Théorie D'un Exploit Sur Le Firmware 4.00

[the-green]

RealPsDev, développeur PS3 connu récemment sur la scène par quelques homebrews, vient de dévoiler une nouvelle théorie qui selon lui et si ça se réalise pourrait ouvrir la porte pour hacker le firmware 4.00 et récupérer les clés de ce dernier.

Ce n'est pas la première fois que RealPSDev lâche une théorie pareille, il avait dèja fait ça il y a deux mois avec sa théorie sur le dump du "LV0 décrypté" sur la RAM de la console, histoire qui malheureusement ne s’est pas transformé en réalité.

Sa nouvelle théorie suit le même chemin (dump sur la RAM) et d'après ses derniers tweets elle nécessitera un flasher hardware et Linux.

RealPsDev dit bien qu'il ne va pas trop fouiller dedans et qu'il partage sa théorie avec les autres développeurs si quelqu'un d'eux veut aller plus loin.

Citation:

OK so lets get right to it. This is a theory, nothing more.

There has been information available for quite some time. and I took it, thought about it, researched and experimented and I come out with my theory below to exploit 4.00 part of the way. This is not a random theory to, this is logical stuff. I'm providing this info for other devs to look at and lets see if this can work I don't keep stuff to my self I share.

The lv2ldr is used to verify and decrypt the lv2_kernal.self. In the lv2ldr Parameters Layout, the arguments start at 0x3E800 we need to know this so we can load with the different arguments we want to. the arguments end around where the program revoke list address starts, so around this 0x3F000. u8* means read one byte from the address. One of the lv2 arguments are lv2_in* that would mean the address in ram (Where it's located). The other is lv2_out* that's where to decrypt lv2 address in ram(Where decrypts lv2_kernal.self). that would also use u8 because you want to read it by one byte from that address. well with a program made to read the address like how readself works we can know the address where the lv2 lies in the ram and where it is decrypted. once we know the address the real decryption can start. So knowing the decrypted address we can take that offset make a progam like coreos_tool pull the and get the lv2 key all from knowing that decrypted lv2_kernal.self location. exploiting 4.00 with this method would work most likely because I doubt sony changed all the locations where the loaders do there thing, sure there encapsulated in the bootloader but they still pass over into the ram at one point before being fed over to the metldr which loads ldrs.

So other devs I post this possible exploit I found here for you to experiment with and get some where with 4.00.

Source:

http://www.ps3hax.net/

Page Twitter de RealPsDev:

https://twitter.com/#!/RealPsDev

[deaphroat]

Merci pour l'information.

Etat du hack Ps3