FTPS4: FTP Server for PS4 with SELF Dumping Support by XVortex

Following the previous PS4 4.05 FTP payloads, PS4 4.05 Root FTP Access Guide and PS4 FTP IP Set application, today PlayStation 4 developer @XVortex made available FTPS4 which is an FTP Server payload fork from IDC for PS4 with SELF dumping support that has been compiled by @JerrysShortGame.

Download: ps4-ftp-vtx-master.zip / PS4-FTP-VTX.bin (32 KB - Compiled) / ps4-ftp-vtx.bin (Compiled GIT version) / ps4-ftp-vtx.bin (Latest Version) / GIT

To quote from his recent forum post on it: "My new FTP payload. GIT

It dumps self's on-the-fly. So you just need to enter and download dumped file. Also no hex-editing is required after that."

Changelog: PS4 FTP VTX v1.1 - Dumping FTP server for PS4

• Add custom DUMP TITLE_ID command

It will dump game into /mnt/usb0

• Run payload, then game then issue custom FTP command - DUMP CUSAxxxxx
• At filezilla: Server -> Enter custom command...
  
• Make sure that you have usb drive in USB0 slot

• PS4_FTP: LibHB Port of Xerpis FTP powered by IDC and Vortes. Updated with 4.55 and 5.05 pkg samples.

Download: ps4_ftp.rar / GIT

From the Readme.txt: ps4_ftp

• Ported FTP App (Simple for now, no SELF Decryption) and made it match for libHB. It's running but have some problems with getting 'LIST'.
• I'll put it into the release so others also can have a look while i am busy. It use the usb drive for logging. Create a Folder called 'PS4FTP' into the root of your usb drive.
  
• If you want to enable debug logging, create a empty text file within 'PS4FTP' directory and rename it to 'usedebug.txt'.

Attention: The drive need to be connected before you run the app. Since the check for logging is within the preparation process.

Cheers to MagicSeb25 on Twitter for the additional details embedded above also!

 

[XVortex]

Now FTP server payload do not require any IP patches by HEX editor.
Also it is available as standalone exploit in my GIT repo.
https://github.com/xvortex/ps4-ftp-vtx

 

[showmethehax]

nice, tyvm

 

[marek256]

Hey guys,
I am planning to dump something for the community, but I am still a bit confused.

Let's say I will get over the FTP issue. I saw newer version on xvortex github and there is one step says "Dump game by issuing the custom FTP command - DUMP CUSAxxxxx, wait till completion". Does it mean that I do not need to copy anything, the script will copy everything directly to USB folder?

Thanks in advance

 

[phaedrus]

marek, yes. DUMP TITLE dump sandbox content to usb0. Make in exfat diskette extra big size, dump arrive in diskette.
Take diskette, put to windows pc, follow README steps (drop folder to gengp4, make to package make tool). It extra simple. He here test, make bad diskette with pkg that hang still after game splash.
Unclear how to tell dump 100%, perhaps too soon for move diskette.

Mentions ftp extra nice to find sandbox title easy. example CUSA00002_000, make use CUSA00002 with DUMP.

 

[phaedrus]

Xvortex, feature request? it possible make with DUMP make dump of game in /mnt/sandbox with no title on stdin? always only 1 game in /mnt/sandbox, simple code for make variable name from directory struct informations at runtime.

If no game in sandbox, tell user they idiot and forgot play game to /mnt/sandbox game for error check.

 

[apexcore]

What port number, what username should I use to connect to it using Filezilla?

 

[Divinegrace]

Thank you!!!

 

[CDNBLOODLUST]

Having issues connecting as others have said...

First of all thank you xvortex. I appreciate what you've done very much.

No ip address found in the binary as others have said. Am I just missing it somehow? Hex editing on windows using HXD (also tried frhed) and I'm not able to find anything. Checking for ipaddress using strings command also turns up nothing.

http://pastebin.com/raw/qPF4f3bM

file name: ps4-ftp-vtx.bin
mime type:

00000018: ATUS1
000001df: AUATI
000002d5: ]A\A]A^
00000300: AWAVAUATUSH
000004da: ]A\A]A^A_
000004ec: []A\A]A^A_
00000500: AVAUATUS1
000005f6: []A\A]A^
00000b44: <AtH<ItDH
00000c58: AUATI
00000d00: ATUS1
00000fc0: ATUSH
00001438: AWAVAUATUSH
0000183a: t$@ARWVAWRPASH
00001a1a: DD$0H
00001b23: t$8ATH
00001b52: ASUWVQRP
00001c85: []A\A]A^A_
00001eb0: AVAUATUS1
00002057: []A\A]A^
0000209b: []A\A]A^
00002120: AUATUSH
000022c3: []A\A]
0000230b: []A\A]
00002390: AVAUATUSH
00002a08: []A\A]A^
00003b80: AUATI
00003bc8: []A\A]
00003bf4: []A\A]
00003ca0: ATUSH
00003f30: AUATUSH
00004076: []A\A]
000040eb: []A\A]
00005703: 200 No operation ;)
00005719: 230 User logged in!
0000572f: 221 Goodbye senpai :'(
00005748: 215 UNIX Type: L8
0000575c: FTPS4_client_%i_data_socket
00005778: %hhu,%hhu,%hhu,%hhu,%hhu,%hhu
00005796: %d.%d.%d.%d
000057a2: %c %s
000057a8: 200 Okay
000057b3: 504 Error: bad parameters?
000057d0: %*[^ ] %d
000057da: 350 Resuming at %d
000057ef: 211-extensions
00005800: REST STREAM
0000580e: 211 end
00005818: FTPS4_server_sock
0000582c: FTPS4_client_%i_thread
00005853: %s/%s
00005859: 550 Invalid directory.
00005872: 226 Rename completed.
0000588a: %02d:%02d
00005899: 226 Transfer complete.
000058b2: 200 Command okay.
000058c6: 226 Transfer completed.
000058e0: 550 File not found.
000058fb: 220 FTPS4 Server ready.
00005915: 226 Directory created.
0000592e: 226 File deleted.
00005942: 226 Directory deleted.
0000595b: 550 Directory is not empty.
00005979: /user/temp.self
00005989: 550 The file doesn't exist.
000059a7: 213 %lld
000059b2: FTPS4_client_list_mutex
000059ca: FTPS4_server_thread
00005a48: 331 Username OK, need password b0ss.
00005a70: 227 Entering Passive Mode (%hhu,%hhu,%hhu,%hhu,%hhu,%hhu)
00005ab0: 500 Syntax error, command unrecognized.
00005ae0: 200 PORT command successful!
00005b00: 257 "%s" is the current directory.
00005b28: 250 Requested file action okay, completed.
00005b58: 550 Error renaming the file.
00005b78: 150 Opening ASCII mode data transfer for LIST.
00005bb0: %c%c%c%c%c%c%c%c%c%c 1 ps4 ps4 %llu %s %2d %s %s
00005be8: %c%c%c%c%c%c%c%c%c%c 1 ps4 ps4 %llu %s %2d %s %s -> %s
00005c28: 550 Could not allocate memory.
00005c50: 150 Opening Image mode data transfer.
00005c78: 502 Sorry, command not implemented. :(
00005ca8: 550 Could not create the directory.
00005cd0: 550 Could not delete the file.
00005cf8: 550 Could not delete the directory.
00005d20: 350 I need the destination name b0ss.
00005d48: 200 Shutting down...
00005d5f: fstype
00005d66: nullfs
00005d6d: fspath
00005d74: target
00005d7b: errmsg
00005d82: 550 Could not mount (%d).
00005d9e: 200 Mount success.
00005db3: 550 Could not unmount (%d).
00005dd1: 200 Unmount success.
00005de8: SHUTDOWN
00005e00: 550 Could not mount (%d): %s.
00005e20: libkernel.sprx
00005e2f: libkernel_web.sprx
00005e42: libkernel_sys.sprx
00005e55: __stack_chk_guard
00005e67: __stack_chk_fail
00005e78: __error
00005e80: sceKernelError
00005e8f: sceKernelLoadStartModule
00005ea8: sceKernelAllocateDirectMemory
00005ec6: sceKernelMapDirectMemory
00005edf: sceKernelStat
00005eed: sceKernelOpen
00005efb: sceKernelRead
00005f09: sceKernelLseek
00005f18: sceKernelClose
00005f27: sceKernelSleep
00005f36: sceKernelUsleep
00005f46: sceKernelGettimeofday
00005f5c: sceKernelGetProcessTime
00005f74: sceKernelGetCurrentCpu
00005f8b: sysctl
00005f92: sysctlbyname
00005f9f: sysarch
00005fa7: execve
00005fae: pthread_self
00005fbb: pthread_setaffinity_np
00005fd2: sceKernelCreateEqueue
00005fe8: sceKernelDeleteEqueue
00005ffe: sceKernelAddUserEvent
00006014: sceKernelAddReadEvent
0000602a: getuid
00006031: getgid
00006038: getpid
0000603f: setuid
00006046: setgid
0000604d: setreuid
00006056: setregid
0000605f: libSceSysmodule.sprx
00006074: sceSysmoduleLoadModule
0000608b: libSceNet.sprx
0000609a: sceNetSocket
000060a7: sceNetSocketClose
000060b9: sceNetConnect
000060c7: sceNetSend
000060d2: sceNetBind
000060dd: sceNetListen
000060ea: sceNetAccept
000060f7: sceNetRecv
00006102: sceNetSocketAbort
00006114: sceNetGetsockname
00006126: sceNetGetsockopt
00006137: sceNetSetsockopt
00006148: sceNetInetNtop
00006157: sceNetInetPton
00006166: sceNetHtonll
00006173: sceNetHtonl
0000617f: sceNetHtons
0000618b: sceNetNtohll
00006198: sceNetNtohl
000061a4: sceNetNtohs
000061b0: libSceNetCtl.sprx
000061c2: sceNetCtlInit
000061d0: sceNetCtlTerm
000061de: sceNetCtlGetInfo
000061ef: scePthreadCreate
00006200: scePthreadExit
0000620f: scePthreadDetach
00006220: scePthreadJoin
0000622f: scePthreadYield
0000623f: scePthreadSelf
0000624e: scePthreadCancel
0000625f: scePthreadMutexInit
00006273: scePthreadMutexDestroy
0000628a: scePthreadMutexLock
0000629e: scePthreadMutexTrylock
000062b5: scePthreadMutexTimedlock
000062ce: scePthreadMutexUnlock
000062e4: libSceLibcInternal.sprx
000062fc: malloc
00006308: calloc
0000630f: realloc
00006317: memalign
00006320: memset
00006327: memcpy
0000632e: memcmp
00006335: strcpy
0000633c: strncpy
00006344: strcat
0000634b: strncat
00006353: strlen
0000635a: strcmp
00006361: strncmp
00006369: sprintf
00006371: snprintf
0000637a: sscanf
00006381: strchr
00006388: strrchr
00006390: strstr
00006397: strdup
0000639e: rindex
000063a5: isdigit
000063b2: strlcpy
000063ba: strerror
000063c3: _Getpctype
000063ce: _Stoul
000063d5: bcopy
000063db: srand
000063e1: asctime
000063e9: asctime_r
000063f3: gmtime
000063fa: gmtime_s
00006403: localtime
0000640d: localtime_r
00006419: mktime
00006420: opendir
00006428: readdir
00006430: readdir_r
0000643a: telldir
00006442: seekdir
0000644a: rewinddir
00006454: closedir
0000645d: dirfd
00006463: getprogname
0000646f: fopen
00006475: fread
0000647b: fwrite
00006482: fseek
00006488: ftell
0000648e: fclose
00006495: fprintf

payload from here
https://github.com/xvortex/ps4-ftp-vtx/releases

Running this off my local server using lighttpd. Debug Settings is enabled but connection refused when trying to connect to ftp. Default port of 21 is used I presume?

Using locally assigned dhcp ip address of ps4...
filezilla.exe connection refused
explorer.exe connection refused
cmd.exe ftp commaned used "open address 21"

Also no real documentation available anywhere. Any help would be greatly appreciated getting ftp server running properly.

 

[Karamazov]

@CDNBLOODLUST there's no documentation but there are the sources, if not changed you should use the 'leet (1337) port and there's no IP to change in the executable because, as XVortex has explained a few posts above, the IP address is autodetected...

 

[CDNBLOODLUST]

Working now...

Ah I could've sworn I even tried port 1337 as I had seen a post mentioning it. Also I did check the source file and couldn't find it when I looked (must not have looked hard enough, but I did look).

Because I thought I had ruled out port 1337 as one of the issues I was having I ended up using nmap to check for open ports LOL. Even though I had tried that port before it somehow started working randomly.

I'm having other issues keeping the connection alive but that's another issue. I'm feeling inspired to take a closer look at the code or create my own payload now haha. Thank you.