This post will deal with the hardware required to trigger the PS3 hypervisor memory access exploit. The purpose of the hardware is to stop the PS3 from saving a change to a value that we don’t want changed. The PS3 saves this changed value by writing the value to RAM. Therefore in order to stop it from saving the changed value we need to stop this write from occurring.
The PS3 sends the write command to the RAM over some control lines, so we interfere with these control lines when the write command is sent. The result we want is having the PS3 think it has successfully written the value to RAM, but the RAM didn’t receive the write command due to our interference and so it did not perform the write operation.
The easiest (and moderately safe) way to interfere with these control lines is to ground them. This is done easily enough by connecting a wire between one of the control lines and ground. The tricky part is timing it just right so that it only interferes with the write we want to stop, and not anything that occurs before or after this write. This might be achievable with costly equipment and a lot of work, however geohotz used the simple method of “luck”. This involves repeatedly preparing the situation to best favour the chance of overwriting the correct write command and then continually grounding a control line until either something crashes that shouldn’t or the mark is hit stopping the write operation from occurring. At this point the exploit has been successfully triggered! 
Now that you know how it works it is time to implement it. A connection is required to the control line that will be grounded as well as a connection to ground. These two wires then need to be connected to each other momentarily. If you were to try and do this manually as fast as you could you might connect them for a millisecond or so, however RAM control lines are very fast so 1ms is going to interfere with way too many commands. Instead these lines need to be connected to some hardware that is able to bridge the connection between then for very small periods of time at once. Geohotz suggests a connection period of 40 nanoseconds.
There are many ways that some hardware can be made to perform this short connection. Geohotz used an FPGA he had on hand in order to do it. Others have suggested using a 555 timer, however I have not heard of anyone having any success with this method. I used a small sx28 microcontroller I had on hand due to using it for a project some years ago. It runs at 50MHz with an instruction cycle of 20 nanoseconds, which means it should be fast enough to provide the 40 nanosecond connection required.
The first step is to take apart your PS3 in order to expose the top side of the motherboard. Once you do so look for one of the following areas on it depending on what version PS3 you have.
This first picture is from an old 60GB PS3 which came with the 4 USB ports and the card readers. You can see I have soldered a wire to the side of a resistor. This is the connection to the PS3 RAM control line that you need to solder on. I suggest you route this wire down and then to the left of the two pronged power plug you can see. My wire continues downward in this picture, but I found that doing so caused interference in the wire that would unintentinally trigger RAM corruptions. To avoid this you should route it to the left underneath the power plug so that it then comes out of the left side of the PS3 case. You can use a long wire during installation, but try to keep it short when you finalise its routing and final positioning. You can see I used a hot glue gun to ensure any stress placed on the wire will not pull at the solder joint.
This second picture is from an 80GB PS3 with 2 USB ports and no card readers. This was the model that was out just before the “fat” PS3s were replaced by the “slim” PS3s, so it is a newer motherboard revision where there are two RAM chips on both sides of the motherboard instead of all four on one side. In this picture I have circled the trace you should solder to for your RAM control line connection. In order to solder to this I used a craft knife to carefully scratch the paint off the top of the trace to expose the copper underneath which I then soldered a wire to. Once connected you should route this wire straight down towards the front of the case to best avoid interference in the wire from other parts of the PS3. Once again try to keep the final wire nice and short.
Next you need to get a ground connection. This is done the same way for both motherboard versions and is very easy. You can just wrap a wire around any of the metal screws that screw into the metal shielding that covers the top of the motherboard. You don’t even need to solder it, just wrap it under the screw head and screw it into place This wire should be routed out of the console next to to your other control line wire.
The above two wire connections are common to any implementation of a hardware trigger. The following is specific to how I did my hardware trigger but you may implement your trigger however you want. Note that I initially tried wiring 5 Volts of power out next to these lines but doing so continually resulted in unwanted interference in the control line causing the PS3 to crash while booting.
For my hardware trigger I used an SX28 microcontroller which I bought years ago as part of this programming kit. To use the SX28 you need the SX28 chip, a way of programming the chip (usually an SX-Key or SX-Blitz) and an oscillator to drive the SX28 chip at 50MHz. All of these are included in the above programming kit. Maybe if enough people buy from them and mention xorloser they’ll send me a USB version of the SX-Key instead of my old serial based one :/
Below is a crappy schematic of my circuit which I drew in windows paint. Please note that I am using the programming kit I mentioned above which utilises the SX-Key programmer in place of an oscillator while the SC-Key is attached. I do not have an external oscillator so I’ll leave the hooking up of that to you. Just take note that you do need either an oscillator or SX-Key attached in order to make the chip run.
This SX28 sourcecode is the last piece of the puzzle. Program this to your SX28 chip using the free SX-Key Editor software from the Parallax. Once this is all hooked up to your PS3 you should be able to send a “pulse” (grounding of the control line) to the PS3 by pressing the switch. You should use a temporary-on push button switch to do so since it will keep sending pulses every 100ms if the switch stays connected. The LED on the right side of the schematic is just there to give the operator some feedback. It will light up when a pulse is sent to let you know that the circuit is working as it should. I should mention that if you look at my SX28 sourcecode you will see that it appears as if I am sending a 360 nanosecond long pulse. I do not know how long the pulse is that actually gets sent as I do not have any hardware that I can measure the pulse with (yet). Possibly there are hardware induced delays that occur when changing the direction of the port which means that although I am waiting 360 ns, it still only sends a pulse that is about 4o ns. To arrive at the 360 ns value I tried many values making the pulse as short as I could until it didn’t trigger anymore, then I increased it just a little bit to get the shortest pulse that still works.
Phew, this is finally the end of this post. My next post will tie it all together along with some software I have written to dump your own hypervisor and more. Cya.
I think the glitched line in the figure above is the RQ8 (if index mark identifies 1A corner as usually it does), instead the glitched line in GeoHot paper is the RQ2.
I believe glitching a random line between RQ0-11 will do the job.
Just some doubt looking XDR datasheet (http://www.elpida.com/pdfs/E0881E20.pdf):
– the RQx timing is near tCYCLE (~3ns), so pulse low for ~40ns will affects alot of addresses.
– the Vih,cfm voltage (logic 0 for RQ lines) is max ~1.2v. We need to set this Volt as high value for the pulse.
Do you agree or I misunderstand something in XDR datasheet ?
Simone
Simone : Many possibilities are possible. As mentionned by you can input the Vref on one of the XDR chips then, down to ground. RQ2 to RQ11 are also many possibilities to input.
Of course, the faster the pulse is, it will affect less instructions / adresses.
What do you mean by “We need to set this Volt as high value for the pulse” ? You suggest to increase the voltage? What is the advantage to get higher voltage? As you said max is ~1.2v ; more than that it will damage for sure.
The goal is to get the perfect timing / pulse. I’ve read also the Atmega8-16pu chip (http://www.ps3news.com/PS3-Hacks/dumping-ps3-hypervisor-and-bootloader-with-atmega8-at-16mhz/). The guy is using a 16hmz crystal and it pulsed every 100ms while the switch is pressed.
Maybe it will be easier to find a Atmega8-16pu chip, what do you use Simone, sX28, Atmega8-16pu or something else?
I need to verify Atmega chip avalaibility, get my old dusted 686 and install Win95 lol (to run ponyprog, as far as I know it doesnt run under Xp)
Pingback: [PS3] GeoHot Opens All HV’s SPUs / XorLoser Preps Manual
a pic chip might more accecible to use for this project ,most city,s have a maplin/Radio shack that sells them
Just had a quick look at your source code , nice to see some ASM at work, damn wish i had a pic programmer here to have a better nosey at whats going on , i guess your adding new stuff to the IDA plugin as we speak
I will be keeping an eye on your blog to see if anything linux/useful happens
I am really hoping this will lead to some realtime linux kernel work for low latency sound processing to make the PS3 a beast in the studio production environment.
Thanks for keeping us all updated with your progress and thanks to eveyone else who has contributed sensible questions,ideas and links to others progress too.
Xorloser…
Can you teach me everything you know about hacking/cracking? I want to learn from the best. Hell, I’d love to write a book about you and your exploits…
KiCkO: I’m using an FPGA (Spartan 3).
The job could be done also with a cheap PIC18 or similar becouse the accuracy of the pulse is not so important: did anyone test with a shorter pulse like <20ns and succeded ?
I have been looking for at different programmer/microprocessor combinations and have decided the the Arduino Duemilanove based on the ATmega328 might be a good option as RS Components are doing them and also http://www.coolcomponents.co.uk for £20 approx.
http://docs-europe.origin.electrocomponents.com/webdocs/0db9/0900766b80db997b.pdf
What do you guys think?
Pingback: PS3 Exploit Reproduced « Jonny Zone : Copyleft – all rights reversed
When I attached the line to the point in xorloser picture for the 80Gb console it wont boot. Maybe I need to reroute the line so it get less interference?
Why is the glitched line different between xorloser and geohot? Is that because it doesn’t matter ?
“PS3 Exploit Reproduced « Jonny Zone : Copyleft – all rights reversed” : Ok… actually it is.. US. Why do you foward a link of our Blog on the Blog itself?!
zer0the0ry : Such a loooser — Learn by yourself!
Simone, Xorloser anything new?
tridentsx: i glitched 2 ps3s with different motherboards. one was the same as geohots, the other was a different layout. that is why the picture i posted shows the layout for the other, newer, type of ps3 motherboard.
if your ps3 doesnt boot, try moving the wires and keeping them as short as possible to reduce interference. i ended up having to route my wires so that they do not cross and approach the connection at 90 degrees to each other because after a few days i kept getting interference.
hello y’all im trying to recreate this but i need a question answered but 1st a little background, i have a 60gb ps3, when you said to solder to the side of the resistor, did you mean the acual resistor or on the board next to the resistor and if so which line on the board.
thanks for your help!
Michy: You cannot solder onto the resistor itself. you can solder to either side of a resistor though. you want to solder to the right side of the resistor as shown in the above photo. You could also scrape back the coating over the track and solder to the track itself, but I find it is easier to solder to the side of the resistor.
hi, can you help to create the connections you’ve drawn with paint? i don’t understand very much electronics and are in trouble ^^
i have the tech board, the sx-key, the sx28 chip, the switch but i don’t understand that links to the prototype area.. could you take a picture from the tech board? thanks;)
So, to make it clear to me and other nooby’s: this is only to redirect the code to an area of observation? Then once this info or code is decoded those who really are intelligent can put the code back together and open up 3D emulations or gaming in any aspect; creating, playing. Truly hope this does not take years to do. So, extract code from Hypervisor then tear it apart and put it back together in a nice Ubuntu package or command…sounds very difficult and easy yet appealing all at the same time. I want to make it clear that I only want the full advantages of Ubuntu on this ppc called PS3 and will not copy or store games or iso’s on my HDD. Only wish to play Sega Dreamcast and N64 Emulators. Getting to the 3D Emulator level would be very exciting. At first I thought I needed to open up my PS3…not just yet though. I’ll let the professional command and coders make an impossible task easy for us life long noobs. This is the best Hack of all time and I hope it works! I know eventually it will. Thanks a million times over everyone working on this. I will pass down a all in one game console to my kids one day thanks to all of you. Is their a usb sx28 that works without a power adapter. That would make things look a lot cleaner looking with this modification.
Question: What SX28 Microcontroller shall I use when all is ready? Is a USB model out? Any answers? Comments?
mathew: this hacks give you full access to read, write exec code on the main ps3 processor (the ppu). in linux sony blocks access to the gfx processor, but via this exploit you could access it. you could do so either by inserting some patches over existing code or inserting a new syscall in addition to existing code. previously a software exploit was found to access the command fifo for the gfx processor which then enables sending of all low level gfx related commands (ie enables 3d). a similar hack needs to now be inserted after running the exploit, however this needs to be done everytime the ps3 boots up. if you don’t turn your ps3 off you do not have to do it again however.
this link refers to the fifo access that was enabled previously:
http://forums.ps2dev.org/viewtopic.php?t=8364
the sx28 devkit/prototype board needs to be hooked up to a PC to send code to it, but you can program the sx28 chip with the code to run and then you should be able to just wire up the chip directly to the ps3 taking power from its usb ports. this means you could install the sx28 inside the ps3 with nothing external required.
the sx28 chip itself is a generic microcontroller, it does not have usb or serial models as such. the usb or serial interface is to the separate device that programs an sx28 chip. this is only required once to program the chip.
I have ordered the supply’s to do the hack. I even ordered a tool kit via http://www.modchip.ca called PRO TOOL KIT ACCESS. Also ordered SX Tech Tool Kit Via Parallax.com I was looking into the Infectus Mod Chip and though thinking about downgrading Firmware, I could not find the Chip for Sale any where online. Any one know of a link to an Infectus Mod chip in order to downgrade software for easy hacking or is this mod chip going to interfere with hardware already on the system? XORLOSER mentioned getting power from the USB ports and mounting from the inside as to do a more clean looking mod. My question is, once I have the Microcontroller hooked up and the code to write, is there code people have been working on that have gotten any results? If so, could I see these System calls and rewritten code to get “Ubuntu 9.10 ps3” to play 3D emulations and make it work as a ppc and not a locked system? Has anybody actually got a 3D – N64, Dreamcast, Sega Saturn game to actually work on Ubuntu ps3? Is it not time to yell a battle cry and make the Hack known? Let’s break the silence fearlessly and free the ps3 as a true ppc! We are the smartest people in the world, we just don’t know it and that gives us the edge over these Corporations. Kinda like the challenge though, will it work? Please XORLOSER
reply with a video of a 3D game code working on screen. I may be too fearless. Although hell bent on making this work, I know it will be a challenge. No one should walk into the Hypervisor alone. Xorloser…we all need your help with this and if any one else has any comments, lets keep this thread rolling. Any questions to my questions in order to help, please speak out. This is not only a hack, this is a movement.
P.S In short, where are the written patches and System calls once I have the code under control? How to rewrite the System calls to let Ubuntu use most of the RAM and all of the Invidia Graphix card? I’ll stop asking questions and hopefully some kind soul will help us all on our venture…thanks and I am not completely CPU savvy so I need help making this happen.
Pingback: HV reversing - PSX PS2 PS3 Scene Modchip & Jailbreak Community
Pingback: WIP: PSGrade code released, but no working keys yet! - Page 26 - PSX PS2 PS3 Scene Modchip & Jailbreak Community
Pingback: Hackerare la PS3 | 901Design.eu