PSXHAX.COM website and domain for sale. Contact Us with your offer!
Locating a Jailbreakable PS4 5.05 / 5.07 Firmware Console in 2019
Earlier this month we covered Sony's official PlayStation 5 Announcement on the PS5 Forums, and as the PlayStation 4 scene awaits Future PS4 Jailbreak Exploits those with a PS4 5.05 / 5.07 Jailbreakable Console can currently play hundreds of PS4 FPKG games... if you can locate a jailbreakable PS4 5.05 / 5.07 Firmware or below console! 
Following the previous guide, below are some recent eBay links to PlayStation 4 version 5.05 / 5.07 consoles available for sale to help those locating a PS4 for exploiting and jailbreaking to run game backups and homebrew / unsigned code.
Once you have a jailbroken PS4 console, be sure to become a Verified Member by getting a Blue Verified Badge (FAQ in the spoiler HERE) through our PSXHAX Floating Discord Channel to access private or restricted areas. 
Here are some PS4 Consoles on 5.05 / 5.07 System Software currently for sale on eBay ranging from $183 through $580 USD:
Following the previous guide, below are some recent eBay links to PlayStation 4 version 5.05 / 5.07 consoles available for sale to help those locating a PS4 for exploiting and jailbreaking to run game backups and homebrew / unsigned code.
Once you have a jailbroken PS4 console, be sure to become a Verified Member by getting a Blue Verified Badge (FAQ in the spoiler HERE) through our PSXHAX Floating Discord Channel to access private or restricted areas. Here are some PS4 Consoles on 5.05 / 5.07 System Software currently for sale on eBay ranging from $183 through $580 USD:
PlayStation Scene Devs on Future PS4 Jailbreak Exploits and Homebrew
During Sony's PlayStation 5 news announcement of a PS5 launch in Q4 2020 yesterday a few PlayStation scene devs shared feedback on future PS4 jailbreak exploits and homebrew with the release of the PlayStation 4 v7.00 Firmware Update leaving many curious since the exploit chain limitations and lack of interest by PS4 scene developers previously noted. 
Below are some related Tweets from @Abkarino of Team Rebug via Twitter and diwidog (aka kiwidog or kiwidoggie) on Twitter who recently hinted at some qwertyoruiopz-level (PS4 5.50 WebKit / Userland Exploit Rewrite, PS4 4.55 BPF Race Condition Kernel Exploit Writeup, PS4 GTA V Mods Demo, Hacking the PS4: From Zero to Ring Zero in Two Easy Steps PDF) memes coming soon!
According to the Tweets, a new public PS4 kernel exploit or SAMU public hack alongside a full open source toolchain and finished Mira and mm (not multiMAN) may not surface until the PS5's release late next year or...
Below are some related Tweets from @Abkarino of Team Rebug via Twitter and diwidog (aka kiwidog or kiwidoggie) on Twitter who recently hinted at some qwertyoruiopz-level (PS4 5.50 WebKit / Userland Exploit Rewrite, PS4 4.55 BPF Race Condition Kernel Exploit Writeup, PS4 GTA V Mods Demo, Hacking the PS4: From Zero to Ring Zero in Two Easy Steps PDF) memes coming soon!
According to the Tweets, a new public PS4 kernel exploit or SAMU public hack alongside a full open source toolchain and finished Mira and mm (not multiMAN) may not surface until the PS5's release late next year or...
PS4 Exploit Host Menu Leeful Host v2 WIP Design Update and Demo
Following the PS4 X-Project Updates, Pure HEN Child Friendly Loader and X-Project GTA V Lotus Menu 1.03 Patch PlayStation 4 homebrew developer @Leeful recently shared on Twitter a work-in-progress (WIP) demo video of his PS4 Exploit Host Menu Leeful Host v2 design update featuring a fresh and clean-looking menu! 
To quote from his Tweets embedded below: "Here is a sneak peak of my new Exploit Host Menu design. It's still early days but I've tried to get it to look as close to the original PS4 home menu as possible. Sorry for the video quality. I've now got exploits loading in the new menu.
"
Meanwhile, @DEFAULTDNB also hinted on Twitter that he is also working on a super lightweight PS4 5.05 exploit host concept, noting the following to quote:
"It's no where near ready for release, but it's turning out quite nicely. I have lots of ideas for it, but it may never see the light of day. It's a fun exercise in JS and a POC of an idea I originally had for X-Project."
To quote from his Tweets embedded below: "Here is a sneak peak of my new Exploit Host Menu design. It's still early days but I've tried to get it to look as close to the original PS4 home menu as possible. Sorry for the video quality. I've now got exploits loading in the new menu.
"Meanwhile, @DEFAULTDNB also hinted on Twitter that he is also working on a super lightweight PS4 5.05 exploit host concept, noting the following to quote:
"It's no where near ready for release, but it's turning out quite nicely. I have lots of ideas for it, but it may never see the light of day. It's a fun exercise in JS and a POC of an idea I originally had for X-Project."
PS4 Kernel Bug Details by TheFloW, Fixed Between 5.05-6.20 OFW
Awhile back popular PS Vita scene developer TheFloW hinted that he'll be looking at the PS4 kernel in his H-ENcore Write-up, and today he shared on Twitter some details on a PS4 Kernel Bug discovered stating it is fxed somewhere between 5.05 and 6.20 OFW... with the PS4 Kernel Exploit 5.05 / 5.07 being the last public jailbreak currently available. 
PS4 kernel bug: sys_randomized_path could leak arbitrary amount of kernel stack:
Unfortunately fixed somewhere between 5.05 and 6.20.
Update: TheFloW said his bug is not exploitable:
Nvm this bug is not exploitable, as copyout will simply abort if it dst+len wraps around or is higher than 0x8000000000000000. However, Sony did actually fix it by adding a max_len > 0 check, so I thought it could be abused.
From Pastebin.com:
PS4 kernel bug: sys_randomized_path could leak arbitrary amount of kernel stack:
Code:
char k_path[0x100];
int64_t max_len = fuword64(max_len_ptr);
if (path_len <= max_len) {
copyout(k_path, out_path, path_len);
} else {
copyout(k_path, out_path, max_len - 1);
}Nvm this bug is not exploitable, as copyout will simply abort if it dst+len wraps around or is higher than 0x8000000000000000. However, Sony did actually fix it by adding a max_len > 0 check, so I thought it could be abused.
From Pastebin.com:
Code:
// <6.00 bug (not exploitable) found by TheFloW, JS adaptation by CelesteBlue only useful for when we find an actual vulnerable syscall
var try_sys_randomized_path_leak = function() {
var mem = p.malloc(0x1000000); // allocate buffer
alert(p.hexdump(mem, 0x500)); // display zeroed buffer
var len_pointer = p.malloc(0x08); // allocate length
p.write8(len_pointer, new int64(0, 2147483648)); // write length: 0x8000000000000000
alert(p.hexdump(len_pointer, 8)); // display length
alert(p.syscall("sys_randomized_path", 0, mem, len_pointer)); // trigger bug
alert(p.hexdump(mem, 0x500)); // display buffer, should have been modified if success
};
PS4 Jailbreak (Syscall 112) Installer Payload via Zecoxao
Today PlayStation 4 developer @zecoxao made available via Twitter a PS4 Jailbreak (Syscall 112) Installer Payload which he explains, "installs syscall 112 to your system so any of the apps that need root permissions can just call this syscall and get root."
It includes support for 4.74, 5.01 and 5.05 PS4 Firmware with 3.50, 3.55, 4.05 and 4.55 currently missing due to lack of SYSENTS offset according to him.
Download: ps4_jailbreak_installer.bin / ps4_jailbreak_installer.map / GIT
From his Tweets below, to quote: "It is mostly based code off of other great devs such as ChendoChap, Sistr0, CelesteBlue123 SocraticBliss to name a few. but the gist is that it's a minimal launcher for the installation of a jailbreak syscall. I did not want a lot of code just to do a simple thing I needed."
Looking for testers in versions below 5.05 (namely 5.01, 5.00, 4.74, 4.55 and 4.05) Launch any hen for those versions, launch ps4_jailbreak_installer.bin and then install this (below) ... and check if you have root access to the folders in mgba emu
Download: MULTIFWMGBA.pkg (6.9 MB - MD5: 52f0d6297adb32c198795819ef6070f3)
It includes support for 4.74, 5.01 and 5.05 PS4 Firmware with 3.50, 3.55, 4.05 and 4.55 currently missing due to lack of SYSENTS offset according to him.
Download: ps4_jailbreak_installer.bin / ps4_jailbreak_installer.map / GIT
From his Tweets below, to quote: "It is mostly based code off of other great devs such as ChendoChap, Sistr0, CelesteBlue123 SocraticBliss to name a few. but the gist is that it's a minimal launcher for the installation of a jailbreak syscall. I did not want a lot of code just to do a simple thing I needed."
Looking for testers in versions below 5.05 (namely 5.01, 5.00, 4.74, 4.55 and 4.05) Launch any hen for those versions, launch ps4_jailbreak_installer.bin and then install this (below) ... and check if you have root access to the folders in mgba emu
Download: MULTIFWMGBA.pkg (6.9 MB - MD5: 52f0d6297adb32c198795819ef6070f3)