Interested in investing time and money into PSXHAX.COM? Read More and Contact Us for details!
Live in Your World, HAX in Ours!
PS4 3.11 Out of Bound Read (Freetype 64bit Exploit) via Dragood2
Despite Sony releasing PS4 Firmware 3.15 last night, dragood2 recently uncovered a PS4 3.11 Out of Bound Read (Freetype 64bit Exploit) that reportedly isn't patched in System Software Update 3.15.

Download: 38662.zip (Proof of Concept) / Source Code

Below are the details, although the usefulness of this has yet to be determined by PS4 developers, to quote:

The following heap-based out-of-bounds memory read has been encountered in FreeType. It has been reproduced with the current version of freetype2 from master git branch, with a 64-bit build of the ftbench utility compiled with AddressSanitizer:
Code:
$ ftbench <file>
Attached are three POC files which trigger the conditions.
Code:
---
$ freetype2-demos/bin/ftbench asan_heap-oob_783b6f_6837_eb01136f859a0091cb61f7beccd7059b

ftbench results for font `asan_heap-oob_783b6f_6837_eb01136f859a0091cb61f7beccd7059b'
-------------------------------------------------------------------------------------

family: (null)
style: (null)

number of seconds for each test: 2.000000

starting glyph index: 0
face size: 10ppem
font preloading into memory: no

load flags: 0x0
render mode: 0

CFF engine set to Adobe
TrueType engine set to version 35
maximum cache size: 1024KiByte

executing tests:
Load =================================================================
==22366==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000eb55 at pc 0x00000069e2fc bp 0x7fffc4670610 sp 0x7fffc4670608
READ of size 1 at 0x60200000eb55 thread T0
#0 0x69e2fb in tt_sbit_decoder_load_bit_aligned freetype2/src/sfnt/ttsbit.c:834:19
#1 0x69d214 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1145:15
#2 0x69b1bf in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1340:12
#3 0x69eee2 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:932:15
#4 0x69d214 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1145:15
#5 0x69b1bf in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1340:12
#6 0x6893d2 in tt_face_load_sbit_image freetype2/src/sfnt/ttsbit.c:1506:19
#7 0x55d265 in load_sbit_image...
PS4 3.15 Firmware Update is Released, Improves System Performance
Sony just released PS4 Firmware 3.15 update tonight, which according to their Tweet below is a minor PlayStation 4 update simply designed to improve system performance.

In other words, it likely patches some of the recently discovered holes :p

Download: PS4 Firmware 3.15 Update (US) / PS4 Firmware 3.15 Update (EU) / PS4 Firmware 3.15 Update (UK) / PS4 Firmware 3.15 Update (AU/NZ) / PS4 Firmware 3.15 Update (JP)

Main features in system software update 3.15
  • This system software update improves the quality of the system performance.
If anyone examines it feel free to report your findings in the comments!
Code:
r64907/release_branches/release_03.150 Dec 18 2015 05:33:07
PS4 Auxiliary Ports for PlayStation 4 Camera Revealed by BigBoss
Following his PS4 Camera PC Driver and PS4 Dual Eye Camera work, PlayStation 4 developer bigboss revealed the PS4 Auxiliary Ports for the PlayStation 4 Camera today.

Check out the pic via embedded Tweet below! :)


For those interested, their work-in-progress Github link is located here: psxdev

PS4 AUX Port to USB 3.0 PlayStation Camera Adapter (Unofficial PSVR Dev Kit)
PS4 Camera Windows Drivers Installation Tutorial
Does the unofficial PS4 Camera adapter will work on PS5?
PlayStation 5 Camera on PC

Download: PS5_camera_files-main.zip / GIT
Hackinside Live Stream Using PS4 Camera V2

PS4 Camera AUX to USB3 Adapters.jpg
PS4Link Loader with PS4SH ELF Loader Session Updates by Hitodama
Following the recent PS4Dev GIT updates, today bigboss has integrated the PS4Link Loader with PS4SH ELF Loader Session updates by hitodama with details below.

Download: 03310c293952786c6aba7c1345308cce2d4d58c4.zip / GIT / PSX Dev GIT

ps4loadingelfsession.txt
Code:
First load custom ps4link in ps4 with webkit exploit
We see log initialization on mac/pc to see if there is a problem with bind.
$ debug.sh
[PS4][INFO]: debugnet initialized
[PS4][INFO]: Copyright (C) 2010,2016 Antonio Jose Ramos Marquez aka bigboss @psxdev
[PS4][INFO]: ready to have a lot of fun...
[PS4][DEBUG]: [PS4LINK] Server request thread UID: 0x80678B40
[PS4][DEBUG]: [PS4LINK] Created ps4link_requests_sock: 84
[PS4][DEBUG]: [PS4LINK] bind to ps4link_requests_sock done
[PS4][DEBUG]: [PS4LINK] Ready for connection 1
[PS4][DEBUG]: [PS4LINK] Waiting for connection
[PS4][DEBUG]: [PS4LINK] Server command thread UID: 0x806970E0
[PS4][DEBUG]: [PS4LINK] Command Thread Started.
[PS4][DEBUG]: [PS4LINK] Created ps4link_commands_sock: 86
[PS4][DEBUG]: [PS4LINK] Command listener waiting for commands...
^C
Now we open ps4sh session
$ ps4sh
ps4sh version 1.0
/Users/bigboss/.ps4shrc: No such file or directory
Connecting to fio ps4link ip 192.168.1.17
log: [HOST][INFO]: [PS4SH] Ready
log: [PS4][DEBUG]: [PS4LINK] Client connected from 192.168.1.3 port: 25797
log: [PS4][DEBUG]: [PS4LINK] sock ps4link_fileio set 85 connected 1
log: [PS4][DEBUG]: [PS4LINK] Initialized and connected from pc/mac ready to receive commands
log: [PS4][DEBUG]: [PS4LINK] Waiting for connection
ps4sh> help
?           ? :: Synonym for `help'..
cd          cd [dir] :: Change pksh directory to [dir]..
debug       debug :: Show pksh debug messages. ( alt-d ).
exit        exit :: Exits pksh ( alt-q ).
help        help :: Display this text..
list        list [dir] :: List files in [dir]..
log         log [file] :: Log messages from PS4 to [file]..
ls          ls [dir] :: Synonym for list.
make        make [argn] ... :: Execute make [argn] ....
gmake       gmake [argn] ...
PS4 Dev Hitodama Updates PS4Dev GIT with New Tools and ELF Loader
PlayStation 4 developer hitodama has updated the PS4Dev GIT today with some new tools including an ELF Loader and more according to Sony PlayStation hacker BigBoss (PSX DEV).

Download: elfldr / elf-loader / elf-loader ([plain]PSXDev[/plain]) / libps4 / libps4-generator / libps4-symbols / libps4-examples / libps4-boilerplate / libps4-sce-include / libps4-std-include / PS4Dev GIT

PS4Dev File Purpose
elfldr Runs 64-bit Elf files in-process on Linux, FreeBSD and the PS4
libps4 Libc, POSIX and SCE module library for the PS4
libps4-generator Generates libps4 through std (C and Posix) and SCE module headers
libps4-symbols Most recent PS4 symbols by firmware for analysis and convenience
libps4-examples Examples and prove of concepts which show something realized with libps4 (not necessarily unique to the PS4 - in fact prove of POSIX parts or failures are quite welcome)
libps4-boilerplate Imported by libps4-generator to generate libps4
libps4-sce-include Reverse engineered community maintained SCE headers. Imported by libps4-generator to generate libps4
libps4-std-include Read-only freebsd libc and POSIX headers. Imported by libps4-generator to generate libps4
Some recent Tweets from Twitter:

To quote zecoxao from the Tweets...
Back
Top