A l'origine développé avec la faille webkit et l'exploit trouvé sur le firmware 3.55 trouvé par xyz et amélioré par Fire30, ce nouveau Playground repose sur un certains nombres de vulnérabilités, qui n'ont rien à voir avec celles employées sur firmware 1.76.
Sur firmware 3.55 (mais aussi sur 3.50 et 3.15), la série d'exploit s'appuie sur des vulnérabilités similaires à celles employées par HENkaku sur PS Vita 3.60, elles sont appelées FIREkaku.
Pour pouvoir utiliser cette interface, vous devez exécuter un script Python sur PC ou sur un serveur distant, et y accéder avec votre PS4, l'exploit paraissant plus stable que le précédent.
UsageYou will need fakedns. You also need to edit the dns.conf to point to the ip address of your PC (can be found in cmd/terminal by typing ipconfig/ifconfig), and modify your consoles' DNS settings to point to your PC's address. Then type the following in your terminal;python fakedns.py -c dns.confYou will also need to setup xampp on your computer and run Apache on port 80. For the easiest method, in /htdocs, create the '/document/en/ps4' directory and place the files from this repo in there.When your fake dns is running and you've setup your localhost server in xampp, you can navigate to PS4 -> Settings -> User Guide. It should then show PS4 Playground.NotesThe exploit will not run correctly all of the time. Sometimes it will stick at stage 4 or webkit will crash before the script is finished. If it doesn't work at first, keep trying until it does, it shouldn't take long.Refreshing the page after a successful attempt or going to another page will crash webkit. Just hit OK and it will resume to the next action you wanted to perform.The project isn't 100% complete, however more things have been added in the 1.3 update. Modules can now be dumped from memory, however currently only modules loaded by WebKit can be dumped.The sizes of dumps may be small for some modules, but they should include most of everything you would need anyway.Because of how large the libSceWebKit2.sprx module is, it must be dumped in 17 parts. Once you have all 17 parts (check filesystem on server first), you can click the "Stitch WebKit" button which will merge them all into one dump. I tried to make it dump the module all at once, but it absolutely wrecked my PS4's ram and gave a system error after a 5 minute long freeze.If you try to stitch WebKit without all 17 parts, the PHP page you are directed to will probably display errors and you may have to close the browser to get out. I plan to fix this in a future commit with proper error handling/Dumps are named .bin rather than .sprx to distinguish that they are dumped from memory and not by file, however they will still load fine in IDA for example.If you have a seemingly endless string of crashes, try closing and re-opening the web browser/user guide, seems to help in this regard.Big thanks to XorLoser, Maxton, and Fire30 for assistance with dumping the modules.Thanks to Xerpi, we now have stack/memory management and are able to do more cool stuff!
Tout est expliqué ici : 3.xx Playground
