An app for dumping PS3 spe local storage

[dlevere]

By Adrian C

LSPWN v0.1 : An app for dumping PS3 spe local storage.

overview:
this app dumps the local store of an spe to /dev_hdd0/game/LSPWN0ADC/USRDIR/localstore.bin
a neat POC for devs, but also a n00b friendly introduction to the spe environment.

instructions:
1. run the app
2. copy the binary from the hdd using your preferred method
3. disassemble using ida and get a hands on look at the local store
4. ???
5. profit!

notes:
source code forthcoming after some cleanup
gui in v0.2 release
support for isolation mode if there is demand

greetz:
gitbrew, mathieulh, geohot, sonic iso, #ps3secret, uf6667, zerkman, and too many others to mention.

addendum:
contact me, adrianc on efnet or [email protected], if you wish to donate and help purchase a reference tool for the community. this has many benefits such as new keys, debugging for all devs, syscon exploits and many more. your support will not be forgotten

-adrianc

Download

[Lazy Bastard]

That's a good step. Hopefully we see similar releases with increased capabilities soon.

[bungholio]

What is a "spe"? Software something environment???

[dlevere]

Synergistic Processing Elements (SPE)

Each SPE is composed of a "Synergistic Processing Unit", SPU, and a "Memory Flow Controller", MFC (DMA, MMU, and bus interface).

An SPE is a RISC processor with 128-bit SIMD organization for single and double precision instructions. With the current generation of the Cell, each SPE contains a 256 KiB embedded SRAM for instruction and data, called "Local Storage" (not to be mistaken for "Local Memory" in Sony's documents that refer to the VRAM) which is visible to the PPE and can be addressed directly by software.

Each SPE can support up to 4 GiB of local store memory. The local store does not operate like a conventional CPU cache since it is neither transparent to software nor does it contain hardware structures that predict which data to load.

The SPE's contain a 128-bit, 128-entry register file and measures 14.5 mm2 on a 90 nm process. An SPE can operate on sixteen 8-bit integers, eight 16-bit integers, four 32-bit integers, or four single-precision floating-point numbers in a single clock cycle, as well as a memory operation.

Note that the SPU cannot directly access system memory; the 64-bit virtual memory addresses formed by the SPU must be passed from the SPU to the SPE memory flow controller (MFC) to set up a DMA operation within the system address space.

In one typical usage scenario, the system will load the SPE's with small programs (similar to threads), chaining the SPE's together to handle each step in a complex operation. For instance, a set-top box might load programs for reading a DVD, video and audio decoding, and display, and the data would be passed off from SPE to SPE until finally ending up on the TV. Another possibility is to partition the input data set and have several SPEs performing the same kind of operation in parallel. At 3.2 GHz, each SPE gives a theoretical 25.6 GFLOPS of single precision performance.

Recent tests by IBM show that the SPEs can reach 98% of their theoretical peak performance using optimized parallel Matrix Multiplication.

Toshiba has developed a co-processor powered by four SPEs, but no PPE, called the SpursEngine designed to accelerate 3D and movie effects in consumer electronics.

[dlevere]

Finding the rest of the PS3 secrets

NEWS SOURCE

The PS3 Reference Tool Kit - DECR-1000A - This tool costs over $10,000 from Sony, and only used by high-end Game Studios as it has features which are not allowed in normal DEBUG/TEST machines.



Quote:

Hey, I'm adrianc, you may know me from around the ps3 scene for my work on various projects, for example finding and releasing the 3.56 keys. I'd like to encourage you to donate whatever you can to this project, as it could be a catalyst for great things in the scene.

First and foremost, the decr-1000a is a device that is essential to any quality homebrew being produced. Without it, homebrew devs cannot profile their applications in real time, something that will cripple most intensive applications such as gamecube or ps2 emulation, preventing them from ever being viable.

Secondly the Decr-1000a could open up the possibility of dumping the 3.60+ keys as it has a different hardware setup which could make it easier to dump the ram. In addition to this, the Syscon, which remains the last unhacked CPU remaining inside the PS3 could be exploited on the 1000a system, as it has a prototype syscon with a completely different update process.

Third and finally, the decr-1000a motherboard remains somewhat of a mystery, with only some very old pictures that are available. It would be an incredible asset to the ps3 developer wiki if we could get more information as well as pictures of this enigmatic device.

If you still believe in the ps3 scene, I urge you to donate whatever you can to this project, in order to secure a bright future for devs and end users alike.

[dlevere]

Adrian C receives Cease and Desist letter



Adrianc was well known for finding the 3.56 keys and recently he had a new project of raising money to buy a DECR console. He planned on using it to better debug applications but also to explore the possibility of exploits, as the DECR hardware differs from a normal PS3. He was well on his way of completing his goal, until he got a cease and desist notice today. His blog and twitter account have both been removed.

His last tweet

"got a cease and desist, going off the radar for a bit. la resistance will live on"

UPDATE: Andrianc did not receive a c&d from Sony but from else where, and is not allowed to disclose who. This does not stop him from purchasing the DERC unit, donations will be open for 3 days after that andrianc will cover the rest for the console.

[dlevere]

UPDATE - PS3 Decr Project - Interview with adrianc