So still, if I understand correctly, CFW does not need to run an exploit every time the console is booted, it's just signed with Sony's cracked keys and one of the loaders loads it thinking it's official.
Yes, we are booting with the official bootldr/metldr combo (because we cant modify them), but the files loaded by metldr (lv1ldr, lv2ldr, isoldr, appldr, rvkldr) have some custom patches applyed permanently and are encrypted with a valid key
Noice that brings more to the table for EvilNat CFW
Any chance that there will be public tools to use on HFW super slims for that? I'm willing to take a risk for my super slim. If not that's fine I request though at least a way for me to patch for CFW super slim on my NOR model on DMs. Or.. just access my files
Thx for the offer, but there is not anything to test, i dont know about any progress related with that, the problem is lv0 always was (and still is) fully secured
Think in it this way, originally it was doing something like this: step0--->step1--->step2 at some point they realized there was a security flaw in step1 so they "stepped back" and did this for superslims: step0-->step2
You know... step1 is still there (inside step0) but we cant take a look at it
In some of the posts i wrote in this thread (i realized was years ago, before the syscon was hacked) i was speculating with syscon because there is an abstract concept (composed by software + hardware) named "config ring" mentioned in this wiki page
https://www.psdevwiki.com/ps3/Boot_Order that is very important in the boot process
Basically... think in it like a BIOS of a PC, where is needed to configure a lot of hardware components of the motherboard (CELL, RSX, SB, HDMI, DVE, etc...), the frequencies of the data buses in between them, voltages, and tenths of other details
This process happenes before any other "stage" of the bootchain is loaded... and is a bidirectional communication in beteeen CELL and syscon (and flash through SouthBridge to retieve the bootloader data), but is coordinated by syscon
Actually, if you read the wiki page "from top to bottom" you are going to realize the syscon chip is the "boss" of the motherboard, because is responsible of switching a voltage regulator to "feed" CELL, configure and initialize it
Long story short... to hack in the confing ring we have 3 options:
-Find a exploit affecting the CELL arquitecture by IBM (the probability for this to happen is very low, or zero)
-Find another flaw in the lv0 security (something similar to the metldr exploit, but after all this time passed the probablity seems to be low too)
-Use syscon as a weapon !!!
The good thing is syscon was hacked, and its firmwares dumped etc... now there are a bunch of skilled hackers (not me) that are able to take a look at how that "config ring" works.... and (with a bit of luck) eventually someone could find a new hack (the "config ring" is the deepest level of the boot process)
