| Mail |
You might also like: WoW Insider, Massively, and more

Reader Comments (146)

Posted: Jan 27th 2010 2:49AM McDuckScrooged said

  • 2 hearts
  • Report
Yeah I bought ps3 on launch because of Linux support as well :) That was my primary reason and then realised how locked down it was.. I waited and waited to see when they would it open it up, and really thought they would :(

http://ww.neogaf.com/forum/showthread.php?t=383838

there was some tax break incentive for selling the ps3 as a pc rather than just a games console (luxury goods) within the EU, but I guess the amount of ps3 being sold to build supercomputers meant huge losses for sony because none of those units would be used to buy games..


Reply

Posted: Jan 26th 2010 8:26PM The Pirate said

  • 3 hearts
  • Report
Altough it's nice to capture all these HV calls and stuff from a plain (not encrypted) lv1 binary, but this will never lead to a hacked PS3.

Let's have a look. The major security architecture on the PS3 is called the "Secure Processing Vault" and is the most important thing regarding "hacking" the PS3.

There is NO WAY for the PPU or even the HV to gain access to the SPU, which is an application running inside of an isolated SPU.

Well you can kick out the isolated SPU, like geohot mentioned, but this gives you nothing, as ALL the encryption and execution of applications (HDD encryption, app encryption, decryption, executing, signature checking, root key extraction) happens inside the isolated SPU.

To run homebrew on the PS3 you would have to reassemble the whole functionality from the SPU inside a binary running on the PPU. For this you will need the root key.

The root key is stored in hardware (not even close to the things on the iPhone). The root key cannot be extracted by any software or hardware means and is essential to ALL encryption/decryption, executing and checking routines.

The only way to get the root key is inside of an isolated SPU, as it is kick-starting the hardware encryption facility. There is no other way to do that !

Let's just assume that geohot or some other guys are able to break into the local store of the isolated SPE. There they will just find some encrypted binaries.

The key for decryption is encrypted by the root key ! You won't get anywhere without the root key.

Let's assume that someone managed to do all those stuff from the isolated SPU on the PPU and creates a CFW.

There is still a secure booting environment. The first module loaded/bootet is integrity checked by the hardware crypto facility utilizing the root key. So you have also to address this booting stuff. Again, no root key, no booting.

So there's always runtime patching you might ask ? Not possible on the PS3 because the hardware crypto facility is able to check the signatures whenever it wants to.

And which part is responsible for this ? Exactly, the isolated SPU. So if you kick out the isolated SPU the system will not boot/run anymore.

The PS3 is neither an PSP nor an iPhone. It's the most secure system architecture of this time !

Posted: Jan 26th 2010 8:31PM (Unverified) said

  • 2 hearts
  • Report
The key for decryption is encrypted by the root key

So they used Biggleman's Safe for the encryption? That's actually rather ingenious on Sony's part.

And didn't the N64 get around people using carts to unlock the console by continuous checks of the authentication chip?
Reply

Posted: Jan 26th 2010 8:34PM The Pirate said

  • 3 hearts
  • Report
Yes Sony basically did lock the plans inside the "safe". I should also mention there are 8 walls of PS3 Security and all geoHot has done is slightly weaken ONE of the walls. If you go to his blog he even says he has given up on it.
Reply

Posted: Jan 26th 2010 8:47PM Vordus said

  • 2 hearts
  • Report
The Titanic is neither the Delmar nor the Duchess of Fife. It's the most unsinkable ship of our time!

...Sorry, couldn't resist.
Reply

Posted: Jan 26th 2010 9:15PM Kif said

  • 3 hearts
  • Report
Well, Mr Pirate, I have no idea what you just said, but it sounds goddamn legit.
Reply

Posted: Jan 26th 2010 9:19PM The Pirate said

  • 3 hearts
  • Report
What annoys me most is that this is nowhere near a hack. Yet everyone is going around screaming that the ps3 has been hacked. It just baffles me.
Reply

Posted: Jan 26th 2010 9:23PM The Pirate said

  • 3 hearts
  • Report
Ill try explain the gist of it. the PS3 is protected by 8 walls and those 8 walls are all controlled by a Root Key. The key is locked down inside the SPU and the SPU is protected by the 8 walls. The 8 walls are impenetrable. the US Army Air-force and Marines use this type of security in their defence grids.
Reply

Posted: Jan 26th 2010 9:27PM (Unverified) said

  • 3 hearts
  • Report
Yeah, the amount of jizzing going on his little 'blog' is disgusting.
Reply

Posted: Jan 26th 2010 11:08PM SoCoolCurt said

  • 2 hearts
  • Report
well that's good then. thanks for the explanation. Joystiq should post that in a "read more" link to clear up any confusion.
Reply

Posted: Jan 27th 2010 12:07AM spin cycle said

  • 2 hearts
  • Report
the Pirate:
The stuff you say as I understand it. Essentially, the CPU runs encrypted code without anything decrypting it first. And it doesn't store it unencrypted anywhere and it refuses to do so if asked. It also refuses to encrypt anything with the execute key.

So how you are going to decrypted code and write it out I dunno. Furthermore, how you will encrypt code to get it to run I dunno. So to me piracy still doesn't seem possible.

The only mitigating factor in this is geohot is no joke. If he says he's onto something I have to pay attention, because maybe he is.
Reply

Posted: Jan 27th 2010 12:07AM googleadam said

  • 2 hearts
  • Report
I did a bit of Googling and found an interesting read (PDF) in which (from what I got) it confirms how secure the Cell processor is...

Here's the link (WARNING PDF)
http://dslab.lzu.edu.cn:8080/members/zhangwei/doc/Cell_Broadband_Engine_processor_vault_security_architecture.pdf

I found that the end of Page 7 begins the amaziness of protection!!!

This Processor is bloody amazing O_O!
Reply

Posted: Jan 27th 2010 12:44AM Vidikron said

  • 2 hearts
  • Report
So I take it this is your blog then?

http://streetskaterfu.blogspot.com/
Reply

Posted: Jan 26th 2010 8:26PM ImSteevin said

  • 2 hearts
  • Report
Nice image guys, well done!

Posted: Jan 26th 2010 8:38PM GordoJones88 said

  • Half a heart
  • Report
Why would I need to hack my PS3 when I only use it to play Blu-ray movies.

Posted: Jan 26th 2010 8:46PM JohnAHD said

  • 3 hearts
  • Report
Well I must admit you are an Intelligent consumer, well aware of the PS3 market
Reply

Posted: Jan 26th 2010 8:46PM NathanHeil said

  • 3 hearts
  • Report
You're doing it wrong..
Reply

Posted: Jan 26th 2010 8:52PM (Unverified) said

  • 3 hearts
  • Report
HURRR.... U SO CLEVER
Reply

Posted: Jan 26th 2010 11:36PM SamE said

  • 2 hearts
  • Report
I LOLed when got HURRED at :D
Reply

Posted: Jan 26th 2010 8:38PM LettucePrey said

  • 1 heart
  • Report
Nice work GeoDick...Now how about putting that massive brain of yours to work on something beneficial to society instead of to thieves? How about that? Thanks...

Posted: Jan 26th 2010 8:56PM Scuffles said

  • 1 heart
  • Report
Well I guess there is a bright side to this.

We Either get Achievement trophies on the PSP
(which did not have them because sony touted it was too hacked for them to ensure legit trophies)

Or we listen intently for the death knell of PS3 Trophies as it is now no longer as bulletproof as Sony had assumed and it therefore can no longer ensure legit trophies.

the downside is pirating on the system will spike in light of this, but hey sony would have blamed pirating for a bad quarter anyhow regardless of its actual impact, as "piracy" is these days as much a valid issue as it is a corperate scapegoat whenever anything goes lemony snicket.

Posted: Jan 26th 2010 10:27PM (Unverified) said

  • 2 hearts
  • Report
Again, this is based on an OLD version. It's like saying that someone just now figured out an abacus and so calculators aren't reliable.
Reply

Posted: Jan 26th 2010 9:02PM BlackRonin357 said

  • 1 heart
  • Report
[banned]

Posted: Jan 26th 2010 9:04PM (Unverified) said

  • 2 hearts
  • Report
First: Screw you.

Second: The system isn't hacked, genius.
Reply

Posted: Jan 26th 2010 9:48PM YeshuabenYosef said

  • 3 hearts
  • Report
By the time I could finish downloading a game, I could have made enough money to buy the store that sells the game.

Posted: Jan 26th 2010 10:07PM somekindarobot said

  • 1 heart
  • Report
anyway to save my hard drive data yet damn YLOD

Posted: Jan 26th 2010 10:20PM (Unverified) said

  • 2.5 hearts
  • Report
I think that hacking is ridiculous. The systems were made to be used in the way they were presented to us. If Sony said, "Go right ahead, do whatever you feel like to it... make our hard work your metaphorical sex slave," then I would be completely okay with it.

Posted: Jan 26th 2010 11:28PM Rususeruru said

  • 2 hearts
  • Report
There will always be a group of people curious about the device's potential and so long as this group exists hacking will as well. It probably started before but was first really documented with people modding cars as early as the 1920's and will likely never end.
Reply

Posted: Jan 26th 2010 10:38PM McDuckScrooged said

  • 2 hearts
  • Report
I posted this tip about 13 hours after gehots post about hello supervisor i'm geohot (about a week ago). Not that it really matters, because it had no actual proof other than a claim and I found out from some other site anyway, so no biggie :)

Also here: http://news.bbc.co.uk/1/hi/technology/8478764.stm

According to his comments the gpu is already accessible to Linux and the hv isnt blocking access, but according to Yellow Dog Linux, access is blocked ?. Either way the exploit gives full hardware access to Linux which is all I want.

The only thing I would like to see happen is for the GPU to be properly accessibly from otheros, for us to get proper gpu access hardware 3d accelleration in Linux.

Why are people so idiotic and only seeing this as a means to pirate games ? By the time they manage to actually do anything with it, it will be next year more than likely, he has already released full specs of the exploit..

Posted: Jan 26th 2010 11:02PM (Unverified) said

  • 3 hearts
  • Report
But he hasn't cracked the system. He's got memory access, not RSX access. And he doesn't have full Cell access either.
Reply

Posted: Jan 27th 2010 1:01AM McDuckScrooged said

  • 2 hearts
  • Report
Brad I had written a whole big reply about this, but the beauty that is this comment system swallowed it up.

From what I understand you do get full hardware privileges to the ps3.. This doesn't mean you get access to the game os:

of interest:
http://pastie.org/795944
http://forum.beyond3d.com/showthread.php?t=56284&page=7

as well as his blog posts which is like walking through crap to find a good technical comment. I bury my head in shame for what humanity has become..

From what I understand (im neither a cracker nor an electronics engineer, so I can only explain it from the angle I understand)

Ive used xen quite a lot and that is hypervisor technology built on/using Linux.

To explain it in terms of xen the main controller os is called dom0 each os that runs on top of dom0 are referred to as domu's

the linux otheros is a domu, it gets a subset of the hardware calls and gets virtualised instances of memory etc.

the dom0 controls exactly what Linux has access to.

The ps3 gameos is also a domu, except its completely encrypted with a root key which is inside the hardware..

He glitches the memory bus which means that he escapes out of the allocation table and jumps into the actual hypervisor layer. This is why all of the extra hardware and system calls becomes available to him.

He uses the glitch to escalate his privileges which means that he can get full access to the hardware not, but it doesnt do anything for actually accessing the ps3 game os, from the hyper visor it becomes slightly easier to launch an attack because you can start working out all of the system calls all the calls made by the system what it all relates to and try to get the encryption key by some other inherent weakness in the os which maybe is not known about, so that you can then access the gameos.

Quote:

"Because of the root key's importance in keeping all other keys hidden, it must be robustly protected. The Cell BE processor accomplishes this with its Hardware Root of Secrecy. The root key is embedded in the hardware, and you cannot access it with software means; only a hardware decryption facility has access to it. This makes it much more difficult for software to be somehow manipulated so that the root key is exposed, and of course, the hardware functionality cannot be changed so that the key is exposed.

Furthermore, the activation of the hardware decryption using this root key is tightly integrated with the SPE isolation mode. When an SPE enters isolation mode, the hardware decryption facility is kick-started to fetch the encrypted data into the isolated SPE and decrypt the data using the hardware root key. The decrypted data is placed within the protected Local Store and is available for an isolated SPE application to use. In fact, the decryption based on the root key can only happen within an isolated SPE and not outside of it; no access to the root key is available, by hardware or software means, from a non-isolated SPE or the PPE. " -- from beyond3d which linked to to the following ibm article: www.ibm.com/developerworks/power/library/pa-cellsecurity/
Reply

Posted: Jan 26th 2010 11:21PM (Unverified) said

  • 2.5 hearts
  • Report
Joystiq, I'd like the article title changed. The PS3 hasn't been hacked.

Posted: Jan 26th 2010 11:45PM Overgauss said

  • 3 hearts
  • Report
Joystiq doesn't change article titles; Article titles change Joystiq.
Reply

Posted: Jan 26th 2010 11:37PM (Unverified) said

  • 2 hearts
  • Report
You can circumvent the hyper visor a bit but unsigned code using the RSX is still not an option.Hence you will never see pirated games,end of story.Awesome,you can do w/e you want with the system,except play games.Hero of the net confirmed

Posted: Jan 27th 2010 12:08AM Twinturbo120 said

  • Half a heart
  • Report
Wow about time somebody hacks it. Games are to expensive!

Posted: Jan 27th 2010 6:03AM sollord said

  • 2 hearts
  • Report
If he only has hypervisor access isn't this the same as Other OS mode? Where you can access the ram and cpu but have no RSX access?

Posted: Jan 27th 2010 6:40AM (Unverified) said

  • 2.5 hearts
  • Report
Joystiq makes so much money off people arguing with each other.

Posted: Jan 27th 2010 9:12AM BanditKing said

  • 1 heart
  • Report
Seriously I hate pirates and hackers. Nothing but a bunch of @$$holes, if I met this guy in public I would punch him straight in the face and kick his teeth in. Its DH's like this that are ruining the industry and stealing money from hardworking people all so they can sit back and say "look at me". If you play pirated games you should be put in jail with the biggest nastiest most STD ridden inmate and be serviced proper.

Posted: Jan 27th 2010 9:54AM Spookimitsu said

  • 2 hearts
  • Report
really is it that serious? Besides, quite the opposites. People who take the time to expose holes in systems that have been billed as "secure" actually promote the need for tighter and better firmware, more updates, and better console management. I'd have to disagree with you there.

But honestly that whole disease prison thing was a little out of proportion. I feel that if it werent for initial hackers and proponents of homebrew, we would NEVER be enjoying features like the x-box live arcade, the PSN classics or arcades and the Wii's virtual consoles. It was the fact that HACKERS made retro games like this available for free on previous consoles (one could argue) that caused the companies to take up the torch and offer their own solutions to piracy.

Meh just one theory, at least. Nevertheless, ARRRRRRRRRRRRRRRR

I knew of many old xbox's that had hundreds of games installed on the harddrive. Games of yesteryear. This became prolific to a point where the big companies just threw up their hands and said "F**k it" and decided to offer this kind of service themselves, and also turn a profit. Makes sense to me.
Reply

Posted: Jan 27th 2010 9:44AM Spookimitsu said

  • 2 hearts
  • Report
ARRRRRRRRRRRR AVAST YE FILTHY SWABS PREPARRRRE TA BE BOARRRRDED

Posted: Jan 27th 2010 11:57AM (Unverified) said

  • 2 hearts
  • Report
I would like to try this (not for the free games, I barely have time for the games I buy and rent) because the ps3 obviously needs a user generated push for us to get our money's worth out of it.

If this is the only way for us ps3 owners to get what was promised to us (video recording, snapshots, custom soundtracks, psp remote play....The list goes on and on) then so be it.

I believe it's a message to sony: open up your machine and let it live up to the promises, or we will.

I actually work, so don't worry, I'll still buy games no matter what I do to my ps3.

Posted: Jan 27th 2010 12:36PM (Unverified) said

  • 2 hearts
  • Report
I hate to say this but it's only a matter of time before this thing is completely hacked. Why? One reason is job security. I work in the tech industry and you will be amazed at how the good and the bad thrive off each other for survival. If there were no viruses, you wouldn't need all these well paid programmers to come up with frequent security innovations. It's life. And not all hackers do this without help of people in the know.

Posted: Jan 27th 2010 5:08PM Crono141 said

  • 2.5 hearts
  • Report
All I ever really want out of a hacked ps3 is the ability to rip and play the ps1 and ps2 games I already own, and launch them from hdd (like the wii usb backup loader).

Full access to hardware from linux comes with tons of benefits as well (like a functional os, for one).

That's right. Downrank me for wanting the convenience of full installs browsable from the couch, and the ability to take my full game library with me without packing up 3 boxes worth of dvds.

Posted: Jan 28th 2010 7:14AM (Unverified) said

  • 2 hearts
  • Report
Single layer blank BD discs can be found as cheap as $3 a piece- it's the dual layer discs that will set you back $20. I'm not sure how much info is on your average PS3 game, but if it can be downsampled to fit onto a single layer BD, then you're talking some cheap backups.

Posted: Jan 28th 2010 6:43PM KillaChaos said

  • 2 hearts
  • Report
@Bradwart [PSN: Mister Bradster XBL: Mr Bradster]

I typed a long explanation and Joystiq's assbackwards comment system deleted. It went something like this:

* You can't compress the data, the ps3 won't uncompress it for you.
** You can't just downsample audio, you would not know where the files are on the disk
* This probably won't start any form of game piracy.

Posted: Jan 29th 2010 1:01AM (Unverified) said

  • 2 hearts
  • Report
yea.. cant believe 3 years and it took this wizkid 5 week. ive been doing some extensive research myself on this matter for my website. check it out

href="http://modsandhacks.net/ps3-hacks/geohots-ps3-exploit-released">GeoHots ps3 exploit


it seem as though this is just sourcecode and has alot of work before its up and running

Featured Stories

Engadget

Engadget

TUAW

TUAW

Massively

Massively

WoW

WoW