PSXHAX - PSXHACKS: PSX HAX - PSX HACKS - PLAYSTATION HAX - PLAYSTATION HACKS

As promised, following their 33c3 2016 presentation Fail0verflow have updated their Blog with a console hacking 2016 postscript by PlayStation 4 hacker Marcan.

Slides: Online / Download / Source Code

Check it out below, to quote: Console Hacking 2016: Postscript

Another year, another console hacking talk! This talk picks off where our lighting talk last year left off, and goes into detail of how we ported Linux to the PS4.

If you haven’t watched it, take a look before reading the rest of this post:

Last year we demoed Linux on the PS4. Since then, we’ve gotten 3D graphics working, polished a number of drivers, and wrote some new ones. Linux on the PS4 is now actually quite a usable OS, with some minor caveats. We can run Steam OS and many games stably (e.g. Portal 2, but most games that run well on Linux should work). The current kernel is based on Linux 4.9.

Continuing last year’s theme of focusing on the Linux port and loader instead of on exploits, this year’s talk focused on the hardware and what it takes to bring up Linux on a very much non-PC-compatible x86 platform. We also covered how we originally got kernel binary dumps via a hardware PCI Express man-in-the-middle attack two years ago, and Radeon reverse engineering tools.

So, what’s next? Well, last year we said we’d like to upstream some of the work into the Linux kernel, and we still plan to do so. Now that the drivers have been cleaned up a bit, that is starting to look more likely.

In addition, we are working on PS4 Pro support. Linux currently boots on it, but the GPU driver needs fixups. We are also interested in adding PS4 support to the newer AMDGPU kernel driver, so it might make sense to defer graphics work on the Pro until that is ready.

The platform is mostly limited by its CPU, as the PS4 has 8 rather weak cores while most PC games are optimized for 1 or 2 fast cores. Nonetheless, even the Dolphin emulator runs surprisingly well; it currently seems to be bottlenecked on CPU geometry processing, which...

Following the previous update, PlayStation 3 developer @deank has released MultiMAN v04.81.00 today which now includes PS3 4.81 Custom Firmware support with a Stealth (aka StealthMAN) version followed by multiMAN v04.81.01 and v04.81.02 with details below.

Download: multiMAN v04.81.00

• multiMAN_04.81.00_BASE_(20161231).pkg (34.5 MB)
• multiMAN_ver_04.81.00_STEALTH_(20161231).zip (33.28 MB)
• multiMAN_ver_04.81.00_STEALTH_(20161231).zip (Mirror)
• multiMAN_04.81.00_UPD_CEX_(20161231).pkg (2.41 MB)

multiMAN v04.81.01

• multiMAN_04.81.01_BASE_(20170101).pkg (34.5 MB)
• multiMAN ver 04.81.01 BASE (20170101).pkg (Mirror)
• multiMAN_04.81.01_STEALTH.zip (33.2 MB)
• multiMAN_04.81.01_STEALTH.zip (Mirror)
• multiMAN_04.81.01_STEALTH.zip (Mirror #2)
• multiMAN_04.81.01_UPD_CEX_(20170101).pkg (2.41 MB)

multiMAN v04.81.02

• multiMAN_04.81.02_BASE_(20170108).pkg (34.5 MB)
• multiMAN_04.81.02_STEALTH_(20170108).zip (33.2 MB)
• multiMAN_04.81.02_STEALTH_(20170108).zip (Mirror)
• multiMAN_04.81.02_STEALTH_(20170108).zip (Mirror #2)...

Previously we linked several guides for Dumping PS4 PKG Files, and with Select PC Drives outlined HERE people have been dumping (minus decrypting) PS4 games since late 2013... but if you have a 1.76 OFW console you can also dump disc-based games from the PlayStation 4 itself thanks to a brief guide from e✘treme-Modding.de alongside some DiscDump 50X Payloads that copy the disc content to a USB HDD!

To quote, roughly translated: Dump Disc Games on PS4 1.76

Since not every drive reads PS4 disc games, there is the possibility to read the content via the PS4.

1. Insert the PlayStation 4 game disc
2. Open the game and create an FTP connection
3. The contents of the disc are located under / mnt / disc


To copy the files, the game must remain open. The original size of the app.pkg is not displayed during the transfer.

Converting Disc-based PS4 Games Into Digital Games 4.05 WebKit Exploit
How to Convert PS4 Game Disc to PKG Format
DUMP YOUR PS4 GAMES FOR PS4 4.05 JAILBREAK | PLAY FREE PS4 BACKUPS GAMES WITHOUT DISCS !
Download: dumpPS4Games.rar (10.7 MB)

Finally, here is one more guide from Thibobo (Twitter) on How to Dump Your Own...

Following the PS4 Linux 33c3 Demo and the start of a community-driven PS4Webkit Project, today I (@juansbeck on Twitter aka HybridComputers) am continuing from my UniversalFlash App work-in-progress bringing an update on the PlayStation 4 glitch pinout used by Marcan and the possibility to downgrade a PlayStation 4 Slim / PS4 Pro with details below.

Rough translation: Failoverflow's Marcan made a 'glitch' attack TOOL0 combined other ports like RX and TX (rs232) to PS4 Southbridge (sysconf-hypervisor) to give read and write permissions to its devboard lattice ECP3 to intercept the signals and return them in a Payload as we showed CTurt in its extensive article, but how?

Anyone can give us the datasheet? Or if at PSDevWiki oops... the blessed datasheet is a farce. It's a troll from a dodgy blog... one has to be very stupid to believe that the r32c is the hypervisor to attack Marcan... not even the VSS nor the VCC agree

Never fool us, not all the other developers that have their functional CFW that the downgrade key or the way we can get to exploit versions 3.55, 4.01, 4.05 or whatever is in this simple sysconf RL78G14 there are 100 pin and 64 and even less as it is ps4 pro the chip is from the company renesas company and although it cost us more 8 months without sleeping here I attach the datasheet, I can say that there is a pin the TOOOL0 credits (JaiCraB) which is the evolution of RX and TX.

For now the datasheet of sysconf and a small drawing for the devs who want to investigate meanwhile we do ours to keep this team that continues adding more than 8,000 euros a month I tell you why not everything is lost, here we keep moving forward and something has to come out of this.

This can be used to find a way to downgrade to the minimum version of any PS4 (including PS4 Pro)

1. Correct hypervisor...

Earlier this week we reported on Fail0verflow's demonstration at 33c3 2016, and today Marcan shared another brief video demo of the Nintendo GameCube / Wii Dolphin Emulator running via PS4 Linux on their exploited 4.05 console.

Below is the PlayStation 4 Linux Dolphin Emulator demonstration video along with some related Tweets:

Thanks to @B7U3 C50SS, @Shodan, @SpardaFTW and @VultraAID in the PSXHAX Shoutbox for sharing the news!