PS4 PS4 5.05 Kernel Exploit released by @SpecterDev - including Homebrew Payloads !!!

After the first announcement for a Kernel Exploit incoming for System Firmware 5.05, Developer @SpecterDev "has been true to one's word" by releasing the announced Kernel Exploit (PS4 Hack) for System Firmware 5.05 (& 5.07). This is some Great News not because of a newer System Firmware is now exploitable, but it could be a giant stride towards great evolution for getting more and more Homebrew Applications available - as already previewed before. Those mentioned "Tools" weren't fully released yet by the time of this writing but a full release should be available in the near future. This Release however also includes several Payloads and other useful Patches, as you can check them down below.​

Screenshot from the 5.05 Kernel Exploit in Action - including some funny "Warning" Notes (Picture Credits by @qwertyoruiopz)​

Ps4 5.05 Kernel Exploit Dev Tweets Demo Videos PS4 Homebrew Toolchain Releases for 5.05

• 
  
  PS4 5.05 / 5.07 Kernel Exploit​
  Summary
  
  • In this project you will find a full implementation of the second "bpf" kernel exploit for the PlayStation 4 on 5.05. It will allow you to run arbitrary code as kernel, to allow jailbreaking and kernel-level modifications to the system. This exploit also contains autolaunching code for Mira and Vortex's HEN payload. Subsequent loads will launch the usual payload launcher. This bug was discovered by qwertyoruiopz, and can be found hosted on his website here.
  
  Patches Included
  
  • The following patches are made by default in the kernel ROP chain:
  1. Disable kernel write protection
  2. Allow RWX (read-write-execute) memory mapping
  3. Syscall instruction allowed anywhere
  4. Dynamic Resolving (sys_dynlib_dlsym) allowed from any process
  5. Custom system call #11 (kexec()) to execute arbitrary code in kernel mode
  6. Allow unprivileged users to call setuid(0) successfully. Works as a status check, doubles as a privilege escalation.
  Payloads included
  
  1. Vortex's HEN (Homebrew Enabler)
  2. Mira
  
  Note: The page will crash on successful kernel exploitation, this is normal​
  
  Contributors - Massive credits to the following:
  
  • qwertyoruiopz
  • Flatz
  • Vortex
  • OpenOrbis Team
  • Anonymous
• 
  
  
  ​
  @SpecterDev Tweet
  

  The 5.05 kernel exploit stack is now released! It includes the kexploit and autolaunches homebrew patches and mira. On subsequent page loads it listens for payloads. Source is up here https://t.co/lUqveOs46A

  
  @SpecterDev Tweet
  

  A few notes on the 5.05 exploit:
  

  1) The page will crash after the kernel exploit successfully runs, this is normal
  2) First load after successful exploitation will autoload HEN and Mira (can get klog by nc [ps4 ip] 9998
  3) Subsequent loads go to the usual payload launcher.​

  
  ‏@qwertyoruiopz - Tweet
  

  ps4 5.05 kernel exploit (BPF setf double free) implementation by @SpecterDev: http://crack.bargains/505k (incl. Mira + XVortexHEN)

  
  @SpecterDev Tweet
  

  From what I'm seeing it seems 5.05 and 5.07 (a rare firmware) webkit and kernel binaries may be identical, so release should work on both

  
  @SpecterDev Tweet
  

  Just to put this out there - I know some are having issues with the system black screening when rebooting out of sleep mode, though I believe this is an issue with Mira, not the exploit itself. It's on the to-do list. Hold power button down for ~10s to force shutdown and reboot.

  
  @SpecterDev Tweet (July 13)
  

  Took me a bit longer than I'd hoped - but the PS4 5.05 Kernel Exploit writeup has now been published . If you have any suggestions for clarity or corrections, please add the issue to the GitHub repo or reply them to this tweet:
  https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4 5.05 BPF Double Free Kernel Exploit Writeup.md

  
  
• 
  
  Various Demonstration from around the Scene.​
• 
  @SpecterDev Tweet
  

  Here's a roadmap on projected tools and such for homebrew development on the PS4. Green = done, Yellow = in progress, Red = not started >>> Ps4 Homebrew Toolchain Roadmap.

  
  Tools
  
  • Oni Auto Installer
  • Oni Framework
  • Mira Framework
  • Console Output Viewer
  • Mira Companion App
    
  • Debugger
  • Remote Viewer
  • Screenshot Capture
  • FTP Explorer
  • Theme Editor
  
  Building
  
  • LLVM Linker
  • Fake PKG Generator
  • PARAM.SFO Editor
  
  Polish/End User Friendliness
  
  • 5.05 Exploit Page W/ Mira Autoload
  • Built-In App Auto-jailbreak / Auto-unsandboxing via Mira
  • Remote PKG Installing
  • Homebrew Store
  • Persistence
  
  Bugs
  
  • MKDIR Mira Bug
  • Mira crashes system rebooting from sleep mode
  • Notification Code (Not Working)
  
  Suggestions
  
  
  
• 
  
  Homebrew Enabler (External-HDD Support) (by xvortex)
  
  • For firmware v5.05 - Make fpkg installer working with external HDD (kudos to flatz for ShellCore offset)
  
  Psxitarch Linux: (by PSXITA Team)
  
  • Psxitarch is a linux distribution for PS4 based on Arch Linux, developed to be light, with low resource usage and easy to install. It includes the graphics drivers (radeon drm, radeonsi) needed to use 3D hardware video acceleration, kernel 4.14.14, support for * bluetooth, * wi-fi, ethernet and USB sound cards. INSTALLED APPLICATIONS, Window manager: jwm, Terminals: lxterminal, xterm, Web Browser: midori, Network Manager: wicd, File manager: pcmanfm, Emulators/Games: steam, retroarch (MULTI EMU), mupen64plus (N64), snes9x (SNES), epsxe (PSX), ppsspp (PSP), Utilities: playonlinux (Gui for wine), leafpad (Text editor), htop (System monitor), xreader (PDF viewer), xarchiver (Archive manager), blueman (Bluetooth manager), Multimedia: gpicview (Img viewer), xnoise (Audio/video player) ADDITIONAL DETAILS & DOWNOADS @ OFFICIAL WEBSITE >>> LINK
  
  PS4 Linux Loader Payload (by valentinbreiz)
  
  • Updated support for the newest System Firmware 5.05 Kernel Exploit that let you run Linux on your PS4.
  
  reactPSPLUS Payload (by Zer0xFF)
  
  • Have a PS Plus Subscription? but can't access your game collection being on a lower firmware and games have reach its expiration for signing into PSN for re-activation, Well, hopefully with this payload it will help you play those games once again. May need a few updates to make all games play as some reports did surface but to early to tell if user error or a issue with the tool that an update will fix.
  
  UI Mod 0.3 Custom Home Menu for 5.05 (by e✘treme)
  
  • Transparent Content Icons / Title Names changed / Location changed for fPKGs / Removed some Icons / Custom User Avatar / Custom Background Music
  
  PS2 Classic GUI (Tool) (by TheDarkProgrammer)
  
  • This utility did not need an update for 5.05 Support, but is a useful tool for preparing a PS2 (Classic) PKG on your exploited PS4, Play your PS2 Collection by preparing your own PS2 PKGs.
  
  PS4 Exploit Host (by Al-Azif)
  
  • A great solution for hosting the exploit on your own LAN connection, no need to rely on a 3rd party site hosting the exploit this handy utility has alot of great features . UPDATE @eXtreme has created a custom playground based on this release (hosting on his website and adding new visuals (and all payloads from Al-Azif's collection) take a look >>> LINK to PS4Brew 5.05 Playground
  
  PS4 Trainer By TylerM
  
  • Here is a trainer for PS4 that I have been working on and it is not 100% just like PS4 modding isn't. I will NOT be adding GTA or COD to this tool. I hope everyone likes it and finds it helpful.YOU MUST ENABLE MIRA+HEN FIRST TO INJECT THE PAYLOAD It is possible these cheats work for different CUSA's. Just have to try and see. If you make a working .cht file. (Pointers preferred) I will add them. I just need you to provide CUSA and game version
  
  X-PROJECT (XMB SELF HOST PROJECT) 5.05 by KiiWii (aka defaultdnb
  
  • Aims to be the AIO customizable toolbox for all your PS4 payload needs on FW 5.05
  
  
  
  
  Development Releases​
  
  PS4Debug (Dev Use) (by Xemio)
  
  • A debugger with support for the PlayStation 4! Have a look at blank for a little example! I hope someone will come along and make a full featured debugger with this framework. Currently supports firmware 5.05 only!
  liborbis (by OrbisDev)
  
  • Libraries and samples for PlayStation 4 (updated to 5.05) >>> http://www.psx-place.com/threads/liborbis-libraries-and-samples-for-playstation-4.18755/
  PS4SDK (bypsxdev)
  
  • via ReadMe" ps4sdk is a modular open source SDK for the PS4 with userland and kernel support.The SDK currently supports most of the standard C library, various FreeBSD 9.0 userland and kernel, as well as some SCE functions. It is designed to be adaptable to new firmwares and entry points and new reverse engineered functions can be integrated into the SDK, by adding headers, function signatures and their names to the list of function stubs. Currently, running user and kernel code on firmwares ~5.05 is supported"
  
  
  Are we missing something???? let us know in the comments below.​

Direct Link to the 5.05 Kernel Exploit (visit from PS4): >>> Click Here <<<
or
for an unofficial version with added payloads / eye candy checkout this link

Source Code: GitHub​

Ps4 Homebrew Toolchain Roadmap >>> Check it out <<<<
Source(s): twitter.com/SpecterDev /(2)/qwertyoruiop
Update: PS4 Write-Up of the 5.05 by SpecterDev
​

 

Ok well good to know gbatemp is good, and I agree everyone should read the dev wiki, that's where I learned about all the non-retail models that got dual video output 2 Ethernet and allot of cool stuff, so it's interesting as well as educational. I also didn't think CBHC was a good idea it seems like it's for lazy ppl tbh, and that's good to know no harm should come by sending payloads (unless you're adding/removing items from the system which if not done properly obviously can and will brick). And I deffenitly learn better from hands on experience or at least visual aid, I wish people on YouTube would care about informing ppl instead of disregarding safety.

cbhc isn't so bad. I've been using it for over a year, but I only play 5 games despite having around 260. some I've never even tried. you can no longer move the exploited game with cbhc. the only way to brick now is by formatting.

Man pkg was copied from usb to ps4 hdd so it appeared on the main screen but it was locked so i realized hen but it didnt work. I'm doing it right?

did you use orbis to create the pkg?

 

cbhc isn't so bad. I've been using it for over a year, but I only play 5 games despite having around 260. some I've never even tried. you can no longer move the exploited game with cbhc. the only way to brick now is by formatting.



did you use orbis to create the pkg?

pkg came from the internet I just copied to usb then to ps4. it was not a backup of some of my games, if that is the issue. but how to use orbis?

 

not sure, but downloading it from the internet could be the issue. I'm not exactly sure how you'd screw up the process though. to make a pkg, dump the game with the app dumper, minimize the browser after deploying the payload, open the game, minimize that, let it finish. it will give you a percentage every minute or whatever you have set in the config.txt (goes by seconds; 60=1 minute). then, make a gp4 with genp4. this is like a cue file with the game's files and sizes, so don't move the files once you've created a go4. after that, load the gp4 into orbis (cfwprophet's github). now, you have your pkg.

btw, you can also get orbis from cfwprophet's twitter account which is where I got it.

 

btw, you can also get orbis from cfwprophet's twitter account which is where I got it.

What is Orbis, I thought that was the codename for the PS4 and the name of the PS4 OS?

Maybe you mean his fake pkg generator http://www.psx-place.com/threads/ps2-fake-pkg-generator-for-ps4-by-cfwprophet.16153/ or fake pkg tools https://anonfile.com/E0j223deb9/Fake_PKG_Tools_v1.2.rar

 

What is Orbis, I thought that was the codename for the PS4 and the name of the PS4 OS?

Maybe you mean his fake pkg generator http://www.psx-place.com/threads/ps2-fake-pkg-generator-for-ps4-by-cfwprophet.16153/ or fake pkg tools https://anonfile.com/E0j223deb9/Fake_PKG_Tools_v1.2.rar

yes, but the files inside refer to it as orbis. I'm pretty sure it's sony code since it says "hacked version by cfwprophet."

 

http://ps4portal.net/ps4-downgrade-to-1-76-official/ is this legit or fake? Ive heard that the ps4portal is trustable but it does smell like a fake

 

http://ps4portal.net/ps4-downgrade-to-1-76-official/ is this legit or fake? Ive heard that the ps4portal is trustable but it does smell like a fake

I don't know if that's trustable. In any case PSX-Place.com has (a probably way better) tutorial for this, you could find it by googling "whatever you wanna google site:PSX-Place.com"

 

Is it possible to use the internet and psn after the exploit ?

 

Is it possible to use the internet and psn after the exploit ?

nope you can't

 

Sorry another question
What happens if the ps4 is on a lower fw 4.73 but has a newer update downloaded but not installed and asking to update, is it possible to delete the update and to stop the ps4 from asking to update?
Thanks

 

Sorry another question
What happens if the ps4 is on a lower fw 4.73 but has a newer update downloaded but not installed and asking to update, is it possible to delete the update and to stop the ps4 from asking to update?
Thanks

You can use FTP to remove the PUP file, so you gotta run an exploit to do that. You could update it via usb, run exploit, remove PUP over FTP .

 

not sure, but downloading it from the internet could be the issue. I'm not exactly sure how you'd screw up the process though. to make a pkg, dump the game with the app dumper, minimize the browser after deploying the payload, open the game, minimize that, let it finish. it will give you a percentage every minute or whatever you have set in the config.txt (goes by seconds; 60=1 minute). then, make a gp4 with genp4. this is like a cue file with the game's files and sizes, so don't move the files once you've created a go4. after that, load the gp4 into orbis (cfwprophet's github). now, you have your pkg.

Then i just put the pkg game from web on genp to make a fpkg? Then it will works on ps4? Or this process works only with my games in bluray?

 

Sorry another question
What happens if the ps4 is on a lower fw 4.73 but has a newer update downloaded but not installed and asking to update, is it possible to delete the update and to stop the ps4 from asking to update?
Thanks

if you're not on an exploitable firmware, I think the only way to delete the update is to reformat the hdd. that's the only way I know of. you could try updating through the recovery menu, but I don't know if it would try to install what's already been downloaded. I've heard that it will.

Then i just put the pkg game from web on genp to make a fpkg? Then it will works on ps4? Or this process works only with my games in bluray?

no, gengp4 is for game dumps. if it's a pkg, it should work. if it doesn't, either you or the person who created did something wrong.

 

You can use FTP to remove the PUP file, so you gotta run an exploit to do that. You could update it via usb, run exploit, remove PUP over FTP .

I have a question. I update my ps4 4.73 via usb to 5.05 version then a run the exploit and works. The pup 5.05 file still exists in ps4?

 

Sorry another question
What happens if the ps4 is on a lower fw 4.73 but has a newer update downloaded but not installed and asking to update, is it possible to delete the update and to stop the ps4 from asking to update?
Thanks

Update from USB via recovery mode. No need to format. Then once on 5.05 and exploited you can delete the PUP via FTP and block updates. Be careful until you have done that, double check which PUP is installing etc.

 

I have a question. I update my ps4 4.73 via usb to 5.05 version then a run the exploit and works. The pup 5.05 file still exists in ps4?

Yea you have to remove the PUP manually after exploit, and be careful to check which FW version it's using, it may want to update from the HDD idk on that

 

Yea you have to remove the PUP manually after exploit, and be careful to check which FW version it's using, it may want to update from the HDD idk on that

Then a need a pc to do that

 

Then a need a pc to do that

Well an Android could use FTP as well

 

I'm curious if a finished update is still located in the update folder. with the wiii u, it also uses a folder named update, but I don't think a finished update download is still stored in that folder. games/updates are stored in the import folder while being downloaded, but are then transferred to its destination afterwards. that's why I'm wondering based on how it works with the wii u.

the recovery menu may be your only hope. I've personally heard of mixed results from doing this. some say that it works; others say that it doesn't. I'm pretty sure that it doesn't from the home menu, so definitely don't do that.

I'd suggest blocking updates immediately to prevent this from happening again. there's a dns method, my ps4 tutorial's method (blocks update servers), and update blocker. I personally don't like the last one since an update will try to download but fail. I don't want to take that risk.

 

Fine. The payload is a file? Other question. If a pkg is fragmented in 5 parts i just put all in usb and install on ps4?

I forgot about this, but try to merge the pkg like this:

copy /b pkg.part01 + pkg.part02 + pkg.part03 + pkg.part04 + pkg.part05

change pkg to whatever the names of the pkgs are. it will merge them into part 1, so delete the rest.