PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!

Home PS4 News - Latest PlayStation 4 and PS3 News

April 3, 2010 // 10:37 pm - As promised, today JaicraB has revealed the PS3 Hypervisor LV2 (GameOS) dump method and circuit used to allow the PS3's memory to persist while booting into OtherOS, which then allows dumping of the memory.

This was apparently on a CECHG model system with board model SEM-001 1-875-384-21

To quote, roughly translated: DemonHades / JaicraB Extraction Method:

First of all, be careful if you're going to attempt this, I am not responsible.

It's about keeping the RAM alive when moving to OtherOS. To do this the ram must be fed at all times so as not to erase the data.

Overview map
Refer to the First Image below.

Zone A

This area is sensitive. At that point we had settled with two resistors together. You have to remove it (remove it, but you could also cause a short circuit). It has 4 legs. At this point it tells the RAM and the integrated MOSFET turns off.

Zone B

From the point labeled we get the feed. You can put anywhere on the track.

Zone C

At this point labeled we have to make a bridge to defeat the two resistors.

Zone D

The original point of the exploit.

Mini Circuit
Refer to the Second Image below.

The Technique

It is possible that the first time you start count him to do for the recovery.

It Summarized a bit with the following steps:

• Log into XMB.
• Touching, ejectura, configure, filling the memory with more information.
• Run a game, insert a BD, etc, etc.
• Then boot to OtherOS.
• Dump memory to exploit.

Remember: The first 36 Megabytes are the "privileged memory" that contains LV00, LV1, LV2. The rest is waste memory of XMB (very interesting) and data from OtherOS.

The next thing to try is to start a tiny linux system and do a full dump. So we would get more data from the XMB and less disturbed memory (from OtherOS)

The bad thing is my two-week vacation is over (I would have liked to have one more week to follow up).

Good luck to all and share!

PS3 Hypervisor LV2 (GameOS) Dump Method is Revealed!

PS3 Hypervisor LV2 (GameOS) Dump Method is Revealed!

Follow us on Twitter, Facebook and drop by the PS3 Hacks and PS3 CFW forums for the latest PlayStation 3 scene and PS4 Hacks & JailBreak updates with PlayStation 4 homebrew.

#33 - kidfather - April 4, 2010 // 10:18 pm
kidfather's Avatar
how much left to play games copies?

#32 - chipsy - April 4, 2010 // 8:58 pm
chipsy's Avatar
Quote Originally Posted by TUHTA View Post
really cool, is it any good results?

Is it a way to take "SPECIAL" USB and return to service mode?

I actually think you could achieve it , but then again it would require some special software which of course isn't publicly available and don't expect it to be leaked any time soon, because it's hidden deep down in Sony's headquarter and you will have to go through 100 of firewalls to get it.

(you know what I mean)

#31 - fhwk - April 4, 2010 // 8:42 pm
fhwk's Avatar
Nice work with the memdump - I've been pretty miffed at Sony for their stunt and decided to hop in with the hacking bandwagon to see if there's anything I could help with. I don't currently have Linux on my PS3 so I haven't tried these out myself yet, but maybe someone could give them a try.

First of all, there's a few linux kernel boot options which may be useful in making sure that the kernel doesn't overwrite the first 36MB of RAM. From the kernel documentation:

Mark specific memory as reserved. Region of memory to be used, from ss to ss+nn. Example: Exclude memory from 0x18690000-0x1869ffff:

So, by adding memmap=36M$0x00000000 to LILO/GRUB boot options would probably do the job. If I remember correctly, this also means that the kernel won't allocate RAM from this area for userspace programs.

Also, as there's no need to boot up a complete system, just starting a kernel and a shell would be enough. The init option lets you to specify the location of the init program (/sbin/init by default) so setting it to /bin/sh would probably be enough. Ie.


This would give a really minimal linux console to work with when getting a dump out.

#30 - xplozion - April 4, 2010 // 8:30 pm
xplozion's Avatar
Ooh man. Can't wait for the next month to see the improvements!

I bet $ony is damn scared of things to come

#29 - ritchan - April 4, 2010 // 8:24 pm
ritchan's Avatar
Short of opening up the lv2 dump in a hex editor and looking at the strings, what is one supposed to do with it?

#28 - tworok - April 4, 2010 // 8:17 pm
tworok's Avatar
wow, everyday a new dev progress, this was the ps3 scene i've dreamed about

keep up the great work!

#27 - TUHTA - April 4, 2010 // 8:10 pm
TUHTA's Avatar
really cool, is it any good results?

Is it a way to take "SPECIAL" USB and return to service mode?

#26 - crazelunatic - April 4, 2010 // 8:09 pm
crazelunatic's Avatar
So is there hope for those that updated to 3.21?

#25 - Hortlo - April 4, 2010 // 7:56 pm
Hortlo's Avatar
From Rich's twitter:
[quote]So.... where's lv2 in the recently leaked dump? I didn't spot a single hypercall in the entire dump. 0x44000022

#24 - Xplic1T - April 4, 2010 // 7:23 pm
Xplic1T's Avatar
Amazing progress guys !!!