http://goo.gl/VKWGn So the lv2ldr verifys decrypts the lv2_kernal.self. We can get the address of this happening. Inside Parameters Layout there are arguments, they are used as commands basically to load a function you want to use. They start in the lv2 @ 0x3E800 (seems to be same for other ldrs) that address. There is a argument that is called lv2_in and lv2_out (we have know about these) basically we can use lv2_in to map out the address and lv2_out to map out the address for where the lv2ldr decryptes the self file. We can make a program like readself basically and get the offset, u8* means read one byte from the address. use that and we can actually be get the exact offset where it all happens at. 既然lv2ldr具備查驗並解秘lv2_kernel.self 主程式的能力，我們也許能藉此獲 知記憶體的位址。lv2ldr這個函式有三個輸入參數，位址從0x3E800 開始（似乎 絕大多數的ldr 的起始位址都在這附近），有一個參數叫lv2_in，參數格式是位 址指標（譯註：即pointer ），一個叫lv2_out ，參數格式也是位址，我們可以 理解成lv1 將lv2_kernel.self 載入記憶體中後，將位址指標傳給lv2ldr，解秘 後將內容寫到 lv2_out所指定的位址。因此我們只要能夠撈到lv2_out 位址記載 的東西，事情就單純了。 Once we have the location grabbing this decrypted self should be the easy task. Like I said, some info we had and some we did not know about can be obtained like this and used to get keys. 用這種手法，可以得到一些想知道的東西，比如說存在appldr裡頭的金鑰。 Exploiting 4.00 with this method would work, most likely because I doubt sony changed all the locations where the loaders do there thing, sure there encapsulated in the bootloader but they still pass over into the ram at one point before being fed over to the metldr which loads ldrs and if all that is still happening then Sony didn't change nothing. 用這個手法有很高的機會能夠成功解秘4.00版韌體，最主要的原因是因為我不相 信SONY會把所有的位址都改過，就算如此，改過的位址也存在bootloader裡頭， 然後遲早都要傳到記憶體中，不然metldr沒辦法載入其他的東西。 ****** 個人比較好奇的地方是，就算知道了位址有辦法單靠外部電路讀出lv2_out 指標 指向位址的內容？如果不是用外部電路，那至少要能破解到有memory dump 權限 ，比如說能跑 Linux的程度直接把記憶體映射到某個檔案然後去找。如果都能跑 Linux 就根本不用去管lv2_out 到底指向哪裡，因為key 的形式很固定，而且在 記憶體中一次會出現一堆，直接寫個程式去找就好，256MB 不會花太久時間的。 ****** 看了原作者的twitter 後，原PO果然給KaKaRoTo打臉了。 -- ○ ____ _ _ _ _ ____ _ _ ____ _____ ____ 。 ★(_ _)( \( )( \/ )( ___)( \( )(_ _)( _ )( _ \ ｏ _)(_ ) ( \ / )__) ) ( )( )(_)( ) / ● ‧ (____)(_)\_) \/ (____)(_)\_) (__) (_____)(_)\_) ★ ｏ --

※ 發信站: 批踢踢實業坊(ptt.cc) ◆ From: 122.117.54.160