Join Us and become a Member for a Verified Badge to access private areas with the latest PS4 PKGs.
PS5 CFW and Hacks       Thread starter PSXHAX       Start date Jul 1, 2023 at 10:08 PM       15      
Status
Not open for further replies.
Proceeding his Exploring the PS5 Security Landscape Hardwear.io 2023 presentation and Slideshow, @SpecterDev (Twitter) recently updated PSDevWiki with details on the PS5 In-Kernel Hypervisor present in PlayStation 5 Firmware 2.50 and below for PS5Scene developers to examine. :geek:

According to @zecoxao on Twitter, "he only has a full dump from a version from those ranges, so it's normal."

Here's further details on the In-Kernel PS5 Hypervisor from the PS5 Developer Wiki, as follows: In-Kernel Hypervisor (<= 2.50)

On 2.50 and lower, the hypervisor is integrated as part of the kernel binary. This is the "first iteration" of the hypervisor, later versions have the hypervisor as a separately loaded component. The hypervisor's main goals are to protect kernel code integrity and enforce xotext (aka. eXecute Only Memory or "XOM") on the kernel.

To accomplish this, Sony takes advantage of various features provided by AMD Secure Virtual Machine (SVM), such as; Nested Page Tables (NPT), Guest Mode Execute Trap (GMET), and intercepting reads/writes to Control Registers (CRs) as well as Machine State Registers (MSRs).

Furthermore, xotext seems to be hardware-backed as a collaboration with AMD, named "nda feature". The hypervisor also manages the I/O Memory Management Unit (IOMMU), as hinted by the fact that it exposes various hypercalls for configuring it.

It's worth noting the hypervisor is very small, especially when compared to that of the PS3. It only supports a handful of hypercalls and mainly exists to protect the kernel. It doesn't run multiple VMs or use nested virtualization, it only virtualizes the kernel/userspace, which Sony calls "GameOS".

SpecterDev has documented information regarding PS5 ioctls and device codenames.
PS5 In-Kernel Hypervisor Details by SpecterDev for PS5Scene.png
 

Comments

@PaperLuigi7789 I seriously doubt that. This doesn't mean much for end users and for those that it does mean something, its going to take them awhile to do something significant and when they FINALLY DO find something significant, they are going to sit on it in private for years. I wouldn't expect anything near goldhen level on ps5 for a minimum of 3 to 4 years.
 
@Sschraube Maybe for you. It will be worth waiting for! I have a plenty backup games for PS4 to worry about. There are not many brand new games for PS5 so it will be worth. No regret here.
 
maybe, depends on how the scene unfolds, as well as what data can bw extracted and provided to devs for them to look over and hope to understand the inner machinations of the hypervisor and other functions of the ps5, which hopefully will articulate attack vectors based upon that.

once we've got enough dumps and enough eyes on that data given time we'll see something come out of the woodwork eventually.
 
Status
Not open for further replies.
Back
Top