Talk:Graf's PSGroove Payload: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
mNo edit summary
mNo edit summary
Line 1: Line 1:
----
=QA-Flag Token Combo=
==HowTo==
===Install Linux===
===Install BootOS===
===LV2===
===How to dump the Dummy Token===
===Decrypt the Token and Edit it===
===How to make a Real Token===
===How to install the Real Token===
===Combo===
----
==old scratchpad==
==old scratchpad==
''(marked for deletion after above text is filled in)''
<pre>
<pre>
<Slynk> Hmm had a thought : / You know how the token and token seed are made at the same time? That means the token seed isn't passed into the processor... what is? It can't be just your idps right? Unless sony doesn't use the HV to make their tokens. There must be other info passed in that determines whether you receive a dummy token or the full one. ... Just a thought. ^^;
<Slynk> Hmm had a thought : / You know how the token and token seed are made at the same time? That means the token seed isn't passed into the processor... what is? It can't be just your idps right? Unless sony doesn't use the HV to make their tokens. There must be other info passed in that determines whether you receive a dummy token or the full one. ... Just a thought. ^^;
Line 31: Line 14:
*updater manager calls spu_token_processor
*updater manager calls spu_token_processor
*sent out of spu_token_processor
*sent out of spu_token_processor
*IBM Cell Simulator with SE Linux (not the ancient Sony SPU Simulator from old pre 0.9x SDKs)
*IBM Cell Simulator (not the ancient Sony SPU Simulator from old pre 0.9x SDKs)
*seed : 80 bytes, only the first 20 are populated
*seed : 80 bytes, only the first 20 are populated


Line 55: Line 38:


----
----
''marked for deletion when all info is on [[QA_Flagging]] including the creation of a valid token and the correct button combo''

Revision as of 14:59, 30 May 2011

old scratchpad

<Slynk> Hmm had a thought : / You know how the token and token seed are made at the same time? That means the token seed isn't passed into the processor... what is? It can't be just your idps right? Unless sony doesn't use the HV to make their tokens. There must be other info passed in that determines whether you receive a dummy token or the full one. ... Just a thought. ^^;

<rms> i can make my own tokens from a nor/nand dump. just like hypervisor

<kevin6548> so what does that mean when a sedd is created it passes something to proccessor . nit the whole seed but a by product of creating it . is that theroy

<rms> seed is calculated from eid which allows token to be calculated. its more of a byproduct/intermediate product. if you do the math, its simple: v+s+f+h=t


  • the seed value is made from your EID (from a NAND/NOR dump, either software with payload, or hardware)
  • updater manager calls spu_token_processor
  • sent out of spu_token_processor
  • IBM Cell Simulator (not the ancient Sony SPU Simulator from old pre 0.9x SDKs)
  • seed : 80 bytes, only the first 20 are populated

there are two algorithms used (one's an alternative of a hashing algorithm / one's a block cipher):

  • HMAC-SHA1
  • AES 256 CBC - Advanced Encryption Standard Cipher-block chaining; fixed block size 128 bit, key size 256 bit - with 4x4 byte matrices
erk: 0x341812376291371C8BC756FFFC611525403F95A8EF9D0C996482EEC216B562ED
iv: 0xE8663A69CD1A5C454A761E728C7C254E
hmac: 0xCC30C4229113DB25733553AFD06E8762B3729D9EFAA6D5F35A6F58BF38FF8B5F58A25BD9C9B50B01D1AB4028676968EAC7F88833B662935D7506A6B5E0F9D97A


  • combo is in vsh
  • combo > 3 < 10 buttons
Goto Network Settings
Hold on L1 and R1
then use the left joystick, and press: down, right, right, down, right, right, down, right, right, down, right, right, start.

^above combo is 13+2 buttons (too long)...


marked for deletion when all info is on QA_Flagging including the creation of a valid token and the correct button combo