P2JB — Patience to Jailbreak (PS5 11.00–12.00)

JavaScript kernel exploit for PS5 firmware 11.00–12.00, running inside the Y2JB framework.
Based on the P2JB bug by Gezine.

---

The Bug

sys_kqueueex holds a crhold() on the calling thread's ucred. If the optional name argument causes copyinstr() to fail (EFAULT), the error cleanup path calls free() + fdclose() + fdrop() — but never crfree() — permanently leaking one cr_ref per call.

__sys_kqueueex((const char *)0x800000000000ULL);  // EFAULT → leaks 1 ref

Repeated ~4.3 billion times, the 32-bit cr_ref wraps from 0xFFFFFFFF back to 0. A subsequent setuid(0) then frees the real ucred while staged file descriptors still hold fp->f_cred pointers to it → use-after-free → heap spray → double-free → kernel r/w.

---

Exploit Chain

Phase	What happens
1	Stage 64 FDs (each holds a live fp->f_cred ref)
2	Leak cr_ref ~4.3B times via sys_kqueueex (~7 hours)
3	setuid(0) → frees real ucred (FDs now dangle)
4	Spray heap with fake ucreds (cr_ref=1) via IPV6_RTHDR
5	Close staged FDs → crfree() on fake ucred → double-free
6	Twin scan: find two sockets aliasing the same freed buffer
7	slowKread8 via ip6po_nhinfo → getsockopt(IPV6_NEXTHOP)
8	Bootstrap ipv6_kernel_rw for full kernel r/w
9	Patch curproc ucred → jailbreak + post-exploitation

---

Supported Firmware Versions

Firmware	Status
11.00	✅ Supported
11.20	✅ Supported
11.40	✅ Supported
11.60	✅ Supported
12.00	✅ Supported
10.xx and below	❌ Not supported
12.02+	❓ Offsets unknown
13.00+	❌ Bug patched by Sony

---

Files

File	Purpose
p2jb_complete.js	Main exploit payload — send via Y2JB's remote JS loader

---

Requirements

• PS5 firmware 11.00–12.00
• Y2JB framework loaded on PS5

---

Usage

Send the payload

Y2JB's remote JS loader starts as soon as the exploit page loads — before jailbreak.
It binds to port 50000 and loops forever accepting payloads.

Send p2jb_complete.js via Y2JB's remote JS loader (e.g., using netcat or a custom sender).

The exploit calibrates the syscall rate on startup and logs the actual ETA. Progress is reported every 50M calls.

Post-jailbreak

Once jailbroken, the exploit automatically:

1. Patches curproc ucred (root uid, SYSTEM authid, full SCE caps)
2. Escapes the filesystem sandbox (sets fd_rdir/fd_jdir to rootvnode)
3. Patches kernel security flags, DEX target_id, QA flags, utoken flags
4. Launches elfldr via elf_loader() — listens on port 9021 for native ELF payloads
5. Kills the YouTube app process

Place elfldr.elf at /data/elfldr.elf on the PS5 before running.

# Send a native ELF payload after jailbreak:
nc <PS5_IP> 9021 < payload.elf

---

Credits

• Gezine — P2JB bug discovery and Y2JB framework
• Bug patched by Sony in PS5 firmware 13.00