PSXHAX.COM website and domain for sale. Contact Us with your offer!
New FreeBSD Kernel Exploit Discovered by PS4 Developer CTurt
Following his announcement of a Kernel Exploit for FreeBSD 10.2, today PlayStation 4 developer CTurt revealed news of a new FreeBSD kernel exploit which he says will be published for PS4 developers to examine once the security team patches it.

Below are the related Tweets:


As always, we'll add updates to this article as they become available! :)
PS4 Development Menu (Debug Mode) Enabled on Retail PlayStation 4
Just over a week ago we heard rumors of accessing the PS4 Debug Mode Settings on retail PlayStation 4 consoles, and today scene developer CTurt confirmed it's now possible to access the PS4 Dev Menu on 1.76 retail units thanks to Flat_z! :D

Download: Enable Dev Menu / PS4-dlclose.zip / PS4-debugmenu.bin (1.0 MB Compiled) via fx0day / PS4-debugmenu.bin (1.0 MB Compiled) via Di_Scala_ / Tutorial by Chaos Kid / PS4-dlclose GIT

From Stuart Fox via Facebook comes a video demo also.

:arrow: Update: From lezek20 also comes code to enable the more advanced debug menu (dlclose.bin (1.00 MB) compiled by ultradogg), to quote:
Code:
*(char *)0xFFFFFFFF833242FD = 0x81;
Just add it into the kernel payload before this part:
Code:
...
PS4 Webkit Exploit PoC for PlayStation 4 Firmware 2.XX by Fire30
Following news of the PS4 Dlclose Exploit for 1.76 and more recently the Entry Point findings, today Wololo reports that PlayStation 4 developer Fire30 made available on Github a PS4 Webkit Exploit proof-of-concept for PlayStation 4 Firmware 2.XX.

Download: PS4-2014-1303-POC-master.zip / PS4-2014-1303-POC GIT

From the ReadMe file: CVE 2014-1303 Proof Of Concept for PS4

This repository contains a poc for the CVE 2014-1303 originally disclosed by Liang Chen. It has been tested to work on system firmware 2.03, but should work for systems on a firmware < 2.50, the ROP test will however only work on 2.03.

Usage

You need to edit the dns.conf to point to the ip address of your machine, and modify your consoles dns settings to point to it as well. Then run
Code:
python fakedns.py -c dns.conf
then
Code:
python server.py
Debug output will come from this process.

Navigate to the User's Guide page on the PS4 and various information should be printed to the console. The ROP test will print what is stored in the rsp register. Continuing execution after rsp is pivoted still needs to be done.

Acknowledgements

Liang Chen
thexyz
dreadlyei

Fire30 also notes, to quote: This implementation will not work on the vita as it uses a different memory allocator. In fact I am using the same exploit that is used in https://github.com/Hykem/vitasploit for 3.36, so that is the farthest this vulnerability will go.

Thanks to CnCore for the tip in the PSXHAX.COM Shoutbox! :D

PS4 3.15 Firmware Entry Point for Testing from Zecoxao
Following the recent PS4 Dlclose Exploit for 1.76 Firmware, today I'd like to share a talk between zecoxao and Zer0xFF on finding an entry point for testing with PS4 Firmware 3.15 and also 3.50.
@zecoxao seems to be working on an entry point for the PS4 3.15 FW and wants some testers :)
1. Entry point:
Code:
<iframe></iframe><object onbeforeload="crash()">
    <script>
    if (window.testRunner) {
        testRunner.dumpAsText();
        testRunner.waitUntilDone();
    }

    function crash() {
        document.getElementsByTagName("iframe")[0].contentWindow.scrollX;
        document.open();
    }

    document.body.offsetLeft;
    setTimeout(function() {
        document.close();
        document.body.innerHTML = 'PASS if not crashed.';
        testRunner.notifyDone();
    }, 1);
    </script>
2. Entry point:
Code:
<input id="t1" type="time">
    <script>
    var time1 = document.getElementById('t1');
    document.addEventListener('beforeload', function(event) {
        time1.value = time1.value ? '' : '23:59';
    }, true);

    if (window.testRunner) {
        testRunner.dumpAsText();
        testRunner.waitUntilDone();
    }
    setTimeout(function() {
        document.body.innerHTML = 'PASS if not crashed.';
        testRunner.notifyDone();
    }, 100);
    time1.focus();
    </script>
    <embed src="data:text/html,PASS"></embed>
Also the the source code from the Webkit from Sony ;)
PS4Link Library Updated by BigBoss with LDR Creation and More!
Since the last revision, PlayStation 4 developer BigBoss has updated the PS4Link library which allows PS4 to communicate and utilize a host file system with the PS4Client host tool.

According to the developer, PS4Link is now updated with ldr creation and information to do it yourself :)

Download: ps4link-master.zip / PS4Link GIT

From the ReadMe file: PS4LINK FOR PS4

What does this do?

PS4Link is a group of tools (libps4link, libdebugnet, ps4sh) for PS4 and host. It is the same method that we used in ps2dev days, so basically it is the same protocol than ps2link and ps2client have been using since 2003.

Functions available are defined like native sce functions so it is easy for homebrew developer to use these new functions:

FILEIO functions
Code:
  int ps4LinkOpen(const char *file, int flags, int mode);
  int ps4LinkClose(int fd);
  int ps4LinkRead(int fd, void *data, size_t size);
  int ps4LinkWrite(int fd, const void *data, size_t size);
  int ps4LinkLseek(int fd, int offset, int whence);
  int ps4LinkRemove(const char *file);
  int ps4LinkMkdir(const char *dirname, int mode);
  int ps4LinkRmdir(const char *dirname);
  int ps4LinkDopen(const char *dirname);
  int ps4LinkDread(int fd, struct dirent *dir);
  int ps4LinkDclose(int fd);
Remote Commands functions

1) execelf

This command let you load and exec elf files compiled with libps4. Check samples directory.

2) execsprx

Right now do nothing

3) execwhoami

Show you uid and gid

4) execshowdir

Let you list filenames in directory. With ftp server you will not need it

5) exitps4

Try to close ps4link resources. If you try to run ps4sh again when all is released you will get a messager saying that it can't connect. Now you can leave ps4 browser.

check ps4link_internal.h and commands.c to see how can you implements new commands

How do I use it?

1) Configure your environment:

You will need:
  • [clang] 3.7 or upper i tested it on freebsd and osx. For osx :

    For osx only (you will not need this for freebsd):

    Downloading clang
    Code:
    cd...
Back
Top