Clarifying the confusion on the PS3 development
If you read my post about the LV0 keys being leaked recently then you know it could be alot to take in and hard to understand. Hopefully this will help clear up everything.
Marcan, who is a valuable asset of the Wii and PS3 hacking scene has made some posts that will help clear the air on things, it helps clarify and break things down even more than what I had previously said in the original article both in technicality and in simplicity. I’ve bolded the important parts that you should pay attention to in his answers.
More Technical Information
“The first-stage bootloader is in ROM and has a per-console key which is effectively in tamper-resistant silicon. The second-stage bootloader (bootldr) is encrypted with the per-console key, but is not upgradable and is the same for all consoles (other than the encryption wrapper around it). This second-stage bootloader verifies lv0. Sony signed lv0 using the same broken process that they used for everything else, which leaks their private key. This means that the lv0 private key was doomed from the start, ever since we demonstrated the screwup at the Chaos Communication Congress two years ago.
However, because lv0 is also encrypted, including its signature block, we need that decryption key (which is part of bootldr) before we can decrypt the signature and apply the algorithm to derive the private key. We did this for several later-stage loaders by using an exploit to dump them, and Geohot did it for metldr (the “second root” in the PS3’s bizarre boot process) using a different exploit (we replicated this, although our exploit might be different). At the time, this was enough to break the security of all released firmware to date, since everything that mattered was rooted in metldr (which is bootldr’s brother and is also decrypted by the per-console key). However, Sony took a last ditch effort after that hack and wrapped everything after metldr into lv0, effectively using the only security they had left (bootldr and lv0) to attempt to re-secure their platform.
Bootldr suffers from the same exploit as metldr, so it was also doomed. However, because bootldr is designed to run from a cold boot, it cannot be loaded into a “sandboxed” SPU like metldr can from the comfort of OS-mode code execution (which we had via the USB lv2 exploit), so the exploit is harder to pull off because you don’t have control over the rest of the software. For the exploit that we knew about, it would’ve required hardware assistance to repeatedly reboot the PS3 and some kind of flash emulator to set up the exploit with varying parameters each boot, and it probably would’ve taken several hours or days of automated attempts to hit the right combination (basically the exploit would work by executing random garbage as code, and hoping that it jumps to somewhere within a segment that we control – the probabilities are high enough that it would work out within a reasonable timeframe). We never bothered to do this after the whole lawsuit episode.
Presumably, 18 months later, some other group has finally figured this out and either used our exploit and the hardware assistance, or some other equivalent trick/exploit, to dump bootldr. Once the lv0 decryption key is known, the signing private key can be computed (thanks to Sony’s epic failure).
The effect of this is essentially the same that the metldr key release had: all existing and future firmwares can be decrypted, except Sony no longer has the lv0 trick up their sleeve. What this means is that there is no way for Sony to wrap future firmware to hide it from anyone, because old PS3s must be able to use all future firmware (assuming Sony doesn’t just decide to brick them all…), and those old PS3s now have no remaining seeds of security that aren’t known. This means that all future firmwares and all future games are decryptable, and this time around they really can’t do anything about it. By extension, this means that given the usual cat-and-mouse game of analyzing and patching firmware, every current user of vulnerable or hacked firmware should be able to maintain that state through all future updates, as all future firmwares can be decrypted and patched and resigned for old PS3s. From the homebrew side, it means that it should be possible to have hombrew/linux and current games at the same time. From the piracy side, it means that all future games can be pirated. Note that this doesn’t mean that these things will be easy (Sony can obfuscate things to annoy people as much as their want), but from the fundamental security standpoint, Sony doesn’t have any security leg to stand on now. It does not mean that current firmwares are exploitable. Firmware upgrades are still signed, so you need an exploit in your current firmware to downgrade. Also, newer PS3s presumably have fixed this (probably by using newer bootldr/metldrs as trust roots, and proper signing all along).”
They are indeed the bootldr keys (I was able to decrypt an lv0 with them). Consider this confirmation that the story is not fake.
Can this be used to sign binaries to run homebrew on OFW PS3s (ala the PSP key leak)? Are those private keys sufficient to sign homebrew software such that they will run in unmodified firmware?
No. The keys are used for two purposes: chain of trust and chain of secrecy. The compromise of the keys fully compromises the secrecy of the PS3 platform permanently, as you can just follow the links down the chain (off-line, on a PC) and decrypt any past, current, or future firmware version. Current consoles must be able to use any future firmware update, and we now have access to 100% of the common key material of current PS3s, so it follows that any future firmware decryptable by current PS3s is also decryptable by anyone on a PC.
However, the chain of trust can be re-established at any point along the line that can be updated. The chain of trust is safely rooted in hardware that is near impossible to modify (i.e. the CPU’s ROM and eFuse key). The next link down the chain has been compromised (bootldr), and this link cannot be updated as it is specific to each console, so the chain of trust now has a permanent weak second link. However, the third link, lv0, can be updated as it is located in flash memory and signed using public key crypto. This allows Sony to secure the entire chain from there onwards. Unless you find a vulnerability in these updated links, you will not be able to attack them directly (applications, e.g. homebrew software, are verified much further down the chain). The only guaranteed way to break the chain is to attack the weak link directly, which means using a flash writer to overwrite lv0. Once you do so, the entire chain collapses (well, you still need to do some work to modify every subsequent link to turn off security, but that is easy). If you have old firmware, you have at least some other weak links that, when compromised, allow you direct access to break the bootldr link (replacing lv0), but if you run up to date firmware you’re out of luck unless you can find a weakness or you use hardware.
Old PS3s are now in the same boat as an old Wii, and in fact we can draw a direct comparison of the boot process. On an old Wii, boot0 (the on-die ROM) securely loads boot1 from flash, which is securely checked against an eFuse hash, and boot1 loads boot2 but insecurely checks its signature. On an old PS3, the Cell boot ROM securely loads bootldr from flash, which is securely decrypted and checked using an eFuse key, and then bootldr loads lv0 but checks its signature against a hardcoded public key whose private counterpart is now known. In both cases, the system can be persistently compromised if you can write to flash, or if you already have code execution in system context (which lets you write to flash). However, in both cases, you need to use some kind of high-level exploit to break into the firmware initially, particularly if you have up-to-date firmware. It just happens that this is trivial on the Wii because there is no game patch system and Nintendo seems to have stopped caring, while this is significantly harder on the PS3 because the system software has more security layers and there is a game patch system.
Breaking it down into simple and easy to understand words
Since Marcan’s answers can be a bit difficult to digest, I’ve broken them up into the form of questions and answers with the special help of ViRGE on this. This will clear alot of it up for those less technical.
Q: What exactly has been recovered?
A: The keys used by bootldr to decrypt/verify lv0, and by reversing the process the private keys used by Sony to sign lv0. If we consult our handy 3.60+ chain of trust diagram, we can see that bootldr is at the very root of the chain of trust, with lv0 being the first module it loads.
Q: So what can we do with the lv0 signing key?
A: In short, we can use it to decrypt lv0, modify it to patch out any lv0 security checks, and resign it with a legitimate key that bootldr will accept. With the chain of trust broken and lv0 no longer enforcing the security of the modules that it controls, we can then start modifying lv1ldr, lv2ldr, appldr, isoldr, etc to patch out their security checks and add CFW functionality.
Q: Can Sony “fix” this like they did for the 3.55 exploit?
A: No. With 3.55 the keys metldr used to verify its dependent modules were recovered. So Sony simply stopped using the now-insecure metldr and started using bootldr (which was still secure) to load.. Sony doesn’t have any more secure modules like bootldr left so like I said in my original post they have no options and cant fix anything; without getting too technical, we now have the keys to every “common” hardware module that is able to decrypt Sony-signed modules. The only thing left are the modules that use per-console keys, which are useless for booting common firmware (which must be decryptable by every PS3)
Q: So bootldr is fixed in hardware?
A: Correct. Like metldr, bootldr cannot be software updated by Sony. It’s hard-coded in hardware. As a reminder, bootldr/metldr themselves can’t be exploited, but because of the keys we have recovered we can make them load anything we want, nullifying whatever security they provide.
Q: What about future firmwares?
A: Good news! We can decrypt those too. Sony can use various coding tricks to make the process more difficult (this is called obfuscation), but they can’t stop us by using keys. We will always be able to decrypt lv0, and as long as we can figure out how to navigate lv0 we can figure out how to decrypt and modify its dependent modules. For those of you that follow Sony hardware this is much like how the earlier PSPs were hacked. So we can always decrypt the firmware and will be able to create newer CFWs as long as we can get past any obfuscation by Sony.
Q: So the PS3 is utterly and completely broken?
A: To an extant yes, debatable but unlike the 3.55 hack we have mostly everything needed. Sony will never be able to re-secure existing consoles.
Q: What about consoles running firmware newer than 3.55?
A: Because all “old” consoles use the same keys to verify modules like lv0, at a minimum we can decrypt, patch, and resign the firmware. The problem is that we need a way to convince the PS3 to flash our modified firmware. With 3.55 and below that was easy enough to do because of the keys recovered, but 3.56 and later change that so that flashing is more complex than just using the recovered keys. This isn’t an insurmountable problem – hardware flashers will always work – but for easy software flashing we need to find new exploits in the PS3 software stack to convince OFW consoles to flash CFW.
Q: What about newer consoles?
A: So there’s the real problem. Remember how we said bootldr and metldr are fixed in hardware? Sony can create new hardware, and update those modules in the process. By using new hardware in conjunction with new firmware for that hardware, Sony could completely change the keys used to secure the system. Without getting too technical, all of this progress comes from the fact that Sony was sloppy and did a poor job of implementing their security on earlier consoles, which is what lead to the first keys being leaked. Sony could always issue new hardware with new keys and a fixed security system at which point we’d be completely locked out of that new hardware. It’s entirely possible they’ll do this (if they haven’t done so already), so much like the PSP we’re going to end up with a limited number of consoles that have hardware-based flaws that can be exploited. Of course we then found new ways of exploiting the PSP anyhow, and ultimately were able to exploit every PSP made in one way or another.
If you are on anything higher than 3.55 it doesn’t mean you are out, there are ways to downgrade if your model is one thats able, otherwise you are just not able to do anything right now until more dev work is done. So sit tight and hold on. Again stay tuned, more info and news will be definitely coming.
Basically, people who have the launch ps3 fat and slims will have to keep waiting for a software downgrade method. Assuming that doing this will be difficult and there’s already hardware downgrading methods, I can’t see anyone putting forth the effort into making a software exploit.
I have no problem with hacking but hacking leads to piracy and this very well could hurt sony and maybe even kill them and i for one think that sony is much better and more caring than freaking microsoft. I know this statement wont change anything but i wanted to voice my opnion and excuse my language but if sony is taken out by this then f the *** who leaked the level zero codes and if you would so kindly go dig yourself a grave. If sony is not taken out then next time you decide to be a *** then go and kill microsoft instead,you know because everyone needs a break and sony isent an exception but i think xboxes break is way overdue even if halo is amazing 🙂
Would you rather pay for these keys or have them free, cuz what i heard is that some team named the three musketers hacked these keys first but they weren’t going to give them to just anyone tho they did give them to a “trusted” circle of people and then another hacker/s came along and got on his hand what the three musketers had worked so hard on, then they (the other hacker/s) were developing a dongle so people would have to buy a stupid dongle (usb stick for ps3), so the three musketers said they were so *** off and they didn’t care about the ps3 scene they just gave these keys away rather than let the other hacker/s get money from people like you and me.
Sorry bro, but Sony is the more evil of the two here. What kind of a company takes away features from its consoles with every update instead of adding them? And lol at Sony plus, if you buy games you can’t even keep them if the subscription runs out. Your comment reeks of blind microsoft hate.
Check your facts son… games bought with a PS+ account are as “yours” as ones bought without it, even if they are discounted. this includes add-ons and anything else. If Sony chooses to put the game up free to PS+ subscribers they do expire if you let your PS+ lapse. A little bit of reading and critical thinking could make you sound a bit more on it. I do agree with you though while I have no great love for either game giant I agree the previous poster sounds about as in bed with Microsoft as you can get without catching something. I would honestly love to see either company humbled, not destroyed mind you, but reminded where they came from and who it was that helped them get where they are now.
My mistake I meant in bed with Sony I agree with you completely that the poster is bias
One: im not mad at the three musketeers im mad at the one who leaked the codes
Two: i would rather get them free but when it comes to the point of having a possibilty of taking out sony then i would rather just not having them
Three: sony requires a continous ps plus sub. To keep your games but when your getting multi games a month and early beta access then yea i think in comparison to microsofts pay for our more expensive premium service that without it you dont get to play online with your frinds and you still dont get ‘free’ games
Four: sony added playstation home and its still here so theres one of many updates thats has stayed
Five:I would like to confirm that when not comparing and just looking at facts sony and microsoft both have their up and their downs and in the end their both companies looking for money i only think that sony does it with more reasanable manners
I hope that clears up any confusion and to say i have blind hate i do not i have very good reasons i hate microsoft and i have valid reasons why i hate sony but the purpose of this post was to say that im mad at the ones who leaked the codes because hacking leads to piracy which isent the hackers fault directly but still when sony is having to fight hackers and still release new games,content, and etc. And xbox is just relaxing over there and not putting half the effort that sony is then of course im going to be mad when sony is put at risk of being taken down but when it comes down too it i do not wish to see either company destroyed but if someone is going to leak something that can kill one then in that case i would rather microsoft be the one taken down.
Why do you hate Microsoft though? You still haven’t given a valid reason for the hate. Wow, Playstation Home, filled with virgins who pester females who might actually be guys and trolls. Honestly, I’d rather pay for live and get good online play than the lagfest and unreliability that is PSN.
Don’t concern yourself with console piracy because it occurs a heck of a lot less than PC game piracy. PC gamers are the ones who are suffering, not the average joe who wouldn’t even know how to jailbreak/flash a console unless he was somewhat tech savvy.
I’m not a MS fanboy, but it really annoys me when people needlessly drag them through the mud over a problem that’s been fixed 3 years ago and a silly little argument like paying for xbox live. I have both consoles and I can honestly say that I’m disappointed with the PS3 and with Sony.
Another thing, locked gamesaves.. seriously? The fact that you need a jailbroken console to bypass that is hilarious and all this does is annoy the heck out of people who formatted their hard drives but can’t use their own saves just because it’s from a different user profile that they themselves made.
Whoever at Sony or whichever *** developer thought of that needs to get slapped.
What’s a matter new Ps3 Super Slims +3.6, if my Ps3 still 3.55 Online PSN! \o/ Victory!!!!
Pls Need CFW PS3 Ultra Slim 250gb CECH-4001b T_T
hi guys i need help i am making 4.31 and 4.40 jb spoofd to 4.40 but ewrytime i am building it then i getting this error (patch_lv1::patch_self self) please help
thanks for taking the time to translate that!