PlayStation 3 researchers have recovered a per-console key used by lv0ldr, one of the earliest pieces of software loaded when the system starts. The result exposes another part of Sony's boot-security chain and could eventually help developers bring full custom firmware to later Slim and Super Slim consoles that still cannot run it.
That possibility remains future work. The researchers demonstrated recovery of an lv0ldr body key on a CECHL-series PS3, not a ready-made jailbreak for every model, according to VideoCardz's report and zecoxao's technical write-up.
A key left behind in the Cell processor
Lv0ldr checks and decrypts important system software before the rest of the PS3 operating system loads. Its per-console key is normally kept inside a protected area of the Cell processor and is not available to ordinary software.
The research team first extracted and analyzed the Cell's Synergistic Processing Unit, or SPU, ROM. That code handles AES operations for lv0ldr and another early loader called metldr. Researcher jestero then found that SPU registers could preserve values across repeated executions instead of being completely cleared.
Register 7 was especially useful because the boot code used it during AES key expansion. By interrupting cleanup at the right moment and reading the retained value, the team could work backward to derive the lv0ldr body key and a related authentication key. Zecoxao credits a wider group of PS3 researchers whose earlier work on system-controller firmware, diagnostics and QuasiCFW made the attack practical.
No all-model jailbreak yet
Older PS3 systems can already run full custom firmware, which gives owners deep control over the operating system. Later Slim 3000-series and Super Slim models changed the boot process and have remained incompatible with that traditional approach.
The newly recovered key material may eventually let developers encrypt and sign modified early-loader code, but more work is required before that becomes usable across later hardware. There is no downloadable jailbreak or finished custom-firmware release based on this research.
The work may also matter to repair shops and preservation projects. Zecoxao says the same access could help unbrick damaged systems, work around failed Blu-ray or Wi-Fi hardware, and pair replacement components when the necessary console-specific keys are available.
