Category PS4 Jailbreaking       Thread starter PSXHAX       Start date Apr 5, 2017 at 2:29 AM       46,616       61            
Status
Not open for further replies.
Since the initial release and PS4 4.50 Kernel R/W Access confirmation by qwertyoruiopz, PlayStation 4 developer @SpecterDev began work on porting it and today he announced on Twitter that the exploit is now ported to 3.50, 3.55, 3.70, 4.00, 4.06, and 4.07 Official Firmware (OFW)! :love:

JailbreakMe PS4 Exploit Links: JailbreakMe PS4 4.0x (Original) / JailbreakMe PS4 3.5x/3.70/4.0x (Port - Mirror by NerdyBitsUK) / JailbreakMe PS4 3.5x/3.70/4.0x (Mirrors by StandardBus) / PS4-4.0x-Code-Execution-PoC-master.zip / GIT

And from the Cryptogenic PS4 4.0x Code Execution PoC README.md, to quote:

PS4 4.0x Code Execution

This repo is my edit of the 4.0x webkit exploit released by qwertyoruiopz. The edit re-organizes, comments, and adds portability across 3.50 - 4.07 (3.50, 3.55, 3.70, 4.00, and of course 4.06/4.07).

The commenting and reorganization was mostly for my own learning experience, however hopefully others can find these comments helpful and build on them or even fix them if I've made mistakes. The exploit is much more stable than FireKaku and sets up the foundation for running basic ROP chains and returns to normal execution. Credit for the exploit goes completely to qwertyoruiopz.

Organization

Files in order by name alphabetically;
  • expl.js - Contains the heart of the exploit and establishes a read/write primitive.
  • gadgets.js - Contains gadget maps and function stub maps for a variety of firmwares. Which map is used is determined in the post-exploitation phase.
  • index.html - The main page for the exploit. Launches the exploit and contains post-exploitation stuff, as well as output and code execution.
  • rop.js - Contains the ROP framework modified from Qwerty's original exploit as well as the array in which module base addresses are held and gadget addresses are calculated.
  • syscalls.js - Contains a system call map for a variety of firmwares as well as a 'name -> number' map for syscall ID's.
Usage

Simply setup a web-server on localhost using xampp or any other program and setup these files in a directory. You can then go to your computer's local IPv4 address (found by running ipconfig in cmd.exe) and access the exploit.

Notes
  • The exploit is pretty stable but will still sometimes crash. If the browser freezes simply back out and retry, if a segmentation fault (identified by prompt "You do not have enough free system memory") occurs, refresh the page before trying again as it seems to lead to better results.
  • This only allows code execution in ring3, to get ring0 execution a kernel exploit and KROP chain is needed.
  • If I've made an error (particularly having to do with firmware compatibility and gadgets) feel free to open an issue on the repo.
  • The exploit has been tested on 3.55 and 4.00, it is assumed to work on other firmwares listed but not guaranteed, again if you encounter a problem - open an issue on the repo.
Credits

qwertyoruiopz - The original exploit, the likes of which can be found here.
Cheers to @GritNGrind, @hyndrid, @mcmrc1, @ombus, @Thisismrnameles and @VultraBabe in the PSXHAX Shoutbox for the tips! :beer: :beer::beer::beer::beer:
JailbreakMe PS4 3.5x 3.70 4.0x Exploit Ports by SpecterDev.jpg
 

Comments

Status
Not open for further replies.

P3T3s

Senior Member
Contributor
Using https://ps4.nerdybits.co.uk on my 4.01 give me:

Error: System may be vulnerable but does not have a valid import map!

Shall I update to 4.06 or 4.07? If yes: which one? Also, how to install manually that update (ONLY if necessary ofc XD)
He has not added the gadget from libxxx for your fw so no map, from what I read try to stay low, works on 4.5, 4.6, 4.7 but was not as stabe on 4.7, would update to 4.5 or wait until kernel exploit lands as we dont know about that yet!
 

umbjolt

Member
Contributor
Thanks you both! So I think the best bet is to stay on 4.01 a bit more and wait for a ring-0 access :p

(We have been waiting a lot, waiting some days or less more doesn't hurt XD)
 

mcmrc1

Senior Member
Contributor
Verified
Using https://ps4.nerdybits.co.uk on my 4.01 give me:

Error: System may be vulnerable but does not have a valid import map!

Shall I update to 4.06 or 4.07? If yes: which one? Also, how to install manually that update (ONLY if necessary ofc XD)
If update then to 4.06 because its the same qwerty is... to manually update download the firmware @ http://darthsternie.bplaced.net/ps4.html

and update via recovery with a fat32 usb drive folder PS4/UPDATE/ps4updat.dat
maybe you must rename the downloaded firmware
 

azoreseuropa

Senior Member
Contributor
Verified
We bought it in Portugal (Azores island) about 2 or 3 years ago and it came with 2.57. Should we leave 2.57 alone for now ? That's what our FW have: 2.57.
 
Status
Not open for further replies.
Recent Articles
Sony PS4 / PS3 Blu-ray Disc Drive Internals & Security by Oct0xor at 36c3
Last year they covered Exploiting PS4 Video Apps, and at the 36th annual Chaos Communication Congress (36c3) from December 27th to the 30th 2019 in Leipzig Germany scene developer @Octopus (aka...
Sony PS4 Remote Play: Now on More Devices Latest Promo Video
Proceeding the PSPlay Free Trial of the unofficial Android app and yesterday's Google Stadia release that includes 22 Stadia Launch Titles, today Sony unleashed their latest PS4 Remote Play - Now...
Baikal Support Added to PlayStation 4 Linux Loader by Valeery
Since the PSXITArch Linux v2 Guide, Spine PS4 Emulator for Linux Demo, CECPS4 Linux Scripts and PS4 Gentoo Linux development updates support for the Baikal chip was recently added to the...
PS5 DualShock 5 (DS5) Controller Images Surface in Japanese Patent
Following Sony's New Controller Patent, PS5 Devkit Prototype Leak and recent PS5 Transition Update in preparation for the PlayStation 5 2020 Launch today some PS5 DualShock 5 (DS5) Controller...
Top