164w ago - As promised, today JaicraB has revealed the PS3 Hypervisor LV2 (GameOS) dump method and circuit used to allow the PS3's memory to persist while booting into OtherOS, which then allows dumping of the memory.
This was apparently on a CECHG model system with board model SEM-001 1-875-384-21
To quote, roughly translated: DemonHades / JaicraB Extraction Method:
First of all, be careful if you're going to attempt this, I am not responsible.
It's about keeping the RAM alive when moving to OtherOS. To do this the ram must be fed at all times so as not to erase the data.
Overview map Refer to the First Image below.
Zone A http://4.bp.blogspot.com/_4rtVxQc9D6s/S7dexn30R7I/AAAAAAAAAFs/tpo2XxknPKs/s1600/Zona+A.JPG
This area is sensitive. At that point we had settled with two resistors together. You have to remove it (remove it, but you could also cause a short circuit). It has 4 legs. At this point it tells the RAM and the integrated MOSFET turns off.
Zone B http://3.bp.blogspot.com/_4rtVxQc9D6s/S7deyC8VeyI/AAAAAAAAAF0/bGUuh1knvRA/s1600/Zona+B.JPG
From the point labeled we get the feed. You can put anywhere on the track.
Zone C http://2.bp.blogspot.com/_4rtVxQc9D6s/S7deye-D8wI/AAAAAAAAAF8/1EeIUE6Keyw/s1600/Zona+C.JPG
At this point labeled we have to make a bridge to defeat the two resistors.
Zone D http://2.bp.blogspot.com/_4rtVxQc9D6s/S7dYDoRKnRI/AAAAAAAAAE0/tp9grVoM5kQ/s1600/Zona+D.jpg
The original point of the exploit.
Mini Circuit Refer to the Second Image below.
It is possible that the first time you start count him to do for the recovery.
It Summarized a bit with the following steps:
• Log into XMB.
• Touching, ejectura, configure, filling the memory with more information.
• Run a game, insert a BD, etc, etc.
• Then boot to OtherOS.
• Dump memory to exploit.
Remember: The first 36 Megabytes are the "privileged memory" that contains LV00, LV1, LV2. The rest is waste memory of XMB (very interesting) and data from OtherOS.
The next thing to try is to start a tiny linux system and do a full dump. So we would get more data from the XMB and less disturbed memory (from OtherOS)
The bad thing is my two-week vacation is over (I would have liked to have one more week to follow up).
Good luck to all and share!
Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!
well what my idea from the infectus was based on was some way to read the ram being it still has poer and all all we need to figure out is a tool to read the ram and the pin out for where to connect such tool.
the reason i used the infectus as an example is it has an external USB port as well as external power how ever im unshure like i said of the hardware or what it would really take to retreive dump from a system ultimitly not loading the otheros kernal what so ever (i.e something that runs a linux kernal indepetently of the PS3 as the ram still contains the data and is still supplied with power kinda like using the xbox PSU to power the DVD rom during a CFW flash)