TheFlow0's BD-JB Sandbox Escape, PS4 13.00 / PS5 12.00 Kernel Exploit & PS5 PUP Unpacker / Decrypt via Zecoxao

As previously announced, today Security Engineer Andy Nguyen (aka theflow0) spoke at Hexacon 2022 discussing his BD-JB: Blu-ray Disc Java Sandbox Escape (PDF) for PS4 / PS5 presented previously at this year's HardWear.io conference prior to disclosing PS5 Kernel Access via PS4 Exploit and the PS4 / PS5 exFAT Vulnerability last month.

Update: In related news theflow0 recently announced on X the disclosure of a Blu-ray Disc Java Sandbox Escape via Two Vulnerabilities Kernel Exploit, with ExploitNetControlImpl.java code available via TheOfficialFloW's Github repository, confirming to quote: "RIP, my PlayStation exploit died. ExploitNetControlImpl.java Works upto PS4 13.00 and PS5 12.00. Patched on PS4 13.02 and PS5 12.02."

Previous Article:

Abstract

WebKit has been exploited in the past in order to have a userland entry point, the initial foothold, on the PS4. Though, porting such an exploit to the PS5 is challenging as the PS5’s AMD CPU newly supports eXecute-Only-Memory (XOM) which prevents the attacker from reading the .text segment. That basically makes it impossible to find addresses of functions, syscalls, and ROP gadgets. In this talk, Andy Nguyen presents a new attack vector and a firmware-agnostic and ROP-less exploit to achieve native code execution on the PS4 and PS5.

Beyond new images shared among the Tweets below, it doesn't appear TheOfficialFloW's Github Repositories have been updated recently nor has a video of today's presentation surfaced yet (added below!), however, those in the PlayStation 5 Scene can check out a PS5 PUP Unpacker and PS5 PUP Decrypt utility via @zecoxao on Twitter with reverse-engineering help from LemonHaze420_ among others detailed below.

Download: ps5-pup-unpacker.7z (1.17 MB) / ps5-pup-unpacker-master.zip / PS5 PUP Unpacker GIT / ps5-pup-decrypt-master.zip / PS5 PUP Decrypt GIT / Zecoxao's Ko-fi Page

• Decrypted PS5 Firmware PUPs
  • pups
    • 300_update1.pup.dec
    • 300_update2.pup.dec
    • 310_update1.pup.dec
    • 310_update2.pup.dec
    • 320_update1.pup.dec
    • 403_update1.pup.dec
    • 450_update1.pup.dec
    • 451_update1.pup.dec
  
  
• Decrypted PS5 Firmware PUPs (Cont'd)
  • pups
    • 300_update1.pup.dec
    • 300_update2.pup.dec
    • 310_update1.pup.dec
    • 310_update2.pup.dec
    • 320_update1.pup.dec
    • 400_update1.pup.dec
    • 402_update1.pup.dec
    • 403_update1.pup.dec
    • 450_update1.pup.dec
    • 451_update1.pup.dec
    • 500_update1.pup.dec
    • 502_update1.pup.dec
    • 510_update1.pup.dec
    • 550_update1.pup.dec
    • 600_update1.pup.dec
    • 601_update1.pup.dec
    • 602_update1.pup.dec
    • 650_update1.pup.dec
    • 700_update1.pup.dec
    • 701_update1.pup.dec
    • 720_update1.pup.dec
    • 740_update1.pup.dec
    • 760_update1.pup.dec
    • 761_update1.pup.dec
  
  
• Matrix Demo on PS5 Map / Videos
  • frosty
    
    • chase.mp4
    • frosty-ps5.part1.rar
    • frosty-ps5.part2.rar
    • frosty-ps5.utoc
    • global.ucas
    • global.utoc
    • logo_vid_hevc.mp4
    • sandbox.mp4
    • wu_vid_0010_hevc.mp4
    • wu_vid_0030_hevc.mp4
    • wu_vid_0070_hevc.mp4
    • wu_vid_0070_subs.json
    • wu_vid_0130_hevc.mp4
    • wu_vid_0130_subs.json
    • wu_vid_0260_hevc.mp4
    • wu_vid_0260_subs.json

This PlayStation 5 PUP Unpacker (based on IDC's PS4 PUP_Unpack, Rewritten by Zer0xFF) comes following the previously released PS5 PUP Info Python Scripts, PS5UPDATE.PUP Unpacked alongside confirmation via notzecoxao on Twitter that BLSUnpack also handles PS5 PUPs... from the PS5 PUP Unpacker README.md: pup_unpacker

A utility to unpack PS5 update blobs that have been previously decrypted using pup_decrypt. this is based on idc/ps4-pup_unpack rewritten with C++ and runs on Linux/OSX/Win32

Note

This utility will not unpack the contents of nested filesystems. The filesystem images in updates are FAT32, exFAT, etc images and can be mounted or unpacked with other tools (for example 7zip with Formats exFAT).

To Build

cmake .
make

And from the PS5 PUP Decrypt README.md: PS5-PUP-Decrypt

PS5 pup decrypt by asking nicely PS5 to do it.

Credits

• SpecterDev: for *** files
• LeGend: for assistance on testing
• Scene-Collective/l0lhax/idc: for original code
• Anonymous: For help in getting the required coolstuff to reverse the protocol
• LemonHaze: For RE help

Usage

Place your PS5 update file in /mnt/usb0/safe.PS5UPDATE.PUP (this is root of your pendrive, file safe.PS5UPDATE.PUP)

Plug the pendrive to the PS5.

Let it do its thing ( warning: this requires elevated privileges for most packages!)

Either one or two files will be produced (PS5UPDATE1.PUP.dec and PS5UPDATE2.PUP.dec) depending on what file you have (sys or recovery)

Requirements

Ubuntu 20.04 with gcc (or WSL alternative)

make

Spoiler: Related Files, Tweets & Videos

HEXACON2022 - bd-jb: Blu-ray Disc Sandbox Escape by Andy Nguyen

 

[achile24]

@streetstylez
Unfortunately it is not possible to activate the PS5 disc without updating to the latest firmware and going online.

 

[dawidps]

@achile24 i'm currently on 6.02, is it worth updating to newer version and then applying the jailbreak or do you think there are no pros for doing that as it won't change much?

 

[sspbhel]

No need to update imo, ps5 disc player is no use unless you have many physical games

 

[pasomo]

This is a really interesting attack vector, especially the transition away from traditional WebKit+ROP chains due to the XOM enforcement on the PS5. I’m especially interested in the necessary prerequisites required to effectively take advantage of BD JB-based exploits on the current firmware, including authoring disc requirements, Java class limitations, and how much firmware-specific work is still necessary despite the firmware-agnostic approach.

 

[darian86]

Will it be possible to activate the Blu-ray drive without updating the console? We'll have to see if they can find a way to do it somehow.

 

[tomh1991]

I have my PS4 on firmware 12.52 and running with the bluray disc method , would love to upgrade to the latest jailbreakable firmware , also wondering if there is a way to get the headset companion app without the store?

Also if i run the exploit bluray disc sometimes it fails and the console reboots into safe mode , sometimes it takes 5-6 tries to get goldhen running is that normal? Or do i need to change something?

I do find it very cool that you just can jailbreak your console with a disc instead of using your computer.

 

[mscaldelai]

have a PS5 fat 11.40 fw, will bluray disc method work with it? sorry my english

 

[Elbo3bo3]

@mscaldelai As for now there is a work on progress for a JB that can reach up to 12 FW ... Let's wait and see what the upcoming days have for us

 

[Zentsuage]

I really thought that was gonna take a lot of time to PS5 get exploits. Here in Brazil the PS4 jailbreak has arrived a little time ago, like nobody knew about it, wow.

 

[e46Saugen]

@mscaldelai there are many userland-exploits that work for your fw 11.40 PS5: BD-JB, LUA, Y2JB and Netflix n Hack. The problem is the kernel-exploit, lapse only works till 10.01 and poopsploit isn't chained with any PS5 userland-exploit although it works up to 12.00.

Your best bet is to wait and hope someone will make poopsploit work with any of the existing userland-exploits. Luac0re with the Star Wars Racer Revenge sadly didn't turn out to work on fw >= 8.00.