166w ago - Just over a month ago the PS3 Hypervisor lv2 (GameOS) was dumped and
GeoHot hinted that it was accomplished by commanding an SPU to load METLDR.
Today
dondolo let us know that
simone has detailed how to load METLDR in SPU isolation mode on the PlayStation 3 and included some
source code.
While this is definitely a step forward, he still doesn't specify what the read/write u32 functions are... or which functions to add to the recent
XorHack release.
Those interested can check it out below, and to quote:
"After some experiment I succeded to load METLDR in spu isolation.
You need geohot's exploit to do this, because you need to turn spu relocation off (MFC_SR1[R]=0) and not let know the HV you are using a SPU (so no calls to lv1_construct_logical_spe or similar). For some strange conf, it doesn't work in HV way."
really looking forward to seeing what all the fuss is about over this game,on my new ps4 .LOL...
think of it like this !, you're searching for a treasure but you don't have a map, so you now don't know where to begin your search, if you got the map now you know the location of the treasure no one knows for sure if you find it or not but at least you know it's place, this level2 dump is like a map for the ps3 OS, a lot of hidden info will be available for devs after they get it maybe they get lucky and find holes in the system that will lead them to software hacks.
about the modchip, we have geohot's method.. it's already doing a modchip's job.
Of course, it may only be usermode code (or, perhaps kernel mode), but it would still be a very nice step in the right direction!
and what will you do if holes won't be found? which way then will you go? create a modchip or something like that? (i even don't own a ps3 and just intereting)
This is how isolation mode is handled by spufs. This basically does the same but might be a bit more readable:
http://lxr.linux.no/#linux+v2.6.33/arch/powerpc/platforms/cell/spufs/run.c#L81
Well, as we all know, LV2 = our glorious kernel. With the kernel, it can be reversed and holes can be looked for - possibly leading the way to load unsigned code straight from the XMB without any hardware (on any model of PS3, slim included).
Of course, it may only be usermode code (or, perhaps kernel mode), but it would still be a very nice step in the right direction!
Did I miss something or is this address just an offset on top of an (unknown) base address?