PS4 Development Menu (Debug Mode) Enabled on Retail PlayStation 4

Just over a week ago we heard rumors of accessing the PS4 Debug Mode Settings on retail PlayStation 4 consoles, and today scene developer CTurt confirmed it's now possible to access the PS4 Dev Menu on 1.76 retail units thanks to Flat_z!

Download: Enable Dev Menu / PS4-dlclose.zip / PS4-debugmenu.bin (1.0 MB Compiled) via fx0day / PS4-debugmenu.bin (1.0 MB Compiled) via Di_Scala_ / Tutorial by Chaos Kid / PS4-dlclose GIT

From Stuart Fox via Facebook comes a video demo also.

Update: From lezek20 also comes code to enable the more advanced debug menu (dlclose.bin (1.00 MB) compiled by ultradogg), to quote:

*(char *)0xFFFFFFFF833242FD = 0x81;

Just add it into the kernel payload before this part:

writeCr0(cr0);

This could brick your console btw, so be careful!

Update #2: From @j0lama with help from @sealab (Demo video: jgoake.mp4 - 43 MB) via Twitter:
Download: Fully-Enable-Debug-Settings.bin (1 MB)

Fully enable Debug Settings:
*(uint32_t*) 0xFFFFFFFF8269C07Cull=0;
*(uint32_t*) 0xFFFFFFFF8269B56Full=0;

Thanks to B7U3 C50SS and GrimDoe in the Shoutbox for the heads-up!

 

[pspfrank4U]

THANK YOU I HAVE A v1.76 PS4

 

[PSXHAX]

Can someone post a tutorial to do this on cywin,I'm confused or better yet pre complied dl close exploit or a video tutorial

I added a compiled PS4-debugmenu.bin via fx0day to the first post now, and thanks @Chaos Kid for the Tutorial also!

 

[Chaos Kid]

i also have another toolchain based on the same idea but uses a older compiler so chaining other toolchains dont break

heres a realy good website for those who like to cross compile on multi platform

http://www.bullfreeware.com/recent_50.php

 

[proskopina]

now its time to find a hole in latest fw....

 

[Chaos Kid]

now its time to find a hole in latest fw....

There's 4 in fw 3.15-3.50 and has bin there since the beginning and not based on badiret.

A good recommendation I recommend personally is to make a multi-toolchain with all in one start with low base look at the website at compilers for compatability and low backend support to high 4.70 is highest I will go be4 it breaks my toolchain

 

[proskopina]

mmmmmm....i think i stop my project on webos and start diging my ps4

 

[Chaos Kid]

mmmmmm....i think i stop my project on webos and start diging my ps4

I don't do all this for some hacks or cfw I do what I do for my own development on a larger scale.
Webkit exploites get you so far and against some1 skilled they will chew thro it like candy.
First advice is any1 who's using exploites don't just obtain keys for top level you want kernel access which no1 has on ps3 for various reasons.
You want to rip thro security on a hard level if you know how or what to watch for.

 

[Blade]

OMG, this is HEAVY
First of all: i was something (small) in the ps3-scene, but im NOTHING in the ps4-world.

As far as I understand it right (and plz consider me as an almost noob ), we are on the same level of programming like programming a microcontroller, with access to read and write certain ports. If i.e. @Chaos Kid is half as good as i think he is, he is waaaay further than the most here can imagine....

Maybe the error the guy in the video is getting is because of the missing qa-flag (which is not properly set) or the target ID which is not set to DEX (unlikely).
Never the less, the "install packages" is working (probably for official signed pkgs only, but its NICE)

All those infos could be wrong, I was just excited reading this. I need to gather a lot more information than only speedreading the main.c
Thank you very much all!! Especially @Chaos Kid for being the MITM between those with powers and us noobs.

Very Gratefully
Blade

 

[B7U3 C50SS]

Yeah @Chaos Kid does good work. like you don't even know..

 

[Chaos Kid]

OMG, this is HEAVY
First of all: i was something (small) in the ps3-scene, but im NOTHING in the ps4-world.

As far as I understand it right (and plz consider me as an almost noob ), we are on the same level of programming like programming a microcontroller, with access to read and write certain ports. If i.e. Chaos Kid is half as good as i think he is, he is waaaay further than the most here can imagine....

Maybe the error the guy in the video is getting is because of the missing qa-flag (which is not properly set) or the target ID which is not set to DEX (unlikely).
Never the less, the "install packages" is working (probably for official signed pkgs only, but its NICE)

All those infos could be wrong, I was just excited reading this. I need to gather a lot more information than only speedreading the main.c
Thank you very much all!! Especially Chaos Kid for being the MITM between those with powers and us noobs.

Very Gratefully
Blade

We all have to start somewhere n honestly every1 is a noob as we always constantly learn I trained myself to see data different then most using hw /sw and designing things for methods into systems. Member as humans we can do anything we set our minds too (if there's a will there's a way).
Member these units are not much different then the Ps3 except the amount of process power and the FPU to make an x64 system and samu for encryption engine. But keep in mind everything is exploitable it's all how the user does it.
Rip a single hole security weakens rip a massive hole and the system is defenceless
Ugh do I hate devs who like to manipulate and use it to an advantage here let me turn your work around to reveal data! Besides on the system kernel uses a nice little rpm packet sniffer which is also used in cobra work