Console Hacking 2016 (33c3)

While the CPU is indeed x86-64, the architecture of the SoC and the device is rather different so emulation still won't be all that easy. This 33c3 talk gives a lot of fascinating information on how PS4 differs from your run-of-the-mill PC and what kind of issues they hit when trying to run Linux on it: [VIDEO]

`It's interesting to note that the PS4 OS is also a forked FreeBSD variant as well.` Here's a nice talk at CCC last year which explains some bits of FreeBSD in the PS4. It's mostly about hardware and how to run Linux on it, but FreeBSD gets a nice mention there too. [VIDEO]

The key is on the console (not server side). Historically either they made some silly choices or there was a hardware bug or glitch that let you read out the key that the processor has to be able to access to decrypt the firmware. Search YouTube for fail0verflow and there are some great CCC talks very approachable and understandable about how it was done on other consoles historically. PS4: [VIDEO] Wii U: [LINK]

This is a good watch, it goes into detail on the architecture of the PS4 showing how it differs from a standard x86_64 “PC.” [VIDEO] The “too long; didn’t watch” summary is that there’s several peripherals, timers, RTC, etc outside of the processor that software will expect to be present (or at least emulated) with specific interfaces. You can implement x86_64 without a lot of this, or redone in a more modern style, but software such as a Linux kernel will have to be patched for it. Typically a modern laptop will have all the legacy peripherals emulated, and the modern peripherals will live alongside them.

> since using a vanilla kernel would make a public exploit in say, FreeBSD, easily ported to their device You mean like at the recent CCC where they demonstrated using a WebKit exploit to trigger a BSD exploit via which they install a working Linux system on a PS4 and launch Steam? Link: [VIDEO] It's not as simple as that because the PS4 is a custom board, so even though the CPU and GPU are standard AMD components, some hacking was required. But using exploits that have long been patched to gain access to hardware by Sony and Nintendo is nothing new.

PCIe is also packet-based BTW [1]. The benefit from the custom protocol is being able to run PCIe and DisplayPort (and I guess networking which no one cares about) over the same cable at the same time with dynamic bandwidth allocation. USB-C has alternate modes but they're not as powerful. In theory PCIe alternate mode over USB-C should be possible and it would be much simpler than Thunderbolt but nobody has tried to build it. I imagine the spec doesn't really exist because Intel has been too lazy to properly write it (I wouldn't be surprised if Thunderbolt is basically defined as whatever the original Ridge controller implemented) and it's probably also gross. Adoption seems to be limited by cost, not by secrecy (thinking back to Firewire, it was open but there were very few controller chips for it). [1] Check out PCIe over RS-232: [VIDEO]

Reminds me of some PS4 or Xbox (I think) reverse engineering video where they they tunneled PCI-E over RS232 (around 8m15s) [VIDEO]

Ah, but have you ever run PCIe over 115200 baud serial? :) We did that for the PS4 hardware experiments, and that also involved a PCIe hotplug capable motherboard, as we had a PS4 southbridge patched in as a PCIe device on a normal PC, and every time we powered on the PS4 that was effectively hotplugging it. Fun times. These days PCIe hotplug is a consumer technology, it's called Thunderbolt (it's hotplug at the logical layer, not physical PCIe lanes, but to the OS/software it's about the same). PS4 talk including the PCIe story: [VIDEO]