PS3 Hypervisor and Bootloader Memory Dump Publically Leaked

[jai]

In sc_proxy::write: workaround for SC firmware bug

lol, this is some kind of debug message related to the fix of the old "fw update bypass" through proxy

[e1ace]

I'm going to spend some of my lunch time at work looking for anything interesting.

Amazed with the progress so far though (I love public leaks).

[chipsy]

Anyone tried xorloser's plugin on older versions of IDA? 5.2, 5.5 anyone?

I tried it on 5.5 and I get this from the log

PowerPC Altivec Extension V1.6 (with VMX128 and Xenon opcodes) is enabled

I'm not 100% sure if the plugin actually works on 5.5 but I tried to play with the IDA..

[bullie]

To the guys that want to just check it out for fun why not look at with the strings command, so strings "*.bin | more" instead of pissing about with a hex editor. Yep you windoze people have no idea what I am talking about

Anyway been reading through and having a look, I could have a great rep if I post up every single thing from doing that command hey Boss? just kidding

like this

PS3_LPAR
/flh/os/lv2_kernel.self
SCE_CELLOS_SYSTEM_MGR
PS2_SW_LPAR
/local_sys0/ps2emu/ps2_softemu.self
SCE_CELLOS_SYSTEM_MGR_PS2_SW
LINUX_LPAR
/flh/lx/linux
SCE_CELLOS_SYSTEM_MGR_LINUX
LINUX_LPAR

Strings is your friend just like google.. Couldnt' edit my last post but I wanted to paste this instead of the other I found

sysmgr : number of system spus = %d
/dev/net0
/local_sys0/sys/internal/eurus_fw.bin
eurus_fw.bin
net_manager:: reset_eurus failed(%d) flag=%d
net_manager:: read_firmware invaild jump command : command=0x%08x, new_data_size=%d current_offset=%d, data_offset=%d
net_manager:: Error : eurus F/W download failed.
net_manager:: read_firmware invaild data : command=0x%08x, new_data_size=%d current_offset=%d, data_offset=%d
net_manager:: read_firmware data: %d, firm_offset: %d
net_manager:: put_firmware read firmware fails.
net_manager:: put_firmware ioctl (EURUS_FIRM) fails %d
net_manager:: open_firmware can't open file (FAT)
net_manager:: open_firmware open file (FAT)
net_manager:: open_firmware open file (COMPOSITE)
net_manager:: on_event_received ioctl (EURUS_STAT) failed.
net_manager:: on_event_received Error : eurus F/W download failed.
net_manager:: on_event_received firmware downloaded.
update
net_manager:: start_firmware_download get_node_value failed. %d
net_manager:: start_firmware_download
net_manager:: initialize ...
net_manager:: initialize couldn't open the file %s. (%d)
net_manager:: initialize mac_addr=0x%016lx
net_manager:: initialize ioctl (NET_INIT) fails %d
net_manager:: initialize ... completed.
1.2.3
  gosldr : * inflateInit: %s
  gosldr : * read error ext os
  gosldr : * inflate: %s
  gosldr : * overflow: %d
  gosldr : * unknown error
  gosldr : * inflateEnd: %s
  gosldr : found valid gos image
  gosldr : * mmap failed: errno = %d
  gosldr : inflating gos image
  gosldr : load gos image completed
/rmt/
timer : expired
timer : set alarm %d us
str_manager : delete_ata_key success
str_manager : * delete_ata_key failed (0x%x)
str_manager : skip delete_ata_key
str_manager : * read size error %d != %d
str_manager : event=%llu, bus_id=%llu, dev_id=%llu, port=%lld, dev_type=%llx
str_manager : * unknown event type (%d)
/dev/rbd0

cell_ext_os_area
  ext_os : * magic number invalid
  ext_os : * header version invalid
  ext_os : * read sysmgr area failed
  ext_os : * image size invalid
clear boot flag for external os!

[dondolo]

Many are currently using IDA with xorloser's plug-in (xorloser.com/blog/wp-content/uploads/2010/01/ppcaltivec_plugin_v1.6_for_ida_v5.6.zip), however, I have yet to see a "trial" version of v5.6 floating around.

I don't believe it will work with the older ones, but if anyone wants to check out v5.5 anyway a few links from Google are: rapidshare.com/files/323871806/HEX-RAYS_www.softarchive.net.rar or hotfile.com/dl/21372420/86412a4/HEX-RAYS_www.softarchive.net.rar.html

my small contribute for the community

http://rapidshare.com/files/34604363...K.v5.6-Lz0.rar
Hotfile

http://hotfile.com/dl/27210910/5d732...6-Lz0.rar.html

[PS3 News]

I could have a great rep if I post up every single thing from doing that command hey Boss? just kidding

Hehe.. I gave ya +Rep, mainly as I (like others here who are non-Devs) find it fascinating what can be accomplished when people start collaborating on a project like this.

One of the Devs is currently working on code that I believe attempts to bruteforce the Sony lpar id.. but it isn't ready just yet.

my small contribute for the community

+Rep to you too dondolo, as even CJPC couldn't dig that up earlier tonight when he was scouring the Interwebs... tho actually, I think it was the 5.6 Disassembler itself but still nice.

[jai]

There are also some interesting strings maybe related to the usb dongle used to access factory menu/configuration of the ps3

usb_dongle_authenticator::initialize
usb_dongle_authenticator::verify_response
dongle_id=%u
dongle ID revoked.
get_dongle_key error
usb_dongle_authenticator::generate_challenge
_USB_DONGLE_AUTH_USB_DONGLE_

[masri01]

It's good to be back from a long holiday Just keeps on getting better and better, doesn't it?

[Warrorar]

There are also some interesting strings maybe related to the usb dongle used to access factory menu/configuration of the ps3

usb_dongle_authenticator::initialize
usb_dongle_authenticator::verify_response
dongle_id=%u
dongle ID revoked.
get_dongle_key error
usb_dongle_authenticator::generate_challenge
_USB_DONGLE_AUTH_USB_DONGLE_

what was this dongle exactly for? O.o
converting retail into debug/test/service?

and to the other posts, nice job guys.
i love it to wake up, eat something, watch tv and see that people going fine in progress.

[Rav]

what was this dongle exactly for? O.o
converting retail into debug/test/service?

and to the other posts, nice job guys.
i love it to wake up, eat something, watch tv and see that people going fine in progress.

From what i know of the usb dongle jig, what it does is put the ps3 into factory service mode, which allows sony to fix the ps3, run tests etc.

From the project i know CJPC is working on i believe he is trying to turn a retail machine into a test debug unit which i don't believe has anything to do with the jig since, putting debug firmware on retail machine wise. for his project but i could be wrong