Last weekend we saw
GTA V Simple Mod Menu v1.0 for PS4 1.76 from PlayStation 4 developer
@2much4u, and today he returns via
Twitter with a PS4 GTA V Native Caller for use with
CTurt's PS4 *** and perhaps
Hitodama's PS4SDK with more details below.
Download:
PS4-GTA-V-Native-Caller-master.zip /
GIT /
iw6_ds.rar (Ghosts Server .exe + .pdb - 11.16 MB) /
iw_ps4_image.zip (Full Server Dump - 403.2 MB)
To quote from the
README.md:
PS4 GTA V Native Caller
A simple example of calling natives for GTA V using
CTurt's PS4 ***.
Brief Explanation
Setting Up Execution
The payload first escalates privileges using the
dlclose kernel exploit. The kernel payload also disables ASLR for newly created processes, making it much easier to modify them. Afterwards, the browser payload constantly checks the running processes waiting for one called eboot.bin. Once a game process is found, the syscall ptrace is used to read and write to it. With ASLR disabled, the EBOOT always starts at 0x400000 in memory.
The payload reads a few bytes from the EBOOT to verify that the game is GTA V and to detect the region. The payload makes 3 edits to the EBOOT. Luckily, the EBOOT's main executable memory page has about 0xE000 free bytes at its end. Two functions are copied into that free space: a standard main function, nativeHook, and another for calling natives by hash, invokeNative. The last edit hooks the IS_PLAYER_ONLINE native to call the recently copied main function. After this, the browser payload exits.
Executing Inside GTA V
Once executing within GTA V, a structure called gtaVars is declared in some more free memory to keep track of global variables as well as a native argument structure. In order to...