PS3 Hypervisor Hacked

OK first of all I am allowing discussion PS3 hack news in this thread only. Any other post will be deleted.

We are NEVER to discuss modchips or piracy for the PS3. EVER. I should also add that this geohot guy is well known and if he thinks that for one second Sony will not stamp on his ass like a bug then he is superbly mistaken.

If you have to ask why then you are admitting to not read the rules when you joined here and you'll probably be booted from DF.

GeoHot, of Blackrain - the iphone hack, claims to have finally hacked the PS3. He also says its a hack that its unpatchable. Before you guys ask Unpatchable means NO PATCHING MODCHIP IS POSSIBLE - so no retarded questions asking about that !

See here...

FRIDAY, JANUARY 22, 2010

Hello hypervisor, I'm geohot
I have read/write access to the entire system memory, and HV level access to the processor. In other words, I have hacked the PS3. The rest is just software. And reversing. I have a lot of reversing ahead of me, as I now have dumps of LV0 and LV1. I've also dumped the NAND without removing it or a modchip.

3 years, 2 months, 11 days...thats a pretty secure system

Took 5 weeks, 3 in Boston, 2 here, very simple hardware cleverly applied, and some not so simple software.

Shout out to George Kharrat from iPhoneMod Brasil for giving me this PS3 a year and a half ago to hack. Sorry it took me so long

As far as the exploit goes, I'm not revealing it yet. The theory isn't really patchable, but they can make implementations much harder. Also, for obvious reasons I can't post dumps. I'm hoping to find the decryption keys and post them, but they may be embedded in hardware. Hopefully keys are setup like the iPhone's KBAG.

A lot more to come...follow @geohot on twitter

Blog here - ....

From ....


I know some function names, and now if calls have restrictions I don't like, I zap them.



What it is and what it isn't ....

First off, this is not a release blog like "On The iPhone .... If you are expecting some tool to be released from this blog like blackra1n, stop reading now. If you have a slim and are complaining this hack won't work for you, stop reading now. WE DO NOT CONDONE PIRACY, NOR WILL WE EVER. If you are looking for piracy, stop reading now. If you want to see the direction in which I will take this blog, read the early entries in the iPhone one. Information on this blog is for research purposes only.

That aside, I'll tell you what I have so far. I have added two hypercalls, lv1_peek and lv1_poke. peek reads memory in real space(including all the MMIO), poke writes it. I can also add other arbitrary hypercalls as I see fit.

The hypervisor is complicated, it is written in C++ and is PPC, which I am not that familiar with yet. At first I was trying to add a hypercall to add arbitrary real memory to the LPAR, but it kept crashing(because I can't code), which is really annoying, because I have to wait while Linux reboots.

Some people pointed out that I have not accessed the isolated SPEs. This is true. Although as far as doing anything with the system, it doesn't matter. The PPE can't read the isolated data, but it can kick the isolated SPEs out. Decrypt the PPE binary you need using the intact SPE and save the decrypted version. Kick out the SPE, and patch the decrypted version all you want. And interesting note, by the time you get to OtherOS, all 7 working SPEs are stopped.

Despite this, I am working on the isolated SPEs now(which I can now load), because what I'd really like to do is post decryption keys here so you guys can join the fun.

cool, saw this yesterday and its excellent news, gonna follow with interest

The 360 getting hacked didn't seem to do it any harm, so maybe this could be the kick up the ass the ps3 needed.

Good to see this being allowed to be discussed, was doing my head in looking at other ad infested forums

PlayStation 3 'hacked' by iPhone cracker


By Jonathan Fildes
Technology reporter, BBC News
....

.... The hack involves hardware and software

A US hacker who gained notoriety for unlocking Apple's iPhone as a teenager has told BBC News that he has now hacked Sony's PlayStation 3 (PS3).
George Hotz said the hack, which could allow people to run pirated games or homemade software, took him five weeks.
He said he was still refining the technique but intended to post full details online soon.
The PS3 is the only games console that has not been hacked, despite being on the market for three years.
"It's supposed to be unhackable - but nothing is unhackable," Mr Hotz told BBC News.
"I can now do whatever I want with the system. It's like I've got an awesome new power - I'm just not sure how to wield it."
Sony said it was "investigating the report" and would "clarify the situation" when it had more information.
'Open curiosity'
Mr Hotz said that he had begun the hack last summer when he had spent three weeks analysing the hardware.
After a long break, he spent a further two weeks cracking the console, which he described as a "very secure system".
He said that he was not yet ready to reveal the full details of the hack but said that it was "5% hardware and 95% software".
.... The hack could allow gamers to play pirated games

"You can use hardware to inject an insecurity and then you can build on that," he said.
He admitted that he had not managed to hack the whole system, including the protected memory, but had worked out ways to trick the console into doing what he wanted.
Mr Hotz said that he was continuing to work on the hack and, once finished, would publish details online in a similar way to his previous iPhone exploits.
In particular, he said, he would publish details of the console's "root key", a master code that once known would make it easier for others to decipher and hack other security features on the console.
He said his motivation was "curiosity" and "opening up the platform".
"To tell you the truth, I've never really played a PS3," he said. "I have one game, but I've never really played it."
Opening the system could allow people to install other operating systems on their console and play homemade games, he said.
In addition, he said, the hack would allow people to play older PS2 games on their consoles.
Recent versions of the PS3 do not have the ability to play PS2 games after Sony controversially removed a piece of hardware.
He admitted that it could also allow people to run pirated games.
"I'm not going to personally have anything to do with that," he told BBC News.
Gaming firms do not take the issue of game piracy and console modification lightly. Recently, Microsoft disconnected thousands of gamers from its online gaming service Xbox Live for modifying their consoles to play pirated games.
Mr Hotz said that the nature of his PS3 hack means that Sony may have difficulty patching the exploit.
"We are investigating the report and will clarify the situation once we have more information," said a Sony spokesman.
Mr Hotz rose to fame in 2007 at the age of 17 when he unlocked the iPhone, which could only be used on the AT&T network in the US at launch.
The hack allowed the popular handset to be used on any network.
He has since released various other hacks, allowing people to unlock later versions of the popular handset.

....

Any chance this kid can hack SKY now that would be fun.
C'mon Raptor put him to the challenge

The 360 getting hacked didn't seem to do it any harm, so maybe this could be the kick up the ass the ps3 needed.

It's ruined multiplayer MW2. :-(

Anyone else think he'll get a court order slapped on him before anything goes public ?

It's ruined multiplayer MW2. :-(

Sorry i can't see how that's relevant to what i meant, a hacked system will be tons more popular because you can play copied games on it.

Anyone else think he'll get a court order slapped on him before anything goes public ?

The japanese Yakuza will get him before that i reckon sent by Sony themselves !

Anyone else think he'll get a court order slapped on him before anything goes public ?

I was thinking that or he may be offered some cash to keep quiet.

If they've got any brains they will hire him

I was thinking that or he may be offered some cash to keep quiet.

He was offered a big bundle of cash for his jailbreak for 3.1.2 and declined it so chances are he'll dithering same


Hopefully

Good news, let's see where this goes but going by Sonys track record could be a bumpy ride... They obviously did a fantastic job designing the machine to let it last this long untainted. I only started using mine in November.