Category PS4 Jailbreaking       Thread starter PSXHAX       Start date Apr 5, 2017 at 2:29 AM       50,325       61            
Status
Not open for further replies.
Since the initial release and PS4 4.50 Kernel R/W Access confirmation by qwertyoruiopz, PlayStation 4 developer @SpecterDev began work on porting it and today he announced on Twitter that the exploit is now ported to 3.50, 3.55, 3.70, 4.00, 4.06, and 4.07 Official Firmware (OFW)! :love:

JailbreakMe PS4 Exploit Links: JailbreakMe PS4 4.0x (Original) / JailbreakMe PS4 3.5x/3.70/4.0x (Port - Mirror by NerdyBitsUK) / JailbreakMe PS4 3.5x/3.70/4.0x (Mirrors by StandardBus) / PS4-4.0x-Code-Execution-PoC-master.zip / GIT

And from the Cryptogenic PS4 4.0x Code Execution PoC README.md, to quote:

PS4 4.0x Code Execution

This repo is my edit of the 4.0x webkit exploit released by qwertyoruiopz. The edit re-organizes, comments, and adds portability across 3.50 - 4.07 (3.50, 3.55, 3.70, 4.00, and of course 4.06/4.07).

The commenting and reorganization was mostly for my own learning experience, however hopefully others can find these comments helpful and build on them or even fix them if I've made mistakes. The exploit is much more stable than FireKaku and sets up the foundation for running basic ROP chains and returns to normal execution. Credit for the exploit goes completely to qwertyoruiopz.

Organization

Files in order by name alphabetically;
  • expl.js - Contains the heart of the exploit and establishes a read/write primitive.
  • gadgets.js - Contains gadget maps and function stub maps for a variety of firmwares. Which map is used is determined in the post-exploitation phase.
  • index.html - The main page for the exploit. Launches the exploit and contains post-exploitation stuff, as well as output and code execution.
  • rop.js - Contains the ROP framework modified from Qwerty's original exploit as well as the array in which module base addresses are held and gadget addresses are calculated.
  • syscalls.js - Contains a system call map for a variety of firmwares as well as a 'name -> number' map for syscall ID's.
Usage

Simply setup a web-server on localhost using xampp or any other program and setup these files in a directory. You can then go to your computer's local IPv4 address (found by running ipconfig in cmd.exe) and access the exploit.

Notes
  • The exploit is pretty stable but will still sometimes crash. If the browser freezes simply back out and retry, if a segmentation fault (identified by prompt "You do not have enough free system memory") occurs, refresh the page before trying again as it seems to lead to better results.
  • This only allows code execution in ring3, to get ring0 execution a kernel exploit and KROP chain is needed.
  • If I've made an error (particularly having to do with firmware compatibility and gadgets) feel free to open an issue on the repo.
  • The exploit has been tested on 3.55 and 4.00, it is assumed to work on other firmwares listed but not guaranteed, again if you encounter a problem - open an issue on the repo.
Credits

qwertyoruiopz - The original exploit, the likes of which can be found here.
Cheers to @GritNGrind, @hyndrid, @mcmrc1, @ombus, @Thisismrnameles and @VultraBabe in the PSXHAX Shoutbox for the tips! :beer: :beer::beer::beer::beer:
JailbreakMe PS4 3.5x 3.70 4.0x Exploit Ports by SpecterDev.jpg
 

Comments

Status
Not open for further replies.

P3T3s

Senior Member
Contributor
People we need the kernel access before we can run any backups...

Once the kernel exploit is released on a new fw, there will be allot more devs with the skills and an exploitable PS4 to work on backups unlike 1.76!

NO KERNEL ACCESS NO BACKUPS!!
 

tonybologna

Sports Freak!
Senior Member
Contributor
I think right now the later people buys ps4 more probably they will come with 4.50
Tiger Direct had a Battefield 4 bundle for $325.00 that had OFW 2.50 on it. How I know was going by the manufacturing date. It was made on 09-16-16. Unless they opened it to update the FW it has to be on 2.50 because 3.00 came out two weeks later.

I was thinking about getting it because our only PS4 in the home is our teenage sons & his has up-to-date FW on it. I think though I want to get a Pro version instead of a regular one. I'm still playing with CFW on a PS3 so waiting on a full CFW for PS4 before jumping but I want to get a Pro version with 2.50 or below. Thanks.
 

NerdyBitsUK

Member
Contributor
Tiger Direct had a Battefield 4 bundle for $325.00 that had OFW 2.50 on it. How I know was going by the manufacturing date. It was made on 09-16-16. Unless they opened it to update the FW it has to be on 2.50 because 3.00 came out two weeks later.

I was thinking about getting it because our only PS4 in the home is our teenage sons & his has up-to-date FW on it. I think though I want to get a Pro version instead of a regular one. I'm still playing with CFW on a PS3 so waiting on a full CFW for PS4 before jumping but I want to get a Pro version with 2.50 or below. Thanks.
There is absolutely no way you will find a Pro console on 2.50 or below. I believe the minimum praxis on Pro models is around 3.70
 
Status
Not open for further replies.
Recent Articles
OrbisGl2 LibOrbis Graphic Backend Based on Raylib for PS4 Homebrew
Following the LibOrbisNfs PS4 Port earlier this year, PlayStation 4 scene developer BigBoss announced today that an OrbisGl2 LibOrbis Graphic Backend Library based on Raylib is now available...
Call of Duty: Modern Warfare 2 PS4 Campaign Remastered Arrives
Starting today the new Call of Duty: Modern Warfare 2 Campaign Remastered is available on PlayStation 4 allowing PS4 fans to relive the classic campaign and get the Underwater Demo Team Classic...
PS3 System Software 4.86 Update Live, Don't Update Your Firmware!
Proceeding their previous PS3 OFW revision and recent PS3 Partial Message Service Ending announcement, today Sony pushed live a new PS3 Firmware / System Software 4.86 Update for those who still...
Lapy's River Raid 1.0 PS4 PKG Homebrew Game by Lapy05575948
Following the River Raid PS4 PKG Preview and his recent Easy PKG Extractor, PlayStation 4 homebrew developer @Lapy released a River Raid 1.0 PS4 PKG today on Twitter for those with a Jailbroken...
Top