Slashdot Mirror
PlayStation 3 Hack Released Online
itwbennett writes "On Friday, George Hotz, best known for cracking Apple's iPhone, said he had managed to hack the PlayStation 3 after five weeks of work with 'very simple hardware cleverly applied, and some not so simple software.' Days later, he has now released the exploit, saying in a blog post that he wanted to see what others could do with it. 'Hopefully, this will ignite the PS3 scene, and you will organize and figure out how to use this to do practical things, like the iPhone when jailbreaks were first released,' he wrote. 'I have a life to get back to and can't keep working on this all day and night.'"
Reader MBCook points out an article written by Nate Lawson "explaining how the hack bypasses the hypervisor to gain unrestricted access to memory. It seems the trick is to use a pulse to glitch the hypervisor while it's unmapping memory, leaving a favorable page table entry."
Even if your software security is perfect, if your hardware cuts corners then all it takes is 100mW in the wrong place at the wrong time...
Does this work on the PS3 slim? Will I be able to install Linux on it now? If so, I will buy one. I have not had enough of a reason to buy a PS3 before, but this will pretty much do it for me. It will be interesting to see if there is a sales spike because of it.
How dramatic
If they are able to bypass the hypervisor and then do hack mods for the PS3 this might open up a whole new avenue for modders and interest in the platform that was not there before. In other words, this might not be a bad thing for the PS3 overall.
ACK
Yes because it will show companies like Sony that hardware designed to prevent a person using a device they bought in the way they want will always fail.
but
No because the PS3 is a dead-end lump of obsolete hardware that is best used as a glorified media player or a cheap number cruncher.
He tried to retrieve the keys and failed miserably, so he gave up and released this half assed attempt. He might be a big fish in the iphone scene but the fact is, he is just a hack. What's even funnier, all of this was accomplished more than one year ago by other people.
I want to send a big fuck you to geofail, all the warez scene (particularly the imbeciles at Paradox) and the people who pirate games.
Glass.
Takedown notice in 3, 2, 1...
pastie.org: registered in KY, USA
blogspot.com registered in CA, USA
Now I'll be able to use my PS3 as a media player without transcoding everything to its preferred format
* This is based on a Linux kernel module, so NO SLIM already, okay?
* All it does is poke a hole in the hypervisor allowing memory access. This means it's not going to give you homebrew quite yet, but it's going to make it possible for people to start exploring and tinkering further.
* It requires hardware that generates a 40ns pulse on some point on some version of the board. Apparently it introduces a hardware glitch that allows the hole to be opened. And it doesn't persist after a reboot.
* The top level of security in the PS3 is in that one reserved SPU. Apparently it is given the root key during startup, holds all the other keys, and is responsible for decrypting and checking everything. But it's going to be very hard to get into.
* Now that it's possible to get into the hypervisor, people can start poking at that SPU. But Sony's security model was supposed to include the possibility of the hypervisor being compromised in just this way.
--
"Open source is good." - Steve Jobs
"Open source is evil." - Microsoft
The only reason for that I like this is if they can get a different way to play media files such as XMBC to work so I can play MKV files without conversion on my PS3. Also I didn't download these MKV files I have the disks, but this will prevent my son from ruining them and also allow me to change shows faster when one is done.
While indeed this opens the door for PS3 hacking, the PS3 has not yet been fully "hacked".
See http://streetskaterfu.blogspot.com/2010/01/ps3-is-hacked-urban-legend-continues.html
The security architecture of the PS3 is designed in a way to prevent hacks like this to fully compromise the system.
Another interesting read, by Kanna Shimizu, http://dslab.lzu.edu.cn:8080/members/zhangwei/doc/Cell_Broadband_Engine_processor_vault_security_architecture.pdf
"It seems the trick is to use a pulse to glitch the hypervisor while it's unmapping memory, leaving a favorable page table entry" Well shit, when you put it like that it's a wonder this thing wasn't cracked by a kindergartner two and a half years ago. :)
Dang, I was just going to try this... (ha ha) geohot: well actually it's pretty simple geohot: i allocate a piece of memory geohot: using map_htab and write_htab, you can figure out the real address of the memory geohot: which is a big win, and something the hv shouldn't allow geohot: i fill the htab with tons of entries pointing to that piece of memory geohot: and since i allocated it, i can map it read/write geohot: then, i deallocate the memory geohot: all those entries are set to invalid geohot: well while it's setting entries invalid, i glitch the memory control bus geohot: the cache writeback misses the memory :)
geohot: and i have entries allowing r/w to a piece of memory the hypervisor thinks is deallocated
geohot: then i create a virtual segment with the htab overlapping that piece of memory i have
geohot: write an entry into the virtual segment htab allowing r/w to the main segment htab
geohot: switch to virtual segment
geohot: write to main segment htab a r/w mapping of itself
geohot: switch back
geohot: PWNED
geohot: and would work if memory were encrypted or had ECC
geohot: the way i actually glitch the memory bus is really funny
geohot: i have a button on my FPGA board
geohot: that pulses low for 40ns
geohot: i set up the htab with the tons of entries
geohot: and spam press the button
geohot: right after i send the deallocate call
Release _your_ PS3 hack, then.
Don't have one, do you?
Jackoff. Again, some Slashdotter thinks they're so much smarter than people who actually DO newsworthy things, but does nothing but post online as an armchair expert.
Anyone have any feeling that after years of finally unraveling the PS3 hardware Sony is going to beam you up to their stolen Ghoa'uld space ship and tell you their the Illuminati and they plan to release an upgraded version of J.C. Denton on the world, but they need you to program his nanobots first?
Nope, I think not.
I have a life to get back to and can't keep working on this all day and night.
If you consider bitching on Twitter a life, sure!
The PS3 supports MPEG-4 ASP, VC-1, H.264 for video and AC-3, MP3, LPCM, DTS-HD, Dolby TrueHD, etc for audio. What formats are you trying to play that you have to transcode?
I wonder what this means for Blue-Ray. It could be a major blow to Blue-Ray protection if this somehow allowed the interception of the encryption keys.
If you have physical access to the circuit board then frankly short of encrypting every single data and address line theres not much any company can do to prevent hack attempts.
It doesn't support the mkv container, which it should, since it's now reconized by DivX (v7) and the PS3 is DivX certified.
http://www.divx.com/en/mkv
http://support.divx.com/faq/view/supportFAQen038/DivX%20on%20the%20Sony%20Playstation%203
Until included natively, PS3MediaServer is the best solution - real time transcoding as the GP said.
it's in my head
Success? The Xbox cost MS millions, and from what I can tell they are still trying to pay it back with the 360 which just recently *may* have turned a profit. The reason I say may is because of the way MS has it's divisions organize group Mac software (highly profitable) with Xbox HW.
Oh, shit, I hope Sony has heard about this!
"Most people, I think, don't even know what a rootkit is, so why should they care about it?"
Can somebody please explain to me why a kernel module (with fewer privileges than the HV) is able to create a "virtual segment, indicating that the hypervisor should store the HTAB associated with it at a specific address."?
I guess that functionality is needed somehow, and therefore accessible to kernel modules;
otherwise it would not make sense to me that they exposed unnecessary calls that mess with sensible stuff like the HTAB location (which contains the main segment, etc..) and ultimately lead to exploits like this.
Any insight, thoughts?
I would certainly agree with that. As you say, there are much better deals, price/performance-wise.
PHEM - party like it's 1997-2003!
I mean, he needs to block the HV correcting the tables, and presses a button to do that. But... that requires serious timing, as the call is made and directly after that he has to block the memory access with the pulse. To me this seems impossible to do, or he can start jamming the signal BEFORE the call is made, but that would potentially ruin the call in the first place.
Never underestimate the relief of true separation of Religion and State.
Ironic that a modern digital device succumbs to an analogue hack.
No, the new certification is known as DivX Plus HD. PlayStation 3 doesn't support that. DivX Plus HD and DivX certifications are two different things.
Not to mention ".ogm" ...which almost all of my media is in (i couldn't imagine converting all of it either...it would probably kill my hard drives). I've been using MediaTomb to transcode though.
In AD 2010, War was beginning...
SONY President: What happen?
Kanna Shimizu: Somebody set up us the bomb.
Kanna Shimizu: We get 40ns signal.
SONY President: What?
Kanna Shimizu: Main screen turn on.
SONY President: It's you!
GeoHot: How are you gentlemen!!
GeoHot: All your base are belong to us.
GeoHot: You are on the way to destruction.
SONY President: What you say!!
GeoHot: You have no chance to survive make your time.
GeoHot: Ha Ha Ha Ha.