Sponsored Links

Sponsored Links

PS3 Hypervisor LV2 (GameOS) Dump Method is Revealed!


Sponsored Links
226w ago - As promised, today JaicraB has revealed the PS3 Hypervisor LV2 (GameOS) dump method and circuit used to allow the PS3's memory to persist while booting into OtherOS, which then allows dumping of the memory.

This was apparently on a CECHG model system with board model SEM-001 1-875-384-21

To quote, roughly translated: DemonHades / JaicraB Extraction Method:

First of all, be careful if you're going to attempt this, I am not responsible.

It's about keeping the RAM alive when moving to OtherOS. To do this the ram must be fed at all times so as not to erase the data.

Overview map
Refer to the First Image below.

Zone A
http://4.bp.blogspot.com/_4rtVxQc9D6s/S7dexn30R7I/AAAAAAAAAFs/tpo2XxknPKs/s1600/Zona+A.JPG

This area is sensitive. At that point we had settled with two resistors together. You have to remove it (remove it, but you could also cause a short circuit). It has 4 legs. At this point it tells the RAM and the integrated MOSFET turns off.

Zone B
http://3.bp.blogspot.com/_4rtVxQc9D6s/S7deyC8VeyI/AAAAAAAAAF0/bGUuh1knvRA/s1600/Zona+B.JPG

From the point labeled we get the feed. You can put anywhere on the track.

Zone C
http://2.bp.blogspot.com/_4rtVxQc9D6s/S7deye-D8wI/AAAAAAAAAF8/1EeIUE6Keyw/s1600/Zona+C.JPG

At this point labeled we have to make a bridge to defeat the two resistors.

Zone D
http://2.bp.blogspot.com/_4rtVxQc9D6s/S7dYDoRKnRI/AAAAAAAAAE0/tp9grVoM5kQ/s1600/Zona+D.jpg

The original point of the exploit.

Mini Circuit
Refer to the Second Image below.

The Technique

It is possible that the first time you start count him to do for the recovery.

It Summarized a bit with the following steps:

• Log into XMB.
• Touching, ejectura, configure, filling the memory with more information.
• Run a game, insert a BD, etc, etc.
• Then boot to OtherOS.
• Dump memory to exploit.

Remember: The first 36 Megabytes are the "privileged memory" that contains LV00, LV1, LV2. The rest is waste memory of XMB (very interesting) and data from OtherOS.

The next thing to try is to start a tiny linux system and do a full dump. So we would get more data from the XMB and less disturbed memory (from OtherOS)

The bad thing is my two-week vacation is over (I would have liked to have one more week to follow up).

Good luck to all and share!





Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!

Comments 63 Comments - Go to Forum Thread »

• Please Register at PS3News.com or Login to make comments on Site News articles. Thanks!

CodeKiller's Avatar
#38 - CodeKiller - 226w ago
hmm... so if i understand what i've been reading right, the hypervisor dump that we got was polluted with linux code,
actually it is the lv2 right now.. the hypervisor have been done a few weeks back.
yes, some part of it has been overwritten but hey, there is at least something to start with!
another option is to figure out how to build an external chip, aka MODCHIP (i know everyone cringes at the mention as they require hardware modification but this dose too), that would somehow record and output all everything thats loaded into the ram or other chips be recoded and outputted to a computer. but this is a very complicated process and could take years.
well, it's not the cross-dump, but the content of the ram what has the problems: AFAIK the ram can be decoded by the runnung sys (thus it's encrypted)

laggmaster's Avatar
#37 - laggmaster - 226w ago
hmm... so if i understand what i've been reading right, the hypervisor dump that we got was polluted with linux code, the solution to this would be to try to rework the otheros bootstrap which would just dump the same data without the linux code mixed into it, this would require the bootstrap to load from somewhere in the memory after the 36mb of code that we actually want (possibly by moving the bootstraps load location to the hardware on a HWBC console), this should give us our golden key right?... well ok, a map to the golden key but you know what i'm saying.

another option is to figure out how to build an external chip, aka MODCHIP (i know everyone cringes at the mention as they require hardware modification but this dose too), that would somehow record and output all everything thats loaded into the ram or other chips be recoded and outputted to a computer. but this is a very complicated process and could take years.

DemonHades's Avatar
#36 - DemonHades - 226w ago
Nice catch! The only problem is that the bootloader used on the PS3 is a small Linux system itself so by the time this parameter is evaluated the bootloader Linux system is already loaded into memory without any contstaints. It would be possible to re-build the bootloader image with the same parameters, though.
hi, is posible build a bld whith the ps3sdk,but the problem is the store dump file.

The sdk ps3 dont have include for mount and storage.

the best is using ethernet cable for dump,using a otheros whith it support but need included the exploit files

1saludo and yes that dump have parts linux,remember when rst don't volatilice the ram the old data mix with the new.

moneymaker's Avatar
#35 - moneymaker - 226w ago
Nice catch! The only problem is that the bootloader used on the PS3 is a small Linux system itself so by the time this parameter is evaluated the bootloader Linux system is already loaded into memory without any contstaints. It would be possible to re-build the bootloader image with the same parameters, though.

Nice point, beside the LILO/GRUB he catched as an example is our case petiteboot/kboot that's better to rebuild..

Building a kernel image as small as possible and running it into the highest memory space avaliable coul make the thing easier..

Even better could be to find a way to run a minimal linux in the backward compatibility reserved memory (32MB) of some models but this, even if possible, could envolve quite more work...

sapperlott's Avatar
#34 - sapperlott - 226w ago
First of all, there's a few linux kernel boot options which may be useful in making sure that the kernel doesn't overwrite the first 36MB of RAM. From the kernel documentation:

memmap=nn[KMG]$ss[KMG]
Mark specific memory as reserved. Region of memory to be used, from ss to ss+nn. Example: Exclude memory from 0x18690000-0x1869ffff:
memmap=64K$0x18690000
or
memmap=0x10000$0x18690000Nice catch! The only problem is that the bootloader used on the PS3 is a small Linux system itself so by the time this parameter is evaluated the bootloader Linux system is already loaded into memory without any contstaints. It would be possible to re-build the bootloader image with the same parameters, though.

Sponsored Links

Sponsored Links
Sponsored Links

Sponsored Links







Affiliates - Contact Us - PS3 Downloads - Privacy Statement - Site Rules - Top - © 2014 PlayStation 3 News