PS3 Hacked

[beryl _ps3_compiz]

Ha Ha, Looks like compiz is coming to the ps3

[ppietro]

(had this reply ready last night - but the board was undergoing maintenance )

All I can say is, what is kboot/yaboot.. kexec?

From what I can tell, Kexec is a way of booting a kernel while another is running.
http://en.wikipedia.org/wiki/Kexec

Kboot is a boot loader that uses kexec. Although the original project page is here:
http://kboot.sourceforge.net/

they appear to be using a fork known as ps3-kboot:
http://www.kernel.org/pub/linux/kernel/ ... ell/README
and others
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=503482

Traditionally, this has been what you load in the otheros.bld for most PS3 Linuxes. Kboot starts in the firmware, then switches to the kernel in the /boot directory on your hard disc. YDL 5.x used kboot.conf, YDL 6.x uses yaboot.conf.

I think YDL is still using kboot for the PS3 since it can read yaboot.conf files. See here: http://www.mail-archive.com/debian-powe ... 59396.html . They're probably just using yaboot.conf to simplify installations, since Macs would need it. kboot also contains busybox, which is why you can execute Unix commands at the kboot: prompt.

Yaboot is a PowerPC boot loader that is popular for Macs & IBMs. Again - I don't think YDL really uses Yaboot on the PS3 - just the yaboot.conf file structure. My guess is that YDL uses yaboot as the boot loader for Mac & IBMs. Since kboot can understand yaboot.conf, this makes sense.

More info:
http://en.wikipedia.org/wiki/Yaboot

There's an alternative GUI bootloader called Petitboot that some folks like:
http://ozlabs.org/~jk/projects/petitboot/

both slim and fat are rambus right?

Correct - to the best of my knowledge, the main part of the Cell/RSX/FlexIO and their associated RAM (XDR, GDDR3) is identical between the two models. The differences appear to be in the southbridge equivalent chipsets - things like the slim's Bravia-link capabilities, Dolby TrueHD & DTS master sound bitstream output, etc.

See here:
http://www.engadget.com/2009/08/21/ps3- ... o-at-last/

Cheers,
Paul

[sirgrinalot]

(had this reply ready last night - but the board was undergoing maintenance )

All I can say is, what is kboot/yaboot.. kexec?

From what I can tell, Kexec is a way of booting a kernel while another is running.
http://en.wikipedia.org/wiki/Kexec

Kboot is a boot loader that uses kexec. Although the original project page is here:
http://kboot.sourceforge.net/

they appear to be using a fork known as ps3-kboot:
http://www.kernel.org/pub/linux/kernel/ ... ell/README
and others
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=503482

Traditionally, this has been what you load in the otheros.bld for most PS3 Linuxes. Kboot starts in the firmware, then switches to the kernel in the /boot directory on your hard disc. YDL 5.x used kboot.conf, YDL 6.x uses yaboot.conf.

I think YDL is still using kboot for the PS3 since it can read yaboot.conf files. See here: http://www.mail-archive.com/debian-powe ... 59396.html . They're probably just using yaboot.conf to simplify installations, since Macs would need it. kboot also contains busybox, which is why you can execute Unix commands at the kboot: prompt.

Yaboot is a PowerPC boot loader that is popular for Macs & IBMs. Again - I don't think YDL really uses Yaboot on the PS3 - just the yaboot.conf file structure. My guess is that YDL uses yaboot as the boot loader for Mac & IBMs. Since kboot can understand yaboot.conf, this makes sense.

More info:
http://en.wikipedia.org/wiki/Yaboot

There's an alternative GUI bootloader called Petitboot that some folks like:
http://ozlabs.org/~jk/projects/petitboot/

both slim and fat are rambus right?

Correct - to the best of my knowledge, the main part of the Cell/RSX/FlexIO and their associated RAM (XDR, GDDR3) is identical between the two models. The differences appear to be in the southbridge equivalent chipsets - things like the slim's Bravia-link capabilities, Dolby TrueHD & DTS master sound bitstream output, etc.

See here:
http://www.engadget.com/2009/08/21/ps3- ... o-at-last/

Cheers,
Paul

That is very enlightening, but I don't think his hack is based off of otheros bootlaoders he states the "The theory isn't really patchable, but they can make implementations much harder." If his hack were based on otheros bootlaoders, all sony would need to do is post a required firmware update (you can't get online until you update) that removes otheros feature altogether as they did with the slim.

[Gogeden]

Hopefully Sony will not get at this exploit found by Geohot. Maybe now we can acquire some more "Horsepower" so to speak.

[sirgrinalot]

Hopefully Sony will not get at this exploit found by Geohot. Maybe now we can acquire some more "Horsepower" so to speak.

There has supposedly been some new developments regarding sony's side here: http://www.qj.net/qjnet/playstation-3/s ... umors.html

Sony states "We are investigating the report and will clarify the situation once we have more information"

[Gogeden]

Damn!

He'd [Geohot] better do something quick. Because if Sony eliminates the ability for Linux to be on the PS3. Not good....

Of course, that would be illegal.

*Threatens his PS3 with a hammer* XP

[Gogeden]

There are some comments on that page about Geohot being an "As*****" for hacking the PS3 and being able to tinker with the hypervisor.

They obviously have never used YDL on their systems.

[oeboeroe]

see my earlier posts, crossref them with ppietros excellent technical support..

he dumped it's brains through tricking the hw. (HE CLAIMS).

because the proof of the pudding is in the eating, he has to reveal.. but then again..

what is dmca.......

this is not an attack on the hypervizor, that is not the way as I read it (but I can be mistaken).

just my 2 euro cents

[imdbowlgod]

he posted a new comment that would be interesting if i knew how to code. http://geohotps3.blogspot.com/2010/01/l ... field.html

[ppietro]

he posted a new comment that would be interesting if i knew how to code. http://geohotps3.blogspot.com/2010/01/l ... field.html

What's interesting is this part:

So install OtherOS and start playing around. If people start coming up with convincing reasons why they need the exploit to go further, I'll release it. It's just a waste to release if people can't make use of it.

This immediately rules out the slim. I know he's just talking about the code he posted to the pastie website which he'd like folks to play with - but still.

Cheers,
Paul

[billb]

A good topic to follow re: this subject over on ps2dev:

http://forums.ps2dev.org/viewtopic.php?t=12794

[beryl _ps3_compiz]

"As far as the GPU goes, I have full access to the GPU memory space 0x2800... But without a driver, it's useless. 3D video card drivers are notoriously hard to write, look at the ATI and NVIDIA ones for linux. The best are still the closed source manufacturer ones. I'm not even sure I believe that the HV restricts video card access, just that the OtherOS driver is 2D. If someone skilled in video card driver development comes forward, and they can explain in detail what the HV is restricting, I'll send them the exploit".

Ok please don't crush my dreams, if i am reading this right then does this mean that compiz wont run on ydl 6.2, also i can see sony coming along an getting this exploit. What is it saying that he has hacked it dont wont release it? Some please explain before my ps3 goes out the window lol.

Thanks Thomas

[ppietro]

*crush* = sound of dreams being crushed

Ok please don't crush my dreams, if i am reading this right then does this mean that compiz wont run on ydl 6.2,

Correct *crush crush*

also i can see sony coming along an getting this exploit.

Also correct. *crush crush crush*

What is it saying that he has hacked it dont wont release it?

Correct. At this point, he doesn't see a need to release the hack, since, apparently, certain parts of the hypervisor can be accessed directly from OtherOS. To paraphrase what he's said, "It doesn't appear that 3D graphics are actually locked out because of the hypervisor - there just isn't a driver for them. If somebody who can write 3D drivers shows me the block, and needs the hack, I will provide them with the exploit."

Cheers,
Paul

[billb]

As of now it's available for download, but there's more to it than just software ... don't think I'll be trying that one myself.

[ppietro]

By the way - if you've been following the Blog, there's a criticism of his hack here:

http://streetskaterfu.blogspot.com/2010 ... inues.html

Interesting note. This criticism puts a name to Sony/IBM's security: Kanna Shimizu. She has written a technical note that folks should read to know what they're in for:

http://www.ibm.com/developerworks/power ... lsecurity/

Cheers,
Paul