C4E’s iXtreme Lite Touch (LT) in association with Team Jungle & Team Xecuter

After a long development and testing process we give you the first official release of the iXtreme LT
- Supports all BenQ Drives (62430C, 64930C)
- Supports all Liteon Drives (74850, 83850V1, 83850V2, 93450)
- Totally re-written code optimised for minimal patching
- Whole banks of firware now untouched
- New Drive response timing engine accurately mimics original drive timings
- Full disc stealth used by default
- Waveless booting , disc images are assumed to be correct!
- Split-Vid used as default

WARNINGS:
* Warning! Ensure all disc images are checked with abgx as LT assumes all stealth/ss/pfi/dmi is correct. Disc images must also be splitvid and preferred SS v2
* Warning! Lt will not save you from being banned if console is already flagged by using a previous firmware or non-stealth discs
* It is also advisable to apply all system updates before flashing with LT. All future console system updates (not game updates) must be applied with caution

THANKS:
* Thanks go to Team Jungle for their hard work and efforts in the development process.
* Thanks also go to Te

To quote (read bolded statement):

Hi All,

On 02/26/2010 04:30 AM, David Woodhouse wrote:
> On Fri, 2009-08-21 at 09:58 -0700, geoffrey.levand at am.sony.com wrote:
>> The feature of “Install Other OS” was removed from the new
>> “Slim” PS3 model to focus on delivering games and other
>> entertainment content.
>>
>> Please be assured that SCE is committed to continue
>> the support for previously sold models that have the
>> “Install Other OS” feature and that this feature will
>> not be disabled in future firmware releases.
>
> Although it’s disappointing that Sony have removed the feature from new
> models, It’s good to have this public assurance from Sony that at least
> the feature won’t be removed from older models which are already
> working.

Please understand that in my position as PS3-Linux maintainer
I can really only provide users with technical support for
Linux and the LV1 hcall interface.

The text above was provided to me by SCE management. If
you have any questions regarding it or any other feature
of the PS3 please contact the Playstation Customer Support
in your country. Using Playstation Customer Support will
insure your inquiry is processed through the correct
channels within SCE.

-Geoff

So everyone can take a breather who thought that geohot’s exploit was going to be patched

To quote:

I finally found the time to complete the PS3 exploit toolkit software I mentioned to in my previous posts. I call it XorHack. It allows you to call lv1 syscalls (level 1 system calls) from a normal (userspace) program. It also lets you run the software required when triggering the PS3 exploit from a normal userspace program. To give an example of how it can be used I have included the following example programs:

• ps3exploit – Runs the software required to exploit the ps3, it loops a number of times which can be specified as a parameter. (This still must be used along with the “button pressing”, it will not exploit the PS3 via software alone).
• dumphv – Dumps the hypervisor to a file in the current directory.
• dumpbl – Dumps the bootloader to a file in the current directory.
• dumprom – Dumps the system rom to a file in the current directory.

The XorHack package contains full sourcecode for everything including a rewrite of geohot’s exploit sourcecode to make it easier to read and understand (the new file is kmod/exploit.c). The rewrite doesn’t just fix the compilation warnings, it attempts to replace all “magic” values with the algorithms and reasoning as well as tidying up the code and commenting it all. I also added another syscall #21 to allow executing of code in hypvervisor context. Due to the associated complexities it is not available from usermode, it is for advanced users to make use of in kernel space. Some small changes were also made to the timing and the text that gets printed onscreen to make the exploit easier and hopefully more stable to use. I recommend XorHack when both looking into how the exploit works and when actually triggering the exploit.

XorHack is made up of three parts. The kernel module, the userspace library file, and lastly the userspace programs themselves. To build all three parts you need to first extract the contents of the XorHack zip file to a directory on your PS3 harddrive. Next you need to navigate on the command line to the directory you extracted the files to. You should be either logged in as root or running as root thanks to the “su” command. Now type “make” to build all parts of XorHack. Then once that completes type “make install” to install all parts of XorHack. If you wish to you can type “make uninstall” in this same directory to remove all of XorHack from your system. When you install XorHack on your system it will always be ready for use, even after rebooting it will be automatically reloaded and ready for use.

To use XorHack to perform the exploit on your PS3 first install it as per the directions above. You then need to switch to a console only mode (no GUI). This is required because it is the only way you can see the printed messages from the kernel module to know when to press the button. Once exploited all other programs can be run normally from a terminal window in GUI mode. To switch to console mode press Ctrl+Alt+F1 on your keyboard. To switch back to the GUI mode press Ctrl+Alt+F7. When you enter console mode you will be greeted with a login screen. Now login with your normal user account and password and type “ps3exploit 100″. This will start the exploit looping 100 times in which you need to successfully glitch the console by pressing the button on your glitch hardware. The idea is the perform the glitch when nothing else is occuring on your PS3. Therefore some things you may want to try when exploiting to help your chances are:

• Only press the button once per loop.
• Try to press the button around the middle of the pause between two concurrent prints of the “press button” message.
• Don’t start pressing the button till after the 10th “press button” message (by this time the system should done loading and preparing the newly running code, so less likely to interfere with processes that occur during these stages)
• Run the ps3exploit software after initially booting up the PS3 and switching to the console login without first logging into the GUI mode.
• After booting the PS3 and switching to the console mode straight away, log in and then wait about a minute before running ps3exploit so that any processes that may occur upon login/startup have completed.
• Don’t use any services that will cause more processes to be running until the exploit is completed. This includes things like accessing your PS3 over samba.
• Once you have successfully exploited, stay in console mode as there is less chance of instabilities causing havoc and crashing your PS3.

The PS3 Exploit Game!

Once you can run the exploit it’s time to turn it into a game. Think of it as a cross between getting the turbo boost at the start of a Mario Kart race and Dance Dance Revolution with a finger pad. The aim of the game is to exploit your PS3 as quickly as possible without it crashing. Below is my highscore table picture showing my highscore of THREE!

You can view and download XorHack and readme here.

[VIA]

To quote:

For those who bear on our community and this study shall know the hypervisor and bootstrap, but for new and newcomers who want to know about the safety features on ps3, and is protected as it manages the hypervisor (hardware manager) believe that interesting reading this list.

Then I leave it here hypervisor dump that I have gone and published it to all make a good background paper on the hypervisor and the bootstrap

Here you will be added all the features you get in a list, if you see that are already discussed here, and exposed them to not only need to copy them from your valleys and fast

You can view the full (rough English translation) examination at the discuss in forums link, or the more organized version at the VIA link (in Spanish).

[VIA]

Here are the symptoms to this problem:

• Can not connect to PSN
• “Hardware failure. Cannot update Firmware or connect to Internet”
• Cannot enter any BR games (Trophy errors, kicks you out; “Can’t register trophy information. The game will now quit”)
• Cant play downloaded titles (demos work).
  
• Trophy information deleted
• PS3 date/setting set to December 31, 1999

This is most likely a firmware related bug but there are also rumors that this may be a PSN hack as a page on Sony PS3 website has a small memo from someone not too happy:

http://us.playstation.com/PS3/dearplaystation/

“get flash and/or enable javascript and stop wasting my time.”

Sony has tweeted with the following on the matter:

“We’re aware that many of you are having problems connecting to PSN, and yes, we’re looking into it. Stay tuned for updates.”

We will keep you updated on the latest progress

I haven’t gotten around to doing an update in a while due to work (and a little relaxation) taking all my time. Rather than wait till I have finished all of the stuff I wanted to before posting again I decided to post some tidbits to tide you over until the rest is ready. Before I do so I’d like to make the following clear as no matter how many times I say it, people believe what they want to believe instead:

THIS PS3 EXPLOIT WILL NOT ENABLE PLAYING OF COPIED OR BACKED UP GAMES. THE EXPLOIT IS FOR RESEARCH PURPOSES ONLY.

It seems someone took some initiative and made some software themselves to dump the hypervisor once they have the correct hardware and software. So for anyone who has used that and dumped their own hypervisor I present this PS3 HV Dump setup script for IDA.This script will setup function tables including the hypercall (syscall) table, mmcall table, OPD, TOC, GOT. It will find common functions such as puts and printf and very importantly it will fixup all rtoc references which are used to access global variables and strings.

To use the script you should extract it somewhere and then from within IDA select “File->IDC File…”, then navigate to where you extracted the file and select it. Please note that this script could overwrite your previous work, so please run backup your idb/i64 file before running it. I recommend running it on a freshly created database by loading your hypervisor dump into IDA as “ppc” at ROM address 0 and then running this script as detailed above before doing anything else.

The other tidbit I wanted to share was the updates to the PPC Altivec plugin source code which I had forgotten to include in the recent releases, but which a few people have since asked for. Here is the PPC Altivec plugin v1.6 for IDA v5.6 with sourcecode. If anyone makes any fixes or adds support for new functions please pass these updates back to me so I can share them on this site.

[Download HV Dump script for IDA]
[VIA]

Owen Stampflee Linux Product Manager for Fixstars Corporation made the following post in the yellowdog-boards:

Everyone,

I’ve caught a rumor from a reputable source that the next firmware update for old PS3s will remove the OtherOS feature…

I’m not sure if it’s true or not but it’s in the best interest of the YDL community to spread the word.

Cheers,
Owen

This indeed is an unexpected move on Sony’s part if indeed this rumor is real, but of course we all know the solution and that is to not update :).

[VIA]

Features:
- Graphics/Sound
- Achievements (don’t be a dumbass and use this on live, your console will be banned)
- Favorites Support
- XUI user interface
- SRAM save support linked to a user profile
- SaveState support (currently 1 per rom)
- Regular and Enhanced Graphics Filters
- Sound filters
- Threaded Audio
- Aspect Ratio/Stretch Mode support
- Previews

Notes:
This is still an early beta. There are bugs…
More of your favorite emulators/homebrew to come..no donations required…

To quote from SKFU blog and patent below:

Recently a new patent by a SONY employee was published on the patent site at faqs.org. It seems it is SONY’s answer for Geohot’s progress. Take a look here:

“A method, system, and computer-usable medium are disclosed for controlling unauthorized access to encrypted application program code. Predetermined program code is encrypted with a first key. The hash value of an application verification certificate associated with a second key is calculated by performing a one-way hash function. Binding operations are then performed with the first key and the calculated hash value to generate a third key, which is a binding key. The binding key is encrypted with a fourth key to generate an encrypted binding key, which is then embedded in the application. The application is digitally signed with a fifth key to generate an encrypted and signed program code image. To decrypt the encrypted program code, the application verification key certificate is verified and in turn is used to verify the authenticity of the encrypted and signed program code image. The encrypted binding key is then decrypted with a sixth key to extract the binding key. The hash value of the application verification certificate associated with the second key is then calculated and used with the extracted binding key to extract the first key. The extracted first key is then used to decrypt the encrypted application code.”

You can read the full patent here.

[VIA]

>> Team XeDev released a bugfix version of XM360.

What’s new/fixed (since v0.8):
* fixed bug where Japanese DLC would prevent DLC scene from working (causing a 360 hang) (v0.8b)
* fixed bug where launching XBLA from the first screen would launch wrong title (v0.8c)
* fixed scraper for XBLA to include UTF-8 encoded text. This makes them look nicer in xm360, and gets rid of the trailing “a” that was on some titles. (v0.8c)