Category PS4 CFW and Hacks       Thread starter PSXHAX       Start date Jan 11, 2018 at 8:47 PM       12,077       33            
Following the 1.76 demo videos, 4.05 PS4 Kernel Exploit and PS4 4.05 Game Modding Payload alongside his Full Debug Settings Payload, today PlayStation 4 developer @2much4u made available a PS4 GTA V Native Caller via Twitter while @0x199 released a Nice Fly PS4 4.05 Game Mod and Firebreather PS4 4.05 Mod for GTAV 1.00 on Twitter proceeding his other PS4 game mods. :D

Download: PS4-GTA-V-Native-Caller-4.05.zip / GIT / nicefly_405.bin (17 KB) / firebreather_405.bin (14 KB) / PS4 GTA V Native Caller 4.05 Byroms Edit.rar (8 KB) by mb2010

For the Nice Fly PS4 4.05 Game Mod, he notes to quote: "Hold Square to fly. Once flying, hold R2 to boost. As a small addon, this version also enables North Yankton. Enjoy!"

For the Firebreather mod on PS4 4.05 for GTAV 1.00 he states: "Simply press R1 to breathe fire (don't press too many times). Ported from PC by me, credits to Kokolaty for originally developing this mod."

And from the README.md, to quote: PS4 GTA V Native Caller

A simple example of calling natives on PS4 GTA V using idc's adaptation of CTurt's PS4 ***.

Brief Explanation

Purpose

A large part of GTA V is controlled by custom script files Rockstar writes in their own format. A virtual processor is included in each version of the game to interpret these scripts. The main way for them to interact with and control the game is to invoke natives. Natives are functions defined within the game's executable. In the same way that scripts use natives to control the game, arbitrarily calling them will allow the caller to control the game to his/her desire. The purpose of this payload is to provide an easy way of doing just that. It includes a few small examples: making the player invincible, giving the player super jump, and teleporting the player when a button combination is pressed.

Setting Up Execution

First, a kernel payload is executed to escape the sandbox, escalate the web browser's privileges, and make appropriate kernel patches. The kernel payload also disables ASLR for newly created processes, making it much easier to modify them. Afterwards, the browser payload constantly checks the running processes waiting for one called eboot.bin. Once a game process is found, the syscall ptrace is used to read and write to it. With ASLR disabled, the EBOOT always starts at 0x400000 in memory. A few bytes are read from the EBOOT to verify that the game is GTA V and to detect the region.

Functions for making syscalls, invoking natives, and setting up the environment are copied into free executable space within the EBOOT. The native IS_PLAYER_ONLINE is hooked with the function to set up the execution environment. This function allocates more memory within GTA's process since the EBOOT has limited space. Once this setup function is called from GTA, the browser payload copies a standard main function into that newly allocated space and exits.

Executing Inside GTA V

Once executing within GTA V, a structure called gtaVars is declared in some arbitrarily allocated memory to keep track of global variables. The native table has the same structure as on other platforms, making it easy to work with. The native hashes on PS4 GTA V 1.00 are also the same as the 1.00 native hashes on PC, meaning the documentation on NativeDB can be used. The majority of the code in nativeHook is filtered to only execute once a frame (IS_PLAYER_ONLINE is called multiple times a frame), in order to keep things smooth. This will be more important for any drawing.

Restrictions

Functions

Functions called from nativeHook must be always inline or GTA will crash. This is because when compiled, nativeHook will expect those functions to be at specific locations relative to itself. Once nativeHook is copied to a different location, those relative addresses will be incorrect. The exceptions to this are functions declared in the payload by their absolute address such as invokeNative.

Strings

Since nativeHook is copied to a different location, strings will have the same relative address issue as called functions. A simple way around this is to define them on the stack like:
Code:
const char helloWorld[] = "hello world";
This is necessary so the compiler does not place the string in the data segment.

Global Variables

Global variables also have the same relative address issue. In order to mitigate this, keep track of global variables with the gtaVars structure defined in gta.h.

Space

By default 0x10000 bytes will be allocated for nativeHook and 0x4000 bytes for gtaVars. These sizes can be adjusted if need be.

Multiple Instances

When executed multiple times, the payloads will replace each other rather than executing simultaneously.

Miscellaneous Notes

Natives

Only a few natives are defined in natives.h. However, more can be defined as necessary.

Buttons

Button ID's for PS4 were different than last gen and PC so a simple mapping of them is included. Button_Tpad_X and Button_Tpad_Y can be used with the natives GET_CONTROL_VALUE and GET_CONTROL_NORMAL for touchpad input. Button_Tpad is just for if the touchpad is pressed.

Testing

Since this payload injects functions into EBOOT memory, different versions of the payload can be tested without having to restart GTA.

Closing Remarks

This is a fairly primitive way to go about modding a game, expect some strange and quirky bugs while using this.

Credits

Specter, CTurt, qwertyoruiopz, flatz, idc, SKFU, droogie, Xerpi, bigboss, Hunger, Takezo, and Proxima - PS4 research making all this possible

Alexander Blade and NativeDB Contributors - Native research making GTA V stuff relatively easy to port to PS4

This includes the necessary kernel patches to get ptrace working. I know many devs have been struggling with that. Also, the payload now allocates memory within gta to eliminate the limited space issue that existed on the 1.76 version.
Don't forget to recompile idc's payload *** before using this. He pushed an update today that added support for the kexec syscall which is needed for this payload.
PS4 4.05 Mod - GTA V Nice Fly Mod
GTA V Firebreather MOD Thanks to 0x199, 2much4u, seb5594 (PS4 4.05) by GrimDoe
GTA V Nice Fly Mod Overview 4.05 PS4
Thanks to both @B7U3 C50SS and @offLife for the news tips in the PSXHAX Shoutbox tonight! <3
GTA V Native Caller by 2much4u, Nice Fly PS4 4.05 Game Mod by 0x199.jpg
 

Comments

Nesterwork

Senior Member
Contributor
My GTA just gets stuck at loading 90% on the first loading screen >.<


after leaving it for about 10 mins it loaded but the mod does not work for me, tried loading the mod before and after loadin GTA also though IDC and specters exploit, through local host and PS4-Exploit-Host, :'(
 

offLife

I miss geohot
Senior Member
Contributor
I think you need GTA V 1.00

I have 1.20 myself and I also can’t seem to get it to work. Also since it’s a psn version i can’t downgrade or anything
 

offLife

I miss geohot
Senior Member
Contributor
Did you send the payload before or after launching gta 5? And is it permanent or do you need to send the payload again after?
 
Recent Articles
JoystickUDP: Collection of Methods Using a PS4 Controller with UDPComms
Recently StanfordRoboticsClub shared on Github a collection of methods using a DualShock 4 PS4 Controller with UDPComms, which is a Python library to enable communication between different...
Star Wars Jedi: Fallen Order Joins New PS4 Game Releases Next Week
Explore the galaxy in the latest PlayStation 4 third-person action-adventure game Star Wars Jedi: Fallen Order from Respawn Entertainment arriving to PS4 next week on November 15th. Play as an...
Feel The Power of Pro with PlayStation 4 Pro Latest PS4 TV Spot!
Right behind their It's Time to Play! campaign and Black Friday Deals, Sony is ramping up PlayStation promotions for the holidays with the latest PS4 TV spot showcasing the Limited Edition PS4 Pro...
REPL4Y for Android PS4 Remote Play App Free Trial Version by Twist3d89
Proceeding his request for Beta Testers and the Chiaki Open Source PS4 Remote Play Client release, developer Twist3d89 has made available a free trial version of his REPL4Y for Android application...
Top