User talk:Zecoxao

From PS3 Developer wiki
Jump to navigation Jump to search

The Last Piece of the Puzzle

How

  • By enabling diagnostic mode on the ps3, we can enable the use of JTAG again (it's temporarily disabled when diag mode isn't set) false
  • It is possible to dump the syscon firmware using this method (in unencrypted state) false
  • The JTAG registers/TAP-controllers need to be bruteforced / reverse engineered false
  • The leaked service manuals present information about the pins connected to the JigPin false
  • The ObjectiveSuite contains an object (DIAGSERVICE) used to diagnose the ps3 using JTAG false
  • Using a DIY JigPin would facilitate the task, but we still need more info about the hardware and software interface used by ObjectiveSuite to handle this. false
  • This would probably work on ps4 too (provided that the diag pin and the JTAG pins still exist) false
  • f0f's method is a viable way to get the ROM from later syscons
  • tx function can be produced and it's not required for bruteforcing
  • ocd flag is located somewhere in the second SFR area (which covers 0x800 bytes, minus already documented flags)
  • code base is located somewhere in the backup ram ( 0x800 bytes) or in the second SFR area (0x800 bytes)
  • second SFR area ranges from 0xF0000 to 0xF0800
  • backup ram ranges from 0xF0800 to 0xF1000
  • ocd flag is likely 0xF07F5 since the other SFRs are the same from RL78 to 78K0R
  • 486 registers from the 2nd SFR range are publically documented
  • 1562 registers are not documented (0xF01E7 - 0xF07FF)
  • minimum scan area would be 0xE1A bytes (covering code base only and assuming ocd flag is the known value of 0xF07F5)
  • maximum scan area would be 0x55FC8A bytes (same as above and assuming ocd flag isn't known (times 0x619 bytes)

To wikify

  • Wikify begin (please wait...)
  • Roxanne, if you could also take care of these : http://pastebin.com/s75FzYxd , that would be awesome (i'm not sure what happened to eussNL so, i leave it on your hands.)
    • When I get my left hand back, then we can check this out together. Roxanne

request_idps generated files binary xor

Note: files are padded 8 bytes at start, for convenience

Wii U Key/IV Goodness

. .

Type Key SHA1 Status Description
Key key:0ADC3A209A563EC90CFE09F324821670 sha1:7A21E70751DD0BA38B3A0F4A1E6E7AF5AA34A9A3 Valid Wii U Xor
Key key:E5959ADF673CA63143A744080EE67FE4 sha1:5BAA45B5E9020ADF4C1117BD7F7B04A0385DE04E Valid USB Stor ENC
Key key:7B118F321870DAB70AF6F207ED2972BA sha1:09EDC0533DDB270DF18B644320DAD6105CCA4FAA Valid SSL ENC/DEC
Key key:EBE42A225E8593E448D9C5457381AAF7 sha1:EBEAE6D2762D4D3EA160A6D8327FAC9A25F8062B Valid Wii Common
Key key:3B8D192A39B759A8DF501FC5DA8EC3E2 sha1:1505970D69AE87FD4A89F02D9A5A20E6D144F017 Valid Wii U SEEPROM
Key key:805E6285CD487DE0FAFFAA65A6985E17 sha1:2BA6F692DDBF0B3CD267E9374FA7DD849E80F8AB Valid Wii U Expresso Ancast
Key key:2EFE8ABCEDBB7BAAE3C0ED92FA29F866 sha1:CE3641B2660253F5A7E789DB297BE2C1585B3054 Valid vWii Expresso Ancast
IV key:596D5A9AD705F94FE158026FEAA7B887 sha1:C1A8BFFB7CA5271677D4242989C6FFE44FD3DC7D Valid Wii U Expresso Ancast / vWii Expresso Ancast
Key key:B5D8AB06ED7F6CFC529F2CE1B4EA32FD sha1:D8B4970A7ED12E1002A0C4BF89BEE171740D268B Valid Wii U Starbuck Ancast
IV key:91C9D008312851EF6B228BF14BAD4322 sha1:8377C1B51FD6AEAB9D6F48A8E858F53AEBFD0BE3 Valid Wii U Starbuck Ancast
Key key:D7B00402659BA2ABD2CB0DB27FA2B656 sha1:6A0B87FC98B306AE3366F0E0A88D0B06A2813313 Valid Wii U Common
Key key:30BFC76E7C19AFBB23163330CED7C28D sha1:2B30B703C6676C8124C7347B30C7972FFEAE2B39 Valid vWii Common
Key - sha1:56DD59752E6AF1E55FC2EE7074ABE2D2C9E70A10 Confirmation Needed boot1
IV key:4FCD24A0E4D3AB6FAE8DFD8108581DCF sha1:A1A87792B95D0294C0867C93D46C3068C1C6D322 Valid boot1
Binary - sha1:EE28D0BE718055423EE79D89889EBE386E5B0C2D Found boot0
Binary - sha1:3D331B3165F9638C6CD6221702B2F736F7FCF931 Found BootROM

Switch Key/IV Goodness

Type Key SHA1/SHA256 Status Description
AES-CTR key:F4ECA1685C1E4DF77F19DB7B44A985CA sha1:8C98FF409724784DDF3E3D39B60B25B7087FF537 Valid stage1_key_00
AES-128-ECB key:C2CAAFF089B9AED55694876055271C7D sha1:4A98D62FF6EC0A042B7592219200E37DD9603479 Valid package1_key_00
AES-128-ECB key:54E1B8E999C2FD16CD07B66109ACAAA6 sha1:8CEC47B1B3974EED32C03B11A9DE0133D9E0F00B Valid master_key_01
AES-128-ECB key:4F6B10D33072AF2F250562BFF06B6DA3 sha1:ADD1D37E4A5C540AEEEF4050A2AB98E8B0DC1D04 Valid master_key_02
AES-CTR key:A35A19CB14404B2F4460D343D178638D sha1:4D64731F7AFA031C7EEAE3EB2F462D55FF8FF5AE Valid package2_key_00
Kernel - sha1:124BEFB2895BBA4DB1726485DAF6684B33EF5F51 Valid 1.00 Encrypted Kernel
System Modules - sha1:96BF598BD162D5D8C87F2B25741F758F47730C88 Valid 1.00 Encrypted System Modules
Modulus 
B36554FB0AB01E85A7F6CF918EBA9699
0D8B91692AEE01204F345C2C4F4E37C7
F10BD4CDA17F93F13359CEB1E9DD26E6
F3BB7787467AD64E474AD141B7794A38
066ECF618FCDC1400BFA26DCC0345183
D93B11543B9627329A95BE1E681150A0
6B10A8838BF5FCBC90847A5A5C4352E6
C826E9FE06A08B530FAF1EC41C0BCF50
1AA4F35CFBF097E4DE320A9FE35AAAB7
447F5C3360B90F222D332AE969793142
8FE43A138BE726BD08876CA6F273F68E
A7F2FEFB6C28660DBDD7EB42A878E6B8
6BAEC7A9E2406E892082258E3C6A60D7
F3568EEC8D518A633C0478230E900CB4
E7863B4F8E130947320E04B84D5BB046
71B05CF4AD634FC5E2AC1EC43396097B
sha1:F847ED0465C0DFDCD2C28B3E1A6DA0C0F01FBBC5 Valid Public Debug
Modulus 
8D13A7776AE5DCC03B25D058E4206959
554BAB7040082807A8A7FD0F312E11FE
47A0F99DDF80DB865A2789CD976C85C5
6C397F41F2FF2420C395A6F79D4A4574
8B5D288AC699356885A56432809FD348
39A21D246769DF75AC12B5BDC32990BE
37E4A0809ABE36BF1F2CAB2BADF59732
9A429D098B08F06347A3E91B36D82D8A
D7E1541195E44588698A2B35CED0A50B
D55DACDBAF114DCAB81EE7019EF446A3
8A946D76BD8AC83BD231580C79A826E9
D1799CCBD42B6A4FC6CCCF90A7B99847
FDFA4C6C6F81873BCAB850F63E395D4D
973F0F353953FBFACDABA87A629A3FF2
0927963F079A91F716BFC63A825A4BCF
4950958C55807E39B148051E21C7244F
sha1:A809E09F8BD790446B86F28B84A6D0F36481A245 Valid Public Retail

Regarding Jokes

  • Sorry, but it's difficult to distinguish Contributors with Spam Users, especially when you aren't logged in and when you log in to your account with different IP Addresses (and especially with this current Spam situation). It won't happen for a second time. Roxanne 21th December 2015 (18:12 GMT+1)
    • It's ok, i should've logged, but i keep formatting my pc, so i always forget :) In the end it was my fault. Thanks for the feedback though Zecoxao
      • OK and to answer your question regarding the newest DEX Firmwares, I'm on CEX but I'm still on this Firmware. Is this Good or Bad? :) (Roxanne 22th December 2015 (22:56 GMT+1)
Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=User_talk:Zecoxao&oldid=52673"