The metldr key does break the console's security even more (especially with respect to newer, future firmwares - and thus also piracy of newer games), and also makes some things require less workarounds. He has released the metldr keyset (with the private key calculated using our attack), but not the exploit method that he used. Then Geohot announced that he had broken into metldr (with an exploit, analogous to the way we exploited lv2ldr to get its keys) and was thus able to apply our techniques one level higher in the loader chain. The root of all of the aforementioned loaders is metldr, which remained elusive.

Basically, homebrew/Linux on every currently manufactured PS3, through software means now, and through hardware means (flasher/modchip) forever, regardless of what Sony tries to do with future firmwares.

And since the revocation is useless and the lame 'anti-downgrade' protection is also easily bypassed, this already enables hardware-based hacks and downgrades forever. With these keys we could decrypt firmware and sign our own firmware. We didn't have lv1ldr, but due to the way lv1 works, we could gain control of it early in the boot process through isoldr, so effectively we also had lv1 control. We could've obtained appldr, (the loader used to load games and apps), but chose not to, since we are not interested in app-level stuff and that just helps piracy. We used these techniques to obtain encryption, public, and private keys for lv2ldr, isoldr, the spp verifier, the pkg verifier, and the revocation lists themselves.

A humongous screwup by Sony, enabling us to calculate their private signing keys for all of those loaders, and thus sign anything to be loaded by those loaders.

An exploit in the revocation list parsing, enabling us to dump a bunch of loaders, and thus their decryption keys.

We (fail0verflow) discovered and released two things:

Jailbreak a ps3 4.81 redmond