Video: PS3 System Crash During Firmware Investigation

[Hosted]

Hello to all members. A week ago I found very useful information of what kind of software (firmware) is inside this powerful box PS3, and I was shocked by the level of protection and level of firmware.

XMB is running in virtualized space (other os too) with conditions that controlled by "Super Hardware Administrator"-its not real name, (there is no Hypervisor like all of you like to say, it has something like that but, the system name is other, we have a deal with strong coded engineered system)

There is so much conditions in the firmware, that $ony and some other good companies create for it, that you even can`t imagine. Under other os I tried too run some other code of software that tries to load some stuff and first results like crashing system in to yellow light and then to blinking red I gained, my ps3 is working fine after that.

Now I`m waiting for a 250gb hdd to install RadHat or Suse (i don't decide yet wich is better for my investigation but both are good) and after that i maybe will have much more information about a system, but now i know a lot about it. I found useful information about what kind of software is inside, how information crypto working (about every 64k point on hdd and how this data crypto is made and why)

Maybe latter I will found a way to dump a firmware, but now I only gathering information and reading a lot of special literature. But even now I can say that downgrade of firmware will be impossible I think, because the original firmware don`t support downgrade and if it does its only for fixing and applying patches to the system. The another big problem is the limited ram (only 256) for that kind of system is very low and debugging in take much more time.

And another very interesting thing is that the original firmware has a daemon that send all information about every error on the firmware to the servers of the company. (with "original firmware" I mean the firmware that is very similar to the $ony Ps3) Tomorrow I will post a test file.

PS.
Sorry for my english


More PlayStation 3 News...

[r3pek]

let's see what comes out of this....

[zomgheals]

Very interesting video :P

keep up the work

[Hosted]

To portably describe object modules, ELF files start with a file header and zero or more program or section headers. The file header also contains the information needed to read the program or section headers; these headers might change a little depending on architecture, so the file header has to indicate their size. The file header starts with four magic numbers: 0x7F, 0x45, 0x4c, and 0x46, in that order. (This corresponds to an ASCII DEL, and the word "ELF.") This is not a four-byte magic number; it is four one-byte magic numbers. If it were a four-byte magic number, there would be endianness problems and the format wouldn't be all cool and portable. The next few bytes indicate the ELF specification revision, the architecture "class" (32-bit or 64-bit, which affects the size of fields in program and section headers), the data-storage format (either big-endian or little-endian two's complement), and information about what ABI to use. There is some divergence in documentation about the remainder of these bytes: some of them are padding, but some implementations document extensions here which may or may not be in use. Various tools use the ELF file header, ranging from linkers to program loaders, to figure out what a file is and what to do with it. Users rarely interact with it. Developers mostly use it through tools, ranging from file to various other types of linkers. PowerPC users will be very glad to note that the header distinguishes between endianness and processor architecture. The ET_CORE file type is only partially specified. Such a file is a core file and while it uses the ELF format at least partially (for instance, an ELF core file should contain sections with standard section headers), there is no detailed specification of how to handle things like register dumps. Program headers are used only in shared libraries and executable programs -- section headers, by contrast, are used in everything. Program headers are needed to create a process image; there might be multiple program headers containing information about a program. Program headers might contain hints about needed dynamic libraries, instructions on where to find a suitable loader, and so on. Dynamically linked executables specify an interpreter (for instance, /lib64/ld-linux-x86-64.so.2 on an x86_64 Linux system or the more prosaic /lib/ld.so.1 on a generic PowerPC Linux). Static executables have simpler program headers because they're self-contained files. For instance, this output from NetBSD's readelf program shows the program headers of a static binary: Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align LOAD 0x000000 0x08048000 0x08048000 0x3ecb14 0x3ecb14 R E 0x1000 LOAD 0x3ed460 0x08438460 0x08438460 0x1e63c 0x289608 RW 0x1000 NOTE 0x000094 0x08048094 0x08048094 0x00018 0x00018 R 0x4 This indicates two sections to be loaded: One read-only section of executable code and one read-write section of initialized data. The NOTE section is purely informative. The offset and filesize values indicate the location and size of the data in the object file (or executable); the memory size and address indicate where to store it at runtime and how much space to allocate. In some cases, the amount of space reserved at runtime may be much larger than the space taken up on disk; this would typically reflect a lot of memory which has been initialized to all zeroes. Section headers serve similar functions to program headers, containing information needed by a program loader, such as actual data or code (code is often called "text" just to confuse you). Many specific types are provided for, such as symbol tables, string tables, or even "array of constructors." Nonetheless, the essential contents are similar.

now take the ps3 update file *.pup and open it with winhex.. find ELF in text and then look to the offset open file in atach with winhex too

The test file is a simple yaboot image for booting another Os, but then you try to run it Ps3 crashes to yelov and then to blinking red light. Just uzip it to usb flash, boot to otherOs and run it.

Attached Images

3.jpg (262.4 KB, 111 views)

[diocan]

why are you saying that ps3 doesn't support downgrade ? for example: for the test unit there are fw capable of downgrade :>

[Hosted]

downgrade on debug consoles supported, but on retail it might be possible but i`m not sure at 100%. Downgrade is made for applying patches. We will see what we can do

[r3pek]

I can be wrong but.... nothing that wasn't known already...

http://www.ibm.com/developerworks/power/library/pa-spec12/

[CJPC]

Well its interesting, but in practice the SELF header is required so the system will know how to decrypt it. There are "flags" in the header that tell it what type of file and how to decrypt - if I had to guess, the system may be crashing due to the fact that it can't parse the resulting (encrypted) elf correctly.

[PS3 News]

Originally Posted by Hosted The test file is a simple yaboot image for booting another Os, but then you try to run it Ps3 crashes to yelov and then to blinking red light. Just uzip it to usb flash, boot to otherOs and run it.

I moved your post to the site news, and merged the other posts after it auto-copied to the Forums.

I also removed your "test.zip" file since this isn't in the PS3 Dev area now.. if you are OK with readding it we can, I think it's fairly harmless myself so let me know.

This was a PITA to reorder, so for future reference it's best to Submit news/videos and then they will get copied to the Forums when they go live... versus trying to make a post like this in the PS3 Dev forum where few people will ever see it unless it's auto-copied from the main page.

[Hosted]

Originally Posted by CJPC Well its interesting, but in practice the SELF header is required so the system will know how to decrypt it. There are "flags" in the header that tell it what type of file and how to decrypt - if I had to guess, the system may be crashing due to the fact that it can't parse the resulting (encrypted) elf correctly.

After header of elf file goes system identification information. I posted information about elf higher in this post. If system cannot decrypt it like you say, the file cannot be run at all and an error message will be displayed. Im still waiting for my new 250gb hdd