PS3 LV2_Kernel Exploit Sample Implementation By Naehrwert

PS정보

PS3 LV2_Kernel Exploit Sample Implementation By Naehrwert

Mac2

2012-09-21 오후 2:19:41 Hit. 19829

- 첨부파일
* 다운로드시 5포인트가 차감됩니다.
images.jpg

<DIV>Following up on his<SPAN class=Apple-converted-space> </SPAN><A href="http://www.ps3news.com/ps3-hacks-jailbreak/ps3-scetool-v0-2-9-by-naehrwert-updated-adds-np-fix-and-more/" target=_blank><B>PS3 SCETool</B></A><SPAN class=Apple-converted-space> </SPAN>update and<SPAN class=Apple-converted-space> </SPAN><A href="http://www.ps3news.com/ps3-hacks-jailbreak/ps3-dump-rootkey-code-and-brief-guide-arrives-from-naehrwert/" target=_blank><B>PS3 Dump_Rootkey</B></A><SPAN class=Apple-converted-space> </SPAN>code, today Sony<SPAN class=Apple-converted-space> </SPAN><SPAN class=IL_AD id=IL_AD5 $iceid="6">PlayStation</SPAN><SPAN class=Apple-converted-space> </SPAN>3 hacker<B>Naehrwert</B><SPAN class=Apple-converted-space> </SPAN>has posted some details on exploiting the PlayStation 3 lv2_kernel and has made available a<SPAN class=Apple-converted-space> </SPAN><SPAN class=IL_AD id=IL_AD3 $iceid="4">sample</SPAN><SPAN class=Apple-converted-space> </SPAN>3.41 implementation below.<BR><BR><SPAN class=IL_AD id=IL_AD6 $iceid="7">To quote</SPAN><SPAN class=Apple-converted-space> </SPAN>from his blog: Exploiting (?) lv2<BR><BR>A long while ago<SPAN class=Apple-converted-space> </SPAN><B>KaKaRoTo</B><SPAN class=Apple-converted-space> </SPAN>pointed me to a stack<SPAN class=Apple-converted-space> </SPAN><SPAN class=IL_AD id=IL_AD7 $iceid="8">overflow</SPAN><SPAN class=Apple-converted-space> </SPAN>he found while reversing lv2_kernel. But there are two problems:<BR><BR>1. The vulnerability is in a protected syscall (the SELF calling it got to have the 0x40... control flags set). So you’d first need to find a suitable usermode exploit (don’t ask us), that gives you code execution with the right privileges.<BR><BR>2. The payload data is copied to lv2 heap first and the function will do a free call on it before the payload has any chance to get executed. This might not sound like a problem but it looks like lv2′s heap implementation will overwrite the free’ed space with 0xABADCAFE and thus destroy the payload.<BR><BR>Here (pastie.org/4755699) is my sample implementation for 3.41 lv2_kernel (although the vulnerability should be present in all versions of lv2 up to the latest<SPAN class=Apple-converted-space> </SPAN><SPAN class=IL_AD id=IL_AD2 $iceid="3">firmware</SPAN>), maybe someone of you will find a way to overcome problem (2.) and can get something nice out of it because right now it’s only good to crash lv2.<BR><BR></DIV>기사 원문 : <A href="http://www.ps3news.com/ps3-hacks-jailbreak/ps3-lv2-kernel-exploit-sample-implementation-by-naehrwert/" target=_blank>http://www.ps3news.com/ps3-hacks-jailbreak/ps3-lv2-kernel-exploit-sample-implementation-by-naehrwert/</A>
<DIV><BR></DIV>
<DIV>==========================================================================================================</DIV>
<DIV>기사 원문과 DASHHACKS의 기사를 짧은 지식으로나마 해석해보니 LV2 단계의 커널의 EXPLOIT이 구현되었다고 하고</DIV>
<DIV>이걸 통해서 모든 현 시스템의 LV2 커널의 EXPLOIT이 가능할 수도 있다라고 하는거 같은데요.</DIV>
<DIV><SPAN style="FONT-SIZE: 13px; COLOR: rgb(85,85,85); LINE-HEIGHT: normal; FONT-FAMILY: Arial, Verdana, sans-serif">(According to the source, there seems to be the possibility of a kernel exploit that could effect all current systems!)</SPAN></DIV>
<DIV><SPAN style="FONT-SIZE: 13px; COLOR: rgb(85,85,85); LINE-HEIGHT: normal; FONT-FAMILY: Arial, Verdana, sans-serif"><BR></SPAN></DIV>
<DIV>==========================================================================================================</DIV>
<DIV><SPAN style="FONT-SIZE: 13px; COLOR: rgb(85,85,85); LINE-HEIGHT: normal; FONT-FAMILY: Arial, Verdana, sans-serif">As of right now, the PS3 scene is somewhat limited to a very specific group that happen to have one of the few possible hacked firmwares. However, if the exploit discussed in this coder's blog post can happen to be capitalized on, it's quite possible that the homebrew community just might open up to a massive degree. According to the source, there seems to be the possibility of a kernel exploit that could effect all current systems! Essentially in technical terms the crash creates what is called a stack overflow, allowing the entire security mechanism to be crushed under the right kind of code.</SPAN></DIV>
<DIV>
<DIV style="PADDING-RIGHT: 0px; PADDING-LEFT: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; WORD-SPACING: 0px; FONT: 13px Arial, Verdana, sans-serif; TEXT-TRANSFORM: none; COLOR: rgb(85,85,85); TEXT-INDENT: 0px; PADDING-TOP: 0px; WHITE-SPACE: normal; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); orphans: 2; widows: 2; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px"> </DIV>
<DIV style="PADDING-RIGHT: 0px; PADDING-LEFT: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; WORD-SPACING: 0px; FONT: 13px Arial, Verdana, sans-serif; TEXT-TRANSFORM: none; COLOR: rgb(85,85,85); TEXT-INDENT: 0px; PADDING-TOP: 0px; WHITE-SPACE: normal; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); orphans: 2; widows: 2; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px">However, as of right now this discovery is not without its share of limitations. As Naehrwert himself puts it "you’d first need to find a suitable usermode exploit (don’t ask us), that gives you code execution with the right privileges" to work behind the protected syscall involved with the vulnerability. Additionally, the firmware itself also has a way of erasing the extra payload so that the true crash isn't allowed to take full effect. Still, as proof of his work, my my source link shows the 3.41 version kernel in the hopes that another group may be able to help him out. Oh what a wonderful world we would live in should this be fully realized.</DIV>
<DIV style="PADDING-RIGHT: 0px; PADDING-LEFT: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; WORD-SPACING: 0px; FONT: 13px Arial, Verdana, sans-serif; TEXT-TRANSFORM: none; COLOR: rgb(85,85,85); TEXT-INDENT: 0px; PADDING-TOP: 0px; WHITE-SPACE: normal; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); orphans: 2; widows: 2; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px"><BR></DIV>
<DIV style="PADDING-RIGHT: 0px; PADDING-LEFT: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; WORD-SPACING: 0px; FONT: 13px Arial, Verdana, sans-serif; TEXT-TRANSFORM: none; COLOR: rgb(85,85,85); TEXT-INDENT: 0px; PADDING-TOP: 0px; WHITE-SPACE: normal; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); orphans: 2; widows: 2; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px"><BR></DIV>
<DIV style="PADDING-RIGHT: 0px; PADDING-LEFT: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; WORD-SPACING: 0px; FONT: 13px Arial, Verdana, sans-serif; TEXT-TRANSFORM: none; COLOR: rgb(85,85,85); TEXT-INDENT: 0px; PADDING-TOP: 0px; WHITE-SPACE: normal; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); orphans: 2; widows: 2; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px"><SPAN style="FONT-SIZE: 12px; COLOR: rgb(0,0,0); LINE-HEIGHT: 18px; FONT-FAMILY: 굴림">DASHHACKS의 기사 : </SPAN><A style="FONT-SIZE: 12px; LINE-HEIGHT: 18px; FONT-FAMILY: 굴림" href="http://www.dashhacks.com/ps3/ps3-rumors/lv2_kernel-exploit-explained.html" target=_blank>http://www.dashhacks.com/ps3/ps3-rumors/lv2_kernel-exploit-explained.html</A></DIV>
<DIV style="PADDING-RIGHT: 0px; PADDING-LEFT: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; WORD-SPACING: 0px; FONT: 13px Arial, Verdana, sans-serif; TEXT-TRANSFORM: none; COLOR: rgb(85,85,85); TEXT-INDENT: 0px; PADDING-TOP: 0px; WHITE-SPACE: normal; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); orphans: 2; widows: 2; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px">==================================================================================</DIV>
<DIV style="PADDING-RIGHT: 0px; PADDING-LEFT: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; WORD-SPACING: 0px; FONT: 13px Arial, Verdana, sans-serif; TEXT-TRANSFORM: none; COLOR: rgb(85,85,85); TEXT-INDENT: 0px; PADDING-TOP: 0px; WHITE-SPACE: normal; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); orphans: 2; widows: 2; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px"><BR></DIV>
<DIV style="PADDING-RIGHT: 0px; PADDING-LEFT: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; WORD-SPACING: 0px; FONT: 13px Arial, Verdana, sans-serif; TEXT-TRANSFORM: none; COLOR: rgb(85,85,85); TEXT-INDENT: 0px; PADDING-TOP: 0px; WHITE-SPACE: normal; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); orphans: 2; widows: 2; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px">제가 너무 확대 해석한건지 ㅋ</DIV>
<DIV style="PADDING-RIGHT: 0px; PADDING-LEFT: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; WORD-SPACING: 0px; FONT: 13px Arial, Verdana, sans-serif; TEXT-TRANSFORM: none; COLOR: rgb(85,85,85); TEXT-INDENT: 0px; PADDING-TOP: 0px; WHITE-SPACE: normal; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); orphans: 2; widows: 2; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px">어쨋든 LV2 커널 EXPLOIT로 인해 3005도 커펌이 되길 기다립니다.</DIV>
<DIV style="PADDING-RIGHT: 0px; PADDING-LEFT: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; WORD-SPACING: 0px; FONT: 13px Arial, Verdana, sans-serif; TEXT-TRANSFORM: none; COLOR: rgb(85,85,85); TEXT-INDENT: 0px; PADDING-TOP: 0px; WHITE-SPACE: normal; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); orphans: 2; widows: 2; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px">(자세한 해석은 밑에분께 ㅠ)</DIV><BR class=Apple-interchange-newline></DIV>

Lv.4 / 일병 . Mac2 (milleniu)

( 56 / 500 ) 11%

포 인 트 : 556 P
가 입 일 : 2009-02-27 오전 1:40:07
최종접속일 : 2021-02-09 오후 3:35:53

3		0

불량게시글신고

글쓰기 수정 삭제 목록

한번믿어봐


정보 2013년 2월 20일의 의미, 소니의 차세대 플레이스테이션 등… 17	urdandy	2013.02.01	8008
정보 E3의 반격? PS3 스테이션 & PS3 글리처 발표 28	urdandy	2013.02.01	12112
정보 개발자 킷으로 보는 차세대 플스 24	urdandy	2013.01.24	8339
정보 Cobra-USB v4.30 출시 22	urdandy	2013.01.23	12441
정보 Eurogamer에 나온 PS4 Orbis의 사양 24	urdandy	2013.01.20	6829
정보 Cobra ODE, '모든' PS3 지원~! 41	urdandy	2013.01.18	23108
정보 Unban 0.3 update 20	urdandy	2013.01.12	7878
정보 COBRA USB 관련 새 소식이 올라왔습니다. 10	wiiman	2013.01.07	6589
정보 COBRA USB 사이트에 새 소식이 올라왔습니다. 45	wiiman	2012.11.14	11783
정보 LV0 Key가 유출되었습니다! 93	웃자	2012.10.24	19907
정보 Rogero CEX 4.21 펌웨어 릴리즈 - 추가사항(긴급) 76		2012.10.23	71748
정보 PS3용 ODD Xkey 출시 예정 - BD key 필수 (영상추가) 72		2012.10.11	14769
정보 PC용 PS3 에뮬레이터 릴리즈 - 홈브류 게임구동가능 48		2012.10.08	40860
정보 PS3 LV2_Kernel Exploit Sample Implementation By Naehrwer… 15	Mac2	2012.09.21	19830
정보 SEN Enabler/Disabler spoof 4.25 by SGK - 4.25 스푸핑, SE… 18	liteuser	2012.09.15	8768
정보 Majrawi DEX GameFixer 릴리즈 - 자동변환 14		2012.09.11	7868
정보 DEX 게임 교체 지원 멀티매니저 04.05.05 릴리즈 - PC 필요… 8		2012.09.09	7245
정보 Multiman 04.05.04 릴리즈 - DEX 게임 마운트 지원 (DEX용) 10		2012.09.07	8397
정보 ps3 cheats editor 사용기(수정) 23	뽀로리	2012.09.03	8864
정보 TrueBlue ELF Dumper 공개 : TB 없이 동글기능 사용 - 수정 53		2012.08.26	12231