Hardware based memory dumping/searching...

[root670]

Has there every been any public developments relating to hardware based memory manipulation? For example, an interface soldered directly to a motherboard that has full R/W access to the RAM while the system is running? I read somewhere that this is the method CMX used for hacking PS2 codes. I'd imagine it would have also been done for systems like the Dreamcast, since the only other would have been through an emulator (I think?). Geohot did RAM dumps on the PS3 with external hardware.

So, if information about this thing isn't readily available, how hard is it to do?

[Lazy Bastard]

Hmm...I believe there was a guide to doing so for PS2, though I don't know if it was specifically the method CMX used. I can do some digging if you can't find it with a Google search or two.

[root670]

Yes, please do some digging, I'd really appreciate it. I've never been able to find anything about it.

[Helder]

you will need some mad soldering skills I'd imagine as some of the processor legs are tiny as all hell and might be needing to solder to a few in a row like the newer model ps2 that mod-chips solder to, and or solder directly onto traces. If you find anything and its not insanely complicated I might give it a shot in one of my ps2.

[Lazy Bastard]

Ah, here it is. I was thinking of the EE-SIO hardware hack, by Marcus R Brown (aka MRBrown). It's a method by which one can create a Serial Input/Output connection with direct access to the Emotion Engine, or EE (skipping the Input/Output Processor, or IOP). You'll still have to find/write/modify some code to allow you to dump live memory whilst connected to a PC in this way, but it's been done before, apparently. Keep in mind that serial connections are slower than ethernet ones, and thus your potential RAM-dumping capabilities will actually be slower than, say, those of the Artemis solution.

Here's a link to a PS2Dev.org thread concerning the EE SIO mod (hey, ps2dev.org's forums are up again, for now):

http://forums.ps2dev.org/viewtopic.p...solder&start=0

...however, the link to the guide itself is broken. So, here's a mirror of the guide:

http://www.kanshima.net/mirrors/ee-sio/ps2-ee-sio.html

...and here's some source for a quick test app, to verify your mod is working:

http://forums.ps2dev.org/viewtopic.php?t=643

Apparently, Marcus R Brown also contributed an entire chapter to the book, Hardware Hacking: Having Fun While Voiding Your Warranty, by Joe Grand (author), Ryan Russell (author), and Kevin Mitnick (editor), in which the guide to creating the EE-SIO is duplicated.

Here's another PS2Dev.org thread concerning some more details related to the mod:

http://forums.ps2dev.org/viewtopic.php?p=82547

[lee4]

Caution you will need Fat PS2 model for this EE-SIO hardware modification

[root670]

Yea I've seen that before, it lets you see stuff that would be seen on a PS2-TOOL's shell screen thing. Maybe if someone could contact CMX, he might have some stuff to say about his solution. Commercial PS2 cheating is dead, so there should be nothing to hide. Of course, he's probabbly busy and iirc, you can't PM him on CodeTwink.

[Helder]

I was gonna attempt this but in order to get a free chip sample I need a non public email which I currently dont have and I have 1 maybe even 2 ps2 phats lying around to test out and a brand new soldering station with a hotair attachment.

https://shop.maxim-ic.com/storefront...MAX3227EEAE%2B

[Parasyte]

This is the "big guns" in terms of attack vectors on hardware. Unfortunately, it doesn't easily work on targets that use ECC memory with custom parity algorithms. And you'll have even more trouble on targets with encrypted memory.

But yeah, for old PS2 and DC, no problem! Wire an FPGA directly to the RAM and have at it...