TheFlow0's BD-JB Sandbox Escape, PS4 13.00 / PS5 12.00 Kernel Exploit & PS5 PUP Unpacker / Decrypt via Zecoxao

As previously announced, today Security Engineer Andy Nguyen (aka theflow0) spoke at Hexacon 2022 discussing his BD-JB: Blu-ray Disc Java Sandbox Escape (PDF) for PS4 / PS5 presented previously at this year's HardWear.io conference prior to disclosing PS5 Kernel Access via PS4 Exploit and the PS4 / PS5 exFAT Vulnerability last month.

Update: In related news theflow0 recently announced on X the disclosure of a Blu-ray Disc Java Sandbox Escape via Two Vulnerabilities Kernel Exploit, with ExploitNetControlImpl.java code available via TheOfficialFloW's Github repository, confirming to quote: "RIP, my PlayStation exploit died. ExploitNetControlImpl.java Works upto PS4 13.00 and PS5 12.00. Patched on PS4 13.02 and PS5 12.02."

Previous Article:

Abstract

WebKit has been exploited in the past in order to have a userland entry point, the initial foothold, on the PS4. Though, porting such an exploit to the PS5 is challenging as the PS5’s AMD CPU newly supports eXecute-Only-Memory (XOM) which prevents the attacker from reading the .text segment. That basically makes it impossible to find addresses of functions, syscalls, and ROP gadgets. In this talk, Andy Nguyen presents a new attack vector and a firmware-agnostic and ROP-less exploit to achieve native code execution on the PS4 and PS5.

Beyond new images shared among the Tweets below, it doesn't appear TheOfficialFloW's Github Repositories have been updated recently nor has a video of today's presentation surfaced yet (added below!), however, those in the PlayStation 5 Scene can check out a PS5 PUP Unpacker and PS5 PUP Decrypt utility via @zecoxao on Twitter with reverse-engineering help from LemonHaze420_ among others detailed below.

Download: ps5-pup-unpacker.7z (1.17 MB) / ps5-pup-unpacker-master.zip / PS5 PUP Unpacker GIT / ps5-pup-decrypt-master.zip / PS5 PUP Decrypt GIT / Zecoxao's Ko-fi Page

• Decrypted PS5 Firmware PUPs
  • pups
    • 300_update1.pup.dec
    • 300_update2.pup.dec
    • 310_update1.pup.dec
    • 310_update2.pup.dec
    • 320_update1.pup.dec
    • 403_update1.pup.dec
    • 450_update1.pup.dec
    • 451_update1.pup.dec
  
  
• Decrypted PS5 Firmware PUPs (Cont'd)
  • pups
    • 300_update1.pup.dec
    • 300_update2.pup.dec
    • 310_update1.pup.dec
    • 310_update2.pup.dec
    • 320_update1.pup.dec
    • 400_update1.pup.dec
    • 402_update1.pup.dec
    • 403_update1.pup.dec
    • 450_update1.pup.dec
    • 451_update1.pup.dec
    • 500_update1.pup.dec
    • 502_update1.pup.dec
    • 510_update1.pup.dec
    • 550_update1.pup.dec
    • 600_update1.pup.dec
    • 601_update1.pup.dec
    • 602_update1.pup.dec
    • 650_update1.pup.dec
    • 700_update1.pup.dec
    • 701_update1.pup.dec
    • 720_update1.pup.dec
    • 740_update1.pup.dec
    • 760_update1.pup.dec
    • 761_update1.pup.dec
  
  
• Matrix Demo on PS5 Map / Videos
  • frosty
    
    • chase.mp4
    • frosty-ps5.part1.rar
    • frosty-ps5.part2.rar
    • frosty-ps5.utoc
    • global.ucas
    • global.utoc
    • logo_vid_hevc.mp4
    • sandbox.mp4
    • wu_vid_0010_hevc.mp4
    • wu_vid_0030_hevc.mp4
    • wu_vid_0070_hevc.mp4
    • wu_vid_0070_subs.json
    • wu_vid_0130_hevc.mp4
    • wu_vid_0130_subs.json
    • wu_vid_0260_hevc.mp4
    • wu_vid_0260_subs.json

This PlayStation 5 PUP Unpacker (based on IDC's PS4 PUP_Unpack, Rewritten by Zer0xFF) comes following the previously released PS5 PUP Info Python Scripts, PS5UPDATE.PUP Unpacked alongside confirmation via notzecoxao on Twitter that BLSUnpack also handles PS5 PUPs... from the PS5 PUP Unpacker README.md: pup_unpacker

A utility to unpack PS5 update blobs that have been previously decrypted using pup_decrypt. this is based on idc/ps4-pup_unpack rewritten with C++ and runs on Linux/OSX/Win32

Note

This utility will not unpack the contents of nested filesystems. The filesystem images in updates are FAT32, exFAT, etc images and can be mounted or unpacked with other tools (for example 7zip with Formats exFAT).

To Build

cmake .
make

And from the PS5 PUP Decrypt README.md: PS5-PUP-Decrypt

PS5 pup decrypt by asking nicely PS5 to do it.

Credits

• SpecterDev: for *** files
• LeGend: for assistance on testing
• Scene-Collective/l0lhax/idc: for original code
• Anonymous: For help in getting the required coolstuff to reverse the protocol
• LemonHaze: For RE help

Usage

Place your PS5 update file in /mnt/usb0/safe.PS5UPDATE.PUP (this is root of your pendrive, file safe.PS5UPDATE.PUP)

Plug the pendrive to the PS5.

Let it do its thing ( warning: this requires elevated privileges for most packages!)

Either one or two files will be produced (PS5UPDATE1.PUP.dec and PS5UPDATE2.PUP.dec) depending on what file you have (sys or recovery)

Requirements

Ubuntu 20.04 with gcc (or WSL alternative)

make

Spoiler: Related Files, Tweets & Videos

HEXACON2022 - bd-jb: Blu-ray Disc Sandbox Escape by Andy Nguyen

 

[vicioPessoa]

So that's how the magic happens. This video reignited my passion for learning security once again. The way Andy Nguyen explains the process makes it look easy.

When I see people like this, it makes me reflect on the Bible, because this level of insight doesn't come only from hours of studying, there must be a point where it speaks to you, where you begin to feel it. Hero by day and a villain by night LoL.

I truly appreciate the time and effort the team puts in to make our lives a bit more joyful.

 

[streetstylez]

I have a ps5 digital, does anyone know if i get the disc addon if i have to be online to activate it? or does it just work automatically when i connect the disc drive?

i dont want to have to get one from ebay only for it require an update destroying my jailbreak in the process.

 

[kaziyo88]

God I hope this update comes out soon, especially for us non disc users.

 

[own3dlol]

Looks like I need to get a new PS5 lol. I gotta have another one cause no way I'm going to be able to use online with the jailbreak. It really is crazy everything that has to be decoded and done in order to do the processes that seem so simple once we actually get our hands on them.

I have plenty of PS4 games to catch up on that I didn't buy during that generation so I'll happily wait for a good deal until I get into PS5 scene. As always, thanks to PSXHAX, Andy, and the developers of the jailbreaks. Keep up the great work!

 

[etijeras]

Excellent news that the community continues to move forward, keep pushing!

 

[captainchuckps5]

From the update, it seems like PS4 and PS5 firmware share same core/kernel, and some times same exploits. Maybe they could just have same PS OS and share it between PS4 and PS5, and similar to MacOS, gracefully stop supporting older devices. It confuses me when I see 13.00 exploit while knowing that PS5 major is 12 as for now.

 

[darian86]

For those of us with a PS5 Digital Edition, will there be anything available? (Firmware 11.20)

 

[ghanshyamkukra]

Yeah, I’m in the same boat honestly. Keeping one PS5 for online and another for jailbreak stuff almost feels mandatory at this point. The amount of work that goes on behind the scenes to make all of this possible is wild, especially when it looks so 'easy' once it’s released.

I’ve still got a big PS4 backlog myself, so I’m not in a rush to jump fully into the PS5 scene yet. I’ll probably wait it out until prices drop or something solid comes along.

 

[Elbo3bo3]

Just bought a new PS5 and unfortunately it came with 11.20 firmware included ... These news are awesome ... It will be a matter of time till 12.00 JB is out ... Let's wait and see

 

[sam73368]

The fact that it covers up to PS4 13.00 and PS5 12.00 is amazing. Seeing people like TheFlow0 constantly trying their best to find a flaw in the Playstation consoles just to unlock the full potential of the hardware makes me realize how lucky we are to have them.

I mean, their work is amazing and they are what keeps the ps scene alive. They also give hope to the community that the consoles are not flawless and that maybe one day there will be an exploit on the latest FW for both ps4 and ps5. Thanks a lot to theflow0 and every other contributor for making all of this possible.