Why Dark_Alex cannot hack the TA88v3

[tinman]

Dark_Alex posed this explaining why.

This is an explanation of the security that was added in TA88v3, and which will be likely in PSP3000.

When the PSP boots, the boot code (aka pre-ipl or ipl loader) loads the ipl from either the nand or memory stick. The IPL is splitted into pieces of 0x1000 bytes.

First 0xA0 bytes of each block is a header for the kirk hardware command 1. It contains keys,
the size of the cipher data, and two hashes, one for part the header itself, and another one for the body. The 0xF60 remaining bytes are the ciphered body, which will decrypt to 0xF60 plain bytes... if the hashes, which are checked by kirk hardware itself, are OK. (Note: ciphered body can actually be less than 0xF60, in this case, remaining bytes are ignored... before TA88v3) Fir

The security of kirk hashes was destroyed by a timing attack, and the IPL became unprotected.
What has Sony added to fix this?

The answer can be found in 4.00+ slim ipl's. They decreased the size of the ciphered body to 0xF40 to leave 0x20 bytes at the end of each block (at offset 0xFE0).
As stated before, these remaining bytes are ignored... in pre-ipl's of psp's prior to TA88v3, and in fact, they can be randomized and ipl will still boot in those psp's. In newest pre-ipl's, these 0x20 bytes have a meaning.

The first 0x10 bytes is an unknown hash calculated from the decrypted block. It is deduced that is calculated from the decrypted block and not the ciphered one due to the fact that 4.01 and 4.05 have a lot of ipl blocks in common, which, when decrypted, are similar, but they are totally different in its encrypted form. In these two ipl's, this hash is same, as seen in the picture:

The second 0x10 bytes seem also to be dependent of the decrypted body (maybe dependent of the previous 0x10 bytes too?). In the picture it can be seen that they are different in 4.01 and 4.05, but they can actually be interchanged, you can move those 0x10 bytes from the same block in 4.05 ipl to the 4.01 ipl and it will still boot; however it cannot be randomized.

This protection also destroys any possibility of downgrading below 4.00, as these new cpu's won't be able to boot previous firmwares ipl's.

Summary: basically, all security of newest psp cpu's rely on the secrecy of the calculation of those 0x20 bytes. If pre-ipl were dumped somehow, the security would go down TOTALLY.

Graphic summary:

[vitorgatti]

That's... sad
I like homebrews

Sony should at least allow that. Damn you, Sony

[royvedas]

That's... sad
I like homebrews

Sony should at least allow that. Damn you, Sony

And you probably like the ability of playing illgotten isos as well. Like all the rest of us. Amen.

[vitorgatti]

And you probably like the ability of playing illgotten isos as well. Like all the rest of us. Amen.

Kinda. I like and deslikes the option to have as many games as I can download, because this becomes boring after a while.

I really rather buying an original game and finishing it with proud, as downloading a lot of games simultaneously and playing only some parts of each. You really don't enjoy the whole game when you get it easily, and for free. You just play, play and play until you get bored, and that's it. When you buy, the value becomes a lot higher!

But MAN, there are some homebrews that I really can't live without. They are so useful...! Like PSPHUD, PSP File Transfer, PDF Reader, etc etc

[NightRaven]

It says in the title in the thread you linked to..

Why TA88v3 cannot be hacked "yet"

That suggests it hasnt been done but not that it wont ever be. Id imagine it will be at some point or another.

[vitorgatti]

Well, somebody has to know a way to dump pre-ipl. Let's wait and see what happens...!

[paladinja]

it's funny how bad news sounds like bad news... even when you don't understand a word of it. I'd love to see the actual math on just how much money software devs are going to loose because most heads won't upgrade past a firmware that will stop them from playing emus etc, so they won't be able to play games requiring the newest firmware.... I bet they loose money in the long run.... well, maybe not.
Thanks allot rampant iso pirates.
Oh well, I won't count DAX out yet.

[mcdougall57]

And you probably like the ability of playing illgotten isos as well. Like all the rest of us. Amen.

Aye but I find I play the games less and less if I have the ability to get them for free because I feel no need to progress if I get stuck as I can just move to another game.

[newb_fo_life]

Oh well,i dont mind,its still only got 64 mb of ram.

O.o

[dangee]

it looks like Sony and their game makers could get a clear run
on the 3000 , at least for a while.

Maybe that's for the best.

But I won't be rushing to trade in my customized phat just yet.