forums.ps2dev.org

crispie · Joined: 29 Feb 2004 Posts: 4

http://geohotps3.blogspot.com/

androvsky · Joined: 11 Nov 2007 Posts: 33

I've been following this. Some of his assumptions contradict what little I recall of Cell security, but I could easily be wrong.

I'm guessing he's reading and writing memory from an external FPGA wired into the memory bus... assuming that's possible. But he's assuming that by playing with hypervisor calls he can somehow shut down the isolated SPU from the PPC and then run unsigned code. Seems unlikely to me.

jimparis · Joined: 10 Jun 2005 Posts: 1179 Location: Boston

He says the hardware is simple, so I doubt he's directly reading/writing the XDR (at an effective 3.2GHz clock, a Spartan-3 probably couldn't do that anyway). I imagine it's some simpler glitching he's doing -- for example, just overwriting a particular bit while watching the initial configuration over the SPI bus, or similar. Still, I can't imagine that the Cell security would fall to something like changing RAM contents. Although Sony has made worse mistakes, so who knows.

It's been discussed here before, but I think a big reason the PS3 hasn't been hacked earlier is not only because of the increased security of the system, but also because Sony already gave us a large portion of the access we wanted through the OtherOS facility. But now that OtherOS is gone in new models, George Hotz is claiming success, and techniques for HD decryption are now public, it sounds like this might start to change...

TyRaNiD · Joined: 18 Jan 2004 Posts: 918

Of course if Sony have done their job correctly then breaking into the HV in otheros mode gives you little, but no doubt they haven't done their job ;)

IronPeter · Joined: 06 Aug 2007 Posts: 207

It is "hv call table" from geohot:

http://2.bp.blogspot.com/_NJ4JFBfr1tY/S1ufqZiXH8I/AAAAAAAAAbY/k2qztNwQhy4/s1600-h/hvcalls.PNG

compare with

http://wiki.ps2dev.org/ps3:hypervisor

The only difference i can note - many hv calls are copies of lv1_allocate_memory (it is new fact and can be easily checked). No other new info.

Is it possible to find names like "lv1_undocumented_function_xx" or "invalid_hypercall" in the debug info? Symbols must be stripped from lv0 code.

I am not sure, is that table handcrafted or actually taken from debug info.

jimparis · Joined: 10 Jun 2005 Posts: 1179 Location: Boston

The lv1_mm_calls aren't identical. For example 0=lv1_allocate_memory and 6=lv1_query_logical_partition_address_region_info, but they're both lv1_mm_call in geohot's image.

jimparis · Joined: 10 Jun 2005 Posts: 1179 Location: Boston

Also

135, 136, 231 are "lv1_mm_call" in PNG and "undocumented" on wiki, maybe they're interesting
233 is "undocumented" in PNG and not listed in wiki

otherwise they match up, in some cases the wiki has functions named where the PNG does not.

KriS · Joined: 13 Nov 2009 Posts: 6

IronPeter · Joined: 06 Aug 2007 Posts: 207

Hmm... yes, really.

Probably, lv1_mm == lv1_memory_management?

Does hypercall know about its index in the interrupt table? Can that table contain one pointer many times?

If no, that picture is just blue-white-black paintwork.

KriS · Joined: 13 Nov 2009 Posts: 6

More info about Geohot and PS3 on BBC news.

"In particular, he said, he would publish details of the console's "root key", a master code that once known would make it easier for others to decipher and hack other security features on the console."

semitope · Joined: 27 Jan 2010 Posts: 1

Doubting what a hacker can do based on reading about the system is so funny. Unless you have hardware on your ps3 and are digging into it as well I don't think you really can comment on what he can or can't do. All you have is a theory of how it is supposed to work.

Someone on http://forum.beyond3d.com/showthread.php?t=56284&page=5 linked to this forum. Glad to see that there isn't the crazy misinterpretation of what Geohot says as there is in there.

When he says the spus are stopped he meant they were idle, not disabled. If he says he can kick a SPU, I am going to have to believe he can. He also posted those calls because he was showing he got them from the system itself which I doubt is what was initially done. Its basically like saying "this is how someone drives" vs seeing someone driving while in the car and documenting what they do

allanl1234 · Joined: 28 Dec 2009 Posts: 4

Interestingly, this is Geohots comment on accessing the RSX from OtherOS:
"And actually, the RSX being restricted is just theory as far as I know. OtherOS under the hypervisor may have the access required to write a 3D driver, just no one wrote one."

Arwin · Joined: 12 Jul 2005 Posts: 426

allanl1234 · Joined: 28 Dec 2009 Posts: 4

That's what I was thinking, too.

jimparis · Joined: 10 Jun 2005 Posts: 1179 Location: Boston

jimparis · Joined: 10 Jun 2005 Posts: 1179 Location: Boston

lotharx · Joined: 16 Jul 2008 Posts: 24

He did it by flooding htab then sending a call after a simple hardware glitch, he published everything. He made a peek and poke for real addresses too including the supervisor LPAR.

Devs here I know can't use it because it isn't what Sony gave them(no "clean room"). It doesn't violate DMCA or EULA though..

Slim is also vulnerable to this by the way you just have to do it on bus with complex circuitry because of RF.

Here is the code part http://pastie.org/796066

Warren · Joined: 24 Jan 2004 Posts: 173 Location: San Diego, CA

How can you claim that the Slim is vulnerable to this when it doesn't have OtherOS?

laichung · Joined: 06 May 2005 Posts: 123

lotharx · Joined: 16 Jul 2008 Posts: 24

laichung · Joined: 06 May 2005 Posts: 123

ouasse · Joined: 30 Jul 2007 Posts: 90 Location: Paris, France

Geohot released his exploit. It needs some hw tweak such as a pic for now. As the instructions say:

ssidx · Joined: 27 Jan 2010 Posts: 1

So, with this exploit, you can alter data from GAMEOS in run-time? Outputting 'Hello world' in GAMEOS, for example. Or do you require a software exploit for that?

cheriff · Regular Joined: 23 Jun 2004 Posts: 262 Location: Sydney.au

jimparis · Joined: 10 Jun 2005 Posts: 1179 Location: Boston

ps2devman · Joined: 09 Oct 2006 Posts: 265

George Hotz now points to an 'explanations' article

http://rdist.root.org/2010/01/27/how-the-ps3-hypervisor-was-hacked/

He even commented it with its own photograph (for sure he's young!)

jonwil · Joined: 12 Nov 2007 Posts: 18

Now that we can dump the hypervisor and reverse engineer it, does that mean we can search the undocumented HV calls for the (rumored to exist) GPU setup calls we need for full GPU access?

cheriff · Regular Joined: 23 Jun 2004 Posts: 262 Location: Sydney.au

lotharx · Joined: 16 Jul 2008 Posts: 24

TyRaNiD · Joined: 18 Jan 2004 Posts: 918

So if the geniuses outside "this" community knew about it the whole time then where is my accelerated graphics? After all it is easy to say that something exists but I have never seen any proof that anyone else has giving out any information on how to use it.

And I don't think people here just wanted to port existing drivers to it, but why not if something is sufficiently similar why would you not do so. Like most NVidia hardware (well perhaps worse than usual) hardware level documentation is sketchy at best and consists in many cases of either NDA'ed information (which cannot be used in public/free sources) or reverse engineered information which has a habit of being sometime inconsistent. Coupled with the general lack of interest in "hacking" the PS3 in the wider community obviously no-one cared enough to do deep, time consuming work in this field. But I guess people here obviously are crap. So what is it you have done again?