Skip to content
Permalink
master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

PS4-5.05-Kernel-Exploit/README.md

Go to file
 
 
Cannot retrieve contributors at this time
PS4 5.05 Kernel Exploit Summary Patches Included Payloads included Notes Contributors Additional Thanks
35 lines (27 sloc) 1.58 KB
Raw Blame
Open in GitHub Desktop

PS4 5.05 Kernel Exploit

Summary

In this project you will find a full implementation of the second "bpf" kernel exploit for the PlayStation 4 on 5.05. It will allow you to run arbitrary code as kernel, to allow jailbreaking and kernel-level modifications to the system. This exploit also contains autolaunching code for Mira and Vortex's HEN payload. Subsequent loads will launch the usual payload launcher.

This bug was discovered by qwertyoruiopz, and can be found hosted on his website here. The GitHub Pages site automatically generated from this repository should also work.

Patches Included

The following patches are made by default in the kernel ROP chain:

  1. Disable kernel write protection
  2. Allow RWX (read-write-execute) memory mapping
  3. Syscall instruction allowed anywhere
  4. Dynamic Resolving (sys_dynlib_dlsym) allowed from any process
  5. Custom system call #11 (kexec()) to execute arbitrary code in kernel mode
  6. Allow unprivileged users to call setuid(0) successfully. Works as a status check, doubles as a privilege escalation.

Payloads included

  1. Vortex's HEN (Homebrew Enabler)
  2. Mira

Notes

  • The page will crash on successful kernel exploitation, this is normal

Contributors

Massive credits to the following:

Additional Thanks