Recent content on fail0verflow
Aaaand we’re back, after an extended delay, to … continue talking about hacking PS4 peripherals 😅. This time, the DUT is the PS4 Virtual Reality peripheral: PSVR. We managed to find some major flaws - breaking secure boot and extracting all key material; let’s go! Yet another PS4 peripheral? Digging into the PSVR was initially done in anticipation of the PS5 release after it…
This post describes another way to attain code execution on Aeolia (actually, the southbridge revision on PS4 Pro which was used in this case is named “Belize”). This exploit differs from the previously documented method as it does not have the prerequisite of gaining control of the APU. Additionally it is fairly generic and therefor workable on all currently released hardware and…
In the PS4 Aux Hax series of posts, we’ll talk about hacking parts of the PS4 besides the main x86 cores of the APU. In this entry, we’ll step outside of the PS4 itself, and take a look at pwning the main handheld controller used by the system. Pwn a controller, what? The Dualshock4 initially came to my attention while looking through the x86 FreeBSD kernel. Parts of the driver stack…
In the PS4 Aux Hax series of posts, we’ll talk about hacking parts of the PS4 besides the main x86 cores of the APU. In this entry, we’ll recount some parts of the path taken to get permanent arbitrary code exec on syscon. Syscon recon The “System Controller” appears as a mysterious “SCEI A01-C0L” device on SAA-001. Thanks to droogie, we know this is a rebranded…
In the PS4 Aux Hax series of posts, we’ll talk about hacking parts of the PS4 besides the main x86 cores of the APU. In this first entry, we’ll give some background for context and describe how we managed to run arbitrary code persistently on Aeolia, the PS4 southbridge. Not shown in this post are the many iterations of failure which lead to success. The blog would be much too long :)…
Welcome to ShofEL2 and Switch Linux, fail0verflow’s boot stack for no-modification, universal code execution and Linux on the Nintendo Switch (and potentially any Tegra X1 platform). Choosing whether to release an exploit or not is a difficult choice. Given our experiences with past consoles, we’ve been wary of releasing vulnerability details or exploits for fear of them being used…
What if a secure device had an attacker-viewable crashdump format? What if that same device allowed putting arbitrary memory into the crashdump? Amazingly, the ps4 tempted fate by supporting both of these features! Let’s see how that turned out… Crashdumps on PS4 The crash handling infrastructure of the ps4 kernel is interesting for 2 main reasons: It is ps4-specific code (likely to…
Plenty of time has passed since we first demonstrated Linux running on the PS4. Now we will step back a bit and explain how we managed to jump from the browser process into the kernel such that ps4-kexec et al. are usable. Over time, ps4 firmware revisions have progressively added many mitigations and in general tried to lock down the system. This post will mainly touch on vulnerabilities and…
Another year, another console hacking talk ! This talk picks off where our lighting talk last year left off, and goes into detail of how we ported Linux to the PS4. If you haven’t watched it, take a look before reading the rest of this post: Slides: Online · Download / source code Last year we demoed Linux on the PS4. Since then, we’ve gotten 3D graphics working, polished a number of…
Ben Byer 1980 – 2016 We are deeply saddened by the news that our member, colleague, and friend Ben “bushing” Byer passed away of natural causes on Monday, February 8th. Many of you knew him as one of the public faces of our group, fail0verflow, and before that, Team Twiizers and the iPhone Dev Team. Outspoken but never confrontational, he was proof that even in the competitive and oftentimes…
If you’re here, you’ve probably heard about our lightning talk at the 32nd Chaos Communication Congress demoing Linux on a PS4. This post continues where the talk left off and clarifies a few aspects of what we’re doing, and why. If you haven’t yet, please watch the talk before reading the rest of this post: Slides: Online · Download / source code Two years ago, I said that…
For the 31c3 CTF , Eindbazen and fail0verflow joined forces as 0xffa , the Final Fail Alliance. Don't miss out on other write-ups at Eindbazen's site ! pong pwn (30 pts) ------------------- To play it, connect to our server via: socat -,raw,echo=0 TCP:188.40.18.92:2001 Have fun! We are provided with the binary for the server, a Linux x86_64 binary that uses Lua. The service is a version of pong…
For the 31c3 CTF , Eindbazen and fail0verflow joined forces as 0xffa , the Final Fail Alliance. Don't miss out on other write-ups at Eindbazen's site ! safelock Signals (20 pts) ------------------- This is the circuit of a safe lock. Get the key to open it! http://188.40.18.86/safelock/ It's neither about webtronics nor ngspice. Disregard bugs in both. If you want to write spice code directly, use…
The chain In the last post, I explained the bug that we used to get a foothold into the system, but we’re far from achieving what we want. We left off being able to overwrite anything before a particular buffer but because of caching behavior that didn’t get us all that far. Additionally, we don’t know exactly where we are in memory. I mentioned in the previous post that there’s a debug port on…
In case you’re looking for the root, it was released a little while back: here The foothold I’d tell you all about what the Chromecast is, but I think Wikipedia has that part covered for me. For our purposes, all you need to know is that it’s an ARMv7 based device, has WiFi, an HDMI connector and a maintenance port in the form of a micro USB port. Additionally you can crack the case open and…