PS3 SCETool, Friday Isolated SPU POC and EIDTool WIP Updates
A few days ago The new sony Ps 3 hacker naehrwert has launched a PS3 SCETool in line with the fail0verflow tools, a remote SPU binary POC named Friday plus some EIDTool work happening updates for Ps 3 designers thinking about remarrying Blu-ray drives, system board secrets, QA tokens, etc via http://twitter.com/#naehrwert.
Download: PS3 SCETool / Friday Isolated SPU Binary POC
Here are the particulars in the ReadMe files and Tweets, the following:
SCETool (C) 2011 by naehrwert – It might find more features later on.
Notice: This Could Do Nothing At All NEW, IT’S Presently Only A REWRITE OF f0f TOOLS.
Keyfile format:
Code:
[keyname]
type={SELF, PKG, SPP}
sdk_type={00, ..., 18, 8000}
version={..., 0001000000000000, ...}
self_type={LV0, LV1, LV2, APP, ISO, LDR, NPDRM}
erk=...
riv=...
An example keyfile is incorporated.Shout-outs: I believe they are fully aware who I am talking aboutFriday (C) 2011 by naehrwert – This can be a POC for any isolated spu binary. Produce a self encoded signed using the metldr secrets from friday.elf. Then use friday.h to create a PPU application that loads the self through the use of metldr and DMAs your console’s EID2 towards the shared SPU LS. It’ll create the P and S block from this, that’s accustomed to pair the BD drive towards the specific console. Yon may then DMA the blocks out of the LS and send these to the drive to remarry it towards the console.Communication using the SPU is performed in_mbox and out_mbox. Monosodium glutamate_OUT_* is send in the SPU code to out_mbox. Monosodium glutamate_IN_* ought to be written in the PPU to in_mbox. When Monosodium glutamate_OUT_READY arrives the PPU should DMA the EID2 to EID2_START and send Monosodium glutamate_IN_READY. When Monosodium glutamate_OUT_GEN_DONE arrives the PPU should DMA the blocks from BLOCKS_START and send Monosodium glutamate_IN_DIE.
Note: this really is UNTESTED but must work
POC http://www.mediafire.com/?u8lvl08h1lai2nb
note: self part is just for spu yet!
scetool http://www.mediafire.com/?31r5482wy28sc9c
veeeery nice http://pastie.org/2928187
Code:
## scetool scetool 0.0.1 (C) 2011 by naehrwert [*] Keys loaded.[*] Loaded keys: Name Type SDK-Type Version isoldr 3.50 SELF 0x0000 0x0003005000000000 isoldr 3.41 SELF 0x0000 0x0003004100000000 isoldr 1.00 SELF 0x0000 0x0001000000000000 metldr SELF 0x0000 0x0000000000000000 spp 0x00 SPP 0x0000 0x0000000000000000 pkg 0x00 PKG 0x0000 0x0000000000000000[*] File decrypted.[*] SCE Header: Magic 0x53434500 [OK] Version 0x00000002 SDK Type [Type 0] Header Type [SELF] Metadata Offset 0x000001B0 Header Length 0x0000000000000480 Data Length 0x0000000000012BF4[*] Metadata Info: Key 00000000: AC 0E 35 E4 A9 22 07 C7 09 2C 38 66 69 45 34 31 IV 00000000: 1C 7D C8 A3 EB B9 C8 9C BB E4 B6 A6 A6 49 61 C2 [*] Metadata Header: Signature Input Length 0x0000000000000450 unknown_0 0x00000001 Section Count 0x00000003 Key Count 0x00000016 Signature Info Size 0x00000030 unknown_1 0x00000000 unknown_2 0x00000000[*] Metadata section headers: Idx Offset Size Type Index unk_1 SHA1 Encrypted Key IV Compressed 000 00000500 00011C20 02 00 02 00 [YES] 06 07 [NO ] 001 00012120 000000A0 02 01 02 08 [YES] 0E 0F [NO ] 002 00012EE4 00000190 01 03 02 10 [NO ] [NO ][*] SCE File Keys: 00000000: F9 A1 54 8A A2 E3 12 FE 3B 67 CB 5E 02 03 66 82 00000001: EF E2 22 82 00 00 00 00 00 00 00 00 00 00 00 00 00000002: F4 06 C9 67 46 0F 09 C3 54 E5 0F DB BD 63 74 A6 00000003: A9 00 9B 0D 53 B4 4E 3E F2 EB 3D 7A C3 0A 79 C3 00000004: 6A 55 C9 6F 72 DE 4E 7E 7A 0D C2 CB 27 F8 C9 9A 00000005: C3 08 9E 65 A9 DF 80 B1 7E 66 DF 6B 9D 10 33 99 00000006: 2A 3C 73 80 C6 1B 85 24 9F 95 3D BE A9 A5 63 38 00000007: CB 41 E6 46 F8 B2 6E 06 D4 1A 5B F5 08 48 28 D3 00000008: 13 07 A2 4F 1C 32 3F D7 15 47 D9 50 BF E4 11 04 00000009: 18 7F EC 72 00 00 00 00 00 00 00 00 00 00 00 00 0000000a: F4 06 C9 67 46 0F 09 C3 54 E5 0F DB BD 63 74 A6 0000000b: A9 00 9B 0D 53 B4 4E 3E F2 EB 3D 7A C3 0A 79 C3 0000000c: 6A 55 C9 6F 72 DE 4E 7E 7A 0D C2 CB 27 F8 C9 9A 0000000d: C3 08 9E 65 A9 DF 80 B1 7E 66 DF 6B 9D 10 33 99 0000000e: 2A 3C 73 80 C6 1B 85 24 9F 95 3D BE A9 A5 63 38 0000000f: CB 41 E6 46 F8 B2 6E 06 D4 1A 5B F5 08 48 28 D3 00000010: 2A AE E7 5C 8C EB 44 4A 62 F4 DF EF 77 5B 02 42 00000011: C7 5C 2D 5C 00 00 00 00 00 00 00 00 00 00 00 00 00000012: F4 06 C9 67 46 0F 09 C3 54 E5 0F DB BD 63 74 A6 00000013: A9 00 9B 0D 53 B4 4E 3E F2 EB 3D 7A C3 0A 79 C3 00000014: 6A 55 C9 6F 72 DE 4E 7E 7A 0D C2 CB 27 F8 C9 9A 00000015: C3 08 9E 65 A9 DF 80 B1 7E 66 DF 6B 9D 10 33 99 [*] SELF Header: unknown_0 0x0000000000000003 App Info Offset 0x0000000000000070 ELF Offset 0x0000000000000090 PH Offset 0x00000000000000D0 SH Offset 0x0000000000012EE4 Section Info Offset 0x0000000000000110 SCE Version Offset 0x0000000000000150 Control Info Offset 0x0000000000000160 Control Info Size 0x0000000000000070[*] Application info: Auth ID [isoldr] Vendor ID 0xFF000000 SELF Type [Secure loader] Version 0x0003004100000000[*] Elf32 Header: Type [EXEC] Machine [SPU] Version 0x00000001 Entry 0x000259E0 PH Offset 0x00000034 SH Offset 0x00012A64 Flags 0x00000000 PH Count 0x0002 SH Count 0x000A SHStr Idx 0x0009[*] Elf32 Section Headers: Idx Name Type Flags Address Offset Size ES Align LK 000 00000000 NULL ... 00000 00000 00000 00 00000 00 001 0000000B PROGBITS .AE 25800 00080 001DC 00 00001 00 002 00000022 PROGBITS .AE 259E0 00260 0F1D0 00 00008 00 003 00000028 PROGBITS .A. 34BB0 0F430 02870 00 00010 00 004 00000030 PROGBITS WA. 374A0 11CA0 00070 00 00010 00 005 00000036 PROGBITS WA. 37510 11D10 0001C 00 00004 00 006 0000003D PROGBITS WA. 3752C 11D2C 00014 00 00004 00 007 00000044 NOBITS WA. 37540 11D40 039B0 00 00010 00 008 00000049 PROGBITS ... 00000 11D40 00CD2 00 00001 00 009 00000001 STRTAB ... 00000 12A12 00052 00 00001 00[*] Elf32 Program Headers: Idx Type Offset VAddr PAddr FileSize MemSize Flags Align 000 LOAD 00080 25800 25800 11C20 11C20 W.E 00080 001 LOAD 11CA0 374A0 374A0 000A0 03A50 .AE 00080
Code:
## sv_iso eid4_fallback_0x00 FF1471C135E4593D0D27F9CAA3795BD9 eid4_fallback_0x10 DD38369F0175173CE32BEED051FD4EF3