Join Us and become a Member for a Verified Badge to access private areas with the latest PS4 PKGs.
PS4 Jailbreaking       Thread starter NORATIO       Start date Jan 31, 2018 at 12:36 AM       145      
Status
Not open for further replies.
Since @XVortex created a java payload version of PS4HEN that doesn't require you to push it using a PC, thanks to his web/java version, I have searched for a way to get this working without a web server needed.

It comes to my mind that PS4 supports BD-J (for Java) for it's Blu-ray Live (BD-Live) and that it has persistent storage and ability to do virtual storage as well.

The process is simple:
  • create a menu for Blu-ray to call ps4-hen-vtx that will load payload.js and the rop.js
  • burn the Blu-ray disc (create an iso)
  • play back in PS4 and click on the menu to load the payload
I will be playing with this more this weekend, but meanwhile, if @XVortex or someone else wants to give a try, go ahead. That will be a perfect so the PS4 is independent of a web server.

More info here ; http://www.oracle.com/technetwork/articles/javame/bluray-142687.html
Loading PS4 Payload from a Blu-ray (Server-less Option) BD-J.jpg
 

Comments

As far I think is a interesting idea, a friend said the follow...

The bdj?
There is zero possibility for bdj to host the exploit unless bdj can somehow access webkit.

So i brought the question here to point you to this problem.
anyway, also the possibility to use a dvd instead a bd is already not answered.
 
There are so many things with this that don't make sense,
Java and Javascript are two entirely separate things, and even if you were able to interpret the Javascript with Java it still wont work because the exploit will only work on WebKit.

The only chance of something like this working is if someone can break out of jvm with another exploit entirely and from there run a kexploit or access WebKit.
 
I was tagged by PSXHAX in this thread, because I have some experience with Blu-ray Disc Java (BD-J) development.

Let me answer a few questions.

The PS4 also plays DVD-R/+R. Cant we use that instead of a Bluray??
I can use DVD?

No. In my experience, PS3 and PS4 will not run Blu-ray content off of a DVD. (Xbox One will though). It may play an AVCHD folder structure - but that's not Blu-ray. That's AVCHD, and will not let you run any BD-J stuff.

yes it is possible on dvd as it was mentioned if you read everyones comments
On a side note you can burn the bdj image on a normal blank dvd. No need to waste a BD-r on it as it will be less than 500mb

But you will still need a bluray drive to burn it

Wrong. It doesn't matter which burner you use. PS3 and PS4 will still not run Blu-ray content from a DVD disc. They insists on a Blu-ray Disc. (Unless it has become possible in newer firmwares - but I doubt that).

you could use bd-j as a way to load Linux just add the paths to the payload if you wanna be creative

JavaME is sandboxed, which means it can't access anything outside the sandbox. Attempting to do so will most likely just result in a Security Exception.

Although for older cellphones (MIDP) there actually was a function platformRequest() available, called e.g. to start the browser - no such method is available for BD-J.

If I've understood correctly this article i can create a single javascript file with the exploit, create a java program like this:
Code:
import javax.script.*;
public class ExecuteScript {
 public static void main(String[] args) throws Exception {

 ScriptEngineManager factory = new ScriptEngineManager();

 ScriptEngine engine = factory.getEngineByName("JavaScript");
engine.eval(new java.io.FileReader("exploit.js"));
}}
compile with java
create a jave ME application that lauch this app
burn a blu ray

and then execute it?

There is no javax.script package available for BD-J, so you can't do this no.

I don't know anything about exploits, or how all of this is supposed to work, but can tell you this:

Yes, you can actually code a small webserver with BD-J, and serve files as you wish. (Check out the PS3/PS4 version of Ukko's Journey (www.UkkosJourney.com), where you can type in the IP address of your PS3/PS4 in the browser of your JavaME enabled phone (connected to the same LAN via Wifi) in order to download the MIDP version of the game from the Blu-ray Disc through your PS3/PS4 to install and run the game on your phone.

On the older cellphones (which also runs JavaME) you could actually code a webserver, and then call platformRequest("http://localhost"); or platformRequest("127.0.0.1"); to open the built-in browser and load whatever you served it from your JavaME webserver. And as far as I understand, this is the scenario threadstarter is looking for.

Unfortunately there is no platformRequest() method available for BD-J, so we would need some other way of calling the browser. Runtime.exec() might be able to do it, but I honestly don't know if it'll work.

Obviously you won't be able to manually open the browser and input the "http://localhost" address - because that would mean stopping the Blu-ray Disc. You can't manually run the Blu-ray disc + the browser at the same time on the same console.

So the experiment is simple:

First, create a BD-J that starts a webserver in its own thread.
Then call Runtime.exec("WebKit http://127.0.0.1"); or whatever might be necessary to get the browser running. I have no clue about the inner workins of PS4, so I wouldn't know what command to try.

I expect you to always get a Security Exception though, but I'm looking forward to hearing the results.

In all honesty, this sounds like a hazzle to go through, just to escape needing to use a webserver? Isn't your PS4 connected to your LAN? Just use your PC as a webserver then, and point your PS4 browser to the IP of your PC.

In any case: Good luck! :)
 
these guys are all using kernel exploite which means it's not within the restrictions of sandbox so while on ofw will be locked down more tightly most devs manipulate the drive to do what they wish which does make things more possible. thes guys were asking in the favour of 4.05 fw that's hacked not on ofw FYI
 
I see.
Well, in that case maybe Runtime.exec() might actually work.
Unless of course the PS4 closes the Blu-ray Disc playback when the browser is opened.

Still though, it seems like a lot of hazzle just to avoid using an external server.
 
to be honest it sounded fishy to me from dvd as I've never tried I always have blank bd discs and I know cyber software can link accounts to the burning process.

as for the whole /mnt/sandbox which I know your speaking of is only used to keep access restricted but if you look at what kernel gives it remains as /mnt/CUSA idea. this alone shows the drive was manipulated and can be again all thro the exploite just as mapping can be done its just using a single hole.
 
Regardless even jailbroken ps4s cannot run payloads from bdj, it just does not work like that. Unless you ran a payload beforehand to communicate between bdj and the payload, then run custom functions through that (which would be really difficult) its not happening and pretty much ruins the whole idea of running payloads straight from bdj.
 
I don't have a full understanding of what a "payload" is, since I'm not into exploits and hacking. But I noticed in the first post of this thread a mention of "payload.js" and "rop.js" files. Those are javascript files and can easily be served by a small BD-J webserver, which, as far as I understand, is exactly what threadstarter is wondering about: Can you feed the PS4 browser these files via BD-J (in order to avoid the need of an external webserver)?

And the answer is: If Runtime.exec() will launch the PS4 browser without stopping Blu-ray Disc playback (just like platformRequest() launches the browser without stopping the MIDlet on older cellphones) - then yes it should be doable.
 
Status
Not open for further replies.
Back
Top