Following up with their announcement that they will introduce their Achievements in "Vita Hacking" at the #35C3-Congress, both Developers @yifanlu and @DaveeFTW from @TeamMolecule today presented their Talk: "Viva la Vita Vida". And in this Thread, you will learn what they got achieved with their Hacks but also what this means for the Community of "Vita Hacking" in future. And to "spoil" you a little bit, we recommend that you will read this Article while sitting on your chair in case you would come off because of your roar with laughter.
For an overview about the #35C3-Congress in General, or where you can find all Livestreams from this Talk as well from other important ones, please click here.
Did you fall off from your chair? We hope you didn't get hurt.
This is the full Talk you can watch via YouTube but to understand what they got achieved, we will include the most important Slides in a summary.
While previous Achievements in both the "User Processes" (this is the Part about past Projects like "HENkaku" and the "Web-Exploit" in General) and the "System Processes" (which allowed you to use your PSP Backups or Homebrew for example) - but also the "ARM TrustZone" were already successfully "infiltraded" by various Developers - Developer @DaveeFTW explains, how they got achieved to break into both the "F00D Kernel" and "F00D Loader". "F00D" is the "Security Co-Processor" inside the PlayStation Vita. While the "F00D Kernel" contains all the "Content Keys" to protect secure assets such as from Game Titles or System Firmwares, the "F00D Loader" contains the "Meta Keys" which protect the "Content Keys" allowing the System to revoke compromised "Content Keys". And by understanding both the "Hardware Architecture" together with the "Software Design and [it's] Implementation", he describes his method how to examine his "Attacking Surface" to break into the "Security Processor". And by tinkering with the "Private Memory" by checking each "byte by byte", they was able built a Model from the "F00D SRAM" to get a "Plain Text" from the Kernel, as they call it the "Octopus Exploit" (but they please you not to ask why it's called like that ). With this result, they was able to analyse the Kernel more deeper.
While @yifanlu takes the Stage talking about his various "Hardware Achievements", which is better explained at the Video from this Talk as mentioned above, "The Way was Clear" to get access to the "last piece of the puzzle", which was the "F00D-Loader". And with access to that, they was also able to find a Vulnerability to get the "SHA256-Hash from the Bootrom". Dumping the "Bootrom" wasn't so interesting - according to @yifanlu - due to the fact that there are no useful Keys included inside. And the "Attacking Surface" wasn't so huge compared to the "F00D Kernel". But this wasn't so tragic since with this effort, they achieved to get Full Control of the PlayStation Vita by dumping every code inside the whole Console. This sounds already very promising since you have to understand that similar to the PS3-era, when someone gets "Full Access" to a Gaming Device, then the next question would be sooner or later: "What you can actually do with such power?" Well, this Thread here can't promise you anything but the chances are high that we can see not only a newer full "Kernel Exploit" for newer System Firmwares above >3.60 or >3.65, but it should give other Developers a easier platform to create newer Homebrew Releases or even a full-fledged Custom Firmware. How you ask? Just take the PS4 as an example, where a "Full Access" is still not provided (by the Time of writing this Article) but even with less Achievements, the side-effect is still sadly Piracy and creating Homebrew is more difficult compared to play your Backups. The PlayStation Vita has a few more Homebrew Releases but the Limitations where still there for many tasks. This could change now but we aren't finished yet with this Article. Now we are getting to the fun part.
Remember the Talk from fail0verflow regarding the PS3 back at #27C3 eight years ago, where they showed the world how "unsecured" the PS3 was at the end with such an cryptographic "Epic Fail" by choosing a "supposed to be random number" the same everytime for signing their SELF-Executables? Sure you remember. And while @yifanlu sums up their Conclusions to both how good the Team from Sony secured this System after such a fiasco with the PS3 while it wasn't such a success for them regarding the Sales of the PlayStation Vita (he even mentioned many things Sony did right with the PSVita, which they didn't for the PS4), he explains that: "Not everyone is Perfect" - while a big "BUT..." is displayed in one of his slides. He admits that: "there is a slight issue in their choice of [the] bootloader encryption key", while he adds the important Tasks of such a key, namely to protect "every other key in[side] the system." So you could see this as a "Master Key." Further on he explains that after they dumped the "Bootrom", they tried to find such a "Master Key" and while the audience is already chuckling as he moves forward to his next Slide, he explains that Sony decided to fill up their "Master Key" with a single byte repeating all the time. Yes you read it right. And by hinting this byte with the Packshot from a Battery-Package including 16x AA-Batteries, he wants to inform you that this "Master Key" is as follows: AA AA AA AA AA AA AA AA - or 0xAA in "Hexadecimal". Yes, this isn't a typo and you are probably speechless like the Audience was (one Question after the Talk was indeed if "this was a Joke!?!?" ). @yifanlu also explains how they was surprised with such a Cryptographic Failure Sony did again since they thought this was just the Code from a Debug Non-Retail Device after they brute-forced this at first but then they realized that this was the "Real Deal" which means that both every PlayStation Vita and PlayStation TV (yes this works for the "PSTV" as well, as asked by one of the Audience's Question) which got sold shares this simple "Master Key". Is there something more to say?
Here you will find several Releases based on the Achievements showed at this Great Talk.
Several "F00D Keys" released by @Mathieulh on "HENkaku Development Wiki"
Developer @theflow0 teases a new "hack" for System Firmware 3.69 in 2019
Developer @pomfpomfpomf3 (from @TeamMolecule) published their "MeP Emulator" together with a "Compiler", which was also mentioned inside the Presentation giving support for "remote debugging"
Developer @DaveeFTW wrote a whole blog post about their Talk at #35C3 with additional details where he didn't have the time to talk about.
We hope that you enjoyed our coverage from this second important Talk at 35C3. Feel free to discuss your opinions about today's Talk in the Comments Section down below. Unlike yesterday's Talk, we are pretty sure here that the PSVita will see very bright days in the near future.
The whole Talk can be found here: media.ccc.de
Twitter: @yifanlu / Twitter: @DaveeFTW / Twitter @TeamMolecule
Bootrom glitching scripts + various SCE decryption units: @GitHub
PS VITA / PS TV Huge Vita News from #35C3- @yifanlu & @DaveeFTW presents their Talk "Viva la Vita Vida"
By Roxanne on Dec 29, 2018 at 5:35 PM
ref00d (plugin) Released - Run Games / Apps that require a higher FW from your ownFollowing the big news from Team Molecule several weeks ago and effectively opening the system wide open, it was only a matter of time before we would start to see other developer's start putting the finding to use and we have seen the FAPS Team (team members listed below) have recently released a new (taiHEN) plugin called ref00d, this plugin is a big deal, as it will allows users/devs to use content that would otherwise require a higher firmware to be played/executed on a lower firmware for your exploited PS Vita or PlayStation TV. Typically not an easy task to reach but thanks to Team Molecule's research and the FAPS Team we now have a ready to use simple plugin solution to remove those firmware restrictions, see additional details about this plugin release in the release notes provided below by the development team.
[Update x2] RetroArch (PS2) Preview (includes 2 cores) - Introducing New Nigthly PS2 ReleasesUpdate (2x): Reports are coming in this PS2 Homebrew is also working on PS3 HAN & PS4 (5.05).
With progress making headway on the upcoming PS4 port of RetroArch from a group of developer's, Another developer (fjtrujy) started progress on a PlayStation 2 (PS2) port several months back (view previous progress) and now has a port that progressed enough for a public soft release, Now available in the new RetroArch PS2 Nighties for anyone interested in downloading and trying out the multi-system emulator on your homebrew capable PS2 hardware. @fjtrujy warns that many things need implemented yet and many pending issue remain and only these early release contains two cores currently 2048 and QuickNES. Which is likely to grow and a good gauge to base what is expected for the PS2 port, Would be to view the PSP as that should be a good baseline of what to expect and the PS2 may be able to handy more then the PSP likely.Continue reading
2018 - Year in Review: "Kernel Exploits, New Cryptographic Failures and a (tiny) new Console" [Poll]2018 is over and it was a very interesting Year, not only for you as a Gamer, but also for PSX-Place. We saw many Releases across all platforms, like several Kernel- and Web Exploits for the PlayStation 4, the PlayStation Vita caught a strong year as well, especially back in December, but also the PS3 was still very popular with many updated Homebrew Releases for System Firmware 4.82 for instance. We also saw some newcomers like the PlayStation Classic, where everyone knows how bad Sony designed it and why we (the Homebrew-Community) has to fix it. But in case you missed something, this Article will give you an overview what happend so far in 2018 for the whole PlayStation-family. And to round things up, there is a small Poll you can find down below where you can vote for your favourite Console of last year. Every Vote is welcome.
But what will 2019 bring to you? It's still early to say but maybe Sony will satisfy the all Gamer who asks for a "PS5". But the PS4 is still a powerful machine don't you think? Maybe we will see a new Kernel Exploit for a higher System Firmware with the hope that it will lead into a proper Homebrew Community. But however the end result will be, we hope that you will stay faithful to our Community, so you won't miss any action in 2019. And speaking of that, we wish everyone a Happy New Year 2019 and may your dreams/wishes come true.Continue reading
Share This Page
- henkaku homebrew
- homebrew game
- playstation 2
- playstation 2 resources
- playstation portable
- playstation portable cfw
- playstation portable resources
- playstation tv
- ps tv
- ps vita
- ps2 emulator
- ps2 resources
- ps3 cfw
- ps3 homebrew
- ps3xploit 3.0
- psp cfw
- psp emulator
- psp resources
- pstv homebrew
- vita homebrew
- webman mod
- User Record:
- Latest Member:
This GBA Emulator is the best one to use with 98% of GBA Games on PS2 (HDD-USB-MC) -belek666