As you may know if you've been following my progress, last week I took a short break from Wi-Fi Sync to look at the PS3 and how it works behind the scenes. The PS3 homebrew scene is currently at a point where you can install userland packages, such as FTPDs and SNES emulators, but you still don't have any access to the hypervisor or GameOS kernel. It's still very much a closed system. 在3.55版韧体上虽然已经可以执行一些自制程式，但遇到要存取HV或是核心的状 况，暂时还没辙，所以不算完全开放。 As an iPhone developer with an app on Cydia, I can see great potential within the PS3. It's crying out for a decent package manager, but you need OS-level access to do that effectively. Unlocking the PS3 in this way has other benefits too; the system can effectively be modified in any way you wish. Cydia 在iPhone上面赚了不少钱，而且潜力仍然深不可测，如果 PS3也能学学人 家iPhone，应该会是件好事，每个人都可以打造自己理想中的主机。 So today I'm releasing three tools which open the PS3's hypervisor (lv1) and GameOS (lv2) to full read/write access from packaged userland applications. These tools can be used to create and test lv1/lv2 patches in RAM, which negates the risk of bricking your PS3 by flashing it with an incorrectly patched lv1 or lv2 binary. You can also use the tools to create a patched lv1 or lv2 binary, if you wish, although I suggest thoroughly testing your patches in-memory first. 因此，今天我释出能够完整存取HV与GameOS核心的三个工具，这些工具可以直接 在记忆体里面操握，换句话说能够免除不小心让自己的主机砖掉的风险。当然， 如果测试一切正常，要直接修正Lv1 与Lv2 的执行档也不是不可以。当然我还是 建议先做好完整的测试再来。 I will make a few things clear before continuing: I do not condone piracy and these tools DO NOT enable copied games to run on the PS3. Again: these tools will not allow backup managers to suddenly start working on firmware 3.55. The tools are packaged in source code form and do not include any Sony code or other Sony assets such as encryption keys. If you're not a developer, these tools will be useless to you, so please do not try to use them. They are made available with no implied warranty of fitness for a particular purpose. 在介绍工具之前，有些事我必须先讲明：1.我不支持盗版，这些工具也不会突然 让盗版游戏变得可执行，备份管理员也不会因此突然就可以在3.55版韧体上执行 。2.这些程式都是以原始码的形式释出，藉此证明里面完全没有$QNY的任何资产 ，包含加密金钥之类的。所以说，如果你不是开发者的话，这些工具对你而言是 完全没用的，因此你也不用特地浪费时间去抓来用。3.使用这些工具的人必须自 行承担风险。 Three tools are being made available today: * resign_self.py. This allows you to automatically replace any segment within a self and re-sign the self so the signatures and hashes are all valid again. Similar to makeself, but it is more suited towards patching lv1 and lv2 (and has been tested for this purpose). 跟makeself很类似的东西，将改过的.elf档案重新加密成.self 档。 * insert_lv1_lv2.py. This is just a convenience script I made to take a modified, re-signed lv1.self and lv2_kernel.self, and automatically create a PUP which is identical to an original PUP except for those two files. 将改过的lv1.self与lv2_kernel.self 档案置入.PUP更新档。 * lv1dumper. This is an application which runs on the PS3 that you can compile and package using PSL1GHT and geohot's tools. After running it, lv1 will be mapped at 0x8000000014000000 with read/write access, and you will be able to poke lv2 without the system shutting down. It disables the new lv2 memory hashing feature Sony added to 3.55 (probably to stop future USB jailbreaks). 将整个lv1 记忆体全部读出的工具，$QNY为3.55版韧体的 lv2加上了防护，如果 lv2 记忆体遭到未获授权的写入，就会立刻切断主机电源，所以要先把这道防护 措施关闭。读出的记忆体会映对在0x8000000014000000这个位址上。 lv1dumper requires that some patches to lv1 and lv2 are already in place. I'll describe how to add these patches. They have been tested but I cannot guarantee that they won't brick your PS3. Do not do this unless you're comfortable with that. 要让lv1dumper 可以动作，有些手续要先完成。我会告诉你们怎麽做，虽然我本 身有测试过了，但我还是不能保证他们绝对安全，如果你愿意冒险，那请继续看 下去。 Firstly, you need to extract the decrypted code segments from lv1.self and lv2_kernel.self (just use unself and copy them directly out of the ELF), and make the following changes to to them, assuming you're using 3.55: 首先要把lv1.self与lv2_kernel.self 这两个档案解密，假设你用的是3.55版韧 体。 * lv1_undocumented_function_114 in lv1 must be patched so that it can be used to map any area of real memory. graf_chokolo found this trick months ago, but it still applies here. Patch the byte at D5A47 from 00 to 01 (2D5A47 if you’re looking for it in IDA). lv1 未记载的第 114号函式必须经过处理。 * You then need to add peek and poke to lv2. Patch 1933C to E8 63 00 00 60 00 00 00 and 19348 to F8 83 00 00 60 00 00 00. 同时lv2_kernel.self 也要经过处理。 You can then use resign_self.py to re-insert your patched code segment back into the self. You'll firstly need to change a few bytes in some useless strings because of the way zlib deflate works; the script will tell you what to do. I found that changing strings was the easiest way to do this, it just takes a bit of trial and error. 都搞定後使用resign_self.py将处理过後的执行档重新加密成.self 档案，在此 之前要砍掉一些不需要的字串否则zlib没办法正常处理。放心，我的程序会告诉 你怎麽做。我个人认为修改字串是最简单的方法，稍微尝试一下就能成功了。 Finally, use insert_lv1_lv2.py to create your modified PUP. You'll need to update to the PUP, then install geohot's jailbreak PUP over the top of it. If you've done everything right, lv1dumper should just exit after you run it and you'll have r/w access to lv1 and lv2 (peek and poke). The lv1_peek, lv1_poke, lv2_peek and lv2_poke functions in lv1dumper show how to use that access. 最後当然是利用insert_lv1_lv2.py 去产生修改过的.PUP档案。要能让效果展现 首先必须要重新更新韧体一次，然後再使用geohot的.PUP档案。如果一切顺利， lv1dumper 在执行後会自动离开，然後主机就会有lv1 跟 lv2的peek & poke 功 能。程式原始码中的几个函式算是示范，会告诉你怎麽用。 I'm hoping that some interesting and innovative stuff can come out of this, and maybe we can start to see 'unofficial' apps enjoying the same success on the PS3 that they do on the iPhone. 我希望大家把我的工具用於正途，也希望众多高手能够慷慨解囊，也许不久，就 能看到一些非官方的软体在 PS3主机上大方光彩，就跟iPhone上面一样。 ****** 基本上lv1 记体都被读出之後，就是寻找dev_bdvd的挂载(hook)的位址了，只要 能够挂上去备份管理员应该就能动了。 -- ○ ____ _ _ _ _ ____ _ _ ____ _____ ____ 。 ★(_ _)( \( )( \/ )( ___)( \( )(_ _)( _ )( _ \ ｏ _)(_ ) ( \ / )__) ) ( )( )(_)( ) / ● ‧ (____)(_)\_) \/ (____)(_)\_) (__) (_____)(_)\_) ★ ｏ --

※ 发信站: 批踢踢实业坊(ptt.cc) ◆ From: 122.117.54.160 ※ 编辑: cassine 来自: 122.117.54.160 (01/17 09:36)