PS3 Hypervisor LV2 (GameOS) Dump Method is Revealed!

[ps3junkie2010]

As promised, today JaicraB has revealed the PS3 Hypervisor LV2 (GameOS) dump method and circuit used to allow the PS3's memory to persist while booting into OtherOS, which then allows dumping of the memory.

This was apparently on a CECHG model system with board model SEM-001 1-875-384-21

To quote, roughly translated: DemonHades / JaicraB Extraction Method:

First of all, be careful if you're going to attempt this, I am not responsible.

It's about keeping the RAM alive when moving to OtherOS. To do this the ram must be fed at all times so as not to erase the data.

Overview map
Refer to the First Image below.

Zone A


This area is sensitive. At that point we had settled with two resistors together. You have to remove it (remove it, but you could also cause a short circuit). It has 4 legs. At this point it tells the RAM and the integrated MOSFET turns off.

Zone B


From the point labeled we get the feed. You can put anywhere on the track.

Zone C


At this point labeled we have to make a bridge to defeat the two resistors.

Zone D


The original point of the exploit.

Mini Circuit
Refer to the Second Image below.

The Technique

It is possible that the first time you start count him to do for the recovery.

It Summarized a bit with the following steps:

- Log into XMB.
- Touching, ejectura, configure, filling the memory with more information.
- Run a game, insert a BD, etc, etc.
- Then boot to OtherOS.
- Dump memory to exploit.

Remember: The first 36 Megabytes are the "privileged memory" that contains LV00, LV1, LV2. The rest is waste memory of XMB (very interesting) and data from OtherOS.

The next thing to try is to start a tiny linux system and do a full dump. So we would get more data from the XMB and less disturbed memory (from OtherOS)

The bad thing is my two-week vacation is over :( (I would have liked to have one more week to follow up).

Good luck to all and share!



More PlayStation 3 News...

[SCE]

Thank you guys for your contribution to the ^^Scene^^.

[colima]

He has update his blog, he somewhat explains how he did it.

[dc740]

What JaicraB basically says in his new blogpost is that what he did is try to keep the RAM alive after he boots into otherOS... so he literally removed some resistances to keep the circuit closed, so the RAM would keep the information on it.

Zone A
He REMOVED (completely) two resistances that where together so he would be able to give power independently. (At least that's what he says). I suppose that when he says "tiene 4 patas" (it has 4 pins) he is talking about the resistances...

Zone B
This is where he gets the power (read the Zone A description) to keep the RAM working.

Zona C
He makes a bridge there to cancel the resistances in those places

Zona D
We all know this one. this is the magical point that revived the ps3 scene

Circuit
C goes to the power suply from "Zona B". A and B go to "Zona A".

After that, he explains that the ideal way to get the dump is to use the PS3 to do some stuffs before perfoming the dump... put a game on it, try to load the RAM with information. and after that, boot into game os to exploit it...

[PS3 News]

OK I moved the post to the Site News of yours ps3junkie2010 and merged the others to this thread. I gave +Rep to everyone who replied as well, but removed the duplicate guide posts and left the comments and additional translations.

[Pcsx2006]

Thanks very much JaicraB and DemonHades your contributions to the scene will never be forgotten. thank you once again and i hope you guys keep working like this bcz due to people like you scene is alive and will remains alive forever.

[Warrorar]

very nice, i hope someone will find a hole in the lv2 dump.

would be awsome to see a cfw with backup support and 3D Output

[Christiann]

This might sound interesting:

Download a demo from the playstation store and install it (usually a .pkg file). Then boot into OtherOS, and use the exploit to dump the lv2/GameOS memory. If we got lucky, the memory dump contains the decryption key which was used to decrypt the .pkg demo file.

[proskopina]

thanks guys you working so hard!! i think soon we will have something out of this!!!

[Raze1988]

Man, that looks so very complicated. I hope the guys who dumped the HV before have no problem understanding/reproducing this.