Dumping Bootldr

From PS3 Developer wiki
Jump to: navigation, search

Requirements[edit]

  • OtherOS++ with SS Patches
  • Linux Kernel with glevand's/graf's patches (red ribbon rc6 will do the trick, since it has the embedded kernel)
  • [the exploit] / [version ports]
  • NOR console with a NOR dump (the exploit isn't adapted to NAND consoles yet, no MMIO available)

How to[edit]

  1. Start a normal session from red ribbon (or any other distro you might have)
  2. Extract the contents of bootldrexploit to your home folder
  3. Open your terminal and type as root:
  4. Type This
    cd bootldrexploit/ps3peekpoke
  5. Compile the lv1 peek poke kernel module:
  6. Type This
    make
  7. Insert the lv1 peek poke kernel module:
  8. Type This
    insmod ps3peekpoke.ko
  9. Change directory to the exploit dir
  10. Type This
    cd ../btldr8
  11. Compile the exploit
  12. Type This
    make
  13. Make a nor dump by typing
  14. Type This
    dd if=/dev/ps3nflasha of=nor.bin bs=1024
  15. Execute the exploit
  16. Type This
    ./lv0Decrypt 0 nor.bin buffer.bin
  17. It should show the status as status A0082. This means you've succeeded. check your dump for the keys.
  18. Type This
    hexdump -C dump.bin > test
    Type This
    nano test

Notes[edit]

  • for the latest version of red ribbon, don't forget to also change dir to /usr/src/[your linux headers folder]/ and type make modules_prepare