PS3 Hypervisor and Bootloader Memory Dump Publically Leaked

[ionbladez]

Yo know this sucks for me, bad.

First I had to get rid of my PS3 because I needed cash, now my laptop is dead, and my server is failing too.

I've been messing with this dump basically because I'd like to help
but no PS3, I wish someone would send me one

Can't even work on my SSL project - That's on my laptop and my server is RAID so I can't connect the HDD.

However I'm finding a few "easter eggs" in this dump, one made me LOL pretty hard last night.

[titanmkd]

I suppose we can give it a try and see what happens... it's now linked on the main Forum page (pictured below) for better accessibility.

Ok i have found some interesting things in dump:

0x00500000 - Start of HTAB (key 0x1408F92C94401)
0x00500008 - Real Addr of hypervisor _exploit @ 0x003B4000 (hypervisor_exploit_lv1_peek)
0x00600000 - End of HTAB

Hypervisor Exploit code:
hypervisor_exploit_lv1_peek ->
@0x003B4000
E8 63 00 00 ld r3, 0(r3)
4E 80 00 20 blr

hypervisor_exploit_lv1_poke
@0x003B4008
F8 83 00 00 std r4, 0(r3)
38 60 00 00 li r3, 0
4E 80 00 20 blr

I have added those informations on the wiki ps3hvdoc.

Lot of other things to come soon ...

It will be great to have also the dmesg output included with the dump because some address are related to it ...

[ju2ef]

Thats what I've found:

00080018 gsboot: load_lv2: filename: %s \n
00080040 gsboot: load_lv2: lpar_id: %d laid: %d \n

and:

00080118 SLL: auth_lv2 called\n
00080130 SLL: auth_lv2 fail @%d \n
000807D8 SL:auth_lv2 ret_value %d\n
000828F0 security_policy_manager::initialize
00082A30 ln security_policy_manager::register_rule:

If thats useful tell me, I'll look for more!

Is that RSX driver path?

[TUHTA]

so i found something interesting lvl2....

00080010-00080030 gsboot: load_lv2: filename: %s

and i dont this one ...but i think its like something with internet,like sockets

00081960-00081A20
 # pme_client::disconnect : PID=%u
!!! pme_client::disconnect : close failed (errno=%d)
# pme_client::connect : PID=%u, portid=%u
pme_client:connect : socket failed (errno=%d)

And this....
00083400-00083420
access_control_if::get_memory(%d)

And something more...
00084200-00084250
max system bytes = %10lu
system bytes     = %10lu
in use bytes     = %10lu

00085140-00085170
/dev/rflash
/dev/eflash
/_init_storage/
/dev/flash_num
0008EC90
asecure_loader

Something SPU
000CF550-000CF560
aim_spu_module.self

.....
000CF750-000CF780
SCE_CELLOS_SS_INDI_INFO_EID
### unmap pages metldr

000CF930-000CF940
SCE_CELLOS_SS_SECURE_RTC

well i found more but it will be so long Message !

Hope this will help and... can i add this on wiki page?

[ju2ef]

What about: 0012A2C0 /local_sys0/ps2emu/ps2_softemu.self

Can you do something with this, can you run it, anything?

[oyashio]

What about: 0012A2C0 /local_sys0/ps2emu/ps2_softemu.self

Can you do something with this, can you run it, anything?

This shows us where the ps2 emu is located and it could an indication that there's already a completely SW-based ps2 emu in the software, but disabled or enabled(?) (cfr. youtube-link of running ps2 on a 40g console).

yes of course you can run it if you have access to the file.. decrypting and modifying is also possible with that...

[TUHTA]

added some more information to ps3hv wiki like i found place of lvl2_kernel.self

well its preatty interesting most files like Linux OS

[sapperlott]

After some little research in the dump at @ from 0x0000 to 0x1800 there is the Vector Table/Exception Table:

@0x0100 System Reset Interrupt
@0x0200 Machine Check Interrupt
@0x0300 Data Storage Interrupt
@0x0380 Data Segment Interrupt
@0x0400 Instruction Storage Interrupt
@0x0480 Instruction Segment Interrupt
@0x0500 External Interrupt
@0x0600 Alignment Interrupt
@0x0700 Program Interrupt
@0x0800 FloatingPoint Unavailable Interrupt
@0x0900 Decrementer Interrupt
@0x0980 Hypervisor Decrementer Interrupt
@0x0C00 System Call Interrupt (very interesting ;)
@0x0D00 Trace Interrupt
@0x0F20 VXU Unavailable Interrupt
@0x1200 System Error Interrupt
@0x1600 Maintenance Interrupt
@0x1800 Thermal Management Interrupt

First of all - nice catch! Could you tell me where you got the names of the vectors > 0x1000 from? Power ISA v2.03 (attached; page 412) states that 0x0000-0x0fff contains the interrupt vectors and that 0x1000-0x2fff is reserved for implementation-specific purposes.

Apart from the ones you posted the ISA lists 0x0f00 as "Performance Monitor Interrupt" and 0x0f20 is named "Vector Unavailable Interrupt" there.

[koerdecke]

Hey Guys

i found something very interesting with the Hex-Editor MX, so i'm german, the program too. i'm not a good coder and have began to learn hex and disassemblering but there was a info about the file and the date: 4.4.2009?!

so look for yourself i think it says when the file was made, or i'm wrong?

[PS3 News]

there was a info about the file and the date: 4.4.2009?!

Yea, that is just the date of the person's PC for the file... nothing of interest as obviously we know it's incorrect.

Some more updates:

http://wiki.ps2dev.org/ps3:memory_map
http://wiki.ps2dev.org/ps3:ppc:op_codes