 |
forums.ps2dev.org
Homebrew PS2, PSP & PS3 Development Discussions
|
| View previous topic :: View next topic |
| Author |
Message |
dridri
Joined: 31 Jul 2009
Posts: 35
|
 Posted: Wed Sep 16, 2009 10:05 am Post subject: Decrypt the Firmware 6.0 |
 |
|
Hi, i'm trying to decrypt the FW 6.0.
Actualy I found a key (first: is it a 16 bytes key ? or more ? less ?), and I use the PSP to decompress the code, and the result that is the result for a "simple" PRX (amctrl.prx) :
And all the file is 00.......
So I think my key is not good, too short or too long maybe ?
But the 8 first bytes means to be Ok, because the ELF header is good for these 8 bytes...
My key is :
C1 00 A9 EF C1 DE 2B 82 XX XX XX XX XX XX XX XX => the rest is not good....
_________________
I'm French, and 15 years old, so my English is not good... |
|
| Back to top |
|
 |
serige
Joined: 26 Nov 2007
Posts: 35
|
| Posted: Wed Sep 16, 2009 1:23 pm Post subject: |
|
|
Is this Sony's way of telling you "thanks for trying"?
Sorry for my non-suggestive comment. :p
I think there are many reasons that you are getting this kind of wired stuff.
It might be the best for you to analyze the problem yourself. Given that what you are trying to do, you should be capable of figuring it out by yourself. |
|
| Back to top |
|
|
SilverSpring
Joined: 27 Feb 2007
Posts: 115
|
| Posted: Wed Sep 16, 2009 2:46 pm Post subject: |
|
|
You must be doing something seriously wrong. There is no possible way to get a 'partially' decrypted prx, this is not a stream cipher. The crypto hw used for decryption will either work and give you the correct output, or will fail and change nothing. It won't give a 'partial' result.
On top of that, after decryption a prx is compressed which needs to be decompressed to get the final plaintext ELF file (compression algo has changed too from GZIP to RLZ to KLE now). So after successful decryption, the header would not be ELF, it would be either 0x1F 0x1B (GZIP compressed), 2RLZ (RLZ compressed), or K4LE (KLE compressed). There would be no way to get a 'partially' decompressed file to produce that first bit of plaintext you showed there.
So somewhere, something has gone seriously wrong.
OR, everything actually worked out perfectly and that really is the final plaintext, in which case SCE is now doing some funky dummy tricks to fool devs.
_________________
PSP PRX LibDocs |
|
| Back to top |
|
|
dridri
Joined: 31 Jul 2009
Posts: 35
|
| Posted: Wed Sep 16, 2009 6:17 pm Post subject: |
|
|
I need to know what is a complete KL4E header, is there any documentation ?
Because that result is by decrypting and decompressing the file, this is the decrypted and compressed file :
So my key is too short I think, because the 3 firsts blocks of 4 bytes are good ine the final result.
I use a xor operation to decrypt the file, is it another thing ? :
| Code: | for(i=0, i<size; i+=4){
data[i] = key[j] ^ data[i];
data[i] = key[j] ^ data[i];
data[i] = key[j] ^ data[i];
data[i] = key[j] ^ data[i];
j++;
if(j >= 16){ // Is it really the key length ?
j = 0;
}
} |
_________________
I'm French, and 15 years old, so my English is not good... |
|
| Back to top |
|
|
ab5000
Joined: 06 May 2008
Posts: 74
|
| Posted: Wed Sep 16, 2009 7:43 pm Post subject: |
|
|
Excuse me...
I decrypted usermode modules of 6.00, but i want to make a question to SilverSpring.
I know i need keys for kernel modules and i know they are in part2 and part3 of IPL.
I thought i can dump the ENCRYPTED firmware, but it says it can't decrypt the psar table (error -1)...
So i took the psardumper code and i modified it a bit so it'll load the psar table from a file.
I extracted the table from updater memory (just run 1.50 in TM, run psplink, reset in updater mode and run the fw update. strage thing: reset updater fails on 5.550 GEN-B2! error 0x8002013A) and i put it on MS.
It dumped and decrypted ALL the USER modules. So it's ok.
Now, here's the questions.
1) Why i can't even get crypted kernel modules? they simply miss.
2) Why psardumper fail in decrypting the table? i thought psar decryption wasn't needing firmware keys. did they change the algoritmh?
Thanks!
_________________
| Code: | %:include<stdio.h>
int _(int __,int ___,int ____,int _____)
<%for(;____<___;_____=_____*__,____++);
return _____;%>main()<%printf
("%d\n",_(2,5,0,1));%> |
|
|
| Back to top |
|
|
dridri
Joined: 31 Jul 2009
Posts: 35
|
| Posted: Thu Sep 17, 2009 12:31 am Post subject: |
|
|
| ab5000 wrote: | | 2) Why psardumper fail in decrypting the table? i thought psar decryption wasn't needing firmware keys. did they change the algoritmh? |
I think the keys has changed, you can see that in the PsarDumper :
| Code: | TABLE_KEYS table_keys[] =
{
{ 0xb730e5c7, 0x95620b49, key_S },
{ 0x45c9dc95, 0x5a7b3d9d, key_S2 },
{ 0x6F20585A, 0x4CCE495B, key_S3 },
{ 0x620BF15A, 0x73F45262, key_S4 }
}; |
Maybe there a new mode, but where to find the two values, and the 'key_S5' table...
_________________
I'm French, and 15 years old, so my English is not good... |
|
| Back to top |
|
|
ab5000
Joined: 06 May 2008
Posts: 74
|
| Posted: Thu Sep 17, 2009 12:42 am Post subject: |
|
|
if you want i hooked the Dmesg function responsible for decrypting PSAR's, we can analyze the output...
_________________
| Code: | %:include<stdio.h>
int _(int __,int ___,int ____,int _____)
<%for(;____<___;_____=_____*__,____++);
return _____;%>main()<%printf
("%d\n",_(2,5,0,1));%> |
|
|
| Back to top |
|
|
dridri
Joined: 31 Jul 2009
Posts: 35
|
| Posted: Thu Sep 17, 2009 2:28 am Post subject: |
|
|
| ab5000 wrote: | | I extracted the table from updater memory (just run 1.50 in TM, run psplink, reset in updater mode and run the fw update. strage thing: reset updater fails on 5.550 GEN-B2! error 0x8002013A) and i put it on MS. |
What you call the updater mode ? What is it ?
EDIT: I said nothing, i found.. ^^
_________________
I'm French, and 15 years old, so my English is not good... |
|
| Back to top |
|
|
dridri
Joined: 31 Jul 2009
Posts: 35
|
| Posted: Fri Sep 18, 2009 3:18 am Post subject: |
|
|
| ab5000 wrote: | | if you want i hooked the Dmesg function responsible for decrypting PSAR's, we can analyze the output... |
What you hook ? The function itself, or the calling function ?
_________________
I'm French, and 15 years old, so my English is not good... |
|
| Back to top |
|
|
ab5000
Joined: 06 May 2008
Posts: 74
|
| Posted: Fri Sep 18, 2009 3:44 am Post subject: |
|
|
I made a PRX containing the patched function, then i did:
| Quote: | | modexp @myDmesgHook |
(myDmesgHook is the name of my module) and wrote down hook function export address. Imagine it's 0x12345678...
| Quote: | | modimp @scePSAR_Driver |
and i wrote down the adress of the stub for Dmesg function... imagine it's 0xABCDEF12. then:
| Quote: | | asm 0xABCDEF12 "j 0x12345678" |
done...
but i didn't dump the table this way.
i dumped user memeory when update was around 12% (no need for it to be 12%, just down it during update). then search for flash0: in the file, you'll find the table in 2 minutes...
then you'll need to copy it in a file. i took another table as reference: there's a "terminating" sequence, something like 08080808 (take a look at 5.50 table for example). modify psardumper to load 1000 and 2000 table from the file and yeah...
_________________
| Code: | %:include<stdio.h>
int _(int __,int ___,int ____,int _____)
<%for(;____<___;_____=_____*__,____++);
return _____;%>main()<%printf
("%d\n",_(2,5,0,1));%> |
|
|
| Back to top |
|
|
dridri
Joined: 31 Jul 2009
Posts: 35
|
| Posted: Fri Sep 18, 2009 3:52 am Post subject: |
|
|
So, now we need to find the key to decrypt the kernel PRXs... Have you any idea ?
I think we need to decrypt the IPL first, because it contains all the keys (1g, 2g, 3g, and maybe 4g..)
_________________
I'm French, and 15 years old, so my English is not good... |
|
| Back to top |
|
|
dridri
Joined: 31 Jul 2009
Posts: 35
|
| Posted: Fri Sep 18, 2009 7:59 am Post subject: |
|
|
UP
I decrypted the 01g IPL, but where is the key ??
_________________
I'm French, and 15 years old, so my English is not good... |
|
| Back to top |
|
|
serige
Joined: 26 Nov 2007
Posts: 35
|
| Posted: Fri Sep 18, 2009 1:05 pm Post subject: |
|
|
| dridri wrote: | UP
I decrypted the 01g IPL, but where is the key ?? |
It should be somewhere in the decrypted IPL, just follow the mips code.
Even if they change the decrypting routine, it would contain specific instructions to tell the ipl how to decrypt kernel modules. |
|
| Back to top |
|
|
dridri
Joined: 31 Jul 2009
Posts: 35
|
| Posted: Fri Sep 18, 2009 8:33 pm Post subject: |
|
|
| serige wrote: | | dridri wrote: | UP
I decrypted the 01g IPL, but where is the key ?? |
It should be somewhere in the decrypted IPL, just follow the mips code.
Even if they change the decrypting routine, it would contain specific instructions to tell the ipl how to decrypt kernel modules. |
I think what you say is true, but for all firmwares. Because I decrypted the 5.00 IPL, as we know the keys, and I searched by using an Hex Editor and no results....
So yes, I need to follow all the code, jumps, and all ?! It's very fastidious...
_________________
I'm French, and 15 years old, so my English is not good... |
|
| Back to top |
|
|
ab5000
Joined: 06 May 2008
Posts: 74
|
| Posted: Sat Sep 19, 2009 2:25 am Post subject: |
|
|
parts 2 and 3 aren't decrypted by psardumper... otherwise is would be too simple :P
take a look at this: http://forums.ps2dev.org/viewtopic.php?p=84468#84468
you need to take decrypted part1, reverse it, decrypt part2 & 3, decompress them and find the keys.
_________________
| Code: | %:include<stdio.h>
int _(int __,int ___,int ____,int _____)
<%for(;____<___;_____=_____*__,____++);
return _____;%>main()<%printf
("%d\n",_(2,5,0,1));%> |
|
|
| Back to top |
|
|
dridri
Joined: 31 Jul 2009
Posts: 35
|
| Posted: Sat Sep 19, 2009 2:36 am Post subject: |
|
|
I ve the full IPL.
You can get it by this wav :
- Put this PRX into "ms0:/elf/"
- install the 6.00 OFW
- Restart your PSP and press SELECT (like R for recovery)
- You arrives in the "ELF Menu"
- then start "Dump_IPL.elf" by pressing X
For sure, you need to have the TM
To reverse the IPL, you can use prxtool :
| Quote: | | prxtool -b -w enc_ipl.bin > enc_ipl.asm |
EDIT: humm... you need the pandora Elf menu ^^
_________________
I'm French, and 15 years old, so my English is not good...
Last edited by dridri on Sat Sep 19, 2009 7:19 am; edited 1 time in total |
|
| Back to top |
|
|
dridri
Joined: 31 Jul 2009
Posts: 35
|
| Posted: Sat Sep 19, 2009 6:47 am Post subject: |
|
|
But, how look likes the key ^^ ?
I found that (bu following the code) :
0xBF 0x0E 0xBF 0xC0 0x02 0x80 0xEC 0x0F 0xEC 0x4F 0xED 0x8F 0x71 0x40 0xE9 0x8F
It's maybe that or not, but what is the algorithm to decrpt the IPL2 ??
_________________
I'm French, and 15 years old, so my English is not good... |
|
| Back to top |
|
|
serige
Joined: 26 Nov 2007
Posts: 35
|
| Posted: Sat Sep 19, 2009 7:52 am Post subject: |
|
|
| dridri wrote: | But, how look likes the key ^^ ?
I found that (bu following the code) :
0xBF 0x0E 0xBF 0xC0 0x02 0x80 0xEC 0x0F 0xEC 0x4F 0xED 0x8F 0x71 0x40 0xE9 0x8F
It's maybe that or not, but what is the algorithm to decrpt the IPL2 ?? |
I remember last time I saw an IPL, it's doing a lot of uncovering of its trace (i.e. zero out key buffers and stacks before routines return, etc.). Based on this, I doubt that it will leave valuable information that visible for you.
There used to be an interesting embedded file inside of part2 IPL, it's gziped and then encrypted. I don't think the encryption is the same for each and every firmware version. So, for fw6.0, you are supposed to figure it out yourself. However, I am pretty sure there are people out there who have already accomplished what you are trying to do :)
Last edited by serige on Sat Sep 19, 2009 7:55 am; edited 1 time in total |
|
| Back to top |
|
|
dridri
Joined: 31 Jul 2009
Posts: 35
|
| Posted: Sat Sep 19, 2009 7:55 am Post subject: |
|
|
| serige wrote: | | However, I am pretty sure there are people out there who have already accomplished what you are trying to do :) |
Yes, it's sure, but that Fu***** people dont want to give me that ! Are they afraid that I make an CFW ?? I don't know how to do !!
_________________
I'm French, and 15 years old, so my English is not good... |
|
| Back to top |
|
|
serige
Joined: 26 Nov 2007
Posts: 35
|
| Posted: Sat Sep 19, 2009 8:05 am Post subject: |
|
|
Hey man, please be polite to other devs. They don't do it because they have to give out the algorithm to you. But like I said, you can always figure it out yourself.
| Quote: | | Are they afraid that I make an CFW ?? |
I don't know about that. But if you can make one, you probably shouldn't be here and asking this kind of questions at the first place. But anyway, I hope you good luck on your mission! |
|
| Back to top |
|
|
dridri
Joined: 31 Jul 2009
Posts: 35
|
| Posted: Sat Sep 19, 2009 8:08 am Post subject: |
|
|
I can make a CFW, but I never decrypted a OFW, I always used already decrypted versions by using the PsarDumper..
_________________
I'm French, and 15 years old, so my English is not good... |
|
| Back to top |
|
|
serige
Joined: 26 Nov 2007
Posts: 35
|
| Posted: Sat Sep 19, 2009 8:13 am Post subject: |
|
|
Oh, my apology then :/
Well, then what you need to do is clear: just reverse engineer the IPL.
It's just a matter of time to find out what you what :) |
|
| Back to top |
|
|
dridri
Joined: 31 Jul 2009
Posts: 35
|
| Posted: Sat Sep 19, 2009 8:28 am Post subject: |
|
|
I made a program to reverse automatically the IPL.
Anyone want this ? ^^
A little screen :p :
_________________
I'm French, and 15 years old, so my English is not good... |
|
| Back to top |
|
|
serige
Joined: 26 Nov 2007
Posts: 35
|
| Posted: Sat Sep 19, 2009 3:00 pm Post subject: |
|
|
| Quote: | | Anyone want this ? ^^ |
I don't mean to offend you, but I don't really see the point of it. If you would like to share it, then why don't you share it. By the way, people who are dealing with assembly in a regular basis should already have something similar.
Excuse me, I just realized I am talking to a 15-year-old, and that may me feel like I am 50... :'( |
|
| Back to top |
|
|
dridri
Joined: 31 Jul 2009
Posts: 35
|
| Posted: Sat Sep 19, 2009 6:47 pm Post subject: |
|
|
| serige wrote: | | Excuse me, I just realized I am talking to a 15-year-old, and that may me feel like I am 50... :'( |
$
just..... LOL
_________________
I'm French, and 15 years old, so my English is not good... |
|
| Back to top |
|
|
Viper8896
Joined: 26 Jan 2006
Posts: 110
|
| Posted: Mon Sep 21, 2009 10:18 am Post subject: |
|
|
| There is really a lack of sharing and openness in the psp dev community. It has been a real bitch since the beginning. No one is interested in any childish competition. Wiki any info you have. Put all your source in a public repo. For the sake of the community. |
|
| Back to top |
|
|
dridri
Joined: 31 Jul 2009
Posts: 35
|
| Posted: Mon Sep 21, 2009 3:24 pm Post subject: |
|
|
Yes, when I finish this work I share it on the net.
_________________
I'm French, and 15 years old, so my English is not good... |
|
| Back to top |
|
|
ab5000
Joined: 06 May 2008
Posts: 74
|
| Posted: Mon Sep 21, 2009 11:46 pm Post subject: |
|
|
Just a thing: lui load upper 16bits. correct your program ;)
_________________
| Code: | %:include<stdio.h>
int _(int __,int ___,int ____,int _____)
<%for(;____<___;_____=_____*__,____++);
return _____;%>main()<%printf
("%d\n",_(2,5,0,1));%> |
|
|
| Back to top |
|
|
Wally
Joined: 26 Sep 2005
Posts: 672
|
| Posted: Tue Sep 22, 2009 9:09 am Post subject: |
|
|
| Viper8896 wrote: | | There is really a lack of sharing and openness in the psp dev community. It has been a real bitch since the beginning. No one is interested in any childish competition. Wiki any info you have. Put all your source in a public repo. For the sake of the community. |
+1
Seriously, the PSP deserves to be as open as we can make it. Bringing more devs to the scene would be nice. Sony aren't going to help. |
|
| Back to top |
|
|
dark_hex
Joined: 02 Dec 2009
Posts: 18
|
| Posted: Thu Dec 03, 2009 9:36 am Post subject: |
|
|
| Someone can give me the 6.20 ipl ou the 6.10. |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
Powered by phpBB © 2001, 2005 phpBB Group
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
