Join Us and become a Member for a Verified Badge to access private areas with the latest PS4 PKGs.
Status
Not open for further replies.
Following the latest PS5 Scene Game Dump and recent PS4 7.02 / 7.51 / 7.55 Read-Write updates, PS4 Scene developer sleirsgoevy pushed live a 7.02 Netcat-only release utilizing port 9020 alongside a netcat702.html commit on Github with a Netcat 7.02 Test Page available for those on PS4 OFW 7.02 from the 7.02 WebKit port forked via Synacktiv based on the findings of abu_y0ussef and 0xdagger in their BHEU 2020 presentation. 😍

Today @SocraticBliss also released a 7.02 Full Stack of the PS4 7.00-7.02 Kernel Exploit via Twitter thanking contributing developers including ChendoChap, @zezu420 (aka Znullptr), Synacktiv, @KIWIDOGGIE (aka kd_tech_), Fire30_, theflow0 and @SpecterDev (Twitter)... while a test version of 7.00-7.02 PS4HEN arrived via Znullptr as @DEFAULTDNB reminded everyone on Twitter that the FRMCHK database has recently been updated with OFW702-confirmed games, some of which are outlined in the lists HERE and HERE via @irefuse. 🥳

From the README.md: PS4 7.00 - 7.02 Kernel Exploit

Summary


In this project you will find a full implementation of the "ipv6 uaf" kernel exploit for the PlayStation 4 on 7.00 - 7.02. It will allow you to run arbitrary code as kernel, to allow jailbreaking and kernel-level modifications to the system. will launch the usual payload launcher (on port 9020).

This bug was originally discovered by Fire30, and subsequently found by Andy Nguyen

Patches Included

The following patches are applied to the kernel:
  1. Allow RWX (read-write-execute) memory mapping (mmap / mprotect)
  2. Syscall instruction allowed anywhere
  3. Dynamic Resolving (sys_dynlib_dlsym) allowed from any process
  4. Custom system call #11 (kexec()) to execute arbitrary code in kernel mode
  5. Allow unprivileged users to call setuid(0) successfully. Works as a status check, doubles as a privilege escalation.
  6. (sys_dynlib_load_prx) patch
Notes
  • The page will crash on successful kernel exploitation, this is normal
  • There are a few races involved with this exploit, losing one of them and attempting the exploit again might not immediately crash the system but stability will take a hit.
Contributors
As many are awaiting a Stable Full 7.02 PS4 Jailbreak Exploit before updating from 5.05 or 6.72, reports of new PS4 FPKG Backports using AutoBackPort 1.08 are already surfacing with Video Footage of PS4 Games Dumped on 7.02 including FF7R (140 GB) by @grabman as outlined in the PS4 7.02 How to Dump a Game Guide using the latest PS4 Dumper and PS4 FTP available in the payloads_1.0.5.zip update of the PS4 Payload Repo via @Al Azif in the Tweets below... so for those who haven't done it yet:

:idea: Be sure to follow the PSXHAX Member Verification & PS4 Fake PKG (FPKG) Sharing Guide to become a Verified Member by getting a Blue Verified Badge (FAQ in the spoiler HERE) through our PSXHAX Floating Discord Channel to access private or restricted areas for the latest FPKG game releases! 🏴‍☠️
For PlayStation 4 Scene developers who enjoy reverse-engineering, below are some early holIDAy presents as well. 🎄🎁 :geek:
Finally, cheers to @cedsaill4 on Twitter for sharing the screenshot below! 🍻
PS4 7.02 WebKit Kernel Exploit with Game Dumper and FTP Payloads!.png
 

Comments

I wish for a guide on how to have it self hosted and all that.. but the xploit is still being worked on. i still have shut downs after putting it to sleep.. is there any other bin of hen out there ? have the hen vtx
 
In some respects the jailbreak & hen does it all Mira may add a layer of confusion. Ive ran the jailbreak a few times and havent had a system crash. If only I could work out how to payload id be happy

we have a jailbreak & hen being if its possible to add payloads what does MIRA actually do, still waiting for info as regards to injecting payloads
 
Been using this a lot the past few days, about 1 in 8 tries usually works. Other people report that rest mode works but it hasn't worked for me and usually I have to redo the webkit exploit.
 
Tried FTP and worked. But what I noticed when I add a second Payload beside HEN it crashed when the PS4 goes into Rest Mode. Without it I have no problem in Rest Mode.

Second thing I noticed was Package Installer Runs, but I can only start one Installation Run after this is finished I cannot reach again need a restart, new HEN run and then I can install the next things. This is something which I have not noticed in the past with 5.05 or 6.72.
 
Hey guys.
Can somebody with a copy of TLOU2 follow these steps?:
1) Run the exploit on 7.02
2) Spoof the firmware (from 7.02 to 7.55)
3) Put the disk and execute the game.
4) Try to DUMP it

Can somebody try this?

PS: @grabman
 
Unfortunately it's not that simple otherwise we could spoof our firmware to 9.99 and and dump the latest games from the latest firmware if this was the case also we wouldn't need to always need the next kex or webkit to play games on higher firmware
 
Status
Not open for further replies.
Back
Top