167K views · Dec 28, 2016 · 53:44 · 4 HN recommenders · 9 mentions · discussed 2017–2024
A 33c3 talk by marcan on reverse engineering the PS4 hardware to run Linux with 3D acceleration. It covers how the console differs from a PC and includes a story about tunneling PCIe over RS-232.
Why Hacker News points people here: Recommended as an approachable, detailed look at console hardware architecture, FreeBSD in the PS4 and console hacking.
“This is a good watch, it goes into detail on the architecture of the PS4”HN comment, 2024
“This 33c3 talk gives a lot of fascinating information on how PS4 differs from your run-of-the-mill PC”
Explains how PS4 differs from a PC and issues running Linux.
While the CPU is indeed x86-64, the architecture of the SoC and the device is rather different so emulation still won't be all that easy. This 33c3 talk gives a lot of fascinating information on how PS4 differs from your run-of-the-mill PC and what kind of issues they hit when trying to run Linux on it: this video
“Here's a nice talk at CCC last year which explains some bits of FreeBSD in the PS4.”
Covers PS4 hardware, running Linux, and FreeBSD in the PS4.
`It's interesting to note that the PS4 OS is also a forked FreeBSD variant as well.` Here's a nice talk at CCC last year which explains some bits of FreeBSD in the PS4. It's mostly about hardware and how to run Linux on it, but FreeBSD gets a nice mention there too. this video
“there are some great CCC talks very approachable and understandable about how it was done on other consoles historically.”
Approachable CCC talk on how PS4 was hacked.
The key is on the console (not server side). Historically either they made some silly choices or there was a hardware bug or glitch that let you read out the key that the processor has to be able to access to decrypt the firmware. Search YouTube for fail0verflow and there are some great CCC talks very approachable and understandable about how it was done on other consoles historically. PS4: this video Wii U: link
“This is a good watch, it goes into detail on the architecture of the PS4”
Details PS4 architecture and how it differs from a standard x86_64 PC.
This is a good watch, it goes into detail on the architecture of the PS4 showing how it differs from a standard x86_64 “PC.” this video The “too long; didn’t watch” summary is that there’s several peripherals, timers, RTC, etc outside of the processor that software will expect to be present (or at least emulated) with specific interfaces. You can implement x86_64 without a lot of this, or redone in a more modern style, but software such as a Linux kernel will have to be patched for it. Typically a modern laptop will have all the legacy peripherals emulated, and the modern peripherals will live alongside them.
Demonstrates WebKit and BSD exploits used to run Linux on a PS4.
> since using a vanilla kernel would make a public exploit in say, FreeBSD, easily ported to their device You mean like at the recent CCC where they demonstrated using a WebKit exploit to trigger a BSD exploit via which they install a working Linux system on a PS4 and launch Steam? Link: this video It's not as simple as that because the PS4 is a custom board, so even though the CPU and GPU are standard AMD components, some hacking was required. But using exploits that have long been patched to gain access to hardware by Sony and Nintendo is nothing new.
“Check out PCIe over RS-232”
Shows PCIe tunneled over RS-232.
PCIe is also packet-based BTW [1]. The benefit from the custom protocol is being able to run PCIe and DisplayPort (and I guess networking which no one cares about) over the same cable at the same time with dynamic bandwidth allocation. USB-C has alternate modes but they're not as powerful. In theory PCIe alternate mode over USB-C should be possible and it would be much simpler than Thunderbolt but nobody has tried to build it. I imagine the spec doesn't really exist because Intel has been too lazy to properly write it (I wouldn't be surprised if Thunderbolt is basically defined as whatever the original Ridge controller implemented) and it's probably also gross. Adoption seems to be limited by cost, not by secrecy (thinking back to Firewire, it was open but there were very few controller chips for it). [1] Check out PCIe over RS-232: this video
“they they tunneled PCI-E over RS232 (around 8m15s)”
Shows PCI-E tunneled over RS232 in PS4 reverse engineering.
Reminds me of some PS4 or Xbox (I think) reverse engineering video where they they tunneled PCI-E over RS232 (around 8m15s) this video
“PS4 talk including the PCIe story”
Speaker's own PS4 talk including the PCIe over serial story.
Ah, but have you ever run PCIe over 115200 baud serial? :) We did that for the PS4 hardware experiments, and that also involved a PCIe hotplug capable motherboard, as we had a PS4 southbridge patched in as a PCIe device on a normal PC, and every time we powered on the PS4 that was effectively hotplugging it. Fun times. These days PCIe hotplug is a consumer technology, it's called Thunderbolt (it's hotplug at the logical layer, not physical PCIe lanes, but to the OS/software it's about the same). PS4 talk including the PCIe story: this video
“This talk is about the PS4, similar in concept”
PS4 talk with concept similar to PS3 approach.
If I remember correctly that's similar what the PS3 did, but that's a different issue and comes with cool discussions This talk is about the PS4, similar in concept this video
