Naehrwert Releases PS3 Dump Rootkey Code

Published on 07-22-2012 11:40 PM

48 Comments

Following his Quick CoreOS Image Tool then his eEID Cryptography discussion PlayStation 3 developer naehrwert has released PS3 Dump_Rootkey code together with a little "how to" for those of you wanting to get your PS3's eid root key without installing Linux on your PS3.

About dump_rootkey - 2012 by naehrwert:

From the README - How to:

Install asbestos_ldr.g.pkg on your PS3 (a firmware with lv2 peek/poke is required to run it).
Compile the client (make sure PS3HOST in main.cpp points to your PS3).
Make sure you got your metldr in './data' as 'metldr'.
A prebuilt 'dumper' is included in './data' (dumper.elf and build.bat is included too if you want to change parameters).
Start asbestos_ldr on your PS3.
Start the client on your PC.
Unicorns!

From @naehrwert via pastie

Code:

[INFO] Connecting...ok.
[INFO] Ping...ok.
[INFO] VAS ID = 0x000000000000000b
[INFO] map_lpar_memory_region(data): res = 0
[INFO] Copying files out...done.
[INFO] Constructing SPE...done. (res = 0)
[INFO] priv2   0x00004c00016e0000
[INFO] problem 0x00004c00016c0000
[INFO] LS      0x00004c0001680000
[INFO] shadow  0x000030000002e000
[INFO] ID      0x0000000000000002
[INFO] Setting up SPE...done.
[INFO] map_lpar_memory_region(shadow) : res = 0
[INFO] map_lpar_memory_region(problem) : res = 0
[INFO] map_lpar_memory_region(priv2) : res = 0
[INFO] map_lpar_memory_region(ls) : res = 0
[INFO] set_spe_privilege_state_area_1_register: res = 0
[INFO] Starting SPE in isolation mode...done.
[INFO] Interrupt status (2, application) = 0000000000000010
[INFO] -> SPU mailbox threshold interrupt
[INFO] Interrupt status (2, application) = 0000000000000011
[INFO] -> SPU mailbox threshold interrupt
[INFO] -> mailbox interrupt
[INFO] Mailbox value = 1
[INFO] -> Dumper loaded.
[INFO] Transferring eid_root_key to buffer...finished.
[INFO] Dumping eid_root_key...done.
[INFO] SPU status = 0x00000081
[INFO] Destructing spe...done.
[INFO] Press any key to exit...

You will need to compile the client yourself using MS Visual C++ since it needs your PS3's IP address. That is until someone wants to create a EXE that prompts for your IP.

Download: Dump_Rootkey

Source: @naehrwert

PSX-SCENE: The Pinnacle Scene Xenocracy

● Latest News ● Report News ● Search Forums ● Hall of Fame ●
● Facebook.com/PSXScene ● RSS ● Twitter.com/psx_scene ●

Share
- Share this post on
- Digg
- Del.icio.us
- Technorati
- Twitter

RUT Dark Ronin, Nathan_r32_69, digitaloverdose and 2 others like this.

Categories:

_{Tags :

naehrwert,

ps3,

ps3 cex to dex,

ps3 cex2dex,

ps3 cfw,

ps3 dump rootkey,

ps3 eid rootkey,

ps3 hacks}

48 Comments

RUT Dark Ronin - 07-23-2012, 01:09 PM
- Reply
vronz, metldrpwn is not involved, as you can see. This method is completely different. AsbestOS gains you access to almost anything inside PS3, but meanwhile we haven't it to work under 3.55, just for 3.41. Either way, it needs to be ported fully, not just loader.

Tranced - 07-23-2012, 01:13 PM
- Reply
My previous post suggests this ^^ not fully perhaps but a step closer

vronz - 07-23-2012, 01:39 PM
- Reply
if it's working on 3.41 then that's not an issue, because QA flagging 3.55 allows to downgrade to 3.41 and that's quite more easy than installing Linux. however, what still bugs me is that in "metldrpwn" exploit instructions it's said if you have firmware lower than 3.55 you need to update to 3.55, because the exploit is expecting such firmware. so, the whole solution just doesn't add up, i.e. "metldrpwn" exploit works on 3.55 only and Asbestos loader on 3.41 only. so, i'm very confused now. i guess we all are waiting on input from developers.

kAs1m - 07-23-2012, 01:51 PM
- Reply
Originally Posted by vronz

if it's working on 3.41 then that's not an issue, because QA flagging 3.55 allows to downgrade to 3.41 and that's quite more easy than installing Linux. however, what still bugs me is that in "metldrpwn" exploit instructions it's said if you have firmware lower than 3.55 you need to update to 3.55, because the exploit is expecting such firmware. so, the whole solution just doesn't add up, i.e. "metldrpwn" exploit works on 3.55 only and Asbestos loader on 3.41 only. so, i'm very confused now. i guess we all are waiting on input from developers.

It's not metldrpwn, Naehrwert method uses different exploit.

vronz - 07-23-2012, 02:45 PM
- Reply
Originally Posted by kAs1m

It's not metldrpwn, Naehrwert method uses different exploit.

i see, it seems i got it wrong, in any case i'm still waiting for 3rd party confirmations that naehrwert method is working.

Cody Hake - 07-23-2012, 03:41 PM
- Reply
Using Rebug 3.41.3, the asbestos_ldr pkg does not want to install. Gives me 80029564 error. Is Rebug missing a patch I need?

aihooo4444 - 07-23-2012, 04:07 PM
- Reply
Originally Posted by Cody Hake

Using Rebug 3.41.3, the asbestos_ldr pkg does not want to install. Gives me 80029564 error. Is Rebug missing a patch I need?

Same problem if anyone figures this out let me no or do i need to be on a different 3.41 cfw

Cody Hake - 07-23-2012, 04:25 PM
- Reply
I remade the package with a little fiddling into a debug package, it installs now.

Now that the client can see my ps3 ill make my dump and extract metldr to see if i have any errors and report back.

kAs1m - 07-23-2012, 04:31 PM
- Reply
How to check if there is some errors in dump? Is there any way to verify the key?
PS
And what to do next, after i'll get the key? Should i just convert my CEX flash dump to DEX using c2d.exe and decrypted key *.bin?

aihooo4444 - 07-23-2012, 04:59 PM
- Reply
Originally Posted by Cody Hake

I remade the package with a little fiddling into a debug package, it installs now.

Now that the client can see my ps3 ill make my dump and extract metldr to see if i have any errors and report back.

hey can you send it to me my email is aihooo444 at yahoo

Cody Hake - 07-23-2012, 05:14 PM
- Reply
Successfully dumped eid0 using this. CEX 2 DEX by GUNNER54 successfully converted cex dump to dex. prepairing to flash. will write back soon.

Originally Posted by aihooo4444

hey can you send it to me my email is aihooo444 at yahoo

If flashing goes as planned I will repackage it and upload it so anyone having this issue can work around using Linux.

kAs1m - 07-23-2012, 05:37 PM
- Reply
Originally Posted by Cody Hake

Successfully dumped eid0 using this. CEX 2 DEX by GUNNER54 successfully converted cex dump to dex. prepairing to flash. will write back soon.

If flashing goes as planned I will repackage it and upload it so anyone having this issue can work around using Linux.

I hope everything will be fine. Can you share your experience of converting via new method? Maybe you could write some guide, if you will have time?

Cody Hake - 07-23-2012, 05:59 PM
- Reply
All went well, I made another backup using jaicrab to compare to the dex flash made by GUNNER54's program. They match, so writing worked fine.

I will write a small tutorial, that avoids petitboot and linux shortly.

!!!USE AT YOUR OWN RISK. I AM NOT LIABLE FOR ANY BRICKS USING MY PKG!!!

Naehrwert's original PKG: asbestos_ldr g pkg
My PKG: asbestos_ldr pkg

I have sent the link to a mod, as I am not able to post links yet.

aihooo4444 - 07-23-2012, 06:06 PM
- Reply
Originally Posted by Cody Hake

All went well, I made another backup using jaicrab to compare to the dex flash made by GUNNER54's program. They match, so writing worked fine.

I will write a small tutorial, that avoids petitboot and linux shortly.

!!!USE AT YOUR OWN RISK. I AM NOT LIABLE FOR ANY BRICKS USING MY PKG!!!

Naehrwert's original PKG: asbestos_ldr g pkg
My PKG: asbestos_ldr pkg

I have sent the link to a mod, as I am not able to post links yet.

can send one to my email

Cody Hake - 07-23-2012, 06:14 PM
- Reply
I have sent you the rar file which includes the edited package. The tutorial is not done.

Edit: PsDev has the basic lowdown on using this on Page 1 comments. Using the Tutorial that's been posted already for CEX2DEX on NAND and his information should get you going on the right track with a little bit of thought.

aihooo4444 - 07-23-2012, 06:51 PM
- Reply
Originally Posted by Cody Hake

I have sent you the rar file which includes the edited package. The tutorial is not done.

Edit: PsDev has the basic lowdown on using this on Page 1 comments. Using the Tutorial that's been posted already for CEX2DEX on NAND and his information should get you going on the right track with a little bit of thought.

freezing on after connecting to ip ok will not ping

Cody Hake - 07-23-2012, 07:06 PM
- Reply
Using 3.41.3 Rebug?

aihooo4444 - 07-23-2012, 07:18 PM
- Reply
figured it out cant be connected with wireless

Cody Hake - 07-23-2012, 07:19 PM
- Reply
Ah, yea that'll do it. Wired connections only folks.

Freesty - 07-24-2012, 04:07 AM
- Reply
This don`t work for me, or i doing something wrong.
can somebody write step by step what i need to do on PC.
i have connected directly pc with ps3 with cable and have settings on pc:10.1.1.1
and on ps3 10.1.1.2. is this correct?