So, some quick news:
We kept on working on this idea, and it worked out. pretty well. We use JTAG to program the DMA target addr, and then SMC to trigger the DMA read. The exploit itself is based on the old 4532 exploit.
The magic is how we launch 4532 - there is a "backdoor" for manufacturing since CB 1920. We have been able to restore the newer CD versions for all hardware types.
This means:
- We can boot own code in HV context ~5s after boot, before any video output, right after the kernel runs.
- we need to reflash the flash, and add 3 resistors for the JTAG (no modchip required! but you might want a dual-nand modchip),
- 8498 kills this by updating the bootloader - it blacklists 4532/4548. it also does hw init stuff which might interefere with the jtag hack, we don't know yet.
- we have a proof of concept hack, we will release it SOON (a matter of hours/days, not more - promised.).
- DON'T UPDATE to summer 09. Did i already say this?
- you don't need to know your cpu key. You can update to all BUT summer '09. you don't need a dvdrom.
- It works on all xenon, zephyr, falcon, opus, jasper. Unless you have updated to 849x. Then you're screwed.
- It's possible to recover DVD keys. In fact, no DVD-ROM is required to run the hack, so it's possible to run own code, dump cpu key, decrypt HV, inject key, flash back. Note that I personally don't like games, so I won't be of much help here.
- No, even if you know your CPU key, it's not possible to downgrade back from 8498.
- Right now, the only way to support both gaming and hacking would be a dual-nand modchip, which switches between nand contents. Note that you still couldn't update to 8498, as it likely (haven't tried) doesn't run without R6T3.
From a technical perspective, I want to stress that this is not "yet another bug" - it's THE SAME bug we used 2 years ago. It's just that we changed the way how we write to memory, and that allows for the new cool features.
R.I.P. 
Citera
Original inlägg av Hansi
Bookmarks