Dumping Bootldr: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
mNo edit summary
 
(8 intermediate revisions by 4 users not shown)
Line 1: Line 1:
[[Category:Software]]{{Wikify}}
{{Wikify}}


==Requirements==
==Requirements==
Line 5: Line 5:
* OtherOS++ with SS Patches
* OtherOS++ with SS Patches
* Linux Kernel with glevand's/graf's patches (red ribbon rc6 will do the trick, since it has the embedded kernel)
* Linux Kernel with glevand's/graf's patches (red ribbon rc6 will do the trick, since it has the embedded kernel)
* [[https://dl.dropbox.com/u/35197530/bootldrexploit.tgz the exploit]]
* [[https://mega.co.nz/#!QcQ2wZDJ!tu1NuOJpFIrlDV-EEqGM8mgdfNCC9cwqOnGK2012CaQ the exploit]] / [[https://mega.co.nz/#!A0U0mKpS!lxiLg37pruRhVsFttUgsMLGx4mBKj80PDycnaJ8SttQ version ports]]
* NOR console with a NOR dump (the exploit isn't adapted to NAND consoles yet)
* NOR console with a NOR dump (the exploit isn't adapted to NAND consoles yet, [[Talk:Hypervisor_Reverse_Engineering#MMIO_.2F_Memorymap|no MMIO available]])


==How to==
==How to==
Line 15: Line 15:
<li>Open your terminal and type as root:</li>
<li>Open your terminal and type as root:</li>


{{keyboard|content=cd bootldrexploit/ps3peekpoke}}
{{keyboard|content=<syntaxhighlight lang="bash">cd bootldrexploit/ps3peekpoke</syntaxhighlight>}}


<li>Compile the lv1 peek poke kernel module:</li>
<li>Compile the lv1 peek poke kernel module:</li>


{{keyboard|content=make}}
{{keyboard|content=<syntaxhighlight lang="bash">make</syntaxhighlight>}}


<li>Insert the lv1 peek poke kernel module:</li>
<li>Insert the lv1 peek poke kernel module:</li>


{{keyboard|content=insmod ps3peekpoke.ko}}
{{keyboard|content=<syntaxhighlight lang="bash">insmod ps3peekpoke.ko</syntaxhighlight>}}


<li>Change directory to the exploit dir</li>
<li>Change directory to the exploit dir</li>


{{keyboard|content=cd ../btldr8}}
{{keyboard|content=<syntaxhighlight lang="bash">cd ../btldr8</syntaxhighlight>}}


<li>Compile the exploit</li>
<li>Compile the exploit</li>


{{keyboard|content=make}}
{{keyboard|content=<syntaxhighlight lang="bash">make</syntaxhighlight>}}


<li>Make a nor dump by typing</li>
<li>Make a nor dump by typing</li>


{{keyboard|content=dd if=/dev/ps3nflasha of=nor.bin bs=1024}}
{{keyboard|content=<syntaxhighlight lang="bash">dd if=/dev/ps3nflasha of=nor.bin bs=1024</syntaxhighlight>}}


<li>Execute the exploit</li>
<li>Execute the exploit</li>


{{keyboard|content=./lv0Decrypt 0 nor.bin buffer.bin}}
{{keyboard|content=<syntaxhighlight lang="bash">./lv0Decrypt 0 nor.bin buffer.bin</syntaxhighlight>}}


<li>It should show the status as status A0082. This means you've succeeded. check your dump for the keys.</li>
<li>It should show the status as status A0082. This means you've succeeded. check your dump for the keys.</li>


{{keyboard|content=hexdump -C dump.bin > test}}
{{keyboard|content=<syntaxhighlight lang="bash">hexdump -C dump.bin > test</syntaxhighlight>}}


{{keyboard|content=nano test}}
{{keyboard|content=<syntaxhighlight lang="bash">nano test</syntaxhighlight>}}


</ol>
</ol>
==Notes==
* for the latest version of red ribbon, don't forget to also change dir to /usr/src/[your linux headers folder]/ and type make modules_prepare
* in the eventual case you get status 89 no matter what you do, replace the function writeResponsePackageChecksum with this one : http://pastie.org/private/fyirapl8w78j462ggxmsyw
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>

Latest revision as of 18:27, 15 September 2021

Requirements[edit | edit source]

  • OtherOS++ with SS Patches
  • Linux Kernel with glevand's/graf's patches (red ribbon rc6 will do the trick, since it has the embedded kernel)
  • [the exploit] / [version ports]
  • NOR console with a NOR dump (the exploit isn't adapted to NAND consoles yet, no MMIO available)

How to[edit | edit source]

  1. Start a normal session from red ribbon (or any other distro you might have)
  2. Extract the contents of bootldrexploit to your home folder
  3. Open your terminal and type as root:
  4. Type This
    cd bootldrexploit/ps3peekpoke
    
  5. Compile the lv1 peek poke kernel module:
  6. Type This
    make
    
  7. Insert the lv1 peek poke kernel module:
  8. Type This
    insmod ps3peekpoke.ko
    
  9. Change directory to the exploit dir
  10. Type This
    cd ../btldr8
    
  11. Compile the exploit
  12. Type This
    make
    
  13. Make a nor dump by typing
  14. Type This
    dd if=/dev/ps3nflasha of=nor.bin bs=1024
    
  15. Execute the exploit
  16. Type This
    ./lv0Decrypt 0 nor.bin buffer.bin
    
  17. It should show the status as status A0082. This means you've succeeded. check your dump for the keys.
  18. Type This
    hexdump -C dump.bin > test
    
    Type This
    nano test
    

Notes[edit | edit source]

  • for the latest version of red ribbon, don't forget to also change dir to /usr/src/[your linux headers folder]/ and type make modules_prepare