PSXHAX

Following the PS4 JailBreak ROP Tool release yesterday and many PS4 WebKit Crash videos, today PlayStation 4 developer @SilicaAndPina ran across another which she linked on her HENkaku4.tk page as a proof-of-concept with a demo below!

Not to be confused with the PlayStation 4 3.55 code execution PS4 HENkaku Exploit, to give the PS4 Web Browser Crash a try, simply:

• Navigate to HENkaku4.tk on your PS4 (similar PS4 browser test page located at PS4-Expo.NeoCities.org and also PS4Playground.tk)
• Click on the 'Crash The Browser (Ps4)' link (or run PSNS: from the PS4 browser)
• Profit and post your results below if you're feeling froggy

There are also some DEX (Debug) PlayStation Store launchers on the HENkaku4.tk page too for those with a Developer PS Vita or PS4 console.

Below are some related Tweets from SilicaAndPina, and also check out her Silica YouTube Channel for a lot of other kewl demonstration videos.

PS: If you haven't done so already, check out the SPOILER near the bottom of THIS article for a plethora of useful PlayStation file download links from her as well!

Thanks to @PS4HELPER123 for the news in the PSXHAX Shoutbox!

Following recent research from PlayStation 4 developers into the 4.01 PS4 Jailbreak by Chaitin Tech, today the Chinese PS4 Jailbreaking Team have released an ROP (Return Oriented Programming) tool on their Pro GIT to aid developers in exploiting the PlayStation 4.

Download: pro-master.zip / GIT

PSXHAX Moderator @Centrino points out the GIT work is incomplete, referencing line 41 meaning it only contains partial information and nothing can be done with it by end-users just yet.

In other words, although Chaitin Tech are not teasing, they also are not spoon feeding (giving away their full exploit).

Here is a snippet from #ps4dev on iRC via @Fimo for those interested:

[rck`d] the nonsecure browser has no jit, only the secure browser now (used for PSN store, etc) has JIT
[rck`d] Since some version, the internal browser is compiled WITHOUT jit support, and sys_jitshm_xxx seems to be disabled for unprivileged process

Everyone can draw their own conclusions, but thus far it wouldn't surprise me if the Chinese Team is just a 'smoke and mirrors' scheme as dongle douchbags start re-DRMing the exploit to profit off PS4 sceners... then when people whine they'll direct them to this GIT of incomplete code as a 'free' alternative to their useless 'product' but hopefully I'm mistaken.

Anyhow, to quote from the README.md: PRO: PROgramming ROP like a PRO

This is a crappy tool used in our private PS4 jailbreak. Since some version, the internal browser is compiled WITHOUT jit support, and sys_jitshm_xxx seems to be disabled for unprivileged process. We have to write the kernel exploitation in ROP, like what has been done in HENKaku jailbreak.

Build

If the PlayStation 4's DualShock 4 (DS4) seems a little too vanilla for your style, check out these new Sony officially licensed third-party professional PS4 controllers coming this holiday season- the Razer Raiju and Nacon Revolution!

Here's a summary of each PS4 pro controller straight from Andrew Mason:

Razer Raiju

The Razer team’s extensive knowledge in developing eSports peripherals made them an ideal partner to create a tournament-grade controller for PS4.

Designed for conquering professional eSports tournaments, the Razer Raiju is equipped with advanced controller customisation and ergonomics. Its features include:

• Two extra bumpers and two extra detachable triggers
• Built-in control panel on the front of the controller
• Trigger-stop switches and hair trigger mode for ultra-fast trigger responses
• Two custom profiles which you can instantly switch between and modify
• 3.5mm headset jack and dedicated headset volume and mic mute controls
• Detachable analog stick rubber caps which provide extra grip during intense gaming sessions
• Compatibility with all PS4 systems via the braided 3m-long USB cable – detachable for easy storage

Nacon Revolution

Developed with the eSport player in mind, the Nacon team of industrial designers and engineers collaborated with pro-gamers to develop the Revolution Pro Controller to meet a wide range of their gameplay needs.

Thanks to this collaboration, the Revolution Pro Controller features include:

• 46° amplitude dual analogue sticks, enhanced with innovative firmware for advanced eSports accuracy and reach
• Four extra shortcut buttons
• Eight-way directional pad
• Four custom profiles – all configurable via the companion PC application, enabling players to: re-map buttons, assign macros to the four shortcut controls and adjust analog and trigger sensitivity
• Two internal compartments with six additional weights – for a tailored balance and feel
• Compatibility with all PS4 systems via the 3m-long secure connection USB cable – detachable for easy storage

Yesterday he shared a nice archive of PS3 and PS4 Dev Unit PUP files, and today @MrNiato returns with a video demonstrating the Debug menu setting differences between a PlayStation 4 TestKit DUH-T1000AA DEX 3.50 Firmware and a PlayStation 3 UltraSlim DECH-4000AA 4.78 DEX OFW console.

Check out MrNiato's Blog for more, and the video is below along with some related Tweets via Twitter:

PS: At 1pm tomorrow (later today) he's planning to release something PS4 developers may find useful... so stay tuned!

Update: It was cancelled, see the Tweet on his Testkit 1.76 Dump below:
To quote from MrNiato's Blog: "Today at 1PM I posted a full dump of my TestKit on 1.76 Non Retail Firmware, unfortunately I've decided to delete this dump to avoid any problem with Sony. Maybe Am I wrong and I risk nothing but we don't know what Sony can do....

Thanks for reading."

Yesterday we reported on research being done by PlayStation 4 developers and enthusiasts to uncover the Chaitin Tech PS4 4.01 Kernel Exploit, and today @SpecterDev shared another Tweet which sheds more light on the suspected CVE-2016-1885 (Exploit-DB) vulnerability.

Below is a brief excerpt, and be sure to check it out in it's entirety on his Latest PS4 Dev Blog entry!

To quote: "My ultimate goal of the lower half of this article is to show a little snippet of the complexity of such an exploit to be developed, so whenever something is found, don't expect an exploit to be released right away.

If and when such a POC is released, be thankful and respectful to the developer, after all many in this scene are doing this work for free."

From Pastebin.com also comes a log from #ps4dev on iRC via @B7U3 C50SS, as follows: