PSXHAX.COM website and domain for sale. Contact Us with your offer!
PS4 3.11 Out of Bound Read (Freetype 64bit Exploit) via Dragood2
Despite Sony releasing PS4 Firmware 3.15 last night, dragood2 recently uncovered a PS4 3.11 Out of Bound Read (Freetype 64bit Exploit) that reportedly isn't patched in System Software Update 3.15.

Download: 38662.zip (Proof of Concept) / Source Code

Below are the details, although the usefulness of this has yet to be determined by PS4 developers, to quote:

The following heap-based out-of-bounds memory read has been encountered in FreeType. It has been reproduced with the current version of freetype2 from master git branch, with a 64-bit build of the ftbench utility compiled with AddressSanitizer:
Code:
$ ftbench <file>
Attached are three POC files which trigger the conditions.
Code:
---
$ freetype2-demos/bin/ftbench asan_heap-oob_783b6f_6837_eb01136f859a0091cb61f7beccd7059b

ftbench results for font `asan_heap-oob_783b6f_6837_eb01136f859a0091cb61f7beccd7059b'
-------------------------------------------------------------------------------------

family: (null)
style: (null)

number of seconds for each test: 2.000000

starting glyph index: 0
face size: 10ppem
font preloading into memory: no

load flags: 0x0
render mode: 0

CFF engine set to Adobe
TrueType engine set to version 35
maximum cache size: 1024KiByte

executing tests:
Load =================================================================
==22366==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000eb55 at pc 0x00000069e2fc bp 0x7fffc4670610 sp 0x7fffc4670608
READ of size 1 at 0x60200000eb55 thread T0
#0 0x69e2fb in tt_sbit_decoder_load_bit_aligned freetype2/src/sfnt/ttsbit.c:834:19
#1 0x69d214 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1145:15
#2 0x69b1bf in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1340:12
#3 0x69eee2 in tt_sbit_decoder_load_compound freetype2/src/sfnt/ttsbit.c:932:15
#4 0x69d214 in tt_sbit_decoder_load_bitmap freetype2/src/sfnt/ttsbit.c:1145:15
#5 0x69b1bf in tt_sbit_decoder_load_image freetype2/src/sfnt/ttsbit.c:1340:12
#6 0x6893d2 in tt_face_load_sbit_image freetype2/src/sfnt/ttsbit.c:1506:19
#7 0x55d265 in load_sbit_image...
Linux PS4 Kernel Released by Fail0verflow, Work-In-Progress
Following their Linux PS4 Demo, today PlayStation 4 hackers fail0verflow released their Linux PS4 Kernel work-in-progress repo on Github.

Download: ps4.zip / GIT

From Twitter:

Also from Wololo on the WIP, to quote:

Linux on PS4: Fail0verflow publish their fork of the linux Kernel (WIP)

After announcing earlier this week that they managed to run Linux on the PS4, the Fail0verflow hacking crew promised they would publish their sources once in a stable state. They just published a github link on twitter, which contains their PS4 fork of the Linux Kernel.

What is this PS4 Linux source code, and is it useful for me?

Unless you’re a PS4 hacker with a Kernel exploit in your possession, these sources will most likely not be useful for you at this point. Fail0verflow have explained during the CCC conference that although they will actively work on providing a Linux port for the PS4 community, they will not provide the hacks/Jailbreaks/exploits they used to install and run it in the first place.

We know that several PS4 hacking groups have PS4 exploits running, so it will be interesting to see what these groups do with this newly announced github repository. For the individual reader, you’ll want to check who forks the Fail0verflow github, as a hint to whom might have running exploits ;)

For those of you interested to jump into the code and understanding what changes Fail0verflow have been working on, the best way is probably to look at the full diff of the PS4 Linux port compared to the base.

When will Linux for the PS4 be released?

For the “end user”, you’ll still have to wait for several things to happen before any of this gets released: this Linux port to be finalized, a group of hackers to release a working PS4 Jailbreak, and someone connecting the dots together between the exploit and booting Linux. Don’t hold your breath, but this might happen sooner than most think.
...​
Linux on PS4 Demo Running Pokemon from Fail0verflow!
Following their recent updates, today PlayStation 4 hackers fail0verflow revealed Linux on PS4 running a Pokemon demo video from the Chaos Communication Congress (CCC) hacking conference!

ps4_jailbreak_NOP_command_southbridge_marvell.jpgBelow is their most recent tweet and further details from Wololo as follows:

  • The PS4 hack entry point runs through what seems to be a Webkit exploit. It is likely they are running the hack on a 1.76 PS4 because of that, but it is also very possible that their exploit runs on higher firmwares (and they’re just using the PS4 Webkit 1.76 entry point for convenience).
  • Fail0verflow hint at critical bugs in the southbridge of the GPU, but do not give more details on the exploit in their presentation, besides “NOP Command is broken on the GPU”.
  • We’re getting conflicting signals on that: it is also possible this is a software hack (a Kernel exploit in the PS4 firmware), running on top of the Webkit 1.76 exploit.
  • Assuming a new userland exploit (similar to the webkit one) was found on recent firmwares, this whole thing could run on recent PS4 firmwares without any hardware mod.
ps4_jailbreak_release.jpgThe original video and announce can be found on the CCC Relive page, the Fail0verflow part is at 1:31:30 in the video.

Check out the PS4 Linux Fai0verflow demo below!


Emulator_on_ps4-Pokemon_on_PS4.jpgFrom zecoxao on IRC: [zecoxao] http://pastie.org/private/diiuzokimhkb1pqjaagm4w
Code:
there was an early hw hack for ps4 that I know of
very affordable too
basically it relies on the ps4 using off the schelves gddr5
and using a "recent" pc gpu card
to dump the chips content
requires tons of soldering though
but a friend of mine did it
doesn't cost much more than the ps4, the gpu and the soldering iron
he used a fpga board to do the switch
but you can use anything else really
allows to dump even recent kernel/modules
thought you might want to know
you can't gain code execution this way btw...
Some Brief PS4 Hacking Updates from Fail0verflow
Following their recent CCC hints of Penguins on Aeolia, console hacking team fail0verflow sent some more brief PS4 hacking update Tweets out.

Check them out below, although there is still no definitive confirmation demo of Sony's PlayStation 4 being able to run Linux just yet.

PS4 Filesystem Root Dump, Linux, Fail0verflow & CCC
Hello... it appears a brief presentation from Marcan of Fail0verflow will be shown at this year's Chaos Computer Club (CCC) covering Penguins on Aeolia (Embedded Linux) on the PS4 :)

:arrow: Update: PS4 3.55 Full Browser FileSystem and Gadget List

From Wololo: Zecoxao, who's very close to the PS3/PS4 dev scene, shared a screenshot on Twitter, showing some reverse engineering work on what appears to be PS4 system files:
Aeolia.png


Finally, GregoryRasputin posted a screenshot of a PS4 Filesystem Root Dump with details below, which has been confirmed by PlayStation 4 developer Lucif3r as follows:

From GregoryRasputin: Christmas is a time for loving and sharing, it is about spending time with the family and enjoying their company, which is why i am happy to let the PlayStationHaX family know that a little Christmas elf popped in to see me today and showed me something wonderful:

PS4_Root_Dump.png

Of course with these being confidential Sony files, i cannot and will not link to any files. You can read about work into hacking the PS4, you can check these links:
For those wondering, yes, this was released today. Edited title to clear some things up a bit.

According to zecoxao regarding the PS4 dump: Apparently it's on a pastebin. Cleverly hidden...

:idea: If anyone runs across it, feel free to share it here... this way the entire PS4 scene can benefit from it rather than a limited number of people. ;)

Download...
Back
Top