SELF Decrypting Payload Released

Submitted by greg; December 02, 2010


Behind the scenes, deep in the underground, graf_chokolo has been working hard at hacking the PS3 HV and today the developer has released, via github, the resulting payload. Now don't get too excited, this isn't anything for the average jail breaker out there, this is for the hardcores -- it's a payload that is capable of decrypting SELF binaries without GameOS and sends the decrypted results over ethernet to your PC. Mind you, commercial games and NPDRMs cannot be decrypted with this, not yet anyway. Let me quote graf_chokolo:

I used only HV calls in my code because i wanted to learn how to decrypt SELFs without GameOS. The decryption and decompression of SELFs is done by isolated module appldr which is prepared and loaded by lv1_undocumented_function_99. After appldr is loaded it sends a message and waits for your instructions to decrypt some encrypted segments. When the message arrives i pass encrypted segment data to appldr through shared memory and it decrypts the passed data. When the decryption is done the payload sends the decrypted data over network to my PC and i capture it with tcpdump. Im using IDA to analyze the decrypted code. First i extract the decrypted segments from pcap dump and load them at right addresses into IDA. I created a shell script to make segment extraction from pcap dumps easier. Virtual addresses of decrypted segments you will find in ELF header. The target group of this release are again advanced programers among you. The goal of this release is not to give you a tool for SELF decryption but to show you how it can be done :-) So, feel free to ask me any questions about my code. I will support everyone who wants to port my code and create more user-friendly GameOS applications for SELF decryption because i do not intend to write any GameOS tools :-) Im more interested in HV reversing.

- source: psx-scene


Tags: graf_chokolo, Payloads, PS3 Hacks, SELF Decrypter