Essentially what it does is modify the PS3's hypervisor adding two calls for reading/writing to all of the system memory.
To quote: "In the interest of openness, I've decided to release the exploit. Hopefully, this will ignite the PS3 scene, and you will organize and figure out how to use this to do practical things, like the iPhone when jailbreaks were first released. I have a life to get back to and can't keep working on this all day and night.
Please document your findings on the psDevWiki. They have been a great resource so far, and with the power this exploit gives, opens tons of new stuff to document. I'd like to see the missing HV calls filled in, nice memory maps, the boot chain better documented, and progress on a 3D GPU driver. And of course, the search for a software exploit.
This is the coveted PS3 exploit, gives full memory access and therefore ring 0 access from OtherOS. Enjoy your hypervisor dumps. This is known to work with version 2.4.2 only, but I imagine it works on all current versions. Maybe later I'll write up how it works
I've gotten confirmation the exploit works on 3.10. Also I've heard about compile issues on Fedora. I did this in Ubuntu.
Compile and run the kernel module.
When the "PRESS THE BUTTON IN THE MIDDLE OF THIS" comes on, pulse the line circled in the picture low for ~40ns.
Try this multiple times, I rigged an FPGA button to send the pulse.
Sometimes it kernel panics, sometimes it lv1 panics, but sometimes you get the exploit!!
If the module exits, you are now exploited.
This adds two new HV calls,
u64 lv1_peek(16)(u64 address)
void lv1_poke(20)(u64 address, u64 data)
which allow any access to real memory.
The PS3 is hacked, its your job to figure out something useful to do with it.
How it works:
geohot: well actually it's pretty simple
geohot: i allocate a piece of memory
geohot: using map_htab and write_htab, you can figure out the real address of the memory
geohot: which is a big win, and something the hv shouldn't allow
geohot: i fill the htab with tons of entries pointing to that piece of memory
geohot: and since i allocated it, i can map it read/write
geohot: then, i deallocate the memory
geohot: all those entries are set to invalid
geohot: well while it's setting entries invalid, i glitch the memory control bus
geohot: the cache writeback misses the memory
geohot: and i have entries allowing r/w to a piece of memory the hypervisor thinks is deallocated
geohot: then i create a virtual segment with the htab overlapping that piece of memory i have
geohot: write an entry into the virtual segment htab allowing r/w to the main segment htab
geohot: switch to virtual segment
geohot: write to main segment htab a r/w mapping of itself
geohot: switch back
geohot: and would work if memory were encrypted or had ECC
geohot: the way i actually glitch the memory bus is really funny
geohot: i have a button on my FPGA board
geohot: that pulses low for 40ns
geohot: i set up the htab with the tons of entries
geohot: and spam press the button
geohot: right after i send the deallocate call
On the Isolated SPUs
Today I verified my theories about running the isolated SPUs as crypto engines. I believe that defeats the last technical argument against the PS3 being hacked.
In OtherOS, all 7 SPUs are idle. You can command an SPU (which I'll leave as an exercise to the reader) to load metldr, from that load the loader of your choice, and from that decrypt what you choose, everything from pkgs to selfs. Including those from future versions.
The PPU is higher on the control chain then the SPUs. Even if checks were to be added to, for example, verify the hypervisor before decrypting the kernel, with clever memory mappings you can hide your modified hypervisor.
Ah, but you still didn't get the Cell root key. And I/we never will. But it doesn't matter. For example, we don't have either the iPhone or PSP "root key". But I don't think anyone doubts the hackedness of those systems.
I wonder if any systems out there are actually secure?
Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!
for a micro-controller solution, have you looked at the arduino? with all the development and user knowledge surrounding the arduino i would think there would be a way to program it to send a low pulse through one of the digital out pins.
unfortunately that's not how a diode works. it passes current when the threshold voltage from - to + crosses Vt, usually something around 0.7v. your circuit will not conduct current when the output is at logic high, however when the low pulse is sent it still does nothing. diodes are not multidirectional (for the most part, not counting breakdown zones). it will allow the board connection to pass through the diode only if the bus is running at logic high, and on top of that the output pin on the 555 is not ground, and will not act as a ground. build the schematic in spice to see for yourself, the circuit does nothing.
I missed some posts in this thread i'm rereading them but meanwhile i didn't get why we have to use inverter. I used diode on circuit because diode block 5V so only low pulse will be go to board when you press button. I'm looking for also micro-controller based solutions but no luck yet.
unfortunately this will not work. i'm not sure if you think you know what you're doing, but a diode is not an inverter. on top of this, your "design", if it worked correctly (which it doesn't) would run into the same issues as my previous one did, which is while the circuit is ON, you'll be pushing vcc onto the ram bus and completely screwing up any communication on that line. 5V doesn't matter where you source it from, you could have a test bench with a power supply and this would still work.
According to my search 555 can pulse with in 40 second but Conee is right about pull-up resistor. Schema must be like,
Without pull-up resistor circuit trigger more then one it self when you push the button. And i think we have to get 5V nearest contact place for circuit because low pulse doesn't mean anything for memory if you supply voltage from outside to circuit. And one more if anyone can access oscilloscope please test circuit for to be sure.
According to calculations,
R1 : 121 ohm
C1 : 300 pf
D1 : 1N4148 supply low pulse from pin3 if i'm not wrong.