August 27 2010
SONY COMPUTER ENTERTAINMENT ANNOUNCES REMOVAL OF THE GAMEOS FEATURE FROM THE PLAYSTATION®3 SYSTEM IN NEXT UPDATE Read the rest of this entry »
Sony PS3 GameOS Removal Press Release
August 27th, 2010XorHack v2.0: The Updated PS3 Exploit Toolkit
March 19th, 2010After using the XorHack for a while I realised it was missing some things so I decided it was time for an update. New syscalls have been added to give finer control over data access, now providing 8, 16, 32 and 64 bit reads and writes. Also some new ioctls were added to provide additional useful functions for your userland code. Lastly new userland applications were added which now give the ability to read, write and execute memory from the command line 
XorHack: The PS3 Exploit Toolkit
March 4th, 2010I finally found the time to complete the PS3 exploit toolkit software I mentioned to in my previous posts. I call it XorHack. It allows you to call lv1 syscalls (level 1 system calls) from a normal (userspace) program. It also lets you run the software required when triggering the PS3 exploit from a normal userspace program. To give an example of how it can be used I have included the following example programs:
- ps3exploit – Runs the software required to exploit the ps3, it loops a number of times which can be specified as a parameter. (This still must be used along with the “button pressing”, it will not exploit the PS3 via software alone).
- dumphv – Dumps the hypervisor to a file in the current directory.
- dumpbl – Dumps the bootloader to a file in the current directory.
- dumprom – Dumps the system rom to a file in the current directory.
PS3 Exploit Tidbits
February 24th, 2010I haven’t gotten around to doing an update in a while due to work (and a little relaxation) taking all my time. Rather than wait till I have finished all of the stuff I wanted to before posting again I decided to post some tidbits to tide you over until the rest is ready. Before I do so I’d like to make the following clear as no matter how many times I say it, people believe what they want to believe instead:
THIS PS3 EXPLOIT WILL NOT ENABLE PLAYING OF COPIED OR BACKED UP GAMES. THE EXPLOIT IS FOR RESEARCH PURPOSES ONLY. Read the rest of this entry »
PS3 Exploit Setup
February 8th, 2010Just a quick pic of it all working together cos everyone loves pictures!
This is the PS3 with the newer motherboard where the socket I installed in the front actually looks nice, the other one was a bit of a hack job 
PS3 Exploit: Hardware
February 8th, 2010This post will deal with the hardware required to trigger the PS3 hypervisor memory access exploit. The purpose of the hardware is to stop the PS3 from saving a change to a value that we don’t want changed. The PS3 saves this changed value by writing the value to RAM. Therefore in order to stop it from saving the changed value we need to stop this write from occurring.
The PS3 sends the write command to the RAM over some control lines, so we interfere with these control lines when the write command is sent. The result we want is having the PS3 think it has successfully written the value to RAM, but the RAM didn’t receive the write command due to our interference and so it did not perform the write operation. Read the rest of this entry »
PS3 Exploit: Software
February 5th, 2010As I’m sure everybody heard, the memory access exploit for the PS3 hypervisor was released recently by geohotz. I was finally able to replicate his hack so I thought I’d take the time to help out others who may also have trouble due to being linux n00bs like me If I were to post everything at once it would be too much work and I’d never get around to it, so I’ll post bits at a time to ensure I actually do post it heh. Today’s post will talk about the software side of the exploit.
Please note that the geohotz exploit software was hardcoded for the v2.42 firmware, I have made a small fix that attempts to dynamically support all firmware versions. I have only tested and used it on v3.15 however.
PS3 and Xbox360 IDA Plugin Update (again)
January 26th, 2010As more special PPC instructions are stumbled across, support for them gets added to the plugin. I know I could go through an exhaustive list of all instructions and add them all, but for now I am content with adding them a few at a time 
PPC Altivec plugin v1.6 for IDA v5.6
Support added for the instructions: attn, lwsync, ptesync, tlbiel, tlbie, tlbi, slbie.
Also added support for the SystemSim “callthru” instruction (should this even be used outside of a simulator?) and lastly an instruction that I cannot find any information about. The hex value is 0×02002000 so for now I have added this instruction as opcode_02002000 so that it will at least disassemble to code and can therefore be treated as code. If anyone knows what this instruction is please let me know
PS3 and Xbox360 IDA Plugin Update
January 24th, 2010Here is version 1.5 of the PPC Altivec Plugin for IDA v5.6 which adds support for special instructions that are used by some PPC based devices. This was originally written by Dean Ashton and then updated by Takires.
This is useful when disassembling Xbox360 and PS3 binaries in IDA as they utilise these special instructions that are not supported by IDAs built in PPC disassembler module.
I have done some fixes to instructions that were previously handled incorrectly, as well as adding support for some new instructions. I also fixed an issue where instruction sizes were being reported incorrectly resulting in an incorrect disassembly.
More broken technology
November 12th, 2009In lieu of adding real content to my blog, here is some more broken techonology I came across. It is an electronic billboard that is basically a computer running ads on a widescreen LCD screen. It seems to be lonely without its keyboard however.
Close up of electronic billboard
Wii: Load Nintendo SDK ELFs via the HBC
July 8th, 2009The Homebrew Channel (HBC) was designed to be used with the Homebrew SDK aka devkitPro. So any files you compile with devkitPro should load OK via the HBC.
If you try to load a file that was compiled with the Nintendo SDK however you will get an error that “This is not a valid Wii application”. This is because the Homebrew Channel retrieves the load addresses for each ELF program segment from the Physical Address field, and in Nintendo SDK files this field is set to zero.
Hopefully the HBC guys will fix this in the next release, making the HBC more compatible. In the meantime you can use this little tool I made to patch your ELF file. It copies the values from the Virtual Address field into the Physical Address field for each program segment in your ELF file.
When arcade machines go bad…
July 1st, 2009I love seeing these kinds of things, so when I saw this at my local pub I thought I would share it with the world.
-
- I’ve got the faulty-dongle-driver blues
-
- Standing back to show where the picture is from
Small update to PS3 IDA plugin
May 25th, 2009I’ve been busy digging into the PS3 lately, I decided it’s finally time to see what secrets can be extracted from it. During my investigations I found that level-1 syscalls, a.k.a. hypercalls, are not handled by IDA so I decided to add support for it to the existing PPC Altivec plugin. Read the rest of this entry »
Bruteforcing AES encrypted data
May 8th, 2009When it comes to cryptography algorithms the topic of bruteforcing them appears often, however is rarely dealt with in a satisfying way. Usually such a discussion will start with someone asking “Why not just bruteforce it?” and end with someone stating “It is not possible, it would take too long”. Occasionally someone will chip in with ”Why not randomly guess it? You might get lucky”. So one day I decided to find out if it is possible, and if not, to at least get an idea of just how long “too long” is.
Cryptography For Dummies
May 6th, 2009This is a very basic overview of some common cryptographic terms and techniques employed not just in videogame consoles but universally. I will make generalisations in order to simplify the explanations, so I urge you to read more elsewhere to get a fuller understanding. Bruce Schneier’s Applied Cryptography is widely regarded as the best introduction and reference book on cryptography. Read the rest of this entry »
Current List of Revoked Xbox 360 Consoles
May 1st, 2009Everyone has heard about the Xbox360 bans that stop a console from connecting to Xbox Live, however not many people realise that Xbox360 consoles can also be revoked. Below you can find a list of all the currently revoked consoles at the time of the Fall’08 system update release. Read on to find out why and how an Xbox360 gets revoked and what effect it has. Read the rest of this entry »
Why is the Wii’s wireless so crap?
April 23rd, 2009Now that my blog is up I have a virtual license to rant!
Now what shits me most about the Wii is it’s wireless networking. Why does it not like to work? I have used many wireless devices on my current router with no troubles, but the Wii only works about 1 in 20 times, and even then it only seems to work for a short amount of time.
I’ve tried all of Nintendo’s suggestions like moving the Wii, channel 1 or 11, static ip, mixed mode B+G etc. Nothing works.
Being the friend he is, Google pats me on the back and assures me that I am not alone in my struggles. Wireless networking is not a new technology, it really should not cause such issues, especially on a device that only provides wireless and no built in Ethernet port.
PS3 SelfTool
April 21st, 2009I’ve finally gotten around to finishing my SelfTool for manipulating Self and Sprx files. Self files are like exe files for the PS3 and Sprx files are like dll files for the PS3.
Among other things, SelfTool can be used to print out information stored in the file in a readable format to make studying them easier.
NOTE: This DOES NOT enable booting of copied games in any way. It also does not support decrypting or encrypting of self/sprx files. It is really only useful for those who are interested in looking a bit deeper at self/sprx files.
New Xbox360 Disc Protections? Bans to follow?
April 19th, 2009I noticed the other day that when FIFA’09 for Xbox360 is patched with the latest update, the flags that specify what media the game is allowed to run from have changed. Originally it was allowed to boot from a standard original Xbox360 disc, however now it is only allowed to boot from a new media type which is basically an updated version of the original Xbox360 disc type. Read the rest of this entry »
Welcome to my blog :)
February 12th, 2009Like the title says welcome to my new blog. I hope to update this a little more often than my webpage which had just turned into a download center for my projects.
I also hope to make this a bit more interesting by writing about projects I am currently working on. I enjoy reading similar pages by others such as tmbinc’s blog and bunnie’s blog, so I thought I’d give it a go.