PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!

Home PS4 News - Latest PlayStation 4 and PS3 News

264w ago - As promised, today JaicraB has revealed the PS3 Hypervisor LV2 (GameOS) dump method and circuit used to allow the PS3's memory to persist while booting into OtherOS, which then allows dumping of the memory.

This was apparently on a CECHG model system with board model SEM-001 1-875-384-21

To quote, roughly translated: DemonHades / JaicraB Extraction Method:

First of all, be careful if you're going to attempt this, I am not responsible.

It's about keeping the RAM alive when moving to OtherOS. To do this the ram must be fed at all times so as not to erase the data.

Overview map
Refer to the First Image below.

Zone A
http://4.bp.blogspot.com/_4rtVxQc9D6s/S7dexn30R7I/AAAAAAAAAFs/tpo2XxknPKs/s1600/Zona+A.JPG

This area is sensitive. At that point we had settled with two resistors together. You have to remove it (remove it, but you could also cause a short circuit). It has 4 legs. At this point it tells the RAM and the integrated MOSFET turns off.

Zone B
http://3.bp.blogspot.com/_4rtVxQc9D6s/S7deyC8VeyI/AAAAAAAAAF0/bGUuh1knvRA/s1600/Zona+B.JPG

From the point labeled we get the feed. You can put anywhere on the track.

Zone C
http://2.bp.blogspot.com/_4rtVxQc9D6s/S7deye-D8wI/AAAAAAAAAF8/1EeIUE6Keyw/s1600/Zona+C.JPG

At this point labeled we have to make a bridge to defeat the two resistors.

Zone D
http://2.bp.blogspot.com/_4rtVxQc9D6s/S7dYDoRKnRI/AAAAAAAAAE0/tp9grVoM5kQ/s1600/Zona+D.jpg

The original point of the exploit.

Mini Circuit
Refer to the Second Image below.

The Technique

It is possible that the first time you start count him to do for the recovery.

It Summarized a bit with the following steps:

• Log into XMB.
• Touching, ejectura, configure, filling the memory with more information.
• Run a game, insert a BD, etc, etc.
• Then boot to OtherOS.
• Dump memory to exploit.

Remember: The first 36 Megabytes are the "privileged memory" that contains LV00, LV1, LV2. The rest is waste memory of XMB (very interesting) and data from OtherOS.

The next thing to try is to start a tiny linux system and do a full dump. So we would get more data from the XMB and less disturbed memory (from OtherOS)

The bad thing is my two-week vacation is over (I would have liked to have one more week to follow up).

Good luck to all and share!

PS3 Hypervisor LV2 (GameOS) Dump Method is Revealed!

PS3 Hypervisor LV2 (GameOS) Dump Method is Revealed!

Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter, Facebook and drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene and PlayStation 4 scene updates and fresh homebrew PS3 Downloads. Enjoy!


  • Sponsored Links




#53 - sapperlott - 264w ago
sapperlott's Avatar
Quote Originally Posted by korn16ftl3 View Post
question tho what is an XDR bus?
It's the memory bus - you have to know how the system talks to the memory first before trying to tap it. Just forget about tapping into the XDR memory.

#52 - renanbianchi - 264w ago
renanbianchi's Avatar
Exploration Pic by Demonhades:


#51 - jumbohype - 264w ago
jumbohype's Avatar
How about using a network shell with the ps3sdk instead of linux to dump the level 2?

#50 - Warrorar - 264w ago
Warrorar's Avatar
awsome work. very nice.

#49 - korn16ftl3 - 264w ago
korn16ftl3's Avatar
Quote Originally Posted by sapperlott View Post
The Infectus can't be used here since the XDR bus protocol is unknown (unless you pay $$$ to Rambus) and it operates at several GHz signalling rate.

Also restricting the memory use of Linux doesn't guarantee that the LV2 memory doesn't get overwritten. This is because there's no way of telling where the HV allocates the memory for the Linux partition. So you can't do something like "tell linux only to use the upper 32 MiB of RAM". You could guess the memory location based on the LPAR documentation on ps2dev.org but it would be just that - a guess.

Also the memory that Linux uses is split up into two parts. At boot time the kernel sees 128 MiB while (up to) another 112 MiB is added later as hot-plug memory.

well what my idea from the infectus was based on was some way to read the ram being it still has poer and all all we need to figure out is a tool to read the ram and the pin out for where to connect such tool.

the reason i used the infectus as an example is it has an external USB port as well as external power how ever im unshure like i said of the hardware or what it would really take to retreive dump from a system ultimitly not loading the otheros kernal what so ever (i.e something that runs a linux kernal indepetently of the PS3 as the ram still contains the data and is still supplied with power kinda like using the xbox PSU to power the DVD rom during a CFW flash)

question tho what is an XDR bus?

#48 - gfour - 264w ago
gfour's Avatar
great news, i have this CECHG model!

#47 - sapperlott - 264w ago
sapperlott's Avatar
The Infectus can't be used here since the XDR bus protocol is unknown (unless you pay $$$ to Rambus) and it operates at several GHz signalling rate.

Also restricting the memory use of Linux doesn't guarantee that the LV2 memory doesn't get overwritten. This is because there's no way of telling where the HV allocates the memory for the Linux partition. So you can't do something like "tell linux only to use the upper 32 MiB of RAM". You could guess the memory location based on the LPAR documentation on ps2dev.org but it would be just that - a guess.

Also the memory that Linux uses is split up into two parts. At boot time the kernel sees 128 MiB while (up to) another 112 MiB is added later as hot-plug memory.

#46 - laggmaster - 264w ago
laggmaster's Avatar
Quote Originally Posted by korn16ftl3 View Post

so my idea is this can the infectus chip be used some how? i know it can acess the NAND but if the RAM is live on the system and the PS3 as a whole is off than why cant we use something like the infectus that has many uses and flashable for multiple things to connect to the RAM rather than the NAND and possibly altering an app for the infectus to read what is live while the PS3 is off via USB

hmm i'm actually kinda surprised that someone has not used the infectus modchip to try and dump more things from the ps3... infact i haven't really seen much news about it on the net after it was released... i believe when it came out i read something about people writing custom code for it but i'm not sure

#45 - jumbohype - 264w ago
jumbohype's Avatar
Is this not just runtime level 2/gameOS rather than say the actual kernel which you can load/dump via mtldr?

#44 - moneymaker - 264w ago
moneymaker's Avatar
Quote Originally Posted by Keninishna View Post
I know there has been customer linux loaders for otheros. Why not make a customer loader that just directly dumps the ram? Should be a very small footprint.


When the console starts the secure-boot routine switches on the HV (aka VCC) I'm not sure if you perform the hack and then switch to xmb if the hack still keeps running, otherwise you have to fire it up again in order to access the whole memory, this makes not possible to dump the whole content of the ram without doing it with the HV in "open" mode, thus you have to boot even a minimal linux but you have to boot it if the hack shouldn't keep itself alive while switching from xmb to otheros, otherwise if the hack still runs in the switching process a code embedded into the bootloader could do the trick with the lesser amount of memory required.