RPCS3 / rpcs3

PlayStation 3 emulator and debugger
https://rpcs3.net/
GNU General Public License v2.0
15.4k stars 1.91k forks source link

[Feature Request] DVD player support #8579

Open CTurt opened 4 years ago

CTurt commented 4 years ago

It would be nice for the PlayStation 3 DVD player to be emulatable with this project, as it would aid reverse engineering efforts. Or at least a sufficient subset just to debug initial IFO file parsing code on the CPU (video / sound playback, etc not required).

Adding some context behind the request to explain the interest here - I hope others will appreciate the passion here, and it will motiviate collaboration on a solution to help achieve the goal:

I'm interested to reverse engineer the PS3 DVD player in order to attempt to exploit a memory corruption vulnerability to allow arbitrary code to be executed from an inserted disc, seamlessly bypassing the unauthorised software security model. I recently accomplished this goal for some versions of the PS2 with my FreeDVDBoot project, and it has since been determined that the PS3 (and even 4) seems vulnerable to the exact same bug (which is a pretty trivial buffer overflow with controlled size up to 0x17FFE8 bytes and controlled contents), so I believe there's probably a strong chance that we can exploit the PS3 as well (obviously using different exploitation primitives like ROP first as PS3 has DEP/NX memory protection).

I'm aware that there already exist convenient personal use exploits for the latest PS3 firmware triggered through the web browser, however the goal I'm interested in is different from just a personal use exploit: Instead, this would allow developers to easily distribute their own homebrew games in physical media format, which would be 100% compatible with all unmodified PS3s (I assume it is a reasonable requirement to request users to update to the latest firmware, which most official games also did when released), ultimately making the PS3 a completely open platform, similar to what the Dreamcast scene achieved.

clienthax commented 4 years ago

This won't happen any time soon, it would require at a minimum VSH to be operational before we could even start looking at it.

If you are interested in poking the DVD code you can decrypt bdp_BDVD.self with rpcs3 and run it through ghidra with this https://github.com/clienthax/Ps3GhidraScripts