To quote: After using the XorHack for a while I realised it was missing some things so I decided it was time for an update. New syscalls have been added to give finer control over data access, now providing 8, 16, 32 and 64 bit reads and writes.
Also some new ioctls were added to provide additional useful functions for your userland code. Lastly new userland applications were added which now give the ability to read, write and execute memory from the command line.
Hypervisor Exploit Changes
At the innermost level some more syscalls are now added to the hypervisor when initially exploiting the PS3. These use different syscall numbers to the previous exploit code in order to group them all together rather than scattering them all over the place.
This should make keeping track of them easier. There are now nine syscalls added to the PS3 upon exploiting. These are added as syscalls 32 to 40 inclusive. Previously syscalls 16 and 20 were used...
194w ago - Today GeoHot has posted a few pictures (below) with the title "Custom Themes?" on the latest PlayStation 3 blog entry, however, no other useful details are available of the PS3 hack demonstration.
To speculate, it appears to illustrate modifying the PS3 GameOS XMB memory areas, but this was already known over a month ago when word first spread of the PS3 Hypervisor lv2 being dumped and reversed.
It's an RCO file edit, just like RCO edits on the PSP (almost same format too). RCO files are resource files for VSH plugins, live in the dev_flash, and aren't signed. To edit them on your system, patch your hypervisor to allow encrypted access to the partition (flash on old systems, hd on new), and mod ps3pf_storage. dev_flash is just a FAT partition, mount it in Linux and change what you'd like.
Nevertheless, it looks like progress is indeed being made editing and replacing an RCO in /dev_flash/vsh/resource/, although it would be nice if the information was made public so that other PS3 Devs in the scene could join in the fun.
From NDT: Le foto sono vere al 100% Ha modificato gli RCO dal dump della ram ma dato che non sono signed questo significa proprio poco. Si vede che stava cercando anche lui qualcosa da postare.
Rough translation: The photos are real 100% Changed...
195w ago - Just over a month ago the PS3 Hypervisor lv2 (GameOS) was dumped and GeoHothinted that it was accomplished by commanding an SPU to load METLDR.
Today dondolo let us know that simone has detailed how to load METLDR in SPU isolation mode on the PlayStation 3 and included some source code.
While this is definitely a step forward, he still doesn't specify what the read/write u32 functions are... or which functions to add to the recent XorHack release.
Those interested can check it out below, and to quote:
"After some experiment I succeded to load METLDR in spu isolation.
You need geohot's exploit to do this, because you need to turn spu relocation off (MFC_SR1[R]=0) and not let know the HV you are using a SPU (so no calls to lv1_construct_logical_spe or similar). For some strange conf, it doesn't work in HV way."
196w ago - Today modrobert has released PS3 Glitch Finder v1.0, which is a VHDL design for Spartan-3 (eg. xc3s400) FPGAs with the purpose of easily creating a custom pulse which can be used to glitch various hardware like the PS3 memory bus.
From the ReadMe file: The pulse LOW and HIGH multipliers have a resolution of 255 (X"FF") and can be set independently.
• Cycle exact pulse generator process tested with logic analyzer
• Digital Clock Manager (DCM) primitive @ 200MHz (5ns) with lock handling
• Continuous pulse or one-shot mode selectable via switch
• Debounce handling for push buttons to prevent erratic behavior
• Set the LOW and HIGH pulse length multipliers via buttons
• 7-seg LED display support showing HIGH and LOW pulse multipliers
• Open source release under GPL v2
The target device is a Spartan-3 fitted on an FPGA board (eg. Spartan-3 Starter Kit, Basys, Nexys, or similar). You need 5 push buttons (3 is ok also), a four digit "seven-segment" LED display, a dip switch, two regular LEDs, an external crystal/clock at 25MHz or 50Mhz,...