Sponsored Links

Sponsored Links

PS3 Hypervisor LV2 (GameOS) Dump Method is Revealed!


Sponsored Links
233w ago - As promised, today JaicraB has revealed the PS3 Hypervisor LV2 (GameOS) dump method and circuit used to allow the PS3's memory to persist while booting into OtherOS, which then allows dumping of the memory.

This was apparently on a CECHG model system with board model SEM-001 1-875-384-21

To quote, roughly translated: DemonHades / JaicraB Extraction Method:

First of all, be careful if you're going to attempt this, I am not responsible.

It's about keeping the RAM alive when moving to OtherOS. To do this the ram must be fed at all times so as not to erase the data.

Overview map
Refer to the First Image below.

Zone A
http://4.bp.blogspot.com/_4rtVxQc9D6s/S7dexn30R7I/AAAAAAAAAFs/tpo2XxknPKs/s1600/Zona+A.JPG

This area is sensitive. At that point we had settled with two resistors together. You have to remove it (remove it, but you could also cause a short circuit). It has 4 legs. At this point it tells the RAM and the integrated MOSFET turns off.

Zone B
http://3.bp.blogspot.com/_4rtVxQc9D6s/S7deyC8VeyI/AAAAAAAAAF0/bGUuh1knvRA/s1600/Zona+B.JPG

From the point labeled we get the feed. You can put anywhere on the track.

Zone C
http://2.bp.blogspot.com/_4rtVxQc9D6s/S7deye-D8wI/AAAAAAAAAF8/1EeIUE6Keyw/s1600/Zona+C.JPG

At this point labeled we have to make a bridge to defeat the two resistors.

Zone D
http://2.bp.blogspot.com/_4rtVxQc9D6s/S7dYDoRKnRI/AAAAAAAAAE0/tp9grVoM5kQ/s1600/Zona+D.jpg

The original point of the exploit.

Mini Circuit
Refer to the Second Image below.

The Technique

It is possible that the first time you start count him to do for the recovery.

It Summarized a bit with the following steps:

• Log into XMB.
• Touching, ejectura, configure, filling the memory with more information.
• Run a game, insert a BD, etc, etc.
• Then boot to OtherOS.
• Dump memory to exploit.

Remember: The first 36 Megabytes are the "privileged memory" that contains LV00, LV1, LV2. The rest is waste memory of XMB (very interesting) and data from OtherOS.

The next thing to try is to start a tiny linux system and do a full dump. So we would get more data from the XMB and less disturbed memory (from OtherOS)

The bad thing is my two-week vacation is over (I would have liked to have one more week to follow up).

Good luck to all and share!





Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!

Comments 63 Comments - Go to Forum Thread »

• Please Register at PS3News.com or Login to make comments on Site News articles. Thanks!

SCE's Avatar
#58 - SCE - 232w ago
So, any ideas how to start making a better dump? At least telling kernel to not to use first 36 MB of RAM?

moneymaker's Avatar
#57 - moneymaker - 232w ago
Quote Originally Posted by sapperlott View Post
SPU Isolation is a hardware feature - not much you can do about it in software (even if it's written in Assembler ).

Hehe... "isolated"... this means no data "enters" the SPU and no data "exits" from there ? NO!

Isolated my rear, let we say it only executes fixed tasks (among which there is also one task we could like to show Kanna her's system is not forced to be unbreakable cause everyone thinks it's unbreakable...

By "hardware" it means it should not be any bus connections between the SPU and the rest of the processor and you have to connect directly on the SPU bus to reach it... and this is not true...cause actually it performs action (de/cypher) on data that runs "through" it... if it were truly isolated it could act only as an hardware replacement protection...

Furthermore there is no hardware that runs by itself "without" software, and both of them could be initialized someway and what proprietary software can also self written LM can...

Yeah, it's a very secure system but's not WrathofGod-proof...

It CAN be found an appropriate use for it's potential, believe me or not, unfortunately I'm not at the level to gain more out of this my idea, specially in theese ones that are hard times for me.

sapperlott's Avatar
#56 - sapperlott - 232w ago
SPU Isolation is a hardware feature - not much you can do about it in software (even if it's written in Assembler ).

moneymaker's Avatar
#55 - moneymaker - 232w ago
Quote Originally Posted by SCE View Post
Actually Geo was talking about this in the beginning of his work on PS3. But since it required an expensive device , he didn't go that way...

Hehe, brain is the most expensive device...

However each system has it's own Achille's heel, if the isolated SPU cannot be manipulated in regular ways it doesn't mean it has not the ability to decrypt it's own content if it should be feeded to the SPU itself through the normal channel, it's "isolated" between quotes cause it actually decrypts everything is /needed/feeded ...if introduced in the right way....

Next step is to dump the SPU cache, it's a pain, I admit it... but bare metal assembler code it's really powerful... maybe it's not impossible...

SCE's Avatar
#54 - SCE - 232w ago
Quote Originally Posted by sapperlott View Post
It's the memory bus - you have to know how the system talks to the memory first before trying to tap it. Just forget about tapping into the XDR memory.


Actually Geo was talking about this in the beginning of his work on PS3. But since it required an expensive device , he didn't go that way...

Sponsored Links

Sponsored Links
Sponsored Links

Sponsored Links







Advertising - Affiliates - Contact Us - PS3 Downloads - Privacy Statement - Site Rules - Top - © 2014 PlayStation 3 News