Post: Core_OS Files Decrypted (Lv1, Lv2_Kernel, etc.)
Options
03-15-2013, 11:27 PM
#1
Dr. Mayham
Banned
Hello! Today I decrypted the core_os files using keysets! I will display a download link so you can download my work! Hopefully this will do something to the community and get the PS3 Scene rolling! Each file has a ELF header so I decrypted them to .elf files. Some of the files like Lv0 and stuff good not be decrypted but thats ok.
Lv1.self (Header .ELF @ 0x00000090)
Keyset: lv1ldr 0x0000 04.31
Lv2_Kernel.self (Header .ELF @ 0x00000090)
Keyset: lv2ldr 0x0000 04.31
Lv0.elf (No Header
)Keyset: Lv0ldr 0x0001 04.31
Download for Lv0: You must login or register to view this content.
I don't have time to post the rest but later I will!
Download: You must login or register to view this content.
Lv0 Calls & Error:
get_flas
h_format_version
[ERROR]:0x%08x sc_nv_storage %d
[ERROR]:0x%08x sc_nv_storage size %d
[ERROR]:0x%08x get_eeprom_dgbe_ip_gateway %d
[ERROR]:0x%08x get_eeprom_dgbe_ip_netmask %d
[ERROR]:0x%08x get_eeprom_dgbe_ip_address %d
[ERROR]:0x%08x get_eeprom_sata_param %d
[ERROR]:0x%08x get_eeprom_core_os_bank_indicator %d
[ERROR]:0x%08x get_eeprom_cellos_spu_configure %d
[ERROR]:0x%08x get_eeprom_flash_ext_format %d
[ERROR]:0x%08x get_eeprom_cellos_flags %d
[ERROR]:0x%08x get_eeprom_gx_config %d
[ERROR]: 0x%08x get_eeprom_select_dgbe_device %d
[ERROR]: 0x%08x get_eeprom_os_boot_order_flag %d
[ERROR]: 0x%08x get_eeprom_restrict_spu_flag %d
[ERROR]: 0x%08x set_eeprom_restrict_spu_flag %d
[ERROR]: 0x%08x set_release_mode %d
[ERRPR]: sc_version %d
[ERRPR]: get H/W config %d
[WARN]: %s: unknown flash_format_version version %04x, format_version %04x Gno Cok Cyt2 Cyt3 Shr Cyt1
[ERROR]: 0x%08x get_eeprom_select_net_device %d
load_component_from_memory
load_component_from_rom_region
load_component_from_bank
load_component_from_region
%s(%d): allocation failure
size 0x%x, align 0x%x, alloc 0x%x, free 0x%x
flash_format_1_component_loader: unsupported component_id=%d
read_composite_region_header: result %d
read_composite_region_header: read_size %lld
load_components %lld too large
load_components %s too large
eEID
flash_format_1_component_loader: unknown component_id=%d
allocate_io_address
invalidate4_iopt_cache fail %d
iost_addr is not aligned 4KB %08llx
iopt_addr is not aligned 4KB %08llx
%s: allocate_iost_entry fail %d
%s: invalid page_size
%s: ea_addr is not aligned by page_size in byte
%s: invalid ea_size < page size in byte
%s: iopt_entry_num > %d
%s: allocate_iopt_entry fail %d
create_alt_sys_parm
%s: parm_name too long
%s = 0x%llx
%s: alt_sys_parm full be 0 bp_base be 0 ioif0 addr
be 0
ioif1
addr
be 0
nclk
be 0
ref_clk
be 0
spu
faultbm
be 0
tb_clk
mu 1
size
plat
id
sys
load
image
in_rom
sys
rom
addr
[ERROR]: 0x%08x invalid debug_interface was selected
sys
dbgcard
dgbe
sys
dbgcard
dgbe
index
sys
dgbe
ipaddr
sys
dgbe
netmask sys dgbe gateway
spider
gbe0
macaddr 0
sys
platform
mode sys mambo version
n sys syscon protocol_version rsx rdcy %d 4 2 5
sys lv0 version 4859 sys lv0 revision sys lv0 address
sys lv0 size sys flash fmt sys flash ext sys flash boot
sys wake_source sys ac sd sys ac misc sys qaf qafen
sys hw config sys hw config_version sys hw model_emulate
sys cellos flags sys cellos spu configure sys ac m
isc2 sys sata param sys ac product_code sys boot gos
%s%s%s
Boot Loader SE Version 4 2 5
(Build I
4859,49405, Build Date: 2012-09-06_23:38:56)
SDK Version: %s %s
Copyright(C) 2012 Sony Computer Entertainment Inc All Rights Reserved
[ERROR]: 0x%08x unknown lv1 file not found
[ERROR]: 0x%08x %s not found
load lv1 fail
init_device_0 fail
init_device_1 fail
[ERROR]: 0x%08x component_manager::initialize
[ERROR]: 0x%08x component_init
[ERROR]: 0x%08x overwrite_2nd_component %d
[ERROR]: 0x%08x load_2nd_component %d
[ERROR]: 0x%08x get_component %d
[WARRING]: 0x%08x get_component %d
[ERROR]: 0x%08x lv1ldr get fail
[ERROR]:0x%08x allocate is_qa_flag
[ERROR]: 0x%08x allocate get_qa_flag
[WARRING]: 0x%08x get_qa_flag
[ERROR]: 0x%08x allocate trace_level
[ERROR]: 0x%08x Boot CELL OS
[ERROR]: 0x%08xlv1ldr stop with stopcode %d
[ERROR]: 0x%08x lv1ldr stop wo stopcode
[ERROR]: 0x%08x Boot CELL OS : stopcode [%d]
[ERROR]: 0x%08x Boot CELL OS : without stopcode %08x
[ERROR]:0x%08x Boot CELL OS : interrupt handler err [%d]
[ERROR]:0x%08x Boot CELL OS : valid spuid not found
[ERROR]: 0x%08x: allocate io address
[ERROR]: 0x%08x Boot CELL OS (init_load_elf)
[INFO]: eid_0 not found
memory_budget::initialize: addr = 0x%llx, size = 0x%llx
[ERROR]: 0x%08x Debug interface CP initialize fail
[ERROR]: 0x%08x Debug interface CP Ch4 initialize fail
[ERROR]: 0x%08x Debug interface Configuration fail
is_emmcbridge_interrupt_asserted
is_ss2_interrupt_asserted
[ERROR] %s(%d) pio is not contifured
Build Date: 2012-09-06_23:38:32)
[INFO]: BE:1 0,
[INFO]: BE:1 1,
[INFO]: BE:1 2,
[INFO]: BE:2 0,
[INFO]: BE:3 0,
[INFO]: BE:3 1,
[INFO]: BE:3 2,
[INFO]: BE:11S DD1 0,
[INFO]: BE:12S DD1 0,
[INFO]: BE:12S DD2 0,
[INFO]: BE:unknown,
SB
X1 0
SBX1 1
SBX2 0
SBX3 0
SBX3 1
SBX3 2
SB
X1 0
SBX1 1
SB:SX1 0
SB:SX1 1
SB:SX1 2
SB:ZX1 0
SB:ZX1 1
SB:ZX1 2
SB:unknown
[INFO]: SPU enable [%d, %d]1 0
[INFO]: === eXtreme Data Rate Memory Subsystem ===
[INFO]: (Configured Memory Size per single XIO channel: %d MBytes )
[INFO]: XIO channel[0] is available
[INFO]: XIO channel[1] is *NOT* available
[INFO]: ---> Total %d MBytes are now in use
[ERROR]:0x%08x get_eeprom_bootrom_trace_leve fail %d
[ERROR]: 0x%08xInvalid be_ref_clk %08x or ref_div %08llx
[ERROR]: 0x%08xiost/iopt buffer allocate fail
[ERROR]: 0x%08x physical_console::initialize
platform_pwrmgr::reboot
fail platform_pwrmgr::reboot
platform_pwrmgr::shutdown
fail platform_pwrmgr::shutdown
load_component
error : %s size is too large
read_cmpl_msg_ver1
write_init_msg_ver1
send_and_receive_safe
send_and_receive
%s: sc_tc(0x%04x) == sc_rc(0x%04x)
%s: too small payload_size %d, body_len %d
%s: too large payload_len %d
%s: body_len(%04x) != body_len2(%04x)
%s: header checksum %d != %d
%s: payload checksum %d != %d
%s: too large payload_size %d
%s: be_tc(0x%04x) != be_rc(0x%04x)
%s: write_init_msg fail %d
%s: wait_swbint(0) returns unknown value %d
%s: read_cmpl_msg fail %d
%s: skip cmpl err %d, receive_id %d, transaction_id %d, communication_tag %d
%s: read_stat_msg fail %d
%s: write_stat_msg fail %d
%s: read_cmpl_msg unknown id %d
%s: read_cmpl_msg unknown transaction_id %d
%s: read_cmpl_msg unknown communication_tag %d
sc_nv_storage error status %d
ros
asecure_loader
ros0
ros1
[ERROR]: 0x%08x unknown flash format
metldr 2
lv2ldr
appldr
isoldr
parm
txt
lv1ldr
lv1
self
eid0
sdk_version
metldr
lv2ldr 2
appldr 2
isoldr 2
lv1ldr 2
[ERROR]: 0x%08x
systemio_dmac_px::configure fail %d,
[ERROR]: 0x%08x spansion_storage_plain::init fail %d, @ Ç @ +
É `
aÉprogram_write_buffer
program_half_word
unlock_bypass_program
%s: NOR is corrupted, data %04x,
expect %04x, addr %llx, data_num %d
%s: write to buffer was
aborted
data 0x%04x, expect 0x%04x
data verify failed
data: 0x%x
rom address: 0x%x
%s: NOR is corrupted
ERROR: program Halt system due to fatal error (2)
[ERROR]:0x%08x allocate fail sector_work
read_block_condition
read_page
erase_flash
low_level_format
identify
_device
erase_sector
write_sector
idle
read_sector
[ERROR] 0x%08x %s(%d) intr %08x
write
read
[ERROR]%s(%d) get_size %d
[WARN] %s(%d) device_size <= offset
[ERROR] %s(%d) read_sector_poll
[ERROR] %s(%d) erase_sector_poll
[ERROR] %s(%d) write_sector_poll
[ERROR]%s(%d) read_sector_dma
get_device_size
erase_sectors_poll_16
write_sectors_poll_16
read_sectors_dma
read_sectors_poll
[ERROR] 0x%08x %s(%d) start_erase_sector %d, stataus %08x
[ERROR] 0x%08x %s(%d) erase_sector %d, stataus %08x
[ERROR] 0x%08x %s(%d) start_write_sector %d, stataus %08x
[ERROR] 0x%08x %s(%d) write_sector %d, stataus %08x
[ERROR]0x%08x %s(%d) start_read_sector %d, stataus %08x
[ERROR]0x%08x %s(%d) kick_dma %d
[ERROR] 0x%08x %s(%d) get_dma_status %08x
[ERROR] 0x%08x %s(%d) interrupt %08x
[ERROR]0x%08x %s(%d) start_idle %d, stataus %08x
[ERROR] 0x%08x %s(%d) idle %d, stataus %08x
[ERROR] 0x%08x %s(%d) read_sector %d, stataus %08x
[ERROR] %s(%d) identify_device %d
[ERROR] %s(%d) identify_info[0] %04x
0123456789abcdef
0123456789ABCDEF
[WARN]: sc_version nvs fail %d
[ERROR]:nv_storage::write block %d, offset %d, size %d fail %d
[ERROR]: nv_storage::read block %d, offset %d, size %d fail %d get_dma_status
[ERROR]: 0x%08x %s fail %08x
is_ebus_interrupt_asserted
get_dma_status
[ERROR]: 0x%08x %s not configured
[ERROR]: 0x%08x %s err status %08x
ERROR: internal_console allocate memory
ERROR: log_cons_channel init %d
[ERROR]: 0x%08x gbe_work_addr
[ERROR]: 0x%08x gbe_work_size 0x%llx
[ERROR]: 0x%08x pci_mini_driver::set_bus_power fail
[ERROR]: 0x%08x fatal
set_power_status<pci_bus> fail %d
[ERROR]: 0x%08x fatal get_power_status<pci_bus> fail %d
ERROR: phy_console buf
authorize_file
get_file_name
get_file
ERROR: log_cons_ctl buf
ERROR: log_cons_ctl init %d
ERROR: log_cons_data buf
ERROR: log_cons_data init %d
[WARN]: %s(%d) command(%d) == FT_SEND_DATA(%d)
[WARN]: %s(%d) parameter(%d) <= %d
[WARN]: %s(%d) parameter(%d) == src_size(%d)
The following 3 users say thank you to Dr. Mayham for this useful post:
The following user groaned Dr. Mayham for this awful post:
03-16-2013, 09:41 PM
#2
Dr. Mayham
Banned
03-17-2013, 03:15 PM
#3
ELITE xxmcvapourxx
Guest
03-17-2013, 06:40 PM
#4
Dr. Mayham
Banned
Originally posted by xxmcvapourxx
here a tip once you decrypt lv0 you get 6 files appldr,isoldr,lv2 try get the keys off it use ida pro see if you can find it
Its hard to decrypt something that doesnt have a header, and doesnt have a extension
---------- Post added at 12:40 PM ---------- Previous post was at 12:04 PM ----------
Decrypted Lv0, header is elf uploading it as soon as possible!
03-17-2013, 10:57 PM
#5
ELITE xxmcvapourxx
Guest
Originally posted by 00x0
Its hard to decrypt something that doesnt have a header, and doesnt have a extension
---------- Post added at 12:40 PM ---------- Previous post was at 12:04 PM ----------
Decrypted Lv0, header is elf uploading it as soon as possible!
---------- Post added at 12:40 PM ---------- Previous post was at 12:04 PM ----------
Decrypted Lv0, header is elf uploading it as soon as possible!
how is it hard,use scetools,lv0 spliter you get 6 files out of them u only need 3-4 files use scetools check them it be appldr,isoldr,lv2ldr to get the keys its not that simple you got to know reverse engineer and need all the plugins of ida pro for it to load elf files if you look at the chain of trust should be 4 but your only using 3 but where is lv1ldr ? here is something for you to research up 0x800000000000F858 _copy_out trust me you wont find it on ps3devwiki or google
03-18-2013, 12:37 AM
#6
Dr. Mayham
Banned
Originally posted by xxmcvapourxx
how is it hard,use scetools,lv0 spliter you get 6 files out of them u only need 3-4 files use scetools check them it be appldr,isoldr,lv2ldr to get the keys its not that simple you got to know reverse engineer and need all the plugins of ida pro for it to load elf files if you look at the chain of trust should be 4 but your only using 3 but where is lv1ldr ? here is something for you to research up 0x800000000000F858 _copy_out trust me you wont find it on ps3devwiki or google
scetool supports up to 3.60 it doesnt support 4.31
03-18-2013, 09:14 AM
#7
ELITE xxmcvapourxx
Guest
The following user thanked BuC-ShoTz for this useful post:
The following user thanked SonyBlack for this useful post:
03-20-2013, 11:18 PM
#10
Dr. Mayham
Banned
Originally posted by ShoTz
what are you trying to accomplish here?
the important file is lv1ldr, everything else has already been extracted, but so has lv1ldr, courtesy of flatz,
there is no new keys btw, everything already been leaked
the important file is lv1ldr, everything else has already been extracted, but so has lv1ldr, courtesy of flatz,
there is no new keys btw, everything already been leaked
How exactly to you know that there aren't any keys? All the posts that you post are negative.... try positive for once....
Copyright © 2026, NextGenUpdate.
All Rights Reserved.
