PS4 Jailbreaking

Following recent research from PlayStation 4 developers into the 4.01 PS4 Jailbreak by Chaitin Tech, today the Chinese PS4 Jailbreaking Team have released an ROP (Return Oriented Programming) tool on their Pro GIT to aid developers in exploiting the PlayStation 4.

Download: pro-master.zip / GIT

PSXHAX Moderator @Centrino points out the GIT work is incomplete, referencing line 41 meaning it only contains partial information and nothing can be done with it by end-users just yet.

In other words, although Chaitin Tech are not teasing, they also are not spoon feeding (giving away their full exploit).

Here is a snippet from #ps4dev on iRC via @Fimo for those interested:

[rck`d] the nonsecure browser has no jit, only the secure browser now (used for PSN store, etc) has JIT
[rck`d] Since some version, the internal browser is compiled WITHOUT jit support, and sys_jitshm_xxx seems to be disabled for unprivileged process

Everyone can draw their own conclusions, but thus far it wouldn't surprise me if the Chinese Team is just a 'smoke and mirrors' scheme as dongle douchbags start re-DRMing the exploit to profit off PS4 sceners... then when people whine they'll direct them to this GIT of incomplete code as a 'free' alternative to their useless 'product' but hopefully I'm mistaken.

Anyhow, to quote from the README.md: PRO: PROgramming ROP like a PRO

This is a crappy tool used in our private PS4 jailbreak. Since some version, the internal browser is compiled WITHOUT jit support, and sys_jitshm_xxx seems to be disabled for unprivileged process. We have to write the kernel exploitation in ROP, like what has been done in HENKaku jailbreak.

Build

Yesterday he shared a nice archive of PS3 and PS4 Dev Unit PUP files, and today @MrNiato returns with a video demonstrating the Debug menu setting differences between a PlayStation 4 TestKit DUH-T1000AA DEX 3.50 Firmware and a PlayStation 3 UltraSlim DECH-4000AA 4.78 DEX OFW console.

Check out MrNiato's Blog for more, and the video is below along with some related Tweets via Twitter:

PS: At 1pm tomorrow (later today) he's planning to release something PS4 developers may find useful... so stay tuned!

Update: It was cancelled, see the Tweet on his Testkit 1.76 Dump below:
To quote from MrNiato's Blog: "Today at 1PM I posted a full dump of my TestKit on 1.76 Non Retail Firmware, unfortunately I've decided to delete this dump to avoid any problem with Sony. Maybe Am I wrong and I risk nothing but we don't know what Sony can do....

Thanks for reading."

Yesterday we reported on research being done by PlayStation 4 developers and enthusiasts to uncover the Chaitin Tech PS4 4.01 Kernel Exploit, and today @SpecterDev shared another Tweet which sheds more light on the suspected CVE-2016-1885 (Exploit-DB) vulnerability.

Below is a brief excerpt, and be sure to check it out in it's entirety on his Latest PS4 Dev Blog entry!

To quote: "My ultimate goal of the lower half of this article is to show a little snippet of the complexity of such an exploit to be developed, so whenever something is found, don't expect an exploit to be released right away.

If and when such a POC is released, be thankful and respectful to the developer, after all many in this scene are doing this work for free."

From Pastebin.com also comes a log from #ps4dev on iRC via @B7U3 C50SS, as follows:

Yesterday we saw their Full Demo Video, and today Kun Yang (GIT / Twitter) of the Chinese PS4 4.01 Jailbreakers Chaitin Tech responded via e-mail to @mcmrc1 who reached out to them with some questions about their recent PlayStation 4 exploit.

Check out the e-mail response image and related Tweets from mcmrc1 below, and in summary they invite all PlayStation 4 fans to follow their Chaitin Tech Twitter for updates on their PS4 Jailbreak, they are still awaiting word back from Sony on their bug submission and have not yet tested their exploit on PS4 Firmware 4.05 to see if it's been patched yet.


Thanks to @B7U3 C50SS for the tipoff in the PSXHAX Shoutbox (and PM), @Winchest and a VERY SPECIAL THANKS to @mcmrc1 for reaching out to the Chaitin Team and keeping us all in the loop here!

After his PS4 TestKit DEX Console Manager demo video and PS4UPDATE-TestKit-GEN3-3_508_041.PUP for PlayStation 4 developers, @MrNiato has since started MrNiato's Blog and shared some PS3 DECH (DEX) and DECR (Reference Tool) PUP's alongside PlayStation 4 DevKit / TestKit PS4UPDATE PUP's for those seeking them!

You can check out all the PS3 and PS4 developer PUP file downloads on MrNiato's Blog HERE along with installation tutorials for PlayStation 3 and PlayStation 4 development console owners.

Here are the PS3 DevKit / TestKit updates he's added thus far:

PlayStation 3 DECH:

• 4.78: PS3UPDAT.PUP
• 4.76: PS3UPDAT.PUP
• 4.75: PS3UPDAT.PUP.475.001.forDEX.release.20150421 (Article)
• 4.70: PS3UPDAT.PUP.470.001.forDEX.release.20150205
• 4.65: PS3UPDAT.PUP.465.001.forDEX.release.20140813
• 4.60: PS3DECHUpdateData.460.001.zip
• 4.55: PS3UPDAT.PUP.455.001.forDEX.release.20140128
• 4.50: PS3UPDAT.PUP.450.001.forDEX.release.20130913

PlayStation 3 DECR:

• 4.60: PS3DECRUpdateData.460.001.zip
• 4.55: PS3UPDAT.PUP.455.001
• 4.50: PS3DECRUpdateData.450.001.zip
• 4.46: PS3UPDAT.PUP.446.001

Below are the PS4 DevKit / TestKit updates he's added thus far:

Download (PS4 TestKit Update):

• 3.508.041...