Dumping Bootldr: Difference between revisions
Jump to navigation
Jump to search
mNo edit summary |
mNo edit summary |
||
| (One intermediate revision by one other user not shown) | |||
| Line 15: | Line 15: | ||
<li>Open your terminal and type as root:</li> | <li>Open your terminal and type as root:</li> | ||
{{keyboard|content=cd bootldrexploit/ps3peekpoke}} | {{keyboard|content=<syntaxhighlight lang="bash">cd bootldrexploit/ps3peekpoke</syntaxhighlight>}} | ||
<li>Compile the lv1 peek poke kernel module:</li> | <li>Compile the lv1 peek poke kernel module:</li> | ||
{{keyboard|content=make}} | {{keyboard|content=<syntaxhighlight lang="bash">make</syntaxhighlight>}} | ||
<li>Insert the lv1 peek poke kernel module:</li> | <li>Insert the lv1 peek poke kernel module:</li> | ||
{{keyboard|content=insmod ps3peekpoke.ko}} | {{keyboard|content=<syntaxhighlight lang="bash">insmod ps3peekpoke.ko</syntaxhighlight>}} | ||
<li>Change directory to the exploit dir</li> | <li>Change directory to the exploit dir</li> | ||
{{keyboard|content=cd ../btldr8}} | {{keyboard|content=<syntaxhighlight lang="bash">cd ../btldr8</syntaxhighlight>}} | ||
<li>Compile the exploit</li> | <li>Compile the exploit</li> | ||
{{keyboard|content=make}} | {{keyboard|content=<syntaxhighlight lang="bash">make</syntaxhighlight>}} | ||
<li>Make a nor dump by typing</li> | <li>Make a nor dump by typing</li> | ||
{{keyboard|content=dd if=/dev/ps3nflasha of=nor.bin bs=1024}} | {{keyboard|content=<syntaxhighlight lang="bash">dd if=/dev/ps3nflasha of=nor.bin bs=1024</syntaxhighlight>}} | ||
<li>Execute the exploit</li> | <li>Execute the exploit</li> | ||
{{keyboard|content=./lv0Decrypt 0 nor.bin buffer.bin}} | {{keyboard|content=<syntaxhighlight lang="bash">./lv0Decrypt 0 nor.bin buffer.bin</syntaxhighlight>}} | ||
<li>It should show the status as status A0082. This means you've succeeded. check your dump for the keys.</li> | <li>It should show the status as status A0082. This means you've succeeded. check your dump for the keys.</li> | ||
{{keyboard|content=hexdump -C dump.bin > test}} | {{keyboard|content=<syntaxhighlight lang="bash">hexdump -C dump.bin > test</syntaxhighlight>}} | ||
{{keyboard|content=nano test}} | {{keyboard|content=<syntaxhighlight lang="bash">nano test</syntaxhighlight>}} | ||
</ol> | </ol> | ||
| Line 52: | Line 52: | ||
* for the latest version of red ribbon, don't forget to also change dir to /usr/src/[your linux headers folder]/ and type make modules_prepare | * for the latest version of red ribbon, don't forget to also change dir to /usr/src/[your linux headers folder]/ and type make modules_prepare | ||
* in the eventual case you get status 89 no matter what you do, replace the function writeResponsePackageChecksum with this one : http://pastie.org/private/fyirapl8w78j462ggxmsyw | |||
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude> | {{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude> | ||
Latest revision as of 18:27, 15 September 2021
| This article is marked for rewrite/restructuring in proper wiki format. You can help PS3 Developer wiki by editing it. |
Requirements[edit | edit source]
- OtherOS++ with SS Patches
- Linux Kernel with glevand's/graf's patches (red ribbon rc6 will do the trick, since it has the embedded kernel)
- [the exploit] / [version ports]
- NOR console with a NOR dump (the exploit isn't adapted to NAND consoles yet, no MMIO available)
How to[edit | edit source]
- Start a normal session from red ribbon (or any other distro you might have)
- Extract the contents of bootldrexploit to your home folder
- Open your terminal and type as root:
- Compile the lv1 peek poke kernel module:
- Insert the lv1 peek poke kernel module:
- Change directory to the exploit dir
- Compile the exploit
- Make a nor dump by typing
- Execute the exploit
- It should show the status as status A0082. This means you've succeeded. check your dump for the keys.
cd bootldrexploit/ps3peekpoke
make
insmod ps3peekpoke.ko
cd ../btldr8
make
dd if=/dev/ps3nflasha of=nor.bin bs=1024
./lv0Decrypt 0 nor.bin buffer.bin
hexdump -C dump.bin > test
nano test
Notes[edit | edit source]
- for the latest version of red ribbon, don't forget to also change dir to /usr/src/[your linux headers folder]/ and type make modules_prepare
- in the eventual case you get status 89 no matter what you do, replace the function writeResponsePackageChecksum with this one : http://pastie.org/private/fyirapl8w78j462ggxmsyw
