Post: [NEWS] Mathieulh Explains The Loader Exploit To Obtain 3.60 Application Keys
Options
04-21-2011, 03:29 PM
#1
MCPADDINGTON
Banned
Mathieulh probably just let the cat out of the bag with his obvious hint to the much talked bug that practically owned future PS3 firmware updates and also the mass growth of warez leechers with the help of 3.60 app keys. Yes, we’re talking about the unstoppable 3.60+ CFWs, you bitch. Provided that Sony won’t release unhackable PS3 consoles in the near future, of course.
Originally posted by another user
X nah, not a single line of code, at least not for the implementation
but finding the exploit itself
is EASY
except no one has gone looking
I’ve seen lots of askings and whining, very little looking xD
if someone who remotely knows spu reversing starts looking
he’ll find it
at the very worse in a matter of hours
the bug is retardly stupid to begin with
LV0, EID0, anything with coreOS imo should not be done without a hardwareflasher. Atleast with that you can undo the mess.
yeah
I am a bit of a red head here xD
you keep saying that, but I suck at SPU assembly
you’d find it even if you fail at it
you just need to know where to look
just look at how selfs are processed by ldrs
and you’ll find it
hell, I’ll help you, it’s about overflowing a certain buffer
yes, that is what defyboy and I tried to document in the ps3devwiki : bootprocess and loader locations etc.
well if you know how selfs are processed by loaders, it’s easy
another hint
it happens before the ecdsa check
my earlier guess btw was that it was a header overflow, which gave access to the local storage
It’s a retarded exploit
if you want to know what it is, I’ll tell you
the function that copies the SCE header from the shared LS to the isolated Local Store
doesn’t check the header’s size
\o/
it’s just THAT retarded
implementing it isn’t easy though
cause loaders have failsafes and shit
header size fail
lol
?
but now that you know, you can try it on your own
X1 yes
you craft a self with a HUGE header
so it overwrites ldr code as it gets copied to the isolated LS
and you wait the loader to jump to it
lolol must try heh
X1 it’s a total bitch to implement
but feel free xD
if someone pwns the bl with this and gets the keys, he’ll have my kudos
cause finding the exploit is the easy part
Sony’ll fix it now, but it’s not like I care much
their “unhackable” ps3s are probably already on the way
but finding the exploit itself
is EASY
except no one has gone looking
I’ve seen lots of askings and whining, very little looking xD
if someone who remotely knows spu reversing starts looking
he’ll find it
at the very worse in a matter of hours
the bug is retardly stupid to begin with
LV0, EID0, anything with coreOS imo should not be done without a hardwareflasher. Atleast with that you can undo the mess.
yeah
I am a bit of a red head here xD
you keep saying that, but I suck at SPU assembly
you’d find it even if you fail at it
you just need to know where to look
just look at how selfs are processed by ldrs
and you’ll find it
hell, I’ll help you, it’s about overflowing a certain buffer
yes, that is what defyboy and I tried to document in the ps3devwiki : bootprocess and loader locations etc.
well if you know how selfs are processed by loaders, it’s easy
another hint
it happens before the ecdsa check
my earlier guess btw was that it was a header overflow, which gave access to the local storage
It’s a retarded exploit
if you want to know what it is, I’ll tell you
the function that copies the SCE header from the shared LS to the isolated Local Store
doesn’t check the header’s size
\o/
it’s just THAT retarded
implementing it isn’t easy though
cause loaders have failsafes and shit
header size fail
lol
?
but now that you know, you can try it on your own
X1 yes
you craft a self with a HUGE header
so it overwrites ldr code as it gets copied to the isolated LS
and you wait the loader to jump to it
lolol must try heh
X1 it’s a total bitch to implement
but feel free xD
if someone pwns the bl with this and gets the keys, he’ll have my kudos
cause finding the exploit is the easy part
Sony’ll fix it now, but it’s not like I care much
their “unhackable” ps3s are probably already on the way
Some of the tidbits explaining how big the exploit is in the eyes of SONY’s M.I.B.
Originally posted by another user
why would they care about bootldr keys?
ps3devnews etc. host metldr keys, appldr keys etc.
X1 cause you can get lv0 decrypted
once you get lv0 decrypted
you get appldr
once you get appldr
you get 3.60 application keys
once you get that
you warez
also, with those keys you can sign your own lv0, no ps3 fw update can beat you then
yah
you can have your 3.60+ custom firmware then
and warez even more
and mess with the psn again
and so on
ps3devnews etc. host metldr keys, appldr keys etc.
X1 cause you can get lv0 decrypted
once you get lv0 decrypted
you get appldr
once you get appldr
you get 3.60 application keys
once you get that
you warez
also, with those keys you can sign your own lv0, no ps3 fw update can beat you then
yah
you can have your 3.60+ custom firmware then
and warez even more
and mess with the psn again
and so on
Before you start bashing out on me, you need to understand that this could help in some way for those who are still trying to pwn the ldrs and eventually sharing the actual hacks in the process. We know how important the keys are to Sony, so expect an anon release in the future. Hopefully, it can be done.
The whole conversation can be read here (thanks to jeffers07): You must login or register to view this content.
You must login or register to view this content.
The following 7 users say thank you to MCPADDINGTON for this useful post:
04-21-2011, 04:13 PM
#12
CodingNation
Banned
Originally posted by dishguy06
Quit bashing Matt you idiots. He is only trying to HELP US by giving the public as many hints as possible on how to create a CFW. Hopefully a dev out there can use this information and create a CFW or a downgrade 
Good on you Matt and thanks and don't mind these 12 year old kids crying and whining about how they "only want to back up their games" LOL yeah right.
Good on you Matt and thanks and don't mind these 12 year old kids crying and whining about how they "only want to back up their games" LOL yeah right.
it was probably the 12 year olds that wanted to backup games that got geohot in court
04-21-2011, 04:31 PM
#15
Pillar2365
I use to give free rep :/
Originally posted by MCPADDINGTON
Mathieulh probably just let the cat out of the bag with his obvious hint to the much talked bug that practically owned future PS3 firmware updates and also the mass growth of warez leechers with the help of 3.60 app keys. Yes, we’re talking about the unstoppable 3.60+ CFWs, you bitch. Provided that Sony won’t release unhackable PS3 consoles in the near future, of course.
Some of the tidbits explaining how big the exploit is in the eyes of SONY’s M.I.B.
Before you start bashing out on me, you need to understand that this could help in some way for those who are still trying to pwn the ldrs and eventually sharing the actual hacks in the process. We know how important the keys are to Sony, so expect an anon release in the future. Hopefully, it can be done.
The whole conversation can be read here (thanks to jeffers07): You must login or register to view this content.
You must login or register to view this content.
Can you link me to the IRC he is in? Thank you.
04-21-2011, 04:39 PM
#16
MCPADDINGTON
Banned
04-21-2011, 04:56 PM
#19
DiJiTaLGoDz
Former Staff
So which one of you is going get sued first? :carling:
Copyright © 2026, NextGenUpdate.
All Rights Reserved.
