PS4 Jailbreaking

Since the previous exploit documentation release and ongoing PS4 WebKit / Jailbreak updates, today PlayStation 4 developer @CelesteBlue has made available PS4Brew 4.74 via Twitter which is a PS4 Kernel Exploit and live demo for those stuck on PS4 4.74 Firmware who are unable to update their consoles due to a broken Blu-ray drive.

PS4 4.74 Kexploit and Payloads: Live Demo / Mirror by zecoxao / Mirror by @pearlxcore / Mirror by @EdiTzZ / Github / ps4-dumper-vtx.rar (347.96 KB) / ps4-ftp-vtx.rar (361.50 KB) / browser_from_rpsplus.rar (70.74 KB) / ps4-ftp-vtx.bin (17.0 KB) / browser.bin (2.2 KB) / ps4-ftp-vtx.bin (17.12 KB - with update blocker) / fake_installer.bin (19.38 KB - 4.74 HEN) / ps4-fake-474.rar (58.65 KB - Latest Source) / EP9000-CUSA07410_00-474nobd-GODOFWAR-A0101-V0100.pkg (50.88 MB) / ps4-fake-474.7z (34.30 KB - added external FPKG support to HEN 4.74 test fake_installer.bin inside fake_installer folder) / PS4HEN 4.74 GIT (Homebrew ENabler for 4.74 PS4 Consoles without Blu-ray) / PS4-Linux-Loader.7z...

Following Parts 1 through 3 of their PS4 Aux Hax covering hacking Aeolia, Syscon and DS4 today PlayStation 4 hackers fail0verflow shared documentation on PS4 Aux Hax 4 which uses HDMI (High-Definition Multimedia Interface) CEC (Consumer Electronics Control) to get code exec on all PS4 Belize southbridge versions (including PS4 Pro, etc) without requiring other parts of the system to be pwned!

According to Wikipedia, CEC is a feature of HDMI designed to allow users to command and control devices connected through HDMI by using only one remote control... and the bug is in the HDMI CEC code with the path reachable when HDMI-CEC is enabled and active.

Be sure to check out the full PS4 Aux Hax 4: Belize via CEC documentation on their latest Blog Entry alongside the PS4 Southbridge Reverse-Engineered Code Examination, and to quote in part:

"So, the overall process is like:

1. Tap onto CEC-related i2c and irq lines and HDMI encoder power switch
2. Power up PS4 and enter Rest Mode
3. Wait for “EAP running” message from custom EAP kernel
4. Induce the CEC RX interrupt
5. Feed data to EMC such that it causes a stack buffer overflow
6. Wait for EMC to copy SRAM to DDR3
7. Dump copied SRAM out of UART

Of course, this is really EMC code exec, so the dumping is just something to do after the fact

This post outlines a way to dump EMC firmware and gain EMC code exec on any hardware revision. While the real root keys (in fuses and ROM) of EMC versions besides the first are still unknown, they could yet be recovered with side channel attacks, if someone really wanted them. Since this method is comparatively much more simple and more generic, it stands on its own as an interesting exploit.

As was...

Following the PS4 Syscon Decapping, PS4 Aux Hax research and his recent PS4 HEN version 1.8 Live Demo (GIT - added to PS4 Exploit Host v0.4.6 Alpha1), today PlayStation 4 developer @zecoxao shared via Twitter his latest Github commit dubbed Siscon which is a PS4 Syscon System Controller firmware decrypter allowing further comparison and examination by scene devs.

Download: siscon-master.zip / GIT / PS4 Syscon Research & Development Repository

As mentioned in the Tweets embedded below, he reminds those planning to use it "decrypts syscon fw updates from PS4 devkit consoles (you need to provide the keys yourself, but they're not hard to find)"

PS4 HEN 1.8 via mohammadfadel
Download: ps3_syscon_decrypt_tool.py (828 Bytes - script by SocraticBliss, atm it only decrypts the dia-002/deb-001 patch)
PS3 TMU Syscon command list, including addresses and needed permissions...

Back before running commercial PS4 games as package (PKG) files on retail PlayStation 4 jailbroken consoles was a 'thing' in the scene, PS4 gamesharing and PS4 modchips surfaced which led to some Russian sites selling modified PS4 consoles that blatantly included packs of pre-loaded and activated games ready to play.

Fast-forward to 2018... Sony appears to finally be catching on, as according to mainstream media outlets Engadget.com, Kotaku.com and TorrentFreak.com Sony Interactive Entertainment recently filed a copyright infringement / DMCA lawsuit (sonycomp.pdf / Scribd Embed) against California hacker Eric David Scales (aka Blackcloak13) for selling jailbroken PS4 consoles loaded with bootleg games on both eBay and his own Website.

Here's an excerpt from the TorrentFreak article on the news, to quote: “Defendant is an individual who has marketed, sold, and distributed ‘jailbroken’ PS4 consoles that: (a) contain ‘p!rated’ (unauthorized) copies of PS4-compatible video games, and (b) were produced and designed for purposes of, and/or were marketed by Defendant for use in, circumventing technological protection measures,” the complaint reads.

Sony ordered two devices online and found that they were indeed ‘as advertised.’ The PS4s were modified to run an unnamed exploit which effectively circumvents the technological protection...

Earlier this week we saw a decked out PS4 AIO Offline 5.05 Exploit Playground, and recently CelliesProjects made available what he calls PS4Brew 5.05 for ESP32 and ESP8266 devices in 5.05 jailbreaking aimed at PlayStation 4 minimalists.

Prior to PS4Brew 5.05 for ESP32 / ESP8266, he's also used ESP8266 boards for other projects including an ESP8266 Temp Server with further details and pictures on his Dutch blog.

Download: esp32-ps4-jailbreak.ino.esp32.bin / esp32-ps4-jailbreak-master.zip / ESP32 GIT / ESP8266-ps4-jailbreak-master.zip / ESP8266 GIT

Those giving it a try may want to grab the Latest PS4HEN version, and from the README.md to quote: esp32-ps4-jailbreak

This is a minimal implementation of the PS4 hack by qwertyoruiopz. It only contains the 'PS4HEN v1.6'.

You will need an ESP32 board with 4MB flash memory and a PS4 on fw 5.05 to use the software.

How to flash your ESP32:

Using Arduino IDE:

1. Download AsyncTCP and ESPAsyncWebServer and install these libraries in the Arduino libraries folder. Restart the Arduino IDE after this step.
   
2. Unpack the latest release zipfile.
   
3. Flash the compiled software to your ESP32.

Using pre-compiled binaries:

1. Flash the pre-compiled...