Sponsored Links

PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!
Sponsored Links

Home PS4 News - Latest PlayStation 4 and PS3 News

Dumping PS3 Hypervisor and Bootloader with Atmega8 at 16Mhz


Sponsored Links
263w ago - Hi guys, I used an Atmega8 running at 16Mhz (I had a couple lying about from the BT Vision project I was working on) and knocked up a small prog to do the same as the other chips and dump out the PS3 Hypervisor and Bootloader.

I was quite surprised, It actually worked fairly straight away! I only had one pulse going everytime I pressed the button at first but not a lot was happening.

So I did what xorloser did, and modded it so it pulsed every 100ms while the switch is pressed.

After about 30-40 seconds... I got a hit with the exploit code posted here. Then I used the dumper (posted here) to dump the 10mb bin.

Just having a look through the dump, lots of strings in there.. I haven't dropped it into IDA yet tho...

This is the source and hex (for those who dont want to compile it) for the Atmega8 which I glitched my PS3 with. The Chip I used was the Atmega8-16pu. You will also need a 16mhz Crystal, and 2 x 22pf Capacitors.

Grounding pin 14 on the chip will produce a pulse on Pins 2 of the chip (infact it does all of PORTD) This should then go to the memory bus point on the ps3. See Circuit diagram (below).

I used ponyprog to program my chip, with CKOPT ticked in the fuse settings, everything else was unticked.

Mick

Dumping PS3 Hypervisor and Bootloader with Atmega8 at 16Mhz

Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter, Facebook and drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene and PlayStation 4 scene updates and fresh homebrew PS3 Downloads. Enjoy!
Sponsored Links
Sponsored Links

Comments 55 Comments - Go to Forum Thread »

• Please Register at PS4News.com or Login to make comments on Site News articles.
 
#45 - ckj1979 - 263w ago
ckj1979's Avatar
[QUOTE=SCE;285215]Exactly. Actually being able to find the tools in my country is more important than the price

Of course, the price shuld be

#44 - CodeKiller - 263w ago
CodeKiller's Avatar
You can use almost all modern atmel microcontroller (from range attiny to atmega with ISP programming feature), or you can port to PIC, 8032, etc...

But the 555 is a no good solution. Check the datasheet: it has a rise-, and fall-time of 100ns, TTL type of output (means no Hi-Z so it can interfere with the system), and not flexible.

If you really that out of resources, maybe try some schmidt-trigger and a latch/gate.

#43 - hagisbasheruk - 263w ago
hagisbasheruk's Avatar
Quote Originally Posted by ckj1979 View Post
Arduino is a nice choice

if you wanted something really cheap you could use the atmega8/16 with a cheaply made parallel programmer.

Yes i thought so as it has the FT232RL a USB to serial UART interface with optional clock generator output witch is not in use handy as the internally generated clock (6MHz, 12MHz, 24MHz, and 48MHz) can be brought out of the device and used to drive a microcontroller or external logic.(not sure why this wasn't use to drive the ATmega , mabey just to give the Arduino some more options for use)

The nice thing is the power options witch can run the board from a battery/usb or AC-DC adaptor and it has a resettable polyfuse that protects your computer's USB ports from shorts and overcurrent.

Here is the circuit: http://arduino.cc/en/uploads/Main/arduino-duemilanove-schematic.pdf

As you can see it is just an enhanced version of what was posted so will be really suitable for those who don't like to built their own or just can be arsed to.

Hopefully this adds more intensive for others to go peek there own ps3 system and dump their own hyperviser. Thanks is0mick for starting this thread and thanks ckj1979 for your response.

#42 - SCE - 263w ago
SCE's Avatar
Exactly. Actually being able to find the tools in my country is more important than the price

Of course, the price shuld be

#41 - is0mick - 263w ago
is0mick's Avatar
Quote Originally Posted by SCE View Post
I am still waiting for a cheap solution...

Costs:

  • atmega8 -16pu £2.39 of ebay
  • 16mhz crystal + 2 x caps £0 robbed off an old circuit board.
  • programmer £0 (old printer lead chopped up)
  • Piece of vero board ~50p
  • Dumping the hypervisor - Priceless :P

I make that < £3 How cheap do you want?

Mick

#40 - SCE - 263w ago
SCE's Avatar
I am still waiting for a cheap solution...

#39 - ckj1979 - 263w ago
ckj1979's Avatar
Arduino is a nice choice

if you wanted something really cheap you could use the atmega8/16 with a cheaply made parallel programmer.

#38 - hagisbasheruk - 263w ago
hagisbasheruk's Avatar
I have previously programmed in ASM on PICs for a few projects years ago, getting data from sensors attatched to ports and writing serial data to some sharp 2 line LCD modules to display results,anyway that got me thinking mabey i could use a PIC of some sort to glitch as some local shops sell them and the programmer/debugger s(never owned my own,just used the one at Uni) but to my suprise the good ones are quite expensive.This led me to following a link to here.Then i had a look at the Arduino Duemilanove based on the ATmega328 as it has usb in-circuit programming.

I have been looking for at different programmer/microprocessor combinations and have decided the the Arduino Duemilanove based on the ATmega328 might be a good option as RS Components are doing them and also coolcomponents.co.uk for £20 approx.

http://docs-europe.origin.electrocomponents.com/webdocs/0db9/0900766b80db997b.pdf

Oh PS to site BOSS i like the way you run things round here. those blogs out there are just full of whiners, so i am glad i have found somewhere that i mabey able to better follow things.I am in no way a hacker by any means but i do like to be able to follow through whats going on and actually trying out the same process to get a better understanding of the topic at hand, thats what got me into using IDApro and getting WinCE and Pocket PC apps running on the Gizmondo Handheld Console.

So its my birthday in March, will get the kids to get me the Arduino Duemilanove or has anyone got a better option, remembering i want to be able to reuse and program the microcontroller ?

#37 - tripellex - 263w ago
tripellex's Avatar
Hey guys,

I have a tunable oscillator circuit I created a while back for a defunct project, that uses two OSAs. Do you think it would it be possible to modify this board to generate the right pulse?

#36 - ckj1979 - 263w ago
ckj1979's Avatar
No worries, i'll give it a go and see how fast it runs..

 

Sponsored Links

Sponsored Links







Advertising - Affiliates - Contact Us - PS4 Downloads - PS4 Forums - Privacy Statement - Site Rules - Top - © 2015 PlayStation 4 News