I was talking to Choco of NGU on skype about black ops and hacking/modding it. From there I spawned a simple idea that may or may not be complex but seems simple in concept. Granted I am not very deep in the PS3 firmware or its inner-workings, but what I am about to propose to everyone is this.

We all know you can use a mod-chip with the PS3, use a dual-nand type system or any other hardware related hack. I am ALSO aware that people are able to dump the NAND if a PS3 with the proper hardware. So here is my thinking.


Step 1 is DUMP the NAND from a 4.11 PS3 from a hardware level.


Step 2 is alter the image data and replace the SSL Certificate 24/25 like we used to with the Chariles proxy hack with the demo one from Charlies proxy.


Step 3 is write the image data BACK to the nand and boot it up.


Step 4 is set up proxy settings and intercept the connection between the PS3 and PSN and get all that good info.


Step 5 is analyze it to get the passphrase and see what rhey have changed and see if there is any new security to handle.


Step 6 is optionally try to re-program 3.55 in a CFW to implement the new security if there is any.


I will say that I don’t know how complex this would really be but in concept it should not be hard. I hope I at-least gave everyone something to think about and possibly someone a new project


Comments ?

true.. very true.

you still have to realise, the people creating these things are way advanced beyond our capabilities and have been doing this for probably 10-20+ years... But saying we overlooked this without previous knowledge prior to obtaining the key is simply... crazy.

Now possible for mauth/graf/kako... yeah sure.

What you guys DON'T Get is this is HOW you get the pass-phrase. The thing here is why would I want to do this if I am not getting the pass. The PS3 SENDS the code to the auth server along with its firmware version. All we need to do is intercept it.

The pass is in vsh.self i believe via reading. It is in 2 places but only 1 is used. We don't need to decrypt that. We just need to read it as it is sent out. This is assuming there's no CRC checks on the CERT files or anything else un-forseen.

So you get the info, then you take it to 3.55 and your online...

I can't recall at this moment, but there is a tool that allows you to intercept data being sent from the server to the console ( vice versa) , maybe this will be of some help if I or any one can remember the name!