[EXPLOIT]LV2 Loader : Exploit PS3 - PS3-Infos

[Itachijiraya]

LV2 Loader par la Team Rebug est un outil destiné aux développeurs permettant de tester un lv2_kernel.self modifié sans risques de brick.

---

Cette application fonctionne sur tous les CFW 3.15, 3.41 et 3.55 CEX ou DEX (Retail ou Debug) ayant les patchs lv1 mmap et lv2 peek and poke .

LV2 Loader[ is a tool for devs to allow the quick testing of modified lv2_kernel.self by launching it from the root of dev_flash without the risk of bricking the PS3[ or need for a flasher if the new kernel does not work.

The app will run on any 3.15, 3.41, 3.55 CEX or DEX firmware that has lv1 mmap and lv2 peek and poke patches. It also has udp_printf support which will return the offset of the lv2 boot path in lv1 and a little bit of info about what it is doing.

It works by searching lv1 memory for the lv2_kernel.self boot path then modifying it to point to the root of dev_flash instead. After it finishes searching and patching the path LV2 Loader will reboot lv2 gameos without rebooting lv1.

If the app has already been ran once and the user attempts to run it again before rebooting lv1 or the current lv2 kernel does not have peek and poke it will return you to the XMB.

Utilisation :

- Placez votre lv2_kernel.self modifié à la racine du dev_flash de votre PS3 via FTP ou Multiman (par le gestionnaire de fichiers).
- Installez lv2_loader.pkg
- Lancez le LV2 Loader depuis le XMB
- La PS3 émettra un bip est redémarrera (si elle ne bip pas, cela n'a pas fonctionné)

NOTE : Tant que vous ne redémarrez pas le lv1, vous pouvez continuer à utiliser le chemin d'accès créé et changer le lv2_kernel.self aussi souvent que vous le souhaitez.

Spoiler : F.A.Q :

Q: Can LV2 Loader boot DEX lv2_kernel.self?
A: YES. It will require your PS3 to be QA flagged. Don’t be fooled though. Just because you can boot the DEX lv2 kernel does not mean it will magically function like a DEX. For that to happen it will require more patching but this certainly makes the road easier to figuring it out.

Q: Can LV2 Loader boot lv2_kernel.self from a higher firmware?
A: In testing, booting a 3.56 lv2 kernel resigned for 3.55 worked without any problems. Keep in mind that amongst other things, the ps3 is still using the lower firmware’s appldr so there is no real advantage to doing this at the moment.

Q: Can this brick my PS3?
A: NO, NO, NO. The whole point of LV2 Loader is to prevent this from happening during your development of lv2 patches.

Q: Isn’t the offset for the lv2 boot path the same for all PS3?
A: NO. In testing on five different PS3 we came across seven dramaticly different offsets. Infact one of the PS3 at one stage or another in testing used four of the same offsets as the others and has now returned to the original offset from when we started.

Q: How do I reboot the PS3 without rebooting lv1 hypervisor?
A: Using glevend’s Reboot app will let you reboot the PS3 and maintain the modified lv2 boot path. As a bonus for REBUG users when changing modes with Rebug Selector the PS3 will reboot from the new path as well.

Q: As a user of REBUG firmware, if I boot the DEX lv2 kernel does that mean I am running DEX firmware on a retail PS3?
A: YES. REBUG uses the entire DEX firmware apart from 3 or 4 sprx (to allow QA flag support mainly) and uses the CEX lv2_kernel.self. Booting the DEX lv2_kernel.self will in effect, complete the set.

Enjoy.

~ Codename: REBUG

Credit and Thanks:
As always to graf and glevend for the hypervisor work.
Big thanks to Dean for the handy memory mapping tip and adding support for LV2 Loader into multiMAN at the last minute.

lv2_loader.pkg

Site officiel : http://rebug.me/