PS4 Filesystem Root Dump, Linux, Fail0verflow & CCC

Hello... it appears a brief presentation from Marcan of Fail0verflow will be shown at this year's Chaos Computer Club (CCC) covering Penguins on Aeolia (Embedded Linux) on the PS4

​

Update: PS4 3.55 Full Browser FileSystem and Gadget List

From Wololo: Zecoxao, who's very close to the PS3/PS4 dev scene, shared a screenshot on Twitter, showing some reverse engineering work on what appears to be PS4 system files:

​

Finally, GregoryRasputin posted a screenshot of a PS4 Filesystem Root Dump with details below, which has been confirmed by PlayStation 4 developer Lucif3r as follows:

From GregoryRasputin: Christmas is a time for loving and sharing, it is about spending time with the family and enjoying their company, which is why i am happy to let the PlayStationHaX family know that a little Christmas elf popped in to see me today and showed me something wonderful:

Of course with these being confidential Sony files, i cannot and will not link to any files. You can read about work into hacking the PS4, you can check these links:

• gist.github.com
• cturt.github.io
• wololo.net

For those wondering, yes, this was released today. Edited title to clear some things up a bit.

According to zecoxao regarding the PS4 dump: Apparently it's on a pastebin. Cleverly hidden...

If anyone runs across it, feel free to share it here... this way the entire PS4 scene can benefit from it rather than a limited number of people.

Download: adm.rar / PS4 root dump (0.8.2) + kernel / NPXX51150_TEST_APP_HELLO_WORLD_0.01_[DEBUG].rar (27.9 MB) via eXtreme-Modding.de

Merry Christmas
Here's all the patches you need for fuse to run on 5.05 retail via Pastebin.com:

//suser_enabled in priv_check_cred
        ksuser_enabled=1;
        //add jail friendly for fuse file system
        p->vfc_flags=0x00400000 | 0x00080000;
        //avoid enforce_dev_perms checks
        //kfuse_enforce_dev_perms=0;
        //default prison_priv_check to 0
        kernel_ptr[0x3B219E]=0;

        //skip devkit/testkit/dipsw check in fuse_loader
        kernel_ptr[0x49DDDE] = 0xEB;
        kernel_ptr[0x49DDDF] = 0x1B;

        //skip sceSblACMgrIsSyscoreProcess check in fuse_open_device
        kernel_ptr[0x4A28EE] = 0xEB;
        kernel_ptr[0x4A28EF] = 0x0;

        //skip sceSblACMgrIsDebuggerProcess/sceSblACMgrIsSyscoreProcess check in fuse_close_device
        kernel_ptr[0x4A29E2] = 0xEB;

        //skip sceSblACMgrIsDebuggerProcess/sceSblACMgrIsSyscoreProcess check in fuse_poll_device
        kernel_ptr[0x4A2F34] = 0xEB;

        // skip sceSblACMgrIsSyscoreProcess check in fuse_vfsop_mount
        kernel_ptr[0x4A30F7] = 0xEB;
        kernel_ptr[0x4A30F8] = 0x04;

        // skip sceSblACMgrIsMinisyscore/unknown check in fuse_vfsop_unmount
        kernel_ptr[0x4A384C] = 0xEB;
        kernel_ptr[0x4A384D] = 0x00;

        // skip sceSblACMgrIsSystemUcred check in fuse_vfsop_statfs
        kernel_ptr[0x4A3BED] = 0xEB;
        kernel_ptr[0x4A3BEE] = 0x04;
the fcking eperm was in fuse_device_open xD

• Fuse is Alive!!!! on PlayStation 4 Retail
• PS4 Firmware File System Dump via FTP and File Analysis

M.e.M.e is ps4 filesystem case sensitive ? \ph\source\data\Menu\Movies\ Vs. \ph\source\data0.pak\menu\movies\ maybe potentional problem backporting DL2 for 5.05

 

[Chaos Kid]

@Chaos Kid sure, anything you wish to share privately we can definitely do so in the VIP area (well, as private as that is anyway... obviously it's not like a Dev-only section).

Everything posted here is just what's available publicly, but I'm sure more details will surface when fail0verflow does their demo at CCC

They are using one of the oldest tricks in the book I even use it myself and is the easiest way to gain access to the system. If you followed the ps3scene close this is how alot of discoveries were made not much has changed since the way the systems work except the fact that it uses arm and the encryption layering.
How they program these chips is quite unique aswel considering once you figure out how they work and operate you can see the link between the 2.

 

[SorenAlke]

http://imgur.com/a/X1YPw

 

[Chaos Kid]

http://imgur.com/a/X1YPw

Now look close at that bin you will notice a signature pattern I can see it just from a quick glimpse of data. Now pull apart the segments you can see the fault lines. It will reveal a segment 1 of 3 section keys. As they buried all 3 under neath
Now cuz the way you did this and how the data is obtained you can't do anything even if you had the ability to write it wodnt give you enough control.
You need to understand how to controlling the emulators or bend them without writing over them

 

[Endless]

Now we know what kernel load's first in details.
And many more configurations that has been made on Orbis.
Also the possibility of using grub rescue.

 

[SorenAlke]

I'll see what i can do... btw @Endless still wondering on whos supposed to deliver that message to me

 

[Chaos Kid]

I'll see what i can do... btw @Endless still wondering on whos supposed to deliver that message to me

Bending emulators is simple its simple tricks in forcing them to load. Look at psn style each are made out of disc base then converted over once you have each load Sig you can use a trick to load it under a disc then lock it in using the method you found in my file
I know it don't seem possible but it is I've used it for many ages and have tested on various systems to get full loading. You shod member what I said and how I did it here is your base for it to load. I know your not out of the scene I know exactly where you moved 2

 

[Chaos Kid]

Now we know what kernel load's first in details.
And many more configurations that has been made on Orbis.
Also the possibility of using grub rescue.

Sure you cod use that but y not clone it? I get being able to run Linux and the true potential it has but nomatter what even with Linux you still have no access to the system even thro dumps.

 

[SorenAlke]

are u directing that to endless? cus of my quote.. and i have to pm u.

 

[SorenAlke]

@ChaosKid few more are involved
but im still awaiting some extra info, probably to do with ccc2015

 

[Chaos Kid]

you may want to watch close i have seen the attention span for some time now but good luck on that theres a reason y i havent rel