POOBS4 Buildroot PS4 9.00 Exploit Web Server / USB Emulation by Shivelight

Proceeding the PS4PiZero / PS4RaspberryPi project, PlayStation 4 Scene developer @Shivelight (Twitter) recently made available via Github a pOOBs4 Buildroot Web server and USB emulation project for the PS4 9.00 pOOBs4 Jailbreak Exploit with Orange Pi Zero / Orange Pi Zero LTS support initially and additional boards including Raspberry Pi Zero W / Raspberry Pi Zero 2 W to be added as stock arrives.

Download: pOOBs4 buildroot (Latest Version) / pOOBs4-buildroot-main.zip / GIT

Spoiler: Depreciated

Here are further details from the README.md: pOOBs4 buildroot

Introduction

This repository contains buildroot external tree for building a minimal Linux image to host pOOBs4 web server and emulate its exfathax USB.

Building

Clone the repository and buildroot version 2021.11:

git clone https://github.com/Shivelight/pOOBs4-buildroot
git clone -b 2021.11 --depth 1 git://git.buildroot.net/buildroot

Configure buildroot to use BR2_EXTERNAL tree and start building. Replace <boardname> with your board defconfig available in configs/ directory or from the Supported Board section:

cd buildroot
make BR2_EXTERNAL=../pOOBs4-buildroot/ <boardname>_poobs4_defconfig
make

The final image is saved here output/images/sdcard.img.

Supported Board

If you have a board that is not listed, feel free to contribute!

Below is the currently supported board with defconfig ready use.

• Orange Pi Zero / Orange Pi Zero LTS [ orangepi_zero_poobs4_defconfig ]
• Raspberry Pi Zero W [ not yet ]
• Raspberry Pi Zero 2 W [ not yet ]
• your board?

Note: You need a board with a USB OTG port for exfathax emulation. All boards listed should have a built-in USB OTG port unless stated otherwise.

not yet: I'm willing to build and test, but currently don't have any and still waiting for restock

Installing

Download the image for your board from the release page or build it yourself. Then write the image to your SD card using dd:

sudo dd if=output/images/sdcard.img of=/dev/sdX bs=4M

Alternatively, you can use:

• USBImager on Windows/Mac/Linux
• balenaEtcher on Windows/Mac/Linux
• Rufus on Windows

Updating

This section is here to warn you to backup any customization you made or, better yet, fork this repo and do your customization there. Writing image to SD card destroy its existing content.

To update see Installing.

Running

Insert SD card and plug the board into PS4 using the USB OTG port. You don't need another power cable; your board will draw power from PS4. It may take 30 seconds to boot up for the first time. Afterward, it should only take ≤5 seconds.

Note: SuperSpeed USB (USB 3.1 Gen 1), which PS4 uses, has a maximum power output of 5V/0.9A. Consider this.

Connecting PS4 to the board

Follow these steps to connect your PS4 to the board:

1. On your PS4 go to Settings -> Network -> Set Up Internet Connection -> Use Wi-Fi -> Custom
2. Select pOOBs4 on the list
3. When asked for the password, input: 12345678
4. Now, for each step, select:
   1. IP Address Settings: Automatic
   2. DHCP Host Name: Do Not Specify
   3. DNS Settings: Automatic
   4. MTU Settings: Automatic
   5. Proxy Server: Do Not Use
5. You are set!

Running the exploit

You can run the actual pOOBs4 exploit either by visiting http://10.0.0.1/ from the PS4 browser or from Settings -> User's Guide/Helpful Info -> User's Guide. The host is based on Leeful's 9v4 (w/ GoldHEN v2.0b2), slightly modified to use the USB emulation.

Payload

Use Payload Guest.

Accessing the board

You can SSH/SFTP to the board using the root user; the board IP is set to 10.0.0.1 (wlan) by default.

ssh [email protected]

The root user does not have a password. You can set a new password if you want using passwd.

Cheers to MSZ_MGS on Twitter and perou64 for the heads up earlier on!

 

[olsztyn41]

i dont understand it.. a small USB stick with 1 gb or something should everybody have at home ..

i have a few too ..

but better to buy a raspberry or other devices

 

[darkdevil985]

I have an orange pi PC but i use it for other stuff. It's not listed yet.

Is it necessary to build and flash a dedicate image?
No way to manually configure the web server and access point?

 

[Doyle444]

I have a Rasp Pi 3B+... I shall wait
Great to see this though!

 

[ysfex3]

@olsztyn41 exactly. i was actually happy to give one of my poor orphaned usb sticks a purpose.

 

[Syboo]

That's great news! Thanks for pushing for a smart USB way. By the way, an esp8266 would not suit?

 

[darkdevil985]

Well looking the sources it's a busybox minimal environment that act as a dhcp server. The wireless is used as an access point.

Then there is the http server with the known sony dns remapped to the exploit webpage. Finally, the cgi scripts that mount the hacked img on the fly with the magic of the usb otg port.

So in other words with some manual steps it should work even with other boards that has the usb otg, the ap could be avoided pointing the Board lan ip as gateway and dns for the ps4.

Not the easier solution but kudos to the dev, interesting.

 

[Hazihell]

There are people who have lot of rasps at home so this is actually useful. As I am not one of those, will sick to flash drive and wait for a permanent method

 

[Shivelight]

@olsztyn41 I'm too lazy to plug/unplug the USB drive, and it's a fun project. Not having to explain too much to my friends and siblings is a plus!

@darkdevil985 You are 100% correct! The reason I chose this way is to achieve minimal boot time to start accepting requests. As I said it is a fun project. Well, maybe I or someone can write a guide on how to manually set up the web server using existing images like armbian or raspbian

 

[darkdevil985]

@Shivelight i bet most of people wants to achieve the goal spending less effort as possible. Most consider boring to plug and unplug an usb drive, imagine doing something like this.

Anyway i'm with you, this is pure fun i will try to setup it on my orangepi PC running raspbian on my spare time and let you know