C'est par le biais de son Twitter que mathieulh donne de grosses informations sur l'exploit qu'il a découvert il y a de cela quelques temps et newsé ICI par Logic-Sunrise, mais aussi aprés qu'il ait annoncé avoir lancé du code sur Fw 3.60 newsé également ICI. Avec ces informations supplémentaires, nous pouvons donc espérer qu'elles tombent entre de bonnes mains expertes, ce qui pourrait donc être une avancée pour le hack du firmware 3.56 ou 3.60 et voir dans un futur plus ou moins proche un CFW.
Affaires à suivre...
Voici ses différents Tweet (non traduit car ils contiennent de nombreux termes techniques)
"You can't overflow user processes, the NX bit applies here, you can only overflow lv2 or a process with higher privileges."
"You can update from your pwn pup only from 3.55 or lower, unless you have an exploit."
"Of course that should be fixed in upcoming lv0 revisions anyway (By moving the ldrs to the top of lv0)"
"You run the 3.60 lv0, then you switch the nor, and pull the cell reset line, and you dump the extra KBs where the loaders are."
"Basically you have a nor with 3.55 (or lower) lv0 and your own small lv1 code that does the dump, and 3.60 lv0 on the other."
" You wont get all of lv0 but the part with the loaders shouldn't be overwritten."
"You can actually get all the 3.60 keys/loaders without knowing lv0 keys by dumping lv0 from ram with dual nor and signed lv1."
"That's from an older lv0, the method to get the data isn't the same, the one I posted was a dump, this one is a decryption "
"There is a nice way to dump pre 3.55 lv0 as well by using a small lv1 binary, it's a risky process though."
"Oh! You mean my pm ? congrats, you just figured I have had lv0 dumped/decrypted for quite some time xD"
"Reminds me of those stupid lv2 overflows I spotted ages ago in the bdemu code, which are useless now on 3.55+ anyway."
"To those planning on building a 3.56+ pup for whatever reason, the files attributes changed, the group and user ids for the files as well."
"The new 3.56+ values for tarballs are the following: owner_id, "0000764" group_id, "0000764" owner, "tetsu" group, "tetsu" ustar, "ustar "
"
"You can use fix_tar to use those new values. Use with caution."
"By comparison, those are the pre-3.56 values. owner_id, "0001752" group_id, "0001274" owner, "pup_tool" group, "psnes" ustar, "ustar "
"
Modifié par espanish, 29 mars 2011 - 11:22.
