PS4 PS4 5.05 Kernel Exploit released by @SpecterDev - including Homebrew Payloads !!!

After the first announcement for a Kernel Exploit incoming for System Firmware 5.05, Developer @SpecterDev "has been true to one's word" by releasing the announced Kernel Exploit (PS4 Hack) for System Firmware 5.05 (& 5.07). This is some Great News not because of a newer System Firmware is now exploitable, but it could be a giant stride towards great evolution for getting more and more Homebrew Applications available - as already previewed before. Those mentioned "Tools" weren't fully released yet by the time of this writing but a full release should be available in the near future. This Release however also includes several Payloads and other useful Patches, as you can check them down below.​

Screenshot from the 5.05 Kernel Exploit in Action - including some funny "Warning" Notes (Picture Credits by @qwertyoruiopz)​

Ps4 5.05 Kernel Exploit Dev Tweets Demo Videos PS4 Homebrew Toolchain Releases for 5.05

• 
  
  PS4 5.05 / 5.07 Kernel Exploit​
  Summary
  
  • In this project you will find a full implementation of the second "bpf" kernel exploit for the PlayStation 4 on 5.05. It will allow you to run arbitrary code as kernel, to allow jailbreaking and kernel-level modifications to the system. This exploit also contains autolaunching code for Mira and Vortex's HEN payload. Subsequent loads will launch the usual payload launcher. This bug was discovered by qwertyoruiopz, and can be found hosted on his website here.
  
  Patches Included
  
  • The following patches are made by default in the kernel ROP chain:
  1. Disable kernel write protection
  2. Allow RWX (read-write-execute) memory mapping
  3. Syscall instruction allowed anywhere
  4. Dynamic Resolving (sys_dynlib_dlsym) allowed from any process
  5. Custom system call #11 (kexec()) to execute arbitrary code in kernel mode
  6. Allow unprivileged users to call setuid(0) successfully. Works as a status check, doubles as a privilege escalation.
  Payloads included
  
  1. Vortex's HEN (Homebrew Enabler)
  2. Mira
  
  Note: The page will crash on successful kernel exploitation, this is normal​
  
  Contributors - Massive credits to the following:
  
  • qwertyoruiopz
  • Flatz
  • Vortex
  • OpenOrbis Team
  • Anonymous
• 
  
  
  ​
  @SpecterDev Tweet
  

  The 5.05 kernel exploit stack is now released! It includes the kexploit and autolaunches homebrew patches and mira. On subsequent page loads it listens for payloads. Source is up here https://t.co/lUqveOs46A

  
  @SpecterDev Tweet
  

  A few notes on the 5.05 exploit:
  

  1) The page will crash after the kernel exploit successfully runs, this is normal
  2) First load after successful exploitation will autoload HEN and Mira (can get klog by nc [ps4 ip] 9998
  3) Subsequent loads go to the usual payload launcher.​

  
  ‏@qwertyoruiopz - Tweet
  

  ps4 5.05 kernel exploit (BPF setf double free) implementation by @SpecterDev: http://crack.bargains/505k (incl. Mira + XVortexHEN)

  
  @SpecterDev Tweet
  

  From what I'm seeing it seems 5.05 and 5.07 (a rare firmware) webkit and kernel binaries may be identical, so release should work on both

  
  @SpecterDev Tweet
  

  Just to put this out there - I know some are having issues with the system black screening when rebooting out of sleep mode, though I believe this is an issue with Mira, not the exploit itself. It's on the to-do list. Hold power button down for ~10s to force shutdown and reboot.

  
  @SpecterDev Tweet (July 13)
  

  Took me a bit longer than I'd hoped - but the PS4 5.05 Kernel Exploit writeup has now been published . If you have any suggestions for clarity or corrections, please add the issue to the GitHub repo or reply them to this tweet:
  https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4 5.05 BPF Double Free Kernel Exploit Writeup.md

  
  
• 
  
  Various Demonstration from around the Scene.​
• 
  @SpecterDev Tweet
  

  Here's a roadmap on projected tools and such for homebrew development on the PS4. Green = done, Yellow = in progress, Red = not started >>> Ps4 Homebrew Toolchain Roadmap.

  
  Tools
  
  • Oni Auto Installer
  • Oni Framework
  • Mira Framework
  • Console Output Viewer
  • Mira Companion App
    
  • Debugger
  • Remote Viewer
  • Screenshot Capture
  • FTP Explorer
  • Theme Editor
  
  Building
  
  • LLVM Linker
  • Fake PKG Generator
  • PARAM.SFO Editor
  
  Polish/End User Friendliness
  
  • 5.05 Exploit Page W/ Mira Autoload
  • Built-In App Auto-jailbreak / Auto-unsandboxing via Mira
  • Remote PKG Installing
  • Homebrew Store
  • Persistence
  
  Bugs
  
  • MKDIR Mira Bug
  • Mira crashes system rebooting from sleep mode
  • Notification Code (Not Working)
  
  Suggestions
  
  
  
• 
  
  Homebrew Enabler (External-HDD Support) (by xvortex)
  
  • For firmware v5.05 - Make fpkg installer working with external HDD (kudos to flatz for ShellCore offset)
  
  Psxitarch Linux: (by PSXITA Team)
  
  • Psxitarch is a linux distribution for PS4 based on Arch Linux, developed to be light, with low resource usage and easy to install. It includes the graphics drivers (radeon drm, radeonsi) needed to use 3D hardware video acceleration, kernel 4.14.14, support for * bluetooth, * wi-fi, ethernet and USB sound cards. INSTALLED APPLICATIONS, Window manager: jwm, Terminals: lxterminal, xterm, Web Browser: midori, Network Manager: wicd, File manager: pcmanfm, Emulators/Games: steam, retroarch (MULTI EMU), mupen64plus (N64), snes9x (SNES), epsxe (PSX), ppsspp (PSP), Utilities: playonlinux (Gui for wine), leafpad (Text editor), htop (System monitor), xreader (PDF viewer), xarchiver (Archive manager), blueman (Bluetooth manager), Multimedia: gpicview (Img viewer), xnoise (Audio/video player) ADDITIONAL DETAILS & DOWNOADS @ OFFICIAL WEBSITE >>> LINK
  
  PS4 Linux Loader Payload (by valentinbreiz)
  
  • Updated support for the newest System Firmware 5.05 Kernel Exploit that let you run Linux on your PS4.
  
  reactPSPLUS Payload (by Zer0xFF)
  
  • Have a PS Plus Subscription? but can't access your game collection being on a lower firmware and games have reach its expiration for signing into PSN for re-activation, Well, hopefully with this payload it will help you play those games once again. May need a few updates to make all games play as some reports did surface but to early to tell if user error or a issue with the tool that an update will fix.
  
  UI Mod 0.3 Custom Home Menu for 5.05 (by e✘treme)
  
  • Transparent Content Icons / Title Names changed / Location changed for fPKGs / Removed some Icons / Custom User Avatar / Custom Background Music
  
  PS2 Classic GUI (Tool) (by TheDarkProgrammer)
  
  • This utility did not need an update for 5.05 Support, but is a useful tool for preparing a PS2 (Classic) PKG on your exploited PS4, Play your PS2 Collection by preparing your own PS2 PKGs.
  
  PS4 Exploit Host (by Al-Azif)
  
  • A great solution for hosting the exploit on your own LAN connection, no need to rely on a 3rd party site hosting the exploit this handy utility has alot of great features . UPDATE @eXtreme has created a custom playground based on this release (hosting on his website and adding new visuals (and all payloads from Al-Azif's collection) take a look >>> LINK to PS4Brew 5.05 Playground
  
  PS4 Trainer By TylerM
  
  • Here is a trainer for PS4 that I have been working on and it is not 100% just like PS4 modding isn't. I will NOT be adding GTA or COD to this tool. I hope everyone likes it and finds it helpful.YOU MUST ENABLE MIRA+HEN FIRST TO INJECT THE PAYLOAD It is possible these cheats work for different CUSA's. Just have to try and see. If you make a working .cht file. (Pointers preferred) I will add them. I just need you to provide CUSA and game version
  
  X-PROJECT (XMB SELF HOST PROJECT) 5.05 by KiiWii (aka defaultdnb
  
  • Aims to be the AIO customizable toolbox for all your PS4 payload needs on FW 5.05
  
  
  
  
  Development Releases​
  
  PS4Debug (Dev Use) (by Xemio)
  
  • A debugger with support for the PlayStation 4! Have a look at blank for a little example! I hope someone will come along and make a full featured debugger with this framework. Currently supports firmware 5.05 only!
  liborbis (by OrbisDev)
  
  • Libraries and samples for PlayStation 4 (updated to 5.05) >>> http://www.psx-place.com/threads/liborbis-libraries-and-samples-for-playstation-4.18755/
  PS4SDK (bypsxdev)
  
  • via ReadMe" ps4sdk is a modular open source SDK for the PS4 with userland and kernel support.The SDK currently supports most of the standard C library, various FreeBSD 9.0 userland and kernel, as well as some SCE functions. It is designed to be adaptable to new firmwares and entry points and new reverse engineered functions can be integrated into the SDK, by adding headers, function signatures and their names to the list of function stubs. Currently, running user and kernel code on firmwares ~5.05 is supported"
  
  
  Are we missing something???? let us know in the comments below.​

Direct Link to the 5.05 Kernel Exploit (visit from PS4): >>> Click Here <<<
or
for an unofficial version with added payloads / eye candy checkout this link

Source Code: GitHub​

Ps4 Homebrew Toolchain Roadmap >>> Check it out <<<<
Source(s): twitter.com/SpecterDev /(2)/qwertyoruiop
Update: PS4 Write-Up of the 5.05 by SpecterDev
​

 

Been keeping the "Releases for 5.05" updated a bit.
If missing anything let us know...

 

Is there any chances of a 5.50 or 5.53 exploit coming soon does anyone know if the devs are working on it thanks not updating anymore just waiting patiently for it

 

Hi guys, I want to say job well done by the devs and all involved in this amazing but tireless achievement, thank you!

So I got myself another PS4 a 1tb Final Fantasy XV limited edition which came with ofw 3.55 . I've read 90% of the stuff posted in this thread. However what's not clear for me is.... What should I do? Do I update to 4.05, 4.07'or 5.05 via usb of course. So what do we do next when our / my PS4 gets exploited? Forgive my barrage of questions but I'm kindly asking for some clarity or guidance please.. Thanks to all and anyone that replies!

 

Hi guys, I want to say job well done by the devs and all involved in this amazing but tireless achievement, thank you!

So I got myself another PS4 a 1tb Final Fantasy XV limited edition which came with ofw 3.55 . I've read 90% of the stuff posted in this thread. However what's not clear for me is.... What should I do? Do I update to 4.05, 4.07'or 5.05 via usb of course. So what do we do next when our / my PS4 gets exploited? Forgive my barrage of questions but I'm kindly asking for some clarity or guidance please.. Thanks to all and anyone that replies!

5.05 if you want to play the newest games. most important payloads have been updated. however, I've heard of weird bugs with certain payloads on 5.05, but they don't seem to affect everyone. most issues seem to be attributed to the slim and the pro as the original ps4 seems to be most compatible. rest mode, for example, seems to be extremely glitchy for non-phat systems. I've never bothered with rest mode though. I also haven't played any games with my system. and, I'm still on 4.55. I mostly just read and soak in the knowledge of what other people are saying, psdevwiki, or through personal tests which I've done some of with the ps4.

btw, love the avatar. I'm a fan of that series, even got Michael Dorn's autograph.

 

5.05 if you want to play the newest games. most important payloads have been updated. however, I've heard of weird bugs with certain payloads on 5.05, but they don't seem to affect everyone. most issues seem to be attributed to the slim and the pro as the original ps4 seems to be most compatible. rest mode, for example, seems to be extremely glitchy for non-phat systems. I've never bothered with rest mode though. I also haven't played any games with my system. and, I'm still on 4.55. I mostly just read and soak in the knowledge of what other people are saying, psdevwiki, or through personal tests which I've done some of with the ps4.

btw, love the avatar. I'm a fan of that series, even got Michael Dorn's autograph.

Thank you Pinky... So are saying it's more stable to go to 4.55 and then later on as 5.05 gets more stable I could venture there or go 5.05 and be done with it? Should I do
The update via recovery mode or just update offline on usb should be fine ?

 

Thank you Pinky... So are saying it's more stable to go to 4.55 and then later on as 5.05 gets more stable I could venture there or go 5.05 and be done with it? Should I do
The update via recovery mode or just update offline on usb should be fine ?

I don't know how stable 5.05 is, but a lot of people seem to have some weird issues with it, mostly if using mira. if a pending update exists, use the recovery menu. from within there, you can select usb. you may be able to do this with the home menu, but I wouldn't trust it if a pending install exists. personally, I'd use the recovery menu either way just to be safe. block updates first. you can do this with certain dns or the servers directly (have a tutorial with the list or all that I could find. this won't block the internet or game updates.).

 

I downloaded resident evil 7 PS4 6 pieces of 4gb downloaded pkg merger to join the pieces plus pkg merger version does not run on windows 7x86 I downloaded the x86 version and it does not run the program opens and it already closes​

 

I downloaded resident evil 7 PS4 6 pieces of 4gb downloaded pkg merger to join the pieces plus pkg merger version does not run on windows 7x86 I downloaded the x86 version and it does not run the program opens and it already closes​

don't know. I've never had a need for a merger. if you backup the game directly, there's no need for it as the pkg created will be a single file. the only time I've seen pkgs split was on the octolus website, but those are only official updates, some of which can be gigantic. I don't know why you're having issues though. it could be cmd line only. you could merge the files like this:

copy /b game_part1.pkg + game_part2.pkg + etc for however many parts there are.  that's probably what the merger is doing actually

name the pkgs accordingly. however, as I said, this should not be necessary if you rip a game that you own. the biggest game I own is FFX HD Remastered at 49.7GBs, and the pkg was only 1 file.

 

don't know. I've never had a need for a merger. if you backup the game directly, there's no need for it as the pkg created will be a single file. the only time I've seen pkgs split was on the octolus website, but those are only official updates, some of which can be gigantic. I don't know why you're having issues though. it could be cmd line only. you could merge the files like this:

copy /b game_part1.pkg + game_part2.pkg + etc for however many parts there are.  that's probably what the merger is doing actually

name the pkgs accordingly. however, as I said, this should not be necessary if you rip a game that you own. the biggest game I own is FFX HD Remastered at 49.7GBs, and the pkg was only 1 file.

Ok thanks i try

 

Is there any way to play backups from an external hard drive or do they have to be on internal hard drive thanks

 

Internal only.

 

Is it possible to back up my ps4 hdd and upgrade to a 2tb hdd without having to update my system software from PlayStation and losing the 505 exploit if so can someone tell me how or put a link on here how to do it or where I can get the complete 505 system software from thanks for you help

 

Is it possible to back up my ps4 hdd and upgrade to a 2tb hdd without having to update my system software from PlayStation and losing the 505 exploit if so can someone tell me how or put a link on here how to do it or where I can get the complete 505 system software from thanks for you help

yes, the 5.05 recovery pup file.

 

Sorry for such a noob question but when I do a back up to an external hdd is that where I find the 5.05 recovery pup file and do I just reinstall it will it be exactly the same as it was thanks for you quick response

 

Is it possible to back up my ps4 hdd and upgrade to a 2tb hdd without having to update my system software from PlayStation and losing the 505 exploit if so can someone tell me how or put a link on here how to do it or where I can get the complete 505 system software from thanks for you help

If you mean backup purchased PSN content and then restore it to a new drive, without updating, then no, after restoring the backup, it will ask you to sign in to reactivate the games. Maybe there is a manual way to backup the licences and act.dat if there is one.

If you only have fpkg content on there then it will probably work ok by just restoring the backup.

Here is a link to the 5.05 recovery update, (link removed) make sure you pick the correct pup.

 

Thanks mate you are a legend I only have a 500gb hdd in my ps4 and I want to upgrade it to a 2tb hdd so I can fit more pkgs on it so all I do is download the 5.05 recovery pup in the link and install it on the new 2tb hdd then install the backup from my old 500gb hdd and that's it or is there anything else I have to do and do I backup from the ps4 xmb or through the debug folder backup is there any chance you can give me a step by step way to do it I know I'm a pain in the butt but this is all new to me thanks for your reply

 

Thanks mate you are a legend I only have a 500gb hdd in my ps4 and I want to upgrade it to a 2tb hdd so I can fit more pkgs on it so all I do is download the 5.05 recovery pup in the link and install it on the new 2tb hdd then install the backup from my old 500gb hdd and that's it or is there anything else I have to do and do I backup from the ps4 xmb or through the debug folder backup is there any chance you can give me a step by step way to do it I know I'm a pain in the butt but this is all new to me thanks for your reply

You will have to figure it out. Ive only done it on my official consoles. Im actually not sure if you can use the backup and restore without any PSN account on there. So you will need to check that out.

 

Thanks for your help anyway DeViL303 maybe someone else on here might be able to help me been looking on the internet but can't find anything on it with the exploit on there system thank anyway

 

Added some additional releases for 5.05 .. in the first post (releases for 5.05) tab

 

Thanks mate you are a legend I only have a 500gb hdd in my ps4 and I want to upgrade it to a 2tb hdd so I can fit more pkgs on it so all I do is download the 5.05 recovery pup in the link and install it on the new 2tb hdd then install the backup from my old 500gb hdd and that's it or is there anything else I have to do and do I backup from the ps4 xmb or through the debug folder backup is there any chance you can give me a step by step way to do it I know I'm a pain in the butt but this is all new to me thanks for your reply

my suggestion is to back up everything with the app dumper just in case backup/restore doesn't work correctly. I've read of fake signed games disappearing just by rebuilding the database, so there's no telling what it will do here. it's a bit of a pita since you'll then have to enable hen for every game you install, but it will at least be safe. you will get that sign in message if you try opening one of those fake signed games without hen, so if this doesn't work, you'll probably be greeted with the same message. keep us posted if it does or doesn't work as it will be good info for everyone.