PSXHAX.COM website and domain for sale. Contact Us with your offer!
PS4Dev: E3Mode Update by ZiL0G80 for PS4 Developers
Previously ZiL0G80 hinted briefly on the PS4 IDU Mode / E3Mode, and today he shared a bit more of his findings with other PlayStation 4 developers on the PS4 E3Mode via Pastebin.com. (y)

Here are a few related Tweets, and below is the code as he warns the Pastebin will expire in 24 hours:

Code:
using System;
using System.Collections.Generic;
using System.Runtime.CompilerServices;
using Sce.PlayStation.HighLevel.UI2;
using Sce.Vsh.Accessor;
using Sce.Vsh.Accessor.Db;
using Sce.Vsh.Lx;
using Sce.Vsh.ShellUI.AppSystem;
using Sce.Vsh.ShellUI.Lnc;

namespace Sce.Vsh.ShellUI.AppMain
{
    // Token: 0x0200000D RID: 13
    [Aot]
    public class E3Mode
    {
        // Token: 0x060000B2 RID: 178 RVA: 0x00004C6A File Offset: 0x00002E6A
        public static void Start()
        {
            if (ShowMode.Enable)
            {
                E3Mode.s_enableAutoBoot = true;
                E3Mode.CreateDimmerScreen();
                E3Mode.StartMonitorPsImpose();
            }
        }

        // Token: 0x060000B3 RID: 179 RVA: 0x00004C83 File Offset: 0x00002E83
        public static void StartFarsightUI()
        {
            if (ShowMode.Enable && E3Mode.s_enableAutoBoot)
            {
                E3Mode.StartAutoBoot();
            }
        }

        // Token: 0x060000B4 RID: 180 RVA: 0x00004C98 File Offset: 0x00002E98
        public static bool IsEnableAutoBoot()
        {
            return ShowMode.Enable && E3Mode.s_enableAutoBoot;
        }

        // Token: 0x060000B5 RID: 181 RVA: 0x00004CA8 File Offset: 0x00002EA8
        private static void Stop()
        {
            E3Mode.s_enableAutoBoot = false;
            E3Mode.DestroyDimmerScreen();
            E3Mode.StopMonitorPsImpose();
        }

        // Token: 0x060000B6 RID: 182 RVA: 0x00004CBC File Offset: 0x00002EBC
        private static void CreateDimmerScreen()
        {
            if (E3Mode.s_dimmerScreen == null)
            {
                E3Mode.s_dimmerScreen = new Scene
                {
                    Focusable = false
                };
                E3Mode.s_dimmerScreen.RootWidget.AppendChild(new Panel
                {
                    BackgroundColor = new UIColor(0f, 0f, 0f, 1f)...
Ryan111 PlayStation 4 4.00 WebKit Development Update
All day PS4 dev @ryan111 (PS4Work Blog updates from him HERE and HERE) has been working on a PlayStation 4 4.0 jailbreak, and has come across a "command" in the web browser about: that gives you info about it.

Which reads:
Code:
AppVersion 5.0 (Playstation 4 4.00) AppleWebKit/537.78 (KHTML, like Gecko)
UserAgent Mozilla/5.0 (Playstation 4 4.0) AppleWebKit/537.78 (KHTML, like Gecko)
Language en-US
OnLine true
Now i did some research on this and this is what i came up with.

https://user-agents.me/useragent/mozilla50-macintosh-intel-mac-os-x-10_9_4-applewebkit537782-khtml-like-gecko-version706-safari537782

Which is about the WebKit and:

https://www.cvedetails.com/vulnerability-list/vendor_id-452/product_id-3264/version_id-112576/Mozilla-Firefox-5.0.html

Which are vulnerabilities for Mozilla 5.0.

Now im not sure if this has already been found but this is the first of me hearing it. Wanted to post this for people so they could know devs are working on a 4.0 JB and never give up hope.

Finally, below are some related Tweets from PlayStation 4 developer CTurt and the ReadMe file from the work-in-progress PS4 Playground 4.00 GIT via darkslake, to quote:

PS4 4.00 Unsigned Code Execution

This GitHub Repository contains all the necessary tools for getting PoC Unsigned Code Execution on a Sony PS4 System with firmwares 3.15, 3.50, 3.55 and 4.00-exploit-ps4.
This Exploit, is based-off Henkaku's WebKit Vulnerability for the Sony's PSVita. It includes basic ROP and is able to return to normal execution.

Pre-Requisites:
  1. A PC
    1. Running Windows, macOS or Linux
    2. A already set up basic server where the PS4 User's Guide launcher will point for loading the payload
    3. Python 2.7.X
      • Python 3.X gives problems, since they included major changes on the syntax and on the libraries in comparison with 2.7
  2. A Sony PlayStation 4
    1. Running the following firmwares:
      • 4.00...
PS4 3.55 Full Browser FileSystem and Gadget List by Dragood2
A few months ago we saw a PS4 3.55 File Browser by theorywrong, and now PlayStation 4 developer dragood2 with help from @xerpi revealed the PS4 3.55 Full Browser FileSystem alongside an Extensive Gadget List below, to quote:

PS4 3.55 Full Browser FileSystem and Extensive Gadget List
Code:
d /.
d /..
d /dev
    c /dev/dipsw
    c /dev/dmem0
    c /dev/dmem1
    c /dev/dmem2
    c /dev/ctty
    c /dev/deci_stdout
    c /dev/deci_stderr
    c /dev/deci_tty2
    c /dev/deci_tty3
    c /dev/deci_tty4
    c /dev/deci_tty5
    c /dev/deci_tty6
    c /dev/deci_tty7
    c /dev/deci_ttya0
    c /dev/deci_ttyb0
    c /dev/deci_ttyc0
    c /dev/deci_stdin
    c /dev/bpf
    l /dev/bpf0
    c /dev/bt
    c /dev/hid
    c /dev/sce_zlib
    c /dev/null
    c /dev/zero
    d /dev/fd
    l /dev/stdin
    l /dev/stdout
    l /dev/stderr
    c /dev/hmd_cmd
    c /dev/hmd_snsr
    c /dev/hmd_3da
    c /dev/hmd_dist
    c /dev/random
    l /dev/urandom
    c /dev/gc
    c /dev/dce
    c /dev/dbggc
    c /dev/ajm
    c /dev/uvd
    c /dev/vce
    c /dev/notification0
    c /dev/notification1
    c /dev/usbctl
    c /dev/camera
    c /dev/rng
d /system_tmp
    d /system_tmp/.
    d /system_tmp/..
    s /system_tmp/GnmCompositor
    s /system_tmp/GnmCompositorRestricted
    s /system_tmp/mdbg0_dbgp
    s /system_tmp/gpvdec_arbitrator
    s /system_tmp/gpvdec_proxy
    s /system_tmp/gpvenc_proxy
    - /system_tmp/bds_state0
d /d2j1O2RRXT
    d /d2j1O2RRXT/.
    d /d2j1O2RRXT/..
    d /d2j1O2RRXT/common
        d /d2j1O2RRXT/common/.
        d /d2j1O2RRXT/common/..
        d /d2j1O2RRXT/common/lib
            d /d2j1O2RRXT/common/lib/.
            d /d2j1O2RRXT/common/lib/..
            d /d2j1O2RRXT/common/lib/remote-web-inspector
                d /d2j1O2RRXT/common/lib/remote-web-inspector/.
                d /d2j1O2RRXT/common/lib/remote-web-inspector/..
                d /d2j1O2RRXT/common/lib/remote-web-inspector/css
                    d /d2j1O2RRXT/common/lib/remote-web-inspector/css/.
                    d /d2j1O2RRXT/common/lib/remote-web-inspector/css/..
                    - /d2j1O2RRXT/common/lib/remote-web-inspector/css/inspectorManx.css...
PlayStation 4 Payload Port Fails, Specter Sends PS4 Back to Jail
Last weekend Twitter blew up with reports of a PlayStation 4 Payload Port work-in-progress from Specter of the PS4Console project, but alas today he announced that the PS4 payload idea didn't work out and for the time being Sony's black box is going back to jail. :X3:

You can read the full article entitled [PS4] A Remote Shell? Go Directly to Jail on Specter's Development Blog, and below is an excerpt from the summary to quote:

"Looking back, in hindsight I feel like I should have known better that this wouldn't have worked because of the jail, but as pointed out by a friend, it's not a complete loss. If we do break out of the jail via a kernel exploit one day, perhaps this could be of some use (partially why I still posted this article). I also grew a lot and learned a lot throughout this little endeavor, and I ended up surprising myself at how much I would be able to keep going despite hitting the walls that I did.

After all, this is what exploitation is all about, having an idea, trying it, and seeing if it works - never make assumptions about a system. Sometimes you'll end up following paths that lead to a dead-end, but that doesn't mean it was all for nothing. Maybe someone else can learn from my mistakes too - I sure have.

I might take a step back and take a break from PS4 stuff for a while though and focus on learning some more in regards to exploitation and the linux kernel for the time being though."
PS4 ShellUI Debug Functions Revealed & Kernel Dumped by OwlBin
Earlier this year PlayStation 4 developers enabled the PS4 Development Menu and PS4 Debug Mode Settings with hints of a mini PS4 Debug Settings Menu, and today OwlBin revealed all of the PS4 ShellUI Debug Functions after dumping his PS4 1.76 Kernel this past June followed by a SceShellUI NETFramework Dump. :ninja:

Below are the related Tweets and Pastebins:

PS4 ShellUI DEBUG
Code:
Sce.Vsh.ShellUI.GameLiveSpectator.GlsSpectatorGuiBaseScene__SetDebugLabelOnFooter                               seg000 0000000000007170 00000078
Sce.Vsh.ShellUI.LoginMgr.LoginMgrSceneBase__get_DebugAutoLogin                                                  seg000 0000000000008DF0 0000000C
Sce.Vsh.ShellUI.Settings.VideoSettings.Debug__Printf                                                            seg000 000000000001E100 00000007
Sce.Vsh.ShellUI.Settings.VideoSettings.Debug__WrnPrintf                                                         seg000 000000000001E110 00000007
Sce.Vsh.ShellUI.Settings.VideoSettings.Debug__FuncStartLog                                                      seg000 000000000001E120 00000001
Sce.Vsh.ShellUI.Settings.VideoSettings.Debug__FuncExitLog                                                       seg000 000000000001E130 00000001
Sce.Vsh.ShellUI.TopMenu.Nsx.Debugger__DebugPrint                                                                seg000 0000000000035E30 00000001
Sce.Vsh.ShellUI.TopMenu.Nsx.Debugger__.ctor                                                                     seg000 0000000000035E40 00000007
Sce.Vsh.ShellUI.TopMenu.NsxUncachedUpdater.Debugger__DebugPrint                                                 seg000 0000000000036D10 00000001
Sce.Vsh.ShellUI.TopMenu.NsxUncachedUpdater.Debugger__.ctor...
Back
Top