TheFlow0's BD-JB Sandbox Escape, PS4 13.00 / PS5 12.00 Kernel Exploit & PS5 PUP Unpacker / Decrypt via Zecoxao

As previously announced, today Security Engineer Andy Nguyen (aka theflow0) spoke at Hexacon 2022 discussing his BD-JB: Blu-ray Disc Java Sandbox Escape (PDF) for PS4 / PS5 presented previously at this year's HardWear.io conference prior to disclosing PS5 Kernel Access via PS4 Exploit and the PS4 / PS5 exFAT Vulnerability last month.

Update: In related news theflow0 recently announced on X the disclosure of a Blu-ray Disc Java Sandbox Escape via Two Vulnerabilities Kernel Exploit, with ExploitNetControlImpl.java code available via TheOfficialFloW's Github repository, confirming to quote: "RIP, my PlayStation exploit died. ExploitNetControlImpl.java Works upto PS4 13.00 and PS5 12.00. Patched on PS4 13.02 and PS5 12.02."

Previous Article:

Abstract

WebKit has been exploited in the past in order to have a userland entry point, the initial foothold, on the PS4. Though, porting such an exploit to the PS5 is challenging as the PS5’s AMD CPU newly supports eXecute-Only-Memory (XOM) which prevents the attacker from reading the .text segment. That basically makes it impossible to find addresses of functions, syscalls, and ROP gadgets. In this talk, Andy Nguyen presents a new attack vector and a firmware-agnostic and ROP-less exploit to achieve native code execution on the PS4 and PS5.

Beyond new images shared among the Tweets below, it doesn't appear TheOfficialFloW's Github Repositories have been updated recently nor has a video of today's presentation surfaced yet (added below!), however, those in the PlayStation 5 Scene can check out a PS5 PUP Unpacker and PS5 PUP Decrypt utility via @zecoxao on Twitter with reverse-engineering help from LemonHaze420_ among others detailed below.

Download: ps5-pup-unpacker.7z (1.17 MB) / ps5-pup-unpacker-master.zip / PS5 PUP Unpacker GIT / ps5-pup-decrypt-master.zip / PS5 PUP Decrypt GIT / Zecoxao's Ko-fi Page

• Decrypted PS5 Firmware PUPs
  • pups
    • 300_update1.pup.dec
    • 300_update2.pup.dec
    • 310_update1.pup.dec
    • 310_update2.pup.dec
    • 320_update1.pup.dec
    • 403_update1.pup.dec
    • 450_update1.pup.dec
    • 451_update1.pup.dec
  
  
• Decrypted PS5 Firmware PUPs (Cont'd)
  • pups
    • 300_update1.pup.dec
    • 300_update2.pup.dec
    • 310_update1.pup.dec
    • 310_update2.pup.dec
    • 320_update1.pup.dec
    • 400_update1.pup.dec
    • 402_update1.pup.dec
    • 403_update1.pup.dec
    • 450_update1.pup.dec
    • 451_update1.pup.dec
    • 500_update1.pup.dec
    • 502_update1.pup.dec
    • 510_update1.pup.dec
    • 550_update1.pup.dec
    • 600_update1.pup.dec
    • 601_update1.pup.dec
    • 602_update1.pup.dec
    • 650_update1.pup.dec
    • 700_update1.pup.dec
    • 701_update1.pup.dec
    • 720_update1.pup.dec
    • 740_update1.pup.dec
    • 760_update1.pup.dec
    • 761_update1.pup.dec
  
  
• Matrix Demo on PS5 Map / Videos
  • frosty
    
    • chase.mp4
    • frosty-ps5.part1.rar
    • frosty-ps5.part2.rar
    • frosty-ps5.utoc
    • global.ucas
    • global.utoc
    • logo_vid_hevc.mp4
    • sandbox.mp4
    • wu_vid_0010_hevc.mp4
    • wu_vid_0030_hevc.mp4
    • wu_vid_0070_hevc.mp4
    • wu_vid_0070_subs.json
    • wu_vid_0130_hevc.mp4
    • wu_vid_0130_subs.json
    • wu_vid_0260_hevc.mp4
    • wu_vid_0260_subs.json

This PlayStation 5 PUP Unpacker (based on IDC's PS4 PUP_Unpack, Rewritten by Zer0xFF) comes following the previously released PS5 PUP Info Python Scripts, PS5UPDATE.PUP Unpacked alongside confirmation via notzecoxao on Twitter that BLSUnpack also handles PS5 PUPs... from the PS5 PUP Unpacker README.md: pup_unpacker

A utility to unpack PS5 update blobs that have been previously decrypted using pup_decrypt. this is based on idc/ps4-pup_unpack rewritten with C++ and runs on Linux/OSX/Win32

Note

This utility will not unpack the contents of nested filesystems. The filesystem images in updates are FAT32, exFAT, etc images and can be mounted or unpacked with other tools (for example 7zip with Formats exFAT).

To Build

cmake .
make

And from the PS5 PUP Decrypt README.md: PS5-PUP-Decrypt

PS5 pup decrypt by asking nicely PS5 to do it.

Credits

• SpecterDev: for *** files
• LeGend: for assistance on testing
• Scene-Collective/l0lhax/idc: for original code
• Anonymous: For help in getting the required coolstuff to reverse the protocol
• LemonHaze: For RE help

Usage

Place your PS5 update file in /mnt/usb0/safe.PS5UPDATE.PUP (this is root of your pendrive, file safe.PS5UPDATE.PUP)

Plug the pendrive to the PS5.

Let it do its thing ( warning: this requires elevated privileges for most packages!)

Either one or two files will be produced (PS5UPDATE1.PUP.dec and PS5UPDATE2.PUP.dec) depending on what file you have (sys or recovery)

Requirements

Ubuntu 20.04 with gcc (or WSL alternative)

make

Spoiler: Related Files, Tweets & Videos

HEXACON2022 - bd-jb: Blu-ray Disc Sandbox Escape by Andy Nguyen

 

[darian86]

Things are progressing, will those of us on version 11.40, the digital version of the PS5, be lucky enough to enjoy the homebrew scene? Or will I have to buy a PS5 with a Blu-ray disc?

 

[Darkmice]

I really like the PS4 Blu-ray exploit but worry sometimes that the drive will eventually give out on me. I still haven't made the plunge to get a PS5 although with the scene being so hot I may, even with the price hikes. Sounds like a good Christmas present to myself.

 

[forum2k]

my PS5 is still on 10.20 hoping TheFlow will find a way to get the party started on a higher firmware !

 

[intensepsx3]

Mine is at 12.02. Would it be included when 12.00 jb for ps5 is out?

 

[Dark Pikachu]

I don't think so at the moment, but we must remain hopeful for the near future

 

[geocentric]

The Flow has been know to give us Christmas presents. Hoping he will be in the giving mood soon

 

[qwert94022]

I believe getting the exploit is purely matter of time. The bigger issue seems to be on the side of working over game dumps (FPKGs etc.). We already have kernel access for multiple firmware versions, but still no major progress in that area. To say the truth kernel exploit fo 10.01, so just a year old firmware is a huge thing, but still it's not super useful without further development behind.

 

[Ben99]

Probably getting ahead of things here, but i have a 4.0 firmware PS5, what would be the best 'safe' firmware for now to use? I hear 8.2 is best, love any suggestions as i am new to the community! Also any info on how backports work would be amazing! thanks!

 

[dajpereira]

Is it possible to use a homelab server to save the games and play from there? Or the game pkg always have to be connected on the PS5? I got verry bad FTP transfer rates to send games to my PS5 form my pc. How can I upgrade that? I have gigabit lan.

 

[Dark Pikachu]

It seems to me that we should forget about FTP; ideally, download the game and transfer it to an external SSD to maintain loading speeds. It requires an investment, but it's worth it. Enjoy the game!