 2011.04.12 -
    eTrust-Vet 36.1.8266 2011.04.11 -
    F-Prot 4.6.2.117 2011.04.12 -
    F-Secure 9.0.16440.0 2011.04.12 -
    Fortinet 4.2.254.0 2011.04.09 -
    GData 22 2011.04.12 -
    Ikarus T3.1.1.103.0 2011.04.11 -
    Jiangmin 13.0.900 2011.04.09 -
    K7AntiVirus 9.96.4360 2011.04.11 -
    Kaspersky 7.0.0.125 2011.04.12 -
    McAfee 5.400.0.1158 2011.04.12 -
    McAfee-GW-Edition 2010.1C 2011.04.11 -
    Microsoft 1.6702 2011.04.11 -
    NOD32 6034 2011.04.11 -
    Norman 6.07.07 2011.04.11 -
    Panda 10.0.3.5 2011.04.11 -
    PCTools 7.0.3.5 2011.04.11 -
    Prevx 3.0 2011.04.12 -
    Rising 23.53.00.05 2011.04.11 -
    Sophos 4.64.0 2011.04.11 -
    SUPERAntiSpyware 4.40.0.1006 2011.04.10 -
    Symantec 20101.3.2.89 2011.04.12 -
    TheHacker 6.7.0.1.171 2011.04.11 -
    TrendMicro 9.200.0.1012 2011.04.11 -
    TrendMicro-HouseCall 9.200.0.1012 2011.04.12 -
    VBA32 3.12.14.3 2011.04.11 -
    VIPRE 8991 2011.04.12 -
    ViRobot 2011.4.11.4404 2011.04.11 -
    VirusBuster 13.6.299.0 2011.04.11 -
    Additional informationShow all
    MD5***: 5c874f7963678d5eb2587da118c1294b
    SHA1**: 8ab36ab5ea6840b21fc668b0f08fb3c5b0cb240a
    SHA256: 0a3cdb0648c032afb4afdac76ec92f874a59152c98cb62d219 0a8dd9fc5893a5
    Last edited by Si1entDev ; 06-05-2011 at 03:55 AM.

  2. The Following 47 Users Say Thank You to Si1entDev For This Useful Post:

    , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

  3. 04-12-2011, 02:22 AM
    Si1entDev's Avatar
    Si1entDev
    Bounty hunter
    Si1entDev's Avatar
    Si1entDev
    Bounty hunter
    156
    Posts
    577
    Reputation
    Apr 2011
    NextGenUpdate
    Originally Posted by killerFBI123 View Post
    if someone would give me another ps3 i would do this,and give it back to the person when i have taken of video of proof with it running homebrew on it! im fairly good at soldering/hacking ive jtag'd 2 360 xenon's =D


    Your sig is like mine shes hot also heres my sig: You must login or register to view this content.

    any if you want to see another hot pic cut off 39_tn.jpg an it will bring you to my pics ive uploaded

    ---------- Post added at 09:22 PM ---------- Previous post was at 07:53 PM ----------

    Originally Posted by norman View Post
    Rob their house. WE NEED CFW! Lol jk. I wont lead to cfw you know right? Well actually thinking of It now malthuilh did say that you would get ecdsa codes. But I for some reason don't think it will work for private keys. Idk


    But I wouldnt know if it was them:(
  4. 04-12-2011, 02:25 AM
    Midnight.eGo's Avatar
    Midnight.eGo
    from El Paso, Texas (915)
    Midnight.eGo's Avatar
    Midnight.eGo
    from El Paso, Texas (915)
    994
    Posts
    4,636
    Reputation
    Sep 2010
    NextGenUpdate
    I Keep Smelling 3.60 CFW. Happy Soon Just Soon
  5. 04-12-2011, 02:34 AM
    SilentStorm1011's Avatar
    SilentStorm1011
    Do a barrel roll!
    SilentStorm1011's Avatar
    SilentStorm1011
    Do a barrel roll!
    125
    Posts
    120
    Reputation
    Nov 2010
    NextGenUpdate
    Originally Posted by RedHair View Post
    this is why rep system shouldnt be in place is fags that think its the world if you are trustworthy they will know your name if not people who are smart will know what you post in these forums dont act like our members are dumb if you let everyone do it by instructions alone no one will ever learn


    maybe you should take a look at the manuals he uploaded instead of pointing fingers on who should be able to rep. if your able to read you will know why i reped him.
  6. 04-12-2011, 02:57 AM
    BriceC's Avatar
    BriceC
    Computer Programmer
    BriceC's Avatar
    BriceC
    Computer Programmer
    1,500
    Posts
    5,428
    Reputation
    Oct 2010
    NextGenUpdate
    Originally Posted by Si1entDev View Post
    whats this for?


    Its for your download file NGU says from now on when you post a DL link you must have virus scan or it will be shut down so get all your scans from You must login or register to view this content.
  7. 04-12-2011, 03:00 AM
    Si1entDev's Avatar
    Si1entDev
    Bounty hunter
    Si1entDev's Avatar
    Si1entDev
    Bounty hunter
    156
    Posts
    577
    Reputation
    Apr 2011
    NextGenUpdate
    Originally Posted by TheWhiteGangsta View Post
    Its for your download file NGU says from now on when you post a DL link you must have virus scan or it will be shut down so get all your scans from You must login or register to view this content.


    Well my thread was posted before it so I am safe
  8. 04-12-2011, 03:02 AM
    bonbonbon's Avatar
    bonbonbon
    dead babies in a tree
    bonbonbon's Avatar
    bonbonbon
    dead babies in a tree
    562
    Posts
    363
    Reputation
    May 2010
    NextGenUpdate
    I'd rather wait for a software JB rather then failing at a hardware one :/
  9. 04-12-2011, 03:14 AM
    BriceC's Avatar
    BriceC
    Computer Programmer
    BriceC's Avatar
    BriceC
    Computer Programmer
    1,500
    Posts
    5,428
    Reputation
    Oct 2010
    NextGenUpdate
    Originally Posted by Si1entDev View Post
    Well my thread was posted before it so I am safe


    What would it hurt tho just to be on the safe side!?!?!
  10. 04-12-2011, 03:18 AM
    Si1entDev's Avatar
    Si1entDev
    Bounty hunter
    Si1entDev's Avatar
    Si1entDev
    Bounty hunter
    156
    Posts
    577
    Reputation
    Apr 2011
    NextGenUpdate
    Originally Posted by TheWhiteGangsta View Post
    What would it hurt tho just to be on the safe side!?!?!


    ok fine credit to you also
  11. 04-12-2011, 03:18 AM
    Norman's Avatar
    Norman
    NORMAN
    Norman's Avatar
    Norman
    NORMAN
    1,215
    Posts
    2,600
    Reputation
    Feb 2010
    NextGenUpdate
    Originally Posted by bonbonbon View Post
    I'd rather wait for a software JB rather then failing at a hardware one :/


    Lol this isn't even a jb