PS4 PS4 5.05 Kernel Exploit released by @SpecterDev - including Homebrew Payloads !!!

Discussion in 'PS4 News' started by Roxanne, May 27, 2018.

By Roxanne on May 27, 2018 at 4:32 PM
  1. 186

    Roxanne Moderator

    Mar 3, 2018
    Likes Received:
    Trophy Points:
    Home Page:
    After the first announcement for a Kernel Exploit incoming for System Firmware 5.05, Developer @SpecterDev "has been true to one's word" by releasing the announced Kernel Exploit (PS4 Hack) for System Firmware 5.05 (& 5.07). This is some Great News not because of a newer System Firmware is now exploitable, but it could be a giant stride towards great evolution for getting more and more Homebrew Applications available - as already previewed before. Those mentioned "Tools" weren't fully released yet by the time of this writing but a full release should be available in the near future. This Release however also includes several Payloads and other useful Patches, as you can check them down below.

    5.05 Kernel Exploit.jpg Screenshot from the 5.05 Kernel Exploit in Action - including some funny "Warning" Notes (Picture Credits by @qwertyoruiopz)

    • PS4 5.05 / 5.07 Kernel Exploit
      • In this project you will find a full implementation of the second "bpf" kernel exploit for the PlayStation 4 on 5.05. It will allow you to run arbitrary code as kernel, to allow jailbreaking and kernel-level modifications to the system. This exploit also contains autolaunching code for Mira and Vortex's HEN payload. Subsequent loads will launch the usual payload launcher. This bug was discovered by qwertyoruiopz, and can be found hosted on his website here.

      Patches Included
      • The following patches are made by default in the kernel ROP chain:
      1. Disable kernel write protection
      2. Allow RWX (read-write-execute) memory mapping
      3. Syscall instruction allowed anywhere
      4. Dynamic Resolving (sys_dynlib_dlsym) allowed from any process
      5. Custom system call #11 (kexec()) to execute arbitrary code in kernel mode
      6. Allow unprivileged users to call setuid(0) successfully. Works as a status check, doubles as a privilege escalation.
      Payloads included
      1. Vortex's HEN (Homebrew Enabler)
      2. Mira

      The page will crash on successful kernel exploitation, this is normal

      Contributors -
      Massive credits to the following:

    • item_XL_8608470_16936945.jpg
      @SpecterDev Tweet
      @SpecterDev Tweet
      ‏@qwertyoruiopz - Tweet
      @SpecterDev Tweet
      @SpecterDev Tweet
      @SpecterDev Tweet (July 13)

    • Various Demonstration from around the Scene.

    • @SpecterDev Tweet

      • Oni Auto Installer
      • Oni Framework
      • Mira Framework
      • Console Output Viewer
      • Mira Companion App
      • Debugger
      • Remote Viewer
      • Screenshot Capture
      • FTP Explorer
      • Theme Editor


      • LLVM Linker
      • Fake PKG Generator
      • PARAM.SFO Editor

      Polish/End User Friendliness

      • 5.05 Exploit Page W/ Mira Autoload
      • Built-In App Auto-jailbreak / Auto-unsandboxing via Mira
      • Remote PKG Installing
      • Homebrew Store
      • Persistence


      • MKDIR Mira Bug
      • Mira crashes system rebooting from sleep mode
      • Notification Code (Not Working)


    • Homebrew Enabler (External-HDD Support) (by xvortex)
      • For firmware v5.05 - Make fpkg installer working with external HDD (kudos to flatz for ShellCore offset)

      Psxitarch Linux: (by PSXITA Team)
      • Psxitarch is a linux distribution for PS4 based on Arch Linux, developed to be light, with low resource usage and easy to install. It includes the graphics drivers (radeon drm, radeonsi) needed to use 3D hardware video acceleration, kernel 4.14.14, support for * bluetooth, * wi-fi, ethernet and USB sound cards. INSTALLED APPLICATIONS, Window manager: jwm, Terminals: lxterminal, xterm, Web Browser: midori, Network Manager: wicd, File manager: pcmanfm, Emulators/Games: steam, retroarch (MULTI EMU), mupen64plus (N64), snes9x (SNES), epsxe (PSX), ppsspp (PSP), Utilities: playonlinux (Gui for wine), leafpad (Text editor), htop (System monitor), xreader (PDF viewer), xarchiver (Archive manager), blueman (Bluetooth manager), Multimedia: gpicview (Img viewer), xnoise (Audio/video player) ADDITIONAL DETAILS & DOWNOADS @ OFFICIAL WEBSITE >>> LINK

      PS4 Linux Loader Payload (by valentinbreiz)
      • Updated support for the newest System Firmware 5.05 Kernel Exploit that let you run Linux on your PS4.

      reactPSPLUS Payload (by Zer0xFF)

      • Have a PS Plus Subscription? but can't access your game collection being on a lower firmware and games have reach its expiration for signing into PSN for re-activation, Well, hopefully with this payload it will help you play those games once again. May need a few updates to make all games play as some reports did surface but to early to tell if user error or a issue with the tool that an update will fix.

      UI Mod 0.3 Custom Home Menu for 5.05 (by e✘treme)

      • Transparent Content Icons / Title Names changed / Location changed for fPKGs / Removed some Icons / Custom User Avatar / Custom Background Music

      PS2 Classic GUI (Tool) (by TheDarkProgrammer)

      • This utility did not need an update for 5.05 Support, but is a useful tool for preparing a PS2 (Classic) PKG on your exploited PS4, Play your PS2 Collection by preparing your own PS2 PKGs.

      PS4 Exploit Host (by Al-Azif)

      • A great solution for hosting the exploit on your own LAN connection, no need to rely on a 3rd party site hosting the exploit this handy utility has alot of great features . UPDATE @eXtreme has created a custom playground based on this release (hosting on his website and adding new visuals (and all payloads from Al-Azif's collection) take a look >>> LINK to PS4Brew 5.05 Playground

      PS4 Trainer By TylerM
      • Here is a trainer for PS4 that I have been working on and it is not 100% just like PS4 modding isn't. I will NOT be adding GTA or COD to this tool. I hope everyone likes it and finds it helpful.YOU MUST ENABLE MIRA+HEN FIRST TO INJECT THE PAYLOAD It is possible these cheats work for different CUSA's. Just have to try and see. If you make a working .cht file. (Pointers preferred) I will add them. I just need you to provide CUSA and game version

      X-PROJECT (XMB SELF HOST PROJECT) 5.05 by KiiWii (aka defaultdnb

      • Aims to be the AIO customizable toolbox for all your PS4 payload needs on FW 5.05

      Development Releases

      PS4Debug (Dev Use) (by Xemio)
      • A debugger with support for the PlayStation 4! Have a look at blank for a little example! I hope someone will come along and make a full featured debugger with this framework. Currently supports firmware 5.05 only!
      liborbis (by OrbisDev)
      PS4SDK (bypsxdev)
      • via ReadMe" ps4sdk is a modular open source SDK for the PS4 with userland and kernel support.The SDK currently supports most of the standard C library, various FreeBSD 9.0 userland and kernel, as well as some SCE functions. It is designed to be adaptable to new firmwares and entry points and new reverse engineered functions can be integrated into the SDK, by adding headers, function signatures and their names to the list of function stubs. Currently, running user and kernel code on firmwares ~5.05 is supported"

      Are we missing something???? let us know in the comments below.

    Direct Link to the 5.05 Kernel Exploit (visit from PS4): >>> Click Here <<<


    for an unofficial version with added payloads / eye candy checkout this link

    Source Code:

    Ps4 Homebrew Toolchain Roadmap >>> Check it out <<<<
    Source(s): /(2)/qwertyoruiop

    Update: PS4 Write-Up of the 5.05 by SpecterDev
    Last edited by a moderator: Jul 21, 2018
    gercapo, jhangleigh, T.A.U and 16 others like this.


Discussion in 'PS4 News' started by Roxanne, May 27, 2018.

    1. JuniorJunior
    2. pinky
      np. I've dumped my entire collection (13 games) which includes both digital and retail games. I only installed my retail collection (4 games), and there was never an issue with game size, dumping or installing. FFX HD Remastered may be getting close to the max game size. it's a dual-layer bdvd. I don't know if a triple-layer game disc even exists. for games like FFX HD, expect it to take about two hours to dump, create the pkg, and install. the second largest game I have was Bloodborne.

      the length of time is dependent on the game size, number of files, and the number of encrypted files. when it's decrypting selfs, it can take a while. FFX HD Collection Remastered seems to have quite a few encrypted files. one of the FF games on the ps3 (was it the same game?) has each spell encrypted separately, so there are scores of encrypted files. I think "self decryption" also includes suprx ("secure user plugin") which is the ps4 equivalent of a sprx ("secure plugin"). I'm thinking that FFX HD Remastered on the ps4 might have each spell encrypted as well.

      there seems to be a bug with orbis to where it ignores a gp4 if it meets certain criteria. I don't know what that criteria is, and I've only seen it happen with psn games. it's where the game and patch are dumped separately. it says something like "file not found" and errors immediately. together (patch and game), they work without issue. the game should work regardless. on the ps4, games and patches are separate, in separate folders, and they're dumped separately if you have that set up (default config.txt). you can change the dumping mechanic in the config.txt (goes on root of flash drive). iirc, it tells you what each number, 0-3, does dumping-wise. I think separate is "3," which I'd suggest using unless you encounter the above error. it's better than having to redump the entire game if something goes wrong with a patch or if you accidentally install a patch for a later firmware version (i.e. Street FIghter V's latest patch requires 5.50).
    3. ghostspar
      My ps4 is running 5.07. I've tried running Al-Azif's PS4 host and I keep getting Unsupported PS4 Attempted to access exploits.

      Do I need to use the crack.b.... website? Or try something else?
    4. JuniorJunior
      Man I had problems here. I got the dump early today. so I downloaded some games and put it in the usb for installation so when I try to perform the exploit the ps4 hangs up and then performs the bug scan. What can it be
    5. ayassinsayed
      How to put pkg file over 4 g.b in extranal usb fat 32 to install ps4 i am new to ps4 or use network ?

      Sent from my iPhone using Tapatalk
    6. pinky
      that's something that should be worthy of mention. the payloads don't exactly make the system "stable." they can cause crashes and freezing if used incorrectly. minimize with the ps button after successfully deploying a payload. then, if you want to use a second payload, open the browser, then push the cancel button (cross or circle) immediately to back out of the payload previously used. then, connect to the bookmark (whether it's a bookmark to a site hosting the files or self-hosted files).

      needs to be exfat.
      Last edited: May 29, 2018
      DrexploidHax likes this.
    7. DrexploidHax
      I didn’t know the PS4 supported exfat, I got rwx permission problems on Raspbian (RPi3B+) using ntfs when and if it’s supporred, and that completely fixes the problem for me thanks for the FYI tip man
    8. JuniorJunior
      I simply used a usb drive with a ps4 pkg so I performed the dump and copied the files. then I performed hen and ps4 rebooted. I tried several times and was afraid to break the console. then the game pkg appears on the main screen but does not work. What can it be
    9. pinky
      hen has to be rerun at every boot. also, afaik, games don't natively work on usb. you have to install to the internal hdd first, then use app2usb (a payload). it redirects the location as outlined by the app.db which you should backup btw.
      DrexploidHax likes this.
    10. pinky
      yes, updating and installing pkg files - exfat is supported. I've never tried using an external hdd, but I'm pretty sure it needs to be exfat and not the format made by the system itself. :)
    11. DrexploidHax
      Well afaik you can’t use a PS4 HDD on a PC can you? I personally haven’t ran across or thought about using a PS4 formatted HDD for backups as you can’t back them up to a PC (assuming the PS4 formatted drive can’t be read by a PC).
    12. JuniorJunior
      Fine. The payload is a file? Other question. If a pkg is fragmented in 5 parts i just put all in usb and install on ps4?
    13. pinky
      I think the way to derive your hdd key is known, but it's not public, so there's currently no way to look at the hdd on a pc. you can, however, look at the content via ftp. if it's been updated, use the db and sg payload by the stooged. it will backup your databases and saved games. I think games are stored in the user directory and game updates are in the patch directory. they're natively pkgs, so you can't examine game files unless you dump the game. I'd suggest backing up the pkg files for all of your games like I did. that's about 200 GBs of space on two hdds. :-p
    14. pinky
      unknown. all of my pkgs were one file with the patch being a separate file. the pkgs on the system could be more than one file though. I think the update to street fighter 5 is two or three pkg files.

      I think how many files a payload is depends. it could be one as a .bin or several as a .html
      JuniorJunior likes this.
    15. DrexploidHax
      Well I personally only have discs and a virgin PS4 so I haven’t been able to try anything, I’ve been waiting for PSXitARCH to be updated to 5.05/7 to do anything, as I believe 5.05/7 would work for cod ww2, and I need the arch Distro for allot of reasons.
    16. pinky
      I haven't really gamed, only backed up my games. btw, you'll get a sign in to psn error if you try booting a game without hen. anyway, I've been preoccupied with the switch. :-p
      DrexploidHax likes this.
    17. DrexploidHax
      If the place you read up on doesn’t contain warez, could you link it?ive been using wololo and gbatemp but I haven’t found it very reliable
    18. pinky
      I learned most of what I know from gbatemp. however, this is one of those things where you learn more by doing and testing. I've learned a lot by doing that. it can be a bit confusing at first since too many payloads can cause the system to go into a panic. that happened to me the first couple times I tried. however, once you figure out how to use them, it's very simple.

      before trying anything, I did a lot of reading on both temp and psdevwiki. I'd suggest doing that when it comes to hacking any console. I think that's the problem with people using youtube videos as reference. it's because it's quick and easy while disregarding safety. I mean you don't usually buy the first car or house you look at, right??? I've seen a lot of people brick with cbhc on the wii u due to this. granted, you're probably unlikely to brick with the ps4, unless you mess with ftp, but it's something to remember. I'm a visual learner myself, but I can get through just text if need be. it's sometimes safer to do so. that's one thing I wish I had with my tutorials - pictures or videos.
      DrexploidHax likes this.
    19. DrexploidHax
      Ok well good to know gbatemp is good, and I agree everyone should read the dev wiki, that’s where I learned about all the non-retail models that got dual video output 2 Ethernet and allot of cool stuff, so it’s interesting as well as educational. I also didn’t think CBHC was a good idea it seems like it’s for lazy ppl tbh, and that’s good to know no harm should come by sending payloads (unless you’re adding/removing items from the system which if not done properly obviously can and will brick). And I deffenitly learn better from hands on experience or at least visual aid, I wish people on YouTube would care about informing ppl instead of disregarding safety.
    20. JuniorJunior
      Man pkg was copied from usb to ps4 hdd so it appeared on the main screen but it was locked so i realized hen but it didnt work. I'm doing it right?

Share This Page