PS4 Jailbreaking

Earlier this week we saw the release of a PS4 Payload Sender for Android by @valentinbreiz (who has since fixed the crash issue in v1.1) followed by a redesign of mine based off his GitHub repo, and today I've made available Version 1.0 followed by a v1.1 crash fix with a preview video and the changes detailed below alongside PS4 Payload Sender 2.0.

Download: 2.0 PS4 Payload Sender 5262018407 signed.apk (1.8 MB) /
PS4 Payload Sender Version 3.0 Update (2.8 MB)

Spoiler: Depreciated

New package name so please uninstall the older one as it will show two applications.

I haven't tested in on a PS4 but will soon (waiting for the 5.05 public release as I'm on 4.73).

Version 1.0 public - 5/16/2018

• Initial release
• Full redesign
• Added an about activity
• Added an adaptable icon support
• Added a splash screen
• New theme based on the Playstation messages app
• Improvements under the hood
• Working on French ans Spanish translations

Known bug:

Some users experience crash when button clicked. Working on that issue right now, will be releasing a fix. This is caused by an onClick used on the xml layout file.

Version 1.1 public - 5/16/2018 8:00

Should be fully usable.

• Fixed crashes by @valentinbreiz

Preview:

Screenshot:

Tweets:

...

We've seen several APK's and Apps for PlayStation 4 payloads before, and today following his PS4 Payload Sender PC client developer @valentinbreiz (Twitter) made available a simple PS4 Payload Sender of his own for Android users followed by a PS4 Payload Sender v1.1 Fatal Crash Fix alongside a PS4 Linux Loader for 5.05 work-in-progress which he states will be ready once he finishes porting the PS4 kexec 5.05 offsets.

Download: PS4-Payload-Sender.apk / GIT

From the README.md: PS4 Payload Sender for Android

Send payloads to your PS4 from your Android device.

Many thanks to kojo9999 for testing

From the README.md: PS4 Linux Loader

A simple payload that let you run Linux on your 5.05 PS4

How to build

I use https://github.com/idc/ps4-payload-*** to compile it. You also need to compile https://github.com/fail0verflow/ps4-kexec and place 'kexec.bin' into this folder. Compile kexec with 'make CFLAG='-DPS4_5_05 -DKASLR -DNO_SYMTAB'.

How to use

For now only some PS4 FAT models are supported, see the list here.

You need a FAT32 formatted USB drive plugged in on any PS4's USB port with the following files on the root directory : bzImage and initramfs.cpio.gz. You can download them here.

Then you will need to send the payload (PS4-Linux-Loader.bin) to your PS4. For that go to...

Today PlayStation 4 developer @SpecterDev announced on Twitter that a full PS4 5.05 Jailbreak (Userland and Kernel exploit) will be coming soon complete with tools for developing PS4 homebrew applications like Alpha-V3.pkg on 5.05 OFW and games!

This comes following the PS4 5.03 WebKit Exploit Port, the PS4 5.50 WebKit Exploit Rewrite and qwertyoruiop's Tweet yesterday that he'll be speaking on PS4 hacking "from zero to ring zero in two easy steps" today at 0x41con.

Also PlayStation developer @Mathieulh dropped some PS4 Firmware 5.53 teasers on Twitter recently including a kernel string, although he reminds everyone to have some patience.

To quote from SpecterDev: "Within the next few weeks there will be a PS4 5.05 full stack release including tools for homebrew development. Some other tools will be dropped as time goes on. Don't update your <= 5.05 consoles if you care about homebrew. Hope to see cool stuff soon "

...

Following to several previews and after a few issues with my isp, I will finally release what I have been working on. The PlayStation 4 Toolbox features a few basic tools such as a peek poker or a notification tool.

It should be straight forward on how to use most of the tools, although there are some features hiding in right-click menus. Here is a PS4 How to Enable Dev Menus Manually tutorial also.

Getting Started

1. Set the ip in the "Settings.ini" file in the tool folder to your PS4 ip.
2. Set your desired firmware version in the "Settings.ini" file (4.05 and 4.55 supported).
3. Launch the tool and click "Inject Payload". Leave the port on 9020.

I will probably add more information on how to use this whole toolbox.

Other things to mention:

• This entire tool is based of goldens jkpatch.
• Everything in this release has only been tested on 4.55 but should work 99% on 4.05 aswell.
• The tool is running an connection test on startup. If you have issues with it detecting the payload as injected although it isn't, disable this check. You can do that by setting the "TestConnectionOnStartup" to "0" in the "Settings.ini" file in the tool folder.
• If you are looking to add more weapons for the bo3 zombie tool: The weapon list are located in the tool folder under "\gametools\bo3\weaponlists". You can refresh the lists at runtime by right-clicking the map selection. You can also add ned files and name them whatever you want. It will read all *.txt files.
• For adding new weapon lists for not yet featured bo3 zombie maps, add around 200 lines of "n/A" in the desired file. It does read each line in the file as an id starting with 1. You can the add in the weapons you get for the selected line to the file and save it. Selecting a new entry in the weapon list will the refresh the names at runtime.

If you are able, please run the benchmark tool and leave your results down below like in the spoiler below. I'm really interested in your results.

Spoiler: Results

Recently the PS4 scene has been focusing on ESP8266 board methods including ESPHost, ESPS4ExploitServer and RetroGamerFirm while today PlayStation 4 developer @Al Azif announced on Twitter alongside the PS4 Exploit Host v0.4.2 release news of the latest PS4 modchip project for Webkit exploits tentatively known as The Gate... although with support for other devices including Nintendo Switch and PlayStation Vita planned it will likely be renamed soon he states.

Here's the full announcement complete with features from the Github update, to quote: Announcement

This project has been a little neglected since the 0.4.1 release almost a month ago as I've been working on another project since that release. I've haven't been hiding and posted a bit on Discord so this won't come as a surprise to some. It's a "modchip" for webkit exploits, mirroring the existing ESP8266 methods, just with more features/polish.

The device can either create a network to connect to (No internet access), connect to an existing network (Works just like this host), or create a bridge (Enabling internet access though the device). It's a custom PCB that's about 25mm*18mm*4mm (Currently) so it should fit inside most consoles. The front end looks like my regular exploit host and you can view a demo (out of date) of the control panel here.

Features

• Control the device from your phone/computer over Bluetooth/Wifi
• Open API for developers to interact/control the device
• Press physical buttons on the console
• View/Download UART data
• Add, download, or delete exploits with one button click
• Custom filetype (Compresses exploits into a single file to install/share)
  • Supports both Bin and JS payloads
  • Includes application to...