ps3hax那篇重点以外的东西太多，PS3DevWiki上有比较详细的解释 http://ps3devwiki.com/index.php?title=Per_Console_Keys per_console_root_key_0 绝对管理员金钥 0 〔所谓绝对是指世界上就只有这麽一把，不会有第二把相同的金钥了，跟绝对座 标的绝对意义相同〕 metldr is decrypted with this key metldr靠这把金钥解密 bootldr is decrypted with this key bootldr 靠这把金钥解密〔是故，取得此一金钥即可改写bootloader，如果 bootloader不是烧死在唯读记忆体中的话〕 might be obtained with per_console_root_key_1? (largely speculative, not nec. true - need more looked into, only based on the behavior of the other derivatives known to be obtained through AES) 或许可以藉由绝对管理员金钥 1号回推？（有很大的猜测成份，证据不足还 需再要深入研究，猜测的基础是 AES加密演算法的运作原理） per_console_root_key_1/EID_root_key 绝对管理员金钥 1／ EID管理员金钥 derived from per_console_key_0 源自绝对管理员金钥 0号 stored inside metldr 储存在metldr里头 copied to sector 0 by metldr 稍後被metldr复制到第 0区间〔虽然sector也有磁区的意思，但此处应该不 是〕 cleared by isoldr 接着被isoldr清除 Used to decrypt part of the EID 可用来解密部份的 EID资讯 Used to derive further keys (per_console_key_0 is not the key which will be derived, but is the key which has derived per_console_key_1) 可用来计算其他的金钥（除了绝对管理员金钥 0号之外，因为金钥 1号是由 0号导出的） can be obtained with a modified isoldr that dumps it 可藉由修改isoldr取得 can be obtained with a derivation of this key going backwards 也可自由它导出的金钥来回推〔理论上可以这麽做，但不实际〕 Obtaining It 该如何取得 Launch the patched isoldr with your prefered method, let it be Option 1, or Option 2... 要载入修改过的isoldr总共有两种方式，随你喜欢，以下稍做解释： Option 1 - Dumper Kernel Module 方法一：在 Linux核心上附加读取模组 modify glevands spp_verifier_direct to dump the mbox to wherever_you_want and then (use the payload below as an example) 将glevands的spp_verifier_direct 挂载成为核心模组（底下使用酬载的方 式原理相同） the example code on how to dump the mbox can be found on 'Option 2 -Dumper Payload' below 范例程式码可自底下Dumper Payload的部份取得 host $ insmod ./spp_verifier_direct.ko host $ cat metldr > /proc/spp_verifier_direct/metldr host $ cat dump_eid_root_key.self > /proc/spp_verifier_direct/isoldr host $ echo 1 > /proc/spp_verifier_direct/run host $ cat /proc/spp_verifier_direct/debug host $ cat /proc/spp_verifier_direct/wherever_you_want Option 2 - Dumper Payload 方法二：直接送入酬载 http://pastie.org/pastes/2101977 patched isoldr to dump it 以上方法皆须搭配修改过的isoldr使用 *DO NOT CREATE AN MFW USING THIS IT WOULD BRICK PS3 警告：请勿将此档包入自制韧体中，否则会变砖 patched isoldr: http://www.multiupload.com/2MP5KY28EZ this can be loaded as the payload stage2 in the payload marcan used to load linux 可利用marcan的方式在stage2载入酬载 http://marcansoft.com/blog/2010/10/asbestos-running-linux-as-gameos/ http://git.marcansoft.com/?p=asbestos.git this can also be loaded as with lv2patcher and payloader3 亦可透过lv2patcher与payloader3送入酬载〔推荐之，简单很多〕 Comments What this selfs do is dump your ISOLATED SPU LS through your mbox, so you only need a way to cach this info with PPU code in lv2 enviroment aka a dongle payload or linux kernel. 这个self程式的功能是把 SPU里头的东西读出来，稍後可以透过能在 lv2 上执行的程式，例如 Linux和新货是电子狗酬载来读取。 This has been tested and proven to work on 3.55 MFW. 此一原理已於3.55-MFW上测试成功 In the dump the remaining dump is the metldr clear code. metldr clears itself and all the registers an jumps to isoldr. 现在还差临门一脚的是metldr的程式，因为metldr会把自己删除，同时把暂 存器清空，然後跳到isoldr Overwritting that code lets you dump your key + metldr. 修改这些程式就能得到金钥跟metldr程式 Consider that per_console_key_1 and per_console_key_n are in fact still in need decryption. 必须考虑绝对金钥 0与绝对金钥 1取出时仍然是加密的状态 per_console_key_0 particularly needs to be dumped once revived from per_console_key_1. 绝对金钥 0在金钥 1生成的时候就要读出，是唯一机会。 per_console_root_key_2/EID0_key 绝对管理员金钥 2／ EID金钥 this key can be obtained through AES from EID_root_key 可利用 AES演算法配合 EID管理员金钥导出 EID can be partially decrypted by setting this key in anergistics and fireing aim_spu_module.self 利用本金钥搭配aim_spu_module.self 模组可以解出部份的 EID内容 Load aim_spu_module.self + EID0 + EID0_key in anegistics = decrypted EID0 This code is to decrypt your EID0 on your PC http://pastie.org/2000330 解码用的范例程式 The prerequisites are: 前置作业： dump your EID0 from your ps3 and save it in the same folder as EID0 将EID0自主机读出，并存放在电脑上某个目录 dump your EID0_key from your ps3 and put it on the code above where the key is needed 将EID0金钥读出，并放在程式码所指定的目录中 load all of them in anergistic 全部塞入anergistic程式中 EID0_key could also be obtained with EID_root_key directly in the following manners: EID0金钥可与 EID管理员金钥用以下方法同时取得： knowing the algorithm (located in isoldr) and applying it to the EID_root_key 知道演算法（存在isoldr中）与 EID管理员金钥，用电脑解码 leting isoldr apply that algorithm directly in anergistic the process is exactly as the one above (modifing anergistic to feed isoldr with EID_root_key 交给isoldr来办，修改anergistic程式，让isoldr解出後直接吐出金钥 Obtaining It 该如何取得 patched aim_spu_module to dump it 利用修改过的aim_spu_module读出 *DO NOT CREATE AN MFW USING THIS IT WOULD BRICK 警告：请勿将此一档案包入自制韧体中，否则会变砖 http://www.multiupload.com/1XUOOYS9I0 per_console_root_key_n 绝对管理员金钥第 n These are further derivations of the per_console_key_1/EID_root_key 由绝对管理员金钥 1／ EID管理员金钥导出 ****** 就等吧，现在这些工具还不大好用，圣诞节前应该会有新消息，拿到rootkey 後 SONY不推新主机，最坏的情况就只能退守 PSN防线。 -- ○ ____ _ _ _ _ ____ _ _ ____ _____ ____ 。 ★(_ _)( \( )( \/ )( ___)( \( )(_ _)( _ )( _ \ ｏ _)(_ ) ( \ / )__) ) ( )( )(_)( ) / ● ‧ (____)(_)\_) \/ (____)(_)\_) (__) (_____)(_)\_) ★ ｏ --

※ 发信站: 批踢踢实业坊(ptt.cc) ◆ From: 140.120.31.137