Release: Fully operational dlclose exploit + Linux for PS4, by kR105

The name kR105 might ring a Bell to you because this developer has been credited a lot recently by CTurt on his PS4 hack work. Today, kR105 popped up on our forums to release something that lots of us had been chasing for a while: a fully operational dlclose exploit. He also emailed me to mention he has now integrated support for booting Linux straight from the PS4-Playground tools, and, icing on the cake, also provided the actual PS4 Linux files to use with the tools.

In other words, kR105 is closing the gap here, releasing everything you need to run Linux on your PS4. This is not a drill or a proof of concept video, people. The files are up for anyone to grab. I haven’t tested them myself though, because I’ve still beenhesitating on getting a 1.76 PS4, but I’m regretting not having one every day that goes by. If you’re the lucky owner of a PS4 1.76 though (we have an article here on where you might be able to get one), now’s the right time to test this! Furthermore, there’s absolutely no reason to doubt this release is real, given that it initiates strait from kR105, in CTurt’s github. Also CTurt confirmed this release to me earlier today.

So, what was just released by kR105?

A fully functional dlclose exploit. The exploit had been released about a week ago, and several people had been able to take it further, but there were still issues on how the publicly available code was working, crashing as soon as the exploit was attempting to return to userland. kR105’s release fixes all of that, it includes root, sandbox escape and jailbreak. This exploit is what you’ll want to run your native code on a 1.76 PS4

The dlclose kernel exploit was released a few days ago

An update to PS4-Playground to run Linux. Another missing link here, that will let people launch linux without having to write their own loader. The launcher integrates the dlclose exploit if I understand correctly. From the Readme:



You need a FAT32 formatted USB drive plugged in on any PS4’s USB port with the following files on the root directory:

bzImage : Kernel image that will be loaded. Recommended to use this sources to compile it.

initramfs.cpio.gz : The initial file system that gets loaded into memory during the Linux startup process. This one is recommended.

The file names must match with the above and you can have more files on the same USB drive. From there you can setup the environment to run from an NFS share or from an external drive via USB (recommended) and boot a complete distro!

A Compiled distro of Linux for the PS4. kR105 has the files bzImage and initramfs.cpio.gz ready for anyone to grab, so you don’t have to compile your own version. In his words: “those files should get you into linux with a nice bash console on your tv”.

Downloads

• You can download the new dlclose exploit from kR105’s github here.
• You can download the latest version of PS4-Playground from CTurt’s github here.
• You can download kR105’s compiled Linux files here.

Update: As pointed out by CTurt, you can simply download the compiled Linux files, put them on a FAT32 USB stick that you’ll connect to your 1.76 PS4, and test directly by going to the PS4 Playground live Demo here.

Wow, now that’s a good start for the weekend!

Is now the right time to buy a 1.76 PS4?

The PS4 scene is boiling right now, with people making daily progress on the dlclose and BadIRET kernel exploits on PS4 1.76. It’s probably going to be a matter of weeks now until people start poking into the Ps4 firmware, or get a full toolkit to install Linux on the device. Is now the right time to get a 1.76 PS4?

If you’ve been on the console scene for a while, you’re probably familiar with the concept of “golden firmware”. The golden firmware is the firmware that gives you the best of what your console can achieve, both from a perspective of official games, and from a hacking point of view. On the PSP, firmware 1.5 was the “golden firmware” for a very long time, as it was the only one with all the cool exploits, piracy, and homebrews. If I recall correctly, the first custom firmwares on the PSP from Dark Alex were basically taking all the cool stuff from firmware 1.5, and merging those on top of the latest firmware, to get the best of both worlds.

Nowadays, with online access being a prerequisite to do anything official on your console, it’s difficult to bypass firmware updates. Most games or applications on your PS4 will probably refuse to run if you’re not running on the latest firmware, and very soon you’d have to say goodbye to the latest games if you decided to stay forever on, say, firmware 1.76.

In that kind of context, I’m convinced people who are interested in the PS4 scene will need basically two consoles: one for hacks that you’d keep on a lower firmware, the other for “regular” gaming, constantly up to date.

The dlclose kernel exploit was released a few days ago

Now that the scene is just getting ramped up on PS4 exploits with firmware 1.76, it is still possible to find a 1.76 PS4 for a “reasonable” price. We’re all facing a choice at this point: some of us will be buying one now for a reasonable price, in the hope that 1.76 exploits take off soon. Others will just be waiting, hoping that new kernel exploits surface for the latest firmware (3.50?) by the time user-friendly hacks and tools are available.

Our first guy is buying a 1.76 console at a quite expensive price, but still reasonable (you can easily find 1.76 PS4s around $550 today). If hacks on 1.76 become mainstream, prices of 1.76 consoles will skyrocket, and I can easily picture such devices selling for more than $1000 very soon. On the other hand, if an exploit is revealed on the latest firmware, which gives people the same level of tools as 1.76 provides now, our  friend has overpaid about $150 for his second PS4.

My second guy doesn’t want to buy a 1.76 PS4 just yet. If an exploit is revealed for the latest firmware 3.50, he can buy any second-hand PS4 for $300, keep it at 3.50, and be done with it. On the other hand, if 1.76 PS4 hacks become mainstream and no “latest firmware” exploit is revealed for a long time, he’ll be the *** having to buy a 1.76 PS4 for more than $1000.

---

I’m personally on the fence right now. It’s a bet. Statistics tell me there’s always going to be an exploit for the latest firmware at some point, however I can’t help but realize that times have changed: hackers don’t release kernel exploits as often as they used to for, say, the PSP. Maybe what we have on 1.76 right now is a “one time thing”, and we might not see more PS4 kernel exploits for a long time.

Thoughts?

PS4 hack: Developer Zer0xFF releases dlclose exploit source

We had the technical writeup from CTurt, and the “confirmation” from bigboss. Today developer Zer0xFF put things together and released the source code for a proof of concept of the dlclose kernel exploit for the PS4. In other words, if you have a 1.76 PS4, you’re getting closer to a PS4 jailbreak, or to running Linux on your PS4.

This goes without saying, but this is not a CFW, it will not magically let you run pirated PS4 games. This is just one step closer for those of you with reasonable coding skills, who are trying to hack their PS4. You’ll need to be able to compile this and run it on your PS4. We give lots of details on how to do this in this article. That’s pretty much the same except you’ll use the dlclose exploit instead of the BadIRET one. (People have said that the dlclose exploit is cleaner and easier to handle).

From a scene perspective, it’s also good to see that more and more people are confirming the exploit and working on it.

Zer0xFF mentions that he got help from bigboss, but also from Twisted, whom you might remember for hisRemote Play PC work. There’s more than a handful of people building on top off CTurt‘s work right now, which is promising.

Bigboss also hinted that he might release something for the sceen soon (ETA might be his birthday which is next week) , which I assume could be the exploit in a compiled way and potentially more user friendly.

If you’re a dev looking for help in building this, we also have a thread on /talk to get help on running the exploits on your PS4. Feel free to join.

Seems like these are good times to own a PS4 running firmware 1.76

Download the PS4 dlclose exploit

---

You can download Zer0xFF’s work on his github here. Keep in mind that this is the source code, it will be useless to you if you’re not a dev.

Also remember that a kernel exploit, especially in the early stages like this, is a dangerous tool: you could brick your PS4 if you handle this incorrectly. Understand that this is work in progress stuff from people who are willing to share their work with the scene in an open way. Don’t make them regret it!

Source: playstationhax.it, thanks to @isset_asset

Cosmo3DS: YifanLu releases new CFW for 3DS, introduces “cleaner” CFW concepts

A few hours ago hacker YifanLu released Cosmo3DS, a barebone 3DS Custom Firmware that ships withemuNAND and allows the user to switch their 3DS region at will. It also gives the user access to any region’s eShop.

Specifically, Cosmo3DS matches the following requirements from YifanLu:

• Keep my 3DS on the hackable 9.2 firmware but still use the latest system software (emuNAND)
• Play games region free right from the home menu
• Change the system region without possibly bricking the device
• Use the eShop with region changed systems

Yifanlu emphasizes that this Customer firmware does not enable piracy, but that’s not the interesting part of this relase:

Cosmo3DS is built on top of the concept that YifanLu introduced recently about a “cleaner” way of writing Custom Firmwares for the 3DS. Yifanlu claims (and basically demonstrates in his articles) that 3DS Custom Firmwares today are written in an inefficient way. They use resources, and make further modding difficult.

Cosmo3DS is built around an entirely rewritten “Loader”, which handles code injection on the 3DS in a much more clean, centralized and controlled way. I’ll let you read Yifan’s article for details. What this means to the end user though is that Cosmo3DS could be the base for much more moddable Custom Firmware in the future. Cleaner code could lead to more customizations for your 3DS. Yifanlu mentions the possibility to see a “homebrew” button in the menu, custom keyboards, or more advanced custom themes.

I believe that using a custom “loader” will make it much easier to write mods for the 3DS. We could see hacks such as a “Homebrew” button in the Home Menu or custom keyboards or custom themes outside of what Nintendo officially supports. We might also see hacks for games similar to HANS but without requiring access to a dump of the game. I hope 3DS developers will pick up on this and make cool mods and hacks for the system.

Having been on the console scene for 10 years now, I can relate to Yifan’s observation about the quality of the code in homebrew in general. The hacking scene is made of people with many skills, and not all of us have a degree in software engineering. For those of us with a computer science background, the lack of quality can be a bit frustrating, and I think this is where Yifanlu is coming from. Back in the days, I’ve worked on PSP hacks with people who cared more about their variable naming conventions than a good long term design to make the project maintainable and scalable. This was annoying (and I believe the other dude was frustrated too to be honest. It’s not always easy working on software projects with people from various backgrounds)

---

On the PSP scene, there used to be a great resource for people looking to collaborate on hacks and build clean stuff (ps2dev.org, now dead). I’m not exactly sure why and how things went so well there, but the people who drove the tech discussions on the PSP back then were building really clean stuff (the PSP SDK comes to mind). It seems to me modern console scenes are having a hard time reaching that level of quality. But maybe I’m just not seeing it. Either way, here’s to YifanLu’s new CFW, and hoping this will bring good news to the scene moving forward!

A few hours ago hacker YifanLu released Cosmo3DS, a barebone 3DS Custom Firmware that ships withemuNAND and allows the user to switch their 3DS region at will. It also gives the user access to any region’s eShop.

Specifically, Cosmo3DS matches the following requirements from YifanLu:

• Keep my 3DS on the hackable 9.2 firmware but still use the latest system software (emuNAND)
• Play games region free right from the home menu
• Change the system region without possibly bricking the device
• Use the eShop with region changed systems

Yifanlu emphasizes that this Customer firmware does not enable piracy, but that’s not the interesting part of this relase:

Cosmo3DS is built on top of the concept that YifanLu introduced recently about a “cleaner” way of writing Custom Firmwares for the 3DS. Yifanlu claims (and basically demonstrates in his articles) that 3DS Custom Firmwares today are written in an inefficient way. They use resources, and make further modding difficult.

Cosmo3DS is built around an entirely rewritten “Loader”, which handles code injection on the 3DS in a much more clean, centralized and controlled way. I’ll let you read Yifan’s article for details. What this means to the end user though is that Cosmo3DS could be the base for much more moddable Custom Firmware in the future. Cleaner code could lead to more customizations for your 3DS. Yifanlu mentions the possibility to see a “homebrew” button in the menu, custom keyboards, or more advanced custom themes.

I believe that using a custom “loader” will make it much easier to write mods for the 3DS. We could see hacks such as a “Homebrew” button in the Home Menu or custom keyboards or custom themes outside of what Nintendo officially supports. We might also see hacks for games similar to HANS but without requiring access to a dump of the game. I hope 3DS developers will pick up on this and make cool mods and hacks for the system.

Having been on the console scene for 10 years now, I can relate to Yifan’s observation about the quality of the code in homebrew in general. The hacking scene is made of people with many skills, and not all of us have a degree in software engineering. For those of us with a computer science background, the lack of quality can be a bit frustrating, and I think this is where Yifanlu is coming from. Back in the days, I’ve worked on PSP hacks with people who cared more about their variable naming conventions than a good long term design to make the project maintainable and scalable. This was annoying (and I believe the other dude was frustrated too to be honest. It’s not always easy working on software projects with people from various backgrounds)

On the PSP scene, there used to be a great resource for people looking to collaborate on hacks and build clean stuff (ps2dev.org, now dead). I’m not exactly sure why and how things went so well there, but the people who drove the tech discussions on the PSP back then were building really clean stuff (the PSP SDK comes to mind). It seems to me modern console scenes are having a hard time reaching that level of quality. But maybe I’m just not seeing it. Either way, here’s to YifanLu’s new CFW, and hoping this will bring good news to the scene moving forward!

Download Cosmo3DS

You can Download Cosmo3DS from YifanLu’s github. There’s no end-user “easy” installation process at this point so follow the instructions below if you feel inclined to:

If you want to use it, you need the CFW as well as the custom loader. Then, the important part is injecting the custom loader into the right FIRM file. (If you search for “reinand 3.1 firmware.bin pastebin” you should be able to find it)

Source: YifanLu on twitter

Wii U Homebrew launcher released by Dimok (supports 5.4.0, 5.3.2, 5.1.0, 5.0.0)

GBATemp developer Dimok has released a Homebrew launcher for the Wii U Yesterday.

This launcher lets you run elf files (the homebrews) directly from your SD Card or from the Network. It is compatible with Loadiine and ftpiiU. Current limitations is that only ELF Files up to 6.5MB are currently supported. (Although the homebrew itself needs to be small, it can still load huge amounts of stuff)

The release is extremely positively welcomed over at the GBATemp forum, and people have started contributing with icons/graphics, as well as updated homebrews to make them compatible with the loader.

Download Wii U Homebrew Launcher

You can download Wii U Homebrew Launcher 1.1 here

Source: GBATemp

PS Vita 3.57 hack: TheFlow found a way to install PS1 bubbles, asks for a 3.57 ePSP Kernel exploit

PSVita hacker theFlow, known for his work on VitaShell, has been recently investigating some PSP emu hacks on the PS Vita. He announced this week that he has found a way to make PS1 bubbles (in other words, a way to run unsigned PS1 binaries directly from the PS Vita’s live screen).

The Vita scene has been pretty quiet lately, so it’s great to know that devs are still active.

The PS1 Bubble technique works on all firmwares, including on the latest 3.57 firmware. However, in order to be able to release it on firmware 3.57, TheFlow is asking for someone to step up and release a Kernel exploit for the PSP emulator on 3.57.

Does anybody have a 3.57 pspemu kernel exploit? Without it, the ps1 loader won’t be supported on 3.57..

— The Flow (@theflow0) February 9, 2016

Of course, this slightly lowers the benefits of the bubble in the first place, as having access to a PSP Emu Kernel exploit means you could access TN-V or ARK, full PSP Custom Firmwares running on the PS Vita, which give you access to all the features of the PSP Emu (including psp iso loading, homebrews, and plugins).

Nonetheless, this is a pretty cool finding, and popular PS Vita Developer 173210 hasconfirmed it works on firmware 3.57.

---

TheFlow has said on Twitter that he would release more information “soon”. Stay tuned



I was only asking whether @DaveeFTW and @173210 were interested, so please stop asking for beta testing. I’ll present more information soon. — The Flow (@theflow0) February 8, 2016

Source: TheFlow on Twitter

Wii U: Smealum showcases unsigned code execution (Coldboothax, redNAND, homebrew)

Yesterday, popular 3DS hacker Smealum shared some work in progress hacks for the Wii U, through a video.

In the Video, Smealum shows he is able to hack the console at boot, then install and run homebrews. Specifically, the video shows a homebrew running on the second screen of the console.

As others have mentioned below, the video shows some hardware mod attached to the Wii U. Smealum gave details earlier this week that this hardware mod was required to unbrick his console, and it is not related to the Wii U hack showcased here.

The hack, named coldboothax, lets Smealum execute a Custom Firmware on the console, named redNAND. From there he is able to run homebrews.

Smealum mentions that there is no plan to release this at the time being. This is just some work in progress that he is sharing. He credits plutoo, naehrwert, yellows8 and derrek for their work on this ongoing project. Most of them were involved in hacks that broke the security of the 3DS, and contributed to reveal some of the Wii U’s encryption keys a few weeks ago.

Hykem has confirmed that this is not related to his own ongoing effort to hack IOSU.

Source: Smealum on Twitter