PSXHAX.COM website and domain for sale. Contact Us with your offer!
PlayStation 4 DUH-T1000AA TestKit Online with 4.71 Demo by MrNiato
Over the weekend we saw a leak of the 4.50 PS4 ***, and with it before Sony put the kibosh on the leak came PS4UPDATE-testkit-GEN3-4_710_001.PUP for PlayStation 4 developers including @MrNiato of PSXHackingNews.net to use on his PS4 TestKit DUH-T100AA console. 
Today he shared a video demo of his PlayStation 4 DUH-T1000AA Testkit online running on 4.71 non-retail Firmware for those interested, and a BIG THANKS once again to KromeMods for the PS4 4.50 *** leak that made this possible.
[4.71] PS4 Testkit DEX Online (Running on 4.71.001 Non Retail Firmware)
From the video's caption: PS4 Testkit DUH-T100AA DEX Console (Running on 4.71.001 Non Retail Firmware)
Today he shared a video demo of his PlayStation 4 DUH-T1000AA Testkit online running on 4.71 non-retail Firmware for those interested, and a BIG THANKS once again to KromeMods for the PS4 4.50 *** leak that made this possible.
[4.71] PS4 Testkit DEX Online (Running on 4.71.001 Non Retail Firmware)
From the video's caption: PS4 Testkit DUH-T100AA DEX Console (Running on 4.71.001 Non Retail Firmware)
Stack Clash Proof-of-Concept (PoC) for FreeBSD by Lattera
We've seen an Experimental Toolchain recently following news of the Stack Clash Exploit, and today @zecoxao shared a link on Twitter via FabOne to the Stack Clash Proof-of-Concept (PoC) for FreeBSD by Security Engineer / Co-Founder of HardenedBSD known as lattera.
Currently the StackClash FreeBSD PoC remains untested on Sony's PlayStation 4 video gaming console, so if any developers or tekkies examine its feasibility with the PS4 we'd love to hear your findings in the comments below!
Download: 001-stackclash.c
Currently the StackClash FreeBSD PoC remains untested on Sony's PlayStation 4 video gaming console, so if any developers or tekkies examine its feasibility with the PS4 we'd love to hear your findings in the comments below!
Download: 001-stackclash.c
Code:
/*-
* Copyright (c) 2017 Shawn Webb <[email protected]>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above
* copyright notice, this list of conditions and the following
* disclaimer.
* 2. Redistributions in binary form must reproduce the above
* copyright notice, this list of conditions and the following
* disclaimer in the documentation and/or other materials
* provided with the distribution.
* 3. The name of the author may not be used to endorse or promote
* products derived from this software without specific prior
* written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
* CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
* USE, DATA, OR PROFITS; OR BUSINESS...
PS4 IPL AES + HMAC Key Recovery Project Demo by Vpikhur
Recently Volodymyr Pikhur has been working on a PS4 IPL AES + HMAC Key Recovery Project with help from nedos utilizing a Verilog FPGA (Field-Programmable Gate Array) to detect IPL (Initial Program Load) read and trigger capture board. 
PlayStation 4 hardware guys that favor FPGA's including @Chaos Kid will definitely take interest in this project, and here's to hoping we see some more on it in the future!
Below are some related Tweets from vpikhur including the demo video alongside some fresh PS4 MEMEs for developers:
Download: 175devkitipldecryptedbytwoconsoles.7z (259.92 KB)
Turns out the "debug key" that is used to hash "debug" firmwares from SMU effectively works on ALL retail versions of the PS4 smu firmware as well (the one on the wiki). Which means things are about to become VERY interesting...
this is the key
SMU HMAC Key (System Management Unit)
no, but you can probably dump your own keys/fuses with SMU code execution
the issue during all these years was, of course, endianess... book the endianess, to hell with it. anyway, now it's confirmed that the SMU key is potentially useful to run nasty code, provided that there is a way to reset available
Some more info
samu has several keys, not just one. smu has only one used to hash the smu firmware. you can use this key to...
PlayStation 4 hardware guys that favor FPGA's including @Chaos Kid will definitely take interest in this project, and here's to hoping we see some more on it in the future!
Below are some related Tweets from vpikhur including the demo video alongside some fresh PS4 MEMEs for developers:
Download: 175devkitipldecryptedbytwoconsoles.7z (259.92 KB)
Turns out the "debug key" that is used to hash "debug" firmwares from SMU effectively works on ALL retail versions of the PS4 smu firmware as well (the one on the wiki). Which means things are about to become VERY interesting...
this is the key
SMU HMAC Key (System Management Unit)
Code:
4D7E73210B677A832B9F293B496E7C3Ethe issue during all these years was, of course, endianess... book the endianess, to hell with it. anyway, now it's confirmed that the SMU key is potentially useful to run nasty code, provided that there is a way to reset available
Some more info
- ccc-final.pdf (225 KB)
samu has several keys, not just one. smu has only one used to hash the smu firmware. you can use this key to...
PS4 1.01 Memory Dump with IDC Script for the Kernel's Symbols
Yesterday we saw the PS4 1.01 Dlclose Exploit release, and today @zecoxao returns with a PlayStation 4 1.01 Memory Dump and IDA Interactive Disassembler IDC Script for populating the Kernel's Symbols so developers can examine it!
Download: 0xffffffff80000000-1.01.7z (8.9 MB) / 0xffffffff80000000-1.01.7z (Mirror) / symbols.idc (2.9 MB) / SceEapCore.elf (Mirror) / SceEapCore.elf (3.95 MB - from 1.01 containing all function names and variables) / symbols.idc (Mirror) / PS4_4_71_Symbols.rar / 101_final_ultra_memes_internal_fixed_offsets.elf (30 MB) / 1.01kernel_ps4_open_in_ida.elf (17.65 MB) / sce_symbols via SiSTR0 forked from sce_symbols via zecoxao
To quote from zecoxao: 1.01 memory dump. first kernel at 0x0700000, second kernel at 0x2200000. this is for the devs who are curious about 1.01 kernel. using the following script will fill the names of up to 99% of the kernel's symbols.
Download: 0xffffffff80000000-1.01.7z (8.9 MB) / 0xffffffff80000000-1.01.7z (Mirror) / symbols.idc (2.9 MB) / SceEapCore.elf (Mirror) / SceEapCore.elf (3.95 MB - from 1.01 containing all function names and variables) / symbols.idc (Mirror) / PS4_4_71_Symbols.rar / 101_final_ultra_memes_internal_fixed_offsets.elf (30 MB) / 1.01kernel_ps4_open_in_ida.elf (17.65 MB) / sce_symbols via SiSTR0 forked from sce_symbols via zecoxao
To quote from zecoxao: 1.01 memory dump. first kernel at 0x0700000, second kernel at 0x2200000. this is for the devs who are curious about 1.01 kernel. using the following script will fill the names of up to 99% of the kernel's symbols.