Editing Dumping Bootldr

{{Wikify}}

==Requirements==

* OtherOS++ with SS Patches
* Linux Kernel with glevand's/graf's patches (red ribbon rc6 will do the trick, since it has the embedded kernel)
* [[https://mega.co.nz/#!QcQ2wZDJ!tu1NuOJpFIrlDV-EEqGM8mgdfNCC9cwqOnGK2012CaQ the exploit]]
* NOR console with a NOR dump (the exploit isn't adapted to NAND consoles yet, [[Talk:Hypervisor_Reverse_Engineering#MMIO_.2F_Memorymap|no MMIO available]])

==How to==

<ol>
<li>Start a normal session from red ribbon (or any other distro you might have)</li>
<li>Extract the contents of bootldrexploit to your home folder</li>
<li>Open your terminal and type as root:</li>

{{keyboard|content=<syntaxhighlight lang="bash">cd bootldrexploit/ps3peekpoke</syntaxhighlight>}}

<li>Compile the lv1 peek poke kernel module:</li>

{{keyboard|content=<syntaxhighlight lang="bash">make</syntaxhighlight>}}

<li>Insert the lv1 peek poke kernel module:</li>

{{keyboard|content=<syntaxhighlight lang="bash">insmod ps3peekpoke.ko</syntaxhighlight>}}

<li>Change directory to the exploit dir</li>

{{keyboard|content=<syntaxhighlight lang="bash">cd ../btldr8</syntaxhighlight>}}

<li>Compile the exploit</li>

{{keyboard|content=<syntaxhighlight lang="bash">make</syntaxhighlight>}}

<li>Make a nor dump by typing</li>

{{keyboard|content=<syntaxhighlight lang="bash">dd if=/dev/ps3nflasha of=nor.bin bs=1024</syntaxhighlight>}}

<li>Execute the exploit</li>

{{keyboard|content=<syntaxhighlight lang="bash">./lv0Decrypt 0 nor.bin buffer.bin</syntaxhighlight>}}

<li>It should show the status as status A0082. This means you've succeeded. check your dump for the keys.</li>

{{keyboard|content=<syntaxhighlight lang="bash">hexdump -C dump.bin > test</syntaxhighlight>}}

{{keyboard|content=<syntaxhighlight lang="bash">nano test</syntaxhighlight>}}

</ol>

==Notes==

* for the latest version of red ribbon, don't forget to also change dir to /usr/src/[your linux headers folder]/ and type make modules_prepare 

* in the eventual case you get status 89 no matter what you do, replace the function writeResponsePackageChecksum with this one : http://pastie.org/private/fyirapl8w78j462ggxmsyw


{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>