PS3 WebKitSploit and PS3 Playground WIP Github Forks by Esc0rtd3w

Following his PS3 OFW PSID Dump Tool Tutorial and recent d0 / d1 pdb file findings PlayStation 3 developer @esc0rtd3w (Twitter) set up some new work-in-progress Github forks for a PS3 WebKitSploit and PS3 Playground port.

Download: ps3-webkitsploit-master.zip / PS3 WebKitSploit GIT / ps3-playground-master.zip / PS3 Playground GIT / Websploit.org / PS3 Playground Test Page / PS3 Webkit POC / PlayStation 3 Browser Investigation

The PS3 WebKitSploit is based on original PS4 code from Cryptogenic and qwertyoruiopz focusing on PS3 3.xx / 4.xx code execution, while the PS3 Playground WebKit exploit port is based on CTurt and Cryptogenics PS4 code.

From the README.md file, to quote: PS3 Playground

A collection of PS3 tools and experiments using the WebKit, Flash, and other options.
We are only testing on firmware 4.81 only at the moment.

THIS REPO IS FOR THE PUBLIC PS3 COMMUNITY TO EXPLORE AND TEST ON THEIR OWN

OUR TEAM IS CURRENTLY WORKING ON THIS PROJECT PRIVATELY AND WILL UPDATE WHEN FINISHED!

FOR A LIVE DEMO WITH PUBLIC TESTS TO TRY OUT, PLEASE VISIT: http://www.websploit.org/ps3/ps3-playground/test/

There are a lot of files here for reference and exploration.

Once more testing has been done, these will be cleaned up over time.

CREDITS:

Inspired by original work from CTurt (https://github.com/CTurt/PS4-playground/) and Cryptogenic (https://github.com/Cryptogenic/PS4-Playground-3.55)

Spoiler: Original (Outdated) Information

If anyone can lend him a hand on Github that would be much appreciated, and cheers to @B7U3 C50SS, @Bultra and @spyro2670 for the heads-up in the PSXHAX Shoutbox earlier today!

 

[Reborn Persona]

Also, one more thing. To those of you asking for a software downgrade, stop, it's pointless. The REASON you would be able to system downgrade is because Kernel AND Hypervisor have ALREADY been compromised AND hey have write access to the revocation list.

...Which literally means they already would own the entire system and downgrading to a lower firmware would get you LESS features unless you area low level programmer and know how to properly use RSXPloit. So for the love of god, please stop asking for that. IDPS dumper maybe, but even that seems a bit foolish because again, that's just payload. At that point, they've already been able to patch lv2 and if they can patch lv2 they already can do MORE than you can do with the IDPS alone.

IDPS would only be useful as a hold-over until they hack further to allow full pkg installation, at that point then IDPS isn't useful anymore.

 

[Jaroslav01]

See fkn GBATemp retards reading this thread, "Patience" do u know that

 

[SSShowmik]

Like if u get kexploit on 4.81 why is there any bloody need to downgrade?

 

[ShadixAced]

The MinVer is 4.50 on super slim, what are you going to do on that firmware?

CFW2OFW 4.70 and below methods.

 

[Jaroslav01]

why would you downgrade if the exploit will be released and you can run .pkg's, no point to use those ofw things.

Edit: "IF" it will be released, and "IF" it will be able to run .pkg's

 

[ShadixAced]

1) Esc0rt and his team are working for a long time, and to be finalized it requires that everyone is OK for release, which can mean also a lot of time to wait.
2) They did not achieve a complete R/W access on the kernel yet. Better be safe than Sorry.
3) Why do you need to wait when an alternative for games can take your hand ? (+also means getting your IDPS back !)

 

[Jaroslav01]

I was here from the beginning, I know about everything, I HATE using the backup and restore method like I already said some months ago.

 

[esc0rtd3w]

@Reborn Persona great explanation of current situation! We are indeed re-using code in a ROP style in conjunction with javascript.

The soft-downgrade however has multiple benefits for many reasons and should be workable for most hardware revisions. IDPS extraction is already basically done. We are currently working on using the USB port for reading/writing dump tests using syscalls, as well as various NAND/NOR patching options.

 

[ExHoBo]

When do you think this will go public? I want to have some fun with my PS3

 

[Reborn Persona]

@Reborn Persona great explanation of current situation! We are indeed re-using code in a ROP style in conjunction with javascript.

The soft-downgrade however has multiple benefits for many reasons and should be workable for most hardware revisions. IDPS extraction is already basically done. We are currently working on using the USB port for reading/writing dump tests using syscalls, as well as various NAND/NOR patching options.

I really should have been more clear. I was primarily talking to Super-Slim users, because their minimum firmware version is high enough that it doesn't give them many extra opportunities. For people on FAT and 3.55 enabled slims, however, it would get extra benefit as you could install hard CFW with keys instead of patch based HEN, like a hardware flasher.

I apologize for not being more clear there, it was intended as a response to the people who wanted 4.70 downgrade on Super Slim for IDPS.