EID crypto is very complicated, it is done so on purpose first of all EID0 isn't decrypted with one key and one
algorithm alone it is decrypted in several parts which use different algos and keys the keys are all derivations
of a per console key (per_console_key_1)which is stored inside metldr and copied by it to sector 0 and never
leaves isolation that same key is a derivation of the per console key (per_console_key_0) used to encrypt metldr
and the bl in the first place as well
isoldr clears that key from sector 0 before jumping to the isolated module but before doing so it encrypts it
with another keyset and stores it in a buffer so that the isolated module can use the new crafted key since the
operation is AES if you know that keyset you can decrypt the crafted key and get the eid root key without pwning
a loader or metldr through an isolated module that is not like you really need it because you can already use the
crafted key to decrypt some of eid0 but not all of it and the crafted key also uses the first elf section to be
built as in your isolated module will have a small section which only contains a key and that key is used as another
layer by isoldr to encrypt the buffer with it so basically you have 2 encryption layer over the root key the final
key then decrypts a specific part of the EID
eid crypto is actually done smart that is because most of it originally comes from the cell bootrom as in they
reuse the same algo used for metldr binaries and bl in the eid crypto including some of the keys and the steps
and you cannot decrypt all of the eid sections unless you gathered every single keys and steps and there are a
lot then you still have to figure out wtf it is you decrypted because eid is actually full of keys
Per Console Keys - PS3 Development Wiki
1.payloader3 aus möglichst neuer quelle erstellen
oder precompiled:
payloader3-341.pkg:
payloader3-315.pkg:
2.Installiere payloader3 pkg auf der ps3
3.export im terminal einstellen
a. export PS3LOAD=tcp:ipaddress.of.ps3
b. start socat (socat udp-recv:18194 stdout)
4. payloader3 pkg auf ps3 starten
5. Es ist ziemlich wahrscheinlich das kein Bild zu sehen ist (black screen) aber man wird einen deutlichen Ton hören (C64 like)
Nun sind verschieden Dinge durchführbar:
a.X dann 4eck startet ps3load mit ethdebug
b.X dann kreis will führt dich zurück ins xmb und lädt ethdebug (für debuging pkg files)
6.Während du den ps3load mode benutzt sende dump_eid_root_key.self an deine ps3 (ps3load dump_eid_root_key.self)
Nun solltest du debug in deinem teminal sehen und im debugging wirst du dann hoffentlich den PCK finden .. (theoretisch
copy&paste by boerse.bz