PS3 Hypervisor and Bootloader Memory Dump Publically Leaked

[Lucifer Kain]

Hi to all and thanks to all involved

I dunno if this is of any help but I found a prog its called bintext and its free you can find it here:

http://www.foundstone.com/us/resources/proddesc/bintext.htm

and is much simpler to use then HEX this is for noobs only like me and I've post a pic of a possibily usb dongle?? could it be the one sony use to unbrick ps3?

[sapperlott]

Looks like the NAND index is shadowed at 0xe3080 with entries in the following format:
(u64) offset, (u64) size, filename

A bit less noise in this thread would be nice though. It's cool that you want to help but if you can't resist the urge to post random bits you have found in the dump with absolutely no idea what they might be doing please at least don't ask if that could help enable <cool feature XY> - most of the time it won't.

And if you don't even know what PPC assembler is supposed to look like please don't bother installing IDA and toying around with the dump - that certainly won't lead to any significant insights.

I really don't want to sound arrogant but it would be a shame if the relevant info in this thread is buried under loads of wild but ultimately irrelevant guesses.

[sapperlott]

Hey George - nice to see you around (despite the occasional whining).

Three quick questions since you're here:
- is metldr individualized per unit or could one take it from the leaked dump and run it on any PS3?
- is there a reason you wrote your own kernel module to load metldr into a isolated SPE instead of using the functions provided by spufs / libspe2?
- could you provide some info what's going on inside the boom_lpar() function since it's missing from the kernel module you posted on your blog?

[geohot]

1. No it's the same
2. That kernel module doesn't work.
3. It isn't important, it just gets the real address so I could know which SPE it is.

[micro87]

+Rep to you too dondolo, as even CJPC couldn't dig that up earlier tonight when he was scouring the Interwebs... tho actually, I think it was the 5.6 Disassembler itself but still nice.

I haven't got the 5.6 Disassembler but I do have "IDA.Pro.Advanced.v5.5.incl.Hex.Rays.Decompiler.v1 .1-iND" if that's of any help to you.

[titanmkd]

After some little research in the dump at @ from 0x0000 to 0x1800 there is the Vector Table/Exception Table:

@0x0100 System Reset Interrupt
@0x0200 Machine Check Interrupt
@0x0300 Data Storage Interrupt
@0x0380 Data Segment Interrupt
@0x0400 Instruction Storage Interrupt
@0x0480 Instruction Segment Interrupt
@0x0500 External Interrupt
@0x0600 Alignment Interrupt
@0x0700 Program Interrupt
@0x0800 FloatingPoint Unavailable Interrupt
@0x0900 Decrementer Interrupt
@0x0980 Hypervisor Decrementer Interrupt
@0x0C00 System Call Interrupt (very interesting ;)
@0x0D00 Trace Interrupt
@0x0F20 VXU Unavailable Interrupt
@0x1200 System Error Interrupt
@0x1600 Maintenance Interrupt
@0x1800 Thermal Management Interrupt

[talruum]

I guess it's not "Linux concepts", it's an stripped AIX version. Anybody discovered any DMA address yet?

[sapperlott]

I guess it's not "Linux concepts", it's an stripped AIX version.

Being a Unix derivative doesn't make it a descendant of AIX per se. Could be BSD based as well. IBM isn't known for licensing AIX to other companies in source form to play around with

[talruum]

Being a Unix derivative doesn't make it a descendant of AIX per se. Could be BSD based as well. IBM isn't known for licensing AIX to other companies in source form to play around with

This kind of crypto system is AIX like. I always wonder about an AIX running on top of it, and the called "GameOS" it´s just a user frontend.

[yellowsnow]

Geohot just for reference what tools are you using to examine the dump.. anything that we aren't?

Also "HyperVisor in strings" for the people without linux much better then hex