|
1 | 1 | # ps4sdk-examples |
2 | 2 | Examples and prove of concepts which show something realized with ps4sdk (not necessarily unique to the PS4) |
| 3 | + |
| 4 | +## Examples |
| 5 | +* `libless` - These do not use any library functions (not even the sdk) and are good for initial tests |
| 6 | +* `posix` - These purely use posix and standard C APIs and should run under any such system |
| 7 | +* `freebsd` - These are pure freebsd examples (and should work there too) |
| 8 | +* `sce` - These showcase SCE functions |
| 9 | +* `ps4sdk` - These are user space programs which use the sdks own (common) capabilities |
| 10 | +* `kernel` - These are showing something we can do in the kernel using the sdk |
| 11 | +* `failures` - These corner-cases noteworthyly do not work (but could be expected to) |
| 12 | + |
| 13 | +## Noteworthy |
| 14 | +* `freebsd/dirent` displays the fs and can be run after you use another elf to escalate your privileges |
| 15 | +* `ps4sdk/kernel_execute` shows how to do enter the kernel from user space on your own (it's likely less |
| 16 | +convenient and useful then a kernel payload, but has a use-case too). Be aware, that when your program |
| 17 | +exits, your resources (all functions and data) will be gone too. Be sure to unlink these user space resources |
| 18 | +from the kernel! Use a kernel payload that never ends (sleep on a mutex) instead. |
| 19 | +* `ps4sdk/system_call_hook` shows how to temporarily hook from user space. For the reasons above, |
| 20 | +a kernel payload is more likely to be useful and stable for any long term attempts. See `kernel/system_call` for |
| 21 | +comparison |
| 22 | +* `kernel/system_call_hook kernel/function_hook` print the same descriptor all the time, thats correct because thats |
| 23 | +what happens. Press the options button to see changes. To influence the return values, use a post hook and alter |
| 24 | +args->returns->rax (etc.). Try the function index hook (on 5055) and restart the browser! |
| 25 | + |
| 26 | +## Important |
| 27 | +The exploit may not always enter the kernel on the first try. Is you browser crashes, |
| 28 | +simply try again and its likely to work. This will be tuned in the future as much as possible. |
| 29 | +Especially after you crashed your kernel, this is very common (down right normal) because the |
| 30 | +initial resource allocation differs. |
0 commit comments