• PS3 Hypervisor LV2 (GameOS) Dumped and Leaked

    PS3 Hacks , 03.04.2010

    Demonhades and JaicraB have managed to dump and release the PS3 Hypervisor LV2 (GameOS). This however won’t lead to any new exploits (especially on LV2), as some websites falsely claim, on retail PS3′s (probably debug units).

    You can download the dumps here (Pass: jaicrab.jaicrab).

    To quote:

    “DHorg friends because that is in luck, and I DemonHades and JaicraB we have dump the LV2 (supervisor) thereby obtaining ps3 kernel very soon we detailed the dump.

    Jaicrab a pleasure working with you friend.

    Best to all! A week ago I started to dismount for the first time a PS3 and install Linux without any experience. My only goal was to teach people to change the cooling of a PS3. Gradually I was calling attention to the world of SCENE and a week I give the LV2.

    This concludes a long afternoon with only one thought. DemonHades Thanks for sharing your experience with me and spend the whole evening with me and discuss check for teaching me everything you know in two hours. The truth is that without DemonHades would have been almost impossible. A great and wise person.

    After an entire afternoon leading a project in mind, we could dump the LV2. We had read access of the last session before entering XMB Other.

    I promised. It will explain the method to follow if you want to do you the same. Enjoy it!

    Next step? The next step is Inmagine. First of all tomorrow if I can I will explain the process of how to do it.

    It is not a simple dump LV2, but a dump of the entire session previously opened in XMB. What you need to debug the dump way to make things not to mix the session Other and so we can analyze everything that we run in XMB.

    This dump was made with an upper size LV2, which contains trash otheros session mixed with XMB. The LV2 area is intact, are the first 36 megabytes, which is lv0, LV1, LV2.

    You open a door and you find 50 more, each new door you can open 50 more doors. Choose your path to investigate and share it with everyone.”

    Sorry for the not so detailed post just wanted to spread the news, someone from staff or anyone else feel free make a detailed post !

    [VIA]

    UPDATE: Another dump has been posted by JaicraB and promises a guide in future:

    So,what is gonna be? One thing make me something.
    That is,first geo hacked HV and released it.Then verification of PKG,SELF,loading mtldr.Then rco edit.Then sony remove otheros and then promises of CFW.And then a rapid update of jaicrab’s blog.All things is going to be very rapid after geo’s invention.

    I bet to anyone that,in the end of 2010.
    we will get:
    1.Running code from XMB.
    2.Probably linux for slim.
    3.Hello world for ps3.
    4.Isoloader for both ps3s.
    5.Some way of safely(nt like 360) playing backups.
    6.End of ps3′s DRM that ruled so long.

    Tags: , , , , , ,

    Discuss in Forums (10)


  • 10 Comments

    1. Sublimewulf
      04-03-2010
      03:40 AM
      1

      NICE! Good work! Progress!! Keep up the good work. Can we write to lvl 2 yet, or is it just read access?

    2. RSXnull
      04-03-2010
      08:15 AM
      2

      ya, and now another update.
      original here http://jaicrab.blogspot.com/

      google translate here http://translate.google.com/translat...&sl=auto&tl=en


      So,what is gonna be? One thing make me something.
      That is,first geo hacked HV and released it.Then verification of PKG,SELF,loading mtldr.Then rco edit.Then sony remove otheros and then promises of CFW.And then a rapid update of jaicrab's blog.All things is going to be very rapid after geo's invention.

      I bet to anyone that,in the end of 2010.
      we will get:
      1.Running code from XMB.
      2.Probably linux for slim.
      3.Hello world for ps3.
      4.Isoloader for both ps3s.
      5.Some way of safely(nt like 360) playing backups.
      6.End of ps3's DRM that ruled so long.

      Arent u PPL just looking that progress is so rapid from many corner?
      Wish googluck to all hackers and badluck for sony.:aetsch:

      A portion i forgot to tell, "they are gonna dump Karnel also"
      Ultimate hack to ps3 is very near then.

    3. BobbyBlunt
      04-03-2010
      11:11 AM
      3

      All lvl's have been dumped now. Progress has really picked up since the 3.21 update. Sony, let this be a lesson to you. When you take away features people pay for bad things will happen. The exploit was months away from any type of progress. Thanks for jump starting the process.

    4. jesdaking
      04-03-2010
      12:32 PM
      4

      Here is it, the thing we have been waiting for.

      http://translate.google.com/translat...-lv2-como.html

    5. General Plot
      04-03-2010
      03:06 PM
      5

      Originally Posted by Sublimewulf View Post
      NICE! Good work! Progress!! Keep up the good work. Can we write to lvl 2 yet, or is it just read access?
      My guess would be to use the dumps to look for vulnerabilities in order to gain kernel mode, etc.. access. Code injection is much more difficult and delicate if the shell hasn't been compromised.

    6. Sumo X
      04-03-2010
      10:17 PM
      6

      Originally Posted by BobbyBlunt View Post
      All lvl's have been dumped now. Progress has really picked up since the 3.21 update. Sony, let this be a lesson to you. When you take away features people pay for bad things will happen. The exploit was months away from any type of progress. Thanks for jump starting the process.
      Agreed.

      I think the guy might be a little optimistic with what he thinks will be accomplished this year (but then again, what the hell do I know?- I'm not a programmer), but Sony really pissed off a lot of people who enjoy tech and hacking. Removing the otherOS function has gotten a community to band together to work against Sony. Before, it seemed like random people doing their own thing...now they've created a community.

      To be honest, I don't particularly care about most things that could come from this. Emulators? I could do it with Swapmagic but I don't/haven't yet. ISOloader? I kind of hope this one doesn't come for a good long while. Some other homebrew app? There's always one that's super cool that I'll want.

      I just don't like Sony taking away a feature they advertised to me. I did use Linux for a period when I was in between computers. Not the greatest machine ever, but it worked fine and I made need to use it again for a period of time in a few months while I move internationally.

      Anyway, its great to see progress being made so rapidly. Thanks to all of those out there working to crack this box. I appreciate your efforts.

    7. BobbyBlunt
      04-04-2010
      05:14 PM
      7

      I would have to agree with that. Everyone is openly sharing all findings now instead of keeping them to themselves.

    8. Disane
      04-04-2010
      06:26 PM
      8

      erm, I hate to say this but, it appears this dump only has 2-3 percent of the lv2 kernel. There are no hv call tables dumped. It appears that they loaded in a whole Linux kernel which overwritten the important parts. I guess it's better to just use the cell reset line and use a boot loader with a small kernel module that allocates it's memory at a custom address, then dumps the important areas.

    9. RSXnull
      04-05-2010
      12:42 AM
      9

      from demonheads blogroughly translated from google)
      " The supervisor is the kernel of ps3, put another way is the software that controls everything in the ps3 from the xmb.

      "It communicates with the reader bd.
      -With the firmware
      -With hdd
      Ultimately, if we get the supervisor will be closer to being able to do whatever we want on PS3 without having to do it in linux."

      So what is it? Ps3 hacking is no longer limited to linux.Be happy,slim owners.
      They are gonna do something on XMB.All this happens so rapidly after sony blocked otheros.This is a lesson for sony.

    10. Disane
      04-06-2010
      05:08 AM
      10

      Originally Posted by RSXnull View Post
      from demonheads blogroughly translated from google)
      " The supervisor is the kernel of ps3, put another way is the software that controls everything in the ps3 from the xmb.

      "It communicates with the reader bd.
      -With the firmware
      -With hdd
      Ultimately, if we get the supervisor will be closer to being able to do whatever we want on PS3 without having to do it in linux."

      So what is it? Ps3 hacking is no longer limited to linux.Be happy,slim owners.
      They are gonna do something on XMB.All this happens so rapidly after sony blocked otheros.This is a lesson for sony.
      The problem is that we need to find an exploit in lv1 in order to do anything interesting with the machine. Even if we find an exploit in lv2, lv1 can still defend the system from being compromised. There are two OSes which need to be compromised at the same time when we are in GameOS.

      We're currently working on tools to reverse Lv1 and trying to find holes in it. It's going to take some time to get familiar with the system it self and it's stupid SPU asm. We are also short on exploited PS3s and people who actually understand SPU code. Some people don't even want to share their units for some reason even if we only want to test our applications.

      There are just too many people out there who have a Ps3 and know how to program but don't have the necessary materials or skills to trigger the exploit. An Lv1 exploit is essential...

      For summary: even a perfect Lv2_kernel.self dump wouldn't be helpful at the moment.