L ß - PSX Scene

More documents

Recommendations

Info

1/9/2011 Console Hacking 2008: Wii Fail Modify executable code of any title Extract secret keys or executables to downloadable applications (WiiWare/Virtual Console) We call this ES_Identify :-) Abusing DVD Video Disc drive firmware (ROM) rejects non-Wii discs when loading games Can't write a warez loader, because you can't even read the disc DVD Video commands left in firmware, to support potential DVD Video channel IOS will not let you use those commands ... unless you set a magic bit in TMD Result: Homebrew ability to play DVD Videos without firmware patching Result: DVD-Rs look a lot like DVD Video discs, so someone wrote a warez loader Tried to inform Nintendo about this, they responded by harassing us Moral: Don't bother Vendor Response First unsigned code demonstrated: Dec. 2007 First optional fix for strncmp bug: 21 Mar. 2008 Near useless, limited to one new IOS First operational fix for strncmp bug + Twilight Hack "fix": 16 Jun. 2008 Limited to System Menu IOS, easily bypassed; hack fix is a failure First near-complete rollout of strncmp fix: 23 Oct. 2008 Fairly effective against VC piracy Second Twilight Hack fix attempt: 17 Nov. 2008 Still a failure Crypto Problems Bug in signature verification (hash check) Keys stored in external GDDR3 RAM in cleartext Memory not cleared when entering GameCube mode Signatures verified at installation time only Chain of trust easily breakable via raw NAND access Broadway API Problems Broadway code can reload IOS Broadway code can call private IOS functions Read/write encrypted flash at low level Identify using TMD/eTicket Poor parameter verification in syscalls Poor caller process checks in syscalls Latent DVD-mode code Procedural problems Long testing cycles Case3:11-cv-00167-SI Document4 Filed01/11/11 Page74 of 282 marcansoft.com/…/25c3_console_hac… 8/9
1/9/2011 Console Hacking 2008: Wii Fail Unwillingness to talk to security researchers Left boot1 unpatched for a year "knee-jerk" bugfixes (fixed irrelevant holes without improving architecture) Two different teams working on software -- poor communication? Embedded Device Scorecard Homebrew demos Homebrew Channel BootMii Case3:11-cv-00167-SI Document4 Filed01/11/11 Page75 of 282 marcansoft.com/…/25c3_console_hac… 9/9
Page 1 and 2:
0/;:: l ß"' 1 KILPATRICK TOWNSEND
Page 3 and 4:
Case3:11-cv-00167-SI Document4 File
Page 5 and 6:
Page 7 and 8:
PS3 Software Piracy Begins as First
Page 9 and 10:
PS3 Software Piracy Begins as First
Page 11 and 12:
Page 13 and 14:
fail0verflow (fail0verflow) on Twit
Page 15 and 16:
Page 17 and 18:
Page 19 and 20:
PlayStation 3 hack - how it happene
Page 21 and 22:
PlayStation 3 hack - how it happene
Page 23 and 24: Case3:11-cv-00167-SI Document4 File
Page 25 and 26: git.fail0verflow.com Git - ps3tools
Page 27 and 28: git.fail0verflow.com Git - noralize
Page 31 and 32: Project Jerry 7, 2008 Our congratul
Page 33 and 34: 1/9/2011 xyzzy HackMii Notes from i
Page 35 and 36: 1/9/2011 xyzzy 5 SageChaozu // Jul
Page 37 and 38: 1/9/2011 xyzzy P.S. Bushing your op
Page 45 and 46: 1/9/2011 xyzzy close Galleries of b
Page 47 and 48: 1/9/2011 Keys, keys, keys. HackMii
Page 49 and 50: 1/9/2011 Keys, keys, keys. needs to
Page 51 and 52: 1/9/2011 Keys, keys, keys. other th
Page 59 and 60: 1/9/2011 Keys, keys, keys. close Ca
Page 63 and 64: Post a Reply Posted 899 days ago 0
Page 67 and 68: Console Hacking 2008: Wii Fail Is i
Page 69 and 70: Wii Optical Discs (WODs) IOS Modifi
Page 71 and 72: Signatures All RSA signature compar
Page 73: 1/9/2011 Console Hacking 2008: Wii
Page 79 and 80: 1/9/2011 Wii: Hardware, seguridad,
Page 83 and 84: Títulos Case3:11-cv-00167-SI Docum
Page 85 and 86: El eTicket El eTicket nos da acceso
Page 87 and 88: IOS Case3:11-cv-00167-SI Document4
Page 91 and 92: Twiizer Attack Case3:11-cv-00167-SI
Page 93 and 94: Twilight Hack Case3:11-cv-00167-SI
Page 103 and 104: 1/9/2011 Dev-Team Blog - Search res
Page 109 and 110: Reply Reply Reply gametheory 44p ·
Page 111 and 112: 1/9/2011 Case3:11-cv-00167-SI Dev-T
Page 115 and 116: Hector Martin (marcan42) on Twitter
Page 125 and 126:
Hector Martin (marcan42) on Twitter
Page 127 and 128:
Page 129 and 130:
Page 131 and 132:
Page 133 and 134:
Page 135 and 136:
Page 137 and 138:
Page 139 and 140:
Page 141 and 142:
Page 143 and 144:
Page 145 and 146:
Page 147 and 148:
Page 149 and 150:
Page 151 and 152:
Page 153 and 154:
Page 155 and 156:
Page 157 and 158:
Page 159 and 160:
Page 161 and 162:
Page 163 and 164:
Page 165 and 166:
Page 167 and 168:
Page 169 and 170:
Page 171 and 172:
Page 173 and 174:
Page 175 and 176:
ushing (gnihsub) on Twitter http://
Page 177 and 178:
Page 179 and 180:
Page 181 and 182:
Page 183 and 184:
Page 185 and 186:
pytey (pytey) on Twitter http://twi
Page 187 and 188:
Page 189 and 190:
Page 191 and 192:
Page 193 and 194:
Page 195 and 196:
Page 197 and 198:
Page 199 and 200:
Page 201 and 202:
Page 203 and 204:
Page 205 and 206:
Page 207 and 208:
Page 209 and 210:
Page 211 and 212:
Page 213 and 214:
Page 215 and 216:
Page 217 and 218:
Page 219 and 220:
Page 221 and 222:
Page 223 and 224:
Page 225 and 226:
Page 227 and 228:
Page 229 and 230:
Page 231 and 232:
Page 233 and 234:
Page 235 and 236:
Page 237 and 238:
Page 239 and 240:
Page 241 and 242:
also @ TechSpot: Tech Tip: Customiz
Page 243 and 244:
trillionsin on January 5, 2011 11:3
Page 245 and 246:
Page 247 and 248:
Geohot: Here is your PS3 Root Key!
Page 249 and 250:
Geohot: Here is your PS3 Root Key!
Page 251 and 252:
Page 253 and 254:
Page 255 and 256:
Page 257 and 258:
*Maximus AVR USB *Acekard2i *modbo
Page 259 and 260:
Burberry Carlton Haymarket Notebook
Page 261 and 262:
Page 263 and 264:
5 January 2011 Last updated at 20:1
Page 265 and 266:
Page 267 and 268:
Page 269 and 270:
Page 271 and 272:
Comment: Re:Same private key? (Scor
Page 273 and 274:
1/10/2011 Case3:11-cv-00167-SI Docu
Page 275 and 276:
Page 277 and 278:
1/10/2011 Slashdot bushing (11) pri
Page 279 and 280:
1/10/2011 Slashdot bushing (11) Com
Page 281 and 282:
show all

L ß - PSX Scene

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?