Following his
JailbreakMe PS4 3.5x/3.70/4.0x ports of the original
JailbreakMe PS4 4.0x exploit, today with the help of
qwertyoruiopz PlayStation 4 developer
SpecterDev broke down the PS4 4.0x WebKit Userland Exploit documenting it under
Exploit Writeups for other scene developers to examine and learn from.
Great stuff
@SpecterDev and here is the break down from the
Update 4.0x WebKit Exploit Writeup.md, to quote:
Breaking down qwertyoruiopz's 4.0x userland exploit
Edit: qwertyoruiopz tweeted at me helping me understand the bug better and I've corrected it.
Not too long ago qwertyoruiopz released a functional (and surprisingly stable)
exploit for 4.0x firmwares. No - it's not the same as the Pegasus exploit which could have been used in ChaitinTech's jailbreak chain, but it uses some similar concepts. Unfortunately, the exploit is patched on 4.50 <= because after 4.07, Sony upgraded to a much newer WebKit version, which patched many potential (and possibly private) exploits, including this one.
Immediately after it was released I started studying the exploit and tried to figure out how it worked at all stages, including post-exploitation. Below I'll share what I found about how it works. I don't expect to be 100% right because I'm still pretty noob to exploitation and I know very little about the internals of webkit, but I'll give it my best shot. If you'd like to follow along/see where I got this process, you can find my
exploit edit on GitHub where I heavily commented as I went through the exploit breaking it down. I'm going to skip past some things such as the int64 object and stuff as that's not relevant to the actual exploit, but is used by it for doing address operations.
Firstly, the exploit ensures the system is vulnerable before attempting to continue with exploitation. It quickly tests the bug before...