Kingdom Hearts: Birth by Sleep - US - ULUS10505

[Hykem]

I doubt the original boot chain loader knows this kind of file, so the loader can be retrieved and the decryption keys can be found somehow. It just need some RE work...

Indeed.
I've already done some research on this and thanks to Mathieulh and Silverspring's recently posted findings (http://www.wololo.net/talk/viewtopic.php...190#p20715 and http://www.wololo.net/talk/viewtopic.php...300#p23979 ), it's quite possible that the latest firmwares employ a very similar scheme as the one used to generate and verify the IDStorage keys' signature during the IPL stage, but this time to encrypt/decrypt other things too (firmware modules, DRMS like Mathieulh mentions in one post).
This now involves reverse engineering KIRK CMD's 0x11 and 0x12, which should now be called from the new loader with a specific structure as header to process the firmware's modules decryption.