2 ms·

> (it also being primarily a vehicle for piracy certainly didn't help). The piracy hacks never used OtherOS. The first piracy hack (the PSJailbreak dongle expl

by phire 3y ago

> (it also being primarily a vehicle for piracy certainly didn't help). The piracy hacks never used OtherOS. The first piracy hack (the PSJailbreak dongle exploit) simply exploited the GameOS usb stack and wasn't released until after OtherOS had already been removed in a firmware update. The only hack that ever targeted OtherOS was a complex memory glitching attack that was pretty hard to pull off. As far as I'm aware, that hack was only ever used by a few people for dumping memory, and those dumps were reverse engineered to find other exploits. If anything, OtherOS might have slowed PS3 modding efforts down, as modders were wasted years banging their heads against the reasonably secure hypervisor. Turns out, GameOS had minimal security, and once you gained kernel access, you could boot backups without needing to touch the hypervisor.

rgovostes 3y ago
Thanks for your work reverse engineering PSJailbreak, by the way. (https://www.psdevwiki.com/ps3/PSJailbreak_Exploit_Payload_Reverse_Engineering https://www.psdevwiki.com/ps3/PSJailbreak_Exploit_Payload_Re...)
- phire 3y ago
  I also worked on PSGroove. Though that was very much a team effort, I knew nothing about USB before working on that. From memory, my contribution was mostly tweaking the code until it worked, I think my PS3 was the first to be exploited by PSGroove. Though, I wasn't happy at merely copying the sequence of packets USB that lead to an exploit, so I spent some time trying to get a better understanding of how the exploit worked. That document is the result of my efforts.
teaearlgraycold 3y ago
I recall there was something involving Other OS and soldering a wire into the motherboard.
- xcrunner529 3y ago
  It was one of the first ways I could rip a bluray, though
- phire 3y ago
  Yes, that was the memory glitching attack. But it was a pretty hard exploit to pull off, the required pulse was pretty short and required getting lucky. Nobody ever developed it into something particularly useful for end users, and it didn't directly enable piracy. While I suspect the unknown person who developed the PSJailbreak exploit did use that attack as a stepping stone towards hacking GameOS, it was not a requirement. And it also could have been done from GameOS once you had kernel level code executing there.

by phire 3y ago

rgovostes 3y ago

Thanks for your work reverse engineering PSJailbreak, by the way. (https://www.psdevwiki.com/ps3/PSJailbreak_Exploit_Payload_Reverse_Engineering https://www.psdevwiki.com/ps3/PSJailbreak_Exploit_Payload_Re...)

phire 3y ago
I also worked on PSGroove. Though that was very much a team effort, I knew nothing about USB before working on that. From memory, my contribution was mostly tweaking the code until it worked, I think my PS3 was the first to be exploited by PSGroove. Though, I wasn't happy at merely copying the sequence of packets USB that lead to an exploit, so I spent some time trying to get a better understanding of how the exploit worked. That document is the result of my efforts.

teaearlgraycold 3y ago

I recall there was something involving Other OS and soldering a wire into the motherboard.

xcrunner529 3y ago
It was one of the first ways I could rip a bluray, though
phire 3y ago
Yes, that was the memory glitching attack. But it was a pretty hard exploit to pull off, the required pulse was pretty short and required getting lucky. Nobody ever developed it into something particularly useful for end users, and it didn't directly enable piracy. While I suspect the unknown person who developed the PSJailbreak exploit did use that attack as a stepping stone towards hacking GameOS, it was not a requirement. And it also could have been done from GameOS once you had kernel level code executing there.