167w ago - As
promised, today
JaicraB has revealed the PS3 Hypervisor LV2 (GameOS) dump method and circuit used to allow the PS3's memory to persist while booting into OtherOS, which then allows dumping of the memory.
This was apparently on a
CECHG model system with board model
SEM-001 1-875-384-21
To quote, roughly translated:
DemonHades /
JaicraB Extraction Method:
First of all, be careful if you're going to attempt this, I am not responsible.
It's about keeping the RAM alive when moving to OtherOS. To do this the ram must be fed at all times so as not to erase the data.
Overview map
Refer to the First Image below.
Zone A
http://4.bp.blogspot.com/_4rtVxQc9D6s/S7dexn30R7I/AAAAAAAAAFs/tpo2XxknPKs/s1600/Zona+A.JPG
This area is sensitive. At that point we had settled with two resistors together. You have to remove it (remove it, but you could also cause a short circuit). It has 4 legs. At this point it tells the RAM and the integrated MOSFET turns off.
Zone B
http://3.bp.blogspot.com/_4rtVxQc9D6s/S7deyC8VeyI/AAAAAAAAAF0/bGUuh1knvRA/s1600/Zona+B.JPG
From the point labeled we get the feed. You can put anywhere on the track.
Zone C
http://2.bp.blogspot.com/_4rtVxQc9D6s/S7deye-D8wI/AAAAAAAAAF8/1EeIUE6Keyw/s1600/Zona+C.JPG
At this point labeled we have to make a bridge to defeat the two resistors.
Zone D
http://2.bp.blogspot.com/_4rtVxQc9D6s/S7dYDoRKnRI/AAAAAAAAAE0/tp9grVoM5kQ/s1600/Zona+D.jpg
The original point of the exploit.
Mini Circuit
Refer to the Second Image below.
The Technique
It is possible that the first time you start count him to do for the recovery.
It Summarized a bit with the following steps:
• Log into XMB.
• Touching, ejectura, configure, filling the memory with more information.
• Run a game, insert a BD, etc, etc.
• Then boot to OtherOS.
• Dump memory to exploit.
Remember: The first 36 Megabytes are the "privileged memory" that contains LV00, LV1, LV2. The rest is waste memory of XMB (very interesting) and data from OtherOS.
The next thing to try is to start a tiny linux system and do a full dump. So we would get more data from the XMB and less disturbed memory (from OtherOS)
The bad thing is my two-week vacation is over
(I would have liked to have one more week to follow up).
Good luck to all and share!
After swapping back in my original 160GB HDD, I was still getting the 8002F281 error. I ended up having to do a full PS3 Reset and reformat of the 160...
Oh yeh i fully understand that as being another benefit to having a tutorial on how it was done
When replying to the post I quoted though, they asked if any of the dev's understood how it could be done and then possibly recreate the process, where I wanted to point out that for dev's recreating the process would be unnecessary at this point unless they wish to try and experiment with other ways of finding an expolit but using this method of dumping the GameOS.
If people out there wish to recreate the process though, that is one of the bonus's of DemonHades and JaicraB sharing the method used
Also if someone does this on an older FW and discovers an exploit, then there's always the possibility of finding a way to downgrade and then use the exploit from there
One of the perks of making decent posts and having a good reputation - your account will get promoted.
Believe it or not, at least by default (as in, no internal Sony firmware) a DECR can not use linux - so all the magic would have to occur from within the GameOS.
Not hard to believe at all, this leaves the high-loaded supermicrokernel the better option, at this point I wonder if the 32MB of extra RAM in a fully HW/BC unit could be of some use....
Not everyone can submit there posts since you need to be a registered user
Actually many users posted the guide, having multiple posts on it would get confusing. We do of course, appreciate the post.
However, for any news - you will have a much better chance getting your post on the frontpage if you submit it here: http://www.ps3news.com/submit
Believe it or not, at least by default (as in, no internal Sony firmware) a DECR can not use linux - so all the magic would have to occur from within the GameOS.