Lots of exciting things happened in the PS3 scene the past few days. The aftermath is that the entire PS3 encryption scheme has been irrevocably cracked and broken, with no possibility of a firmware fix, due to a rookie cryptography mistake made by Sony who is now crying in a corner.

Let’s take a look at the itinerary of events.

The Story

First, a little background.

Sony excluded Other OS (Linux) support from its new PS3 Slim models for unknown reasons. This annoyed some people but did not cause too much stir because hackers who wanted Linux still had their old PS3s.

In his attempt to restore Other OS functionality to the PS3 Slim, George Hotz, a famed iPhone hacker who has a slight ego issue, discovered an exploit in the PS3’s Other OS system that may lead to enabling of piracy. Sony made some legal noise and took the drastic measure of removing Linux support from all PS3 consoles through the 3.21 firmware update. This is illegal in Europe and probably other countries with decent consumer protection laws, but no substantial legal challenges have succeeded thus far. This move also pissed off a lot of hackers who previously ignored the PS3 due to its existing Linux support. George Hotz disappeared like a little girl without releasing his claimed exploit because he was afraid of law suits.

Months later when the uproar had died down, the PS3 was suddenly cracked using a USB exploit by a (presumed-to-be) Chinese hacker group who released the hack commercially as the PSJailbreak. Out of the blue, PS3 homebrew and piracy communities sprung to life. The technique was refined and made open source by various individual and community efforts such as PSGroove and PSFreedom and ported to numerous devices.

However, Sony released the 3.50 and 3.55 firmware to block the exploit. The community remained on 3.41 and no real breakthrough was made after that, with the small exception of a “downgrader” released by the same mysterious PSJailbreak team, which was also subsequently cloned by other jailbreak manufacturers and open sourced. While the downgrader allowed 3.50 and 3.55 firmwares to revert to 3.41 using USB protocols copied from Sony’s official maintenance tools, it does nothing to allow 3.41 firmwares to run new games such as Gran Turismo 5 which are signed by a new encryption key present only in 3.50 and newer firmwares.

The Breakthrough

On 29th Dec 2010, a collaboration of hackers called fail0verflow unveiled a groundbreaking discovery at the 27th Chaos Communication Congress (27C3) hacking conference held in Berlin. By observing files and runtimes in the PS3 using processes made possible by the PSJailbreak exploit, the team discovered that Sony had made numerous mistakes in the design of the PS3’s much-hyped security architecture. You can watch their presentation on YouTube and download their slides here.

Towards the end of their presentation, they revealed the most fatal flaw in the system: Sony had failed to correctly implement the cryptography scheme they used to sign their ELF executables (PS3’s equivalent of an EXE). The encryption scheme required the generation of a new random number each time a signature is created, but Sony’s implementation uses the same “random” number every time. This made it a constant instead of an unknown variable, reducing the number of unknowns from two (private key and random number) to one and making it mathematically possible to derive the encryption keys via algebra, which is what fail0verfow did. They published their method but not the actual keys they obtained through it.

The Keys

Almost immediately after fail0verflow’s disclosure, George Hotz made a sudden grand entrance back into the scene and released the PS3’s metldr keys he discovered by using an undisclosed exploit to dump the “metldr”, which fail0verflow did not achieve, and then applying fail0verflow’s method to recover the private encryption key. I am not completely clear on this part, but I gather that the metldr is some kind of bootloader the PS3 uses to call up the higher-level functions like the Game OS.

The metldr key is a very low level encryption key embedded in the PS3 hardware that can then be used to decrypt higher level keys found in the Game OS firmware that are used to sign actual games. Immediately following this announcement, community members of the PS3 scene used the metldr key to decrypt and post every single encryption keys used in every PS3 firmware version.

The Aftermath

With these keys, it is now possible for anyone to sign any PS3 ELF executable as if he were Sony and there is no reason for any PS3, modded or otherwise, to reject the signed files.

The immediate effect is of course homebrew. Anyone can now create applications for the PS3 and run them without using PSJailbreak.

The next obvious outcome is of course piracy. Since all PS3 games can now be decrypted, it is trivial to decrypt new games such as Gran Turismo 5 using the 3.55 key and re-encrypt them with the 3.41 key so that they can be played on an exploited PS3 running older firmware. Indeed, fixed EBOOT.BIN for the frequently-requested Gran Turismo 5 was one of the first scene releases following the breakthrough.

Going forward, it is likely that the current piracy methods will be greatly streamlined and such manual patching processes will no longer be necessary. This is because the keys allow hackers to decrypt all official Sony firmware updates and use them as the basis for creating custom firmwares similar to those prevalent in the PSP piracy scene. Since these custom updates will be signed with Sony’s official keys, even non-modded PS3s will accept them without complaints. The first custom firmware for the PS3 came out just days later and allows users to install homebrew without using the PSJailbreak exploit.

In the next few months, there will likely be non-stop releases and refinements of PS3 custom firmwares, amazing homebrews (an XMBC port maybe?) and streamlined piracy tools.

An amusing side effect of all these is that PSP’s private encryption keys are also completely exposed and they have been used to implement the HEN exploit on the newest 3000-series and PSP Go hardware running 6.31/6.35 firmware. The keys were presumably being used by the PS3 to play PSP Minis games. Apparently, Sony was very confident of the PS3’s protection scheme.

The Conclusion

For Sony, there is no way to put the genie back into the bottle. The metldr key cannot be revoked through a firmware update and changing it will require new hardware. But a new hardware revision is utterly meaningless, since current PS3 consoles (with their metldr key exposed) must presumably be able to run all future PS3 games and firmwares. As a result, future game- and OS-level encryption keys will forever remain vulnerable to reverse engineering, unless Sony takes the extremely drastic action of breaking games compatibility with current PS3s.

The conventional wisdom has always been that console-hacking is motivated mainly by piracy. This idea is being challenged by the case study of the PS3, a console which remained secured for years despite what we now know is a utterly broken security architecture. The piracy motivation has always been there, but the pirates apparently did not possess the technical expertise needed to make the breakthrough.

The explanation proposed by fail0verflow, which they say apply to themselves, is that highly motivated and technically competent hackers were initially not interested in cracking the PS3 protection scheme because it ran Linux out of the box. Efforts to crack it by capable individuals only began after Sony excluded Other OS from the PS3 Slim and subsequently removed it from all existing PS3s through a firmware update.

Looking at the flurry of activities in recent months, less than a year after Other OS was removed, there appears to be some truth in that explanation.

Sony has completely lost the battle. The war will continue with the PS4.

It’s been just over a month since the sudden debut of the world’s first PS3 mod device. The original release was purely commercial and overpriced (around 150 USD for what is essentially a simple USB development board in a casing), and as a result it was quickly made obsolete by cheaper (and free) alternatives). Still, its spirit lives on in the countless clones that have since flooded the market and we owe the original creators for the breakthrough. If only they weren’t such greedy bastards.

Since the breakthrough, a PS3 homebrew community has blossomed overnight and, though it still has a long way to go, significant progress has been made. It’s really like the early days of PSP’s 1.5 firmware. Here’s a quick summary of the current state of PS3 homebrew.

Jailbreak Method

The method of jailbreaking itself has not fundamentally changed since the original PS Jailbreak was unveiled a month ago. The essential steps are:

1. Have a PS3 (slim or original) with firmware 3.41.
2. Switch off and on the PS3’s main power.
3. Plug in the jailbreak USB device (this comes in many possible forms).
4. Press the PS3’s power button followed immediately by the eject button.
5. Jailbreak device does its magic.
6. PS3 starts up in debug mode, allowing you to install and run all unsigned code.

The general idea is that Sony uses a proprietary dongle to repair and reflash bricked PS3s at their service centres, much like the Pandora battery for PSPs. The PS3 looks for such a dongle when the eject button is pressed immediately after powering on. The role of the jailbreak device is to emulate a USB hub with a USB device plugged into it that shares the same device ID as Sony’s service dongle. It doesn’t actually work as a service dongle, but it uses this access to execute some exploits that put the PS3 into debug mode. The exact payload used is described here for those who can understand it.

The jailbreak device itself has grown to include a whole variety of reprogrammable USB devices thanks to the PSGroove and PSFreedom projects. The list of compatible devices include:

• Nokia N900
• Palm Pre
• Archos 5 IMT
• Dingoo
• TI-84+ calculator
• iPhone 2G and 3G and iPod touch 1G
• MP3 players running Rockbox
• Various Android phones, including the major ones like Droid, Hero, Desire, Legend, Dream, Nexus One
• Various USB development boards, including Teensy, AT90USBKEY, Minimus AVR USB

This is of course not an exhaustive list. In addition to homemade solutions, there are various dedicated jailbreak devices, some of which are reprogrammable with a PC, such as PS3 Key and X3 Jailbreak.

Running the Jailbreak (TI-84 Plus)

I am using a TI-84 Plus because it’s the only compatible device I have on hand. I’ll probably be getting a dedicated dongle (PS3 Key in my case) soon because it’s somewhat troublesome to run the corresponding programme on the calculator each time I start up my PS3, plus the calculator requires four AAA batteries… Here’s how the process looks like:

Run the installed programme on the TI-84+

Ready to switch on PS3

Eject button pressed

Debug mode enabled, allowing you to install arbitrary .pkg files

A FTP server for managing files on the PS3’s internal HDD, an example of a homebrew currently available

Backup Manager

Let’s face it: most people who jailbreak their PS3 are going to play pirated (“backup”) games. The Backup Manager is the tool that lets you do that. Indeed, it was the very first homebrew released for the PS3 and it was made by the original creators of the PS Jailbreak.

Backup Manager, used to rip and load games off internal or external HDDs

That said, there are some very compelling legitimate reasons to use the Backup Manager over Blu-ray. Loading games off the HDD is many times faster than loading games off Blu-ray. The reduced load-time is especially noticeable in games like Bayonetta which suffer from extremely long loading screens. Loading a stage in Bayonetta from the internal HDD takes less than 10 seconds. Using the Backup Manager also reduces wear and tear of the Blu-ray drive. Given that DVD drive failure was the number one cause of PS2 mortality, this is an attractive advantage.

The Manager works by ripping wholesale the entire folder structure on the game Blu-ray disc onto either the internal HDD or an external USB HDD. This means that it will not produce an ISO image, but rather a folder of files and subfolders. There is currently no way to run a game off a Blu-ray ISO image, which is encrypted.

Backup Manager menu. Note the lack of unicode support resulting in Tales of Vesperia having a blank title (still works otherwise)

Upon loading a game, the Manager exits to the main menu. The current game disc is replaced by the loaded backup, much like in very early UMD loaders for the PSP

The PS3 does not support NTFS for external media and only accepts FAT. Since FAT only supports files up to 4GB in size, this may be problematic. However, since the Manager rips games into folders instead of a single ISO image, this is only a problem if the size of a single file in a game exceeds 4GB (usually a movie file) and it is not as common as you may imagine.

The PS3’s proprietary internal file system supports files of any size (at least for current-day purposes) and therefore has better compatibility with games. This serves as an incentive to upgrade your internal 2.5″ HDD. Furthermore, loading games off the internal HDD is significantly faster than loading games through the USB interface. The internal HDD also has better games compatibility, no doubt as a result of the difference in load time. A comprehensive list of compatible games can be found on Google Docs.

The first release of the Backup Manager requires any legitimate Blu-ray disc to be in the drive in order for backups to work, much like the first-generation PSP UMD loaders. A new release removes this requirement but appears to have poorer game compatibility.

Homebrew

Currently, the PS3 homebrew scene is still in its infancy. There are no comprehensive development environments or programming guides available and development is largely carried out by dedicated long-time veterans in the console homebrew community. The use of Sony’s official development kit to compile homebrew programmes also brings legality into question.

But still, impressive progress has been made in the span of one month. There are various proofs of concept such as Pong, a port of SNES9X SNES emulator, a port of NullDC Dreamcast emulator, a port of Yabause Saturn Emulator, a file manager, an FTP server, and various tools for PS3 development such as a registry editor.

The FTP server in particular is a god-sent because it allows direct access to the PS3’s internal HDD.

blackb0xâ€s FTP Server running

PS3’s root folder accessed using Filezilla

Folders containing ripped games

I suspect the next homebrew breakthrough will be a full Linux distro. Sony previously removed the PS3’s OtherOS Linux support in firmware 3.21 due to concerns over Linux being used as a potential vector for exploiting PS3’s anti-piracy protection. This pissed off a lot of people who actually used the OtherOS for things like distributed computing. I am sure a successful Linux port would be too delicious an “up yours” for the dedicated hackers out there to ignore.

The Future of PS3 Jailbreak

Current jailbreak solutions offer no fundamental improvement over the original PS Jailbreak. The exploit used only works in PS3 firmware version 3.41 and older and no new exploit has yet been uncovered for firmwares 3.42 (which was released with the sole purpose of blocking the exploit) and 3.50 (which went one step further by blocking all unauthorized USB devices, including unlicensed third-party controllers).

Much like the early PSP homebrew scene’s reliance on PSP firmware 1.5, current PS3 homebrew development appears to be confined to 3.41. This problem was solved for the PSP with the discovery of new buffer overflow exploits in later firmware revisions and eventually by the Pandora battery hardware solution and the development of custom firmwares capable of spoofing official firmware versions. There is no guarantee that the same will happen with the PS3 due to the complexity of its hardware, but there is no indication that it is impossible either. We can only wait and see.

PS3 Key, one of the more reputable jailbreak solutions currently available

For now, using the Backup Manager and homebrew solutions requires that you do not update your firmware beyond 3.41. This means that you will not be able to log on to PSN, but your PS3 can remain connected to the Internet as long as you disable auto-updating. Games released after September will also start to require firmware 3.42 or newer, which will pose a problem if no solution is found in the long run.

The Xbox 360 and Wii were successfully modded a long time ago and both have now developed more sophisticated jailbreak solutions than the initial exploits. If the same applies for the PS3, future developments will likely see the release of firmware loaders that allow the user to switch between different firmware revisions or custom firmwares that are capable of fooling the PSN and version-checkers that come with games.

However, there is no guarantee for this due to the PS3’s notoriously complex Cell architecture and the fact that it took three years to even produce one viable exploit. On the bright side, should such a solution come to be, most current jailbreak devices are easily re-programmable using a PC and you won’t have to pay for new mods.

Conclusion

I’ve been following the development of the PS3 jailbreak since the first batch of working samples was quietly mailed out to modchip vendors by the secretive people behind PS Jailbreak and subsequently reverse engineered by the community. This article serves as a summary of all the important milestones that have transpired so far.

If you are looking for a more instructional article, please look through PS3 Hacks or PSFreedom.

This has huge implications for anime fansubbing. For good or for bad.

But first, let’s take a huuuuge detour and look at a little comparison between fansubs and official DVD releases…

Speed

Fansubs have always been faster than commercial releases. Even if a show was pre-licensed and released with subtitles only, physical distribution just can’t beat BitTorrent.

Fansubs win by a wide margin.

Quality

Fansubs appear to have the upper hand with their fancy karaoke effects and typesetting, but in reality commercial translations are of significantly higher value. Personally, I would rather have professionally translated and edited subtitles than colourful effects. Official translations are done with the original script on hand, which makes a lot of difference compared to me translating Happiness! by ear.

Of course there are exceptionally good fansub translators, such as crustol who used to translate for AnimeOne, but they are extremely rare because if you are that good, you are usually getting paid to translate. Watching Triad’s Nanoha reminded me of just how bad fansubs are…

DVDs win. But I guess some people, such as Doremi fanboys, don’t care about translation quality. :P

Price

R1 DVDs are certainly not as overpriced as their R2 counterparts, but even factoring in the manufacturing cost, quite a huge portion of the price tag goes into overheads (wholesalers, retailers, transport…). Fansubs, like all other forms of piracy, are not exactly free. There is a moral cost involved which is dependent on your conscience and a risk cost involved which is dependent on your country’s copyright enforcement. Generally speaking, most fans want to support their favourite series and in that sense official DVDs have the advantage of providing a warm and fuzzy feeling after you purchase them…until you look into your emptied wallet.

It’s hard to compare this, so I have come up with a brilliant formula instead.

Makes no sense? Well I thought so…

To put it simply, fansubs are not free because money is not the only cost involved. However, fansubs generally still enjoy a “price” advantage because we are all heartless pirates and Big Brother has more things to worry about than cartoon pirates. Unless of course you live in Singapore. Ops.

Conclusion

Commercial releases are of higher quality than fansubs, (again, unless you live in Singapore. Ops.) but physical distribution is the fail. The only reason people like me buy DVDs is for the extras that come with the limited editions, which defeats the point of having DVDs at all.

In this age where data can be copied as many times as desired for almost no cost, it’s only a matter of time before the death of physical media arrives. Well, except for books because they provide a significantly different experience than from reading an e-book, whereas watching anime off a DVD or an exact digital copy makes zero difference to the viewer. So books are safe, that is of course until digital paper technology is perfected.

iTunes recently overtook Amazon as the 4th largest music retailer in USA. It’s only a matter of time.

What about anime?

It’s not going to happen overnight, but eventually the best model for the anime industry (at least IMO) is to legally distribute the anime episodes themselves as cheaply as possible to an audience as large as possible over the Internet, and then make a killing off selling merchandises (i.e. things that still hold meaning because they cannot be digitized…yet). It’s like how non-label bands give away their songs for free online and make money by holding live concerts and charging people $5 for a can of Coke.

By switching to digital distribution, the speed advantage of piracy is automatically gone. Commercial releases will still enjoy the advantage of higher quality. Because the overheads associated with physical distributions are gone, the price will be low enough (with a little push from fanboyism) to “underprice” the guilt+risk factors involved in piracy.

Now if only someone would take the first step…

…Or did Viz already?

I believe in a digital future. :P

It seems like Bandai has been getting a lot of, to misuse tj han’s term, “negative energy” recently for the whole Solid State Society fiasco. Some people see my latest rant on the Long Tail phenomenon as an indirect attack on Bandai.

The truth is, as hypocrite as this may sound considering my rant on the Wind incident, I support Bandai in its business decision to protect its profits. Bandai exists not to spread the love for anime but to make money. Popularizing anime is one of the ways through which Bandai can make money but the difference between an end and a mean to an end must be made clear.

It does not serve Bandai’s purpose as a company responsible to its investors to continue to turn a blind eye on fansubbers, especially for its most popular franchises.

It’s illegal. GASP!

First thing first, fansubs are illegal. There is no possible defence. Most of the world belongs to the Berne Convention that establishes the shared international laws of copyright. All rights of all works of any value, monetary or otherwise, belong to their creators unless the creator explicitly releases it to public domain or a set time period has elapsed since the creator’s death.

These rights include the right to translate the work, the right to distribute the work and the right to make derivative works based on it. Fair Use is a clause to grants very limited rights to people to use very limited portions of a copyrighted material for special purposes such as education. You can quote a line from a novel in your school essay without seeking permission from the author. You can watch a DVD with your friends without buying a copy for every one of them. If you translate a movie for your friends and families, then it can probably be considered Fair Use. But once you start distributing the translation online in great numbers, good luck trying to convince the judge/jury (depending on your country).

Fansubbing has nothing to do with Fair Use. Fansubbing is illegal in all countries except certain African states and Pacific islands that you are most likely not living in if you are reading this entry. There is no “grey” area with regards to copyright laws and fansubbing.

That said…

However, fansubbing does have (or did have, if you ask certain experts on the subject) a very special difference from bootlegging and piracy in general.

Fansubs are created for people who fall outside the target audience. As mentioned in my arguments on Wind, fansubs serve to create new markets where there were none. This should always be the main purpose of fansubbing: to induce more fans into the hobby.

The purpose of fansubbing was never to let you “try before you buy” or get things for free if you don’t think they deserve your money. When you think that way, you are basically admitting the fact that those things are available in your local market and they are being sold with you as the target audience. That means that fansubbing, by that stage, has already lost its original meaning: to give us access to shows that have excluded us from their target audience. Because now we ARE the target audience and yet we choose to download pirated copies citing the same reasons that I have heard a million times before in the warez scene long before digital fansubbing took off in the Love Hina era.

It’s more convenient for us to download a fansub than to buy a physical DVD, I agree. That is a limitation of traditional distribution that has to be re-examined by the industry soon. But that does not grant us the god-given right to download and watch fansubs faster than the companies can bring them over to the English-speaking world.

The state of fansubbing

The truth is that fansubbing in America today plays a terribly minute role in promoting new anime series. It probably does a better job at promoting piracy.

Unlike the underground anime fandom of the last century and the ren’ai game community of now, anime has already achieved the amount of success needed to guarantee its continued survival and growth in North America. Fansubbing will occasionally create success stories of an obscure anime title being brought to fame by the internet, but that’s simply insignificant when you compare it to the market that Bandai, ADV and Geneon are enjoying right now. They don’t NEED fansubs.

Pulling statistics out of my ass (actually I think I read this somewhere before), only a very tiny portion of American fans was introduced to anime by fansubs. The anime on TV, the HUUUUUUUUGE variety of anime DVDs and manga you get in stores and the various major anime conventions held in America, those things do a LOT MORE to help promote anime than fansubs are doing now. Clearly, fansubs, at least for the anime market, are losing their original purpose of promoting anime. Without that purpose, fansubs are no different from bootlegs of Hollywood movies.

And indeed, Ghost in the Shell, along with most of Bandai’s portfolio, DO NOT need fansubs. Bandai is well-established in North America and Ghost in the Shell is already very popular there due to the previous titles in the franchise. The very same titles that you can just waltz into a store and purchase, i.e. they are marketed at you! GASP!

Bandai doesn’t need fansubs!

What can Bandai hope to ever gain if it allows fansubs for a series that was created with the obvious intention of being brought over to North America? NOTHING! So what if it appeased a few “fans” who absolutely must watch the series within two days of its Japanese release? There’s no guarantee that the fansubs will reach a bigger North American audience than what the series is already reaching. The only guarantee is that there is now a free and easily-available bootleg copy of the series before it has even been released in the North American market.

If you want to “try before you buy”? Go watch it on cable TV! I bet it’ll be there. You Americans have it all so good but yet you demand for more. There are anime that were created with YOU in mind. Just look for those sponsored by Geneon.

“I want my anime now!” Well it’s not YOURS, it’s BANDAI’S. Shut the fuck up and wait for it.

If you plan to download Solid State Society like I will be doing, please at least admit that you are a pirate. I download pirated games and movies all the time too. But it just sounds terribly silly if you start calling foul when the company tells you to stop pirating. :) Stop pretending to be fighting the good fight, it’s not the 1990s any more.

Repeat after me:

We are just selfish bastards who want to watch anime for free and we have no right to whine if Bandai chooses to do something about it.
We are just selfish bastards who want to watch anime for free and we have no right to whine if Bandai chooses to do something about it.
We are just selfish bastards who want to watch anime for free and we have no right to whine if Bandai chooses to do something about it.

In conclusion

There is a huge difference between fansubbing an obscure eroge-based anime that would never have had a 1/100000 chance of being released for the North American market and fansubbing a series that is pre-licensed and obviously made with the North American market in mind.

Doing the former produces the occasional success stories like KimiNozo (aka Rumbling Hearts).

Doing the latter pisses off the hand that feeds you.

Just some thoughts from a disillusioned ex-fansubber.

[audio:dontdownloadthis.mp3]

You can download a higher quality version of the song from http://www.dontdownloadthissong.com

Now excuse me while I go rob a liquor store while selling crack and running school kids down with a car. :P

Anyway, before you go wtf over it, it’s a joke. Weird Al is not the latest propangada machine of the RIAA. In fact if you visit his MySpace page, you’ll be able to play and download his song “You’re Pitiful”, a parody of the popular “You’re Beautiful” by James Blunt.

James Blunt gave his approval for the parody but his record label didn’t. Weird Al decides to screw the suits and release the song for free through the internet.

“I have a long-standing history of respecting artists’ wishes,” Yankovic writes. “So if James Blunt himself were objecting, I wouldn’t even offer my parody for free on my Web site. But since it’s a bunch of suits — who are actually going against their own artist’s wishes — I have absolutely no problem with it.”

And that is an artist that deserves respect.