Sony PS3 hacker
Mathieulh published a PlayStation 3 and PSP Communication Processors Exploit today for other developers to examine followed by the Despertar Del Cementario and M33 source code (under GPLv3) for the M33 10th anniversary.
Download:
Despertar Del Cementerio GIT /
3.90 M33 GIT
Sound interesting? Check out the PS3 and PSP Communication Processors Exploit details below!
Communication Processor
Hardware
- CXD9790GG (I/O)
- TCP-510 (Board ID on the DEH models such as DEH-R1040)
- TCP-520 (Board ID on the DECR-1000)
(TCP-510 matches the TMU-510 motherboard, while TCP-520 matches the TMU-520 motherboard) The PSP DTP-T1000 unit also sports a communication processor but it does not come as a separate board, the hardware is integrated/soldered directly to the motherboard, unlike the PS3 CP, it does not run the firmware from RAM (the PS3 CP copies the firmware from ROM to RAM at boot so changes are, by default not persistent) and therefore writes files directly to flash.
CEB units feature a PCI slot capable of harboring a CP daughterboard (Sony used such setups as System Debuggers before DEH units came along), CP boards switched to a proprietary interface and shipped to 3rd parties starting with DEH-Rx
Software
De/Encrypt Communication Processor updates
This is how to decrypt/encrypt Playstation 3 Reference Tool Communication Processor updates. (use this knowledge wisely)
This was achieved by exploiting the communication processor firmware and gaining root privileges on the running Montavista Linux. The key for the CP update packages is located within the toolupdatedec binary located at /usr/local/sony/bin/toolupdatedec
The update packages are just tar.gz packages encrypted using AES256CBC Here is the syntax to decrypt them :
The first 16 bytes of the package is the IV, the Second 16 bytes is the hash of the decrypted package.
So use this Syntax after skipping the...