- 精华
- 0
- 帖子
- 1036
- 威望
- 0 点
- 积分
- 1021 点
- 种子
- 0 点
- 注册时间
- 2005-6-12
- 最后登录
- 2014-4-15
|
楼主 |
发表于 2011-11-17 21:39 · 上海
|
显示全部楼层
还有TRUE BLUE用的不是什么DEBUG EBOOT，而是直接提取了EBOOT中的FSELFs执行文件部分进行解密，这个是最最直接的破解方式，也是最难的！
2h ago - Following up on the True Blue PS3 JB2 v2.2 Payload, today PlayStation 3 developers on the Wiki (linked above) have started a preliminary Q&A work-in-progress for hacking the True Blue (TB) PS3 JailBreak 2 (JB2) USB dongle.
To clarify the initial reports, after examining the PS3 JailBreak 2 (JB2) / True Blue (TB) CFW PARADOX Game Releases they now state the EBOOT used on the True Blue (TB) released 3.6+ PS3 games are not a Debug ones. Below is the complete text thus far, as follows:
True Blue (TB) PS3 JailBreak 2 (JB2) Q&A
Q: Is this possible on other dongles from the FW3.41 days like Blackcat and Teensy?
A: Time will tell
Q: Are they (TB team) just stealing the dev eboots?
A: First we thought that too but today the first TB game was released Dirt 3 and it's working and it isn't a dev eboot so it maybe is really worth something so it's time to search why and how to use it.
It seems the ps3jb2 loads masterdiscs with fself, with the algo provided and the right key (which is not provided) you can decrypt said masterdiscs images right on pc and grab the fself files.
// do crypt
unsigned char sector_key[16];
memset(sector_key, 0, 16);
sector_key[12] = (sector_num & 0xFF000000)>>24;
sector_key[13] = (sector_num & 0x00FF0000)>>16;
sector_key[14] = (sector_num & 0x0000FF00)>> 8;
sector_key[15] = (sector_num & 0x000000FF)>> 0;
// encrypt sector
aes_context aes_ctx;
aes_setkey_enc(&aes_ctx, G_DEBUG_KEY, 128);
aes_crypt_cbc(&aes_ctx, AES_ENCRYPT, aligned_size, sector_key, buff, buff);
// decrypt
aes_context aes_ctx;
aes_setkey_dec(&aes_ctx, G_DEBUG_KEY, 128);
aes_crypt_cbc(&aes_ctx, AES_DECRYPT, aligned_size, sector_key, buff, buff);
That's the algo for masterdiscs, ps3gen dll has the static keys for masterdiscs you can also get it from sv_iso the crappy sdk tool that generates masterdisc images for dex.
More talk:
Folks I looked a little more and it seems the psjb2 just runs masterdiscs with fself, kinda lame. very lame. npdrm encrypted but labeled as fself, it's an fself but I dunno what it does, I never looked at it. I don't really care on doing more if you use the masterdisc algo I provided and the proper key which I am not supplying you can decrypt all the psjb2 disc images right on pc, grab the fself and use them to run them on a regular 3.55 fw.
Basically security == LAME, still interesting to see how they patched the firmware to allow masterdiscs, they also do some auth with the dongle which involves crypto to make sure the firmware does not load without it, but if you don't need the firmware to load the games... they could have added some extra keys in appldr and encrypted the damn eboots at least. I guess they didn't have enough time or enough spu skills
Regarding FSELF from "RikuKH3":
Real FSELFs are never encrypted. You can extract it with official unfself tool from SDK. But, in this FSELF I looked into (driver sf) ELF inside IS encrypted. You can say this because it's masterdisc fself, but I really doubt it. It doesn't look like a proper fself to me at all, in header it says that sections unecrypted, but it's not true. Another thing - Masterdisc Generator tool from Sony gives errors with this EBOOT (if it's a masterdisc eboot as stated, why?).
More details will be posted as they become available, and below is another PS3 JailBreak 2 (True Blue) HDD Review video from MrDjbubba2002.
Read more: http://www.ps3news.com/ps3-hacks ... gins/#ixzz1dyBP26nr |
|
川公网安备 51019002005286号
发表于 2011-11-17 21:34 · 河南
(前提是能流出…
)
