Night_Cervant's Profilo
Una nuova scoperta su come ottenere le chiavi più importanti
Finora non era mai stata nominata e di lei si conosceva praticamente nulla: oggi però arriva la news che sulla PS3Wiki è stata pubblicata una guida per ottenere la "per_console_key", una chiave di criptazione che permetterà di svolgere ciò che il dongle JB2 permette di fare (ossia avviare i nuovi giochi richiedenti Firmware superiori) e inoltre apre le porte verso i Custom Firmware su qualsiasi Firmware, anche quelli più recenti.
Purtroppo però non tutto è già pronto e disponibile, infatti pare che per avere l'accesso a tutti questi "sogni" bisognerà attendere ancora un po', fino a quando non si riuscirà a scoprire come ottenere la per_console_key_0, infatti la guida pubblicata ci permetterà di ottenere la cosidetta per_console_key_1 (che a sua volta è necessaria per ottenere la 0).
Il concentto e l'effettivo valore di questa scoperta purtroppo non è ancora chiaro del tutto, ma tutti i maggiori siti della scena PS3 stanno gridando alla "bomba" pronta ad esplodere. Non ci resta che attendere un altro po' quindi.
- Codice: Seleziona tutto
Just good news after good news for the PS3 scene recently, as the folks over at PS3DevWiki have documented and released on how to dump the PS3 per console keys! For the newb what this does is basically replace the current function JB2 aka TrueBlue! In short once the keys for per_console_key_0 are found, it will basically fully unlocks the PS3 and grant as CFW access on basically ALL firmwares! This is great news for everyone in the PS3 scene and is only a matter of time before we have the keys!
Spiegazione sulla root key:
- Codice: Seleziona tutto
EID crypto is very complicated, it is done so on purpose first of all EID0 isn’t decrypted with one key and one
algorithm alone it is decrypted in several parts which use different algos and keys the keys are all derivations
of a per console key (per_console_key_1)which is stored inside metldr and copied by it to sector 0 and never
leaves isolation that same key is a derivation of the per console key (per_console_key_0) used to encrypt metldr
and the bl in the first place as well
isoldr clears that key from sector 0 before jumping to the isolated module but before doing so it encrypts it
with another keyset and stores it in a buffer so that the isolated module can use the new crafted key since the
operation is AES if you know that keyset you can decrypt the crafted key and get the eid root key without pwning
a loader or metldr through an isolated module that is not like you really need it because you can already use the
crafted key to decrypt some of eid0 but not all of it and the crafted key also uses the first elf section to be
built as in your isolated module will have a small section which only contains a key and that key is used as another
layer by isoldr to encrypt the buffer with it so basically you have 2 encryption layer over the root key the final
key then decrypts a specific part of the EID
eid crypto is actually done smart that is because most of it originally comes from the cell bootrom as in they
reuse the same algo used for metldr binaries and bl in the eid crypto including some of the keys and the steps
and you cannot decrypt all of the eid sections unless you gathered every single keys and steps and there are a
lot then you still have to figure out wtf it is you decrypted because eid is actually full of keys.
Spiegazione sulla per_console_key_0:
- Codice: Seleziona tutto
metldr is decrypted with this key
bootldr is decrypted with this key
might be obtained with per_console_root_key_1? (largely speculative, not nec. true – need more looked into, only based on the behavior of the other derivatives known to be obtained through AES)
Spiegazione sulla per_console_key_1:
- Codice: Seleziona tutto
derived from per_console_key_0
stored inside metldr
copied to sector 0 by metldr
cleared by isoldr
Used to decrypt part of the EID
Used to derive further keys
can be obtained with a modified isoldr that dumps it
can be obtained with a derivation of this key going backwards
derived from per_console_key_0stored inside metldrcopied to sector 0 by metldrcleared by isoldrUsed to decrypt part of the EIDUsed to derive further keyscan be obtained with a modified isoldr that dumps it can be obtained with a derivation of this key going backwards
Spiegazione sulla per_console_key_2:
- Codice: Seleziona tutto
this key can be obtained through AES from EID_root_key
EID can be partially decrypted by setting this key in anergistics and fireing aim_spu_module.self
Load aim_spu_module.self + EID0 + EID0_key in anegistics = decrypted EID0
This code is to decrypt your EID0 on your PC Registrati o effettua il Login per visualizzare il link!.
The prerequisites are:
dump your EID0 from your ps3 and save it in the same folder as EID0
dump your EID0_key from your ps3 and put it on the code above where the key is needed
load all of them in anergistic
EID0_key could also be obtained with EID_root_key directly in the following manners:
knowing the algorithm (located in isoldr)and applying it to the EID_root_key
leting isoldr apply that algorithm directly in anergistic
the process is exactly as the one above (modifing anergistic to feed isoldr with EID_root_key
fonte: ps3-ita
travis96's Sito web
-.jpg)
