Check it here: http://geohotps3.blogspot.com/2010/0...im-geohot.html
Check it here: http://geohotps3.blogspot.com/2010/0...im-geohot.html
Ha cool, be nice to see what may come.
Hacked, yes. PS3 emulator soon? Which run commercial games at a playable speed? I highly doubt it.
This is what he did, accordingly. It's in h4x0r language, so I don't understand shit xD
Expect a firmware upgrade soon.Code:geohot: well actually it's pretty simple geohot: i allocate a piece of memory geohot: using map_htab and write_htab, you can figure out the real address of the memory geohot: which is a big win, and something the hv shouldn't allow geohot: i fill the htab with tons of entries pointing to that piece of memory geohot: and since i allocated it, i can map it read/write geohot: then, i deallocate the memory geohot: all those entries are set to invalid geohot: well while it's setting entries invalid, i glitch the memory control bus geohot: the cache writeback misses the memory :) geohot: and i have entries allowing r/w to a piece of memory the hypervisor thinks is deallocated geohot: then i create a virtual segment with the htab overlapping that piece of memory i have geohot: write an entry into the virtual segment htab allowing r/w to the main segment htab geohot: switch to virtual segment geohot: write to main segment htab a r/w mapping of itself geohot: switch back geohot: PWNED geohot: and would work if memory were encrypted or had ECC geohot: the way i actually glitch the memory bus is really funny geohot: i have a button on my FPGA board geohot: that pulses low for 40ns geohot: i set up the htab with the tons of entries geohot: and spam press the button geohot: right after i send the deallocate call
There are currently 1 users browsing this thread. (0 members and 1 guests)