EXCLUSIVE: PS3 'Metldr' Exploit been 'leaked'

[JLM]

Uh, okay.

I checked for you at the debian site and the directories containing the updated software/lists are still in the same place as when I wrote that guide to updating offline. Meaning you can just go to the 3 "squeeze" directories listed in the "how-to" post (and the 3 "stable" directories if you want) and download 2 files from each directory to update the lists that synaptic uses.

It looks like you are frustrated but red ribbon is a live cd version of debian he put together to make things easier for ps3 users to install linux. It's not really his fault that debian changed the repositories.

Also why be upset that this one person put in all his personal time to help us (for free) and he didn't also include all the software that people might want to use? Being relatively small makes it easier for some people to dl. Plus he was nice to put it on sourceforge with really fast dl speeds for free instead of some filesharing site with slow speeds unless we pay to dl faster. Finally, it's not his fault if someone doesn't know how to install software on linux. If your ps3 is online, synaptic (which is included) will do it for you.

He started his project over a year ago not just recently for those wanting a dex.

As for the Rnd release, I have heard several people had problem with it. Maybe don't use it. I don't know anything about it.

Someone else has released the already compiled metldrpwn.ko here:

http://www.ps3crunch.net/forum/threa...getID-Changing

in the seventh post, the share online biz link. Good luck with the conversion.

[Berion]

It looks like you are frustrated but red ribbon is a live cd version of debian he put together to make things easier for ps3 users to install linux. It's not really his fault that debian changed the repositories.

Yes I Was frustrated. My words was to harsh and I must apologize for my behaviour. Especially an author of RR if he one day read this post.
You know, a bad day...

Someone else has released the already compiled metldrpwn.ko here:

I have tried version attached by DeanK with RR rc5 LiveCD and finally it's work.

BTW: If someone have problem with launching metldrpwn.ko from script I suggest insert it before launching a script:

sudo insmod metldrpwn.ko

After that, change chmod to execute on script.

sudo chmod -x run.sh

It looks like I have properly dump. Uff... ^^

Good luck with the conversion.

Thank you.

[JLM]

Glad you made some progress. I get frustrated with some linux quirks as well.

Here is the output message from unpacking and compiling the exploit
(moved, it belongs in this thread not the other one):

username@ps3:~$ tar -zxvf metldr838exploit.tar.gz
metldr838exploit/
metldr838exploit/metldrpwn.c
metldr838exploit/spu.h
metldr838exploit/metldr
metldr838exploit/README
metldr838exploit/Makefile
metldr838exploit/run.sh
metldr838exploit/appldr-metldrexploit350.elf
metldr838exploit/appldr-metldrexploit350.self

username@ps3:~$ cd metldr838exploit && make
make -C /lib/modules/2.6.38-powerpc64-otheros/build M=/home/username/metldr838exploit modules
make[1]: Entering directory `/home/username/headers/usr/src/linux-headers-2.6.38-powerpc64-otheros'
CC [M] /home/username/metldr838exploit/metldrpwn.o
/home/username/metldr838exploit/metldrpwn.c:512:1: warning: "/*" within comment
/home/username/metldr838exploit/metldrpwn.c: In function "metldrpwn_init":
/home/username/metldr838exploit/metldrpwn.c:807: warning: label "bad5" defined but not used
Building modules, stage 2.
MODPOST 1 modules
CC /home/username/metldr838exploit/metldrpwn.mod.o
LD [M] /home/username/metldr838exploit/metldrpwn.ko
make[1]: Leaving directory `/home/username/headers/usr/src/linux-headers-2.6.38-powerpc64-otheros'
username@ps3:~/metldr838exploit$

executing the exploit:

username@ps3:~/metldr838exploit$ sudo ./run.sh
+ insmod ./metldrpwn.ko
+ cat metldr
+ sleep 1
+ cat appldr-metldrexploit350.self
+ sleep 2
+ echo 1
+ sleep 5
+ cat /proc/metldrpwn/debug
PPE id (0x0000000000000001) VAS id (0x0000000000000002)
lv1_construct_logical_spe (0x00000000)
SPE id (0x0000000000000033)
lv1_enable_logical_spe (0x00000000)
lv1_set_spe_interrupt_mask(0) (0x00000000)
lv1_set_spe_interrupt_mask(1) (0x00000000)
lv1_set_spe_interrupt_mask(2) (0x00000000)
lv1_set_spe_privilege_state_area_1_register (0x00000000)
ea (0xc0000000066e0000) esid (0xc000000008000000) vsid (0x0000408f92c94500)
lv1_get_spe_interrupt_status(0) (0x00000000)
lv1_get_spe_interrupt_status(1) (0x00000000)
lv1_get_spe_interrupt_status(2) (0x00000000)
sleep
lv1_get_spe_interrupt_status(0) (0x00000000)
lv1_get_spe_interrupt_status(1) (0x00000000)
lv1_get_spe_interrupt_status(2) (0x00000000)
out interrupt mbox (0x0000000000000001)
lv1_clear_spe_interrupt_status(2) (0x00000000)
transferring EID0, ldr args and revoke list to LS
waiting until MFC transfers are finished
MFC transfers done
out mbox (0x00000001)
problem status (0x00000089)
lv1_destruct_logical_spe (0x00000000)
username@ps3:~/metldr838exploit$

Thanks to Mathieulh for making it a complete release (including source code, also self/elf files) and the explanation.

[Berion]

I have got the same log except:

ea (0xc0000000066e0000) esid (0xc000000008000000) vsid (0x0000408f92c94500)

mine is:

ea (0xc000000006600000) esid (0xc000000008000000) vsid (0x0000408f92c94500)

And I have no idea what this mean.

[kado]

First post updated with the wonderful tutorial by 'Mathieulh', maybe now some of you can stop the 'bashing', learn some PPC and figure out the rest!

Don't shoot the messanger, or kill the one that 'layed' the 'Golden Egg'.

Now all you got to do is throw the egg into the frying pan, and add in the rest of the 'spices' to make a tasty meal for your PS3.

agree.....

[Berion]

By the way, I've successfully converted my precious one. I'm happy like a little child. ;D

Thanks all for help and all devs who figure out this stuff.