{"id":13695012,"url":"https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit","last_synced_at":"2025-05-03T04:31:35.135Z","repository":{"id":49799549,"uuid":"115493739","full_name":"Cryptogenic/PS4-4.05-Kernel-Exploit","owner":"Cryptogenic","description":"A fully implemented kernel exploit for the PS4 on 4.05FW","archived":false,"fork":false,"pushed_at":"2018-03-05T18:47:18.000Z","size":25,"stargazers_count":534,"open_issues_count":3,"forks_count":233,"subscribers_count":58,"default_branch":"master","last_synced_at":"2024-11-12T21:39:47.340Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Cryptogenic.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-12-27T07:21:10.000Z","updated_at":"2024-10-28T10:03:12.000Z","dependencies_parsed_at":"2022-08-21T23:20:29.122Z","dependency_job_id":null,"html_url":"https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cryptogenic%2FPS4-4.05-Kernel-Exploit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cryptogenic%2FPS4-4.05-Kernel-Exploit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cryptogenic%2FPS4-4.05-Kernel-Exploit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cryptogenic%2FPS4-4.05-Kernel-Exploit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Cryptogenic","download_url":"https://codeload.github.com/Cryptogenic/PS4-4.05-Kernel-Exploit/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252144564,"owners_count":21701434,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-02T17:01:56.596Z","updated_at":"2025-05-03T04:31:30.505Z","avatar_url":"https://github.com/Cryptogenic.png","language":"JavaScript","funding_links":[],"categories":["JavaScript","Kernel Exploits"],"sub_categories":["Remote Package Installers"],"readme":"# PS4 4.05 Kernel Exploit\n---\n## Summary\nIn this project you will find a full implementation of the \"namedobj\" kernel exploit for the PlayStation 4 on 4.05. It will allow you to run arbitrary code as kernel, to allow jailbreaking and kernel-level modifications to the system. This release however, *does not* contain any code related to defeating anti-piracy mechanisms or running homebrew. This exploit does include a loader that listens for payloads on port `9020` and will execute them upon receival.\n\nYou can find fail0verflow's original write-up on the bug [here](https://fail0verflow.com/blog/2017/ps4-namedobj-exploit/), you can find my technical write-up which dives more into implementation specifics [here](https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md).\n\n## Patches Included\nThe following patches are made by default in the kernel ROP chain:\n1) Disable kernel write protection\n2) Allow RWX (read-write-execute) memory mapping\n3) Dynamic Resolving (`sys_dynlib_dlsym`) allowed from any process\n4) Custom system call #11 (`kexec()`) to execute arbitrary code in kernel mode\n5) Allow unprivileged users to call `setuid(0)` successfully. Works as a status check, doubles as a privilege escalation.\n\n## Notes\n- This exploit is actually incredibly stable at around 95% in my tests. WebKit very rarely crashes and the same is true with kernel.\n- I've built in a patch so the kernel exploit will only run once on the system. You can still make additional patches via payloads.\n- A custom syscall is added (#11) to execute any RWX memory in kernel mode, this can be used to execute payloads that want to do fun things like jailbreaking and patching the kernel.\n- An SDK is not provided in this release, however a barebones one to get started with may be released at a later date.\n- I've released a sample payload [here](http://www.mediafire.com/file/n4boybw0e06h892/debug_settings.bin) that will make the necessary patches to access the debug menu of the system via settings, jailbreaks, and escapes the sandbox.\n\n## Contributors\nI was not alone in this exploit's development, and would like to thank those who helped me along the way below.\n\n- [qwertyoruiopz](https://twitter.com/qwertyoruiopz)\n- [Flatz](https://twitter.com/flat_z)\n- [CTurt](https://twitter.com/CTurtE)\n- Anonymous\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FCryptogenic%2FPS4-4.05-Kernel-Exploit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FCryptogenic%2FPS4-4.05-Kernel-Exploit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FCryptogenic%2FPS4-4.05-Kernel-Exploit/lists"}