Right Let's Try This Again: PS3 Hypervisor Hacked

androvsky said:
Holy crap. So basically, "I've done nothing that wasn't possible before, except allow an RSX driver to be written for linux. Which was probably already possible." Am I reading that wrong? If the routine for shutting down the isolated SPE was accessible at the linux kernel level, it's probably not very useful from an exploit point of view.
Click to expand...

Pretty much.

"Oh hai guyz, I haz hacked PS3, took 5 weeks only lulz"
" oh noez wait, I don't haz the codes. AND IT'S FUCKING C++"
"Booh, oh well I'll play with otherOS now, forget the hack. Well, I could release what I have, but what's the point, righ- oh wait I have full GPU access with Linux!!1!&1§ ... but no driver"

I think he should just quit posting his "updates", and either go back to work, or admit that PS3 is no cell phone.
 
gofreak said:
I dunno if I'd be so quick to close the lid on this.

I mean he says he got custom hypervisor calls working, right?

Is this not significant? It does the beg the question why he doesn't do something interesting in a custom function (vs just observing memory or writing to it...things he could do without the custom functions), but still...

(Maybe someone else can fill us in on the significance or insignificance of that)
Click to expand...

I agree.

Lets wait and see.

The people dismissing this 'hack' are almost as bad as the people accepting it as fact.

Official documents, don't prove that this hack is 100% useless because it's a hack or exploit.

What I mean by that is, if this hack has any truth or significance to it, the official docs will be useless regarding this hack because he's managed to do something you can't normally do.

That's the way I see it anyway. Sorry if I'm wrong.
 
gofreak said:
I dunno if I'd be so quick to close the lid on this.

I mean he says he got custom hypervisor calls working, right?

Is this not significant? It does the beg the question why he doesn't do something interesting in a custom function (vs just observing memory or writing to it...things he could do without the custom functions), but still...

(Maybe someone else can fill us in on the significance or insignificance of that)
Click to expand...
well, if i understood it right - and i really don't remember the difference between cell's ppus, spus, spes and whatever - the blog dude who discredited geohot said that the root key can't be retrieved by hardware or software, and that at best he'd be able to copy encrypted data from the spe.

so, the data he could get would be encrypted by a key he can't retrieve. and he hasn't even gotten that data yet, it seems. that's disregarding the possibility of a vulnerability somewhere, of course.

even if this guy doesn't find anything, i think he's gotten enough attention to how hard hacking the ps3 is, which is actually bad for the ps3's security. hackers like the challenge of breaking the "unbreakable", so i think this'll get more people with skills interested. although, it also seems sony/ibm are pretty confident in their architecture, so maybe it won't be hacked anytime in the next couple of years
 
Cruzader said:
Sounds like good news. I might get flamed but I'd rather PS3 not get hacked. This is solely my opinion so dont start to bash me. Theres ppls on both sides.
Click to expand...
Nah man, I'm the same. I mean I'd love for an iso loader off HDD, but in the end I'd like my PS3 to stay pure and just hope Sony comes up with some installation method sometime in the future
 
This is worth posting, for anyone familiar with the figures in the PSP scene. It's a few days old, but still relevant in wake of everyone dismissing the hack.

http://www.maxconsole.net/?mode=news&newsid=38360

Well known PSP hacker and Dark_Alex's right hand man previously 'Mathieulh' has confirmed to us that Geohot's PS3 exclusive is indeed the real deal. He didn't want us to publish exactly why he knows it is the real deal, but let's just say he has some first hand evidence ;).
Click to expand...

Mathieulh and Geohot were going back and forth in his early blog posts, so I'm assuming they probably hooked up offsite to go over how far Geohot had gone.
 
This is all interesting ...

Glancing over the Cell security stuff, the root key is stored in hardware and cant be accessed . The decryption happens on a hardware level on an isolated SPU, which again you cannot access, even if you could you'll just find a bunch of encrypted binaries.

Geohotz or whatever his name is states it doesnt matter because he can just drop that SPU. But if he drops it that means decryption never occurs and code will not run nor will the console boot.

To my understanding anyway, he seems to have bypassed the whole mechanism altogether which according to IBM is impossible, either thru software or h/w means.

So either he doesn't understand how the Cell security works or he's found some flaw in the design/implementation that IBM and Sony missed.
 
So, what controls whether code can be executed or not? If he's found that he can execute unencrypted code on the PPE without passing it through the SPE first then it's a way in.
 
Green Biker Dude said:
well, if i understood it right - and i really don't remember the difference between cell's ppus, spus, spes and whatever - the blog dude who discredited geohot said that the root key can't be retrieved by hardware or software, and that at best he'd be able to copy encrypted data from the spe.

so, the data he could get would be encrypted by a key he can't retrieve. and he hasn't even gotten that data yet, it seems. that's disregarding the possibility of a vulnerability somewhere, of course.
Click to expand...

Well, he claims he's decrypted PPE code he's sent to the SPU...that's how he's getting the code in the first place to patch.

He's not claiming he has any key though, let alone the root key. But that he's managed to trick the SPE into decrypting said code and spitting it out to a place he can read.

I dunno if I'd be comfortable accepting it's impossible to get these keys either via software or hardware though. Unless that's coming from someone who has exhaustively attempted all possible approaches (and said person probably doesn't exist).

Then again, geohot perhaps hasn't best demonstrated exactly what he's achieved. At least from this layman's POV.

IMO the other hacker blog post is just not entirely convincing blog post vs geohot's not entirely convincing blog posts.

So I dunno.
 
bmf said:
So, what controls whether code can be executed or not? If he's found that he can execute unencrypted code on the PPE without passing it through the SPE first then it's a way in.
Click to expand...

if they can get around the hypervisor controls on the hardware, they could open it up to full homebrew, linux running on newer consoles without the otheros option, and things like that. but piracy of published games would require them decrypting the executables, which is very unlikely to happen, seeing as all of that happens in a way which is virtually impossible to snoop. if the above happens (full homebrew support, with zero piracy support) that would be pretty cool. but i'm still doubtful they will achieve full and reliable access to the hardware. others have been attempting this for a long time through official ps3 linux and have gotten nowhere or given up.
 
Alec said:
This is worth posting, for anyone familiar with the figures in the PSP scene. It's a few days old, but still relevant in wake of everyone dismissing the hack.

http://www.maxconsole.net/?mode=news&newsid=38360



Mathieulh and Geohot were going back and forth in his early blog posts, so I'm assuming they probably hooked up offsite to go over how far Geohot had gone.
Click to expand...

Is Mathieulh his name on the geohot blog?

If it really is him, confirms it as true and it leads to something significant, the people in this thread, who are laughing at him because he might have done something that most people can already do, are going to look pretty stupid themselves.

<B>IF</B> this turns out true, of course. Which will be hilarious, because I love it when people get owned on here.
 
Lillster said:
Is Mathieulh his name on the geohot blog?

If it really is him, confirms it as true and it leads to something significant, the people in this thread, who are laughing at him because he might have done something that most people can already do, are going to look pretty stupid themselves.

<B>IF</B> this turns out true, of course. Which will be hilarious, because I love it when people get owned on here.
Click to expand...

And I like owning previously perma-banned members who incorrectly think they are welcome back when we let a new batch of users in, cya :P
 
Damn, if Mathieulh is involved, I would be sorta worried again...:lol

I wonder why he aint helping the PSP scene with CFW 6+.
 
Vennt said:
And I like owning previously perma-banned members who incorrectly think they are welcome back when we let a new batch of users in, cya :P
Click to expand...

Wow, you're on a hotstreak. OT, but what's the biggest clue? IP address?
 
Dragona Akehi said:
So, after the previous thread turned into a piece of shit about accusing people excited about this hack for being pirates, let's try again.

Anyone accusing people of piracy, or saying that this hack is just for piracy is going to get a three month ban.

There are many uses for homebrew on PS3, such as region free PS1, PS2, DVD or Bluray playback. Plus a better media server setup than PS3 MediaServer, which is useless to anyone not on a wired connection (like myself).

So back to the Original Post:
Click to expand...









I bet you are so hot. Marry me. Marry me and be my second wife!

With your mod powers and cold heart, plus my idiocy, we could own this world.
 
I never use IP address FWIW, firstly proxies and dynamic IP's make that pointless, secondly an IP search of the DB as things stand would make the 500's you see now seem like smallfry, hell such a search would probably cause a fire at the server host ;)
 
Vennt said:
I never use IP address FWIW, firstly proxies and dynamic IP's make that pointless, secondly an IP search of the DB as things stand would make the 500's you see now seem like smallfry, hell such a search would probably cause a fire at the server host ;)
Click to expand...

So you're not going to tell us? Oh well, guess I better behave. :|

Keep up the good work. /kissass
 
geohot: well actually it's pretty simple
geohot: i allocate a piece of memory
geohot: using map_htab and write_htab, you can figure out the real address of the memory
geohot: which is a big win, and something the hv shouldn't allow
geohot: i fill the htab with tons of entries pointing to that piece of memory
geohot: and since i allocated it, i can map it read/write
geohot: then, i deallocate the memory
geohot: all those entries are set to invalid
geohot: well while it's setting entries invalid, i glitch the memory control bus
geohot: the cache writeback misses the memory :)
geohot: and i have entries allowing r/w to a piece of memory the hypervisor thinks is deallocated
geohot: then i create a virtual segment with the htab overlapping that piece of memory i have
geohot: write an entry into the virtual segment htab allowing r/w to the main segment htab
geohot: switch to virtual segment
geohot: write to main segment htab a r/w mapping of itself
geohot: switch back
geohot: PWNED
geohot: and would work if memory were encrypted or had ECC
geohot: the way i actually glitch the memory bus is really funny
geohot: i have a button on my FPGA board
geohot: that pulses low for 40ns
geohot: i set up the htab with the tons of entries
geohot: and spam press the button
geohot: right after i send the deallocate call
Click to expand...

Interesting.
 
santi_yo said:
So... he just uploaded the exploit.

Who is lying now?
Click to expand...
I don't think many people were saying he was lying.

Most just say he hasn't gotten anything substantial out of it.

Or at the very least, anything worthy of "FULLY CRACKED ISO LOADERS PS2 EMULATION XMBC WHOAHOAHOHOWH IM CUMMINNNNNNNNNNNNNNNNNNNN" hype that the media seemed to have garnished upon him.
 
just wanted to point out that without otherOS (ie old ps3 fat) and fucking with your hardware every time, this is pretty useless.

i guess it might help people find exploits in the XMB side of things, but for now it requires you to be running custom code (which otheros allows) in the first place to do this particular exploit.
 
Sounds to me like he didn't know where to go next. Releasing an exploit at this stage isn't the best of ideas as it just means Sony get a crack at beating it before real world exploits arrive.
 
He posted the exploit
In the interest of openness, I've decided to release the exploit. Hopefully, this will ignite the PS3 scene, and you will organize and figure out how to use this to do practical things, like the iPhone when jailbreaks were first released. I have a life to get back to and can't keep working on this all day and night.

Please document your findings on the psDevWiki. They have been a great resource so far, and with the power this exploit gives, opens tons of new stuff to document. I'd like to see the missing HV calls filled in, nice memory maps, the boot chain better documented, and progress on a 3D GPU driver. And of course, the search for a software exploit.

This is the coveted PS3 exploit, gives full memory access and therefore ring 0 access from OtherOS. Enjoy your hypervisor dumps. This is known to work with version 2.4.2 only, but I imagine it works on all current versions. Maybe later I'll write up how it works :)

Good luck!
Click to expand...
Edit: beaten :lol
 
Something I've always wondered: how do hackers interface with something like a games console? OK PS3 is different because of the other OtherOS stuff, but how would you even begin issuing commands to something like a PS2 or a Wii?
 
Sounds like it's fairly patchable for practicality, though I see why it's theoretically not. Let's see how long it takes Sony.
 
For those interested in other "master hacker" points of view on the subject, I have a feeling this thread on Xboxhacker.net will blow up when some of the other techies start experimenting with the exploit.

If you're unfamiliar with Xboxhacker.net, do not post anything unless you have something to contribute. You'll pretty much get insta-banned.
 
santi_yo said:
So... he just uploaded the exploit.

Who is lying now?
Click to expand...

I know I never said he was lying. I think he was getting ahead of himself, he's the dude who tweeted a 'btw, I just hacked the ps3'.
 
obonicus said:
I know I never said he was lying. I think he was getting ahead of himself, he's the dude who tweeted a 'btw, I just hacked the ps3'.
Click to expand...

definition of hacked

hackers = control over the system
everyone else = ZOMG free games! where's my free games?!
 
So really all this is going to achieve is more memory to spend in PS3 Linux, something Sony put in there to encourage homebrew nuts and hackers to muck around with all along anyway? Its the clever equivalent of a parent constructing a sandbox on the beach, and telling their kid to have fun with that specific box of sand.

Its kinda funny him even trying to compare it to "jailbreaking" the iPhone when he's nowhere near hacked the thing wide open.
 
Zen said:
obviously, but in a year or two video game piracy could be in full swing on the PS3. I wish there would be a way to 'open up' a system WITHOUT making Piracy viable at the same time.
Click to expand...

Of all the things Sony has gotten wrong this gen. The sure got the PS3's security right.

PS3>>>>>>Hackers
Click to expand...

correct me if I am wrong, but haven't the console which has been easiest to hack always been the best selling system? There is no proof that a hacked console suffer. Quite the opposite.

PS1 - easy to hack. Best selling system
N64 - dunno, i dont think it was hacked
PS2 - easy to hack. Sold like crazy.
Gamecube - got hacked late in lifespan. Sold bad.
Xbox - easy hacked I think. Sold okay
Wii - very easy to hack. Sells like crazy.
Xbox 360 - easy to hack - sells good.
PS3 - well, nothing on the market yet. Worst selling.
 
darkwings said:
correct me if I am wrong, but haven't the console which has been easiest to hack always been the best selling system? There is no proof that a hacked console suffer. Quite the opposite.

PS1 - easy to hack. Best selling system
N64 - dunno, i dont think it was hacked
PS2 - easy to hack. Sold like crazy.
Gamecube - got hacked late in lifespan. Sold bad.
Xbox - easy hacked I think. Sold okay
Wii - very easy to hack. Sells like crazy.
Xbox 360 - easy to hack - sells good.
PS3 - well, nothing on the market yet. Worst selling.
Click to expand...

Dreamcast. 'nuff said.
 
darkwings said:
correct me if I am wrong, but haven't the console which has been easiest to hack always been the best selling system? There is no proof that a hacked console suffer. Quite the opposite.

PS1 - easy to hack. Best selling system
N64 - dunno, i dont think it was hacked
PS2 - easy to hack. Sold like crazy.
Gamecube - got hacked late in lifespan. Sold bad.
Xbox - easy hacked I think. Sold okay
Wii - very easy to hack. Sells like crazy.
Xbox 360 - easy to hack - sells good.
PS3 - well, nothing on the market yet. Worst selling.
Click to expand...

Dreamcast - very easy to hack. Sold bad.
 
darkwings said:
okay but i can imagine that it wasnt very widespread.
Click to expand...

Correct. It was also fairly expensive and the equipment was sort of difficult to find.

I would also be interested in the numbers from the parallel universe in which the Dreamcast wasn't hacked. If only...
 
You must log in or register to reply here.

Similar threads

Modern Vintage Gamer: Why a Hacked PS3 is STILL awesome in 2025.
Opinion Trailer Hardware 
20
246
joeygreco1985 replied
  • Locked
PayPal reportedly hacked
2
96
2K
Orpheus replied
Crimson Collective claims to have hacked Nintendo-Systems
6
144
TrebleShot replied
Xbox social media pages hacked? Scammers trying to push Xbox Token
19
602
Pallas replied
This is going to be the 6th time 343 industries disappoints halo fans I'm calling it right now
2
96
529
Dirk Benedict replied
Top Bottom