http://goo.gl/VKWGn So the lv2ldr verifys decrypts the lv2_kernal.self. We can get the address of this happening. Inside Parameters Layout there are arguments, they are used as commands basically to load a function you want to use. They start in the lv2 @ 0x3E800 (seems to be same for other ldrs) that address. There is a argument that is called lv2_in and lv2_out (we have know about these) basically we can use lv2_in to map out the address and lv2_out to map out the address for where the lv2ldr decryptes the self file. We can make a program like readself basically and get the offset, u8* means read one byte from the address. use that and we can actually be get the exact offset where it all happens at. 既然lv2ldr具备查验并解秘lv2_kernel.self 主程式的能力，我们也许能藉此获 知记忆体的位址。lv2ldr这个函式有三个输入参数，位址从0x3E800 开始（似乎 绝大多数的ldr 的起始位址都在这附近），有一个参数叫lv2_in，参数格式是位 址指标（译注：即pointer ），一个叫lv2_out ，参数格式也是位址，我们可以 理解成lv1 将lv2_kernel.self 载入记忆体中後，将位址指标传给lv2ldr，解秘 後将内容写到 lv2_out所指定的位址。因此我们只要能够捞到lv2_out 位址记载 的东西，事情就单纯了。 Once we have the location grabbing this decrypted self should be the easy task. Like I said, some info we had and some we did not know about can be obtained like this and used to get keys. 用这种手法，可以得到一些想知道的东西，比如说存在appldr里头的金钥。 Exploiting 4.00 with this method would work, most likely because I doubt sony changed all the locations where the loaders do there thing, sure there encapsulated in the bootloader but they still pass over into the ram at one point before being fed over to the metldr which loads ldrs and if all that is still happening then Sony didn't change nothing. 用这个手法有很高的机会能够成功解秘4.00版韧体，最主要的原因是因为我不相 信SONY会把所有的位址都改过，就算如此，改过的位址也存在bootloader里头， 然後迟早都要传到记忆体中，不然metldr没办法载入其他的东西。 ****** 个人比较好奇的地方是，就算知道了位址有办法单靠外部电路读出lv2_out 指标 指向位址的内容？如果不是用外部电路，那至少要能破解到有memory dump 权限 ，比如说能跑 Linux的程度直接把记忆体映射到某个档案然後去找。如果都能跑 Linux 就根本不用去管lv2_out 到底指向哪里，因为key 的形式很固定，而且在 记忆体中一次会出现一堆，直接写个程式去找就好，256MB 不会花太久时间的。 ****** 看了原作者的twitter 後，原PO果然给KaKaRoTo打脸了。 -- ○ ____ _ _ _ _ ____ _ _ ____ _____ ____ 。 ★(_ _)( \( )( \/ )( ___)( \( )(_ _)( _ )( _ \ ｏ _)(_ ) ( \ / )__) ) ( )( )(_)( ) / ● ‧ (____)(_)\_) \/ (____)(_)\_) (__) (_____)(_)\_) ★ ｏ --

※ 发信站: 批踢踢实业坊(ptt.cc) ◆ From: 122.117.54.160