Talk:Graf's PSGroove Payload

---

QA-Flag Token Combo

---

old scratchpad

(marked for deletion after above text is filled in)

<Slynk> Hmm had a thought : / You know how the token and token seed are made at the same time? That means the token seed isn't passed into the processor... what is? It can't be just your idps right? Unless sony doesn't use the HV to make their tokens. There must be other info passed in that determines whether you receive a dummy token or the full one. ... Just a thought. ^^;

<rms> i can make my own tokens from a nor/nand dump. just like hypervisor

<kevin6548> so what does that mean when a sedd is created it passes something to proccessor . nit the whole seed but a by product of creating it . is that theroy

<rms> seed is calculated from eid which allows token to be calculated. its more of a byproduct/intermediate product. if you do the math, its simple: v+s+f+h=t

• the seed value is made from your EID (from a NAND/NOR dump, either software with payload, or hardware)
• updater manager calls spu_token_processor
• sent out of spu_token_processor
• IBM Cell Simulator with SE Linux (not the ancient Sony SPU Simulator from old pre 0.9x SDKs)
• seed : 80 bytes, only the first 20 are populated

there are two algorithms used (one's an alternative of a hashing algorithm / one's a block cipher):

• HMAC-SHA1
• AES 256 CBC - Advanced Encryption Standard Cipher-block chaining; fixed block size 128 bit, key size 256 bit - with 4x4 byte matrices

erk: 0x341812376291371C8BC756FFFC611525403F95A8EF9D0C996482EEC216B562ED
iv: 0xE8663A69CD1A5C454A761E728C7C254E
hmac: 0xCC30C4229113DB25733553AFD06E8762B3729D9EFAA6D5F35A6F58BF38FF8B5F58A25BD9C9B50B01D1AB4028676968EAC7F88833B662935D7506A6B5E0F9D97A

• combo is in vsh
• combo > 3 < 10 buttons

Goto Network Settings
Hold on L1 and R1
then use the left joystick, and press: down, right, right, down, right, right, down, right, right, down, right, right, start.

^above combo is 13+2 buttons (too long)...

---