Ps3 May Have Been Hacked


Orion4874

Orion4874

Mega GP Mania
Joined
May 17, 2009
Messages
1,426
Age
50
Location
North Brunswick, New Jersey
Here's something interesting for the weekend. iPhone developer Geohot claims to have been finally able to hack the PS3.



Here's what the dev posted on his blog:



I have read/write access to the entire system memory, and HV level access to the processor. In other words, I have hacked the PS3. The rest is just software. And reversing. I have a lot of reversing ahead of me, as I now have dumps of LV0 and LV1. I've also dumped the NAND without removing it or a modchip.



Geohot further adds that even though he's not revealing the exploit yet, it's not patchable by Sony. Firmware updates could however make implementation harder. There's no mention of what firmware he's working with.



Geohot -- if it is the same one -- made his mark on the iPhone homebrew community with a baseband unlock for firmware 3.1. Without further proof I'll have to put this under rumor for now. I guess we'll just have to wait and see if this turns out to be the real deal.





Found this article on QJ. Not much info yet but hopefully more will come.

Here's the link to the article: http://www.qj.net/qjnet/playstation-3/ps3-hacked-by-iphone-dev.html
 
I'm gonna say it's true.

It is the same Geohot, his PS3 blog is linked to from his iPhone one. Also, he mentioned the PS3 on his twitter page.

He was very reliable in the iPhone scene. He's not gonna waste his reputation by babbling some false shit about a PS3 being hacked.
 
This would be cool, I was kinda bummed when the slim had not Linux support. This way maybe it will be a little bit better than the Linux support on the fat version. It's still a cell processor though.
 
second exodous said:
This would be cool, I was kinda bummed when the slim had not Linux support. This way maybe it will be a little bit better than the Linux support on the fat version. It's still a cell processor though.
Click to expand...

Assuming the hack works for both, it's awesome news since it could mean the GPU becomes accessible from PS3 Linux. That would be awesome.
 
Last edited by a moderator:
Quote:
Just before the weekend iPhone 2G hacker GeoHot announced that he has hacked the PS3 entertainment system, and today IncGamers.com (linked above) has confirmed from their Rep that Sony is launching an investigation into it.



Quote:
This comes as no surprise, considering a public PlayStation 3 hack would cost Sony Corporation and developers millions in lost revenue due to piracy as a result of reverse-engineering their intellectual property.


GeoHot has also told the BBC that, "I can now do whatever I want with the system. It's like I've got an awesome new power - I'm just not sure how to wield it."


To quote: "We contacted Sony and a spokesperson confirmed that the company is looking into the issue.


"We are investigating the report and will clarify the situation once we have more information," said the statement."


Time will tell if Sony gets tough or goes in the direction as Apple did, simply sending out DMCA notices and not attempting to hold George Hotz personally accountable for his actions.


Unfortunately, unless Sony makes an example of Hotz it may encourage other hackers to continue defeating their proprietary protection schemes without ill consequence.


Our advice to GeoHot: Let common sense be your guide, and isolate yourself from end-user PS3 hacks or exploits that could be proven by a court as used to circumvent protection or aid in software piracy... it simply isn't worth the risk.




OK, now I came across this article so who knows what's going to happen now. As long as there is no piracy is involved I don't think Sony can do much about it.
 
Ravnos said:
second exodous said:
This would be cool, I was kinda bummed when the slim had not Linux support. This way maybe it will be a little bit better than the Linux support on the fat version. It's still a cell processor though.
Click to expand...

Assuming the hack works for both, it's awesome news since it could mean the GPU becomes accessible from PS3 Linux. That would be awesome.
Click to expand...
Ah, it is the older model he's working on since he's had it for a while. I like the slim better, not really because of size but because it's quieter. Also the touch sensor rather than a button kinda bugged me, I don't own one but I now a few people that do and turning the fats on and off is still strange for me. I have a monitor that is the same way and it bugs me.

I would have bought a slim by now had it had Linux support, I understand why Sony did away with it but I still want it to be an option.

I hope this hack works on the slim consoles and will allow Linux to be installed on them. If so I might break down and get one, I haven't gotten a blu-ray player yet and being able to just send video to it from my computer to watch would be great.
 
Last edited by a moderator:
Here's your silver platter
In the interest of openness, I've decided to release the exploit. Hopefully, this will ignite the PS3 scene, and you will organize and figure out how to use this to do practical things, like the iPhone when jailbreaks were first released. I have a life to get back to and can't keep working on this all day and night.

Please document your findings on the psDevWiki. They have been a great resource so far, and with the power this exploit gives, opens tons of new stuff to document. I'd like to see the missing HV calls filled in, nice memory maps, the boot chain better documented, and progress on a 3D GPU driver. And of course, the search for a software exploit.

This is the coveted PS3 exploit, gives full memory access and therefore ring 0 access from OtherOS. Enjoy your hypervisor dumps. This is known to work with version 2.4.2 only, but I imagine it works on all current versions. Maybe later I'll write up how it works :)
Click to expand...
 
YEEEEEEEEEEEEEEEEEEEEEEEESSSSSSSSSSSSSSSSSSSSSSSS!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Maybe we could take advantage of the connectivity between the PS3 and PSP and make some totally awesome homebrew!
WIN!
Also, maybe this is a sign. We need a totally powerful open source home console with great connectivity between our open handheld, open PC, OpenOffice, etc.
Any bites?
Flames?
Ice?
 
Sadly the PS3 is way limited: ram and cpu. It was cool 3 years ago but you can put together a quad amd system for VERY cheap that is very powerful.

From what I saw today, it seems the hack is currently only possible by directly accessing the wire between the cpu and memory and "pulling it low" during some memory transfer.

The hack itself I think isn't going to be useful. However it *is* a way to getting what would be needed to make this useful: the system encryption keys.
 
PS3 is hacked - The urban legend continues

So the PS3 is hacked ? Well that's nothing more than an urban legend.

Altough it's nice to capture all these HV calls and stuff from a plain (not encrypted) lv1 binary, but this will never lead to a hacked PS3.

Let's have a look.
The major security architecture on the PS3 is called the "Secure Processing Vault" and is the most important thing regarding "hacking" the PS3.

There is NO WAY for the PPU or even the HV to gain access to the SPU, which is an application running inside of an isolated SPU.
Well you can kick out the isolated SPU, like geohot mentioned, but this gives you nothing, as ALL the encryption and execution of applications (HDD encryption, app encryption, decryption, executing, signature checking, root key extraction) happens inside the isolated SPU.

To run homebrew on the PS3 you would have to reassemble the whole functionality from the SPU inside a binary running on the PPU.
For this you will need the root key. The root key is stored in hardware (not even close to the things on the iPhone). The root key cannot be extracted by any software or hardware means and is essential to ALL encryption/decryption, executing and checking routines.
The only way to get the root key is inside of an isolated SPU, as it is kick-starting the hardware encryption facility. There is no other way to do that !

Let's just assume that geohot or some other guys are able to break into the local store of the isolated SPE. There they will just find some encrypted binaries.
The key for decryption is encrypted by the root key !
You won't get anywhere without the root key.

Let's assume that someone managed to do all those stuff from the isolated SPU on the PPU and creates a CFW.
There is still a secure booting environment. The first module loaded/bootet is integrity checked by the hardware crypto facility utilizing the root key. So you have also to address this booting stuff. Again, no root key, no booting.

So there's always runtime patching you might ask ? Not possible on the PS3 because the hardware crypto facility is able to check the signatures whenever it wants to. And which part is responsible for this ? Exactly, the isolated SPU.
So if you kick out the isolated SPU the system will not boot/run anymore.

The PS3 is neither an PSP nor an iPhone. It's the most secure system architecture of this time !

The girl behind this stuff, Kanna Shimizu, is not somebody. Messing around with this is not like saying Bruce Schneier is a n00b.

Btw.: forget about all those stories, that certain hackers are or will be employed by SONY. That's nothing more than another urban legend.

@geohot It is OBVIOUS that the HV is PPC. The Cell BE is a PPC architecture, you know ;-) Better read those IBM papers in first place !

http://streetskaterf...-continues.html
 
1. Copy image url
2. Paste image url into browser url thingie
3. Hit enter
4. ???
5. Profit
 
Oh thanks,
That was kinda worth it, quite a good one :).


But it still stands that his avatar is ugly to look at.
 
You must log in or register to reply here.

Similar threads

T
Can't Decide Between Psp And Gp2x?
2
Replies
20
Views
6K
g4m3r
G
Back
Top