Sponsored Links

Sponsored Links

 

PS3 Hypervisor Dump Setup Script for IDA is Now Available

700°
253w ago - Today xorloser has shared a PS3 Hypervisor Dump setup script for [Register or Login to view links] (Interactive Disassembler), which automatically sets up function tables, resolves rtoc offsets and finds some common functions in PlayStation 3 Hypervisor Dumps for easier reversing.

Additionally, titanmkd has updated the script with a patch available HERE, and as a result xorloser has now made his more compatible with older versions of IDA and updated it yet again with peek/poke calls labeled.

To quote: "It seems someone took some initiative and made some software themselves to dump the hypervisor once they have the correct hardware and software. So for anyone who has used that and dumped their own hypervisor I present...
 

PS3 Memory Dump Hypervisor Call Table Finder Tool is Available

500°
253w ago - I have just finished another (first is HERE) little 010 Editor script to search the Hypervisor Call Table on any PS3 Memory Dump.

Requirements: [Register or Login to view links], script PS3MemDump_hv_call_table.bt and PS3_Memory_Dump.bin.

See also the source of the script in attachment.

Little how to for 010 Editor:

1. If you do not already have 010 Editor -> Download and install a free 30-day trial for Windows 7/Vista/XP/2000 of [Register or Login to view links].
2. Unzip the archive (PS3MemDump_hv_call_table.zip) in attachement in your documents path for example C:/MyDocuments/SweetScape/010 Templates/
3. Start 010 Editor.
4. Click on shortcut Ctrl+O (menu File -> Open File...) and choose the file PS3_Memory_Dump.bin.
5. Click on shortcut Ctrl+F5 (menu...
 

PS3 Hypervisor and Bootloader Memory Dump Publically Leaked

1300°
254w ago - Just a few days after kakarotoks released a kernel module to dump out the PS3 Hypervisor and Bootloader someone named Ps3 Memory Dump from GeoHot's blog did just that, and has leaked it publically as pictured below.

The included ReadMe file acknowledges is0mick's recent Atmega8 port, however, it curiously attempts to flame other PS3 News Devs despite using their code to make the HV dump... go figure, eh?

Preliminary examination of the leaked dump is currently underway by both Devs and end-users alike, with a few noteworthy findings thus far as follows:

From sapperlott:

• repos @ 0x2c00 - 0x43ff
• partition table @ 0x6000
• SELFs @ 0x20000, 0x37000, 0x55000, 0x1624bc, 0x6c25b4, 0x6d5470
• FSELFs (?) @ 0xa19a0, 0x12dea0, 0x369720
• other SCE files @ 0x35e100, 0x6c5ed4
• LPAR data @ 0x12a0a0

From Karl69:

• IDA entry point looks like 0x10190 is interesting address.

From ifcaro:

• Code starts at 0x00203000 according to my analysis....
 

Dumping PS3 Hypervisor and Bootloader with Atmega8 at 16Mhz

1050°
254w ago - Hi guys, I used an Atmega8 running at 16Mhz (I had a couple lying about from the BT Vision project I was working on) and knocked up a small prog to do the same as the other chips and dump out the PS3 Hypervisor and Bootloader.

I was quite surprised, It actually worked fairly straight away! I only had one pulse going everytime I pressed the button at first but not a lot was happening.

So I did what xorloser did, and modded it so it pulsed every 100ms while the switch is pressed.

After about 30-40 seconds... I got a hit with the exploit code posted [Register or Login to view links]. Then I used the dumper (posted here) to dump the 10mb bin.

Just having a look through the dump, lots of strings in there.. I haven't dropped it into [Register or Login to view links] yet tho...

This is the source and hex (for those who dont want to compile it) for the Atmega8 which I glitched my PS3 with. The Chip I used was the Atmega8-16pu....
 

PS3 Hypervisor and Bootloader Dumped from RAM and More!

1300°
254w ago - We are happy to report that the PS3 Hypervisor LV1 and Bootloader LV0 are dumped from the PlayStation 3's RAM after getting our SX28 Hardware a few days ago, utilizing code for glitching and mashing buttons for hours - the exploit eventually will get triggered!

We tried a few different ways to dump out the real memory - the biggest "problem" was the fact that you can't just simply use File I/O code in a kernel module. Furthermore, you can't call the lv1_peek function from user mode either.

Luckily, resident DEV kakarotoks was up to the challenge. After some trial and error (and too many PS3 crashes!) he made a kernel module which maps the "real" PS3 memory to a device in /proc. The /proc area lets the kernel and userland interact some.

Basically, the device /proc/ps3_hv_mem is created when the kernel module is inserted. Once it is inserted, you can use dd to read the device. By doing this, the device gets passed arguments, which is...
 
Sponsored Links

Sponsored Links
Sponsored Links

Sponsored Links






Advertising - Affiliates - Contact Us - PS3 Downloads - PS3 Forums - Privacy Statement - Site Rules - Top - © 2015 PlayStation 3 News

Sponsored Links