Per Console Keys

From PS3 Developer wiki
Revision as of 15:55, 26 October 2011 by FiniteElement (talk | contribs)
Jump to navigation Jump to search

per_console_root_key_0

  • metldr is decrypted with this key
  • bootldr is decrypted with this key
  • might be obtained with per_console_root_key_1?

per_console_root_key_1 / EID_root_key

  • derived from per_console_key_0
  • stored inside metldr
  • copied to sector 0 by metldr
  • cleared by isoldr
  • Used to decrypt part of the EID
  • Used to derive further keys
  • can be obtained with a modifyed isoldr that dumps it
  • can be obtained with a derivation of this key going backwards

obtaining it

launch the patched isoldr with your prefered method

Option 1 - modified kernel module

modify glevands spp_verifier_direct to dump the mbox to wherever_you_want and then (use the payload below as an example)

insmod ./spp_verifier_direct.ko
cat metldr > /proc/spp_verifier_direct/metldr
cat isoldr_PATCHED > /proc/spp_verifier_direct/isoldr
echo 1 > /proc/spp_verifier_direct/run
cat /proc/spp_verifier_direct/debug
cat /proc/spp_verifier_direct/wherever_you_want

Option 2 - dumper payload

per_console_root_key_2 / EID0_key

  • this key can be obtained through AES from EID_root_key
  • EID can be partially decrypted by setting this key in anergistics and fireing aim_spu_module.self
  • Load aim_spu_module.self + EID0 + EID0_key in anegistics = decrypted EID0
  • http://pastie.org/2000330


obtaining it


per_console_root_key_n

these are further derivations of the per_console_key_1/EID_root_key