[IMG]http://img3.**************/img3/6018/nforenderhtmlq.png[/IMG]

We just got a very exciting email this morning from anon0 (not to be confused with anonymous group). The email sums up what this leak was very well:

To quote:

Hello PS3 Scene, this is another anonymous leak!

I would like to be called: anon0 to prevent confusion with all the other ‘anonymous’ members

2 months ago, a CEX-to-DEX came out which needed the request-idps.txt

It was all accomplished by .SIG files and ObjectiveSuites, they are encrypted files which carry out specific commands to the PS3

We are now bringing THREE new .SIG files which can be used with 3.73 FW to carry out certain ‘tasks’
Figure what it can do by yourself… And samples of many files can be found there which can aid in 3.73 getting hacked…
To use ObjSuites: Put PS3 in service mode, connect PS3 to PC by ethernet cable, IP Address to 192.168.0.100

Copy files from objcon to root of your usb drive
Start ObjectiveSuites, then power the PS3
All info necessary will be in the temp folder in objectivesuites…

This is a part-of-the-equation of hacking the 3.73

Some notes: I can guarantee something: There are many exploits present when ObjSuites connects to PS3, it forms a trusting bond… ObjSuites gets LV0/LV1 access
Use this with care…

I also bring more detail from an0n, the leaker himself bringing more information and clarification on this leak:

10:44 anonym0us – Okay
10:44 anonym0us – let me explain
10:44 anonym0us – ObjectiveSuites is used in combination with a jig
10:45 anonym0us – It allows more things to be done while PS3 is in service mode
10:45 anonym0us – something like 2 months ago
10:45 anonym0us – There was a leak
10:45 anonym0us – that allowed Retail->Debug
10:45 anonym0us – but it required a person getting request_idps.txt
10:45 anonym0us – from Sony
10:45 anonym0us – It was accomplished by a .SIG file
10:46 anonym0us – .SIG files carry out commands to the PS3
10:46 anonym0us – So
10:46 anonym0us – I got hands on 3 more .SIG files
10:46 anonym0us – Which report all kinds of things about the PS3
10:46 anonym0us – But, there is another thing
10:46 anonym0us – When ObjSuites is used with the PS3 in service mode
10:46 anonym0us – We can exploit the PS3
10:47 anonym0us – Sony never bothered fixing bugs between the ObjSuites-PS3 connection
10:47 anonym0us – Reason?
10:47 anonym0us – The original ObjSuites required a membership to SCEDevNet
10:48 anonym0us – this is cracked
10:48 anonym0us – So
10:48 anonym0us – yeha
10:48 anonym0us – yeah
10:48 anonym0us – thats pretty much it
10:48 anonym0us – When PS3 connects to ObjSuites
10:48 anonym0us – you get LV0/LV1 access
10:48 anonym0us – you get LV0/LV1 access
10:48 anonym0us – So with a bit of tinkering
10:48 anonym0us – You can be sure that you can get the PS3 to do what you want ot
10:48 anonym0us – to*
10:48 anonym0us – And thats pretty much it

Now an0n is claiming that these tools can lead to the holy grail of CFW (which seems to be at version 3.7x currently). Please keep in mind these tools are really only for devs/experienced users and not knowing what you are doing can result in a PS3 brick.

Download Links provided (download n mirror before they are gone!):
o3sig:
ps3/2_mecha:
http://depositfiles.com/files/g2zkn5quc

We got you covered on all the latest scene news, don’t let the other slow places around the scene drag you down! Same tuned for more exclusive news only at PS3Hax

Read more: http://www.ps3hax.net/#ixzz1dzdBeTAy

[22:18:29] <Mathieulh> though I am totally not interested in pwning it
[22:18:37] <Apocalyps> @TECH Send it to me
[22:18:42] <zecoxao> Mathieulh, quick question
[22:18:47] <zecoxao> syscon, owned or not?
[22:18:51] <Mathieulh> luis353, does it look like I code for the money ?
[22:19:00] <Apocalyps> Yes...
[22:19:03] <luis353> no math just asking
[22:19:07] <Mathieulh> zecoxao, yah I pwned that
[22:19:11] <zecoxao> kk
[22:19:20] <zecoxao> i asked Pockets69 to ask you that
[22:19:29] <zecoxao> but he didn't tell me so...
[22:19:32] <Apocalyps> One question
[22:19:35] <randuev> Mathieulh: i undestand why you feel so about this whole ps3 thing, with people like that
[22:19:36] <Mathieulh> easy when sony leave their sc fw key lying around
[22:19:42] <Apocalyps> Can we switch **** loader with Boot loader?
[22:19:44] <zecoxao> :P
[22:19:51] <zecoxao> thanks for the hint
[22:20:02] <Mathieulh> Apocalyps, not if you want to brick
[22:20:07] <Apocalyps> damn
[22:20:11] <Mathieulh> not if you don't want to brick *
[22:20:27] <randuev> Mathieulh: is HW key stored in e-fuses unique in each console?
[22:21:03] <TechnoDon> only xbox has e-fuses
[22:21:25] <Apocalyps> I wish the PS3 scene was as fast and progressing as the 360 scene
[22:21:29] <Mathieulh> randuev, obviously yes
[22:21:42] <Mathieulh> TechnoDon, the ps3 has some too
[22:21:47] <Mathieulh> but they can only be programmed once
[22:21:50] <randuev> Mathieulh: but it's only 48 bits
[22:22:07] <randuev> 2^48 is enough?
[22:22:10] <Mathieulh> randuev, what makes you say that ?
[22:22:25] <randuev> well, i've read in cell docs
[22:22:39] <Mathieulh> it's more than that
[22:22:51] <Mathieulh> and cell docs does not reference everything
[22:22:56] <Mathieulh> that part is NDAed
[22:23:15] <Apocalyps> Wouldn't cell docks only reference the proccessor itself?
[22:23:27] <randuev> that's unfortunate
[22:23:59] <TechnoDon> i have sony 3.73 ofw if that helps..
[22:24:10] <TechnoDon> at Xbo
[22:24:11] <Apocalyps> It doesn't
[22:24:16] <TechnoDon> meh
[22:24:33] <randuev> Mathieulh: did you end up making that hw device to read local storage or 3 exploits were pure software?
[22:24:34] <luis353> math LV2Diag/ObjectiveSuite leaked lead to 3.73 CFW ?
[22:24:39] <randuev> luis353: no
[22:24:51] <Mathieulh> seriously wtf with the noobish questions?
[22:24:55] <Apocalyps> objectivesuite useless without jig
[22:24:56] <TechnoDon> how many times has that been asked now?
[22:25:02] <Mathieulh> randuev, softwate
[22:25:06] <Mathieulh> software*
[22:25:23] <zecoxao> i was more interested in the syscon key
[22:25:26] <Mathieulh> though randuev I suggest you to go the hardware root
[22:25:31] <zecoxao> since i know it's hanging around
[22:25:42] <randuev> Mathieulh: yeah, i am more keen on that as well
[22:25:43] <Mathieulh> zecoxao, then look for it xD
[22:25:54] <randuev> Mathieulh: i like soldering
[22:25:57] <zecoxao> nah, i'm stupid and mentally ill xD
[22:26:00] <Mathieulh> randuev, the sw approach is not easy
[22:26:17] <Mathieulh> it relies on tricking the bl to load more than once
[22:26:31] <zecoxao> that's what xxxxxx said
[22:26:35] <randuev> Mathieulh: no doubt. i was hoping to spy on the bus, but clock is bit too fast for me
[22:26:39] <Mathieulh> xxxxxx ?
[22:26:49] <zecoxao> http://pastebin.com/xkXxk8fM
[22:26:57] <zecoxao> but it wasn't for hw
[22:27:01] <zecoxao> it was for bootldr
[22:27:02] <Mathieulh> randuev, which bus are you looking at
[22:27:04] <Mathieulh> ? *
[22:27:19] <zecoxao> so he's probably wrong
[22:27:37] <randuev> Mathieulh: ram/cell
[22:27:48] <Mathieulh> rofl no wonder then
[22:27:56] <Apocalyps> Another Stupid Question: What exactly is Runtime Secure Boot?
[22:28:01] <Mathieulh> you are messing with the wrong bus
[22:28:09] <Mathieulh> also the xdr clock speed can be descreased
[22:28:12] <Apocalyps> Not really asking for an explanation, but what will it give us
[22:28:33] <Mathieulh> Apocalyps, it allows to load metldr at runtime
[22:28:39] <Mathieulh> it gets decrypted by the crypto engin
[22:28:42] <Mathieulh> and authenticated
[22:28:47] <Mathieulh> and then runs in a secure context
[22:28:50] <Mathieulh> in isolation mode
[22:28:53] <Apocalyps> So we still need to exploit that also, amirite?
[22:28:56] <randuev> heh, i don't have sufficient docage for syscon
[22:29:00] <zecoxao> so, underclock xdr...
[22:29:08] <Mathieulh> Apocalyps, you need to exploit the isolated process
[22:29:21] <Mathieulh> zecoxao, that's a way
[22:29:23] <Mathieulh> there are others
[22:29:36] <DarukBot> (title) [16:41] I think it works [16:41] I mean this is what I th - Pastebin.com
[22:30:07] <Apocalyps> After exploiting the isolated process, we follow up to the authenticatation and decryption of the crypto engine?
[22:30:48] <Apocalyps> In other words, would we need to exploit the process before the isolation?
[22:30:58] <randuev> TechnoDon: you are wasting your time with this dh crap
[22:31:01] <Mathieulh> if you want to go the hw route
[22:31:10] <Mathieulh> do not try to read the shared LS directly
[22:31:56] <randuev> Mathieulh: i am kinda confused about getting reliable readings out of cell cpu especially if local storage indeed is local
[22:32:19] <Apocalyps> but shouldn't hardware authentication step go before it can execute on an isolated SPE? Why not just exploit the hardware unthentication?
[22:32:21] <randuev> without removing covers off the cpu )
[22:32:28] <Mathieulh> randev the LS is only interconnected to the EIB
[22:32:40] <Mathieulh> and the EIB can only be accessed from the ppu
[22:33:07] <randuev> yeah, that's the problem, what to capture if it's all internal
[22:33:08] <Mathieulh> Apocalyps, go for it then
[22:33:21] <Mathieulh> it's not all internal
[22:33:33] <Apocalyps> It would require modifying the hardware. :/
[22:33:37] <Mathieulh> the shared LS can be accessed from the ppu
[22:33:40] <Apocalyps> Useless
[22:33:51] <Mathieulh> but hell, I am saying too much
[22:33:54] <Mathieulh> figure the rest yourselves
[22:34:05] <randuev> Apocalyps: nothing is wrong with hardware tinkering
[22:34:12] <zecoxao> hold on a sec
[22:34:18] <zecoxao> THE Raziel?
[22:34:19] <Apocalyps> Basically the hardware anthentication is just telling the spe that the hardware is tack?
[22:34:23] <randuev> Mathieulh: thanks for tips, i'll try this way
[22:34:29] <Apocalyps> *in tack
[22:34:32] <MajorPSP1> lol
[22:34:34] <_Raziel_> ops
[22:34:41] <_Raziel_> not they but math
[22:34:46] <zecoxao> the one that makes that emu?
[22:34:58] <zecoxao> oh rly?
[22:34:59] <Mathieulh> Apocalyps, there are freaking docs about it written by IBM, I suggest you read them
[22:35:26] <Apocalyps> I'll read them... later
[22:35:47] <MajorPSP1> not jk lol
[22:36:03] <randuev> Mathieulh: about software route, can this all be done from otheros withour reboots of the system?
[22:36:18] <Mathieulh> you need lv1 privs
[22:36:29] <randuev> yeah, that can be patched
[22:36:36] <Mathieulh> not really
[22:36:47] <randuev> i mean in flash with nor flasher
[22:36:54] <Mathieulh> yeah
[22:37:08] <Mathieulh> you can update to a patched lv1
[22:37:10] <zecoxao> nor or nand xD
[22:37:13] <Mathieulh> that is ****ing easy
[22:37:46] <Mathieulh> also the bl fetches lv0 straight from nor
[22:37:49] <Apocalyps> http://www.ibm.com/developerworks/po...y/image002.gif
[22:37:50] <Mathieulh> so you need to write your own
[22:37:57] <Mathieulh> at least on a temporary basis
[22:38:03] <Mathieulh> and the check has to fail
[22:38:05] <randuev> no problem with temporary bricks
[22:38:11] <Mathieulh> otherwise it will overwrite lv1
[22:38:32] <Mathieulh> that is if you get to reload it
[22:38:41] <Mathieulh> which is HARD
[22:39:03] <randuev> yeah, i am not that far into software side unfortunately
[22:39:33] <Apocalyps> So this is secure runtime boot: http://www.ibm.com/developerworks/po...y/image2-3.gif
[22:39:59] <randuev> i was hoping that by malforming lv0 in the right way i could make it write needed info to flash
[22:40:37] <randuev> but if i understand diagrams correctly, everything interesting gets wiped before passing on next lvl
[22:40:53] <Apocalyps> Yes
[22:41:13] <Mathieulh> lv0 "destroys" the spu at some point
[22:41:44] <MajorPSP1> fr rly? lol
[22:42:04] <Mathieulh> well it has to be terminated from ppu side
[22:42:09] <Mathieulh> so err.... yeah
[22:42:16] <Mathieulh> it is done quite early btw
[22:42:43] <Apocalyps> ...
[22:42:52] <randuev> ok, it seems that i have to look at lv0 in ida again
[22:43:08] <Mathieulh> dumped it?
[22:43:09] <randuev> last time it went over head
[22:43:38] <randuev> or maybe it wasn't decrypted
[22:43:58] <Mathieulh> how did you do the dump?
[22:44:17] <Mathieulh> if it's straight from nor, it is encrypted
[22:45:24] <randuev> that must be it
[22:46:11] <zecoxao> TechnoDon, go get the keys lol
[22:46:38] <Apocalyps> Ok?
[22:48:12] <Apocalyps> crack37
[22:48:28] <Mathieulh> CV >>>>>>>>>>> terminate_isolated_spu
[22:48:28] <Mathieulh> CV : error : already normal state
[22:48:28] <Mathieulh> CV : error : stop isolated spu fail
[22:48:28] <Mathieulh> CV >>>>>>>>>>> terminate_isolated_spu finished.
[22:48:28] <Mathieulh>
[22:48:29] <TechnoDon> ?
[22:48:40] <Mathieulh> that's when the bootloader spu is "destroyed"
[22:48:59] <zecoxao> is that on RAM? i believe i saw that on a peek poker once
[22:49:06] <Mathieulh> no way
[22:49:12] <Mathieulh> that's from lv0
[22:49:16] <zecoxao> oh ok
[22:49:24] <zecoxao> i saw something else then
[22:50:22] <Apocalyps> crypto isolation process
[22:51:37] <DarukBot> (title) [C++] #include int main(int argc, char *argv[]){ printf( "n" "break - Pastebin.com
[22:52:31] <Mathieulh> my code had a little more lines (and keys) than that one
[22:52:54] <Apocalyps> How about you post a code? :P
[22:53:46] <Mathieulh> Apocalyps, don't make me look for a hello world
[22:53:55] <Apocalyps> ish dat guy geohotz
[22:54:29] <zecoxao> deroad, Math has posted the lv0 version
[22:54:30] <Apocalyps> Mathieulh, no one is telling you to look for hello world. just something labeled "3.73 keys here"

Известная команда fail0verflow может сделать свое возвращение на 28C3 (Chaos Communication Congress в своем 28-м издании) в Берлине, Германия, которая состоится с 27 по 30 декабря 2011 года. На предыдущем конгрессе, то есть 27C3 (состоялся в декабре), команда fail0verflow сломала безопасность PS3 и впоследствии опубликованы инструменты, которые позволили состоятся появлению CFW. Впоследствии Sony преследовала команду и мы больше ничего не слышал о них ... Пока. По данным последних твитов с командой fail0verflow, можно было бы поэтому думать, что сцена готовися испытать новые PS3 потрясения.

Небольшое напоминание, CCC (Chaos Решения Конгресса речи) является большим собранием хакеров, происходящих в течение 3-4 дней, у них есть все последние сведения для взлома с объяснениями и демонстрациями в форме лекций.

Их первые твиты направляются MathieuLH:

Fail0verflow @ MathieuLH: Успокойся, дорогая, это просто игровая консоль!
MathieuLH @ Fail0verflow: я запомню это, я не люблю ненужные драмы.
Fail0verflow @ MathieuLH: xoxoxoxo <3

Затем через час, новый твит окно:
Не беспокойтесь, мы всего лишь пытаемся "разогреть" двигатель Twitter, чтобы подготовиться к Tweets в декабре ;-)


Случайно ли, что число твитов, по их словам, растет в геометрической прогрессии, месяц пройдет 28C3? Именно поэтому мы подумали, об их участии в 28C3.


Кроме того, не было бы подтверждение MathieuLH об участии команды fail0verflow в 28C3, с твитом обратился к ним:


MathieuLH @ Fail0verflow: В любом случае я не буду присутствовать на CCC, слишком занят в последнее время. : /


Поэтому мы должны ждать, пока онлайн график конгресса, будет ли команда будет участвовать fail0verflow в 28C3, но одно можно сказать наверняка: на PS3 сцене будут проходить потрясения.

as I work Ill be realeasing more stuff.

saying this is not worthy... hehehe explanation :

We have a decrypted metldr here , if u see it a little u will see is an normal elf without the header.

it contains the root keys that geohot publiseh and a couple of 0x30 addead from 3.50 and ahead , and it STILL USES IT

having the metldr in elf we can put it the header and upload it in anergistic using it as unselfer for loaders!

the metldr is still used in 3.74 ( already exist a dubug ) and 3.73 retail too

the difference of charge is thar before the metldr used to take the files from coreos and now it deliveres them to lv0 via ram and close us the acces to the file BUT WE CAN DECRYPTED IT with the root keys from the metldr added if we have the file....

the lv0 can be decrypted if we fix the of math exploit to charge the bootldr and decrypte the metadata from the header from lv0 and with this decrypte the rest of the spaces with their loaders..

it isn't worthy? hehe

edit to add , if u compare a ISOLDR from 3.55 with the metldr u will realize that they are almost the same , I mean the isoldr contains the updates for the metldr ( virtuals of course )
and that in 3.60+ it also is inside of the lv0 so it can update every time the initial metldr boots with the new couple of keys the already have....

uploading the metldr in anergistic...http://pastie.org/private/2kijry6y7jwoiwsepqqcbq