Skip to content
Hallway
0:00 / 0:00

#ps4#linux#fail0verflow

Console Hacking 2016 (33c3)

media.ccc.de

274K subscribers • 57 videos on Hallway • Conference channel

YouTube
  • Recommended by 4 people: 4 on Hacker News.
  • A classic. People kept recommending it from 2017 to 2024.
  • Presented by Hector Martin, member of fail0verflow

Advanced. Deep dive for people who know the field.

166K views9 years ago4 recommendations

SecuritySystems programmingExploits and vulnerabilitiesReverse engineeringOperating systems

Hector Martin explains how fail0verflow reverse engineered the PlayStation 4 hardware to run a full Linux distribution with 3D acceleration.

media.ccc.de/v/33c3-7946-console_hacking_2016 PS4: PC Master Race Last year, we demonstrated Linux running on the PS4 in a lightning talk - presented on the PS4 itself. But how did we do it? In a departure from previous Console Hacking talks focusing on security, this year we're going to focus on the PS4 hardware, what makes it different from a PC, and how we reverse engineered it enough to get a full-blown Linux distro running on it, complete with 3D acceleration. ['marcan']

Why it's here

4 people recommend this

What people say. Recommended as a classic, highly detailed talk on console reverse engineering, hardware hacking, and running Linux on custom architectures.

izacuson Hacker News • Recommends

On “What the death of the CRT display technology means for classic arcade machines”

While the CPU is indeed x86-64, the architecture of the SoC and the device is rather different so emulation still won't be all that easy. This 33c3 talk gives a lot of fascinating information on how PS4 differs from your run-of-the-mill PC and what kind of issues they hit when trying to run Linux on it: link to this video
View on Hacker News

jvdhon Hacker News • Recommends

On “The BSD family tree”

`It's interesting to note that the PS4 OS is also a forked FreeBSD variant as well.` Here's a nice talk at CCC last year which explains some bits of FreeBSD in the PS4. It's mostly about hardware and how to run Linux on it, but FreeBSD gets a nice mention there too. link to this video
View on Hacker News

lathiaton Hacker News • Recommends

On “Hacking group says it has found encryption keys needed to unlock the PS5”

The key is on the console (not server side). Historically either they made some silly choices or there was a hardware bug or glitch that let you read out the key that the processor has to be able to access to decrypt the firmware. Search YouTube for fail0verflow and there are some great CCC talks very approachable and understandable about how it was done on other consoles historically. PS4: link to this video Wii U: link
View on Hacker News

s1gsegvon Hacker News • Recommends

On “How to reenable undervolting in 2020 Dell Laptops by editing EFI variables”

This is a good watch, it goes into detail on the architecture of the PS4 showing how it differs from a standard x86_64 “PC.” link to this video The “too long; didn’t watch” summary is that there’s several peripherals, timers, RTC, etc outside of the processor that software will expect to be present (or at least emulated) with specific interfaces. You can implement x86_64 without a lot of this, or redone in a more modern style, but software such as a Linux kernel will have to be patched for it. Typically a modern laptop will have all the legacy peripherals emulated, and the modern peripherals will live alongside them.
View on Hacker News

Asookaon Hacker News • Mentions

On “Ask HN: Why is BSD becoming more popular in embedded devices?”

> since using a vanilla kernel would make a public exploit in say, FreeBSD, easily ported to their device You mean like at the recent CCC where they demonstrated using a WebKit exploit to trigger a BSD exploit via which they install a working Linux system on a PS4 and launch Steam? Link: link to this video It's not as simple as that because the PS4 is a custom board, so even though the CPU and GPU are standard AMD components, some hacking was required. But using exploits that have long been patched to gain access to hardware by Sony and Nintendo is nothing new.
View on Hacker News

wmfon Hacker News • Mentions

On “Struck by a Thunderbolt”

…oo lazy to properly write it (I wouldn't be surprised if Thunderbolt is basically defined as whatever the original Ridge controller implemented) and it's probably also gross. Adoption seems to be limited by cost, not by secrecy (thinking back to Firewire, it was open but there were very few controller chips for it). 1 Check out PCIe over RS-232: link to this video…
View on Hacker News

raverbashingon Hacker News • Mentions

On “Cursed Adapters”

Reminds me of some PS4 or Xbox (I think) reverse engineering video where they they tunneled PCI-E over RS232 (around 8m15s) link to this video
View on Hacker News

marcan_42on Hacker News • Mentions

On “Raspberry Pi PCIe Devices”

Ah, but have you ever run PCIe over 115200 baud serial? :) We did that for the PS4 hardware experiments, and that also involved a PCIe hotplug capable motherboard, as we had a PS4 southbridge patched in as a PCIe device on a normal PC, and every time we powered on the PS4 that was effectively hotplugging it. Fun times. These days PCIe hotplug is a consumer technology, it's called Thunderbolt (it's hotplug at the logical layer, not physical PCIe lanes, but to the OS/software it's about the same). PS4 talk including the PCIe story: link to this video
View on Hacker News

drekipuson Hacker News • Mentions

On “Google developing own CPUs for Chromebook laptops”

If I remember correctly that's similar what the PS3 did, but that's a different issue and comes with cool discussions This talk is about the PS4, similar in concept link to this video
View on Hacker News