• For Seryi Valero : _____________________________
HMX
This is an exploit available to anyone (sceners, for example) so they can continue working and investegando, and get so applications / functions practice. If you decide to do this is at your own risk.
Currently there are no applications or emulators, or you can load backups
's just an exploit
GeoHot Text and Translation (by Ferdopa)
In the Interest of Openness, 've Decided to release the exploit . Hopefully, this will ignite the scene PS3, and you will Organize and figure out how to use this to do Practical Things, like the iPhone Were jailbreaks When first released. I have a life to get back to and can not keep working on this all day and night.
In the interest of all is public, I've decided to disclose / publish the exploit. I hope this is the starting point / shoot the scene of PS3, and you can organize and plan how to use it for practical things, like the iPhone when the jailbreak was released / unveiled for the first time. I have a life to come back and I can not keep working on it day and night.
Please document your Findings on the psDevWiki . They Have Been a great resource so far, and with the power this exploit Gives, opens tons of new stuff to document. I'd like to see the calls filled in missing HV, nice memory maps, the boot chain Better Documented, and progress on a 3D GPU driver. And of course, the search for a software exploit.
Please subid / write your findings on psDebWiki. Have been a great resource so far, and the power that this exploit, open tons of new stuff to record. I would like to see the HV calls reported and documented losses, good memory maps, the boot chain and best-documented progress in the 3D GPU driver. And of course, the search for a software exploit.
This is the coveted PS3 exploit, Gives full memory access and THEREFORE OtherOS from ring 0 access. Enjoy your hypervisor dumps. This is Known to work with version 2.4.2 only, But I imagine it works on all current versions.
This is the coveted PS3 exploit complete access to memory and therefore ring 0 access from OtherOS. Enjoy your hypervisor dump. Confirmed that it works only with version 2.4.2, but I imagine it will work with all current versions available.
Good luck!
Good luck!
Making
http://pastie.org/795944
geohot: Actually it's pretty well
geohot simple: i allocate a piece of memory
geohot: using map_htab and write_htab, You Can figure out the real address of the memory
geohot: which is a big win, and something the hv shouldn't allow
geohot: i fill the htab with tons of entries pointing to that piece of memory
geohot: and since i allocated it, i can map it read/write
geohot: then, i deallocate the memory
geohot: all those entries are set to invalid
geohot: well while it's setting entries invalid, i glitch the memory control bus
geohot: the cache writeback misses the memory
geohot: and i have entries allowing r/w to a piece of memory the hypervisor thinks is deallocated
geohot: then i create a virtual segment with the htab overlapping that piece of memory i have
geohot: write an entry into the virtual segment htab allowing r/w to the main segment htab
geohot: switch to virtual segment
geohot: write to main segment htab a r/w mapping of itself
geohot: switch back
geohot: PWNED
geohot: and would work if memory were encrypted or had ECC
geohot: the way i actually glitch the memory bus is really funny
geohot: i have a button on my FPGA board
geohot: that pulses low for 40ns
geohot: i set up the htab with the tons of entries
geohot: and spam press the button
geohot: right after i send the deallocate call
Blog Oficial:
http://geohotps3.blogspot.com/
Download Exploit GeoHot and instructions (in English):
http://geohot.com/ps3_exploit.zip
http://www.megaupload.com/?d=6AS7L1U0
http://rapidshare.com/files/341615343/ps3_exploit.zip
http://www.mediafire.com/?yzotkyzzz0n
Courtesy: Valero Seryi
0 comments:
Post a Comment