PS3 3.60 Keys Leaked

Published on 08-01-2012 05:18 AM

343 Comments

First it seemed as if it was just a rumor or perhaps fake. But euss has confirmed that they are indeed real. The day I'm sure all of you have been waiting for. The release of some PlayStation 3 keys (lv1ldr, lv2ldr, isoldr, appldr) have been leaked to the masses allowing you to patch 65 additional games. You will need a few tools in order to patch the SFO of your games. Or not. Word is Rogero says a new custom firmware will be made available. So those of you who don't want to decrypt and encrypt files should just wait a little longer.

eussNL Comments:

If you post keys in a random topic, you will fast enough be
marked as a troll. When posting keys, please do it in proper
format, so it can be easily debunked/proven

greetz, eussNL

KaKaRoTo Comments:

3.60 keys Update:

Q: recently 3.60 keys surfaced (lv1ldr, lv2ldr, isoldr, appldr), what does this mean for this release and the future?
A: That is actually a multiparted answer:

Now that several binairies (Iso module + CoreOS minus the loaders that are inside lv0) can be decrypted, more investigation can be done in them, which give a new boost in (unrelated to the HeN) other targets, like:

Hardwareless downgrades : Downgrading with PSgrade Dongle (lv1.self)
QA Flagging / systemtokens (spu_token_processor.self) and usertokens (spu_utoken_processor.self)
PS2 compatibility (mc_iso_spu_module.self , me_iso_for_ps2emu.self , sv_iso_for_ps2emu.self)
Getting per_console_root_key_1 / EID_root_key on 3.56+/slim3K (lv1.self , aim_spu_module.self)
Backsigning applications for <=3.55 and patch sys_proc_param_version (appldr.self , lv2_kernel.self)

Q: So does this mean a future release would be sooner?
A: Only God knows

But it can also be that because of the above, it would become meaningless/surpassed by better progress. So lets all hope for the best

I will be adding to this article as I learn more. Just wanted to rush this news to you asap.

UPDATE: Use Deank's EBOOT Fix Tool 0.5 to convert the EBOOTS for you. Just download the keys add them to EBOOT Fix Tool's ps3 folder. (Download below includes the keys, so no need to download them unless using other methods)

Originally Posted by deank

They also posted my ebootFIX/ebootMOD tools prepackaged with the keys in .ps3 folder, so it is ready to be used like in the old 3.41/3.55 days.

Have in mind that some games (like Sniper Ghost Warrior) have additional .self/.sprx files and it is better to use ebootFIX by dragging the PS3_GAME folder to it - it will find and fix all necessary files. If you use ebootMOD you'll have to search for these files yourself and 'fix' them one by one.

UPDATE 2: Another Method

Use SCETool to Decrypt a PS3 3.60 EBOOT.BIN File:
For those of you who want to decrypt a 3.60 EBOOT.BIN use scetool. Download scetool_0.2.7.zip unzip it to C:\scetool. Create a new folder inside scetool and name it data and download these files here:

keys: ps3devwiki.com/files/devtools/scetool/data/keys
ldr_curves: ps3devwiki.com/files/devtools/scetool/data/ldr_curves
vsh_curves: ps3devwiki.com/files/devtools/scetool/data/vsh_curves

Put them inside data folder. Put your EBOOT.BIN file in scetool folder. Go to start - run - cmd and cd to the folder were scetool is. For example "cd C:\scetool". Then type this command to decrypt the EBOOT.BIN: "scetool -d EBOOT.BIN EBOOT.ELF" and use this one to encrypt it to 3.41: C:\scetool>scetool -0=SELF -5=APP -6=0003004100000000 -e EBOOT.elf EBOOT.BIN

Download: Deank's EBOOT Fix Tool 0.5 - UPDATED LINK

Source: elotrolado via ps3crunch via ps3devwiki via ps3news

Thanks to deeptrap for the awesome news tip!

PSX-SCENE: The Pinnacle Scene Xenocracy

● Latest News ● Report News ● Search Forums ● Hall of Fame ●
● Facebook.com/PSXScene ● RSS ● Twitter.com/psx_scene ●

Share
- Share this post on
- Digg
- Del.icio.us
- Technorati
- Twitter

RUT Dark Ronin, SkyNet, bourat and 5 others like this.

Categories:

_{Tags :

euss,

kakaroto,

ps3,

ps3 3.60 keys,

ps3 custom firmware,

ps3 hacks,

ps3 keays,

ps3 keys leaked,

rogero}

343 Comments

oakhead69 - 08-08-2012, 11:41 AM
- Reply
Originally Posted by Elissa

I'll have a look inside your patch file and try to do the things in it manually then since a update I want to try has a self file in it.

Easiest thing to do is to put a pause command in the script file just before it repackages the output. Just before the line

rem Create the new pkg

then use this script to re-encrypt the self file. Just put the below commands in a .bat file in the same directory as the others and the self in the same directory and drag and drop. Copy the self back to the output dir and unpause the original script. Should work.

%~d0
cd %~p0

IF "%1"=="" (set filename=EBOOT.BIN) ELSE (set filename=%1)
echo fn is %filename%

FOR /F "tokens=*" %%A IN ('scetool -i %filename% ^| find "ContentID"') DO SET contentID=%%A
set contentID=%contentID:~13%
echo contentID is "%contentID%"
pause
scetool --decrypt %filename% %filename%.ELF
del %filename%
scetool.exe --sce-type=SELF --compress-data=FALSE --skip-sections=TRUE --key-revision=0001 --self-auth-id=1010000001000003 --self-vendor-id=01000002 --self-type=NPDRM --self-fw-version=0003004000000000 --np-license-type=FREE --np-content-id=%contentID% --np-app-type=EXEC --np-real-fname=%filename% --encrypt %filename%.ELF %filename%
del /Q %filename%.ELF
scetool -i %filename% > %filename%.txt
scetool -i %filename% | find "ContentID"
:eof
pause

Elissa - 08-08-2012, 12:02 PM
- Reply
I'm getting an error right at the beginning but I have all the right files and keys. Here is the error but edited since this forum keeps thinking it is a link:

!!ERROR!! PackageVersion is required. 00.00 is not allowed.
Configuration file should include ContentID
Configuration file should include Klicensee.

Configuration file parse error: "C Users Evelyn Desktop Package Decrypter EP1003 BLES01377 00 RAGEDAYONEPATCH1 A0101 V0100-PE pkg"
gameid is ""
C Users Evelyn Desktop Package Decrypter
Could not find PARAM SFO in C Users Evelyn Desktop Package Decrypter

oakhead69 - 08-08-2012, 12:48 PM
- Reply
Originally Posted by Elissa

I'm getting an error right at the beginning but I have all the right files and keys. Here is the error but edited since this forum keeps thinking it is a link:

!!ERROR!! PackageVersion is required. 00.00 is not allowed.
Configuration file should include ContentID
Configuration file should include Klicensee.

Configuration file parse error: "C Users Evelyn Desktop Package Decrypter EP1003 BLES01377 00 RAGEDAYONEPATCH1 A0101 V0100-PE pkg"
gameid is ""
C Users Evelyn Desktop Package Decrypter
Could not find PARAM SFO in C Users Evelyn Desktop Package Decrypter

I see why, sorry forgot to deal with space in path names. I will fix the script and re-upload. Meanwhile just put all in a directory off root with no spaces.

Elissa - 08-08-2012, 01:26 PM
- Reply
Originally Posted by oakhead69

I see why, sorry forgot to deal with space in path names. I will fix the script and re-upload. Meanwhile just put all in a directory off root with no spaces.

That works now thanks but when I try to path the .self with the script you posted the .self file just disappears entirely. A txt file appears which says it couldn't load the .self file.

oakhead69 - 08-08-2012, 01:52 PM
- Reply
try
scetool -i ????.self > ????.txt

look at the txt file and it will probable have this at the start

scetool 0.2.8 <public build> (C) 2011-2012 by naehrwert
NP local license handling (C) 2012 by flatz
[*] Warning: Could not decrypt header.[*] SCE Header:

It is a self file that scetool can not decrypt the header for.

Sorry I can not fix this I he has not released the source.

Elissa - 08-08-2012, 02:00 PM
- Reply
Originally Posted by oakhead69

try
scetool -i ????.self > ????.txt

look at the txt file and it will probable have this at the start

scetool 0.2.8 <public build> (C) 2011-2012 by naehrwert
NP local license handling (C) 2012 by flatz
[*] Warning: Could not decrypt header.[*] SCE Header:

It is a self file that scetool can not decrypt the header for.

Sorry I can not fix this I he has not released the source.

Mine says nothing about a header. Here is a copy and paste of it:

scetool 0.2.8 <public build> (C) 2011-2012 by naehrwert
NP local license handling (C) 2012 by flatz
[*] Error: Could not load C Users Evelyn Desktop PackageDecrypter patch self

oakhead69 - 08-08-2012, 02:14 PM
- Reply
Space in path. Put all in same directory no spaces.

Elissa - 08-08-2012, 02:16 PM
- Reply
Originally Posted by oakhead69

Space in path. Put all in same directory no spaces.

There is no spaces. I had to change the quote because this forum thinks it was a URL I was trying to post and doesn't let me.

oakhead69 - 08-08-2012, 03:33 PM
- Reply
Sorry the last reply was short, I was out walking and it was from my phone.

Here is a more rugged version of the script the previous one was just one I had lying around that I was using to decrypt self files in BD games.

This now will handle errors better and I think you will find that scetool can not decrypt NPDRM self files. :-(

But please try it on the one you are attempting. BTW what game update is it?

Good luck.

@echo off
%~d0
cd %~p0

IF "%1"=="" (set filename=EBOOT.BIN) ELSE (set filename=%1)
echo fn is %filename%

FOR /F "tokens=*" %%A IN ('scetool -i "%filename%" ^| find "ContentID"') DO SET contentID=%%A
set contentID=%contentID:~13%
echo contentID is "%contentID%"

scetool --decrypt "%filename%" "%filename%.ELF"
IF NOT EXIST "%filename%.ELF" goto decryptFailed
scetool.exe --sce-type=SELF --compress-data=FALSE --skip-sections=TRUE --key-revision=0001 --self-auth-id=1010000001000003

--self-vendor-id=01000002 --self-type=NPDRM --self-fw-version=0003004000000000 --np-license-type=FREE --np-content-id=%contentID%

--np-app-type=EXEC --np-real-fname=%filename% --encrypt "%filename%.ELF" "fixed-%filename%"
del /Q "%filename%.ELF"
scetool -i "fixed-%filename%" > "fixed-%filename%.txt"
goto eof
:decryptFailed
echo Decrypt failed look in %filename%.txt
scetool -i "%filename%" > "%filename%.txt"
:eof
pause

Elissa - 08-08-2012, 04:06 PM
- Reply
Oh hold on, the script you posted which does the entire package right? You know the part where another window pops up and says it is decrypting the eboot? Straight after the eboot it says it is decrypting the self file

Edit.. Yeah doesn't work I guess it doesn't actually encrypt the self file even though it says it does. Also I tried the new script you posted and it now gives the error about the header. It is a shame I am trying the update for the game "Rage".

oakhead69 - 08-08-2012, 04:47 PM
- Reply
Updated the Re-encrypt script, it now handles spaces in the path and I have improver the final package naming.
Original package name is now not changed and the created package is the same a the original with a '-3.4' on the end.

oakhead69 - 08-10-2012, 08:09 AM
- Reply
Turns out the decrypting of self and sprx files (or failure there of) is not a bug or lack of feature in scetool. It can already do it.

The self is encrypted with a klicense key, which when the eboot.bin loads the self it decrypts it. So the klicense key is in the eboot.bin. So once the eboot.bin is decrypted to the eboot.elf we can brute force search for the klicense key.

We then give this to scetool like this: (example is BCES00938 SOCOM: Special Forces)

scetool -l 08727df80102030431c855b900000101 -d s4_g.self s4_g.elf

It will then decrypt it.

Other example I brute forced is
Portal 2 19089cbaf948487f9530832bf477b369

This is as far as I have got so far, we then need to re-encrypt it and put it back in the package file. Just like we do with the EBOOT.BIN.

Just thought I would share where I am up to.

@Elissa I am trying to brute force Rage as we speak to get the klicense.

EDIT:

@Elissa

offset 0x1978b20 into boot.elf for Rage (BLES01377)

you find the klicense key:
58a4badb96035258c54dde01f210cbdd

So to decrypt patch.elf in Rage use

scetool -l 58a4badb96035258c54dde01f210cbdd -d patch.self patch.elf

Good luck.

EDIT2:

Also remember when you re-encrypt the elf to self/sprx you need to include the -l 58a4badb96035258c54dde01f210cbdd.

aienma - 08-11-2012, 11:03 PM
- Reply
does this mean i can patch a 3.60 game on my own?

makail100 - 08-12-2012, 05:09 AM
- Reply
god bless us, with CFW?

Matsumot0 - 08-12-2012, 08:00 PM
- Reply
oakhead69 Thank you so much for this such information, i make a pkg for the lasted patch of Black Ops 1.13 for 3.55

but i have a problem, multiplayer side doesn't work... i have a blackscreen and i don't know why!...
Solo and Zombie seems to work without bugs. I've tested uncompressed selfs too... doesn't working :x
I don't know what to do else.

Klicense BLES01031 Blackops Patch 1.13: AF0A8F0A8909F09234091AFADF909AF0
i can send the pkg in PM if you want inspect my work, i can't post link i'm new member...

Tested on cfw 3.55 TB v2
Thanks in advance

PS: Sorry for my bad english

YoYoBalls - 08-12-2012, 08:38 PM
- Reply
Originally Posted by oakhead69

Other example I brute forced is
Portal 2 19089cbaf948487f9530832bf477b369

This is as far as I have got so far, we then need to re-encrypt it and put it back in the package file. Just like we do with the EBOOT.BIN.

Could this then be my problem I at having in this thread with portal 2??? - http://psx-scene.com/forums/f187/portal-2-a-105281/ (Portal 2)

The fixed has several sprx files that need replaced as well as the EBOOT. (this was odd to me at first but I read some games do need sprx files pacthed/replaced)

The game locks up at that point because the sprx's that are being loaded at that time are not properly decrypted?

BahumatLord - 08-12-2012, 08:41 PM
- Reply
@YoYouBalls - yes that's exactly it

@oakhead69 - Would you mind sharing the script you're using to brute-force the klicense? I get what you're saying but I don't want to get into doing a base-16 number generator if you've already got a working method

YoYoBalls - 08-12-2012, 08:45 PM
- Reply
@BahumatLord

Ok cool thanks for the speedy reply - glad I figured it out.

BahumatLord - 08-12-2012, 08:59 PM
- Reply
I'm about to check out the PSFR33 patch that was talked about on that thread. Give me a minute and I'll let you know if it works

Edit: I tried it with my TB patched copy and I get a spinning yellow warning sign. I'm going to try to redump the game clean and try again. I've never seen that warning logo. It's not a Sony one, so they might be junk patches