PS4 PS4 5.05 Kernel Exploit released by @SpecterDev - including Homebrew Payloads !!!

Discussion in 'PS4 News' started by Roxanne, May 27, 2018.

By Roxanne on May 27, 2018 at 4:32 PM
  1. 186

    Roxanne Moderator

    Mar 3, 2018
    Likes Received:
    Trophy Points:
    Home Page:
    After the first announcement for a Kernel Exploit incoming for System Firmware 5.05, Developer @SpecterDev "has been true to one's word" by releasing the announced Kernel Exploit (PS4 Hack) for System Firmware 5.05 (& 5.07). This is some Great News not because of a newer System Firmware is now exploitable, but it could be a giant stride towards great evolution for getting more and more Homebrew Applications available - as already previewed before. Those mentioned "Tools" weren't fully released yet by the time of this writing but a full release should be available in the near future. This Release however also includes several Payloads and other useful Patches, as you can check them down below.

    5.05 Kernel Exploit.jpg Screenshot from the 5.05 Kernel Exploit in Action - including some funny "Warning" Notes (Picture Credits by @qwertyoruiopz)

    • PS4 5.05 / 5.07 Kernel Exploit
      • In this project you will find a full implementation of the second "bpf" kernel exploit for the PlayStation 4 on 5.05. It will allow you to run arbitrary code as kernel, to allow jailbreaking and kernel-level modifications to the system. This exploit also contains autolaunching code for Mira and Vortex's HEN payload. Subsequent loads will launch the usual payload launcher. This bug was discovered by qwertyoruiopz, and can be found hosted on his website here.

      Patches Included
      • The following patches are made by default in the kernel ROP chain:
      1. Disable kernel write protection
      2. Allow RWX (read-write-execute) memory mapping
      3. Syscall instruction allowed anywhere
      4. Dynamic Resolving (sys_dynlib_dlsym) allowed from any process
      5. Custom system call #11 (kexec()) to execute arbitrary code in kernel mode
      6. Allow unprivileged users to call setuid(0) successfully. Works as a status check, doubles as a privilege escalation.
      Payloads included
      1. Vortex's HEN (Homebrew Enabler)
      2. Mira

      The page will crash on successful kernel exploitation, this is normal

      Contributors -
      Massive credits to the following:

    • item_XL_8608470_16936945.jpg
      @SpecterDev Tweet
      @SpecterDev Tweet
      ‏@qwertyoruiopz - Tweet
      @SpecterDev Tweet
      @SpecterDev Tweet
      @SpecterDev Tweet (July 13)

    • Various Demonstration from around the Scene.

    • @SpecterDev Tweet

      • Oni Auto Installer
      • Oni Framework
      • Mira Framework
      • Console Output Viewer
      • Mira Companion App
      • Debugger
      • Remote Viewer
      • Screenshot Capture
      • FTP Explorer
      • Theme Editor


      • LLVM Linker
      • Fake PKG Generator
      • PARAM.SFO Editor

      Polish/End User Friendliness

      • 5.05 Exploit Page W/ Mira Autoload
      • Built-In App Auto-jailbreak / Auto-unsandboxing via Mira
      • Remote PKG Installing
      • Homebrew Store
      • Persistence


      • MKDIR Mira Bug
      • Mira crashes system rebooting from sleep mode
      • Notification Code (Not Working)


    • Homebrew Enabler (External-HDD Support) (by xvortex)
      • For firmware v5.05 - Make fpkg installer working with external HDD (kudos to flatz for ShellCore offset)

      Psxitarch Linux: (by PSXITA Team)
      • Psxitarch is a linux distribution for PS4 based on Arch Linux, developed to be light, with low resource usage and easy to install. It includes the graphics drivers (radeon drm, radeonsi) needed to use 3D hardware video acceleration, kernel 4.14.14, support for * bluetooth, * wi-fi, ethernet and USB sound cards. INSTALLED APPLICATIONS, Window manager: jwm, Terminals: lxterminal, xterm, Web Browser: midori, Network Manager: wicd, File manager: pcmanfm, Emulators/Games: steam, retroarch (MULTI EMU), mupen64plus (N64), snes9x (SNES), epsxe (PSX), ppsspp (PSP), Utilities: playonlinux (Gui for wine), leafpad (Text editor), htop (System monitor), xreader (PDF viewer), xarchiver (Archive manager), blueman (Bluetooth manager), Multimedia: gpicview (Img viewer), xnoise (Audio/video player) ADDITIONAL DETAILS & DOWNOADS @ OFFICIAL WEBSITE >>> LINK

      PS4 Linux Loader Payload (by valentinbreiz)
      • Updated support for the newest System Firmware 5.05 Kernel Exploit that let you run Linux on your PS4.

      reactPSPLUS Payload (by Zer0xFF)

      • Have a PS Plus Subscription? but can't access your game collection being on a lower firmware and games have reach its expiration for signing into PSN for re-activation, Well, hopefully with this payload it will help you play those games once again. May need a few updates to make all games play as some reports did surface but to early to tell if user error or a issue with the tool that an update will fix.

      UI Mod 0.3 Custom Home Menu for 5.05 (by e✘treme)

      • Transparent Content Icons / Title Names changed / Location changed for fPKGs / Removed some Icons / Custom User Avatar / Custom Background Music

      PS2 Classic GUI (Tool) (by TheDarkProgrammer)

      • This utility did not need an update for 5.05 Support, but is a useful tool for preparing a PS2 (Classic) PKG on your exploited PS4, Play your PS2 Collection by preparing your own PS2 PKGs.

      PS4 Exploit Host (by Al-Azif)

      • A great solution for hosting the exploit on your own LAN connection, no need to rely on a 3rd party site hosting the exploit this handy utility has alot of great features . UPDATE @eXtreme has created a custom playground based on this release (hosting on his website and adding new visuals (and all payloads from Al-Azif's collection) take a look >>> LINK to PS4Brew 5.05 Playground

      PS4 Trainer By TylerM
      • Here is a trainer for PS4 that I have been working on and it is not 100% just like PS4 modding isn't. I will NOT be adding GTA or COD to this tool. I hope everyone likes it and finds it helpful.YOU MUST ENABLE MIRA+HEN FIRST TO INJECT THE PAYLOAD It is possible these cheats work for different CUSA's. Just have to try and see. If you make a working .cht file. (Pointers preferred) I will add them. I just need you to provide CUSA and game version

      X-PROJECT (XMB SELF HOST PROJECT) 5.05 by KiiWii (aka defaultdnb

      • Aims to be the AIO customizable toolbox for all your PS4 payload needs on FW 5.05

      Development Releases

      PS4Debug (Dev Use) (by Xemio)
      • A debugger with support for the PlayStation 4! Have a look at blank for a little example! I hope someone will come along and make a full featured debugger with this framework. Currently supports firmware 5.05 only!
      liborbis (by OrbisDev)
      PS4SDK (bypsxdev)
      • via ReadMe" ps4sdk is a modular open source SDK for the PS4 with userland and kernel support.The SDK currently supports most of the standard C library, various FreeBSD 9.0 userland and kernel, as well as some SCE functions. It is designed to be adaptable to new firmwares and entry points and new reverse engineered functions can be integrated into the SDK, by adding headers, function signatures and their names to the list of function stubs. Currently, running user and kernel code on firmwares ~5.05 is supported"

      Are we missing something???? let us know in the comments below.

    Direct Link to the 5.05 Kernel Exploit (visit from PS4): >>> Click Here <<<


    for an unofficial version with added payloads / eye candy checkout this link

    Source Code:

    Ps4 Homebrew Toolchain Roadmap >>> Check it out <<<<
    Source(s): /(2)/qwertyoruiop

    Update: PS4 Write-Up of the 5.05 by SpecterDev
    Last edited by a moderator: Jul 21, 2018
    gercapo, jhangleigh, T.A.U and 16 others like this.


Discussion in 'PS4 News' started by Roxanne, May 27, 2018.

    1. al-sadiq
    2. DeViL303
      STLcardsWS and al-sadiq like this.
    3. pinky
      that website only contains game updates, and they're not fake signed, so they won't work with a game rip. also, the min firmware requirement is with the latest patch. games by themselves - I don't know.
      al-sadiq likes this.
    4. STLcardsWS
    5. nickxfaster
      Hello im nikos from greece i saw your news about ps4 i got one ps4 4.73 and need to put 5.0.5 firmware please tell me where to go and download it and after how to jailbreak it if you got a tutorial to see ..if you can help i would be grateful ..

      Στάλθηκε από το HUAWEI VNS-L21 μου χρησιμοποιώντας Tapatalk
    6. deadbody
      im currently on 4.55.... i dont have my ps4 bd rom matching there anyway i can update too? or will it brick my ps4?
    7. DeViL303
      You cant update, stay on 4.55.
    8. hibernate
      Does anyone know how to run FTP server? Thank you.
    9. Ozy666
      EXCELLENT! Great thank to all dev. Tested - > working! Pkg installation working. Waiting for good homebrew, like movian, multiman
    10. pinky
      there's an ftp server that's been updated to 5.05 I believe. unfortunately, I don't know the name of the dev who made it, but you can probably find it via google (github). what it will do is say that welcome to ftp server iirc on the home menu followed by the ip and port number. you can then use ftp. be careful as several partitions now have write access. I believe these are flash partitions too.
      hibernate likes this.
    11. faith genesis raven
      faith genesis raven
      Sorry if its off topic or silly questions

      I'm very interested in the recent advancements of the ps4 so I was looking into getting a second ps4.

      can i use the exploit on a ps4 that is already banned?
      can i use the exploit on a ps4 that has a non working disc drive?
      does it work on all ps4 models?
      Last edited: May 28, 2018
    12. hibernate
    13. Killer Bunny
      Killer Bunny
      Isn't this funny? The devs are able to jailbreak the PS4 but not the ps3 super slim on of 4.82
    14. DrexploidHax
      It’s funny that people who can’t discover a kernel exploit, make an entry point, thoroughly test it, and release it to the public complain about the lack of support on exploits they didn’t create. I didn’t make HAN but thought it was insane they got that far on the thought to be UNHACKABLE models unless you solder onto it which take both money and soldering skills.
      DeViL303 likes this.
    15. pinky
      I believe pkgs for the ps4 use a fake license as there's a rif generator as part of orbis. I think it's similar to the vita hack. it bypasses pfs (don't think the folder even exists after dumping a game), and the selfs are decrypted using the system itself ("decrypting selfs" as part of the app dumping process if you've ever dumped a game).. on the ps4, games and updates are merely pkgs which are decrypted and extracted somewhere on the hdd. they let the system decrypt these. it's different with the ps3..
    16. DeViL303
      PS4 hack is similar to the HAN hack in lots of ways. So you could just as easily say "isn't it funny that all the new consoles like super slim ps3 and ps4 use browser hacks that need to be applied again after every reboot". :)
      Bloodmoons366466 likes this.
    17. Bloodmoons366466
      The ps3 was never ment to be hacked to begin with due to the way the os was made,the ps3 has han which nearly does the same thing as the ps4 jailbreak,but cant take advantage of any kernel exploits due to its unsighned code restriction on the os unless you run cfw.The ps4 isnt really jailbroken since it isn't running cfw,It's taking advantage of somthing called hen,which allows you to homebrew enable the console through the webbrowser to run unsighned code.The ps4 os seems to have more loop holes or vulnerable points since the ps4 falls victim to somthing as simple as a web browser exploit.We still have a long ways to go before the console is fully hacked to be able to install a cfw or atleast a custom patch,but unsighned code without any of that goes to show how vulnerable the os really is.
    18. DrexploidHax
      I think I think it’s kinda weird that the PS3 only had 2 FW versions exploitable in its entire life and the newer/pricier console has had 4 FW versions hacked SO FAR and most likely more to come. How is the PS4 that much more vulnerable? Or do the researchers, devs, etc. just put that much more work into the PS4 than they did the PS3?
    19. pinky
      after looking at orbis again, I couldn't find the rif generator. I did find a debug rif key, so it may be using that for games. I could've sworn I saw some ps4 app with a rif generator though. :-p

      and, I agree with @DeViL303 . :)

      I wouldn't necessarily call the ps4 exploit a jailbreak.
    20. DrexploidHax
      Not to argue and split hairs, and I agree that it’s not a “jailbreak” in conventional terms or a full jailbreak like CFW. But wouldn’t an unexploited PS4 on 1.76 4.05 4.55 5.05 be “jailed” and it could be considered (as apposed to a fully untethered or permanent jailbreak) semi-(un)tethered jailbreak?

Share This Page