CFW 3.60 para muito breve!?
Algumas notícias são muito emocionantes foi revelado hoje pelo Mathieulh. Ele (OFW 3.60) foi recentemente explorado e contornado o LV0 no 3.60 firmware.
No entanto, ao contrário de algumas de suas façanhas do passado, onde ele mantinha os detalhes e muito bem guardados, desta vez ele é bastante sincero sobre como reproduzir o seu método.
Um usuário do Twitter, com o nome de Ps3WeOwnYoU, já afirmou ter reproduzido o truque do Mathieulh. Ele afirma que ele possui actualmente o LV0 decifrado do OFW 3.60 depois de usar o truque. No entanto, as alegações do user Ps3WeOwnYoU ainda não foi comprovada e isso ainda se deve levar isto como rumor. (Só esta parte)
Mathieulh's Tweets:
- Spoiler:
* xShadow125 You can update from your pwn pup only from 3.55 or lower, unless you have an exploit.
* xShadow125 Of course that should be fixed in upcoming lv0 revisions anyway (By moving the ldrs to the top of lv0)
* xShadow125 You run the 3.60 lv0, then you switch the nor, and pull the cell reset line, and you dump the extra KBs where the loaders are.
* xShadow125 Basically you have a nor with 3.55 (or lower) lv0 and your own small lv1 code that does the dump, and 3.60 lv0 on the other.
* xShadow125 You wont get all of lv0 but the part with the loaders shouldn’t be overwritten.
* xShadow125 You can actually get all the 3.60 keys/loaders without knowing lv0 keys by dumping lv0 from ram with dual nor and signed lv1.
* To those planning on building a 3.56+ pup for whatever reason, the files attributes changed, the group and user ids for the files as well.
* The new 3.56+ values for tarballs are the following: owner_id, “0000764″ group_id, “0000764″ owner, “tetsu” group, “tetsu” ustar, “ustar″
* You can use fix_tar to use those new values. Use with caution.
* By comparison, those are the pre-3.56 values. owner_id, “0001752″ group_id, “0001274″ owner, “pup_tool” group, “psnes” ustar, “ustar”
* Ps3WeOwnYoU You need to either decrypt or dump lv0, then you can get the encrypted loaders and decrypt them with the metldr key. Good luck.
So, to decrypt this LV0 thing, we need to get to know it better. In the latest blog post by ..