PS4 PS4 5.05 Kernel Exploit released by @SpecterDev - including Homebrew Payloads !!!

After the first announcement for a Kernel Exploit incoming for System Firmware 5.05, Developer @SpecterDev "has been true to one's word" by releasing the announced Kernel Exploit (PS4 Hack) for System Firmware 5.05 (& 5.07). This is some Great News not because of a newer System Firmware is now exploitable, but it could be a giant stride towards great evolution for getting more and more Homebrew Applications available - as already previewed before. Those mentioned "Tools" weren't fully released yet by the time of this writing but a full release should be available in the near future. This Release however also includes several Payloads and other useful Patches, as you can check them down below.​

Screenshot from the 5.05 Kernel Exploit in Action - including some funny "Warning" Notes (Picture Credits by @qwertyoruiopz)​

Ps4 5.05 Kernel Exploit Dev Tweets Demo Videos PS4 Homebrew Toolchain Releases for 5.05

• 
  
  PS4 5.05 / 5.07 Kernel Exploit​
  Summary
  
  • In this project you will find a full implementation of the second "bpf" kernel exploit for the PlayStation 4 on 5.05. It will allow you to run arbitrary code as kernel, to allow jailbreaking and kernel-level modifications to the system. This exploit also contains autolaunching code for Mira and Vortex's HEN payload. Subsequent loads will launch the usual payload launcher. This bug was discovered by qwertyoruiopz, and can be found hosted on his website here.
  
  Patches Included
  
  • The following patches are made by default in the kernel ROP chain:
  1. Disable kernel write protection
  2. Allow RWX (read-write-execute) memory mapping
  3. Syscall instruction allowed anywhere
  4. Dynamic Resolving (sys_dynlib_dlsym) allowed from any process
  5. Custom system call #11 (kexec()) to execute arbitrary code in kernel mode
  6. Allow unprivileged users to call setuid(0) successfully. Works as a status check, doubles as a privilege escalation.
  Payloads included
  
  1. Vortex's HEN (Homebrew Enabler)
  2. Mira
  
  Note: The page will crash on successful kernel exploitation, this is normal​
  
  Contributors - Massive credits to the following:
  
  • qwertyoruiopz
  • Flatz
  • Vortex
  • OpenOrbis Team
  • Anonymous
• 
  
  
  ​
  @SpecterDev Tweet
  

  The 5.05 kernel exploit stack is now released! It includes the kexploit and autolaunches homebrew patches and mira. On subsequent page loads it listens for payloads. Source is up here https://t.co/lUqveOs46A

  
  @SpecterDev Tweet
  

  A few notes on the 5.05 exploit:
  

  1) The page will crash after the kernel exploit successfully runs, this is normal
  2) First load after successful exploitation will autoload HEN and Mira (can get klog by nc [ps4 ip] 9998
  3) Subsequent loads go to the usual payload launcher.​

  
  ‏@qwertyoruiopz - Tweet
  

  ps4 5.05 kernel exploit (BPF setf double free) implementation by @SpecterDev: http://crack.bargains/505k (incl. Mira + XVortexHEN)

  
  @SpecterDev Tweet
  

  From what I'm seeing it seems 5.05 and 5.07 (a rare firmware) webkit and kernel binaries may be identical, so release should work on both

  
  @SpecterDev Tweet
  

  Just to put this out there - I know some are having issues with the system black screening when rebooting out of sleep mode, though I believe this is an issue with Mira, not the exploit itself. It's on the to-do list. Hold power button down for ~10s to force shutdown and reboot.

  
  @SpecterDev Tweet (July 13)
  

  Took me a bit longer than I'd hoped - but the PS4 5.05 Kernel Exploit writeup has now been published . If you have any suggestions for clarity or corrections, please add the issue to the GitHub repo or reply them to this tweet:
  https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4 5.05 BPF Double Free Kernel Exploit Writeup.md

  
  
• 
  
  Various Demonstration from around the Scene.​
• 
  @SpecterDev Tweet
  

  Here's a roadmap on projected tools and such for homebrew development on the PS4. Green = done, Yellow = in progress, Red = not started >>> Ps4 Homebrew Toolchain Roadmap.

  
  Tools
  
  • Oni Auto Installer
  • Oni Framework
  • Mira Framework
  • Console Output Viewer
  • Mira Companion App
    
  • Debugger
  • Remote Viewer
  • Screenshot Capture
  • FTP Explorer
  • Theme Editor
  
  Building
  
  • LLVM Linker
  • Fake PKG Generator
  • PARAM.SFO Editor
  
  Polish/End User Friendliness
  
  • 5.05 Exploit Page W/ Mira Autoload
  • Built-In App Auto-jailbreak / Auto-unsandboxing via Mira
  • Remote PKG Installing
  • Homebrew Store
  • Persistence
  
  Bugs
  
  • MKDIR Mira Bug
  • Mira crashes system rebooting from sleep mode
  • Notification Code (Not Working)
  
  Suggestions
  
  
  
• 
  
  Homebrew Enabler (External-HDD Support) (by xvortex)
  
  • For firmware v5.05 - Make fpkg installer working with external HDD (kudos to flatz for ShellCore offset)
  
  Psxitarch Linux: (by PSXITA Team)
  
  • Psxitarch is a linux distribution for PS4 based on Arch Linux, developed to be light, with low resource usage and easy to install. It includes the graphics drivers (radeon drm, radeonsi) needed to use 3D hardware video acceleration, kernel 4.14.14, support for * bluetooth, * wi-fi, ethernet and USB sound cards. INSTALLED APPLICATIONS, Window manager: jwm, Terminals: lxterminal, xterm, Web Browser: midori, Network Manager: wicd, File manager: pcmanfm, Emulators/Games: steam, retroarch (MULTI EMU), mupen64plus (N64), snes9x (SNES), epsxe (PSX), ppsspp (PSP), Utilities: playonlinux (Gui for wine), leafpad (Text editor), htop (System monitor), xreader (PDF viewer), xarchiver (Archive manager), blueman (Bluetooth manager), Multimedia: gpicview (Img viewer), xnoise (Audio/video player) ADDITIONAL DETAILS & DOWNOADS @ OFFICIAL WEBSITE >>> LINK
  
  PS4 Linux Loader Payload (by valentinbreiz)
  
  • Updated support for the newest System Firmware 5.05 Kernel Exploit that let you run Linux on your PS4.
  
  reactPSPLUS Payload (by Zer0xFF)
  
  • Have a PS Plus Subscription? but can't access your game collection being on a lower firmware and games have reach its expiration for signing into PSN for re-activation, Well, hopefully with this payload it will help you play those games once again. May need a few updates to make all games play as some reports did surface but to early to tell if user error or a issue with the tool that an update will fix.
  
  UI Mod 0.3 Custom Home Menu for 5.05 (by e✘treme)
  
  • Transparent Content Icons / Title Names changed / Location changed for fPKGs / Removed some Icons / Custom User Avatar / Custom Background Music
  
  PS2 Classic GUI (Tool) (by TheDarkProgrammer)
  
  • This utility did not need an update for 5.05 Support, but is a useful tool for preparing a PS2 (Classic) PKG on your exploited PS4, Play your PS2 Collection by preparing your own PS2 PKGs.
  
  PS4 Exploit Host (by Al-Azif)
  
  • A great solution for hosting the exploit on your own LAN connection, no need to rely on a 3rd party site hosting the exploit this handy utility has alot of great features . UPDATE @eXtreme has created a custom playground based on this release (hosting on his website and adding new visuals (and all payloads from Al-Azif's collection) take a look >>> LINK to PS4Brew 5.05 Playground
  
  PS4 Trainer By TylerM
  
  • Here is a trainer for PS4 that I have been working on and it is not 100% just like PS4 modding isn't. I will NOT be adding GTA or COD to this tool. I hope everyone likes it and finds it helpful.YOU MUST ENABLE MIRA+HEN FIRST TO INJECT THE PAYLOAD It is possible these cheats work for different CUSA's. Just have to try and see. If you make a working .cht file. (Pointers preferred) I will add them. I just need you to provide CUSA and game version
  
  X-PROJECT (XMB SELF HOST PROJECT) 5.05 by KiiWii (aka defaultdnb
  
  • Aims to be the AIO customizable toolbox for all your PS4 payload needs on FW 5.05
  
  
  
  
  Development Releases​
  
  PS4Debug (Dev Use) (by Xemio)
  
  • A debugger with support for the PlayStation 4! Have a look at blank for a little example! I hope someone will come along and make a full featured debugger with this framework. Currently supports firmware 5.05 only!
  liborbis (by OrbisDev)
  
  • Libraries and samples for PlayStation 4 (updated to 5.05) >>> http://www.psx-place.com/threads/liborbis-libraries-and-samples-for-playstation-4.18755/
  PS4SDK (bypsxdev)
  
  • via ReadMe" ps4sdk is a modular open source SDK for the PS4 with userland and kernel support.The SDK currently supports most of the standard C library, various FreeBSD 9.0 userland and kernel, as well as some SCE functions. It is designed to be adaptable to new firmwares and entry points and new reverse engineered functions can be integrated into the SDK, by adding headers, function signatures and their names to the list of function stubs. Currently, running user and kernel code on firmwares ~5.05 is supported"
  
  
  Are we missing something???? let us know in the comments below.​

Direct Link to the 5.05 Kernel Exploit (visit from PS4): >>> Click Here <<<
or
for an unofficial version with added payloads / eye candy checkout this link

Source Code: GitHub​

Ps4 Homebrew Toolchain Roadmap >>> Check it out <<<<
Source(s): twitter.com/SpecterDev /(2)/qwertyoruiop
Update: PS4 Write-Up of the 5.05 by SpecterDev
​

 

Thanks pinky for all your help I will give it a try and let you know how I go with it I was getting a bit confused because on some sites when I was doing my research they were saying Sony was not signing 5.05 firmware anymore but I have found step by step instructions and the 5.05 recovery pup file and by the sounds of it I just install the recovery pup and my backup files and that's it I hope but I will let you know how I go again thanks for your help

 

Thanks pinky for all your help I will give it a try and let you know how I go with it I was getting a bit confused because on some sites when I was doing my research they were saying Sony was not signing 5.05 firmware anymore but I have found step by step instructions and the 5.05 recovery pup file and by the sounds of it I just install the recovery pup and my backup files and that's it I hope but I will let you know how I go again thanks for your help

yes, the recovery pup should work regardless. as for the backup/restore function, I have no idea. I think the issue with games disappearing with rebuilding the database is not backing up the app.db. you can back it up with the sg and db payload. it will also backup profiles, saves, and trophies. I'm not sure if those are restorable with a new hdd though.

 

Ok so I finally upgraded my hdd to 2tb thanks to DeViL303 and pinky for all there help everything worked great and I got all my save game files and trophy's back. here are the steps I took.

• Back up your data, but don't use official methods to backup your fake signed games and apps, use FTP to copy the USER/APP/XXXXXXXXX/APP.PKG (fake signed games) to an external backup: rename them as the CUSAXXXXX folders they came out of to remind you what they were.
  You can retain SAVES by using the built in options under: [Settings] > [System] > [Backup and Restore] > [Back Up PS4] (Deselect Applications).You can also retain TROPHIES by copying the USER/HOME/XXXXXXXXX/TROPHY folder and the USER/TROPHY folder via FTP (be careful to keep them separate as they are named the same)

• Replace the HDD:
  You can internally upgrade the PS4 to 8tb max, however the dimensions of the HDD must be no taller than 9.5mm to fit in the enclosure (2.5inch Sata HDD).

• Reinstall the System software in safe mode (option 7):
  5.05 RECOVERY PUP - MD5: C2A602174F6B1D8EF599640CD276924A
  
  
• Restore the data that has been backed up: Once upgraded restore your saves again using the [Backup and Restore] option, restore trophies using FTP, and restore games by reinstalling the APP.PKG files to internal

The only thing I have to work out now is how to resign into the PlayStation network without having to update so I can play my online disc games like The crew and Friday the 13th that needs to be online does anyone know if there is a spoof like the PS3 that we can sign in on
Thanks again everyone for all your help and I hope what I have wrote helps anyone else who is thinking of upgrading there hard drive

 

@Blackbeast , I'm glad you got it all sorted. your post should help others. alternatively, you can save the original pkgs on your computer (if anyone's as ocd as me. lol). I've never personally tested this, but the pkg you install and the app.pkg should have the same md5...or so I've read.

 

Just as a FYI / Reminder ,

We ( myself and @Roxanne ) been adding various releases for 5.05 in the main post..

I am sure we have overlooked something (with things evolving) so be sure to let us know if we are missing anything.

 

Just as a FYI / Reminder ,

We ( myself and @Roxanne ) been adding various releases for 5.05 in the main post..

I am sure we have overlooked something (with things evolving) so be sure to let us know if we are missing anything.

Which can be found in the "Releases for 5.05" Tab

 

Exploit is mine, but used by someone else and sent me this video with the question "My mine 5.53 with an exploit as much as possible?".

 

Exploit is mine, but used by someone else and sent me this video with the question "My mine 5.53 with an exploit as much as possible?".

I have notice that OSD, have familiar for me language and that product commercial (in radio)
can help muscles and brain.
Maybe it's good for making homebrew?

 

Is normal to get sometimes ce-36329-3 error(immediately shutdown)? I am with 5.05 on cuh-7016b

 

Is normal to get sometimes ce-36329-3 error(immediately shutdown)? I am with 5.05 on cuh-7016b

is this after playing a game? you mean shutdown and not rest mode, right? rest mode is supposed to be unstable.

I'm still on 4.55 (not updating 'til I get a game that requires it). I've never encountered any error aside from sending the system into a panic from using too many payloads at once. once you figure out how to do it properly you won't have that problem.

 

is this after playing a game? you mean shutdown and not rest mode, right? rest mode is supposed to be unstable.

I'm still on 4.55 (not updating 'til I get a game that requires it). I've never encountered any error aside from sending the system into a panic from using too many payloads at once. once you figure out how to do it properly you won't have that problem.

Yes this happens when i play games. I mean shutdown, and when i turn on the console is showing menu for restoring system software, after that this message about the error. Yesterday it happens about 4 times, its really annoying.
I am not sure that i understated you about what to do properly?
I am not using any other payloads, only those that come with the exploit.

 

one question, I can install a game (pkg retail no fake) in sploit 5.05 (hen 1.7)

 

one question, I can install a game (pkg retail no fake) in sploit 5.05 (hen 1.7)

no, unfortunately, you must still use fake pkgs.

 

no, unfortunately, you must still use fake pkgs.

how can i get the files of a retail pkg or update pkg retail

 

how can i get the files of a retail pkg or update pkg retail

I just asked Kiiwii to be sure about retail pkgs. he said that they only work if you have a legitimate license, so you can't pirate them. retail games and updates must be physically dumped, so afaik, retail updates (turned into fake pkgs) can only be dumped if you have the retail disc. I don't think a retail update works with a fake pkg, because the game must be bootable in order to dump.

 

a question, when passing a game in the external hdd with the apptousb, I can connect in usb0 or usb1 to play the game or only in one of them

 

a question, when passing a game in the external hdd with the apptousb, I can connect in usb0 or usb1 to play the game or only in one of them

I believe app2usb creates a symlink. my guess is that either will work. however, afaik, either the app dumper or install pkgs can only be done with usb0.

 

what is that countdown mean ?

 

 

if roxanne is roxanne i'm jordi. So guys i have 5.07. Before three days i was investigsating why observer freeze on some ps4 and why on other it was working, until lenovo laptop touchpad in moving cursor get two npx directory and move it in download directory, after that i try restore them but filezilla comment " access denied inclu..............IN PEACE.

Bst regards

Yes.