Skip to content

Commit a83f34f

Browse files
committed
missed last minute renaming bug
1 parent 90c9f8e commit a83f34f

File tree

3 files changed

+31
-3
lines changed

3 files changed

+31
-3
lines changed

README.md

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,30 @@
11
# ps4sdk-examples
22
Examples and prove of concepts which show something realized with ps4sdk (not necessarily unique to the PS4)
3+
4+
## Examples
5+
* `libless` - These do not use any library functions (not even the sdk) and are good for initial tests
6+
* `posix` - These purely use posix and standard C APIs and should run under any such system
7+
* `freebsd` - These are pure freebsd examples (and should work there too)
8+
* `sce` - These showcase SCE functions
9+
* `ps4sdk` - These are user space programs which use the sdks own (common) capabilities
10+
* `kernel` - These are showing something we can do in the kernel using the sdk
11+
* `failures` - These corner-cases noteworthyly do not work (but could be expected to)
12+
13+
## Noteworthy
14+
* `freebsd/dirent` displays the fs and can be run after you use another elf to escalate your privileges
15+
* `ps4sdk/kernel_execute` shows how to do enter the kernel from user space on your own (it's likely less
16+
convenient and useful then a kernel payload, but has a use-case too). Be aware, that when your program
17+
exits, your resources (all functions and data) will be gone too. Be sure to unlink these user space resources
18+
from the kernel! Use a kernel payload that never ends (sleep on a mutex) instead.
19+
* `ps4sdk/system_call_hook` shows how to temporarily hook from user space. For the reasons above,
20+
a kernel payload is more likely to be useful and stable for any long term attempts. See `kernel/system_call` for
21+
comparison
22+
* `kernel/system_call_hook kernel/function_hook` print the same descriptor all the time, thats correct because thats
23+
what happens. Press the options button to see changes. To influence the return values, use a post hook and alter
24+
args->returns->rax (etc.). Try the function index hook (on 5055) and restart the browser!
25+
26+
## Important
27+
The exploit may not always enter the kernel on the first try. Is you browser crashes,
28+
simply try again and its likely to work. This will be tuned in the future as much as possible.
29+
Especially after you crashed your kernel, this is very common (down right normal) because the
30+
initial resource allocation differs.

kernel/cache/source/main.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,8 @@ int main(int argc, char **argv)
6868
//r = ps4KernelSocketPrint(td, client, "ps4KernelDlSym sysctl_handle_64: %p\n", m);
6969

7070
// uses a sub-cache called ps4.kernel.symbol.lookup
71-
r = ps4KernelSymbolLookup("sysctl_handle_64", &m);
72-
r = ps4KernelSocketPrint(td, client, "ps4KernelSymbolLookup sysctl_handle_64: %p %i\n", m, r);
71+
r = ps4KernelSymbolLookUp("sysctl_handle_64", &m);
72+
r = ps4KernelSocketPrint(td, client, "ps4KernelSymbolLookUp sysctl_handle_64: %p %i\n", m, r);
7373

7474
m = NULL;
7575
r = ps4KernelCacheGlobalGet("ps4.kernel.symbol.lookup", &m);

kernel/system_call_hook/source/main.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ int main(int argc, char **argv)
116116
struct sysent *sy;
117117
int r;
118118

119-
ps4ExpressionReturnOnError(ps4KernelSymbolLookup("sysent", (void **)&sy));
119+
ps4ExpressionReturnOnError(ps4KernelSymbolLookUp("sysent", (void **)&sy));
120120

121121
if(ps4KernelIsInKernel() != PS4_OK)
122122
{

0 commit comments

Comments
 (0)