Sponsored Links

Sponsored Links

 

How to Load METLDR in SPU Isolation Mode on PlayStation 3

1000°
232w ago - Just over a month ago the PS3 Hypervisor lv2 (GameOS) was dumped and GeoHot hinted that it was accomplished by commanding an SPU to load METLDR.

Today dondolo let us know that simone has detailed how to load METLDR in SPU isolation mode on the PlayStation 3 and included some [Register or Login to view links].

While this is definitely a step forward, he still doesn't specify what the read/write u32 functions are... or which functions to add to the recent XorHack release.

Those interested can check it out below, and to quote:

"After some experiment I succeded to load METLDR in spu isolation.

You need geohot's exploit to do this, because you need to turn spu relocation off (MFC_SR1[R]=0) and not let know the HV you are using a SPU (so no calls to lv1_construct_logical_spe or similar). For some strange conf, it doesn't work in HV way."
 

PS3 Glitch Finder v1.0 VHDL Design for Spartan-3 FPGAs Arrives

550°
233w ago - Today modrobert has released PS3 Glitch Finder v1.0, which is a VHDL design for Spartan-3 (eg. xc3s400) FPGAs with the purpose of easily creating a custom pulse which can be used to glitch various hardware like the PS3 memory bus.

Download: PS3 Glitch Finder v1.0 VHDL Design for Spartan-3 FPGAs

From the ReadMe file: The pulse LOW and HIGH multipliers have a resolution of 255 (X"FF") and can be set independently.

Features:

• Cycle exact pulse generator process tested with logic analyzer
• Digital Clock Manager (DCM) primitive @ 200MHz (5ns) with lock handling
• Continuous pulse or one-shot mode selectable via switch
• Debounce handling for push buttons to prevent erratic behavior
• Set the LOW and HIGH pulse length multipliers via buttons
• 7-seg LED display support showing HIGH and LOW pulse multipliers
• Open source release under GPL v2

Requirements:

The target device is a Spartan-3 fitted on an FPGA board (eg. Spartan-3 Starter Kit, Basys, Nexys, or similar). You need 5 push buttons (3 is ok also), a four digit "seven-segment" LED display, a dip switch, two regular LEDs, an external crystal/clock at 25MHz or 50Mhz,...
 

XorHack: The PS3 Exploit Toolkit is Now Available!

800°
234w ago - Today xorloser has shared his XorHack: The PS3 Exploit Toolkit which allows you to call lv1 syscalls (level 1 system calls) from a normal (userspace) program and run the software required when triggering the PS3 exploit from a normal userspace program.

To quote: I finally found the time to complete the PS3 exploit toolkit software I mentioned to in my previous posts. I call it [Register or Login to view links].

It allows you to call lv1 syscalls (level 1 system calls) from a normal (userspace) program. It also lets you run the software required when triggering the PS3 exploit from a normal userspace program. To give an example of how it can be used I have included the following example programs:

ps3exploit - Runs the software required to exploit the ps3, it loops a number of times which can be specified as a parameter. (This still must be used along with the "button pressing", it will not exploit the PS3 via software alone).
dumphv - Dumps the hypervisor to a file in the current directory.
dumpbl - Dumps the bootloader to a file in the current directory.
dumprom - Dumps the system rom to a file in the current directory.

The XorHack package contains full sourcecode...
 

PS3 PUP and SELF File Decoder Script v0.1 Now Available

350°
234w ago - I have just finished new little scripts for [Register or Login to view links] to decode / display / edit PS3 Update Files (PUP) and SELF files.

It is a work in progress and these scripts are not final script and contains lot of unknown things.

Download: PS3 PUP File Decoder Script v0.1 / PS3 SELF File Decoder Script v0.1

For 010 Editor beginners, see the 010 Editor how-to HERE.

Finally, feel free to add any findings to the [Register or Login to view links].

Best Regards,

TitanMKD
 

PS3 Hypervisor Dump Setup Script for IDA is Now Available

700°
235w ago - Today xorloser has shared a PS3 Hypervisor Dump setup script for [Register or Login to view links] (Interactive Disassembler), which automatically sets up function tables, resolves rtoc offsets and finds some common functions in PlayStation 3 Hypervisor Dumps for easier reversing.

Additionally, titanmkd has updated the script with a patch available HERE, and as a result xorloser has now made his more compatible with older versions of IDA and updated it yet again with peek/poke calls labeled.

To quote: "It seems someone took some initiative and made some software themselves to dump the hypervisor once they have the correct hardware and software. So for anyone who has used that and dumped their own hypervisor I present...
 
Sponsored Links

Sponsored Links
Sponsored Links

Sponsored Links






Affiliates - Contact Us - PS3 Downloads - Privacy Statement - Site Rules - Top - © 2014 PlayStation 3 News

Sponsored Links