Technological discussion on PS3 security and crack.*

Little point arguing any more about the rest of your post since we're just going around in circles. However, on the points above, I'm not referring to PSP as a way into PS3. I'm referring to Datel signing their own executables to run on unmodified hardware. In short, they have replicated Sony's private key for creating encrypted software. Nobody else has done that, certainly not unpaid researchers. It won't help on PS3, but puts their operation on a different plane to the homebrew hackers. While Datel may well be considered to have leeched a lot of work from them, I've seen their factories and labs, spoken with "Mr Datel" (one of the richest men in the UK btw) and his engineers and they are a formidable operation.

What I mean is that, if Datel, with his solid operation, has only figured this out after some unpaid hacker spends a few months fiddling with the PS3, I'm not holding my breath on them actually coming out with a product. My suspicion, instead, is that this isn't new to Datel. (I'd even guess that this isn't new to Sony, either.)
 
You guys are so pessimistic... well in this case you might be considered optimistic. Hoping the ps3 is never hacked. The fact that datel can make their own signed executables is interesting, but how often is it that to do homebrew or play backups you need full access to the system? I would assume you don't need to get into that isolated SPU to get the root key.

I am interested in where you all get your "its not possible" confirmations from. If you are just reading what IBM says about how the system should function then... well.... :rolleyes:

The hypervisor is not there for no reason, it would be unnecessary to have such a hard to beat HV system if the security beneath it could not be bypassed or beaten. I would bet that the isolated SPU now ultimately serves to prevent compromise of sensitive information (sony's signing info etc) rather than stopping unwanted use of the ps3.

I also would bet datel will do it. What is stopping most hackers is simply equipment and man hours
 
You guys are so pessimistic... well in this case you might be considered optimistic. Hoping the ps3 is never hacked. The fact that datel can make their own signed executables is interesting, but how often is it that to do homebrew or play backups you need full access to the system? I would assume you don't need to get into that isolated SPU to get the root key.

I am interested in where you all get your "its not possible" confirmations from. If you are just reading what IBM says about how the system should function then... well.... :rolleyes:

It sounds like the concerns are different (GameOS vs OtherOS).

The hypervisor is not there for no reason, it would be unnecessary to have such a hard to beat HV system if the security beneath it could not be bypassed or beaten. I would bet that the isolated SPU now ultimately serves to prevent compromise of sensitive information (sony's signing info etc) rather than stopping unwanted use of the ps3.

I also would bet datel will do it. What is stopping most hackers is simply equipment and man hours

I think the HV is there to prevent unauthorized access and privilege escalation from the signed code in GameOS, and from OtherOS. In the latter case, if the OtherOS is compromised, it does not affect GameOS. But Sony could remove OtherOS totally.

On the hacking side, they can probably introduce more hardware to help defeat the software, but one of the first challenges is to make the exploit repeatable in a safe, consistent and cheap way by the users.

What does this mean?

Sounds like a done deal by that.

It's the same Square One from GameOS perspective. He'll need to address the isolated SPU sooner or later. Kicking it out is insufficient and may actually make his work more difficult at specific times. I think one of the best cases is to figure out a way to write "Hello World" by pretending to play along with the isolated SPU (i.e. homebrew instead of game piracy). The other way is to write everything from scratch, and not rely on the isolated SPU at all.

It should be possible to do that, and can be considered a victory by the homebrew folks.
 
My suspicion, instead, is that this isn't new to Datel. (I'd even guess that this isn't new to Sony, either.)

That's the general consensus after the fog cleared, and it's not like the PS3 launched months ago. Hotz' work has been overblown for sure, but it sure got him another media spotlight at least in the UK.

What is stopping most hackers is simply equipment and man hours

It's been well over 3 years now, what stopped an army of hackers and Datel up to now? I suspect that the light at the end of the tunnel isn't an exploit done via the Other OS on an old firmware.
 
You guys are so pessimistic... well in this case you might be considered optimistic. Hoping the ps3 is never hacked. The fact that datel can make their own signed executables is interesting, but how often is it that to do homebrew or play backups you need full access to the system? I would assume you don't need to get into that isolated SPU to get the root key.

But that's the whole point, the rootkey is only inside the isolated SPU and so is all the drm/encryption/whatNot stuff.

Also potentially any call to gameos may use the isolated SPU and hence make hacks detectable if the isolated SPU is running or alternatively making game fail if the SPU is not online. Such features start from game loading code/assets to typing text, chat, bringing up XMB and so on. Patching all the work to PPU that the isolated SPU does is not straight forward even if it is possible to do. I expect that games actually reuse a lot of functionality in gameos in favour of implementing everything themselves.

The hypervisor is not there for no reason, it would be unnecessary to have such a hard to beat HV system if the security beneath it could not be bypassed or beaten. I would bet that the isolated SPU now ultimately serves to prevent compromise of sensitive information (sony's signing info etc) rather than stopping unwanted use of the ps3.

Any sane security system is built on layers stacking on top of each other making the hackers work more difficult. The security doesn't need to be invincible, it only needs to last long enough. Sony would be stupid to trust the hypervisor only... It's no different to cars having not only locks in the door but also system where if the car doesn't recognize the key the engine refuses to start(making the start car from wires impossible on "newer" cars).

edit. I would be willing to bet that if the current firmware doesn't already have shitload of "detect hacks to gameos" then the next update will sprinkle magic dust everywhere :)
 
Last edited by a moderator:
I think that it's clear that going after Game OS is a fools errand, it isn't going to happen.

However, what I hope comes out of this is that they get full access to RSX and they then do something useful with it. I want to see Amiga OS 4.1 running on this box - dual threaded 3.2Ghz PPC, half a gig of RAM, 3D acceleration, and 6 little monster processors on the side - yes please.
 
Patches are not applied automatically without the users consent. You can avoid them should you be satisfied with the firmware you have. To me, patches are nearly irrelevant.
 
I guess it's give and take.

In my understanding, the latest games will auto-install the required firmware. If the user refuses to proceed, then he or she won't be able to play them.

You will also be bothered by compulsory firmware upgrade when you go online.

What you mentioned still sounds like homebrew OS (OtherOS) rather than GameOS hacking.
 
In my understanding, the latest games will auto-install the required firmware. If the user refuses to proceed, then he or she won't be able to play them.

Yup. I had to upgrade to 3.01 when I popped in Tekken 6 in Oct. Sooner or later, there is no way around it unless you stick to playing old games.
 
Patches are not applied automatically without the users consent. You can avoid them should you be satisfied with the firmware you have. To me, patches are nearly irrelevant.

And again, it seems that Sony knew that there would be a chance of people finding ways in via software, and that people might end up not upgrading firmware, hell i bet there are some hackers out there that never upgraded the original PS3 firmware for this exact reason...

So they added the extra layer or layers, maybe in the hope that many people would waste lots of valuable time hitting their head on a brick wall, and maybe even in the hope that they would never get through.

Hacking the PS3 is big money, as soon as it´s compromised criminals in the far east will start pressing copies and erode whatever little money there was to be earned.

Personally i would absolutely LOVE the idea of an Amiga OS on a PS3. But Sony clearly chose to protect their Hardware so much that while they KNOW that software will be broken, they still chose to make it as hard as possible since that would buy them time before the attack on the hardware solution began.

The best outcome that can come of this, is 1-3 years of hopeless attacks and lots of wasted time on getting through the hardware, and Sony then chosing to believe that the Hardware is safe and then letting everyone have access to the Hardware so we can get some funky Amiga OS/Linux stuff going :)
..... yeah right :)
 
Personally i would absolutely LOVE the idea of an Amiga OS on a PS3. But Sony clearly chose to protect their Hardware so much that while they KNOW that software will be broken, they still chose to make it as hard as possible since that would buy them time before the attack on the hardware solution began.

Yes, but it's a shame from the OtherOS side of things, so much could be done with the machine, especially with an OS such as Amiga OS being a microkernal, highly efficient, and the legacy that it was always built on top of non-unified memory from the outset - Fast RAM and Chip RAM. It's an even bigger shame in that the current developers apparently said in a chat that they already had it running on a PS3 (I suppose on a DevKit - probably without 3D acceleration).

The PlayStation 3, PowerPC Macintoshes, and mobile devices are also viable OS 4.1 targets. A Hyperion developer told me that not only has the OS been run on a PS3, but they have even tested support for the seven SPU units in the Cell processor.

I don't know how reputable the writer of that piece is, but it's an interesting thought.
 
Well isn't this interesting:
"Not that most of us are on the hunt for 1U server blades to build a rendering farm out of, but it's always fun to see Sony's PS3 hardware put to a use that actually earns Sony money. The Cell-based ZEGO BCU-100 includes the PS3's RSX graphics processor and is designed for processing HD video. Sony plans to work with software developers to take advantage of the unique architecture, and will be launching 'em later this year in the States. No word on price."

If the Zego is the same architecture as PS3 then possibly the driver will now work with GH's unlocked PS3. If not, then could this not at least be a starting point for hashing a driver together?

http://www.yellowdoglinux.com/support/hardware/sony.shtml

Source: http://www.engadget.com/2008/08/14/sony-wrangles-cell-chip-into-zego-bcu-100-video-rendering-system/
 
Last edited by a moderator:
Well isn't this interesting:
"Not that most of us are on the hunt for 1U server blades to build a rendering farm out of, but it's always fun to see Sony's PS3 hardware put to a use that actually earns Sony money. The Cell-based ZEGO BCU-100 includes the PS3's RSX graphics processor and is designed for processing HD video. Sony plans to work with software developers to take advantage of the unique architecture, and will be launching 'em later this year in the States. No word on price."

If the Zego is the same architecture as PS3 then possibly the driver will now work with GH's unlocked PS3. If not, then could this not at least be a starting point for hashing a driver together?

http://www.yellowdoglinux.com/support/hardware/sony.shtml

Source: http://www.engadget.com/2008/08/14/sony-wrangles-cell-chip-into-zego-bcu-100-video-rendering-system/

I'm not sure if it ever went on sale, and if it did, if anyone ever bought it. Note the story is from August 2008, according to wikipedia it appears to be discontinued as of August 2009. So while Yellow Dog might have a driver, good luck getting it from them; they might be the only ones that have it (besides Nvidia and Sony). :)

http://en.wikipedia.org/wiki/Zego
 
It didn't have and video out however did it? That required an extra plug-in card. So it's possible that there was no driver for it in terms of 3D acceleration, and RSX was being used for compute and other processing.
 
Back
Top