Sponsored Links

Sponsored Links

XorHack v2.0: The Updated PS3 Exploit Toolkit Arrives


Sponsored Links
248w ago - Today xorloser has updated his XorHack PS3 Exploit Toolkit to XorHack v2.0!

Download: [Register or Login to view links]

To quote: After using the XorHack for a while I realised it was missing some things so I decided it was time for an update. New syscalls have been added to give finer control over data access, now providing 8, 16, 32 and 64 bit reads and writes.

Also some new ioctls were added to provide additional useful functions for your userland code. Lastly new userland applications were added which now give the ability to read, write and execute memory from the command line.

Hypervisor Exploit Changes

At the innermost level some more syscalls are now added to the hypervisor when initially exploiting the PS3. These use different syscall numbers to the previous exploit code in order to group them all together rather than scattering them all over the place.

This should make keeping track of them easier. There are now nine syscalls added to the PS3 upon exploiting. These are added as syscalls 32 to 40 inclusive. Previously syscalls 16 and 20 were used for 64bit peek and 64bit poke, but these syscalls are no longer setup.

Kernel Module Changes

In the middle level I added interfacing support to the nine new syscalls as well as a new ioctl to let user apps convert lpar addresses to real addresses and yet another to let user apps perform an ioremap on memory. I also fixed the syscall that executes code via a real memory address since previously it wasn't saving the link register, which is not good..

Lastly I tracked down the problem I was having with calling ioctls from userland code. It turns out there are issues sending ioctls to a 64bit kernel from 32bit userland code. When you send the ioctl from your userland code there is a hidden function that attempts to "make it compatible" before sending it on to the kernel. This was transparently causing some ioctls to not make it to my kernel code

Things like this are why I hate linux hehe. It looked like fixing this was going to require a rebuild of sections of the kernel, so instead I brute force tried all ioctl numbers until I found a nice bunch that made it through ok and settled for using them instead. When sending these ioctls a handle to the XorHack device is used, so I am not too worried about them going astray and wreaking havoc.

User Library Changes

Finally the on outermost level I added support for calling the new syscalls to read and write 8, 16, 32, or 64 bits at a time. In doing so I support unaligned addresses without the user having to check or worry about such things. If the address being accessed is aligned it will access it in a single syscall of the specified size.

If the address is unaligned it will either use multiple syscalls or a syscall of a larger access size. I also added functions to easily check if the system has been exploited yet, to perform the lpar address to real address translation, io-remapping of addresses and to execute code at a given real address.

A new header file xorhack_sc.h was added which contains translations between syscalls as they would be used in kernel mode and the userland interface. I have only done a few here, but it should be enough to follow the pattern and create translations for any other syscalls. If anyone does complete these translations, please send it to me to include in the next version of XorHack.

Sample Application Changes

As well as the above additions and changes to userland code I have added three new command line applications; ps3peek, ps3poke and ps3exec which allow reading, writing and executing of memory. The ps3peek and ps3poke tools work in a similar fashion.

Both are able to perform 8bit, 16bit, 32bit and 64bit data accesses and can access multiple amounts of the data size in one call. The ps3peek tool can print data to screen as hex values and ascii characters similar to the display of a hex editor, or be printed as binary data and redirected into a file.

The ps3poke tool does not print data to screen but can write data to memory from values passed on the command line or values read from a file.

Here are some examples of what these tools can be used for.

Dumping the Hypervisor

This reads 0–10000000 bytes (16MB) of data starting at address zero using a data access size of 8 bytes (64bits) and prints it in binary form which gets redirected into the hvdump.bin file. Note that the 64bit access is used since it requires 8 times less syscalls to get the same amount of information as if we used the default 8bit access.

ps3peek 0 -s 0–1000000 -d 8 -b > hvdump.bin

Reading the status register for spu0

ps3peek 0–20000044024 -d 4

Loading metldr..

Scripts can be written using ps3peek, ps3poke and ps3exec and utilising files to store values between calls. By doing so many tasks can be done such as the setting of the required registers to load metldr.

Everyone loves pictures

The following is a picture taken with my dodgy G1 iPhone camera to show peek and poke in action. One day I will get a decent camera...



Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter, Facebook and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene and PlayStation 4 scene updates and fresh homebrew releases!

Comments 6 Comments - Go to Forum Thread »

• Please Register at PS3News.com or Login to make comments on Site News articles.
 
#6 - PS3 News - 241w ago
PS3 News's Avatar
Here is an update to xorhack_sc.h from covenant, to quote:
A small update to and probably the last from me for a while as I need to get to grips with IDA now: [Register or Login to view links]

This version is rather verbose as it also contains most of the notes I collected from the ps2dev wiki, as much code as I can put together around the undocumented calls (based on present knowledge - hence IDA) and a number of corrections to typos, mistakes etc. The xorhack tools compile cleanly with this version of xorhack_sc.h on my PS3 (Ubuntu 8.10).

I hope it is of some use.

The code is below as well:

[Register or Login to view code]


#5 - proskopina - 248w ago
proskopina's Avatar
yes it looks like really a breakthrough... I was following the progress of hacking psp from beginning, of course I used many of the mods and hack on my psp, and it looks similar. I think its a big step.

#4 - vandalj - 248w ago
vandalj's Avatar
Quote Originally Posted by IuMb View Post
I have a question, can you make the custom soundtrack work for ALL games with the hack? that would be great!

As stated above, this hack tool is explicitly for exploring the PS3's innards with the hardware exploit.

#3 - sapperlott - 248w ago
sapperlott's Avatar
Quote Originally Posted by IuMb View Post
I have a question, can you make the custom soundtrack work for ALL games with the hack? that would be great!
No. Neither that nor playing pirated games. Right now you can't do anything with the hack an end user would benefit from - it's strictly a hacker / developer toy.

#2 - IuMb - 248w ago
IuMb's Avatar
I have a question, can you make the custom soundtrack work for ALL games with the hack? that would be great!

 

Sponsored Links

Sponsored Links
Sponsored Links

Sponsored Links







Advertising - Affiliates - Contact Us - PS3 Downloads - PS3 Forums - Privacy Statement - Site Rules - Top - © 2015 PlayStation 3 News