PS4 Webkit Bad_Hoist Exploit for PlayStation 4 Firmware 6.XX by Fire30

Proceeding his PS4 6.20 Build Strings, PS4 7.00 Kernel String and Oct0xor's PS4 Blu-ray Drive Vulnerabilities that were patched in 7.02 on this New Year's Eve 2020 scene dev Fire30 (aka Fire30_ on Twitter) released a PS4 Webkit exploit for 6.XX consoles that gains addrof/fakeobj with arbitrary read/write primitives... according to the developer it was fixed in 7.00 leaving a potential window of opportunity between 5.50 and 6.72 OFW to work from.

Other PlayStation 4 scene contributions from him include a PS4 Webkit Exploit PoC for Firmware 2.XX, PS4 HENkaku Exploit: 3.55 Code Execution, HENkaku PS4 Exploit Update for 3.15 / 3.50 Firmware and this bad_hoist exploit comes following the previously released PS4 5.50 WebKit (Userland) Exploit Rewrite, PS4 6.XX JSC_ConcatMemcpy WebKit Exploit POC and PS4 6.20 WebKit Code Execution Exploit PoC for those following along.

Download: bad_hoist-master.zip / GIT

For newbs: This is a 6.XX PS4 WebKit (Userland) exploit and not a Kernel-level exploit, meaning until a fully implemented 6.XX Kernel exploit is publicly available you won't be able to jailbreak these PlayStation 4 consoles so don't update!

If you can't wait for a Future PlayStation 4 Jailbreak Exploit then Locate a Jailbreakable PS4 5.05 / 5.07 Firmware Console to enjoy playing hundreds of PS4 FPKG games, various emulators and homebrew applications.

It uses an Issue 1665: WebKit: JSC: BytecodeGenerator::hoistSloppyModeFunctionIfNecessary doesn't invalidate the ForInContext object bug from lokihardt of Project Zero, and from the README.md to quote: bad_hoist

Exploit implementation of CVE-2018-4386. Obtains addrof/fakeobj and arbitrary read/write primitives.

Supports PS4 consoles on 6.XX. May also work on older firmware versions, but I am not sure. Bug was fixed in firmware 7.00.

A champagne toast to @DEFAULTDNB for the heads-up of this news on Twitter earlier, and wishing everyone a very safe and Happy New Year's Eve 2020 tonight!

 

[hajiki]

hi i think that devkit and testkit console can help to get games with higher FW to be playable on retail consoles

 

[MadBob]

*snore* wake me up when something actually happens, stopped giving a toss about all this look-at-me-I-did-something-you-cannot-use stuff.

 

[Droxz2007]

Ps4 v7.02 jailbreakable yet?

 

[CoDe ReKeR]

ah some progress, made me actually need to sign in just to commit. Maybe soon we'll get an updated kernel exploit and I can finally use trainers on newer games. Who knows? We'll have to wait and see.

Also @MadBob this is progress in the right direction, while it's not fully useful right now it's the first half of what we need to be able to run code on 6.xx, the kernal exploit is what allows that code to bypass system security.

 

[lotus78]

But don't forget - earlier last year we already had a webkit 6.20 from @SpecterDev - and nothing happend....

 

[hulyahulya]

they enjoy games with people minds, every update same thing. i already sold my ps4 5 months ago because of bla bla. i only interesting what happening here. im happy with pc with free games.

 

[UltraLex]

So, why do the dev's enjoy teasing people so much? Are people really this childish to show their toys and not allow others to play? I mean, WTF

 

[SirSilvan83]

So, at least it's the best News since months... ok, there was already a similar release months ago for FW 6.20 but if I'm correct then the bug for Kexploit was still not fixed.

Maybe we're in luck an it's solved for this <7.00 Webkit and some Dev maybe publish something? Therefore I'm happy about this news, Independent from the result.

 

[Rotbard]

why it comes not cfw out, where is Rebug !!

 

[windwaker]

waiting patiently...