Editing Dumping Metldr

{{Wikify}}

== source/basis ==

[http://www.phrack.org/issues.html?issue=66&id=13&mode=txt archives/66/p66_0x0d_Power cell buffer overflow_by_BSDaemon.txt] [http://www.kernelhacking.com/rodrigo/docs/Cell-phrack.txt]

this is pretty safe (if you know what you are doing, and do it right)<br/>

if you plan on rehashing your EID make sure to have a flasher and a good backup of your flash handy<br/>

you can decrypt eid with root keys and static keys in the wiki key talk page<br/>

<ol>

<li>otheros++ with ss patches<br/> (yes the ones that cause trophy errors, just update when you wanna play games again and dont complain)</li>

<li>linux on your ps3 (im using ubuntu 10.10)</li>

<ul>

<li>metldr (aka asecure)</li>

<li><strike>EID0</strike> (not needed, commented out in run.sh) (if used, you will need to split eid from your flash [[Dev_Tools#dump_EID0.sh|dump_EID0.sh]]; use 'modprobe ps3dmproxy' if needed)</li>

</ul>

<ul>

<li>isoldr</li>

=== Step by Step instuctions ===

you can do this over ssh or on console.<br/>

Note: don't forget to provide EID0 and RL_FOR_PROGRAM.img if you do manually, instead of the run.sh file where they are commented out

<ol>

<li>ssh into the ps3</li>

<li>download the files:

<li>untar the files:

<li>enter the directory and compile:

<li>run the following commands now:

cat metldr > /proc/metldrpwn/metldr

cat appldr-metldrexploit350.self > /proc/metldrpwn/mathldr

cat eid0 > /proc/metldrpwn/eid0

echo 1 > /proc/metldrpwn/run

<li>there now you have a dump check it out:

<li>now copy the dump somewhere or youll lose it:

</ol>

now you have a copy in your home directory for safe keeping<br/>

<br/>

::'''So now you get code execution on metldr at the best time possible because your code executes right after metldr copies the root keys from 0x00 to 0x30, which means you get to dump these too. (Although they are hardcoded in metldr's code anyway)'''

==== example ====

  00000000 66 4d ee 51 65 6f 68 28 38 98 83 ea df ea 90 04 |fM.Qeoh(8.......|    // erk/key

  00000010 01 f3 79 09 d6 a6 52 d9 ea 6d ef 04 51 69 ec 7b |..y...R..m..Qi.{|    // erk/key

==== example with hardcoded version of minver 3.50+ console ====

  Rare example of eid_root_key with min version hardcoded into it.  Found in some rare <!--// minver 3.50 revisionkey 00 00 0E 92  C3 26 6E 4B BB 28 2E 76 B7 67 70 95 //--> 2501A's (believed to possibly be in 3.60+ as well, but unable to verify.)

  00000000  F5 CC 0B 7F 4D 00 31 07 F2 BC 57 A4 B5 C3 8B E1  |õÌ..M.1.ò¼W¤µÃ‹á|  // erk/key

  00000030  00 03 00 56 00 00 00 00 32 7F FF 80 32 7F FF 80

[[File:Ps3-cryptochain.png|300px|thumb|left|3.56 and older Chain of Trust]]

* [[Boot Order]]

This is most likely how geohot exploited it in the first place, this takes (give or take) about 10 minutes to be performed. (yeah, not so much of a "I hacked the ps3 all on my own work", especially not when it partially relies on Segher's work, one of the reason geohot never shared the way he exploited metldr to anyone)

<br><br>

<br><br>

Now You want to gain code execution to metldr, you know that metldr loads loaders to its own space, but you cannot run a loader because the loader needs to be signed and even though you know about the signature fail that Segher introduced at the CCC, you cannot use it because you don't have decrypted signatures to calculate a private key and to get signatures you need keys which you are currently trying to dump, so far you are stuck in a chicken and egg scenario.

So basically you have to <br>

1) set the offset += 0x2000<br>

and keep increasing 0x2000<br>

2) when it changes 0x40 bytes, you can add/subtract the proper amount to make it decrypt the proper locations<br>

knowing that metldr uses SCE header 0xECF0, you could calculate it knowing the address 0x3E1F0 - 0xECF0 = the value you would patch at SCE header + 0x0C<br>

<br>