Jump to content

PS4 4.05 Kernel Exploit

Conéctate para seguir esto  

1 Screenshot

Sobre este archivo

In this project you will find a full implementation of the "namedobj" kernel exploit for the PlayStation 4 on 4.05. It will allow you to run arbitrary code as kernel, to allow jailbreaking and kernel-level modifications to the system. This release however, *does not* contain any code related to defeating anti-piracy mechanisms or running homebrew. This exploit does include a loader that listens for payloads on port `9020` and will execute them upon receival.

## Patches Included

The following patches are made by default in the kernel ROP chain:

  1. Disable kernel write protection
  2. Allow RWX (read-write-execute) memory mapping
  3. Dynamic Resolving (`sys_dynlib_dlsym`) allowed from any process
  4. Custom system call #11 (`kexec()`) to execute arbitrary code in kernel mode
  5. Allow unprivileged users to call `setuid(0)` successfully. Works as a status check, doubles as a privilege escalation.

## Notes

  • This exploit is actually incredibly stable at around 95% in my tests. WebKit very rarely crashes and the same is true with kernel.
  • I've built in a patch so the kernel exploit will only run once on the system. You can still make additional patches via payloads.
  • A custom syscall is added (#11) to execute any RWX memory in kernel mode, this can be used to execute payloads that want to do fun things like jailbreaking and patching the kernel.
  • An SDK is not provided in this release, however a barebones one to get started with may be released at a later date.
  • I've released a sample payload [here](http://www.mediafire.com/file/n4boybw0e06h892/debug_settings.bin) that will make the necessary patches to access the debug menu of the system via settings, jailbreaks, and escapes the sandbox.

## Contributors

I was not alone in this exploit's development, and would like to thank those who helped me along the way below.

Críticas de usuarios

Comentarios recomendados

No hay comentarios para mostrar

Crear una cuenta o conéctate para comentar

Tienes que ser miembro para dejar un comentario

Crear una cuenta

Regístrese para obtener una cuenta nueva en nuestra comunidad. ¡Es fácil!

Registrar una nueva cuenta


¿Ya tienes una cuenta? Conéctate aquí.

Conectar ahora