PS4 Jailbreaking

Last night we saw the first Hello world, PS4! homebrew for exploited PlayStation 4 v4.05 consoles, and today we're beginning with the arrival of PS4HEN: PS4 HEN (Homebrew ENabler) in the form of a PS4HEN.bin payload for version 4.05 Firmware from VVildCard777 who thanks flat_z for ALL his work including his recent writeup, notzecoxao and psxdev for their help and IDC for the codebase and shellcore patch method used.

Many may recall HENkaku for PS Vita, and similar to it the PS4HEN Homebrew Enabler allows PlayStation 4 v4.05 users to launch homebrew applications alongside backup games and more which we'll cover in some other articles tonight!

Download: PS4HEN.bin (1.00 MB) / PS4 HEN + TestApplication - AlFaMoDz.rar (5.5 MB) via @AlFaMoDz / PS4HEN Github / PS4 HEN 4.05 Exploit Payload Webpage (No PC Needed)

Below are some related Tweets and a video (for those who missed it) from RSPxAndrew2007x via his YouTube Channel on running the testapp.pkg homebrew and fake PKGs on PS4 4.05 jailbroken consoles, and to quote from the...

Recently we saw the release of a PS4 4.05 Kernel Exploit, which lit up the scene bringing cool stuff like 4.05 PS4 Linux followed by Flat_z's Writeup, IDC's PS4Fake405, a Fake PKG Generator and now confirmation that homebrew on PlayStation 4 v4.05 Firmware is a thing now!

To kick off the 4.05 PS4 homebrew scene PlayStation 4 developer @zecoxao shared some handy payloads and a "Hello World, PS4!" Test Application (testapp.pkg) on Twitter, which some including @GritNGrind already took for a test drive!

Download: fake_installer.bin (1.0 MB - kernel_hooks Payload) / hostapp_launch_patcher.bin (1.0 MB - ShellCore Patches IP is 192.168.0.4) / testapp.pkg (7.1 MB) / PS4HEN.bin (1.00 MB)

There are still some hoops to jump through before a user-friendly method to make PS4 backup games playable on 4.05 OFW is available which we'll discuss below, and these patches can also be added to the 4.05 PS4 Exploit so end-users will then be able to just run the exploit after each reboot to apply them.

Here's a summary of what's known thus far with the related Tweets, as follows:

ok, to start, shellcore patches from flatz...

Based on IDC's previous PS4 PUP_Unpack, PlayStation 4 developer Thunder07 (aka Zer0xFF on Twitter) made available a PS4 PUP Unpacker v1.0 to unpack decrypted PS4 PUP images such as the recent 3.70 Decrypted OFW by BurtE.

Download: pup_unpacker.exe / GIT

In other news today since the PS4 Keys by RedEyeX32 released last month, Something Sinister shared a tool for PS4 developers to create RSA key pairs with source code stating the following: "Polarssl's rsa_genkey.exe generates RSA key pairs. All inputs generated internally.

This version generates RSA key pairs from user input. 2048bit keys only. User inputs the exponent and randoms p and q."

Download: polarssl_rsa_application.zip (58 KB) / polarssl_rsa_source.zip (18 KB) / ps4pkgdec.zip (7.2 KB - contains ps4pkgdec.exe) / ps4pkgdec_update.zip (14 KB) / ps4pkgdec_update_source.zip (10 KB)

Additional details on usage with the PKGDec Tool are available from Robbie Luong for those interested. To quote from the README.md file: pup_unpacker

A utility to unpack PS4 update blobs that have been previously decrypted...

If anyone is interested and wants to try, I created a PSX-CPL program in CSharp that combines the DNS-Server, HTTP-Server and one additional HTTP-Server for the ELF-loader and allows sending PS4 payloads with some updates HERE.

Additionally you can monitor DNS/HTTP requests.

I wanted to have one in all, so this replaces netcat (payloads + log client), nodejs (elfloader), webserver (playground), python (dns).

I made this for myself and it is working, but thought, somebody likes to improve it.

Download: PSX-CPL FULL / LIGHT v1.0.0 / psx-cpl-master.zip / GIT

You need to compile it and add the playgrounds, elfloader and payloads yourself. I left the references to the files in the project so that you can see what was where but it will fail to compile if not all files are present, simply remove them from the project.

WARNING: It was more or less a proof of concept to have one in all. This means this code is not polished, follows no coding standard and should not be used for any serious work as it could be harmful even if it was never intended! So only use it at your own risk and if you know what you do.

You might need to configure / disable your firewall because the program is listening on the ports 53 (dns), 80 (http), 5350 (elfloader http).

As I have not enough time to finish it, there could be done improvements like:

• code cleanup
• ui design and missing controls
• stabilization
• proper logging (log4net)
• move to dotnet core to be able to use it with linux
  
• add proxy

Thanks goes to all of the developers and contributors like CTurt, Hitodama, Specter, flatz, idc, fail0verflow,...

Original source for DNS library is: https://github.com/kapetan/dns (Mirza Kapetanovic)

Original source http server is: https://gist.github.com/flq/369432 (Frank Quednau)

Thanks to all contributing at https://stackoverflow.com/

Hot on the heels of yesterday's PS4 Fake 4.05 updates, today PlayStation 4 developer @cfwprophet shared on Twitter a Fake PKG Generator for PS4 with documentation to generate fake packages which will support homebrew once the ShellCore patches (for fake PKG support) are implemented.

Download: Fake_PKG_Generator.rar (2.85 MB - v2.89) / Fake_PKG_Generator.rar (429.72 MB - Documentation) / make_fself.py (0.2 MB) / make_fself.py (Mirror) / make_fself.py (Mirror #2) / sc.exe_hack.rar (0.28 MB) / Fake PKG Generator 3.12 hotfix.zip / Fake PKG Generator 3.12 hotfix2.zip / Fake PKG Generator 3.38.zip (4 MB) / Fake PKG Generator 3.38.zip (Mirror) / Fake PKG Generator 3.38.zip (Mirror #2 - includes orbis-pub-sfo.exe) / Mirror #3 / PS4_Fake_PKG_Tools_v3.87.rar (3.35 MB) / PS4 Fake PKG Tools with Fake PKG Generator 3.87 Patched for FPKGs by CyB1K

Note: Use '00000000000000000000000000000000' for the PKG Gen password in case others need to...