PS3 Hack Exploit SX28 Hardware Arrives, Bring on the Hypervisor!

[CJPC]

Yeah, at the moment our data is a tad corrupted, for instance the TEXT:

.sys.loasys.loadys.load.s.load.i.load.imload.imaoad.imagad.imaged.image..image.iimage.inmage.in_age.in_rge.in_roe.in_rom.in_rom.in_rom..n_rom..._rom....rom....

Which, should be:

.sys.load.image.in_rom.

007379732e6c6f61
7379732e6c6f6164
79732e6c6f61642e
732e6c6f61642e69
2e6c6f61642e696d
6c6f61642e696d61
6f61642e696d6167
61642e696d616765
642e696d6167652e
2e696d6167652e69
696d6167652e696e
6d6167652e696e5f
6167652e696e5f72
67652e696e5f726f
652e696e5f726f6d
2e696e5f726f6d00
696e5f726f6d0000
6e5f726f6d000000
5f726f6d00000000
726f6d0000000000

As you can see, the data is offset quite a bit, let alone every time I crash the PS3 it takes nearly one hour to get the sploit back!

[Reaper2122]

(CJPC after a day's work) "I Got Blisters On My Fingers" if anyone gets the reference kudos to you.

[Raze1988]

As you can see, the data is offset quite a bit, let alone every time I crash the PS3 it takes nearly one hour to get the sploit back!

Damn, that sounds exhausting

But that line of corrupted text sounds like a little child who tries learning to read

im..ima...image!

[puppero]

Well, it seems to me that, as it's usual for a 64bit architecture, you are just reading 8 bytes at a time. So to fix this it would be enough to change your reading loop from

for(i=0;i<N;i++)
dump(lv1_peek(i+base));

to

for(i=0;i<N;i+=8)
dump(lv1_peek(i+base));

[moneymaker]

CJPC, how much are you in a mood to try kicking-in a quicker signal to do the sploit ?

Maybe going down near as possible as we can to 1,25ns (that's the initial timing of the XDR set) it could be possible to avoid data corruption...

[CJPC]

Well, it seems to me that, as it's usual for a 64bit architecture, you are just reading 8 bytes at a time. So to fix this it would be enough to change your reading loop from

for(i=0;i<N;i++)
dump(lv1_peek(i+base));

to

for(i=0;i<N;i+=8)
dump(lv1_peek(i+base));

Heh thanks - that would be the exact issue and fix - nice work!

Of course, in the mean-while we sorted another (more automated) way to get it dumped - stay tuned!

[moneymaker]

Like a modded keyboard with a delay cell to synchronyze the input of the signal right after the input of the "disallocate" command ?

[ekrboi]

As you can see, the data is offset quite a bit, let alone every time I crash the PS3 it takes nearly one hour to get the sploit back!

i'm more of a reader than a poster.. but i had been wondering if this was a one time deal or if it had to be redone every time it reboots.. I assumed by the way it works it had to be redone every time... which i'm sure sucks! Good luck though! I can't wait to see the dumps.. doubt i will find anything with my current limited knowledge but i do know how to work ida and i'm sure i'll waste a few nites staring at stuff i don't understand for the heck of it =P

[Tender Phantom]

This is great, hopefully someone will find something to enable some sweetass homebrew

I was also wondering after you have all snooped around a little and hopefully learnt some new things, would it make it any easier to craft say for example malformed tiff images or saved games etc?

[Hemanleo]

good luck. Hope we can have something going on the near future!