https://github.com/ps4dev/ps4sdk-examples

ps4sdk examples and small showcases
https://github.com/ps4dev/ps4sdk-examples

Last synced: about 2 months ago
JSON representation

ps4sdk examples and small showcases

• Host: GitHub
• URL: https://github.com/ps4dev/ps4sdk-examples
• Owner: ps4dev
• License: unlicense
• Created: 2016-04-27T05:05:40.000Z (over 8 years ago)
• Default Branch: master
• Last Pushed: 2017-10-04T23:31:57.000Z (over 7 years ago)
• Last Synced: 2024-08-03T23:05:50.943Z (5 months ago)
• Language: C
• Homepage:
• Size: 93.8 KB
• Stars: 14
• Watchers: 4
• Forks: 10
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• Awesome-PS4-Jailbreak - PS4SDK Examples - of-concepts which show somehing realized with [PS4 SDK](https://github.com/ps4dev/ps4sdk). (Examples and Tutorials / Remote Package Installers)

README

        
# ps4sdk-examples

Examples, showcases and prove-of-concepts which show something realized with ps4sdk (not necessarily unique to the PS4)

## Examples

* `libless` - These do not use any library functions (not even the sdk) and are good for initial tests or when something breaks

* `posix` - These solely use posix and standard C APIs and should run under any such system

* `freebsd` - These are pure freebsd examples (and should work there too)

* `sce` - These showcase SCE functions

* `ps4sdk` - These are user space programs which use the sdks own (common) capabilities

* `kernel` - These are showing something we can do in the kernel using the sdk

* `failures` - These are corner-cases, which noteworthyly do not work (but could be expected to by somebody)

## Noteworthy

* `freebsd/dirent` displays the fs and can be run after you use another elf to escalate your privileges

* `ps4sdk/kernel_execute` shows how to enter the kernel from user space on your own (it's likely less

convenient and useful then a kernel payload, but has its use-case).

* `ps4sdk/system_call_hook` shows how to temporarily hook from user space. Be aware, that when your program

exits, your resources (all functions and data) will be freed too. **Be sure to unlink** any of these user space resources

from the kernel before you exit main. A kernel payload that never ends (sleep on a mutex) is more likely to be useful and stable

for any long term or persistent (module like) modifications. See `kernel/system_call` for comparison.

* `kernel/system_call_hook`, `kernel/function_hook` print the same descriptor all the time. That's not a bug,

it's what actually happens. Press the options button to see changes. To influence the return values, use a post

hook and alter args->returns->rax (etc.). Try the function index (rindex) hook (on 5055), close the browser,

connect and restart the browser.

## Important

The exploit may not always enter the kernel on the first try. If you browser crashes,

simply try again. It's likely to work. This will be tuned in the future as much as possible.

Especially after you crashed your kernel, this behaviour is very common (down right normal) because the

initial resource allocation differs.