Category PS4 Jailbreaking       Thread starter PSXHAX       Start date Jul 8, 2020 at 12:43 AM       100,893       262            
Proceeding his PS4 ROP 8CC Port and the 7.02 PS4 Kernel Exploit (KEX) release, PlayStation 4 scene developer sleirsgoevy added a work-in-progress (WIP) port of the PS4 Webkit Bad_Hoist 6.XX Exploit by Fire30 to his Github repository noting it should work up to 6.72 but requires some minor changes and offset adjustments. :geek:

In related news, @zecoxao shared via Twitter a PS4 dump file pack including webkit, libc, libkernel, gadgets and syscalls from 6.72 Firmware and kernel, libc, libkernels and libSceWebkits decrypted from 7.00 Firmware which can also be found below. đź’—

Download: bad_hoist-master.zip / GIT / 6.72 Payload Ports / dumps_672.7z (41.41 MB) / 700.7z (46.84 MB) - 6.72 Contents:
Code:
gadgets.txt
libc.bin
libc.elf
libc-gadgets.txt
libkernel.bin
libkernel.elf
syscalls.txt
webkit-gadgets.txt
webkit.bin
webkit.elf
7.00 Contents:
Code:
80010002.elf
libc.sprx
libkernel.sprx
libkernel_sys.sprx
libkernel_web.sprx
libSceWebKit2.sprx
libSceWebKit2ForVideoService.sprx
libSceWebKit2Secure.sprx
:alert: As covered previously, it's recommended not to update your Firmware until a full PS4 6.72 jailbreak is publicly released. :alert:

And from the README.md: bad_hoist

This is an actually working implementation of Fire30's bad_hoist exploit.

Supported firmwares

This exploit has been tested and proven to be working on FW 6.51. This should work up to 6.72 with minor changes, however various offsets need to be adjusted.

ROP compiler setup

In order to run the ROP compiler you need to have dumps of WebKit, libc & libkernel.

Run make and follow instructions to obtain the dumps.

Dependencies: python3, gcc, ROPgadget

Assembly-like ROP format

This toolchain uses assembly-like ROP format that is briefly described below.
Code:
<label>:
Declare a label. Labels are global and should be valid Python identifiers.
Code:
<asm_instr>
Find a gadget that looks like asm_instr ; ret and insert its address. Will error out if the gadget is not found inside the dumps.

Note: after dumping you can find a dumps/gadgets.txt file.
Code:
# comment
For each line, every character after the first # is considered a comment.
Code:
db <expr>
(<expr>) must be a valid Python expression that evaluates to a collection of integers in range(256). The corresponding bytes will be written into the ropchain.

Examples: db 1, 2, 3, db bytes(256)
Code:
dq <expr>
<expr> must be a valid Python expression that evaluates to an integer. The integer will be written into the ropchain as a 64-bit little-endian value.
Code:
dp <expr>
Same as above, but <expr> should evaluate to an offset from the start of the ropchain. This will result in an absolute address being written.

For example, the commands
Code:
pop rsp
dp label_to_jump_to
will perform a jump.
Code:
$<expr>
<expr> should be a JavaScript expression that evaluates to an integer. The expression will be executed inside the exploited WebKit and the result will be written into the ropchain as a 64-bit little-endian value.

Example: $infloop_addr

Note: in JavaScript numbers only have 52-bit precision.
Code:
$$<expr>
<expr> will be inserted into the resulting JavaScript code literally.

If <expr> reads exactly pivot(ropchain);, the final pivot statement will be omitted.

Example:
Code:
$$function(some_params)
$${
...ropchain...
$$pivot(ropchain);
$$}
See examples of this language in the rop/ directory.

ROP compiler usage
Code:
usage: python3 rop/compiler.py <rop_source> <gadgets.txt> > <rop_js>
<rop_source> is the ropchain source code in the format described above.

<gadgets.txt> should point to dumps/gadgets.txt (or an alternative gadgets file in the same format).

<rop_js> is the resulting JavaScript file that should be executed.

Running ropchains

To run a compiled ROP chain, add the corresponding <script> tag to the end of index.html, then load that page in the PS4 web browser.

PS4 Webkit Bad_Hoist 6.72 Exploit Port WIP by Sleirsgoevy & 6.72 Dumps.jpg
 

Comments

seanp2500

Senior Member
Contributor
yeah it is looking more and more like specterdev is our hope here and he has always come through. I would strongly urge scene to support him in ways each of us can. For those who are struggling yes faith does have power and so does positive thinking. Believe it or not.

@joe2025 ha little do you know I have had my eyes on poop slinger... mwahaha now the odds of someone having poop slinger and a ps4 that is jailbroken!!! So I will prob need to buy it but gosh 3 grand??? maaaaaaaan maybe if I win the lotto or something
 

nikeymikey

Senior Member
Contributor
Verified
@Anubic
Wtf man, are you a bit simple?? History has shown that once the pieces of the puzzle are all out there (which for 6.72, they are) someone will complete it and release it.... It wont take until 2021.. I reckon a couple of weeks or so and we will all be enjoying RDR 2 on our hacked ps4s. I cant wait for the first RDR2 trainer... :)
 

UltraLex

Senior Member
Contributor
Verified
You know what would be cool? If there is some kind of boot disc, Maybe we won't have to use fake pkgs and retail would be fine.
 

lubedjoystick

Member
Contributor
Forgive me if i am wrong but SpecterDev stated in one of his latest streams that tonight will be his last stream because he will go on a vacation of sort where there won't be internet and will continue to work since he cames back. The dude deserves all the rest he can get but for us unfortunately its in a worst possible time. Hope i am wrong and if not lets hope someone else surprises us in the meantime.
 
Recent Articles
State of Play August 2020 Features New Godfall PS5 Gameplay and More!
Following the last PlayStation State of Play event, the Godfall PS5 Reveal Trailer and the Godfall PS5 Box Art here's a recap of the latest State of Play for August 2020 featuring a new Godfall...
Black PS5 DualSense Wireless Controller Images Surface, Prototype Leak?
Proceeding the leaked images of PS5 Swappable White Console Plates, Sony's confirmation that PS4 Peripherals & Accessories Are Not Compatible with PS5 Games and the PS5 News of Updatable DualSense...
New PSN Titles Join PlayStation Store's Summer Sale Promotion
Headlining Sony's latest PlayStation Store Summer Sale promotion are more sizzling hot PSN titles including Final Fantasy VII Remake, Doom Eternal and World War Z. :fire: Here's more from...
PS5 DualSense Wireless Controller to Have Updatable Software
When you thought updating PlayStation 5's Firmware just to play a video game is enough hassle, Sony kicked things up a notch with confirmation on the DualSense Wireless Controller official page...
Top