PSXHAX.COM website and domain for sale. Contact Us with your offer!
PS4 GIFLIB Entry Point for User PlayStation 4 Exploit via Joona70
Earlier this week PlayStation 4 developer @joona70 let us know in the PSXHAX Shoutbox that he ran across a potential userland heap overflow 5.1.1 vulnerability in the GIFLIB library for reading and writing GIF images... as Sony's PS4 uses version 4.1.2. 
While it's currently unknown if this could be an entry point in PS4 Firmware above 4.07 OFW, besides the PS4 JailBreak Status Chart and PS4 Hacking / Modding FAQ here's what we know from developer @xxmcvapourxx in summary:
While it's currently unknown if this could be an entry point in PS4 Firmware above 4.07 OFW, besides the PS4 JailBreak Status Chart and PS4 Hacking / Modding FAQ here's what we know from developer @xxmcvapourxx in summary:
- PS4 1.76 Browser Exploit > Kspoilt (Dlclose) Kernel > Fail0verflow's 3D Drivers / Patches with PS4 Kexec exploit
- PS4 3.55 Browser Exploit > Fire30 (Henkaku) > Ksploit (In Progress) > Fail0verflow Kexec exploit
PS4 4.05 Offsets Now Added to Fail0verflow's Kexec GIT by Marcan
Following their PS4 Kexec Code to Load the Linux Kernel and the addition of Kaslr 3.55, 4.00 and 4.01 Support today Marcan has merged the pull request in Fail0verflow's kexec system call GIT adding the PS4 4.05 Offsets for developers! 
This comes just over a week before their Console Hacking 2016 CCC Presentation which will be Streaming Live at 23:00 on December 27, 2016.
From Fail0verflow's PS4 kexec magic.h via Github: Add 4.05 offsets
This comes just over a week before their Console Hacking 2016 CCC Presentation which will be Streaming Live at 23:00 on December 27, 2016.
From Fail0verflow's PS4 kexec magic.h via Github: Add 4.05 offsets
Code:
#ifdef PS4_3_55
#define kern_off_printf 0x1df550
#define kern_off_copyin 0x3b96e0
#define kern_off_copyout 0x3b9660
#define kern_off_copyinstr 0x3b9a50
#define kern_off_kmem_alloc_contig 0x337ea0
#define kern_off_kmem_free 0x33bca0
#define kern_off_pmap_extract 0x3afd70
#define kern_off_pmap_protect 0x3b1f50
#define kern_off_sched_pin 0x1ced60
#define kern_off_sched_unpin 0x1cedc0
#define kern_off_smp_rendezvous 0x1e7810
#define kern_off_smp_no_rendevous_barrier 0x1e75d0
#define kern_off_icc_query_nowait 0x3ed450
#define kern_off_kernel_map 0x196acc8
#define kern_off_sysent 0xeed880
#define kern_off_kernel_pmap_store 0x19bd628
#define kern_off_Starsha_UcodeInfo 0x1869fa0
#define kern_off_pml4pml4i 0x19bd618
#define kern_off_dmpml4i 0x19bd61c
#define kern_off_dmpdpi 0x19bd620
#elif defined PS4_4_00 || PS4_4_01
#define kern_off_printf 0x347450
#define kern_off_copyin 0x286cc0
#define kern_off_copyout 0x286c40
#define kern_off_copyinstr 0x287030
#define kern_off_kmem_alloc_contig 0x275da0
#define kern_off_kmem_free 0x369580
#define kern_off_pmap_extract 0x3eeed0
#define kern_off_pmap_protect 0x3f1120
#define kern_off_sched_pin 0x1d1120
#define kern_off_sched_unpin 0x1d1180
#define kern_off_smp_rendezvous 0x34a020
#define...
LudicrousBeach's Recompiled PS4 Dlclose Exploit Web Browser Patch
Over the weekend we saw Part 2 of his PS4 GTA V RTM Mod, and now PlayStation 4 developer LudicrousBeach has recompiled the PS4 1.76 Dlclose Exploit into a fixed Web Browser Patch for 1.76 OFW and under with details below. 
Download: WebBrowserPatch.bin (1.0 MB)
To quote: [Fixed] PS4 Web Browser Patch
Introduction
So myself and a few others tried the released Web Browser Patch that was released named "ps4_dev-dlclose_(Browser)_Kernel_Patch.bin", but couldn't get it to work.
Therefore I looked for the code online, implemented the dlclose exploit and compiled it.
The debug information this payload sends is sent to the IP 192.168.1.77, although not needed for the patch. if you want to view the debug information make sure you have a TCP listener on port 9023 and you have changed your PC IP to 192.168.1.77.
Note
Thanks to @lezek20 for the code:
Also thanks to @HydrogenNGU for the news tip in the PSXHAX Shoutbox! 
Download: WebBrowserPatch.bin (1.0 MB)
To quote: [Fixed] PS4 Web Browser Patch
Introduction
So myself and a few others tried the released Web Browser Patch that was released named "ps4_dev-dlclose_(Browser)_Kernel_Patch.bin", but couldn't get it to work.
Therefore I looked for the code online, implemented the dlclose exploit and compiled it.
The debug information this payload sends is sent to the IP 192.168.1.77, although not needed for the patch. if you want to view the debug information make sure you have a TCP listener on port 9023 and you have changed your PC IP to 192.168.1.77.
Note
Thanks to @lezek20 for the code:
Code:
uint64_t (*sceRegMgrSetInt)(uint32_t reg, int val) = (void *)0xFFFFFFFF8269B310;
sceRegMgrSetInt(0x3c040000, 0);
PS4 Retail vs DevKit / TestKit 1.76 VSH Differences by ZiL0G80
A few months back we saw a PS4 Retail vs Dev / Test Console comparison, and this weekend PlayStation 4 developer ZiL0G80 shared a PS4 Retail vs DevKit / TestKit VSH difference file comparison from 1.76 Firmware. 
Download: PS4 1.76 Retail vs DevKit / TestKit VSH Diff (Thanks to HydrogenNGU for the fixed link!)
Recently a stack pivot for PS4 1.76 surfaced on Pastebin for those following at address: 0x7710e200
Also thanks to @raedoob, @VultraAID and @HydrogenNGU for the news in the PSXHAX Shoutbox!
Download: PS4 1.76 Retail vs DevKit / TestKit VSH Diff (Thanks to HydrogenNGU for the fixed link!)
Recently a stack pivot for PS4 1.76 surfaced on Pastebin for those following at address: 0x7710e200
Also thanks to @raedoob, @VultraAID and @HydrogenNGU for the news in the PSXHAX Shoutbox!
PS4 1.76 Game Decryption / Homebrew Kernel Console IDPS Address
Previously we reported on a PS4 1.76 Kernel ELF followed by PS4 Kernel ELF Loading and Hooking which brings us to a UniversalFlash App WIP from earlier this week, and now HybridComputers shared a gift with the community!
To quote from the English translation via @juansbeck in the forum HERE:
Hello vultraid, I admire your job
This is the address of idps in the kernel 1.76 to decrypt what you want in terms of games or apply to homebrew
Offset 0XFFFFFFFF833242F8 console id
ipdsfullkernel1.76universalflash.jpeg
This is the command:
This is the complete kernel in case you want to see yourselves
kernelfulluniversalflash1.76.rar
Greetings and I hope this helps in the advance of the scene.
While it'd be simply festivus if this localized PS4 Console ID aided in a PS4 Spoofer, according to @xxmcvapourxx this is from the old 1.76 kernel and thus nothing to get overly excited about at the moment.
Cheers to @juansbeck, @spyro2670, @TheOneAngel and @VultraAID in the PSXHAX Shoutbox for their contributions to this update.
To quote from the English translation via @juansbeck in the forum HERE:
Hello vultraid, I admire your job
This is the address of idps in the kernel 1.76 to decrypt what you want in terms of games or apply to homebrew
Offset 0XFFFFFFFF833242F8 console id
ipdsfullkernel1.76universalflash.jpeg
This is the command:
Code:
Sysctlbyname ("machdep.idps", dest, & sizze, NULL, NULL)This is the complete kernel in case you want to see yourselves
kernelfulluniversalflash1.76.rar
Greetings and I hope this helps in the advance of the scene.
While it'd be simply festivus if this localized PS4 Console ID aided in a PS4 Spoofer, according to @xxmcvapourxx this is from the old 1.76 kernel and thus nothing to get overly excited about at the moment.
Cheers to @juansbeck, @spyro2670, @TheOneAngel and @VultraAID in the PSXHAX Shoutbox for their contributions to this update.