diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..7301f2c --- /dev/null +++ b/.gitignore @@ -0,0 +1,4 @@ +src/kpatch/*.bin +src/kpatch/*.d +src/kpatch/*.elf +src/kpatch/*.o diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..815ea27 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,90 @@ +# Changelog + +All notable changes to this project will be documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [Unreleased] + +## [1.5.1] - 2025-05-12 + +### Added + +- `.gitignore` for kpatch output +- Auto detect console type and firmware in `config.mjs` + - Used elsewhere to determine which offsets/patches/ROP chain are used +- **WIP:** Add 8.50-9.60 support + - All offsets found + - Running into some issue here. Wiped out my JOP chains to redo them... + +### Fixed + +- Call `lapse.mjs` rather than `code.mjs` +- Makefile for kpatch builds all currently available + +### Changed + +- Use relative locations rather than absolute +- Changed kpatch binaries to just be shellcode vs full ELFs + - 5,216 bytes to 257 bytes. +- Build kpatch binaries with `-Os` rather than `-O` + - 257 bytes to 233 bytes. +- Renamed/Formatted `CHANGELOG.md`, `README.md`, and `LICENSE` + +## [1.5.0](#) - 2025-05-08 + +### Added + +- Lapse kernel exploit + +### Fixed + +- Rewrite PSFree exploit + +## [1.4.0](#) - 2024-01-25 + +### Added + +- Kernel patch payload for 8.0x + +### Fixed + +- Remove the risk of crashing from using the Chain classes +- Remove the risk of crashing from using `make_buffer()` +- (PS5 < 3.00) use valid config at `exploit.mjs:setup_ssv_data` + +## [1.3.0](#) - ????-??-?? + +### Added + +- ROP chain managers for 8.5x, 9.0x, 9.5x + +### Fixed + +- Improve the speed and reliability of the exploit (`exploit.mjs`) + +### Removed + +- Support for webkitgtk 2.34.4, see 1.0.0 for a working implementation + +## [1.2.0](#) - 2023-12-03 + +## Added + +- Support for PS4 6.00-6.20 + +## [1.1.0](#) - ????-??-?? + +### Added + +- Support for running ROP chains (PS4 8.03) +- Support for calling syscalls (PS4 8.03) + +## [1.0.0](#) - ????-??-?? + +### Added + +- Proof-of-concept code to gain arbitrary read/write (PS4 6.50-9.60/PS5 1.00-5.50) + +[unreleased]: https://github.com/Al-Azif/psfree-lapse/compare/v1.5.1...HEAD +[1.5.1]: https://github.com/Al-Azif/psfree-lapse/releases/tag/v1.5.1 diff --git a/src/COPYING b/LICENSE similarity index 100% rename from src/COPYING rename to LICENSE diff --git a/README.md b/README.md index a1ab8d0..7dca378 100644 --- a/README.md +++ b/README.md @@ -1,20 +1,50 @@ -# PSFree version 1.5.0 +# PSFree version 1.5.1 -PSFree is a collection of exploits for the PS4 console. The main focus of the -repo is for the PS4 but we try to make things portable to PS5. +PSFree is a collection of exploits for the PS4 console. The main focus of the repo is for the PS4, but we try to make things portable to PS5. -* Exploits - * PSFree: src/psfree.mjs - * Lapse (kernel): src/scripts/lapse.mjs +## Features -Donation (Monero/XMR): -86Fk3X9AE94EGKidzRbvyiVgGNYD3qZnuKNq1ZbsomFWXHYm6TtAgz9GNGitPWadkS3Wr9uXoT29U1SfdMtJ7QNKQpW1CVS +* **Auto-detection:** Automatically detects console type and firmware version (via `src/config.mjs`). +* **WebKit Exploit (PSFree):** Entry point via the console's web browser. +* **Kernel Exploit (Lapse):** Escalates privileges to kernel level. +* ~~Payload Loader: After successful kernel exploitation listens for a payload on port 9020.~~ **WIP** -# COPYRIGHT AND AUTHORS: -AGPL-3.0-or-later (see src/COPYING). This repo belongs to the group -`anonymous`. We refer to anonymous contributors as "anonymous" as well. +## Vulnerability Scope + +| | PSFree | Lapse | +|:--------------|:----------|:-----------| +| PlayStation 4 | 6.00-9.60 | 1.01-12.02 | +| PlayStation 5 | 1.00-5.50 | 1.00-10.01 | + +## Supported by this Repository + +This table indicates firmware versions for which the *current version* of this repository provides a functional and tested exploit chain. + +| | PSFree | Lapse | +|:--------------|:----------|:-----------| +| PlayStation 4 | 8.00-8.03 | 8.00-8.03 | +| PlayStation 5 | N/A | N/A | + +*Note: Support for other firmwares listed in the "Vulnerability Scope" table may, or may not, be actively being worked on or may have been supported in previous versions of this repository. Please check `CHANGELOG.md` for historical support.* + +## TODO List + +- [ ] Integrate payload loader (Test on 8.00-8.03) +- [ ] Rewrite JOP chains in `rop/ps4/850.mjs`, `rop/ps4/900.mjs`, and `rop/ps4/950.mjs` + - I scrapped the ones I had... +- [ ] `lapse.mjs`: Just set the bits for JIT privs +- [ ] `view.mjs`: Assumes PS4, support PS5 as well +- [ ] Add PS5 support + +## Copyright and Authors: + +AGPL-3.0-or-later (see [LICENSE](LICENSE)). This repo belongs to the group `anonymous`. We refer to anonymous contributors as "anonymous" as well. + +## Credits: -# CREDITS: * anonymous for PS4 firmware kernel dumps -* Check the appropriate files for any **extra** contributors. Unless otherwise - stated, everything here can also be credited to us. +* Check the appropriate files for any **extra** contributors. Unless otherwise stated, everything here can also be credited to us. + +## Donations + +(Monero/XMR): **86Fk3X9AE94EGKidzRbvyiVgGNYD3qZnuKNq1ZbsomFWXHYm6TtAgz9GNGitPWadkS3Wr9uXoT29U1SfdMtJ7QNKQpW1CVS** diff --git a/changelog.txt b/changelog.txt deleted file mode 100644 index 30e48d1..0000000 --- a/changelog.txt +++ /dev/null @@ -1,27 +0,0 @@ -* 1.5.0: - * add Lapse kernel exploit - * rewrite PSFree exploit - -* 1.4.0: - * add kernel patch payload for 8.0x - -fixes: - * remove the risk of crashing from using the Chain classes - * remove the risk of crashing from using make_buffer() - * (PS5 < 3.00) use valid config at exploit.mjs:setup_ssv_data - -* 1.3.0: - * improve the speed and reliability of the exploit (exploit.mjs) - * add ROP chain managers for 8.5x, 9.0x, 9.5x - * drop support for webkitgtk 2.34.4, see 1.0.0 for a working implementation - -* 1.2.0: - * add support for PS4 6.00-6.20 - -* 1.1.0: - * add support for running ROP chains (PS4 8.03) - * add support for calling syscalls (PS4 8.03) - -* 1.0.0: - * add proof-of-concept code to gain arbitrary read/write - (PS4 6.50-9.60/PS5 1.00-5.50) diff --git a/fw_series_convention.txt b/fw_series_convention.txt deleted file mode 100644 index 0c6e17f..0000000 --- a/fw_series_convention.txt +++ /dev/null @@ -1,16 +0,0 @@ -PS4/PS5 Firmware Series Convention - -Convention used by this repo to refer to a set of firmwares. - -The pattern X.Yx means X.Y0 <= firmware < (X + 1).V0. Y is either 0 or 5. V is -5 if Y is 0, 0 if Y is 5. - -examples: -* 6.0x refer to 6.00 <= fw < 6.50. -* 6.5x refer to 6.50 <= fw < 7.00. - -The pattern X.xx means X.00 <= firmware < (X + 1).00. - -examples: -* 6.xx refer to 6.00 <= fw < 7.00. -* 7.xx refer to 7.00 <= fw < 8.00. diff --git a/src/about.html b/src/about.html index 2fc6be3..bf26ae4 100644 --- a/src/about.html +++ b/src/about.html @@ -22,8 +22,7 @@ along with this program. If not, see . PSFree is an exploit chain for PS4 and PS5.
- PSFree is free software. See COPYING for the copyleft information.
- PSFree's license is GNU-AGPL-3.0-or-later.
+ PSFree is free software. PSFree's license is GNU-AGPL-3.0-or-later.
Here is the source code of this program:

HTML files:
@@ -31,11 +30,6 @@ along with this program. If not, see . about.html
JavaScript files:
- - - - - @@ -46,20 +40,50 @@ along with this program. If not, see . + + + + + + + + + + - + - + - + - + + + + + + + + + + + + + + + + + + + + + @@ -72,9 +96,9 @@ along with this program. If not, see . - + - + @@ -82,9 +106,9 @@ along with this program. If not, see . - + - + @@ -92,25 +116,49 @@ along with this program. If not, see . - + - + - + - + + + + + + + + + + + + + + + + + + + + +
psfree.mjsGNU-AGPL-3.0-or-laterdownload
alert.mjs GNU-AGPL-3.0-or-laterGNU-AGPL-3.0-or-later download
lapse.mjsGNU-AGPL-3.0-or-laterdownload
psfree.mjsGNU-AGPL-3.0-or-laterdownload
send.mjs GNU-AGPL-3.0-or-later download
scripts/lapse.mjslapse/ps4/800.mjs GNU-AGPL-3.0-or-laterdownloaddownload
rop/800.mjslapse/ps4/850.mjs GNU-AGPL-3.0-or-laterdownloaddownload
lapse/ps4/852.mjsGNU-AGPL-3.0-or-laterdownload
lapse/ps4/900.mjsGNU-AGPL-3.0-or-laterdownload
lapse/ps4/903.mjsGNU-AGPL-3.0-or-laterdownload
lapse/ps4/950.mjsGNU-AGPL-3.0-or-laterdownload
module/chain.mjsdownload
module/view.mjsmodule/mem.mjs GNU-AGPL-3.0-or-laterdownloaddownload
module/memtools.mjsdownload
module/utils.mjsmodule/offset.mjs GNU-AGPL-3.0-or-laterdownloaddownload
module/rw.mjsdownload
module/offset.mjsmodule/utils.mjs GNU-AGPL-3.0-or-laterdownloaddownload
module/mem.mjsmodule/view.mjs GNU-AGPL-3.0-or-laterdownloaddownload
rop/ps4/800.mjsGNU-AGPL-3.0-or-laterdownload
rop/ps4/850.mjsGNU-AGPL-3.0-or-laterdownload
rop/ps4/900.mjsGNU-AGPL-3.0-or-laterdownload
rop/ps4/950.mjsGNU-AGPL-3.0-or-laterdownload
kpatch/ files:
- kpatch/utils.h
- kpatch/script.ld
+ kpatch/800.c
+ kpatch/850.c
+ kpatch/900.c
+ kpatch/903.c
+ kpatch/950.c
kpatch/Makefile
- kpatch/80x.c
+ kpatch/script.ld
kpatch/types.h
+ kpatch/utils.h
fonts/ files:
- fonts/README.txt
fonts/FONTS.LICENSE
fonts/LiberationMono-Regular.ttf
+ fonts/README.txt
diff --git a/src/config.mjs b/src/config.mjs index 4141ead..4c3f856 100644 --- a/src/config.mjs +++ b/src/config.mjs @@ -66,5 +66,19 @@ export function set_target(value) { target = value; } +function get_target_from_ua(useragent) { + const pattern = /^Mozilla\/5\.0 \(?(?:PlayStation; )?PlayStation (4|5)[ \/]([0-9]{1,2}\.[0-9]{2})\)? AppleWebKit\/[0-9.]+ \(KHTML, like Gecko\)(?: Version\/[0-9.]+ Safari\/[0-9.]+)?$/; + const match = pattern.exec(useragent); + if (!match) { + return; + } + + if (match[1] == '4') { + return parseInt(`0x0${match[2].replace('.', '').padStart(4, '0')}`); + } else if (match[1] == '5') { + return parseInt(`0x1${match[2].replace('.', '').padStart(4, '0')}`); + } +} + export let target = null; -set_target(0x800); +set_target(get_target_from_ua(navigator.userAgent)); diff --git a/src/index.html b/src/index.html index 004cca5..a5d0e14 100644 --- a/src/index.html +++ b/src/index.html @@ -22,7 +22,7 @@ along with this program. If not, see .