In questo ultimo periodo la scena hack su PlayStation 3 si è un po’ ripresa con l’uscita del JFW-DH e soprattutto con l’uscita di un nuovo dongle creato da uno sconosciuto team indonesiano chiamato Kado, il quale permette per la prima volta in assoluto l’avvio di titoli che richiedono firmware superiori al 3.6x.
Per fare un po’ di chiarezza sul dongle e per capire il funzionamento del dispositivo il nostro caro Giadej, ha deciso di creare un topic apposito nella sezione USB Dongles : Hardware Jailbreaks un topic dedicato al True Blue che spiega minuziosamente il suo funzionamento e molto altro.. Guida all'Installazione Attenzione ne io ne il forum si prende la responsablitià su danni dovuti alla console... Fonte: ps3-ita
KaKaRoTo, tramite il suo account Twitter ufficiale, ha reso pubblico che sulla PS3Wiki sono state create delle prime FAQ per chi volesse maggiori e più specifici dettagli sull'annunciato Jailbreak del Firmware 3.73 che proprio KaKaRoTo ha intenzione di rilasciare nelle prossime settimane. Queste le FAQ, Domanda: Avrò bisogno di hardware speciale per effettuare il Jailbreak? (n.d.a. dongle USB, Flasher, ecc...) Risposta: Assolutamente no.
D: Funzioneranno gli homebrew? R: Con delle dovute patch al NPDRM, si. Showtime comunque funzionerà sicuramente.
D: Funzioneranno i giochi recenti? (n.d.a. intesi da Disco originale!). R: Si, sarai a Fw 3.7x a tutti gli effetti, quindi potrai giocare tutti i giochi che richiedono fino a quel Firmware.
D: Questo jailbreak includerà le syscall Peek & Poke? (n.d.a. necessarie per usare i backup!) R: No.
D: Funzioneranno i Backup Manager? R: No, per il motivo detto sopra. (n.d.a. l'assenza delle Peek & Poke).
D: Questo Jailbreak ci darà le chiavi 3.7x? R: No.
D: Questo Jailbreak ci poterà ad un Custom/Modified Firmware? R: No.
D: Questo Jailbreak ci permetterà il downgrade? R: No.
D: E allora perché tutti i siti di news dicono il contrario? R: Perché non leggono la wiki e il mio blog xD Alcuni hanno addirittura definito il mio Jailbreak con annunci di "CF in arrivo presto!". Sbagliatissimo.
D: C'è una data di release stabilita? R: No, sicuro si sa solo che non potrò lavorare per le prossime 2 settimane (causa viaggio in Cile). Dipende pure da quanto tempo ci vorrà per fixare le NPDRM.
Infine, se volete ancora altre spiegazioni, potete far riferimento ad un articolo chiarificatore lasciato sul blog dallo stasso KaKaRoTo e che trovate al seguente indirizzo:http://kakaroto.homelinux.net/2011/11/clar...3-73-jailbreak/ AGGIORNAMENTO: le FAQ sono state oggi integrate con nuove risposte che trovate qui di seguito:
[SPOILER]D: Con questo Jailbreak funzionerà il PSN? R: Essendo a tutti gli effetti al 3.7x si, funzionerà perfettamente.
D: I miei vecchi Homebrew continueranno a funzionare? R: No, tutti gli homebrew richiederanno delle patch al NPDRM. Quelli poi che richiedono syscall particolari (esempio i Backup Manager) non funzioneranno proprio.
D: Con questo Jailbreak funzionerà l'OtherOS++? R: No, OtherOS++ richiede delle modifiche al Firmware per funzionare e siccome questo non sarà né un CFw né un MFw non si potranno fare modifiche al Firmware.
D: Questo Jailbreak funzionerà su tutti i modelli di PS3? R: Si, su tutti quelli esistenti ad oggi.
D: Ci sono rischi di brick facendo questo Jailbreak? R: Assolutamente no (sarà testato approfonditamente prima di essere rilasciato, come tutto quello su cui KaKaRoTo mette la sua firma!).
D: Questo Jailbreak funzionerà solo su 3.73? R: No, è stato testato sia su 3.60 che su 3.73 senza problemi.
D: Cosa accadrà se intanto Sony rilascerà un nuovo Firmware 3.74/3.8x? R: In quel caso lo proveremo anche sul nuovo Firmware.
Quindi ci viene confermato che il PSN funzionerà, che si potrà fare su qualsiasi PS3 (anche le più recenti!) e che sono abbastanza sicuri che Sony non può fixarlo prima della sua release.
Fonte: Ps3-ita
PS3 Root Key svelata, a breve il rilascio del Custom Firmware?
Basta una notizia, una semplice news come tante altre, da muovere intere comunità e siti web; da ieri circola un qualcosa che effettivamente potrebbero significare molto più di semplici parole, sembra infatti che la root key sia stata svelata, la chiave di volta per l’accesso a tempo indeterminato alla beneamata Playstation 3.
Cos’è la Root Key? Questa non è altro che la chiave privata, utilizzata dalla casa produttrice per proteggere e firmare tutti i file eseguibili dalla console stessa. All’interno della Ps3, infatti, esistono molteplici chiavi di questo tipo, la più importante è la console_root_key_0, la quale non è altro che l’ultimo baluardo a protezione del firmware della console. Ad oggi, questa non è ancora stata svelata, tuttavia, i rumors affermano che ormai ha sicuramente i minuti contati. Per riuscire a comprendere l’importanza della scoperta, possiamo ricordare che per altre console quali Xbox o Wii, le corrispettive chiavi non sono state violate, nonostante sia possibile installare un CFW in entrambe i dispositivi; l’unica altra in cui è stato possibile scavalcare la sicurezza Sony è la piccola Sony Psp, per la quale, ad ogni nuovo firmware ufficiale, ne viene affiancato uno modificato.
A cosa potrebbe portare questa scoperta? Gli esperti del settore, ricorderanno che, tempo fa Geohot riuscì a produrre un CFW per il firmware ufficiale 3.55; il risultato venne raggiunto, grazie alla scoperta delle chiavi pubbliche. Successivamente, Sony corse ad i ripari e, con un semplice aggiornamento di firmware, ha reso inutilizzabile quanto scoperto, ma soprattutto non permetteva a questi utenti di avviare i giochi rilasciati nei mesi avvenire. Con la scoperta delle chiavi private, la casa produttrice ha praticamente le mani legate; infatti, non potrà risolvere il problema semplicemente con un aggiornamento software. I prossimi sviluppi, dovrebbero essere la scoperta della chiave 0, che garantirà completo accesso alla console; successivamente, sarà possibile creare un custom firmware per ogni nuovo originale rilasciato da Sony ed installare un qualsiasi homebrew.
I tempi per tutto questo? Purtroppo non è possibile sapere quando, come e se verrà rilasciato; il primo passo è stato compituo, ora è dovere di buoni programmatori creare CFW da diffondere per permettere ad ogni utente che lo desidera, di modificare la propria console. Una cosa è certa, Sony non resterà con le mani in mano, seguiranno nuovi sviluppi; infine un plauso è doveroso alle misure di sicurezza adottate, per 5 anni hanno quasi impedito qualsiasi violazione.
Ci risiamo: è proprio il caso di dirlo, ancora una volta un leak nella scena PS3 che, come sempre, porta caos e litigi tra i vari coder e gli utenti finali. Stavolta a farne le spese è KaKaRoTo con il suo già annunciato Jailbreak: su Twitter infatti l'hacker ha reso noto di essere molto contrariato dal leak che gli è stato fatto da alcuni "compagni" tra cui all'inizio compare anche il nome del francese Mathieulh, poi subito smentito però.
Per la precisione pare che questo leak sia inspiegabilmente passato inosservato alle masse ma non a KaKaRoTo, che ha espresso ovviamente tutto il suo rammarico e la sua rabbia dal suo account ufficiale su Twitter: Now I'm pretty fucking pissed, it seems that my 3.73 jailbreak was leaked by someone, even though VERY FEW people knew what it was...now if Sony blocks it before the release, then too bad, I'm not the one getting fucked so I hope the leaker is happy about it. btw: fuck you...
Come si può intuire (anche se non conosceste l'inglese), KaKaRoTo esprime tutta la sua rabbia su questo leak e il rammarico sul fatto che adesso molto probabilmente Sony correrà ai ripari fixando il bug che permette l'esecuzione del Jailbreak ancor prima che quest'ultimo possa essere rilasciato.
Ma a creare ancora più caos e scalpore è la notizia (ancora non certa però!) che ci sia invischiato perfino Mathieulh, come ci dice sempre KaKaRoTo in un altro tweet di sfogo: Considering all, my guess is that the leak came from @Mathieulh, but no proof yet, and I have yet to discuss it with him (no accusation yet)...
Non ci resta ora che aspettare la risposta di Mathieulh (se ci sarà) e vedere come procederà questa vicenda...
UPDATE: prontamente è giunta la risposta di Mathieulh che ovviamente si dichiara estraneo a tutta la vicenda e anzi precisa che se mai c'è qualcuno che più di tutti è stato vittima di leak nella scena PS3 è proprio lui. In questo momento i due si stanno chiarendo per vie "private" (MSN) in quanto KaKaRoTo non vuol mantenere il litigio pubblico. Vedremo se ci aggiorneranno sull'esito di questo colloquio.
UPDATE 2: arriva quasi immediato il responso del colloquio privato con KaKaRoTo che conferma l'estraneità di Mathieulh nella vicenda e annuncia di non sapere ancora come intende procedere d'ora in poi. Dobbiamo preoccuparci o solo demoralizzazione post-leak? Staremo a vedere.
UPDATE 3: a sopresa KaKaRoTo fa dietro front e annuncia di essersi sbagliato, non c'è stato alcun leak quindi e il lavoro può tornare a procedere come se nulla fosse.
Nota: come segnalato da luxor nei commenti, non ci è stato riferito da KaKaRoTo dove questo leak è stato pubblicato proprio per mantenere la cosa più segreta possibile da occhi indiscreti. Quindi evitate di chiedere dove reperire il leak perché non c'è dato saperlo (per ora). Fonte: ps3-ita
KaKaRoTo annuncia che la release del suo Jailbreak dipende da Mathieulh
Ancora una volta il nostro "amato" hacker francese Mathieulh si ritrova in mezzo alla scena PS3 per quanto lui "pare" voglia restarne sempre fuori. KaKaRoTo infatti ha annunciato tramite il suo sito ufficiale che il Jailbreak funziona anche su Fw 4.00 (cosa che già sapevamo da precedenti conferme via Twitter) ma che per una release bisognerà attendere Mathieulh, l'unico in possesso di un algoritmo NPDRM in grado di poter avviare homebrew su Fw Ufficiale, 4.00 compreso.
KaKaRoTo ci dice che Mathieulh non ha alcuna intenzione per ora di condividere questa sua scoperta con lui e quindi il Jailbreak non potrà essere rilasciato finché o KaKaRoTo arriva "da solo" alla scoperta fatta da Mathieulh oppure quest'ultimo decida di cambiare posizione condividendo il suo lavoro. La ragione ufficiale di questa sua decisione è concentrata tutta sugli insulti ricevuti (e che dopo questa notizia sicuramente continuerà a ricevere...) dagli utenti mondiali. Lo stesso KaKaRoTo ci invita a riflettere su quanto sia sbagliato insultare questi abili hacker perché alla fine, come sta accadendo, tutto si rivolta comunque contro l'utente finale. Ci invita inoltre a dimostrare più gratitudine verso Mathieulh e il suo operato. Così facendo magari un gioco il francese cambierà idea. Questo l'annuncio ufficiale di KaKaRoTo sul suo blog:
CITAZIONE
I tested the jailbreak on the latest firmware 4.0 since it was released and I can confirm that it still works. Mathieulh also confirmed that the NPDRM algo that he has still allows applications to run on 4.0, although he still doesn’t want to share that with us/me at the moment. Mathieulh is still thinking about whether or not to share it, so I’m hopeful he’ll help us move forward with the release.
He has however received so many hate messages and so many flaming that he is completely disgusted with the scene and the way it treated him. He is so disgusted that he does not want to share or help anymore. He thinks that all those haters do not deserve to be given something that they are so ungrateful for, and I perfectly understand his position. Receiving all that hate towards me a while back also made me depressed to the point I stopped looking at the PS3 entirely.
Next time you want to insult a dev, thinking it’s “fun” or that he deserved it, think about it some more, you are poisoning the scene without even realizing it. We are all doing this for fun, the only reward we get is people’s gratitude, and all you do is hate and disrespect us, so why continue to do what we do?
For those who hate and insult : Mathieulh may not be acting the way you want him to, you may think he’s a jerk or hate him for teasing without releasing, but the simple fact remains that he has done more to the scene that you did, so you should just shut up and show him respect. When you have your little ‘hate fun’, you are actually contributing to the scene, but in the wrong way, you are killing it by killing the developer’s motivation.
For now, Mathieulh doesn’t want to share his work with me, and I’m not mad or disappointed at all at him, I am mad and disgusted at those who made him make that decision. So please, if you are just as mad as I am, do NOT make this an opportunity to hate even more on Mathieulh for not sharing, make this an opportunity to show gratitude where it’s due and educate those who are ungrateful on what their role is/was in this scene.
Aggiornamento: sempre dai loro account Twitter sia Mathieulh che KaKaRoTo ci danno la lieta notizia che questa collaborazione è finalmente andata in porto. La release di questo Jailbreak si fa quindi sempre più vicina! Fonte: Ps3-ita
Ormai il Jailbreak di KaKaRoTo si è trasformato in una vera e propria telenovela: nella puntata di oggi vi riferiremo di come KaKaRoTo, tramite sempre il suo account ufficiale su Twitter, risponde alle accuse di chi lo vede "sfaticato" giustificandosi dicendo che alla fin fine ciò che Mathieulh gli ha passato non era nulla di nuovo né tantomento di utile al suo scopo.
In risposta a un Tweet in cui veniva accusato di aver ormai tutto il necessario per finire il suo Jailbreak e nonostante ciò di non averlo ancora rilasciato, KaKaRoTo risponde annunciando che in realtà tutto ciò che Mathieulh ha condiviso con lui è inutile al suo scopo e anzi, era tutta roba già conosciuta e ben documentata. Lo stesso Mathieulh però, chiamato in causa, dice che invece ha condiviso tutto con KaKaRoTo eccetto l'algoritmo per avviare homebrew firmati con NPDRM su Fw ufficiali superiori al 3.56. Ed ovviamente invece era proprio quest'ultima cosa che KaKaRoTo si aspettava di ricevere. Come evolverà la vicenda? Non ci resta che attendere la prossima puntata!
Di seguito i vari Tweet di KaKaRoTo (tranne il secondo dall'alto che è la risposta di Mathieulh): [SPOILER]
CITAZIONE
@Mathieulh shared a file with me (not npdrm algo), but he doesn't want to be involved with the ps3 anymore.
CITAZIONE
@KaKaRoToKS actually I did share the whole algo minus the part you need to run the npdrm on 3.56+ that's as far as I am willing to go.
CITAZIONE
@Mathieulh yeah, but like I told you, the "algo" you shared is already known and documented, the actual "npdrm algo" needed (the hash), you
CITAZIONE
@Mathieulh .. didn't share it.. so I consider that you "helped" but you didn't "share the npdrm algo" because that's a metaphor for the hash
CITAZIONE
@Mathieulh I just finished reading all your code yesterday, there's honestly nothing new in it (other than .sceversion) that we didn't know
CITAZIONE
@Mathieulh we had even already reversed some stuff that you still had marked as 'unknown' in your own code
CITAZIONE
@Mathieulh I still appreciate the code you sent (it still helps), but no offense, I don't consider it as the part we need or the npdrm algo
Neanche una giornata passa dal lancio di PSV in giappone che gli sviluppatori iniziano a testare punti di forza e vulnerabilità della console,scoprendo che...è vulnerabile agli stessi exploit dei savegame nel gioco Teck4, che già su PSP presentava vari exploit nei salvataggi che conducevano a buffer overflow (continua...)
L'exploit trovato permise su firmware 6.31 di PSP di eseguire codice non autorizzato. Il livello di accesso con tale tecnica è solo Usermode,ovvero non permette interazioni più delicate come quelle che hanno accompagnato la PSP nella sua vita (Custom firmwares e simili), tuttavia può dimostrarsi un punto di partenza per eseguire ulteriori "manovre" in User-Mode e quindi tentare di comprendere meglio il funzionamento della console e i suoi segreti.
Tale exploit, come conclude Neur0n, l'autore di questa scoperta, dimostra solo che l'emulazione/retrocompatibilità dei giochi PSP è eccellente,ma non che l'hacking su PSVita è realmente iniziato. E' comunque bello vedere come l'eredità della PSP possa aiutare gli sviluppatori a districarsi in questa nuova sfida.
Di seguito le Parole di Neur0n:
I read lot’s of article around the world about this Hello World on Vita and I found so many “this is fake,right?”…No, this is not a fake. But you have to think this is inevitable result because of emulation.
And you can find “Hello World for PSP Firmware 6.31 by Teck4″ and say “Why 6.31?”
Teck4 have some savegame exploits. These were found when PSP lastest firmware was 6.31. He tried to run his unsigned code without any modification..including the letter “6.31″
That’s why “6.31″ was displayed in his Hello World.
His exploit use buffer overflow of the system and, you know, what we call “Usemode exploit”, So do not expect kernel hacking from it.
I know his exploit and I know he is not a faker. That’s real. But I think this shows us that emulation tech on vita is brilliant, NOT “PS Vita is hackable!”
Nelle ultime ore il noto ConsoleDev ha annunciato che sul sito degli sviluppatori e degli addetti stampa di SCEA sono stati caricati gli ultimi firmware debug ovvero il 3.74 e il 4.00. I vari firmware debug funzionano solamente su console Debug e non sulle comuni Retail.
Direttamente dal sito PressCenter.PlayStation.com sito dedicato agli addetti del settore e alla stampa autorizzata americana e non sono stati pubblicati i nuovi firmware debug 3.74 e 4.00 oltre a del materiale informativo dedicati ad essi. I firmware debug sono destinati solamente a sviluppatori che posseggono una console debug, chi proverà ad installare i firmware su una console retail al controllo iniziale riceverà il seguente errore The data type is not supported. (8002F029).
Di seguito una breve dichiarazione e l’immagine del sito.
CITAZIONE
For those who own PS3 Debug / Test consoles or are simply into collecting PlayStation 3 file leaks, recently PS3 Debug / Test Firmware 3.74 surfaced alongside version 4.00 from Sony's North American Press Web site.
If you didn't know, the address to their Press site is http://PressCenter.PlayStation.com/ and Sony offers free access to all members of the press there using SCEA / SC3APR to login and obtain the latest press releases and related files.
Finally, keep in mind these PUP updates will currently NOT install on a retail PS3, and so they are intended for examination and comparison purposes only.
We have 100% confirmed that running this updater on a retail PS3 will not damage it, however, it will give the following error before the installation completes: The data type is not supported. (8002F029)
Special Thanks to ConsoleDev for the heads-up on the news tip!
Fonte: Ps3-ita
DeanK aggiorna mmCM alla versione 4.00.00! Compatibile con tutti i CFW
Proprio nelle ultime ore il team Cobra, creatore dell’omonimo dongle e DeanK creatore del più famoso homebrew per PlayStation 3 jailbreak, MultiMan o mmCM, hanno rilasciato una nuova versione. Questa nuova versione però ha una inattesa particolarità sarà compatibile anche con i classici Custom Firmware!
Da diversi mesi ormai MultiMan non veniva più aggiornato da DeanK, il creatore, in quanto era passato a lavorare con il Team Cobra e aveva modificato e riadattato il suo famoso backup manager al dongle del gruppo. Nelle ultime ore ecco arrivare l’annuncio sui più importanti siti della scena underground dell’arrivo di una nuova versione compatibile sia con il dongle usb che con i vari custom firmware in circolazione, questa versione, la 4.00.00, introdurrà importantissime novità. Di seguito l’intero Change Log rilasciato da DeanK.
CITAZIONE
Hello!
Added support for jpg/png covers for BD/DVD ISO files in "Coverflow" mode Added PIC1.PNG/SND0.AT3 (background image and music) support to lastGAME and "PSP Launcher" for PSP ISO files Improved performance when extracting CSO to ISO and when creating ISO files from folders SIXAXIS gyroscope affects screensaver mode (wave/tilt the controller to navigate the starfield) Improved "Coverflow" display mode Added preparations for experimental support for multi-disc PSX games in CUE+BIN or ISO format for up to 4 discs ("Required Cobra USB/FW update will be announced when PSX multidisc support is available") mmCM 04.00.00 will work without CobraUSB dongle connected (See the 'Second Quote' below for more information).
New mmCM users will have to install mmCM 04.00.00 FULL version.
Cobra USB
Changelog (for users updating from multiMAN 02.09.02 to multiMAN/mmCM 04.00.00):
CITAZIONE
Added function "Create ISO from folder" Support for *.0/.31, *.001/.032, *.66600/.66631 split file formats Join split files in file manager (select and copy the first file to get the rest joined) New display mode "XBDM" - XBOX Dash Clone Added option "Detect Game Title in ISO Images" to allow using ISO filenames and *not* scan for game names in local database Improved scanning for retro roms/iso and covers (populating the Retro column) New THEME format (.thm). One theme - one file. Easy installation within multiMAN/mmCM without going to XMB to install theme pkg files. mmTM - Easy to use PC application to create thm files from folders (separate download). multiMAN/mmCM will try to read disc volume labels and display in VIDEO column (BD/DVD entry) and in other display modes. Added indication (rotating refresh icon next to the column icon) when multiMAN/mmCM is loading/extracting title thumbnails (XMMB [mode)*]Added pop-up notifications when new versions of multiMAN/mmCM and Showtime are available for download Added pop-up notification when running low on disc space (less than 1GB on internal HDD) Added pop-up notification when multiMAN/mmCM successfully connects to nethost folders during startup (/net_host# in File Manager) Added support for downloading themes in a background thread (pop-up messages will notify user when download starts and completes) Added support for copying big (4+GB) files in File Manager to USB drives. multiMAN/mmCM will split source file when copying to USB. Changed option "Link Video Library to Showtime" - it will only create links for XMB Video files, but will not start Showtime Added shortcut (virtual folder) "XMB Video Files" when browsing HDD/USB drives in VIDEO column Added "Showtime Font Preference" option to select 10 different fonts for SHOWTIME media player (GUI and Subtitles) Added support to extract PSP CSO (compressed ISO) files in XMMB/XBDM display modes and File Manager (extracted image is saved in /dev_hdd0/PSPISO) Added shortcut to ISO folder when browsing external USB devices (PSP connected with memory stick /ISO folder, containing CSO and ISO files) Added music playback fade-out when leaving multiMAN/mmCM Added download progress indication in XMMB/XBDM modes - Web column. An entry will show current download filename and percentage of completion. Added TextViewer in File Manager (supported files colored in light blue). Supports viewing of ANSI/UTF plain text files. TextViewer controls: L1/R1 - PageUp/PageDown, L2/R2 - zoom out/in (50%-250%), R3 - change font, UP/DOWN/LEFT/RIGHT - scroll/pan, L1/R1+SELECT - skip to start/end of file Added support for browsing Video, Games, Favorites and Retro (ROMS/PS1/PS2/PSP) in "Coverflow" display mode. Change content mode with UP/DOWN. Improved performance when extracting CSO to ISO and when creating ISO files from folders SIXAXIS gyroscope affects screensaver mode (wave/tilt the controller to navigate the starfield)* Improved "Coverflow" display mode
Sarà possibile fare l'aggiornamento direttamente tramite MultiMan dall'apposita funzione o scaricando e installando il .pkg.
KaKaRoTo fa il punto sul suo Jailbreak e accusa Mathieulh
Direttamente sul suo blog ufficiale KaKaRoTo torna finalmente a parlare del suo Jailbreak ormai dato per disperso. Attraverso un lunghissimo messaggio l'hacker ci spiega la situazione attuale e ne approfitta per dimostrare inoltre come Mathieulh l'ha preso in giro e gli ha fatto perdere almeno 2 mesi di lavoro.
Nel suo lungo messaggio KaKaRoTo si concentra su 2 cose: fare il punto della situazione del suo lavoro e dimostrare come Mathieulh sia un bugiardo e gli abbia fatto perdere almeno 2 mesi di lavoro.
Per quanto riguarda il primo punto, ci viene detto che sono un gruppo di una decina di hacker che lavorano assieme e sostanzialmente tutto il loro lavoro si può dividere in 3 parti. La prima parte consiste nell'hackare i PKG in modo da poterli fare installare sul Firmware ufficiale. E questa parte è finita al 100%, testata e funzionante. La seconda parte invece riguarda l'esecuzione di questi Homebrew una volta installati: e questa è purtroppo la parte più dolente, dove praticamente non si son fatti progressi. Infatti bisogna scoprire l'algoritmo NPDRM giusto che permette alla PS3 di avviare gli homebrew come fossero ufficiali. Il problema sostanziale, ci dice KaKaRoTo, consiste nel fatto che per ottenere l'hash necessario bisognerebbe essere in possesso della famosa (e dannata) private key: e mentre per i Firmware minori del 3.56 si poteva entrarne in possesso facilmente visto che Sony usava nell'algoritmo un numero costante invece che uno random (generato a caso), dal 3.60 in poi Sony ha rafforzato la sicurezza impostando questo famoso numero causale. È quindi praticamente impossibile (parole di KaKaRoTo) risalire alla private key tramite equazioni matematiche come fatto in passato e la situazione quindi è pressoché in stallo. Serve trovare un nuovo exploit che permetta di aggirare il problema, ma non si sa SE e QUANDO questo exploit verrà davvero trovato. Infine, la terza parte riguarda una "sopresa" che KaKaRoTo non vuole ancora annunciarci, ma precisa che nulla ha a che fare con i backup in quanto il suo Jailbreak sarà al 100% libero da possibile pirateria. E questa terza parte è completa al 60-70% circa.
Finito questo riassunto sullo stato del lavoro, KaKaRoTo passa ad attaccare ed accusare Mathieulh, dimostrando come tutto ciò che ha detto è puramente fasullo e a causa di queste sue bugie gli ha fatto perdere oltre 2 mesi di lavoro inutilmente.
Questo, in parole povere, ciò che l'hacker ci ha voluto dire, ma se volete leggere l'estratto integrale del messaggio di KaKaRoTo lo trovate di seguito:
CITAZIONE
Here’s a “quick” status update on the 4.00 HEN (Homebrew ENabler) for PS3.
Following my clarifications from almost 2 months ago here, there has been a lot of progress. We have not been slacking off, we’re a group of about 10 developers working together for the last 2 months, for sometimes 15 hours everyday in order to bring back homebrew support to the latest version of the PS3.
There are three major parts to the HEN, first, getting the packages to install on the PS3, that part is done, completed, tested, debugged, etc.. the second part is to get the apps to run, that one still has major issues… the last part is something I will not discuss for now (it’s a surprise) but it’s about 60% to 70% done (and it has nothing to do with peek&poke and has nothing to do with backup managers or anything like that. This is and will stay a piracy-free solution for the PS3).
Now, running apps is the biggest challenge that we’ve been working on for the past 2 months. As some of you know, if you’ve been following me on Twitter, we originally had hoped for Mathieulh to give us the “npdrm hash algorithm” that was necessary to run the apps, but he was reluctant, he kept doing his usual whore so people would kiss his feet (or something else) so he’d feel good about himself. But in the end, he said that he refuses to give us the needed “npdrm hash algorithm” to make it work… So what I initially thought would be “this will be released next week” ended up taking a lot more time than expected, and we’re still nowhere near ready to make it work.
Mathieulh kept tossing his usual “riddles” which he thinks are “very helpful for those who have a brain”, and which pisses off anyone who actually does… so he told us that the solution to all our problems was to look in appldr of the 3.56 firmware.. and that it was something lv1 was sending appldr which made the “hash check” verified or not… so we spent one month and a lot of sweat and after killing a few of our brain cells out of exhaustion, we finally concluded that it was all bullshit. After one month of reading assembly code and checking and double-checking our results, we finally were able to confirm that that hash algorithm was NOT in the 3.56 firmware like he told us (at all).
He said that it was an AES OMAC hash, but after tracking all the uses of the OMAC functions in appldr, we found that it was not used for the “hash”… he then said “oh, I meant HMAC“, so we do that again and again come up with the same conclusion, then we’re sure it’s not in appldr, and then he says “ah no, it’s in lv1“.. have a look for yourself to what he decided to write : ps3devwiki.com/index.php?title=Talk:KaKaRoTo_Kind_of_%C2%B4Jailbr eak%C2%B4
That happened after the huge twitter fight I had with him for being his usual arrogant ass and claiming that he “shared” something (For your information, the code that he shared was not his own, I have proof of that too (can’t show you the proof because even if I don’t respect him, I gave him my word to not share what he gave me, and I respect my word) since he forgot to remove the name of the original developer from one of the files… also it was completely useless and was not used at all, just made me waste a day reading the crappy undocumented code. So why is he still trying to force his “advice” through these riddles even after we had that fight? Well to sabotage us and make us lose all those months of hard work!
So anyways, we had all accepted that Mathieulh was full of shit (we knew before, but we gave him the benefit of the doubt) and decided to continue working without considering any of his useless riddles. So we then tried to exploit/decrypt the 3.60+ firmware in order to get the algorithm from there.
Now, a few more weeks later, we finally have succeeded in fully understanding that missing piece from the “npdrm hash algorithm”, and here it is for everyone’s pleasure with some prerequisite explanation :
A game on the PS3 is an executable file in a format called a “SELF“file (kind of like .exe on windows), those “self” files are cryptographically signed and encrypted.. For PSN games (games that do not run from a bluray disc), they need to have an additional security layer called “NPDRM”. So a “npdrm self” is basically an executable that is encrypted and signed, then re-encrypetd again with some additional information. On 3.55 and lower, we were able to encrypt and sign our own self files so they would look like original (made by sony) “npdrm self” files, and the PS3 would run them without problem. However, it wasn’t really like an original file.. a real NPDRM self file had some additional information that the PS3 simply ignored, it did not check for that information, so we could put anything in it, and it worked. Since the 3.60 version, the PS3 now also validates this additional information, so it can now differentiate between NPDRM self files created by sony and the ones that we create ourselves for homebrew. That’s the “npdrm hash algorithm” that we have been trying to figure out, because once we can duplicate that information in the proper manner, then the PS3 will again think that those files are authentic and will let us play them.
Another important point to explain, I said a few times that the files are “signed”.. this means that there is an “ECDSA signature” in the file which the PS3 can verify. The ECDSA signature is something that allows the PS3 to verify if the file has been modified or not.. it is easy to validate the signature, but impossible to create one without having access to the “private keys” (think of it like a real signature, you can see your dad’s signature and recognize it, but you can’t sign it exactly like him, and you can recognize if your brother tried to forge his signature). So how were we able to sign the self files that were properly authenticated on 3.55? That’s because this “ECDSA signature” is just a very complicated mathematical equation (my head still hurts trying to fully understand it, but I might blog about it in the future and try to explain it in simple terms if people are interested), and one very important part of this mathematical equation is that you need to use a random number to generate the signature, but Sony had failed and used the same number every time.. by doing that, it was easy to just find the private key (which allows us to forge perfectly the signature) by doing some mathematical equation on it. So to summarize, a “signed file” is a file which is digitally signed with an “ECDSA signature” that cannot be forged, unless you have the “private key” for it, which is impossible to obtain usually, but we were able to obtain it because Sony failed in implementing it properly.
Now, back on topic.. so what is this missing “npdrm hash algorithm” that we need? well it turns out that the “npdrm self” has a second signature, so it’s a “encrypted and signed self file” with an additional layer of security (the NPDRM layer) which re-encrypts it and re-signs it again. That second signature was not verified in 3.55 and is now verified since the 3.60 version of the PS3 firmware.
One important thing to note is that Sony did NOT make the same mistake with this signature, they always used a random number, so it it technically impossible to figure out the private key for it. To be more exact, this is the exact same case as the .pkg packages you install on the PS3, you need to patch the firmware (making it cfw) so that those .pkg files can be installed, and that’s because the .pkg files are signed with an ECDSA signature for which no one was able to get the private key. That’s why we call them “pseudo-retail packages” or “unsigned packages”.
The signature on the NPDRM self file uses the exact same ECDSA curve and the same key as the one used in PS3 .pkg files, so no one has (or could have) the private key for it. What this means is that, even though we finally figured out the missing piece and we now know how the NPDRM self is built, we simply cannot duplicate it.
The reason we wasted 2 months on this is because Mathieulh lied by saying that he can do it.. remember when the 4.0 was out and I said “I can confirm that my method still works” then he also confirmed that his “npdrm hash algorithm” still works too? well he didn’t do anything to confirm, he just lied about it because there is no way that he could have verified it because he doesn’t have the private key.
I said I will provide proof of the lies that Mathieulh gave us, so here they are : he said it’s in 3.56, that was a lie, he said it’s an AES OMAC, that was a lie, he said it’s an HMAC, that was a lie, he said it’s in appldr, that was a lie, he said it’s in lv1, that was a lie, he said that he can do it, that was a lie, he said that “it takes one hour to figure it out if you have a brain”, that was a lie, he said that he verified it to work on 4.0, that was a lie, he said that he had the algorithm/keys, that was a lie, he said that once we know the algorithm used, we can reproduce it, that was a lie, he kept referring to it as “the hash”, that was wrong. The proof ? It’s an ECDSA signature, it’s not a hash (two very different terms for different things), it was verified by vsh.self, it was not in lv2, or lv1, or appldr, and the private key is unaccessible, so there is no way he could build his own npdrm self files. Now you know the real reason why he refused to “share” what he had.. it’s because he didn’t have it…
So why do all this? was it because his arrogance didn’t allow him to admit not knowing something? or was it because he wanted to make us lose all this time? To me, it looks like pure sabotage, it was misleading information to steer us away from the real part of the code that holds the solution…. That is of course, if we are kind enough to assume that he knew what/where it was in the first place. In the end, he wasn’t smart enough to only lie about things that we could not verify.. now we know (we always knew, but now we have proof to back it) that he’s a liar, and I do not think that anyone will believe his lies anymore.
...
Enough talking about liars and drama queens, back to the 4.0 HEN solution… so what next? well, we now know that we can’t sign the file, so we can’t run our apps on 3.60+ (it can work on 3.56 though). What we will do is look for a different way, a completely new exploit that would allow the files we install to actual run on the PS3. We will also be looking for possible “signature collisions” and for that we will need the help of the community, hopefully there is a collision (same random number used twice) which will allow us to calculate the private key, and if that happens, then we can move forward with a release.
When will the “jailbreak” be released? If I knew, I’d tell you, but I don’t know.. I would have said in last november, then december, then before christmas, then before new year, etc… but as you can see, it’s impossible to predict what we will find.. we might get lucky and have it ready in a couple of days, or we may not and it will not be ready for another couple of months.. so all you need to do is : BE PATIENT (and please stop asking me about an estimated release date)!
I would like to thank the team who helped on this task for all this time and who never got discouraged, and I’d like to thank an anonymous contributor who recently joined us and who was instrumental in figuring it all out. We all believe that freedom starts with knowledge, and that knowledge should be open and available to all, that is why we are sharing this information with the world. We got the confirmation (by finding the public key used and verifying the signatures) yesterday and since sharing this information will not help Sony in any way to block our efforts in a future release, we have decided to share it with you. We believe in transparency, we believe in openness, we believe in a free world, and we want you to be part of it.
If you want to know more about this ECDSA signature algorithm, read this interesting paper that explains it in detail, and you can also watch Team Fail0verflow’s youtube.com/watch?v=5E0DkoQjCmI that first explained Sony’s mistake in their implementation, which made custom firmwares possible.
Thanks for reading,
KaKaRoTo
Fonte: ps3-ita
Install Package files compare anche sul firmware 4.00
Salve ragazzi, proprio quando ormai si iniziano a buttare le speranze per quanto riguarda un futuro jailbreak/CFW, ecco spuntare fuori la la notizia di qualche ora fa secondo cui un Hacker sia riuscito a far comparire tra le icone dell'XMB la tanto amata funzione "Install Package Files".
Purtroppo per noi poveri utenti finali ancora non serve a nulla tutto ciò, in quanto comunque non si riescono ad installare e ad avviare pacchetti non firmati. Oltretutto l'hacker ci fa sapere che c'è bisogno di un Hardware che permetta il "dual boot" (che poi vero dual boot non è) tipo E3 Flasher o Progskeet o Teensy. A prova di tutto ciò ci ha rilasciato anche un video che trovate sotto.
Queste le sue parole:
CITAZIONE
Note: This modification does not allow the installation / usage of unsigned content / PS3 homebrew etc. This is purely a convenience hack and is aimed for use by those who have hardware flashers which allow dual boot.
After technodon's work creating a modified kiosk dev_flash which lets you install retail signed package files. The restrictions of having to use kiosk firmware inspired me to find a way to add "Install Package Files" for retail firmware.
This is hack does the following things:
adds "★ Install Package Files" and "★ /app_home/PS3_GAME/" to "GAME" on the XMB (allowing the user to install retail package files anytime they want) adds other debug functions which are small but still there does not give access to "★ Debug Setting" (reasons for this are explained below)
Installation instructions:
This installation procedure is the similar to technodon's original dev_flash hdd swap procedure
For this you will need two hard drives a e3 flasher or similar device to downgrade your PS3 (assuming that you're on firmware 4.00 and you have an e3 flasher)
downgrade to 3.55 using the downgrade tools from e3 (Of course when downgrading to 3.55 make sure you use a different hdd than the hdd which you were using 4.00) once booted back into the xmb turn off the console swap hard drives turn on the system, press the PS button and you will be asked to reinstall the firmware place the pup file from the e3 downgrade tools in the normal PS3/UPDATE usb folder and follow the on-screen instructions to reinstall the firmware then install dev_blind.pkg & Blackb0x FTP from install packages run dev_blind then BlackB0x and FTP into the console goto /dev_blind delete everything and replace them with the customised dev_flash press the ps button and the console should reboot and and ask to reinstall the firmware again, switch off the console and swap the hard drive back turn on the console press the ps button twice the console should boot back into 3.55 Rogero goto system update and install 4.00 OFW once installed turn the console off again and swap hard drives back and you should boot into a modified 4.00 retail firmware.
My package (downloadable at Link Rimosso) includes:
My modded dev_flash OFW 4.00 PS3UPDAT.PUP
Sorry about the camera quality, it's the best I can manage.
P.S. BTW the "nas_plugin.sprx" in this dev_flash has not been altered to achieve "Install Package Files". Also for those who will analyze my modded dev_flash, you will find that I have used debug .sprx files from the a debug 4.00 pup.
P.P.S. I originally intended to get "★ Debug Settings" to work with this. But usage of "debug settings" required the ps3 to use a debug vsh.self, and that crashes the ps3 when trying to load applications (I did some other things as well to prevent the PS3 from giving me a RSOD when I swapped the vsh.self files, I'm not detailing it in public because I don't want Sony to patch it).
Fonte: ps3-ita
PS3Dev ha trovato un possibile exploit sul firmware 4.0?
Durante la notte è apparsa una curiosa e alquanto interessante notizia sui maggiori portali underground legati alla scena PlayStation 3. Stando a quanto dichiarato da un certo PS3Dev, già famoso per la creazione di diversi homebrew, sarebbe riuscito a trovare un nuovo exploit sull’ultimo firmware ufficiale, il 4.0.
Il dev dichiara che dopo attente analisi e numerose prove effettuate sulla sua console di essere riuscito a trovare un piccolo bug che potrebbe essere usato per creare nuovi exploit per la nostra amata console. A differenza degli altri sviluppatori che in passato hanno dichiarato di aver scoperto miracolosi bug da sfruttare e poi per paura di Sony o per altri motivi hanno fatto marcia indietro, PS3Dev ha deciso di condividere il tutto con i suoi “colleghi” la scoperta in modo che qualcuno riesca a creare qualcosa di concreto. Per ora non è molto ma magari apre uno spiraglio per la rinascita della scena hack su PlayStation 3, stagnante da moltissimi mesi. Ecco quanto dichiarato da PS3Dev.
CITAZIONE
So the lv2ldr verifys decrypts the lv2_kernal.self. we can get the address of this happening. inside Parameters Layout there are arguments, they are used as commands basically to load a function you want to use. they start in the lv2 @ 0x3E800(seems to be same for other ldrs) that address. There is a argument that is called lv2_in and lv2_out (we have know about these) basically we can use lv2_in to map out the address and lv2_out to map out the address for where the lv2ldr decryptes the self file. We can make a program like readself basically and get the offset, u8* means read one byte from the address. use that and we can actually be get the exact offset where it all happens at. once we have the location grabbing this decrypted self should be the easy task. Like I said some info we had and some we did not know about can be obtained like this and used to get keys. exploiting 4.00 with this method would work most likely because I doubt sony changed all the locations where the loaders do there thing, sure there encapsulated in the bootloader but they still pass over into the ram at one point before being fed over to the metldr which loads ldrs and if all that is still happening then Sony didn't change nothing
Nuove News: Ormai il Jailbreak di KaKaRoTo si è trasformato in una vera e propria telenovela: nella puntata di oggi vi riferiremo di come KaKaRoTo, tramite sempre il suo account ufficiale su Twitter, risponde alle accuse di chi lo vede "sfaticato" giustificandosi dicendo che alla fin fine ciò che Mathieulh gli ha passato non era nulla di nuovo né tantomento di utile al suo scopo.
In risposta a un Tweet in cui veniva accusato di aver ormai tutto il necessario per finire il suo Jailbreak e nonostante ciò di non averlo ancora rilasciato, KaKaRoTo risponde annunciando che in realtà tutto ciò che Mathieulh ha condiviso con lui è inutile al suo scopo e anzi, era tutta roba già conosciuta e ben documentata. Lo stesso Mathieulh però, chiamato in causa, dice che invece ha condiviso tutto con KaKaRoTo eccetto l'algoritmo per avviare homebrew firmati con NPDRM su Fw ufficiali superiori al 3.56. Ed ovviamente invece era proprio quest'ultima cosa che KaKaRoTo si aspettava di ricevere. Come evolverà la vicenda? Non ci resta che attendere la prossima puntata!
Di seguito i vari Tweet di KaKaRoTo (tranne il secondo dall'alto che è la risposta di Mathieulh):
ps vita già hackata Neanche una giornata passa dal lancio di PSV in giappone che gli sviluppatori iniziano a testare punti di forza e vulnerabilità della console,scoprendo che...è vulnerabile agli stessi exploit dei savegame nel gioco Teck4, che già su PSP presentava vari exploit nei salvataggi che conducevano a buffer overflow (continua...)
L'exploit trovato permise su firmware 6.31 di PSP di eseguire codice non autorizzato. Il livello di accesso con tale tecnica è solo Usermode,ovvero non permette interazioni più delicate come quelle che hanno accompagnato la PSP nella sua vita (Custom firmwares e simili), tuttavia può dimostrarsi un punto di partenza per eseguire ulteriori "manovre" in User-Mode e quindi tentare di comprendere meglio il funzionamento della console e i suoi segreti.
Tale exploit, come conclude Neur0n, l'autore di questa scoperta, dimostra solo che l'emulazione/retrocompatibilità dei giochi PSP è eccellente,ma non che l'hacking su PSVita è realmente iniziato. E' comunque bello vedere come l'eredità della PSP possa aiutare gli sviluppatori a districarsi in questa nuova sfida.
Di seguito le Parole di Neur0n:
I read lot’s of article around the world about this Hello World on Vita and I found so many “this is fake,right?”…No, this is not a fake. But you have to think this is inevitable result because of emulation.
And you can find “Hello World for PSP Firmware 6.31 by Teck4″ and say “Why 6.31?”
Teck4 have some savegame exploits. These were found when PSP lastest firmware was 6.31. He tried to run his unsigned code without any modification..including the letter “6.31″
That’s why “6.31″ was displayed in his Hello World.
His exploit use buffer overflow of the system and, you know, what we call “Usemode exploit”, So do not expect kernel hacking from it.
I know his exploit and I know he is not a faker. That’s real. But I think this shows us that emulation tech on vita is brilliant, NOT “PS Vita is hackable!”
Nelle ultime ore il noto ConsoleDev ha annunciato che sul sito degli sviluppatori e degli addetti stampa di SCEA sono stati caricati gli ultimi firmware debug ovvero il 3.74 e il 4.00. I vari firmware debug funzionano solamente su console Debug e non sulle comuni Retail.
Direttamente dal sito PressCenter.PlayStation.com sito dedicato agli addetti del settore e alla stampa autorizzata americana e non sono stati pubblicati i nuovi firmware debug 3.74 e 4.00 oltre a del materiale informativo dedicati ad essi. I firmware debug sono destinati solamente a sviluppatori che posseggono una console debug, chi proverà ad installare i firmware su una console retail al controllo iniziale riceverà il seguente errore The data type is not supported. (8002F029).
Di seguito una breve dichiarazione e l’immagine del sito.
CITAZIONE
For those who own PS3 Debug / Test consoles or are simply into collecting PlayStation 3 file leaks, recently PS3 Debug / Test Firmware 3.74 surfaced alongside version 4.00 from Sony's North American Press Web site.
If you didn't know, the address to their Press site is http://PressCenter.PlayStation.com/ and Sony offers free access to all members of the press there using SCEA / SC3APR to login and obtain the latest press releases and related files.
Finally, keep in mind these PUP updates will currently NOT install on a retail PS3, and so they are intended for examination and comparison purposes only.
We have 100% confirmed that running this updater on a retail PS3 will not damage it, however, it will give the following error before the installation completes: The data type is not supported. (8002F029)
Special Thanks to ConsoleDev for the heads-up on the news tip!
Proprio nelle ultime ore il team Cobra, creatore dell’omonimo dongle e DeanK creatore del più famoso homebrew per PlayStation 3 jailbreak, MultiMan o mmCM, hanno rilasciato una nuova versione. Questa nuova versione però ha una inattesa particolarità sarà compatibile anche con i classici Custom Firmware!
Da diversi mesi ormai MultiMan non veniva più aggiornato da DeanK, il creatore, in quanto era passato a lavorare con il Team Cobra e aveva modificato e riadattato il suo famoso backup manager al dongle del gruppo. Nelle ultime ore ecco arrivare l’annuncio sui più importanti siti della scena underground dell’arrivo di una nuova versione compatibile sia con il dongle usb che con i vari custom firmware in circolazione, questa versione, la 4.00.00, introdurrà importantissime novità. Di seguito l’intero Change Log rilasciato da DeanK.
CITAZIONE
Hello!
Added support for jpg/png covers for BD/DVD ISO files in "Coverflow" mode Added PIC1.PNG/SND0.AT3 (background image and music) support to lastGAME and "PSP Launcher" for PSP ISO files Improved performance when extracting CSO to ISO and when creating ISO files from folders SIXAXIS gyroscope affects screensaver mode (wave/tilt the controller to navigate the starfield) Improved "Coverflow" display mode Added preparations for experimental support for multi-disc PSX games in CUE+BIN or ISO format for up to 4 discs ("Required Cobra USB/FW update will be announced when PSX multidisc support is available") mmCM 04.00.00 will work without CobraUSB dongle connected (See the 'Second Quote' below for more information).
New mmCM users will have to install mmCM 04.00.00 FULL version.
Cobra USB
Changelog (for users updating from multiMAN 02.09.02 to multiMAN/mmCM 04.00.00):
CITAZIONE
Added function "Create ISO from folder" Support for *.0/.31, *.001/.032, *.66600/.66631 split file formats Join split files in file manager (select and copy the first file to get the rest joined) New display mode "XBDM" - XBOX Dash Clone Added option "Detect Game Title in ISO Images" to allow using ISO filenames and *not* scan for game names in local database Improved scanning for retro roms/iso and covers (populating the Retro column) New THEME format (.thm). One theme - one file. Easy installation within multiMAN/mmCM without going to XMB to install theme pkg files. mmTM - Easy to use PC application to create thm files from folders (separate download). multiMAN/mmCM will try to read disc volume labels and display in VIDEO column (BD/DVD entry) and in other display modes. Added indication (rotating refresh icon next to the column icon) when multiMAN/mmCM is loading/extracting title thumbnails (XMMB [mode)*]Added pop-up notifications when new versions of multiMAN/mmCM and Showtime are available for download Added pop-up notification when running low on disc space (less than 1GB on internal HDD) Added pop-up notification when multiMAN/mmCM successfully connects to nethost folders during startup (/net_host# in File Manager) Added support for downloading themes in a background thread (pop-up messages will notify user when download starts and completes) Added support for copying big (4+GB) files in File Manager to USB drives. multiMAN/mmCM will split source file when copying to USB. Changed option "Link Video Library to Showtime" - it will only create links for XMB Video files, but will not start Showtime Added shortcut (virtual folder) "XMB Video Files" when browsing HDD/USB drives in VIDEO column Added "Showtime Font Preference" option to select 10 different fonts for SHOWTIME media player (GUI and Subtitles) Added support to extract PSP CSO (compressed ISO) files in XMMB/XBDM display modes and File Manager (extracted image is saved in /dev_hdd0/PSPISO) Added shortcut to ISO folder when browsing external USB devices (PSP connected with memory stick /ISO folder, containing CSO and ISO files) Added music playback fade-out when leaving multiMAN/mmCM Added download progress indication in XMMB/XBDM modes - Web column. An entry will show current download filename and percentage of completion. Added TextViewer in File Manager (supported files colored in light blue). Supports viewing of ANSI/UTF plain text files. TextViewer controls: L1/R1 - PageUp/PageDown, L2/R2 - zoom out/in (50%-250%), R3 - change font, UP/DOWN/LEFT/RIGHT - scroll/pan, L1/R1+SELECT - skip to start/end of file Added support for browsing Video, Games, Favorites and Retro (ROMS/PS1/PS2/PSP) in "Coverflow" display mode. Change content mode with UP/DOWN. Improved performance when extracting CSO to ISO and when creating ISO files from folders SIXAXIS gyroscope affects screensaver mode (wave/tilt the controller to navigate the starfield)* Improved "Coverflow" display mode
Sarà possibile fare l'aggiornamento direttamente tramite MultiMan dall'apposita funzione o scaricando e installando il .pkg.
Direttamente sul suo blog ufficiale KaKaRoTo torna finalmente a parlare del suo Jailbreak ormai dato per disperso. Attraverso un lunghissimo messaggio l'hacker ci spiega la situazione attuale e ne approfitta per dimostrare inoltre come Mathieulh l'ha preso in giro e gli ha fatto perdere almeno 2 mesi di lavoro.
Nel suo lungo messaggio KaKaRoTo si concentra su 2 cose: fare il punto della situazione del suo lavoro e dimostrare come Mathieulh sia un bugiardo e gli abbia fatto perdere almeno 2 mesi di lavoro.
Per quanto riguarda il primo punto, ci viene detto che sono un gruppo di una decina di hacker che lavorano assieme e sostanzialmente tutto il loro lavoro si può dividere in 3 parti. La prima parte consiste nell'hackare i PKG in modo da poterli fare installare sul Firmware ufficiale. E questa parte è finita al 100%, testata e funzionante. La seconda parte invece riguarda l'esecuzione di questi Homebrew una volta installati: e questa è purtroppo la parte più dolente, dove praticamente non si son fatti progressi. Infatti bisogna scoprire l'algoritmo NPDRM giusto che permette alla PS3 di avviare gli homebrew come fossero ufficiali. Il problema sostanziale, ci dice KaKaRoTo, consiste nel fatto che per ottenere l'hash necessario bisognerebbe essere in possesso della famosa (e dannata) private key: e mentre per i Firmware minori del 3.56 si poteva entrarne in possesso facilmente visto che Sony usava nell'algoritmo un numero costante invece che uno random (generato a caso), dal 3.60 in poi Sony ha rafforzato la sicurezza impostando questo famoso numero causale. È quindi praticamente impossibile (parole di KaKaRoTo) risalire alla private key tramite equazioni matematiche come fatto in passato e la situazione quindi è pressoché in stallo. Serve trovare un nuovo exploit che permetta di aggirare il problema, ma non si sa SE e QUANDO questo exploit verrà davvero trovato. Infine, la terza parte riguarda una "sopresa" che KaKaRoTo non vuole ancora annunciarci, ma precisa che nulla ha a che fare con i backup in quanto il suo Jailbreak sarà al 100% libero da possibile pirateria. E questa terza parte è completa al 60-70% circa.
Finito questo riassunto sullo stato del lavoro, KaKaRoTo passa ad attaccare ed accusare Mathieulh, dimostrando come tutto ciò che ha detto è puramente fasullo e a causa di queste sue bugie gli ha fatto perdere oltre 2 mesi di lavoro inutilmente.
Questo, in parole povere, ciò che l'hacker ci ha voluto dire, ma se volete leggere l'estratto integrale del messaggio di KaKaRoTo lo trovate di seguito:
CITAZIONE
Here’s a “quick” status update on the 4.00 HEN (Homebrew ENabler) for PS3.
Following my clarifications from almost 2 months ago here, there has been a lot of progress. We have not been slacking off, we’re a group of about 10 developers working together for the last 2 months, for sometimes 15 hours everyday in order to bring back homebrew support to the latest version of the PS3.
There are three major parts to the HEN, first, getting the packages to install on the PS3, that part is done, completed, tested, debugged, etc.. the second part is to get the apps to run, that one still has major issues… the last part is something I will not discuss for now (it’s a surprise) but it’s about 60% to 70% done (and it has nothing to do with peek&poke and has nothing to do with backup managers or anything like that. This is and will stay a piracy-free solution for the PS3).
Now, running apps is the biggest challenge that we’ve been working on for the past 2 months. As some of you know, if you’ve been following me on Twitter, we originally had hoped for Mathieulh to give us the “npdrm hash algorithm” that was necessary to run the apps, but he was reluctant, he kept doing his usual whore so people would kiss his feet (or something else) so he’d feel good about himself. But in the end, he said that he refuses to give us the needed “npdrm hash algorithm” to make it work… So what I initially thought would be “this will be released next week” ended up taking a lot more time than expected, and we’re still nowhere near ready to make it work.
Mathieulh kept tossing his usual “riddles” which he thinks are “very helpful for those who have a brain”, and which pisses off anyone who actually does… so he told us that the solution to all our problems was to look in appldr of the 3.56 firmware.. and that it was something lv1 was sending appldr which made the “hash check” verified or not… so we spent one month and a lot of sweat and after killing a few of our brain cells out of exhaustion, we finally concluded that it was all bullshit. After one month of reading assembly code and checking and double-checking our results, we finally were able to confirm that that hash algorithm was NOT in the 3.56 firmware like he told us (at all).
He said that it was an AES OMAC hash, but after tracking all the uses of the OMAC functions in appldr, we found that it was not used for the “hash”… he then said “oh, I meant HMAC“, so we do that again and again come up with the same conclusion, then we’re sure it’s not in appldr, and then he says “ah no, it’s in lv1“.. have a look for yourself to what he decided to write : ps3devwiki.com/index.php?title=Talk:KaKaRoTo_Kind_of_%C2%B4Jailbr eak%C2%B4
That happened after the huge twitter fight I had with him for being his usual arrogant ass and claiming that he “shared” something (For your information, the code that he shared was not his own, I have proof of that too (can’t show you the proof because even if I don’t respect him, I gave him my word to not share what he gave me, and I respect my word) since he forgot to remove the name of the original developer from one of the files… also it was completely useless and was not used at all, just made me waste a day reading the crappy undocumented code. So why is he still trying to force his “advice” through these riddles even after we had that fight? Well to sabotage us and make us lose all those months of hard work!
So anyways, we had all accepted that Mathieulh was full of shit (we knew before, but we gave him the benefit of the doubt) and decided to continue working without considering any of his useless riddles. So we then tried to exploit/decrypt the 3.60+ firmware in order to get the algorithm from there.
Now, a few more weeks later, we finally have succeeded in fully understanding that missing piece from the “npdrm hash algorithm”, and here it is for everyone’s pleasure with some prerequisite explanation :
A game on the PS3 is an executable file in a format called a “SELF“file (kind of like .exe on windows), those “self” files are cryptographically signed and encrypted.. For PSN games (games that do not run from a bluray disc), they need to have an additional security layer called “NPDRM”. So a “npdrm self” is basically an executable that is encrypted and signed, then re-encrypetd again with some additional information. On 3.55 and lower, we were able to encrypt and sign our own self files so they would look like original (made by sony) “npdrm self” files, and the PS3 would run them without problem. However, it wasn’t really like an original file.. a real NPDRM self file had some additional information that the PS3 simply ignored, it did not check for that information, so we could put anything in it, and it worked. Since the 3.60 version, the PS3 now also validates this additional information, so it can now differentiate between NPDRM self files created by sony and the ones that we create ourselves for homebrew. That’s the “npdrm hash algorithm” that we have been trying to figure out, because once we can duplicate that information in the proper manner, then the PS3 will again think that those files are authentic and will let us play them.
Another important point to explain, I said a few times that the files are “signed”.. this means that there is an “ECDSA signature” in the file which the PS3 can verify. The ECDSA signature is something that allows the PS3 to verify if the file has been modified or not.. it is easy to validate the signature, but impossible to create one without having access to the “private keys” (think of it like a real signature, you can see your dad’s signature and recognize it, but you can’t sign it exactly like him, and you can recognize if your brother tried to forge his signature). So how were we able to sign the self files that were properly authenticated on 3.55? That’s because this “ECDSA signature” is just a very complicated mathematical equation (my head still hurts trying to fully understand it, but I might blog about it in the future and try to explain it in simple terms if people are interested), and one very important part of this mathematical equation is that you need to use a random number to generate the signature, but Sony had failed and used the same number every time.. by doing that, it was easy to just find the private key (which allows us to forge perfectly the signature) by doing some mathematical equation on it. So to summarize, a “signed file” is a file which is digitally signed with an “ECDSA signature” that cannot be forged, unless you have the “private key” for it, which is impossible to obtain usually, but we were able to obtain it because Sony failed in implementing it properly.
Now, back on topic.. so what is this missing “npdrm hash algorithm” that we need? well it turns out that the “npdrm self” has a second signature, so it’s a “encrypted and signed self file” with an additional layer of security (the NPDRM layer) which re-encrypts it and re-signs it again. That second signature was not verified in 3.55 and is now verified since the 3.60 version of the PS3 firmware.
One important thing to note is that Sony did NOT make the same mistake with this signature, they always used a random number, so it it technically impossible to figure out the private key for it. To be more exact, this is the exact same case as the .pkg packages you install on the PS3, you need to patch the firmware (making it cfw) so that those .pkg files can be installed, and that’s because the .pkg files are signed with an ECDSA signature for which no one was able to get the private key. That’s why we call them “pseudo-retail packages” or “unsigned packages”.
The signature on the NPDRM self file uses the exact same ECDSA curve and the same key as the one used in PS3 .pkg files, so no one has (or could have) the private key for it. What this means is that, even though we finally figured out the missing piece and we now know how the NPDRM self is built, we simply cannot duplicate it.
The reason we wasted 2 months on this is because Mathieulh lied by saying that he can do it.. remember when the 4.0 was out and I said “I can confirm that my method still works” then he also confirmed that his “npdrm hash algorithm” still works too? well he didn’t do anything to confirm, he just lied about it because there is no way that he could have verified it because he doesn’t have the private key.
I said I will provide proof of the lies that Mathieulh gave us, so here they are : he said it’s in 3.56, that was a lie, he said it’s an AES OMAC, that was a lie, he said it’s an HMAC, that was a lie, he said it’s in appldr, that was a lie, he said it’s in lv1, that was a lie, he said that he can do it, that was a lie, he said that “it takes one hour to figure it out if you have a brain”, that was a lie, he said that he verified it to work on 4.0, that was a lie, he said that he had the algorithm/keys, that was a lie, he said that once we know the algorithm used, we can reproduce it, that was a lie, he kept referring to it as “the hash”, that was wrong. The proof ? It’s an ECDSA signature, it’s not a hash (two very different terms for different things), it was verified by vsh.self, it was not in lv2, or lv1, or appldr, and the private key is unaccessible, so there is no way he could build his own npdrm self files. Now you know the real reason why he refused to “share” what he had.. it’s because he didn’t have it…
So why do all this? was it because his arrogance didn’t allow him to admit not knowing something? or was it because he wanted to make us lose all this time? To me, it looks like pure sabotage, it was misleading information to steer us away from the real part of the code that holds the solution…. That is of course, if we are kind enough to assume that he knew what/where it was in the first place. In the end, he wasn’t smart enough to only lie about things that we could not verify.. now we know (we always knew, but now we have proof to back it) that he’s a liar, and I do not think that anyone will believe his lies anymore.
...
Enough talking about liars and drama queens, back to the 4.0 HEN solution… so what next? well, we now know that we can’t sign the file, so we can’t run our apps on 3.60+ (it can work on 3.56 though). What we will do is look for a different way, a completely new exploit that would allow the files we install to actual run on the PS3. We will also be looking for possible “signature collisions” and for that we will need the help of the community, hopefully there is a collision (same random number used twice) which will allow us to calculate the private key, and if that happens, then we can move forward with a release.
When will the “jailbreak” be released? If I knew, I’d tell you, but I don’t know.. I would have said in last november, then december, then before christmas, then before new year, etc… but as you can see, it’s impossible to predict what we will find.. we might get lucky and have it ready in a couple of days, or we may not and it will not be ready for another couple of months.. so all you need to do is : BE PATIENT (and please stop asking me about an estimated release date)!
I would like to thank the team who helped on this task for all this time and who never got discouraged, and I’d like to thank an anonymous contributor who recently joined us and who was instrumental in figuring it all out. We all believe that freedom starts with knowledge, and that knowledge should be open and available to all, that is why we are sharing this information with the world. We got the confirmation (by finding the public key used and verifying the signatures) yesterday and since sharing this information will not help Sony in any way to block our efforts in a future release, we have decided to share it with you. We believe in transparency, we believe in openness, we believe in a free world, and we want you to be part of it.
If you want to know more about this ECDSA signature algorithm, read this interesting paper that explains it in detail, and you can also watch Team Fail0verflow’s youtube.com/watch?v=5E0DkoQjCmI that first explained Sony’s mistake in their implementation, which made custom firmwares possible.
Salve ragazzi, proprio quando ormai si iniziano a buttare le speranze per quanto riguarda un futuro jailbreak/CFW, ecco spuntare fuori la la notizia di qualche ora fa secondo cui un Hacker sia riuscito a far comparire tra le icone dell'XMB la tanto amata funzione "Install Package Files".
Purtroppo per noi poveri utenti finali ancora non serve a nulla tutto ciò, in quanto comunque non si riescono ad installare e ad avviare pacchetti non firmati. Oltretutto l'hacker ci fa sapere che c'è bisogno di un Hardware che permetta il "dual boot" (che poi vero dual boot non è) tipo E3 Flasher o Progskeet o Teensy. A prova di tutto ciò ci ha rilasciato anche un video che trovate sotto.
Queste le sue parole:
CITAZIONE
Note: This modification does not allow the installation / usage of unsigned content / PS3 homebrew etc. This is purely a convenience hack and is aimed for use by those who have hardware flashers which allow dual boot.
After technodon's work creating a modified kiosk dev_flash which lets you install retail signed package files. The restrictions of having to use kiosk firmware inspired me to find a way to add "Install Package Files" for retail firmware.
This is hack does the following things:
adds "★ Install Package Files" and "★ /app_home/PS3_GAME/" to "GAME" on the XMB (allowing the user to install retail package files anytime they want) adds other debug functions which are small but still there does not give access to "★ Debug Setting" (reasons for this are explained below)
Installation instructions:
This installation procedure is the similar to technodon's original dev_flash hdd swap procedure
For this you will need two hard drives a e3 flasher or similar device to downgrade your PS3 (assuming that you're on firmware 4.00 and you have an e3 flasher)
downgrade to 3.55 using the downgrade tools from e3 (Of course when downgrading to 3.55 make sure you use a different hdd than the hdd which you were using 4.00) once booted back into the xmb turn off the console swap hard drives turn on the system, press the PS button and you will be asked to reinstall the firmware place the pup file from the e3 downgrade tools in the normal PS3/UPDATE usb folder and follow the on-screen instructions to reinstall the firmware then install dev_blind.pkg & Blackb0x FTP from install packages run dev_blind then BlackB0x and FTP into the console goto /dev_blind delete everything and replace them with the customised dev_flash press the ps button and the console should reboot and and ask to reinstall the firmware again, switch off the console and swap the hard drive back turn on the console press the ps button twice the console should boot back into 3.55 Rogero goto system update and install 4.00 OFW once installed turn the console off again and swap hard drives back and you should boot into a modified 4.00 retail firmware.
My package (downloadable at Link Rimosso) includes:
My modded dev_flash OFW 4.00 PS3UPDAT.PUP
Sorry about the camera quality, it's the best I can manage.
P.S. BTW the "nas_plugin.sprx" in this dev_flash has not been altered to achieve "Install Package Files". Also for those who will analyze my modded dev_flash, you will find that I have used debug .sprx files from the a debug 4.00 pup.
P.P.S. I originally intended to get "★ Debug Settings" to work with this. But usage of "debug settings" required the ps3 to use a debug vsh.self, and that crashes the ps3 when trying to load applications (I did some other things as well to prevent the PS3 from giving me a RSOD when I swapped the vsh.self files, I'm not detailing it in public because I don't want Sony to patch it).
Durante la notte è apparsa una curiosa e alquanto interessante notizia sui maggiori portali underground legati alla scena PlayStation 3. Stando a quanto dichiarato da un certo PS3Dev, già famoso per la creazione di diversi homebrew, sarebbe riuscito a trovare un nuovo exploit sull’ultimo firmware ufficiale, il 4.0.
Il dev dichiara che dopo attente analisi e numerose prove effettuate sulla sua console di essere riuscito a trovare un piccolo bug che potrebbe essere usato per creare nuovi exploit per la nostra amata console. A differenza degli altri sviluppatori che in passato hanno dichiarato di aver scoperto miracolosi bug da sfruttare e poi per paura di Sony o per altri motivi hanno fatto marcia indietro, PS3Dev ha deciso di condividere il tutto con i suoi “colleghi” la scoperta in modo che qualcuno riesca a creare qualcosa di concreto. Per ora non è molto ma magari apre uno spiraglio per la rinascita della scena hack su PlayStation 3, stagnante da moltissimi mesi. Ecco quanto dichiarato da PS3Dev.
CITAZIONE
So the lv2ldr verifys decrypts the lv2_kernal.self. we can get the address of this happening. inside Parameters Layout there are arguments, they are used as commands basically to load a function you want to use. they start in the lv2 @ 0x3E800(seems to be same for other ldrs) that address. There is a argument that is called lv2_in and lv2_out (we have know about these) basically we can use lv2_in to map out the address and lv2_out to map out the address for where the lv2ldr decryptes the self file. We can make a program like readself basically and get the offset, u8* means read one byte from the address. use that and we can actually be get the exact offset where it all happens at. once we have the location grabbing this decrypted self should be the easy task. Like I said some info we had and some we did not know about can be obtained like this and used to get keys. exploiting 4.00 with this method would work most likely because I doubt sony changed all the locations where the loaders do there thing, sure there encapsulated in the bootloader but they still pass over into the ram at one point before being fed over to the metldr which loads ldrs and if all that is still happening then Sony didn't change nothing
