fail0verflow

[fail0verflow @fail0verflow]

btw: we first used the included iommu script to bypass iommu and dump x86 kernel text via custom pcie device in m.2 slot - worked first try :')
#historylesson #incaseyouevencared

[fail0verflow @fail0verflow]

Method we used (>5 years ago, now) on ps5 to fiddle with mp4 and hv memory: https://t.co/SJ0hyG5YRC
hope it helps for linux!

[fail0verflow @fail0verflow]

🐧

[Andy Nguyen @theflow0]

I ported Linux to the PS5 and turned it into a Steam Machine. Running GTA 5 Enhanced with Ray Tracing. 🤯

[fail0verflow @fail0verflow]

want to play with the fbsd umtx exploit? check out https://t.co/AARWy9HR4c

[fail0verflow @fail0verflow]

https://t.co/Pyo2j8ZCwY

[Aleksei Kulaev @flat_z]

finally... hello, PS5 PSP :)

[fail0verflow @fail0verflow]

@vpikhur @oct0xor @theflow0 @hardwear_io If a tree falls in a forest and no one is around to hear it, does it make a sound?

[fail0verflow @fail0verflow]

New blog post about hacking PS VR! We managed to find some major flaws - breaking secure boot and extracting all key material: https://t.co/8Qdzr6OMa5

[fail0verflow @fail0verflow]

@3226_2143 @notzecoxao yes, but it's arm here

[fail0verflow @fail0verflow]

Translation: We got all (symmetric) ps5 root keys. They can all be obtained from software - including per-console root key, if you look hard enough!

[fail0verflow @fail0verflow]

Another one bites the dust 😎

[fail0verflow @fail0verflow]

@damienmiller No

[fail0verflow @fail0verflow]

Another one bites the dust 😎

[fail0verflow @fail0verflow]

@VVildCard777 @LightningMods_ With emc code exec, you can handle all snvs msgs to sc yourself. Makes it easier to fiddle with snvs contents and avoid bad writes into the actual sc. sc dump is still required for key. hdd backup isn't required, but maybe faster than going through recovery install.

[fail0verflow @fail0verflow]

Here is our implementation of the Renesas RL78 debug protocol (as requested in a comment on the blog): https://t.co/AYbWwIsgx3

[fail0verflow @fail0verflow]

Took a peek at latest PS4 Pro (CUH-72xx, board NVG-001): same southbridge (CXD90046GG), newly marked syscon (A06-C0L2 but still RL78/G13) - so nothing changes in terms of "Aux Hax" stuff :)

[fail0verflow @fail0verflow]

Another "PS4 Aux Hax" blog! Using HDMI-CEC to get code exec on all PS4 southbridge versions (including PS4 Pro, etc.), without requiring other parts of the system to be pwned:
https://t.co/tLBvMho8W2

[fail0verflow @fail0verflow]

Small update to Aux Hax:
Nearly same methods are working against devices on recent PS4 Pro board NVB-003:
Syscon A05-C0L2 (R5F101LL)
Belize southbridge (CXD90046GG)

Belize has ROM readout protection and clears stack...they're learning ;)

[fail0verflow @fail0verflow]

@drtune @cybergibbons Agree; would be nice if it were useful on other devices too. Note the FM3 on that board was still marked Fujitsu. Design has gone to Spansion, which has merged with Cypress since then. A lot of opportunity for change - or not :D

[fail0verflow @fail0verflow]

A trio of new blog posts! Checkout "PS4 Aux Hax": hacking Aeolia, Syscon, and DS4. https://t.co/7nsAMNzPY0

[fail0verflow @fail0verflow]

@wmbell It's an upper bound. It could've been disclosed earlier, but not later, otherwise a CVE wouldn't have been allocated (unless we requested it ourselves, which we didn't).

[fail0verflow @fail0verflow]

The Tegra X1 flaw that both ShofEL2 and Fusée Gelée exploit now has a name: CVE-2018-6242. https://t.co/4VAd7TUxhd https://t.co/KWUKQPjrxQ

[fail0verflow @fail0verflow]

@diwidog @St4rkDev Touchée