PS4 Jailbreaking

Since the PS4 Filesystem Root Dump, today eXtreme posted a PlayStation 4 Model CUH-1116A Firmware 1.760.001 System Dump done via PS4 FTP complete with a File Analysis for developers to examine with the previously released Tools Package.

To quote: PS4 1.76 DUMP

PlayStation 4 - Firmware 1.76 - System Dump - Dumped Filesystem for everyone to look at it or to examine. Should be complete apart from the Sandbox directory. Dumped on FW 1.76 via FTP.

PS4 Model: CUH-1116A
Firmware: 1.760.001
Dumped: 26-04-16
Files: 1.546
Size: 789 MB

To quote from the e✘treme File Analysis page, roughly translated:

System Information (settings / System) -> name / IP address
system_data/settings/system.dat


Profile -> User
user/home/10000000/username.dat


Database -> Home Screen
system_data/priv/mms/app.db


User Application -> Icon
user / appmeta / CUSAXXXXX / icon0.png

System Application -> Icon
system_ex / app / NPXSXXXXX / sce_sys / icon0.png

Trophies -> Number
user / home / user_number / trophy / data / sce_trop / trpsummary.dat

Font
preinst / common / font / DFHEI5-SONY.ttf

Update History
user / appmeta / CUSAXXXXX / change info / changeinfo.xml

Home Menu Sound
preinst / priv / systembgm / bgm_main.at9

Login Sound
preinst / priv / systembgm / bgm_login.at9

Fault History (Settings / Control)
system_data / priv / error / history / 00000001.json


User Authentication
system_data / priv / home / 10000000 / np / auth.dat

EULA (Settings / Control)
update / eula.xml

[ATTACH type="full" alt="PS4...

Last weekend @MrNiato shared a PS4 Testkit 3.50 Firmware Demo followed by the corresponding PS4UPDATE-TestKit-GEN3-3_508_041.PUP for those with Generation 3 TestKits, and today he returns with a PlayStation 4 TestKit simple PS4 DEX Console Manager demo video!

To quote from Guillaume Leleu (MrNiato), roughly translated:

Simple Console Manager for PlayStation 4 DEX!

With simple functions like:

• connect the console.
• get information on the console.
• the restart.
• turn it off.
• the disconnect of neighborhood.
• the delete of neighborhood.

All this using the Dll ortmapi.dll. No release because it can go far...

Other:

• YouTube video: [PS4/DEX] Console Manager Software for TestKit / DevKit !
• Follow me on Instagram: https://www.instagram.com/guillaume_mrniato/
• H7K3R Website: https://www.h7k3r.fr/

[PS4/DEX] Console Manager Tool for TestKit/Devkit ! Recorded on PS4 DEX 3.508.041 FIRMWARE

Following MrNiato's PS4 TestKit 3.50 Firmware demo, today he replied with where to obtain the PS4UPDATE-TestKit-GEN3-3_508_041.PUP for other PlayStation 4 developers who own a PS4 TestKit GEN3 console.

Download: PS4UPDATE-testkit-GEN3-3_508_041.PUP (335.0 MB)

Backing up just a minute, previously we reported on the unboxing of a Sony PlayStation 4 / PS4 Debug Test Kit DUH-T1000AA, followed by a PS4UPDATE-testkit-GEN2-1_501_041.PUP, a PS4UPDATE-DevKit-GEN3-P01620590-1_750_061.PUP and also a PS4UPDATE-TestKit-GEN3-1_760_001.PUP leak.

To quote from my post in the ongoing thread with some working download links:

I've seen non-retail PS4 TestKit Generation 1 / Generation 2 / Generation 3 PUP's (like below) floating around sites including the Wiki, but unless you have a GEN1 / GEN2 / GEN3 TestKit they aren't much use.

• PS4UPDATE-devkit-GEN1-1_010_031.PUP
• PS4UPDATE-devkit-GEN2-1_020_010.PUP
• PS4UPDATE-devkit-GEN1-1_020_041.PUP
• PS4UPDATE-devkit-GEN1-1_020_051.PUP
• PS4UPDATE-devkit-GEN1-1_030_001.PUP
• PS4UPDATE-devkit-GEN1-2_508_051.PUP
• PS4UPDATE-testkit-GEN2-1_501_041.PUP
• PS4UPDATE-testkit-GEN2-1_510_011.PUP
• PS4UPDATE-testkit-GEN3-1_500_101.PUP...

Last week I noticed a new set of experiments for the PS4WebKit exploit targeting vulnerabilities in PS4 Firmware 4.01 by @Uint32Array, and recently dragood2 shared further details on it with PlayStation 4 developers.

Before we dive into that, some other recent contributions from dragood2 include news of a PS4 3.11 Out of Bound Read (Freetype 64bit Exploit) and a PS4 3.55 Full Browser FileSystem and Gadget List for those interested.

Download: PS4WebKit-master.zip / GIT / Lamashtu GIT (Mirror) / Lamashtu PS4 WebKit (Mirror)

To quote: PS4 4.01 Webkit Exploits (POC , no ROP yet)

New Alias (I have no idea XD): White0verFlow -> Uint32Array -> Lamashtu -> DonaldDuck64 (2Dork).

Had to embed his New Alias @VultraAID sick off tired Seeing people posting in Shout box That his Testing Ground was new When its not.. Its White0VerFlow just changing his name for some Odd Reason.

This repository contains all the WebKit Vulnerabilities that affect the PS4 on version 4.01 (Not tested on lower versions, but could be ported with enough development).

Keep in mind that it's not a ROP, so it won't give you access to SysModules, Dumping, FSBrowsing and all that.

It's just a Proof Of Concept of which are the vulnerabilities of WebKit for the PS4's Orbis OS version 4.01

https://github.com/Uint32Array/PS4WebKit

Credits go to Uint32Array !
Also greets to @toni1988 for sharing the memo with us in the PSXHAX Shoutbox...

Earlier this year we reported on the PS4 DevKit / TestKit Root Kernel Dump and today MrNiato (Guillaume Leleu aka H7K3R MrNiato) of the H7k3r Team (Official Site) shared a video demo of his PlayStation 4 Testkit DUH-T1000AA DEX 3.50 Firmware for those interested!

Here's what MrNiato had to say, roughly translated to quote:

PlayStation 4 TESTKIT DUH-T1000aa (DEX Official) in version 3.50. Console so wanted the normal price is a little less than a minimum wage.

Shown in the video:

• Debug Settings.
• Installation of PKG.
• Connection since the PC with neighborhood for PlayStation 4.
• Connect with a simple tool directed by sc58.

No it's not a PS4 jailbreak!!!!!
While this isn't the first time we've covered both the PS4 Development Kit (DUH-D1000AA) and PS4 Testing Kit (DUH-T1000AA) and the Activated Testing Kit, it wasn't on a version 3.50 Firmware unit which is always nice to see in the hands of developers outside of Sony.

Thanks @YamooDookie123 for the news tip in the Shoutbox!