PS4 Jailbreaking

Since @flatz shared on Twitter his awesome PS4 Fake PKGs & SELF / FSELF Write-up, and following the PS4 SELF_Info.exe release and recent 4.05 Experiments PlayStation 4 developer IDC made available some PS4 4.05 patches and hooks on Github to enable FSELF / FPKG loading with ShellCore patches (for fake PKG support) implementation yet to come.

Download: ps4-fake-405-master.zip / PS4Fake405 (Simplified payload makefile independent of libPS4) / GIT

To quote from the README.md: PS4 Fake 4.05

Patches and hooks to enable fself/fpkg loading for 4.05, as described by flatz in his writeup.


ShellCore patches (for fake PKG support) not yet implemented.

• fake_installer - Add payload and installer. (Compiled fake_installer.bin by akenateb and midos2010 with a compiled FSELF.zip working download link from DomyGX)
• fake_payload - Fix fake_payload.x for normal builds. (Compiled fake_payload.bin by...

Following the PS4 Serial and Flash Pinouts, PS4 UART Enabler and PS4 4.05 Debug Settings and UART Output this past weekend, today PlayStation 4 modder ImJtagModz (YouTube) made available UART Ground Wire and Uart0 TX pinouts for a SAC-001 Motherboard alongside a Windows tool called PS Watson (PSWatson.exe) to view your PS4 console's UART output.

Download: PSWatson.exe (578 KB) / Solderless_UART_by_Centrino.pdf (928 KB) by Centrino

In related news, PlayStation 4 modder and YouTube extraordinaire Blasts Mods (YouTube) who helped with the PS4 Advanced Warfare Mod Menu shared a brief UART on PS4 4.05 demonstration video for those interested.

Check out the related Tweets with pictures and the 4.05 PS4 UART demo video below!

Jailbreaking Your PlayStation 4 With Just A...

As promised, following his 4.55 Custom / Repacked PS4 Package (PKG) Files demo video and recent updates today PlayStation 4 developer @flatz made available on Twitter his method to handle PS4 Fake PKGs and SELF / FSELF write-up so that PS4 Scene developers can backport and make use of it with the recent 4.05 Kernel Exploit and 4.05 Game Dumps!

Check it out below, or download it from here: write-up.zip (415 KB)

Fake PKGs + SELFs: Table of Contents

1. Overview
2. Fake SELFs
   2.1. Kernel code
   2.2. Testing
3. Fake PKGs
   3.1. Toolchain
   3.2. Modding of Shellcore
   3.3. Kernel code
4. Defines, structures and helper functions
5. Package repacking issues
   5.1. SFO file parsing
   5.2. PlayGo chunk builder
   5.3. GP4 project generation
   5.4. Some of PKG/PFS stuff
6. Conclusion

Overview

My original intent was to implement a minimalistic strategy that could lead to running stuff like fselfs and debug pkgs. I don't like methods that do a lot of patching and involve a lot of manual work, so I prefer to use built-in functionality whenever possible. While the result is not as minimalistic, it is effective. As I've said multiple times, this stuff can be ported to any firmware.

So here's the problems we have:

1. Executable files including SELFs/SPRXs/SEXEs/SDLLs are signed and encrypted. While their fake versions are not signed and encrypted, we usually can't use them on a retail console due to restrictions that are put in place by the auth manager that loads them (a secure module, or SM, that is running by SAMU, a secure co-processor that is embedded into our AMD's APU). The (S)ELF loader from the kernel use SAMU calls for everything crypto-related...

We've covered the PS4 Full Debug Settings 4.05 Payload release, and today Tralala LS from French scene site Logic-Sunrise.com shared a video demo of Trypeur installing The Last of Us Remastered 1.06 PKG game update (see the PlayStation 4 Package (PKG) Finder and PS4 Package (PKG) Database for more) via Debug Menu on an Exploited PS4 4.05 console using Trypeur.96.lt.

This comes following how to Install PS4 PKG Files Using a Function vs Debug Settings and PlayStation 4 developer @flatz's demo of Custom Repacked PKG's, as the PS4 4.05 scene awaits Flat_z's Upcoming Release in hopes it will aid developers in porting code for running PS4 4.05 Game Dumps on jailbroken consoles.

To quote from their blog, roughly translated: "It is very hot right now on the PS4 scene with the famous kernel flaws of SpecterDev and all the payloads 4.05 that fall from the sky and the ability to boot linux. Debug menu now available simply with a payload, we see all the colors.

I recently noticed that it was possible to install game UPDATES with the PKG's installation menu on a previously installed game via a disc.

Be careful not to install an update requesting a firmware higher than 4.05, otherwise your game will start and you must erase your entire game to remove the update."

• ...

Finally it's happening... over a year ago fail0verflow revealed PS4 Linux on 4.05 Firmware and continued to school the PlayStation 4 scene on everything from Adieu to Kernel Dumping which ignited the 4.05 era of exploiting, jailbreaking and once again PS4 Linux followed by PS4 Linux Loader 4.55!

Many may recall seeing a demonstration from the Tencent Security Conference, and according to Rebug developer @Joonie early PS4 Linux Loader work was missing the now released 4.05 Kernel Exploit.

While many developers including @jocover have been working (405_linux_loader.bin - 21 KB) on a PS4 Linux Loader (GIT), PlayStation 4 developer @valentinbreiz (Twitter) who brought us the 4.05 PS4 Payload Sender last week was able to get PS4 Linux running on 4.05 with PS4-Linux-Loader.bin payload testing by @Darbness (Twitter) who shared a 4.05 PS4 Linux demo video below!

Download...