Nonostante alcuni sviluppatori noti stiano già lavorando per sbloccare definitivamente la PlayStation 3 con firmware 4.00, il lavoro da fare è ancora tanto…ma lo sviluppatore Ps3Dev ha avuto un’ idea su un possibile exploit da utilizzare e ha voluto condividerlo con tutti gli sviluppatori, proprio per velocizzare le operazioni!
Di seguiti, la sua idea (purtroppo non tradotta).
So the lv2ldr verifys decrypts the lv2_kernal.self. we can get the address of this happening. inside Parameters Layout there are arguments, they are used as commands basically to load a function you want to use. they start in the lv2 @ 0x3E800(seems to be same for other ldrs) that address. There is a argument that is called lv2_in and lv2_out (we have know about these) basically we can use lv2_in to map out the address and lv2_out to map out the address for where the lv2ldr decryptes the self file. We can make a program like readself basically and get the offset, u8* means read one byte from the address. use that and we can actually be get the exact offset where it all happens at. once we have the location grabbing this decrypted self should be the easy task. Like I said some info we had and some we did not know about can be obtained like this and used to get keys.
exploiting 4.00 with this method would work most likely because I doubt sony changed all the locations where the loaders do there thing, sure there encapsulated in the bootloader but they still pass over into the ram at one point before being fed over to the metldr which loads ldrs and if all that is still happening then Sony didn’t change nothing.void *buf; // <- that will get the address of the argument we chose to load u? buf_size;// <- pretty clear it gets the size. but would you add u64? } lv2_in; struct { u8 result[0x10];//read it by one byte from the address } lv2_out; }
