GeoHot Resumes Sony PS3 Hacking, Opens PS3 Hacks Blog

[semitope]

This weekend GeoHot, the hacker responsible for several Apple iPhone hacks, has returned to Sony PS3 hacking after his initial announcement a few months back and has opened a PS3 hacks blog (linked above).

He recently made this http://twitter.com/geohot/status/7073023086:

"I just pulled everything from the USB bus... http://pastie.org/757313 the Cell processor SPI bus, PS3 is going down :-)"

These are the latest posts on his new PS3 hacks blog:

Cell SPI

The Cell processor has an SPI port which is used to configure the chip on startup. Well documented https://www-01.ibm.com/chips/techlib/techlib.nsf/techdocs/BD3F1F4C3DB32C7487257142006131BC/$file/CellBE_HIG_90nm_v1.5_30Nov2007_pub.pdf. It also allows hypervisor level MMIO registers to be accessed. In the PS3, the south bridge sets up the cell, and the traces connecting them are on the bottom layer of the board. Cut them and stick an FPGA between.

Quick theoretical attack. Set an SPU's user memory region to overlap with the current HTAB. Change the HTAB to allow read/write to the hypervisor! If that works it's full compromise of the PPU.


A Real Challenge

The PS3 has been on the market for over three years now, and it is yet to be hacked. It's time for that to change.

I spent three weeks in Boston working software only, but now I'm home and have hardware. My end goal is to enable unsigned code execution, making every unit into a test and opening up a third party development community, either through software or hardware (with a mod chip). The PS3 is a prime example of how security should be done, very open docs wise, and the thing even runs Linux. But it isn't unbreakable :-)


More PlayStation 3 News...

[PS3 News]

A bunch of people submitted this news hehe, +Rep for the post semitope and also if urbanracer34 replies here I will +Rep you too as your submission was nice but I could only pick one to approve.

[ModderFokker]

Hope it works somehow.

Wanted to stream a movie a couple of minutes back but no audio came out of the system.

[urbanracer34]

A bunch of people submitted this news hehe, +Rep for the post semitope and also if urbanracer34 replies here I will +Rep you too as your submission was nice but I could only pick one to approve.

That's alright. It happens.

[PS3 News]

That's alright. It happens.

Indeed.. and +Rep!

[Ihatecompvir]

Amazing news. Makes me think this guy will do it, and in the next month or so we will see "PS3 Hello World!"

[red8316]

Great news, the more people with the skills and insight to attack this beast (PS3) the better. And acronyms according to Google / Wiki for the less savvy as myself :

MMIO = Memory Mapped Input Output
FPGA = Field-Programmable Gate Array

Hoping all the news and peoples efforts lead to a awesome new year for the PS3. Need to catch up on those 360 hacks

[Raze1988]

The news just keep coming!
I wonder who'll be faster: CJPC & Crew who already know a lot, or GeoHot the genius?

[joni84]

Great, i hope he finally manages to hack the PS3, i want some homebrew like in the PSP.

[adrianc1982]

Great, i hope he finally manages to hack the PS3, i want some homebrew like in the PSP.

I just hope that a hack doesnt destroy the awesome online comunity the ps3 has. I know I've said it enough times to make some of you sick, but the ps3 is a great machine the way it is. Sure you need money to full on games but we get linux, and the movie player is not half-bad reencoding is a must some time but hey it plays video. I wish you luck geohot with your project, thanks for the iphone hack I still remember using 2 needles to flash it.