Pharaoh2k
bdc1ba7780
Additive and FW-gated, so every previously supported firmware is untouched. 13.40 and 13.42 share a case; 13.60 needs its own because its kernel data layout shifted: the text/data delta grows to 0x0CC0000 and security_flags, rootvnode and bus_data_devices all move. Every value was derived from the decrypted kernel dumps by static analysis rather than copied, using FW 12.00 as a control that the method had to reproduce first: allproc via the intersection of the process-list-walking syscalls (discriminated from allproc_lock by its insert/remove writes), security_flags via the flag-bit test histogram, rootvnode via sys_is_in_sandbox, and bus_data_devices via masked code signatures transferred from the control. kdata_base is the read-only data segment base, which is what pins the text delta. vmspace p_root stays 0x1d0, confirmed from the vm_map function cluster.
ps5-payload-sdk
This is an SDK for developing payloads targeted at exploited PS5s. ELF loaders known to work include:
Several artifacts in this repository originate from the PS5SDK project.
Prerequisites
On Debian-flavored operating systems, you can invoke the following commands to install dependencies used by the SDK.
john@localhost:ps5-payload-dev/sdk$ sudo apt-get update && sudo apt-get upgrade # optional
john@localhost:ps5-payload-dev/sdk$ sudo apt-get install bash clang-18 lld-18 # required
john@localhost:ps5-payload-dev/sdk$ sudo apt-get install socat cmake meson pkg-config # optional
If you are using Fedora, you can install dependencies as follows (tested with version 41):
john@localhost:ps5-payload-dev/sdk$ sudo dnf install bash llvm-devel clang lld # required
john@localhost:ps5-payload-dev/sdk$ sudo dnf install socat cmake meson pkg-config # optional
If you are using macOS, you can install them using the Homebrew Package Manager (tested with macOS Sequoia):
john@localhost:ps5-payload-dev/sdk$ brew install llvm@18 # required
john@localhost:ps5-payload-dev/sdk$ export LLVM_CONFIG=/opt/homebrew/opt/llvm@18/bin/llvm-config # required
john@localhost:ps5-payload-dev/sdk$ brew install socat cmake meson # optional
Quick-start
You can download a binary distribution of the SDK from the latest release page, then install it to your local storage, e.g,
john@localhost:tmp$ wget https://github.com/ps5-payload-dev/sdk/releases/latest/download/ps5-payload-sdk.zip
john@localhost:tmp$ sudo unzip -d /opt ps5-payload-sdk.zip
Assuming you have all the prerequisites and you are on a POSIX system, the binary distribution should work regardless of CPU architecture, e.g., x86_64, aarch64.
Usage
john@localhost:ps5-payload-dev/sdk$ export PS5_PAYLOAD_SDK=/opt/ps5-payload-sdk
john@localhost:ps5-payload-dev/sdk$ make -C samples/hello_world
john@localhost:ps5-payload-dev/sdk$ export PS5_HOST=ps5; export PS5_PORT=9021
john@localhost:ps5-payload-dev/sdk$ make -C samples/hello_world test
Building the SDK
john@localhost:ps5-payload-dev/sdk$ make DESTDIR=/opt/ps5-payload-sdk install
john@localhost:ps5-payload-dev/sdk$ export PS5_PAYLOAD_SDK=/opt/ps5-payload-sdk
john@localhost:ps5-payload-dev/sdk$ ./libcxx.sh # fetch, build, and install libcxx
Adding new SCE Libs
If you have decrypted sprx files that you would like to interact with, you can build stubs for them as follows:
john@localhost:ps5-payload-dev/sdk$ sudo apt-get install wget python3 python3-pyelftools
john@localhost:ps5-payload-dev/sdk$ ln -s /path/to/sprx/libSceXYZ.sprx sce_stubs/libSceXYZ.sprx
john@localhost:ps5-payload-dev/sdk$ make -C sce_stubs stubs
john@localhost:ps5-payload-dev/sdk$ make DESTDIR=/opt/ps5-payload-sdk install
Reporting Bugs
If you encounter problems with the SDK, please file a github issue. If you plan on sending pull requests which affect more than a few lines of code, please file an issue before you start to work on you changes. This will allow us to discuss the solution properly before you commit time and effort.
License
Files in the folder include/freebsd are licenced under BSD licences. Unless otherwhise explicitly stated inside a file, the rest are licensed under the GPLv3+.