TheFlow0's BD-JB Sandbox Escape, PS4 13.00 / PS5 12.00 Kernel Exploit & PS5 PUP Unpacker / Decrypt via Zecoxao

As previously announced, today Security Engineer Andy Nguyen (aka theflow0) spoke at Hexacon 2022 discussing his BD-JB: Blu-ray Disc Java Sandbox Escape (PDF) for PS4 / PS5 presented previously at this year's HardWear.io conference prior to disclosing PS5 Kernel Access via PS4 Exploit and the PS4 / PS5 exFAT Vulnerability last month.

Update: In related news theflow0 recently announced on X the disclosure of a Blu-ray Disc Java Sandbox Escape via Two Vulnerabilities Kernel Exploit, with ExploitNetControlImpl.java code available via TheOfficialFloW's Github repository, confirming to quote: "RIP, my PlayStation exploit died. ExploitNetControlImpl.java Works upto PS4 13.00 and PS5 12.00. Patched on PS4 13.02 and PS5 12.02."

Previous Article:

Abstract

WebKit has been exploited in the past in order to have a userland entry point, the initial foothold, on the PS4. Though, porting such an exploit to the PS5 is challenging as the PS5’s AMD CPU newly supports eXecute-Only-Memory (XOM) which prevents the attacker from reading the .text segment. That basically makes it impossible to find addresses of functions, syscalls, and ROP gadgets. In this talk, Andy Nguyen presents a new attack vector and a firmware-agnostic and ROP-less exploit to achieve native code execution on the PS4 and PS5.

Beyond new images shared among the Tweets below, it doesn't appear TheOfficialFloW's Github Repositories have been updated recently nor has a video of today's presentation surfaced yet (added below!), however, those in the PlayStation 5 Scene can check out a PS5 PUP Unpacker and PS5 PUP Decrypt utility via @zecoxao on Twitter with reverse-engineering help from LemonHaze420_ among others detailed below.

Download: ps5-pup-unpacker.7z (1.17 MB) / ps5-pup-unpacker-master.zip / PS5 PUP Unpacker GIT / ps5-pup-decrypt-master.zip / PS5 PUP Decrypt GIT / Zecoxao's Ko-fi Page

• Decrypted PS5 Firmware PUPs
  • pups
    • 300_update1.pup.dec
    • 300_update2.pup.dec
    • 310_update1.pup.dec
    • 310_update2.pup.dec
    • 320_update1.pup.dec
    • 403_update1.pup.dec
    • 450_update1.pup.dec
    • 451_update1.pup.dec
  
  
• Decrypted PS5 Firmware PUPs (Cont'd)
  • pups
    • 300_update1.pup.dec
    • 300_update2.pup.dec
    • 310_update1.pup.dec
    • 310_update2.pup.dec
    • 320_update1.pup.dec
    • 400_update1.pup.dec
    • 402_update1.pup.dec
    • 403_update1.pup.dec
    • 450_update1.pup.dec
    • 451_update1.pup.dec
    • 500_update1.pup.dec
    • 502_update1.pup.dec
    • 510_update1.pup.dec
    • 550_update1.pup.dec
    • 600_update1.pup.dec
    • 601_update1.pup.dec
    • 602_update1.pup.dec
    • 650_update1.pup.dec
    • 700_update1.pup.dec
    • 701_update1.pup.dec
    • 720_update1.pup.dec
    • 740_update1.pup.dec
    • 760_update1.pup.dec
    • 761_update1.pup.dec
  
  
• Matrix Demo on PS5 Map / Videos
  • frosty
    
    • chase.mp4
    • frosty-ps5.part1.rar
    • frosty-ps5.part2.rar
    • frosty-ps5.utoc
    • global.ucas
    • global.utoc
    • logo_vid_hevc.mp4
    • sandbox.mp4
    • wu_vid_0010_hevc.mp4
    • wu_vid_0030_hevc.mp4
    • wu_vid_0070_hevc.mp4
    • wu_vid_0070_subs.json
    • wu_vid_0130_hevc.mp4
    • wu_vid_0130_subs.json
    • wu_vid_0260_hevc.mp4
    • wu_vid_0260_subs.json

This PlayStation 5 PUP Unpacker (based on IDC's PS4 PUP_Unpack, Rewritten by Zer0xFF) comes following the previously released PS5 PUP Info Python Scripts, PS5UPDATE.PUP Unpacked alongside confirmation via notzecoxao on Twitter that BLSUnpack also handles PS5 PUPs... from the PS5 PUP Unpacker README.md: pup_unpacker

A utility to unpack PS5 update blobs that have been previously decrypted using pup_decrypt. this is based on idc/ps4-pup_unpack rewritten with C++ and runs on Linux/OSX/Win32

Note

This utility will not unpack the contents of nested filesystems. The filesystem images in updates are FAT32, exFAT, etc images and can be mounted or unpacked with other tools (for example 7zip with Formats exFAT).

To Build

cmake .
make

And from the PS5 PUP Decrypt README.md: PS5-PUP-Decrypt

PS5 pup decrypt by asking nicely PS5 to do it.

Credits

• SpecterDev: for *** files
• LeGend: for assistance on testing
• Scene-Collective/l0lhax/idc: for original code
• Anonymous: For help in getting the required coolstuff to reverse the protocol
• LemonHaze: For RE help

Usage

Place your PS5 update file in /mnt/usb0/safe.PS5UPDATE.PUP (this is root of your pendrive, file safe.PS5UPDATE.PUP)

Plug the pendrive to the PS5.

Let it do its thing ( warning: this requires elevated privileges for most packages!)

Either one or two files will be produced (PS5UPDATE1.PUP.dec and PS5UPDATE2.PUP.dec) depending on what file you have (sys or recovery)

Requirements

Ubuntu 20.04 with gcc (or WSL alternative)

make

Spoiler: Related Files, Tweets & Videos

HEXACON2022 - bd-jb: Blu-ray Disc Sandbox Escape by Andy Nguyen

 

[7out]

so did I understand it right, it is posible to jailbreak the ps5 via disc like the ps4? that would be awesome

 

[kingd]

Some exciting developments ongoing at the moment. My PS5 was dormant for almost a year now. I’m still on 4.03. Debating on whether to upgrade to a higher firmware or continue waiting.

 

[James Russell]

Same here, but on 4.50. I am thinking about buying:

1) either an early pro and keep it on 10.00 for now + without disk OR
2) a newer pro (new charge) with a FW hopefully under 12.00 but using it with a drive for now.

 

[kurlbr]

Great, THANKS

I need it to work on a 12.x version

 

[mrsin]

Thanks, I cant wait to test jailbreak on my PS5pro 11.x until then i have to check ps4pro 12.00

 

[tomibi]

I'm still running firmware 9.60 on my PS4, as there are now some really good and stable jailbreak options available, as well as a mature homebrew scene.

Unfortunately, my PS5 ‘unintentionally’ updated to 12.00 - but in retrospect, that seems to have been a stroke of luck, because the new kernel vulnerability only affects up to 12.00 and was only fixed with the higher 12.xx firmware versions.

It looks to me like next year could be really exciting in terms of 12.00. I will definitely not be updating anymore and hope that a clean jailbreak workflow for this version will be available.

 

[GingerRub1x]

I've got a fat PS5 on 3.00 and just managed to get a PS5 Pro for a decent price that included a disc drive. I'm yet to open it but has the serial which indicates it was released in August 25 so should be v12.00 firmware. Which (finger crossed) will hopefully be jailbreakable soon.

My problem is that I can't pair the drive without it forcing an upgrade. I'm hoping the jailbreak for 12.00 will come followed by an offline drive enabler. That would be a great start to 2026.

My PS4 pro is still on 9.00 - but not sure if I should sell it on seeing as we can play all the fpkgs on the PS5.

 

[SerWolf]

How much more effort must be invested in order to successfully unlock the console... It's really impressive what goes in to give us mere mortals the pleasure of playing. Thank you all.

 

[allnewtxp]

Thank you for your hard work and dedication on this project, it's truly appreciated.

 

[mscaldelai]

the ps5 scene is boiling, the understanding of the community is really pleasant compared to the beginning hacks on ps4. i have ps5 11.40 fw