Sponsored Links

PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!
Sponsored Links

Home PS4 News - Latest PlayStation 4 and PS3 News

PS3 Hypervisor LV2 (GameOS) Dump Method is Revealed!


Sponsored Links
256w ago - As promised, today JaicraB has revealed the PS3 Hypervisor LV2 (GameOS) dump method and circuit used to allow the PS3's memory to persist while booting into OtherOS, which then allows dumping of the memory.

This was apparently on a CECHG model system with board model SEM-001 1-875-384-21

To quote, roughly translated: DemonHades / JaicraB Extraction Method:

First of all, be careful if you're going to attempt this, I am not responsible.

It's about keeping the RAM alive when moving to OtherOS. To do this the ram must be fed at all times so as not to erase the data.

Overview map
Refer to the First Image below.

Zone A
http://4.bp.blogspot.com/_4rtVxQc9D6s/S7dexn30R7I/AAAAAAAAAFs/tpo2XxknPKs/s1600/Zona+A.JPG

This area is sensitive. At that point we had settled with two resistors together. You have to remove it (remove it, but you could also cause a short circuit). It has 4 legs. At this point it tells the RAM and the integrated MOSFET turns off.

Zone B
http://3.bp.blogspot.com/_4rtVxQc9D6s/S7deyC8VeyI/AAAAAAAAAF0/bGUuh1knvRA/s1600/Zona+B.JPG

From the point labeled we get the feed. You can put anywhere on the track.

Zone C
http://2.bp.blogspot.com/_4rtVxQc9D6s/S7deye-D8wI/AAAAAAAAAF8/1EeIUE6Keyw/s1600/Zona+C.JPG

At this point labeled we have to make a bridge to defeat the two resistors.

Zone D
http://2.bp.blogspot.com/_4rtVxQc9D6s/S7dYDoRKnRI/AAAAAAAAAE0/tp9grVoM5kQ/s1600/Zona+D.jpg

The original point of the exploit.

Mini Circuit
Refer to the Second Image below.

The Technique

It is possible that the first time you start count him to do for the recovery.

It Summarized a bit with the following steps:

• Log into XMB.
• Touching, ejectura, configure, filling the memory with more information.
• Run a game, insert a BD, etc, etc.
• Then boot to OtherOS.
• Dump memory to exploit.

Remember: The first 36 Megabytes are the "privileged memory" that contains LV00, LV1, LV2. The rest is waste memory of XMB (very interesting) and data from OtherOS.

The next thing to try is to start a tiny linux system and do a full dump. So we would get more data from the XMB and less disturbed memory (from OtherOS)

The bad thing is my two-week vacation is over (I would have liked to have one more week to follow up).

Good luck to all and share!

PS3 Hypervisor LV2 (GameOS) Dump Method is Revealed!

PS3 Hypervisor LV2 (GameOS) Dump Method is Revealed!

Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter, Facebook and drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene and PlayStation 4 scene updates and fresh homebrew PS3 Downloads. Enjoy!
Sponsored Links
Sponsored Links

Comments 63 Comments - Go to Forum Thread »

• Please Register at PS4News.com or Login to make comments on Site News articles.
 
#23 - saviour07 - 256w ago
saviour07's Avatar
Quote Originally Posted by Kraken View Post
Having the method of dumping out there could allow people with different (older?) firmware versions to dump their firmware which could lead to the discovery of some security holes that $ony patched and that were never found.

Oh yeh i fully understand that as being another benefit to having a tutorial on how it was done

When replying to the post I quoted though, they asked if any of the dev's understood how it could be done and then possibly recreate the process, where I wanted to point out that for dev's recreating the process would be unnecessary at this point unless they wish to try and experiment with other ways of finding an expolit but using this method of dumping the GameOS.

If people out there wish to recreate the process though, that is one of the bonus's of DemonHades and JaicraB sharing the method used

Also if someone does this on an older FW and discovers an exploit, then there's always the possibility of finding a way to downgrade and then use the exploit from there

#22 - CJPC - 256w ago
CJPC's Avatar
Quote Originally Posted by Mbb View Post
Not everyone can submit there posts since you need to be a registered user

One of the perks of making decent posts and having a good reputation - your account will get promoted.

#21 - moneymaker - 256w ago
moneymaker's Avatar
Quote Originally Posted by CJPC View Post

Believe it or not, at least by default (as in, no internal Sony firmware) a DECR can not use linux - so all the magic would have to occur from within the GameOS.


Not hard to believe at all, this leaves the high-loaded supermicrokernel the better option, at this point I wonder if the 32MB of extra RAM in a fully HW/BC unit could be of some use....

#20 - Mbb - 256w ago
Mbb's Avatar
Quote Originally Posted by CJPC View Post
However, for any news - you will have a much better chance getting your post on the frontpage if you submit it here: http://www.ps4news.com/submit

Not everyone can submit there posts since you need to be a registered user

#19 - CJPC - 256w ago
CJPC's Avatar
Quote Originally Posted by dondolo View Post
i tried to post the guide yesterday in the afternoon but i suppose i'm still under moderation.

Actually many users posted the guide, having multiple posts on it would get confusing. We do of course, appreciate the post.

However, for any news - you will have a much better chance getting your post on the frontpage if you submit it here: http://www.ps4news.com/submit

Quote Originally Posted by moneymaker View Post
Maybe on a DECR it could be done even better since there is little to no chance to expand RAM onto a retail/debug unit...

Believe it or not, at least by default (as in, no internal Sony firmware) a DECR can not use linux - so all the magic would have to occur from within the GameOS.

#18 - moneymaker - 256w ago
moneymaker's Avatar
Quote Originally Posted by sapperlott View Post
Yup - that might indeed be a problem. But if it's the case it should be visible in the dump quite easily since LV2 and Linux data will be intermingled then.


About this I've to point out that HV is not currently hijackable while in XMB, why it should keep track of memory block allocation when translating to alternate OS ?

Data would be corrupted cause HV is not knowing it should keep track of the RAM content into this process, nothing tells it to do it and keeping the RAM content alive is not preventing linux to overwrite it while HV tables are gone, this leads to the need of using unallocated memory blocks to boot linux, guessing for example that the higher you can boot it the better the result...

Obviously this could be done better with a "made on purpose" microkernel requiring the lowest amount of memory possible....in the try to dodge useful content...

Maybe on a DECR it could be done even better since there is little to no chance to expand RAM onto a retail/debug unit...

EDIT: otherwise it could be possible to boot into linux, map the memory, instruct the HV and then switch to XMB, do what we have to do and then switch back to linux keeping memory alive....but I'm not sure neither I've time to try...

#17 - sapperlott - 256w ago
sapperlott's Avatar
Quote Originally Posted by moneymaker View Post
It's not a bad idea at all but... who tells the linux OS to NOT overwrite memory blocks used by XMB ?

This needs a specially crafted allocation table in the initrd to work, otherwise the system booting may corrupt the RAM content...

Am I wrong ? And who tell us the memory blocks which are not used by XMB in order to use them to boot linux ?

Experience maybe, just try, try, try again I suppose...
Yup - that might indeed be a problem. But if it's the case it should be visible in the dump quite easily since LV2 and Linux data will be intermingled then.

#16 - Kraken - 256w ago
Kraken's Avatar
Having the method of dumping out there could allow people with different (older?) firmware versions to dump their firmware which could lead to the discovery of some security holes that $ony patched and that were never found.

#15 - zeromx - 256w ago
zeromx's Avatar
Hey,

Again this seem like great development towards some progress. I hope we have something soon... Keep up the great work everyone...

#14 - aries2k6 - 256w ago
aries2k6's Avatar
This is great!!! Now that just about everything on the ps3 is ready to be examined, I'm hoping we'll be able to see something for the basic user.

Good luck to everyone who's putting the effort into it. i'm guessing there's going to be people with reverse engineering skills needed. I hope a few step up to the plate and deliver.

Great job!!!

 

Sponsored Links

Sponsored Links







Advertising - Affiliates - Contact Us - PS4 Downloads - PS4 Forums - Privacy Statement - Site Rules - Top - © 2015 PlayStation 4 News