PS3: LV0 Man-in-the-middle attack writeup + tools, by MikeM64. Full CFW for all PS3s is next? - Wololo.net

The aim of this exploit is to fully unlock the LV0 (Boot Loader) on PS3 newer models, to ultimately be able to install Full Custom Firmwares on the console.

There was some poking and prodding done from Linux to the hypervisor but nobody really bothered to dig too far until OtherOS support was removed from slim consoles.

After the release of GeoHot’s HTAB exploit, OtherOS was removed from all consoles in 3.21.

This was the catalyst which opened the floodgates to complete exploit of the console.

I’ve summarized the current state of many exploits released for the PS3 console below:.

After the release of the sigfail exploit, Sony attempted to re-secure the bootchain by moving all loaders into lv0 as that had yet to be dumped or exploited.

This was a good stop-gap solution until Juan Nadie and the Three Musketeers dumped lv0ldr and their exploit and keys were leaked.

Consoles manufactured after the sigfail release were updated with new lv0 metadata (lv0.2) which is not vulnerable to the sigfail exploit.

For all consoles which were not vulnerable to sigfail, HEN was released which exploited both the built-in web browser and LV2 kernel to enable both homebrew and piracy in GameOS.

This still does not allow for OtherOS support or hypervisor modification to this day.

This issue alone would not normally be enough to exploit lv0ldr.

This allows us to pause execution of lv0ldr on any memory access, enabling the exploit and dumping lv0ldr.

MikeM64 gives extensive details on how to achieve the hardware hack, providing all the necessary tools for other hackers to work on the next steps, including CFW support for all PS3 models.

PS4 exploit: functional FTP Payload released for Firmware 9.03/9.04

PS4 exploit: functional FTP Payload released for Firmware 9.03/9.04