GeoHot Releases PS3 Hack, Exploit Your System and Enjoy!

[conee]

Hey Mdiv,

Gave your circuit a run - alas it does not "appear" to work. Wired into the PS3, it won't even hiccup (vs say, directly grounding the line) Just to make sure, I rebuilt the thing from all new parts (again). Any suggestions?

Edit: Finally got "something" after making a modification (pin 6 held high), basically getting it to successfully install the exploit (twice), but then crashing soon there after. Over the course of two hours managed to get it to hit twice, so it may need a bit of work, but the general principle does seem sound - question is, is it too slow, or something else?

I took a look at his datasheet.. seems the propagation delay isn't equal on both sides (high/low vs low/high). normally shouldn't be that much of a problem, except that the propagation delay difference is on the order of your pulse width. at 5V, datasheet specifies worst case scenario for the difference at 10ns, and typical case at 5ns.

i'm not sure how sensitive the timing is for this glitch to work, but with the circuit the way mdiv designed it, you'll be putting in anywhere from a 45ns pulse to a 50ns pulse (this is also disregarding the capacitor's charging characteristic and whether it performs within a tight enough tolerance).

[p00chie]

It's a shame i've got no ps3. i have a spartan3-an evaluation kit and even virtex4 ml405 by my side. what i am trying to say is that if someone gets a board i could provide the source code to trigger the 40ns and i can create the *.bit file if you tell the fpga.

just a help if someone gets his hands on such a board and don't know how to program/code for them.

msg me if you need any help...

[Mdiv]

I took a look at his datasheet.. seems the propagation delay isn't equal on both sides (high/low vs low/high). normally shouldn't be that much of a problem, except that the propagation delay difference is on the order of your pulse width. at 5V, datasheet specifies worst case scenario for the difference at 10ns, and typical case at 5ns.

i'm not sure how sensitive the timing is for this glitch to work, but with the circuit the way mdiv designed it, you'll be putting in anywhere from a 45ns pulse to a 50ns pulse (this is also disregarding the capacitor's charging characteristic and whether it performs within a tight enough tolerance).

PSPICE sims with that very circuit gave a high pulse for 30-35 nS then rolled off down to 0V at 45-50 nS. If you want to replace the bilateral switch for a transistor it might work a little bit better and be more accurate timing wise. Base to pin 3, Collector to PS3, Emitter to ground. Also, talking to my tutor the smaller the capacitor the more defined the pulse will be with less roll off.

So if you can, try C = 10pF, R = 3k6 Ohms (40nS)
If no luck try C = 10pF, R = 3k1 Ohms (to allow for 5 nS delay).

[SCE]

OK I have ordered the parts 4016 and 555. So, I am screwed

[veggav]

Ok, Why 40ns pulse ? 39 and 41ns would not work ? O.o

Geohot has guessed the exact right time you need ?

[TUHTA]

Mdiv does your 40ns button is fully work? I just assemble it but it isn't?! i just press it sometimes and its not!!

[Mdiv]

Mdiv does your 40ns button is fully work? I just assemble it but it isn't?! i just press it sometimes and its not!!

I haven't made one yet, Uni work has taken priority. Try wiring Pin 6 to Pin 2, that might solve it, I think CJPC has wired Pin 6 to 5V directly. I have see 1 shot 555 timers in both configurations and some work one way and the others work a different way.

Check the data sheet for your 555 chip to see if pin 4 inverts the signal or not. If it does invert it that's fine, if it doesn't wire pin 4 to ground.

[TUHTA]

Pings on what? HFE... or NE555? just can you upload ur new flasher diagram..

[mrbeers]

I'm fairly new to the site. I have been reading through a lot of various threads and noticed since Geohot released his hack, most people have become impatient lost their appreciation to the devs that are spending their time and working hard on researching and developing things that will make our PS3 experience a lot better at no cost to us.

So without flaming anyone or calling anyone fake or complaining about what has or has not been done, my thanks and gratitude goes to the people that are working on the PS3. Whether progress has been made or not.

I dont need to mention names. You know who you are. And I hope others will post their appreciation as well.

Thanks.

[CJPC]

Pings on what? HFE... or NE555? just can you upload ur new flasher diagram..

I've yet to try this (will later) but the diagram that Mdiv mentioned, wiring pin 6 to 2, is attached!