How the PS3 Hypervisor was Hacked and Dumped by GeoHot

215w ago - A few days ago GeoHot Hacked the PS3 and dumped the PlayStation 3 hypervisor lv0 and lv1, and has now updated his blog with a technical writeup here on how it was done written by Nate Lawson at rdist.root.org.




George's hack compromises the hypervisor after booting Linux via the "OtherOS" feature. He has used the exploit to add arbitrary read/write RAM access functions and dump the hypervisor. Access to lv1 is a necessary first step in order to mount other attacks against the drive firmware or games.













Comments 28 Comments - Go to Forum Thread »

Quick Reply Quick Reply

Rac3rX's Avatar
#13 - Rac3rX - 215w ago
I'm interested in seeing where this goes, homebrew on regular PS3's would be sweet.

Not to mention getting Linux the ability to use the PS3 hardware accelerators finally..

PS3 News's Avatar
#12 - PS3 News - 215w ago
So when can an average user expect to be able to get their hands on one of these dumps to look at?
That's the question most are asking at the moment... my guess is either when someone from the community with the equipment dumps it themselves and shares it publically, when CJPC has time and dumps it (assuming nobody else does, otherwise he won't bother), or when the existing dumps are leaked to more people pretty much.

internetfloozy's Avatar
#11 - internetfloozy - 215w ago

The more eyes experimenting with RE the better.

semitope's Avatar
#10 - semitope - 215w ago
They just don't have the time nor materials to bother dumping it themselves at the moment, and honestly, there is little need for it (besides comparing them) when dumps already exist.
It'd have been cool if they had the time and equipment though. Maybe they can poke around beyond what geohot did. I doubt they could attempt getting keys without some hardware.

lilstevie's Avatar
#9 - lilstevie - 215w ago
In regards to ModderFokker's post, it's basically like an "inside man" job. Glitching the Hypervisor so it doesn't wipe the RAM leaving a small window to plant a few small landmines for the Hypervisor to step on.

As I said, sounds similar to the Xbox 360, the CPU is glitched (reset) while the rest of the system (CPU, RAM, etc) is still active. When the CPU has reset, it loads code from a different address in flash (eg. XeLL...)

Please correct me if I'm wrong but this is my basic understanding.
The xbox 360 exploit is actually an exploit in hypervisor itself, Xell catches and resets the CPU threads.

http://www.securityfocus.com/archive/1/461489 is a good writeup on the xbox 360 hypervisor exploit
