- C 95.2%
- Makefile 3.5%
- Shell 1.3%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
738edccd45
Bounds-check ELF headers read from the socket and stop the spawn when the libc heap setup fails. Add an optional TRACKED request that replies with the pid of the spawned payload. |
||
| .github/workflows | ||
| stress-test | ||
| .gitignore | ||
| asset.h | ||
| bootstrap.c | ||
| elfldr.c | ||
| elfldr.h | ||
| LICENSE | ||
| log.h | ||
| main.c | ||
| Makefile | ||
| notify.c | ||
| notify.h | ||
| pt.c | ||
| pt.h | ||
| README.md | ||
| selfldr.c | ||
| selfldr.h | ||
| socksrv.c | ||
| uri.c | ||
| uri.h | ||
ps5-payload-elfldr
This is an ELF loader for PS5 systems that have been jailbroken using either the
BD-J ps5-payload-loader, or the webkit approached from Specter.
Unlike the ELF loaders bundled with those exploits, this one uses the ptrace
syscall to bootstrap itself into the SceRedisServer process, and then launches
itself into a new process that keeps running in the background, even when
playing games. Furthermore, this ELF loader will also resume its execution when
the PS5 returns from rest mode. Since payloads are executed in induvidual
processes, this ELF loader keeps on running even if a payload crashes.
Quick-start
To deploy ps5-payload-elfldr, first launch a kernel exploit that provides a rudimentary ELF loader on port 9020, e.g., BD-J ps5-payload-loader, or the webkit approached from Specter. Then, run the following:
john@localhost:~$ export PS5_HOST=ps5
john@localhost:~$ export PS5_PORT=9020
john@localhost:~$ wget -q -O - https://github.com/ps5-payload-dev/elfldr/releases/latest/download/elfldr-ps5.elf | nc -q0 $PS5_HOST $PS5_PORT
Usage examples
john@localhost:~$ export PS5_HOST=ps5
john@localhost:~$ export PS5_PORT=9021
john@localhost:~$ export PS5_PAYLOAD=payload.elf # from local storage
john@localhost:~$ nc -q0 $PS5_HOST $PS5_PORT < $PS5_PAYLOAD
john@localhost:~$
john@localhost:~$ export PS5_PAYLOAD=file:/data/payload.elf # from console storage
john@localhost:~$ echo "$PS5_PAYLOAD" | nc -q0 $PS5_HOST $PS5_PORT
john@localhost:~$
john@localhost:~$ export PS5_PAYLOAD=https://github.com/ps5-payload-dev/ftpsrv/releases/latest/download/ftpsrv-ps5.elf
john@localhost:~$ echo "$PS5_PAYLOAD" | nc -q0 $PS5_HOST $PS5_PORT
john@localhost:~$
john@localhost:~$ export PS5_PAYLOAD=https://github.com/ps5-payload-dev/ftpsrv/releases/latest/download/ftpsrv-ps5.elf
john@localhost:~$ curl "http://$PS5_HOST:$PS5_PORT?uri=$PS5_PAYLOAD"
Building
Assuming you have the ps5-payload-sdk installed on a Debian-flavored operating system, ps5-payload-elfldr can be compiled using the following set of commands:
john@localhost:ps5-payload-elfldr$ sudo apt-get install xxd
john@localhost:ps5-payload-elfldr$ export PS5_PAYLOAD_SDK=/opt/ps5-payload-sdk
john@localhost:ps5-payload-elfldr$ make
Reporting Bugs
If you encounter problems with ps5-payload-elfldr, please file a github issue. If you plan on sending pull requests which affect more than a few lines of code, please file an issue before you start to work on you changes. This will allow us to discuss the solution properly before you commit time and effort.
License
ps5-payload-elfldr is licensed under the GPLv3+.