• Hey, guest user. Hope you're enjoying NeoGAF! Have you considered registering for an account? Come join us and add your take to the daily discourse.

[33c3] Console Hacking 2016

jmga

Member
Can you elaborate on this?

Just take a look at the talk.

- Completely lack of security at the low level, cannot be patched.
- HDD connected via USB instead of SATA.
- Useless components like a DisplayPort->HDMI controller instead of using HDMI.
- The microcode of GPU microcontrollers is completely broken.

And more things.
 

blu

Wants the largest console games publisher to avoid Nintendo's platforms.
Just take a look at the talk.

- Completely lack of security at the low level, cannot be patched.
- HDD connected via USB instead of SATA.
- Useless components like a DisplayPort->HDMI controller instead of using HDMI.
- The microcode of GPU microcontrollers is completely broken.

And more things.
1. Security is largely a sw provision.
2. That is shit indeed, and so is
3. This, since it complicates the arch and adds to the BOM for nil.
4. It's a microcode bug resulting in a particular behavior; if it was a completely broken ucode you'd get a completely non-functional GPU, which is not the case here.

So of all things just two are hw design snafus and the rest is good old sw design issues and bugs.

At the end of the day ps4 is a custom amd64 machine. And neither sony nor ms had much other choice but go with an AMD APU:

http://www.forbes.com/sites/patrickmoorhead/2013/06/26/the-real-reasons-microsoft-and-sony-chose-amd-for-consoles/#49c167bd9559 said:
My sources have confirmed for me that both Sony and Microsoft felt that MIPS didn’t have the right size developer ecosystem or the horsepower to power the new consoles. Then it came down to ARM versus X86 architecture. I am told there was a technical “bake-off”, where prototype silicon was tested against each other across a myriad of application-based and synthetic benchmarks. At the end of the bake-off, ARM was deemed as not having the right kind of horsepower and that its 64-bit architecture wasn’t ready soon enough. 64-bit was important as it maximized memory addressability, and the next gen console needed to run multiple apps, operating systems and hypervisors. ARM-based architectures will soon get as powerful as AMD’s Jaguar cores, but not when Sony or Microsoft needed them for their new consoles.

At this stage I might be sounding like a broken record on these boards, but timing is everything in the CE business - you get a product 6 months earlier or 6 months later to market and the product ends up with fundamentally different constraints than it would have otherwise.
 

test_account

XP-39C²
There was a hardware panel at the Chaos Communication Camp and the PS4 has some strange and exotic ways its build, but since nobody of the developers complaints labeling it as "pure shit" is pure shit.
Edit: I of cours emean the panel in this very thread. Thought this is the Steam Thread.
Yeah, i did watch parts of the video, but its much tech stuff and i dont grasp everything of it. So i was curious what the guy i quoted was referring to.


Just take a look at the talk.

- Completely lack of security at the low level, cannot be patched.
- HDD connected via USB instead of SATA.
- Useless components like a DisplayPort->HDMI controller instead of using HDMI.
- The microcode of GPU microcontrollers is completely broken.

And more things.
Thanks for the answer, but i was hoping you could elaborate more on how these things affect things for the PS4 overall, as in developing for it etc.. The HDD via USB sounds bad, but how does the rest of the stuff affect working with the PS4 for its intended purposes? I ask since you said that the architecture is "pure shit", making it sound like you mean that the PS4 is incredible bad/hard to work with, and that designing things differently would make it a much more powerful or efficient machine, in my opinion. Thats why i'm curious how these things affect developement and performance on the PS4. Can you elaborate more on that?

What are more things referring to?
 

Panajev2001a

GAF's Pleasant Genius
1. Security is largely a sw provision.
2. That is shit indeed, and so is
3. This, since it complicates the arch and adds to the BOM for nil.

I wonder what the reason for these two HW oddities are. Work around for HW or timing issues we do not know?
Were these two changes kept in the Pro revision and why would they if so? I would assume that considering how cost efficient Sony tried to be with this console and especially the redesigns that came out this year that they would not complicate the design for nothing.

I am very very curious about the DisplayPort to HDMI path. Maybe it has to do with HDR support?

4. It's a microcode bug resulting in a particular behavior; if it was a completely broken ucode you'd get a completely non-functional GPU, which is not the case here.

So of all things just two are hw design snafus and the rest is good old sw design issues and bugs.

At the end of the day ps4 is a custom amd64 machine. And neither sony nor ms had much other choice but go with an AMD APU:



At this stage I might be sounding like a broken record on these boards, but timing is everything in the CE business - you get a product 6 months earlier or 6 months later to market and the product ends up with fundamentally different constraints than it would have otherwise.

Timing was essential, AMD could have designed an SoC with the same GPU and an ARM chip, but it may have taken longer and evidently the design that AMD was sure they could deliver on time without too many unexpected issues would have not been powerful enough. Two huge corporations paying a large sum of money for semi custom designs explored all their options for sure.
Also, both consoles were going to give a huge grunt of work traditionally done on the CPU to the GPU as well, so adding to the usual launch timings risks by pushing the envelope on the CPU side of the equation did not make sense.
The rest of the system, especially the semi-custom GPU and its memory/bus architecture as well as the HW for all the background and social features they wanted to add without impacting game performance, is what presented most risk and investment.

Apple got to fast 64 bits ARM designs, 64 bit as your link states was a strong requirement, but they invested in CPU design teams (I am not going to be shocked when they move their MacBook nonPro line to their ARM chips in a not too distant future... Windows is working on renewed ARM support to have both WinRT API/UWP and x86 32 bit Windows/WIN32 apps running on ARM efficiently and maybe x86-64 will follow not too long after that... enough for Apple to keep their bootcamp option and allow people to install Windows too if they do wish) and made manufacturing deals long before Sony and MS were finalising their next generation plans.
I do not think either MS or Sony wanted to invest an extra $300-400 Million in additional R&D to go with their own desired custom ARM solution or divert their existing R&D budget away from the rest of the system.
 

Panajev2001a

GAF's Pleasant Genius
About potential piracy:
I've heard the same things back in the day. The PS3 was at one point 'totally hacked' etc. An online box like the PS4 or Xbox One can never fully be hacked or Sony and Microsoft didn't do their job right and having no hackers or pirates on their console is always one of the priorities of a new console.

But even ignoring that and focusing on the emulation. Why would someone use their console for emulation? You would make your PS4 outdated and most certainly banned forever, so you can play some older games even a 40 euro raspberry pi can play (if we're talking about the older Nintendo games) or a 20 euro Steam Link if you really want to play more recent games on your TV that aren't on a PS4/Xbox One.
As an IT-guy I find these things interesting, but I see it as nothing more than that. It's a stunt, running Steam on a PS4, it has no real-life value.

Emulation is really the worst possible use of these consoles and game consoles in the future too IMHO. Game consoles invest too much R&D budget in the GPU and graphics while for emulation you need a lot of CPU power and versatility to make the host system as compatible with the original emulated system as possible.

A decent not even high spec GPU and a fast CPU are going to serve you a lot better and in the not so distant features you will be able to buy FPGA based boxes that allow you to have HW optimised for each emulated platform profile. Hacking PS4 to do this is not really that useful to that end...
 

Ahasverus

Member
A decent not even high spec GPU and a fast CPU are going to serve you a lot better and in the not so distant features you will be able to buy FPGA based boxes that allow you to have HW optimised for each emulated platform profile. Hacking PS4 to do this is not really that useful to that end...
Xbox emulation was great though.
 

MUnited83

For you.
Yeah, i did watch parts of the video, but its much tech stuff and i dont grasp everything of it. So i was curious what the guy i quoted was referring to.



Thanks for the answer, but i was hoping you could elaborate more on how these things affect things for the PS4 overall, as in developing for it etc.. The HDD via USB sounds bad, but how does the rest of the stuff affect working with the PS4 for its intended purposes? I ask since you said that the architecture is "pure shit", making it sound like you mean that the PS4 is incredible bad/hard to work with, and that designing things differently would make it a much more powerful or efficient machine, in my opinion. Thats why i'm curious how these things affect developement and performance on the PS4. Can you elaborate more on that?

What are more things referring to?
HDD connected via USB means shitty loading, copying, installing speed.
Using Display port>HDMI means adding unecessary input lag.
 

horkrux

Member
As an IT-guy I find these things interesting, but I see it as nothing more than that. It's a stunt, running Steam on a PS4, it has no real-life value.

I mean you'd have a very small, neat-looking PC with reasonable performance. I think there is value in that.
 

blu

Wants the largest console games publisher to avoid Nintendo's platforms.
I wonder what the reason for these two HW oddities are. Work around for HW or timing issues we do not know?
Were these two changes kept in the Pro revision and why would they if so?
We might have to wait for marcan et al to get answers to that.

I would assume that considering how cost efficient Sony tried to be with this console and especially the redesigns that came out this year that they would not complicate the design for nothing.

I am very very curious about the DisplayPort to HDMI path. Maybe it has to do with HDR support?
Or they discovered a Liverpool HDMI bug too late in the production stage. Either way, what they did was a patch to a design issue.

Timing was essential, AMD could have designed an SoC with the same GPU and an ARM chip, but it may have taken longer and evidently the design that AMD was sure they could deliver on time without too many unexpected issues would have not been powerful enough. Two huge corporations paying a large sum of money for semi custom designs explored all their options for sure.
Also, both consoles were going to give a huge grunt of work traditionally done on the CPU to the GPU as well, so adding to the usual launch timings risks by pushing the envelope on the CPU side of the equation did not make sense.
The rest of the system, especially the semi-custom GPU and its memory/bus architecture as well as the HW for all the background and social features they wanted to add without impacting game performance, is what presented most risk and investment.

Apple got to fast 64 bits ARM designs, 64 bit as your link states was a strong requirement, but they invested in CPU design teams (I am not going to be shocked when they move their MacBook nonPro line to their ARM chips in a not too distant future... Windows is working on renewed ARM support to have both WinRT API/UWP and x86 32 bit Windows/WIN32 apps running on ARM efficiently and maybe x86-64 will follow not too long after that... enough for Apple to keep their bootcamp option and allow people to install Windows too if they do wish) and made manufacturing deals long before Sony and MS were finalising their next generation plans.
I do not think either MS or Sony wanted to invest an extra $300-400 Million in additional R&D to go with their own desired custom ARM solution or divert their existing R&D budget away from the rest of the system.
Well, it was clearly stated in the Forbes articles - ARMv8 was too early for them. I agree with everything you said.

HDD connected via USB means shitty loading, copying, installing speed.
Using Display port>HDMI means adding unecessary input lag.
It is a SATA2 (3Gbps) over USB3 bridge (5Gbps) - SATA3 (6Gbps) was introduced only in ps4 pro, so it's not like the ps4 non-pro loses BW from going over USB3.
 

Alo81

Low Poly Gynecologist
The guy said up to 2 seconds.

Specifically, 2 seconds on boot up between turning on and displaying an image on screen. Not a persistent 2 second delay.

We have no idea how he modded his system. For all we know he could've multilated its insides in a way that is completely infeasible for non-hackers to replicate

We have some idea if you watch the video. He commented that there is little (none?) encryption breaking, he knows they're not the only ones to have done it, and his description made it sound relatively doable. But they don't want to be the ones to break piracy open onto the scene because its too much drama.
 

test_account

XP-39C²
The guy said up to 2 seconds.
That has to be something very different. If it was 2 second delay, it means that what you press on the controller, thing would react 2 seconds later (in addition to what th HDMI does) on the screen. The HDMI port is also output, not input. I know what was ment though, just had to point that out.

EDIT: If its only 2 seconds extra on boot up as mentioned above, it wont have any real performance differences.
 

Ahasverus

Member
Specifically, 2 seconds on boot up between turning on and displaying an image on screen. Not a persistent 2 second delay.
Oh, I see, I'm sorry.
We have some idea if you watch the video. He commented that there is little (none?) encryption breaking, he knows they're not the only ones to have done it, and his description made it sound relatively doable. But they don't want to be the ones to break piracy open onto the scene because its too much drama.
I think he's the only one. If it was doable, it would already be in the wild. There's money to be made (People will pay those guys hundreds to mod their PS4's).
 

test_account

XP-39C²
I think he's the only one. If it was doable, it would already be in the wild. There's money to be made (People will pay those guys hundreds to mod their PS4's).
There are several of people who have access to the exploit(s). Homebrew running on PS4 was recently demonstrated in China at a convention for example:

http://wololo.net/2016/10/24/ps4-4-01-jailbreak-showcased-chinese-hackers-geekpwn-convention

That said, it seems unclear if anyone has been able to break the encryption or finding the public decryption keys.
 

Ahasverus

Member
There are several of people who have access to the exploit(s). Homebrew running on PS4 was recently demonstrated in China at a convention for example:

http://wololo.net/2016/10/24/ps4-4-01-jailbreak-showcased-chinese-hackers-geekpwn-convention

That said, it seems unclear if anyone has been able to break the encryption or finding the public decryption keys.
Oh yeah, but he was talking about total system control, being able to run games and all, I don't think that part has been widespread yet. remember how it took mere weeks for the 3DS method to become "mainstream".
 

test_account

XP-39C²
Oh yeah, but he was talking about total system control, being able to run games and all, I don't think that part has been widespread yet. remember how it took mere weeks for the 3DS method to become "mainstream".
Ah ok. Yeah, in that case, i guess its not really that easy, or a very limited number of people have access to it, but dont want to release anything.
 

c0de

Member
Good guy marcan showing his skills again. The ps4 really seems like a weird system in terms of architecture.
 

test_account

XP-39C²
Good guy marcan showing his skills again. The ps4 really seems like a weird system in terms of architecture.
I wish he would talk a bit more regarding why he thinks those design choices were made, other than just "its Sony", which doesnt really say anything about the choices being done. Maybe he doesnt know though, but if he does, it would be interesting to read. Definitelly a skilled guy regardless though.
 

c0de

Member
I wish he would talk a bit more regarding why he thinks those design choices were made, other than just "its Sony", which doesnt really say anything about the choices being done. Maybe he doesnt know though, but if he does, it would be interesting to read. Definitelly a skilled guy regardless though.

Well, for the arm soc we know, though, and he explained. Why there is USB to sata though or the hdmi-dp-hdmi path I think there won't be an explanation from him, the designers have to answer this as it really doesn't make any sense.
 

PGamer

fucking juniors
jeff_rigby got a shoutout!

Possibly, but I'm not entirely sure. HDMI is complicated, but that Panasonic encoder they used is a mystery. It doesn't do HDCP 2.0 - so no 4K media content. There is no HDCP between the GPU and the encoder, so you can sniff unencrypted video off the DP port all you want. It's even conceivable that you could just replace the encoder outright with a microcontroller emulating the (not that complex) I2C interface, hook up a DisplayPort monitor straight to the GPU, and get output.

It's possible that the APU does HDR over DP but not HDMI, which might explain why they needed the encoder to do HDR over HDMI, but that make you wonder if they were really planning on that all along, and if they'd really spend the money to go for this more convoluted setup just for the sake of HDR.

There is a lot of wild speculation going around, e.g. this post goes off the rails about encryption and TrustZone in the southbridge, none of which makes any sense, as the southbridge ARM core isn't even running during normal PS4 operation, and the DisplayPort data goes straight from the APU to the HDMI encoder. The HDMI chip is not programmable, and "passing through" HDCP doesn't make any sense, because you can't really format-convert HDCP encrypted content, and that would defeat the entire purpose of having an external encoder chip in the first place. The PS4 only supports HDCP 1.0 and it's implemented in hardware on the Panasonic chip.
 
Shesh, he talks so fast it makes things hard to follow, had to pause quite a bit to scrutinize pseudo-code. All the same, crazy skills on display to pull all of this off.
 

Bollocks

Member
Interesting talk except for his smug talk.
He shows off a hobbyist poc with rough edges while simultaneously talking smack about sony engineers who delivered a finished consumer product under a time constraint lol.
 

la_briola

Member
Interesting talk except for his smug talk.
He shows off a hobbyist poc with rough edges while simultaneously talking smack about sony engineers who delivered a finished consumer product under a time constraint lol.

With zero documentation vs full documentation (and they designed it). Nice try.
 

test_account

XP-39C²
Well, for the arm soc we know, though, and he explained. Why there is USB to sata though or the hdmi-dp-hdmi path I think there won't be an explanation from him, the designers have to answer this as it really doesn't make any sense.
I see.


With zero documentation vs full documentation (and they designed it). Nice try.
Those are two different things though. The VS makes it sounds like both parties were going for the same goal while one party had zero documentation while the others had full documentation. Those who designed the PS4 also designed the documentation.

I guess his point is that while some of those design choices doesnt make sense to him (Marcan), theres probably some reasoning behind it. That doesnt mean that there are the best design choices however, but i'm sure theres some reasons for doing these design choices.
 

la_briola

Member
I see.



Those are two different things though. The VS makes it sounds like both parties were going for the same goal while one party had zero documentation while the others had full documentation. Those who designed the PS4 also designed the documentation.

I guess his point is that while some of those design choices doesnt make sense to him (Marcan), theres probably some reasoning behind it. That doesnt mean that there are the best design choices however, but i'm sure theres some reasons for doing these design choices.
My point was: reverse engineering something with basically no documentation is very hard. Sony had AMD (designer of the SoC) and full documentations to design and built the PS4. They could do whatever they want and did some rather strange decisions.
Marcan's remark are valid.
 

test_account

XP-39C²
My point was: reverse engineering something with basically no documentation is very hard. Sony had AMD (designer of the SoC) and full documentations to design and built the PS4. They could do whatever they want and did some rather strange decisions.
Marcan's remark are valid.
Sure, but so is designing a system like this, thats also very hard. You still need to get the different components working together even if you have documentation for each component. Its a custom built machine, so they had to build the manual themself. Just like with reverse engineering. Theres documentation on X86, PCI, FreeBSD etc. out there, but you still need to know how to make it work when reverse engineering the PS4 (or whatever it might be). But the two things are quite different, so its hard to compare them to each other like that.

But sure, his comments are indeed valid on this, but the question still remains why Sony chose to do such things. There doesnt seem to be any answers to that. As mentioned, maybe these design choices could be done differently, but that doesnt mean that there arent any valid reasons behind the current choices even if we cant figure out what they are. So do Sony deserve smack talk for those design choices? Well, who knows =)
 

c0de

Member
But sure, his comments are indeed valid on this, but the question still remains why Sony chose to do such things. There doesnt seem to be any answers to that. As mentioned, maybe these design choices could be done differently, but that doesnt mean that there arent any valid reasons behind the current choices even if we cant figure out what they are. So do Sony deserve smack talk for those design choices? Well, who knows =)

I think they had certain pillars on tech that they wanted to achieve. First, they wanted a secure system and a secondary helper chip. The marvell stuff seems to be what was a good fit from a hardware point of view and connecting everything is mainly a hardware challenge.
Making it work for freebsd was potentially also a big problem like it was for marcan, just not to the same extend. They also had to adjust freebsd to make it work with a system that doesn't have a lot of "legacy" and that is where it comes in handy that they used bsd and not linux (sadly, not for the community, though, but of course they don't care).
So I guess this was more of a necessity of the given circumstances made by the hardware team that the software team had to solve.
We already saw that when the PS4 launched and a lot of promised things didn't work, like suspend. And IIRC some features still don't really work like intended with the arm chip.
 
Top Bottom