forums.ps2dev.org

bestnoob · Joined: 12 Jun 2005 Posts: 1

Hi guys,

Please no flaming, I have read most of this forum this morning and wanted to ask few questions to start on the right direction.

I have seen that all games have in the SYSDIR directory both a EBOOT.bin and a BOOT.bin.

1/ Is EBOOT.bin the encrypted version of BOOT.bin?
2/ If it is why would Sony include both on a disk?
3/ Having both the plain text and the cypher text how difficult is it to brute force both AES and the signature process private keys?

Edit1: 3/ => Ok I have read more about AES, the steps are quick and easy but even an early out would take considerable amount of time. Even if 128b seems small, parsing each combination at every 1 cycle would take > 2^96 seconds on a 3Ghz machine :)

Edit2: 2/ => AES is robust to such sort of attack, DES needed more than 2^43 cypher/plain couples to reduce the complexity, it is believed that AES needs even more, so unless Sony release 2^43 different games on the PSP there is no chance it will break this way, so Sony do not make their system less robust this way. However the question remains, is it there for future compatibility and for consoles that could only run unencrypted Boot.bin in case they change the public/private keys?

Edit3: I just realized that AES is symmetric since Sony are not complete idiots they must have used a random key for every game, key encrypted with their private RSA key. Encryption is just a smoke screen to stop us for a little while but when it will be cracked it will be for ever. This does not solve the problem though since we will not be able to sign executables.

boot.bin might not even be a decrypted version of eboot.bin but just a decoy left there by Sony. Am I over estimating Sony guys? :)

Bestnoob

TRF-Yu-Ki · Joined: 08 Jun 2005 Posts: 15

First off, let me say good job for doing the research. This is much better than the posts like:

"Hey hackers, how about you just reverse-encrypt, get the keys, and encrypt again? I wanna play my SNES games on my PSP 1.5 already!"

NOTE: I purposely said reverse-encrypt instead of decrypt. ;-)

Anywayz, personally, I think the secret here is not to attack the encryption directly. I've seen VeriSign/RSA stuff used in different forms, and encryption that's pretty much time-tested stuff(like PGP) is basically invinsible against today's home PCs/MACs. Your research definitely shows that it's not some simple XORing bits like Microsoft does with certain passwords in the registery. ;-) Unless some game-dev'er accidentally leaks a private-key to a game, I'd leave the encryption defense alone. >_<

But keep working at it. :)
_________________
Learning to hack is not bad in itself; it's what you do with your abilities that count. - a.k.a. Shadow-Me-Twice of ddrfreak.com

Shine · Joined: 03 Dec 2004 Posts: 728 Location: Germany

Agoln · Joined: 08 Jun 2005 Posts: 326 Location: Fort Wayne, IN

TRF-Yu-Ki · Joined: 08 Jun 2005 Posts: 15

Yeah... I just said that for people who don't understand anything about (strong)encryption. =^P
_________________
Learning to hack is not bad in itself; it's what you do with your abilities that count. - a.k.a. Shadow-Me-Twice of ddrfreak.com

StriderA · Joined: 15 Jun 2005 Posts: 9 Location: Pope AFB, NC

Too many people believe in a do_magic(); function that just does all the hard stuff for us. Maybe when we can get to quantum computing will decrypting and finding the private key for the signing of the code be possible, but by then, I'm sure the PSP will be so obsolete that the next systems will blow our mind. Oh well... just be warned...

Never underestimate the power of stupid people in large numbers. :)
_________________
Lost in a thought, found in a dream.