PSXHAX.COM website and domain for sale. Contact Us with your offer!
PS4BackupLoader: Multiple Payload PS4 Backup Loader by STONEMC
Hello,

Yesterday I wrote a little .bat file according to the KernelHooksHelper by @0x199 to make the process to run PlayStation 4 game backups on PS4 1.76 jailbroken consoles as easy as you can imagine.

Download: PS4Backuploader.rar (232 KB) / PS4Backuploaderv2.rar (371 KB - includes BigWadger's Payloads)

Now you can choose the way you want to load your game in one second. The benefit for me is that I can run two games from internal hdd (kernel hooks /data/CUSAXXXX and donor disc payload) without using filezilla to change the name of the internal backup folder in /data/. Also you can run a third game on external usb port.

After launching your local elf loader you have to launch the PS4Backuploader.bat and follow the instructions.

Set your PS4IP and name of donor disc payload in the two .txt files before and copy your donor disc payload into PS4Backuploader root.

Credits to @zecoxao, @0x199
PS4 PKGDec Tool to Decrypt Encrypted Package Entries by RedEyeX32
Since his recent PS4 Orbis Title Metadata Database release, PlayStation 4 developer @RedEyeX32 made available on Twitter a PS4 PKGDec homebrew tool used to decrypt encrypted entries within a package file container. :ninjaxf2:

In his Tweets below, he notes "The keys to decrypt these entry files are encrypted with RSA. I've provided the necessary keys but you will need to calculate the rest to make the tool useful."

Download: pkgdec.rar (86 KB) / Usage Details from Robbie Luong with Something Sinister's Tool

Also from him are some PS4 private and public key SHA-256 hashes, as the PlayStation 4 v1.76+ scene eagerly awaits further word of SpecterDev's progress on a public v4.05 kernel exploit that can be used to jailbreak newer PS4 console models.

Remove the last 16 bytes from the included keys within the source to get the actual 'key' of E, P, & Q.

To calculate public key: n = q * p
To calculate private key: d = e^-1 mod ((p - 1) * (q - 1))
Code:
Private key SHA-256: a9ac2702937c953ce42a85fae1d3914443a4859fed76140126d8d52ab2778caf
Public key SHA-256: c80fecd0f96b5f06135505d9056794117697c3b2848c89fdf370e087ea3e6237
And from @RedEyeX32 on Discord: This is the most important entry types since those are the encrypted ones:
Code:
ENTRY_TYPE_ENTRY_KEYS          = 0x0010
ENTRY_TYPE_IMAGE_KEY           = 0x0020
ENTRY_TYPE_GENERAL_HASHES      = 0x0080
...
PS4 NID to Function Name Resolver for Bin / Lib by Zer0xFF
Following the initial PS4 NIDs, additional PlayStation 4 NIDs, his recent PS4 PUP Unpacker Rewrite and the PS4LibDoc updates today PlayStation 4 developer Zer0xFF released PS4 NID to Function Name Resolver source code for use in IDA Pro 7.0 resolving Bin / Lib Function Names by developers. :ninja:

Download: PS4 NID Resolver IDA Plugin (compiled to work with IDA 7.0) / ps4_nid_resolver_ida-master.zip / GIT

From the related Tweets below, to quote: "2 weeks ago I posted this picture, today I'm posting up the source, this will be helpful for anyone working with PS4 and RE sprx, currently it's missing game bin/sprx support but that will be added in due time"

And to quote from the README.md file: PS4 NID to Function Name Resolver

Resolves PS4 Bin/Lib Function Names

Requirement
  • IDA (Have only been tested on IDA 7.0)
  • IDA ***
  • cmake
  • ps4libdoc by idc
How-To-Build
Code:
git clone --recurse-submodules https://github.com/Thunder07/ps4_nid_resolver_ida.git
cd ps4_nid_resolver_ida
./extern/ida-cmake/build.py -t 7.0 -i ~/idasdk70/ --idaq ~/.idapro/
Note: on windows you'd need to change --idaq C:\Users\USERNAME\AppData\Hex-Rays\IDA Pro\

How-To-Use
  • Ctrl+Alt+F10: Basic Settings Panel
  • Ctrl+F10: Resolve Function Names (Note: this action is none reversible, make sure you've a copy of your ida database before applying this)
TO-DO

At this moment, the plugin will only attempt to resolve libraries...
PS4 Entrypoint 1.76 Payload Executing for Firmware 1.76 by IDC
Following the rewrite of his PS4 PUP Unpacker and his recent PS4LibDoc updates, today PlayStation 4 developer IDC (aka 3226:2143‏) shared his version of the PS4 Playground he calls PS4 Entrypoint 1.76 which supports payload executing for Firmware 1.76 with details below. :ninja:

Download: ps4-entrypoint-176-gh-pages.zip / GIT / Live Demo / PS4 Entrypoint 4.05

Despite Sony trying to block some PS4 Playground versions, this latest revision comes following the PS4 1.76 Advanced WebKit Playground and recent 4.05 updates from SpecterDev on Discord.

From the README.md, to quote: ps4-entrypoint-176

Payload executing for PS4 firmware 1.76.

Intended to be used with payloads developed using ps4-payload-***. Not required, as long as the payload is well-formed (should be compatible with original PS4-***).

Payload binary should be two 1MB sections. First 1MB section should be readable/executable data, second 1MB section should be readable/writeable data. It is OK if the binary is truncated. Sending more than 2MB of data is likely to corrupt memory and cause issues.

This fork makes several changes to the original PS4-playground to increase stability of running payload binaries and removes everything unrelated to this functionality.

Setup

A live demo can be tried...
PS4 AIO v1.3.0 Update by MODDEDWARFARE with Video Guide
Following the previous updates, today I've updated PS4 AIO to version 1.3.0 alongside a video guide for jailbroken PlayStation 4 v1.76 consoles! :bananaman13:

Download: PS4-AIO Portable_1.3.0.zip (37.1 MB) / PS4-AIO-Setup_1.3.0.exe (37.5 MB)

Mine has the latest game update 01.20 included to access Extinction mode from the main menu. I have confirmed it working on my 1.76 PS4 using the Watch Dogs donor disc payload.

If you want to know how to install the 01.20 patch so you can run your backup on the latest update watch from 5:00 on the video from my YouTube Channel below.

How to Run Backup PS4 Games with the Latest Game Patch Installed 1.76
Also to note I tried the GTA-V EU donor disc payload which didn't work correctly when trying to access multiplayer or extinction mode comes up with a box saying installing additional content. So looks like some donor disc payloads might not work.

I have also added an update for my PS4-AIO mod tool which includes a game dumper payload. You can add your own game ID of the game you want to decrypt/dump and select whether you want to dump the game files app0 or the games update files patch0.

You can also select an output device but I would recommend keeping it on USB0 as default. In addition you can either inject the payload from the tool or save the payload to be used later. You can get more details at this 15:00 on the video.
CoD Ghosts by Modded Warfare & OhcHIT with PS4 AIO v1.3.0 Update.png
Back
Top