As previously announced, today Security Engineer Andy Nguyen (aka theflow0) spoke at Hexacon 2022 discussing his BD-JB: Blu-ray Disc Java Sandbox Escape (PDF) for PS4 / PS5 previously presented at this year's HardWear.io conference prior to disclosing PS5 Kernel Access via PS4 Exploit and the PS4 / PS5 exFAT Vulnerability last month. 
Abstract
WebKit has been exploited in the past in order to have a userland entry point, the initial foothold, on the PS4. Though, porting such an exploit to the PS5 is challenging as the PS5’s AMD CPU newly supports eXecute-Only-Memory (XOM) which prevents the attacker from reading the .text segment. That basically makes it impossible to find addresses of functions, syscalls, and ROP gadgets. In this talk, Andy Nguyen presents a new attack vector and a firmware-agnostic and ROP-less exploit to achieve native code execution on the PS4 and PS5.
Beyond new images shared among the Tweets below, it doesn't appear TheOfficialFloW's Github Repositories have been updated recentlynor has a video of today's presentation surfaced yet (added below!), however, those in the PlayStation 5 Scene can check out a PS5 PUP Unpacker and PS5 PUP Decrypt utility via @zecoxao on Twitter with reverse-engineering help from LemonHaze420_ among others detailed below. 
Download: ps5-pup-unpacker.7z (1.17 MB) / ps5-pup-unpacker-master.zip / GIT / ps5-pup-decrypt-master.zip / GIT / Zecoxao's Ko-fi Page
A utility to unpack PS5 update blobs that have been previously decrypted using pup_decrypt. this is based on idc/ps4-pup_unpack rewritten with C++ and runs on Linux/OSX/Win32
Note
This utility will not unpack the contents of nested filesystems. The filesystem images in updates are FAT32, exFAT, etc images and can be mounted or unpacked with other tools (for example 7zip with Formats exFAT).
To Build
And from the PS5 PUP Decrypt README.md: PS5-PUP-Decrypt
PS5 pup decrypt by asking nicely PS5 to do it.
Credits
Place your PS5 update file in /mnt/usb0/safe.PS5UPDATE.PUP (this is root of your pendrive, file safe.PS5UPDATE.PUP)
Plug the pendrive to the PS5.
Let it do its thing (
warning: this requires elevated privileges for most packages!)
Either one or two files will be produced (PS5UPDATE1.PUP.dec and PS5UPDATE2.PUP.dec) depending on what file you have (sys or recovery)
Requirements
Ubuntu 20.04 with gcc (or WSL alternative)
HEXACON2022 - bd-jb: Blu-ray Disc Sandbox Escape by Andy Nguyen
Abstract
WebKit has been exploited in the past in order to have a userland entry point, the initial foothold, on the PS4. Though, porting such an exploit to the PS5 is challenging as the PS5’s AMD CPU newly supports eXecute-Only-Memory (XOM) which prevents the attacker from reading the .text segment. That basically makes it impossible to find addresses of functions, syscalls, and ROP gadgets. In this talk, Andy Nguyen presents a new attack vector and a firmware-agnostic and ROP-less exploit to achieve native code execution on the PS4 and PS5.
Beyond new images shared among the Tweets below, it doesn't appear TheOfficialFloW's Github Repositories have been updated recently
Download: ps5-pup-unpacker.7z (1.17 MB) / ps5-pup-unpacker-master.zip / GIT / ps5-pup-decrypt-master.zip / GIT / Zecoxao's Ko-fi Page
Decrypted PS5 Firmware PUPs- pups
- 300_update1.pup.dec
- 300_update2.pup.dec
- 310_update1.pup.dec
- 310_update2.pup.dec
- 320_update1.pup.dec
- 403_update1.pup.dec
- 450_update1.pup.dec
- 451_update1.pup.dec
- pups
- Decrypted PS5 Firmware PUPs (Cont'd)
- pups
- 300_update1.pup.dec
- 300_update2.pup.dec
- 310_update1.pup.dec
- 310_update2.pup.dec
- 320_update1.pup.dec
- 400_update1.pup.dec
- 402_update1.pup.dec
- 403_update1.pup.dec
- 450_update1.pup.dec
- 451_update1.pup.dec
- 500_update1.pup.dec
- 502_update1.pup.dec
- 510_update1.pup.dec
- 550_update1.pup.dec
- 600_update1.pup.dec
- 601_update1.pup.dec
- 602_update1.pup.dec
- 650_update1.pup.dec
- 700_update1.pup.dec
- 701_update1.pup.dec
- 720_update1.pup.dec
- 740_update1.pup.dec
- 760_update1.pup.dec
- 761_update1.pup.dec
- pups
- Matrix Demo on PS5 Map / Videos
- frosty
- chase.mp4
- frosty-ps5.part1.rar
- frosty-ps5.part2.rar
- frosty-ps5.utoc
- global.ucas
- global.utoc
- logo_vid_hevc.mp4
- sandbox.mp4
- wu_vid_0010_hevc.mp4
- wu_vid_0030_hevc.mp4
- wu_vid_0070_hevc.mp4
- wu_vid_0070_subs.json
- wu_vid_0130_hevc.mp4
- wu_vid_0130_subs.json
- wu_vid_0260_hevc.mp4
- wu_vid_0260_subs.json
- frosty
A utility to unpack PS5 update blobs that have been previously decrypted using pup_decrypt. this is based on idc/ps4-pup_unpack rewritten with C++ and runs on Linux/OSX/Win32
Note
This utility will not unpack the contents of nested filesystems. The filesystem images in updates are FAT32, exFAT, etc images and can be mounted or unpacked with other tools (for example 7zip with Formats exFAT).
To Build
Code:
cmake .
makePS5 pup decrypt by asking nicely PS5 to do it.
Credits
- SpecterDev: for *** files
- LeGend: for assistance on testing
- Scene-Collective/l0lhax/idc: for original code
- Anonymous: For help in getting the required coolstuff to reverse the protocol
- LemonHaze: For RE help
Place your PS5 update file in /mnt/usb0/safe.PS5UPDATE.PUP (this is root of your pendrive, file safe.PS5UPDATE.PUP)
Plug the pendrive to the PS5.
Let it do its thing (
warning: this requires elevated privileges for most packages!)Either one or two files will be produced (PS5UPDATE1.PUP.dec and PS5UPDATE2.PUP.dec) depending on what file you have (sys or recovery)
Requirements
Ubuntu 20.04 with gcc (or WSL alternative)
Code:
makeHEXACON2022 - bd-jb: Blu-ray Disc Sandbox Escape by Andy Nguyen
