Right Let's Try This Again: PS3 Hypervisor Hacked

ChronicleX said:
First steps are always very interesting, I look forward to see where this goes as I would like to see a PS3 linux that has full access to the hardware, it would be as powerfull as a PC 2-3x its cost which is well worth it.



Slightly offtopic

Considering that the PSP has PS3 linkage, Remote play etc would it not be possible to hack the PS3 with the already hacked PSP? Makes me wonder why the PS3 could of not been hacked from this angle much sooner. The thing is many items on the PS Store are for PSP and PS3, meaning they would have to be signed in such a way for both systems to run (PS1 games / PSP Mini's being the prime example).

Where am I going with this? Well in the last month or so Datel released proof that they can sign Eboots to run on PSP's with their newest Action Replay that works on all PSP's including the PSPGO, there is even a demo you can acquire of the product.

Assuming that the PS3 can recognise and run signed PSP code, which is how the PS1/Mini games work from the store on both systems. So if the method to sign a PSP Eboot is discovered then not only will all PSP's be hacked (again) but it also potentially opens up the PS3 to hacks that cannot be easily (or at all) patched/detected by Sony if the PSP signed Eboot runs on the PS3 system. It will just read it as software it is allowed to run, no hacking required.

In short there is a high chance that the PSP-PS3 compatibility is the way forward if this hack leads to a wall because software can be signed for both systems to accept. If someone can get it to work on one (The PSP) then it will also work on its counterpart (The PS3) providing the software can fool it into something it is allowed to run (A PSP Mini).
Click to expand...

It's a dead end. Either way, the best you can hope for is a buffer overflow, which the hypervisor (and other security measures) protect against quite nicely.
 
I don't see much more than memory access in there.. Huh?

I mean, sweet, he's shown that you can make memdumps and shovel data onto the thing.

Am I missing something here?

That isn't what we call an exploit..

Edit: Oh geeze, some of the comments over there are really awful.
 
androvsky said:
It's a dead end. Either way, the best you can hope for is a buffer overflow, which the hypervisor (and other security measures) protect against quite nicely.
Click to expand...

Hence now that the Hypervisor has been hacked there is potential in bypassing the security with PSP homebrew, provided the method Datel has for signing PSP Eboots can be discovered.
 
ChronicleX said:
Hence now that the Hypervisor has been hacked there is potential in bypassing the security with PSP homebrew, provided the method Datel has for signing PSP Eboots can be discovered.
Click to expand...
??

The Hypervisor isn't hacked. The functions are exposed. That's all I'm seeing right now. That doesn't mean much if you're talking about a blackbox though.
 
darkwings said:
PSP isn't as easy hacked as the DS. Enough said.
Click to expand...
:lol PSP was stupidly easy to hack for years, hell, the original Japanese one didn't even have any security signing checks enabled, and could run homebrew with no hacking at all. They just recently got it to the point of not being hacked only with newest hardware revision and PSP Go. You never even needed to order anything from shady looking asian websites like you have for DS, just copy some files to memory stick, and that was it for the longest time.
 
Lord Error said:
:lol PSP was stupidly easy to hack for years, hell, the original Japanese one didn't even have any security signing checks enabled, and could run homebrew with no hacking at all. They just recently got it to the point of not being hacked only with newest hardware revision and PSP Go. You never even needed to order anything from shady looking asian websites like you have for DS, just copy some files to memory stick, and that was it for the longest time.
Click to expand...

dunno, following psp homebrew scene from the outside perspective is such a chore. different kernels, patch for latest version, homebrew compatibility on different psp. numerous mother board modification Sony make. you have to be prepared to read a lot to follow and find the latest stable solution for psp homebrew and piracy.

ds on the other hand, you only need to buy one of the many choices of supercard and after ward, anyone that can browse pc can play pirated games
 
wmat said:
??

The Hypervisor isn't hacked. The functions are exposed. That's all I'm seeing right now. That doesn't mean much if you're talking about a blackbox though.
Click to expand...


If you can alter what the hypervisor sees and zap his calls I guess that it is hacked no? I mean if the hypervisor sees something wrong and you can zap it into saying that is rigth that has to count.

Too early to say anything but at least it seems that the door it's open for others to continue his work. We will see in the future if geohot was indeed right or all this was for nothing. At least he has done something that no-one did before, that is a step :)
 
itxaka said:
If you can alter what the hypervisor sees and zap his calls I guess that it is hacked no? I mean if the hypervisor sees something wrong and you can zap it into saying that is rigth that has to count.

Too early to say anything but at least it seems that the door it's open for others to continue his work. We will see in the future if geohot was indeed right or all this was for nothing. At least he has done something that no-one did before, that is a step :)
Click to expand...
Well, yeah, he did one hell of a job there, that's no question.
 
wmat said:
Well, yeah, he did one hell of a job there, that's no question.
Click to expand...

Actually, checking the code of the exploit.c seems like he installs 2 lv1 calls on the hypervisor :O

That is awesome, and that could lead to something*


*NOTE: I am null with code so I could be reading it wrong, someone feel free to correct me.
 
Looks like PS3 won again. Interesting that it has no effect on 3rd party support. I'd imagine there'd be significant ripples if a highly anticipated release went PS3 only citing 'Zero Piracy' as a reason. Why people don't want to make these ripples is clear, it's better to sell a million and have a million pirated than sell 999,999 copies.

Marty Chinn said:
What needs to happen is that everyone subscribes to the light/dark console theory.

NES (light) vs Master System (dark) - NES won
SNES (light) vs Genesis (dark) - SNES won
PS (light) vs Saturn (dark) vs N64 (dark) vs 3D0 (dark) vs Jaguar (dark) - PS won
Wii (lightest) vs Xbox 360 (light) vs PS3 (dark) - Wii is winning
Gameboy (light) vs Lynx (dark) vs Game Gear (dark) - Gameboy Won
Nintendo DS (silver so it was light) vs PSP (dark) - Nintendo DS is winning

The only mishap to this whole theory is:

PS2 (dark) vs Xbox (dark) vs Dreamcast (light)

In which of course leave it to Sega to screw things up on their hardware exit :D
Click to expand...
I do subscribe to this theory. The Dreamcast, although light, had a dark soul.
 
So basically here's how the exploit stands:

Requires a system with OtherOS
Mess around with the existing hardware
Install your own hardware
Allows you to access RSX from Linux (which you already could)
But you need a driver that needs to be written from the ground-up on Linux for PS3
And even then with Hypervisor access you still have no way to get to the isolated SPE
Which means no root key, which decrypts the games (and everything else) in the first place

So piracy is completely out of the question
And anything else is still developmentally at square one because
a) nothing has been advanced
b) there still needs to be a massive undertaking of reverse engineering and complete new programming

Sony wins?
 
hauton said:
So basically here's how the exploit stands:

Requires a system with OtherOS
Mess around with the existing hardware
Install your own hardware
Allows you to access RSX from Linux (which you already could)
But you need a driver that needs to be written from the ground-up on Linux for PS3
And even then with Hypervisor access you still have no way to get to the isolated SPE
Which means no root key, which decrypts the games (and everything else) in the first place

So piracy is completely out of the question
And anything else is still developmentally at square one because
a) nothing has been advanced
b) there still needs to be a massive undertaking of reverse engineering and complete new programming

Sony wins?
Click to expand...

The PS3 is a BEAST.
 
hauton said:
So basically here's how the exploit stands:

Requires a system with OtherOS
Mess around with the existing hardware
Install your own hardware
Allows you to access RSX from Linux (which you already could)
But you need a driver that needs to be written from the ground-up on Linux for PS3
And even then with Hypervisor access you still have no way to get to the isolated SPE
Which means no root key, which decrypts the games (and everything else) in the first place

So piracy is completely out of the question
And anything else is still developmentally at square one because
a) nothing has been advanced
b) there still needs to be a massive undertaking of reverse engineering and complete new programming

Sony wins?
Click to expand...

31136_1Ken_Kutaragi.jpg
 
hauton said:
So basically here's how the exploit stands:

Requires a system with OtherOS
Mess around with the existing hardware
Install your own hardware
Allows you to access RSX from Linux (which you already could)
But you need a driver that needs to be written from the ground-up on Linux for PS3
And even then with Hypervisor access you still have no way to get to the isolated SPE
Which means no root key, which decrypts the games (and everything else) in the first place

So piracy is completely out of the question
And anything else is still developmentally at square one because
a) nothing has been advanced
b) there still needs to be a massive undertaking of reverse engineering and complete new programming

Sony wins?
Click to expand...
Not true. This exploit allows full hardware access through OtherOS. No restrictions, full GPU and memory access on firmware versions after 2.1. And that's it - but it is quite an achievement nevertheless. It just won't help pirates.
 
I really hope that if anything comes out of this (IF... a very big IF), I hope it's the support for things that Sony can't do or legally don't want to do i.e. Region Free movie support, access to video/audio format or .mkv straight from PS3.

Piracy is not an issue for me as I love supporting game developers for gaming has been part of my lifestyle ever since I was born (and I don't like ripping others off for the years of hardwork as much as I'd hate being ripped off).
 
shagg_187 said:
I really hope that if anything comes out of this (IF... a very big IF), I hope it's the support for things that Sony can't do or legally don't want to do i.e. Region Free movie support, access to video/audio format or .mkv straight from PS3.
Click to expand...

Hopefully region-free BD playback will return. There really hasn't been too many real firmware releases since it was removed, so hopefully it was just an accident/oversight.

Matroska container support has to arrive at some point. It's officially part of the latest DivX revision, and Sony has said they want to keep the PS3 as a DivX-certified device.
 
wsippel said:
Not true. This exploit allows full hardware access through OtherOS. No restrictions, full GPU and memory access on firmware versions after 2.1. And that's it - but it is quite an achievement nevertheless. It just won't help pirates.
Click to expand...

Linux on the PS3 already uses the video memory for programs in what's probably the fastest method possible, so for the trouble of installing a modchip, all people would gain is RSX access. However, with the hypervisor dump, I expect them to find the proper calls to access the RSX without requiring a hack. Since there's already a bunch of work on open-source 3D nvidia drivers, I don't expect it'd take long to port those to the RSX (even the 2.1 hole had basic 3D support in just a couple weeks).
 
wsippel said:
Not true. This exploit allows full hardware access through OtherOS. No restrictions, full GPU and memory access on firmware versions after 2.1. And that's it - but it is quite an achievement nevertheless. It just won't help pirates.
Click to expand...
Maybe I'm lost?

I thought the only thing that has been advanced is memory access. GPU was already available, just there's nobody insane enough to program a fully functional GPU driver in Linux specifically for the RSX on PS3. Understanding of the hypervisor calls has improved, but nothing concrete that wasn't available before.

In terms of memory access, Lv0/1 are mostly available, but still nothing in terms of the isolated SPE, the secure processing vault and the root key, the backbone of the CELL's encryption and security system.

In other words - dandy that you have hypervisor control, which we didn't have before, but Ms. Shimizu has already seen ahead of that move and has that attack vector checkmated.
 
hauton said:
Maybe I'm lost?

I thought the only thing that has been advanced is memory access. GPU was already available, just there's nobody insane enough to program a fully functional GPU driver in Linux specifically for the RSX on PS3. Understanding of the hypervisor calls has improved, but nothing concrete that wasn't available before.

In terms of memory access, Lv0/1 are mostly available, but still nothing in terms of the isolated SPE, the secure processing vault and the root key, the backbone of the CELL's encryption and security system.

In other words - dandy that you have hypervisor control, which we didn't have before, but Ms. Shimizu has already seen ahead of that move and has that attack vector checkmated.
Click to expand...

There's plenty of work on open-source GPU drivers in linux, including chips very similar to the RSX. The problem is that on PCs, you can talk to hardware directly, but on the PS3, you have use the correct hypervisor function. Without knowing the correct hypervisor function to use to talk to the RSX, development was at a real standstill.
 
H_Prestige said:
So now the only chance for region free everything is if Sony does it themselves. Fat chance.
Click to expand...
Out of curiosity, what specifically isn't region-free?

I know games are.
Movies aren't.
PSN stuff?
 
hauton said:
Out of curiosity, what specifically isn't region-free?

I know games are.
Movies aren't.
PSN stuff?
Click to expand...

PSN stuff can be accessed from any region so long as you have an acc from that region.

The only things that are region locked are Blu-Rays (and not all of them)
 
wsippel said:
Not true. This exploit allows full hardware access through OtherOS. No restrictions, full GPU and memory access on firmware versions after 2.1. And that's it - but it is quite an achievement nevertheless. It just won't help pirates.
Click to expand...

This is literally the best scenario for everyone.

No piracy.

Yet more freedom to "do what you want" with the system.
 
Geohotz releases his work to the net and wishes people good luck in the search for a software exploit.

In the interest of openness, I've decided to release the exploit. Hopefully, this will ignite the PS3 scene, and you will organize and figure out how to use this to do practical things, like the iPhone when jailbreaks were first released. I have a life to get back to and can't keep working on this all day and night.
Click to expand...

http://geohotps3.blogspot.com/2010/01/heres-your-silver-platter.html
 
I hope this picks up. I'm interested in PS3 development for hobbyist programming projects (using it as a render satellite) and perhaps making realtime demos.

I was put off the slim because it is without Other OS functionality. This might make me buy a fat one. I wonder what benefits amateur coders like myself have received from this.
Register article said:
The hack will allow PS3 users for the first time to run unrestricted versions of Linux that have full access to the system's central processing unit and graphical processing unit.
Click to expand...
Looks like this is exactly what I was waiting for. Full hardware access. I think it's time to buy a fat.
 
hauton said:
Out of curiosity, what specifically isn't region-free?

I know games are.
Movies aren't.
PSN stuff?
Click to expand...

PS1/PS2 games. I don't think Sony will ever let go of those ancient region restrictions. I don't know of the legalities behind it, so it may not be Sony's fault per se, but it will probably never happen.
 
Visualante said:
I hope this picks up. I'm interested in PS3 development for hobbyist programming projects (using it as a render satellite) and perhaps making realtime demos.

I was put off the slim because it is without Other OS functionality. This might make me buy a fat one. I wonder what benefits amateur coders like myself have received from this.
Click to expand...

a middle finger.
 
H_Prestige said:
PS1/PS2 games. I don't think Sony will ever let go of those ancient region restrictions. I don't know of the legalities behind it, so it may not be Sony's fault per se, but it will probably never happen.
Click to expand...
They are region locked in PS3 because their were licensed in this way in their original platforms. But I think in the dark side there was a way to run them in PS3 without region restriction.
 
H_Prestige said:
PS1/PS2 games. I don't think Sony will ever let go of those ancient region restrictions. I don't know of the legalities behind it, so it may not be Sony's fault per se, but it will probably never happen.
Click to expand...

It is unlikely to happen because of the licensing agreements with the publishers. PS1 and PS2 pubs signed for their region, and allowing those games to be used outside the region specified in the contracts would require re-licensing or be a breach on Sony's part.
 
PS1 games sold on PSN are region free (PAL PS1 games can be played if your monitor/tv can output 50hz on a NTSC console iirc). If PS2 games are put up on PSN it would be the same given the new licensing required.
 
I expect this level of security in all consoles going forward. Well at least from Sony and Microsoft.

A locked core becoming a SPV and runtime secure boot.
 
hauton said:
In terms of memory access, Lv0/1 are mostly available, but still nothing in terms of the isolated SPE, the secure processing vault and the root key, the backbone of the CELL's encryption and security system.

In other words - dandy that you have hypervisor control, which we didn't have before, but Ms. Shimizu has already seen ahead of that move and has that attack vector checkmated.
Click to expand...
First of all: If all you care about is legal homebrew, this exploit pretty much does the trick. You don't need the isolated SPE or the root key for that purpose. But sure, this exploit doesn't enable cheating or piracy. So... everyone won, right?

Also, if Shimizu is all that clever (I guess she is), she knows someone will break her security concept (I guess she does). Everyone who works in information security knows it'll happen, unless they're completely naive or arrogant beyond believe. No matter how clever you think you are, and no matter how perfectly secure your concept looks on paper, there will be someone more clever than you blowing the door wide open using a vector you never expected. It eventually happens, unless nobody even cares to hack your system of course. It's also impossible to tell how long this will take. The fact nobody hacked the PS3 in three years doesn't really say much about the level of security, it usually just means that the nobody capable enough really tried yet, or that they were on the wrong track.
 
Valkyr Junkie said:
Hopefully region-free BD playback will return. There really hasn't been too many real firmware releases since it was removed, so hopefully it was just an accident/oversight.
Click to expand...
There has never been a region free BD playback in PS3. You could play discs that were authored as region free, and you still can - provided that they are not 50hz video material, like the TV shows from Europe would be. I have a couple of region free discs imported from Europe and Australia (all theatrical movies, non 50hz footage) and they all play fine with latest firmware.
 
yurinka said:
They are region locked in PS3 because their were licensed in this way in their original platforms. But I think in the dark side there was a way to run them in PS3 without region restriction.
Click to expand...

I wish there were a way to change the ps3's region in the settings, like you can with dvd players. I imagine this is what a hacked ps3 would allow.
 
avaya said:
I expect this level of security in all consoles going forward. Well at least from Sony and Microsoft.

A locked core becoming a SPV and runtime secure boot.
Click to expand...

The first of the pirate-free consoles perhaps (minus whatever non-PS3 games they eventually will manage to run).
 
H_Prestige said:
PS1/PS2 games. I don't think Sony will ever let go of those ancient region restrictions. I don't know of the legalities behind it, so it may not be Sony's fault per se, but it will probably never happen.
Click to expand...

And the lockout is all hardware related and not software so it's the PS3 itself that is going out of it's way to lock out out of region games. Even the Net Yaroze could play any region game on it.
 
It's good to know that fortress known as the PS3 is still standing proud and tall. It's would be an abomination to see people taking advantage of the system particularly when sony sells the ps3 as a loss.


lol at the comments at geohotz blog. seems like alot of disappointed would be pirates out there. Kanna Shimizu is officially the most hated person on that blog
 
OldJadedGamer said:
And the lockout is all hardware related and not software so it's the PS3 itself that is going out of it's way to lock out out of region games. Even the Net Yaroze could play any region game on it.
Click to expand...

Isn't it software, just like the ps2 and ps1 themselves?
 
Marty Chinn said:
What needs to happen is that everyone subscribes to the light/dark console theory.

NES (light) vs Master System (dark) - NES won
SNES (light) vs Genesis (dark) - SNES won
PS (light) vs Saturn (dark) vs N64 (dark) vs 3D0 (dark) vs Jaguar (dark) - PS won
Wii (lightest) vs Xbox 360 (light) vs PS3 (dark) - Wii is winning
Gameboy (light) vs Lynx (dark) vs Game Gear (dark) - Gameboy Won
Nintendo DS (silver so it was light) vs PSP (dark) - Nintendo DS is winning

The only mishap to this whole theory is:

PS2 (dark) vs Xbox (dark) vs Dreamcast (light)

In which of course leave it to Sega to screw things up on their hardware exit :D
Click to expand...

So gamers are racist?
 
You must log in or register to reply here.

Similar threads

Modern Vintage Gamer: Why a Hacked PS3 is STILL awesome in 2025.
Opinion Trailer Hardware 
20
347
joeygreco1985 replied
  • Locked
PayPal reportedly hacked
2
96
2K
Orpheus replied
Crimson Collective claims to have hacked Nintendo-Systems
6
168
TrebleShot replied
Xbox social media pages hacked? Scammers trying to push Xbox Token
19
617
Pallas replied
Gaming will become more expensive (again)
2
81
116
Branded replied
Top Bottom