MathieuLH nous livre quelques explications sur l'obtention des clés 3.60

MathieuLH refait parler de lui en nous expliquant, cette fois-ci, ce qu'il a fait pour obtenir les clés des applications 3.60. C'est sur IRC que toutes ces informations sont tombées. Comme pourrons le comprendre les anglophones ayant des connaissances dans le monde du hack, MathieuLH déclare bel et bien avoir trouvé une faille de type buffer overflow. L'avancée du hack PS3 serait vraiment grande si ces informations s'avéraient être vraies (ce qui a l'air vraisemblablement le cas) et si quelqu'un arrive à les exploiter. Comme diraient nos amis anglais, wait & see...

Voici une partie de sa conversation :

[14:31:11] btw, I saw a quote somewhere that mentions you said something like 'pwning loaders can be done with a single line of code' (yes, that very same site you ranted just now). How true is this?

[14:31:32] X nah, not a single line of code, at least not for the implementation

[14:31:35] but finding the exploit itself

[14:31:37] is EASY

[14:31:46] except no one has gone looking

[14:32:00] I've seen lots of askings and whining, very little looking

[14:32:16] if someone who remotely knows spu reversing starts looking

[14:32:20] he'll find it

[14:32:25] at the very worse in a matter of hours

[14:32:53] the bug is retardly stupid to begin with

[14:33:10] LV0, EID0, anything with coreOS imo should not be done without a hardwareflasher. Atleast with that you can undo the mess.

[14:33:27] yeah

[14:33:34] I am a bit of a red head here

[14:33:36] you keep saying that, but I suck at SPU assembly

[14:34:12] you'd find it even if you fail at it

[14:34:20] you just need to know where to look

[14:34:50] just look at how selfs are processed by ldrs

[14:34:53] and you'll find it

[14:35:54] hell, I'll help you, it's about overflowing a certain buffer

[14:36:40] yes, that is what defyboy and I tried to document in the ps3devwiki : bootprocess and loader locations etc.

[14:37:14] well if you know how selfs are processed by loaders, it's easy

[14:37:18] another hint

[14:37:22] it happens before the ecdsa check

[14:37:27] my earlier guess btw was that it was a header overflow, which gave access to the local storage

[14:37:40] It's a retarded exploit

[14:37:47] if you want to know what it is, I'll tell you

[14:38:01] the function that copies the SCE header from the shared LS to the isolated Local Store

[14:38:05] doesn't check the header's size

[14:38:16] \o/

[14:38:18] it's just THAT retarded

[14:38:37] implementing it isn't easy though

[14:38:44] cause loaders have failsafes and shit

[14:39:07] header size fail

[14:39:09] lol

[14:39:14] ?

[14:39:19] but now that you know, you can try it on your own

[14:39:22] X1 yes

[14:39:29] you craft a self with a HUGE header

[14:39:42] so it overwrites ldr code as it gets copied to the isolated LS

[14:39:51] and you wait the loader to jump to it

[14:39:58] lolol must try heh

[14:40:14] X1 it's a total bitch to implement

[14:40:18] but feel free

[14:40:23]

[14:41:01] there are probably other fails anyway

[14:41:06] I should start looking for more

[14:41:36]

[14:41:53] *Waits for every ps3 news site to post these logs*

[14:42:00] you can never have enough exploits in the backpocket Mathieulh

[14:42:31] X5 yeah, that'll probably happen soon enough

[14:42:49] pssshhhtt... :>

[14:43:14] if someone pwns the bl with this and gets the keys, he'll have my kudos

[14:43:23] cause finding the exploit is the easy part

[14:44:08] Sony'll fix it now, but it's not like I care much

[14:44:18] their "unhackable" ps3s are probably already on the way