PSXHAX - PSXHACKS

PS4 Jailbreaker Qwertyoruiopz Confirms 4.50 Kernel Read / Write Access!

Last week PlayStation 4 developer qwertyoruiopz made available a JailbreakMe PS4 4.0x Webkit exploit for OFW 3.55 through 4.07, and over this weekend he received an invite from the Rebug Team while sharing progress updates leading to confirmation of a 0day 4.50 kernel exploit obtaining R/W (Read / Write) access!

His latest JailbreakMe PS4 4.0x (Mirror via @X41) update states the exploit supports all non-4.50 Firmware, but specifically targets 4.06 currently due to ROP gadgets being hardcoded.

To recap, those on PS4 1.76 Firmware were able to make use of the Kernel Exploit Source Code that progressed to a PS4 BadIRET PoC finally leading to the 1.76 PS4 Dlclose Exploit.

For those on PS4 Firmware 4.07 or below you can use the JailbreakMe PS4 4.0x Exploit to gain userland access, and users on System Software 4.50 can rest assured a 0day 4.50 kernel exploit also exists although there is no user-level entry point for 4.50 OFW reported publicly as of yet.

Also keep in mind PlayStation 4 scene developers may decide to hold off disclosing the 0day PS4 4.50 kernel exploit much like the PS4 Pro 0day Exploit that...

PS4 Jailbreaking PSXHAX Apr 2, 2017 at 10:20 PM 60

Evilsperm of Team Rebug Invites Qwertyoruiopz to Join PS4Dev Channel

Here's to hoping everyone is having a nice April Fool's Day today, and while it wouldn't qualify as an April 1st joke since the Tweet is dated 8:17 PM - 31 Mar 2017 yesterday @evilsperm of Team Rebug sent word to JailbreakMe PS4 4.0x exploit developer qwertyoruiopz inviting him to join their private PS4Dev channel to share information privately.

Here's what the Tweet states, to quote: "@qwertyoruiopz we would like to extend an invite to our private PS4DEV chan and share some knowledge, shoot me a DM for more info. ^^ rebug"

When asked earlier today, qwertyoruiopz has yet to reply on the invitation publicly but hopefully they decide to collaborate in some capacity.

Keep in mind at this point it's just an invitation for qwertyoruiopz to join Team Rebug's PS4Dev channel to talk, and if they decide to exchange knowledge among one another it wouldn't necessarily mean a new PlayStation 4 jailbreak or PS4 CFW would result.

Cheers to @mcmrc1 for the heads up in the PSXHAX Shoutbox!

PS4 CFW and Hacks PSXHAX Apr 1, 2017 at 4:50 PM 12

PS4 *** Updated by PlayStation 4 Homebrew Developer CTurt

Following his previous PS4 Hacking work and the recent JailbreakMe PS4 4.0x exploit, PlayStation 4 homebrew developer @CTurt (Twitter) updated his open-source PS4 *** with the most recent commit details below.

Download: PS4-***-master.zip / PS4 *** GIT (CTurt) / PS4SDK GIT (Hitodama) / MSYS64.7z (51.9 MB) / MSYS64-beta2.7z (51.9 MB) / MSYS64-beta3.7z (51.9 MB)

Update libc.h

Code:

libPS4/include/libc.h

@@ -60,5 +60,6 @@ extern size_t (*fwrite)(const void * ptr, size_t size, size_t count, FILE *strea
 extern int (*fseek)(FILE *stream, long int offset, int origin);
 extern long int(*ftell)(FILE *stream);
 extern int (*fclose)(FILE *stream);
+extern int (*fprintf)(FILE *stream, const char *format, ...);
 
 void initLibc(void);

Update libc.c

Code:

libPS4/source/libc.c

@@ -53,6 +53,7 @@ size_t (*fwrite)(const void * ptr, size_t size, size_t count, FILE *stream );
 int (*fseek)(FILE *stream, long int offset, int origin);
 long int(*ftell)(FILE *stream);
 int (*fclose)(FILE *stream);
+int (*fprintf)(FILE *stream, const char *format, ...);
 
 void initLibc(void) {
     int libc = sceKernelLoadStartModule("libSceLibcInternal.sprx", 0, NULL, 0, 0, 0);
@@ -108,4 +109,5 @@ void initLibc(void) {
     RESOLVE(libc, fseek);
     RESOLVE(libc, ftell);
     RESOLVE(libc, fclose);
+    RESOLVE(libc, fprintf);
 }

Cheers to @mcmrc1 in the...

PS4 CFW and Hacks PSXHAX Mar 31, 2017 at 9:53 PM 6

ArmaGallant: Decks of Destiny PS4 on PlayStation Store Next Week

Next week's PSN update combines deckbuilding with real-time strategy and multiplayer arena battles in ArmaGallant: Decks of Destiny for PS4 on PlayStation Store.

Here's a summary from SIEA Social Media Senior Specialist Ryan Clements of what else is hitting PS Store next week!

New Releases: Week of April 4, 2017

Air Conflicts: Secret Wars Ultimate Edition - PS4 — Digital, Retail
ArmaGallant: Decks of Destiny - PS4 — Digital, Retail
Blackwood Crossing - PS4 — Digital
Bulletstorm: Full Clip Edition - PS4 — Digital, Retail (Out 4/7)
Drawn to Death - PS4 — Digital (Free with PS Plus)
Lego City Undercover - PS4 — Digital, Retail
Mortal Blitz - PS VR — Digital
PaRappa the Rapper Remastered - PS4 — Digital
Persona 5 - PS4, PS3 — Digital, Retail
Plutobi: The Dwarf Planet Tales - PS4 — Digital
Use Your Words - PS4 — Digital
Virry VR - PS VR — Digital

PlayStation Music

Ghost in the Shell (Music Inspired by the Motion Picture)
Mastodon – Emperor of Sand
G-Eazy – Step Brothers

PlayStation Video

Split (plus bonus features)
Teen Titans: The Judas Contract

PlayStation Vue

Archer- April 5 at 10/9c (FXX)
Colony- April 6 at 10/9c (USA)
Crashing- April 9 at 10:30/9:30c (HBO)

The information above is subject to change without notice.

PS4 News PSXHAX Mar 31, 2017 at 8:50 PM 0

PS4 NIDs and PS3 NIDs Added to Hashcat Bruteforcer by Jarveson

Following the PS3 FNIDS Python Scripts by PlayStation developer @zecoxao, today he let us know on Twitter that jarveson added PS4 NIDs and PS3 NIDs to his Hashcat bruteforcer password recovery utility.

Download: Hashcat v3.40 / PS4 NIDs / PS3 NIDs

Intended for developers, the NIDs can be used with the attack tool to determine PlayStation 4 and PlayStation 3 System Firmware function names.

From the README.md: hashcat

hashcat is the world's fastest and most advanced password recovery utility, supporting five unique modes of attack for over 200 highly-optimized hashing algorithms.

hashcat currently supports CPUs, GPUs, and other hardware accelerators on Linux, Windows, and OSX, and has facilities to help enable distributed password cracking.

PS4 NIDs

include/interface.h

Code:

@@ -1761,6 +1761,7 @@ int filezilla_server_parse_hash   (u8 *input_buf, u32 input_len, hash_t *hash_bu
 int netbsd_sha1crypt_parse_hash   (u8 *input_buf, u32 input_len, hash_t *hash_buf, MAYBE_UNUSED const hashconfig_t *hashconfig);
 int atlassian_parse_hash          (u8 *input_buf, u32 input_len, hash_t *hash_buf, MAYBE_UNUSED const hashconfig_t *hashconfig);
 int ps3_nid_parse_hash            (u8 *input_buf, u32 input_len, hash_t *hash_buf, MAYBE_UNUSED const hashconfig_t *hashconfig);
+int ps4_nid_parse_hash            (u8 *input_buf, u32 input_len, hash_t *hash_buf, MAYBE_UNUSED const hashconfig_t *hashconfig);
 
 /**
  * hook functions

src/interface.c

Code:

@@ -240,6 +240,7 @@ static const char HT_14900[] = "Skip32";
 static const char HT_15000[] = "FileZilla Server >= 0.9.55";
 static const char HT_15100[] = "Juniper/NetBSD sha1crypt";
 static const char HT_16110[] = "PS3 Function NIDs";
+static const char HT_16111[] = "PS4 Function NIDs";
 static const char HT_99999[] = "Plaintext";
 
 static const char HT_00011[] = "Joomla < 2.5.18"...

PS4 Jailbreaking PSXHAX Mar 30, 2017 at 3:56 PM 6

PSXHAX - PSXHACKS: PSX HAX - PSX HACKS - PLAYSTATION HAX - PLAYSTATION HACKS

PSXHAX Categories

Share This Page