PS3 WebKitSploit and PS3 Playground WIP Github Forks by Esc0rtd3w

Punisher9 · Oct 30, 2017 at 6:18 PM

gezzus im just going to say if your stupid enough to leave auto update on your ps3 your should not be on this forum cus if you dont update the exploit will still work use your brains people i mean seriously i know its hard and all but stop and think about what your saying.
with that said hi guys

esc0rtd3w · Oct 30, 2017 at 7:00 PM

k9mo said:
Esc0rtd3w its been awhile any progress worth mentioning and also i really hope you publish this soon because any mintue now sony will release a patch update for your webkit as they know all the entry points and how to patch them and i am not talking off my ass i have a friend that works with sony they are making an update he said they finished it and they just have to improve a couple of stuff so i hope you release this soon before they patch it and thanks.

k9mo said:
They know all the entry points so please dont say anything if you dont know anything about the ps3 system if they patch the entry point then his exploit code wont do crap

so the false flag planting worked? haha

remember, we have more than 60 entry points in the private webkit testing page, as well as several other undisclosed system vulnerabilities. the public testing page is just that, public, for the community to test entry points on their own...... just sayin

if they make a patch or two in a firmware update for webkit, it won't matter, our code will still be usable.

JaroslavN said:
That's a good joke... , They can't patch anything if they don't know what the code is that Esc0rtd3w and his team wrote.

we are still working on it...have been busy with life stuffs

kevlion · Oct 31, 2017 at 1:28 AM

esc0rtd3w said:
so the false flag planting worked? haha

remember, we have more than 60 entry points in the private webkit testing page, as well as several other undisclosed system vulnerabilities. the public testing page is just that, public, for the community to test entry points on their own...... just sayin

if they make a patch or two in a firmware update for webkit, it won't matter, our code will still be usable.

we are still working on it...have been busy with life stuffs

good to know that no matter what sony does it wont even matter

DMTihtees · Oct 31, 2017 at 3:22 AM

esc0rtd3w said:
we are still working on it...have been busy with life stuffs

I'm super new here and just got finished reading probably 80 pages worth of comments. That being said glad to see work on this is going.

If you end up getting things going i'll be glad to throw my self to the wind and help out any way I can.

esc0rtd3w · Oct 31, 2017 at 6:15 PM

if $ony miraculously does fix all the bugs in a new update, this will actually be a good thing in the end, as we can have all the new patches on CFW as well. That being said...turn off auto updates

JackEllisElway · Nov 1, 2017 at 8:26 AM

did you consider another doorway perhaps through hardware design of 3k/4k models in regards to hardware glitching?

https://www.blackhat.com/docs/eu-15/materials/eu-15-Giller-Implementing-Electrical-Glitching-Attacks.pdf

https://rdist.root.org/2007/05/24/hardware-design-and-glitch-attacks/

George’s hack compromises the hypervisor after booting Linux via the “OtherOS” feature. He has used the exploit to add arbitrary read/write RAM access functions and dump the hypervisor. Access to lv1 is a necessary first step in order to mount other attacks against the drive firmware or games.

His approach is clever and is known as a “glitching attack“. This kind of hardware attack involves sending a carefully-timed voltage pulse in order to cause the hardware to misbehave in some useful way. It has long been used by smart card hackers to unlock cards. Typically, hackers would time the pulse to target a loop termination condition, causing a loop to continue forever and dump contents of the secret ROM to an accessible bus. The clock line is often glitched but some data lines are also a useful target. The pulse timing does not always have to be precise since hardware is designed to tolerate some out-of-spec conditions and the attack can usually be repeated many times until it succeeds.

George connected an FPGA to a single line on his PS3’s memory bus. He programmed the chip with very simple logic: send a 40 ns pulse via the output pin when triggered by a pushbutton. This can be done with a few lines of Verilog. While the length of the pulse is relatively short (but still about 100 memory clock cycles of the PS3), the triggering is extremely imprecise. However, he used software to setup the RAM to give a higher likelihood of success than it would first appear.

100 memory clock cycles is about 50 mhz give or take. if you take into account the actual hardware used in his attack. you will find theres lots to do.

for reference the actual article-> https://rdist.root.org/2010/01/27/how-the-ps3-hypervisor-was-hacked/

kountzero · Nov 1, 2017 at 8:51 PM

JackEllisElway said:
did you consider another doorway perhaps through hardware design of 3k/4k models in regards to hardware glitching?

https://www.blackhat.com/docs/eu-15/materials/eu-15-Giller-Implementing-Electrical-Glitching-Attacks.pdf

https://rdist.root.org/2007/05/24/hardware-design-and-glitch-attacks/

George’s hack compromises the hypervisor after booting Linux via the “OtherOS” feature. He has used the exploit to add arbitrary read/write RAM access functions and dump the hypervisor. Access to lv1 is a necessary first step in order to mount other attacks against the drive firmware or games.

His approach is clever and is known as a “glitching attack“. This kind of hardware attack involves sending a carefully-timed voltage pulse in order to cause the hardware to misbehave in some useful way. It has long been used by smart card hackers to unlock cards. Typically, hackers would time the pulse to target a loop termination condition, causing a loop to continue forever and dump contents of the secret ROM to an accessible bus. The clock line is often glitched but some data lines are also a useful target. The pulse timing does not always have to be precise since hardware is designed to tolerate some out-of-spec conditions and the attack can usually be repeated many times until it succeeds.

George connected an FPGA to a single line on his PS3’s memory bus. He programmed the chip with very simple logic: send a 40 ns pulse via the output pin when triggered by a pushbutton. This can be done with a few lines of Verilog. While the length of the pulse is relatively short (but still about 100 memory clock cycles of the PS3), the triggering is extremely imprecise. However, he used software to setup the RAM to give a higher likelihood of success than it would first appear.

100 memory clock cycles is about 50 mhz give or take. if you take into account the actual hardware used in his attack. you will find theres lots to do.

for reference the actual article-> https://rdist.root.org/2010/01/27/how-the-ps3-hypervisor-was-hacked/

Oh there is still life in the rgh dog yet. Wonder if that spare TX board would be usable with a mod lol

JackEllisElway · Nov 1, 2017 at 9:00 PM

depends what you want to do. many ways in. you can dump games/keys at runtime

what geohot used is around 50mhz to send pulse. for glitch attack. the hw itself is a fine piece.

kountzero said:
Oh there is still life in the rgh dog yet. Wonder if that spare TX board would be usable with a mod lol

be picky with boards it makes life easier. and dealing with low volt sh1t better to do things right the first time than end up with a paperweight

JackEllisElway · Nov 3, 2017 at 9:59 PM

esc0rtd3w said:
so the false flag planting worked? haha

remember, we have more than 60 entry points in the private webkit testing page, as well as several other undisclosed system vulnerabilities. the public testing page is just that, public, for the community to test entry points on their own...... just sayin

if they make a patch or two in a firmware update for webkit, it won't matter, our code will still be usable.

we are still working on it...have been busy with life stuffs

they kind of screwed themselves adding a data transfer utility, now if you explored dumping sh1t like idps and ftp capabilities

play around a bit as you can dump way more than that using dtu alone with 2 consoles to pull it off.

nice little bridged connection over tcp/ip stack. just thought i would make you aware of that.

LightningMods · Nov 3, 2017 at 10:02 PM

A Glitch attack would need a custom Glitching Board because of the fact the PS3 doesnt have SPI,.. also your going to have to find the points like for CPU Reset ,.. anyways too much work easier just buying a jailbreakable model

PS3 WebKitSploit and PS3 Playground WIP Github Forks by Esc0rtd3w

Comments

Punisher9

esc0rtd3w

kevlion

DMTihtees

esc0rtd3w

JackEllisElway

kountzero

JackEllisElway

JackEllisElway

LightningMods

PSXHAX Categories

Latest Forum Topics

Share This Page