├── win-clean.bat ├── win-make.bat ├── .gitattributes ├── tool ├── Makefile └── bin2js.c ├── clean.sh ├── DB_SG_Backup ├── include │ └── patch.h ├── Makefile └── source │ ├── patch.c │ └── main.c └── exploit.template /win-clean.bat: -------------------------------------------------------------------------------- 1 | @ECHO OFF 2 | bash -c "./clean.sh" 3 | #pause -------------------------------------------------------------------------------- /win-make.bat: -------------------------------------------------------------------------------- 1 | @ECHO OFF 2 | bash -c "export PS4SDK=~/PS4-SDK && ./build.sh" 3 | pause -------------------------------------------------------------------------------- /.gitattributes: -------------------------------------------------------------------------------- 1 | # Auto detect text files and perform LF normalization 2 | * text=auto 3 | -------------------------------------------------------------------------------- /tool/Makefile: -------------------------------------------------------------------------------- 1 | all: bin2js 2 | 3 | bin2js: bin2js.c 4 | gcc -o bin2js bin2js.c 5 | 6 | .PHONY: clean 7 | 8 | clean: 9 | rm bin2js 10 | 11 | -------------------------------------------------------------------------------- /clean.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | pushd tool 3 | make clean 4 | popd 5 | pushd DB_SG_Backup 6 | make clean 7 | popd 8 | rm -f html_payload/DB_SG_Backup.html 9 | rm -f bin/DB_SG_Backup.bin 10 | 11 | -------------------------------------------------------------------------------- /tool/bin2js.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | int main(int argc, char** argv) 8 | { 9 | assert(argc == 2); 10 | char* fn = argv[1]; 11 | FILE* f = fopen(fn, "r"); 12 | fseek(f, 0, SEEK_END); 13 | int l = ftell(f); 14 | int ll = (l + 3) / 4; 15 | fseek(f, 0, SEEK_SET); 16 | char *b = malloc(ll * 4); 17 | memset(b, 0, ll * 4); 18 | fread(b, l, 1, f); 19 | fclose(f); 20 | uint32_t *u = (uint32_t *)b; 21 | printf("var payload=["); 22 | for (int i = 0; i < ll; i++) 23 | { 24 | printf("%u", *u++); 25 | if (i < (ll - 1)) printf(","); 26 | } 27 | printf("];\n"); 28 | free(b); 29 | } 30 | 31 | -------------------------------------------------------------------------------- /DB_SG_Backup/include/patch.h: -------------------------------------------------------------------------------- 1 | #ifndef LINK_H 2 | #define LINK_H 3 | 4 | struct auditinfo_addr { 5 | char useless[184]; 6 | }; 7 | 8 | struct ucred { 9 | uint32_t useless1; 10 | uint32_t cr_uid; // effective user id 11 | uint32_t cr_ruid; // real user id 12 | uint32_t useless2; 13 | uint32_t useless3; 14 | uint32_t cr_rgid; // real group id 15 | uint32_t useless4; 16 | void *useless5; 17 | void *useless6; 18 | void *cr_prison; // jail(2) 19 | void *useless7; 20 | uint32_t useless8; 21 | void *useless9[2]; 22 | void *useless10; 23 | struct auditinfo_addr useless11; 24 | uint32_t *cr_groups; // groups 25 | uint32_t useless12; 26 | }; 27 | 28 | struct filedesc { 29 | void *useless1[3]; 30 | void *fd_rdir; 31 | void *fd_jdir; 32 | }; 33 | 34 | struct proc { 35 | char useless[64]; 36 | struct ucred *p_ucred; 37 | struct filedesc *p_fd; 38 | }; 39 | 40 | struct thread { 41 | void *useless; 42 | struct proc *td_proc; 43 | }; 44 | 45 | 46 | int patcher(struct thread *td); 47 | 48 | #endif 49 | -------------------------------------------------------------------------------- /DB_SG_Backup/Makefile: -------------------------------------------------------------------------------- 1 | LIBPS4 := $(PS4SDK)/libPS4 2 | 3 | CC := gcc 4 | AS := gcc 5 | OBJCOPY := objcopy 6 | ODIR := build 7 | SDIR := source 8 | IDIRS := -I$(LIBPS4)/include -I. -Iinclude 9 | LDIRS := -L$(LIBPS4) -L. -Llib 10 | CFLAGS := $(IDIRS) -Os -std=gnu11 -ffunction-sections -fdata-sections -fno-builtin -nostartfiles -nostdlib -Wall -masm=intel -march=btver2 -mtune=btver2 -m64 -mabi=sysv -mcmodel=small -fpie 11 | SFLAGS := -nostartfiles -nostdlib -masm=intel -march=btver2 -mtune=btver2 -m64 -mabi=sysv -mcmodel=large 12 | LFLAGS := $(LDIRS) -Xlinker -T $(LIBPS4)/linker.x -Wl,--build-id=none 13 | CFILES := $(wildcard $(SDIR)/*.c) 14 | SFILES := $(wildcard $(SDIR)/*.s) 15 | OBJS := $(patsubst $(SDIR)/%.c, $(ODIR)/%.o, $(CFILES)) $(patsubst $(SDIR)/%.s, $(ODIR)/%.o, $(SFILES)) 16 | 17 | LIBS := -lPS4 18 | 19 | TARGET = $(shell basename $(CURDIR)).bin 20 | 21 | $(TARGET): $(ODIR) $(OBJS) 22 | $(CC) $(LIBPS4)/crt0.s $(ODIR)/*.o -o temp.t $(CFLAGS) $(LFLAGS) $(LIBS) 23 | $(OBJCOPY) -O binary temp.t $(TARGET) 24 | rm -f temp.t 25 | 26 | $(ODIR)/%.o: $(SDIR)/%.c 27 | $(CC) -c -o $@ $< $(CFLAGS) 28 | 29 | $(ODIR)/%.o: $(SDIR)/%.s 30 | $(AS) -c -o $@ $< $(SFLAGS) 31 | 32 | $(ODIR): 33 | @mkdir $@ 34 | 35 | .PHONY: clean 36 | 37 | clean: 38 | rm -f $(TARGET) $(ODIR)/*.o 39 | 40 | 41 | 42 | 43 | -------------------------------------------------------------------------------- /DB_SG_Backup/source/patch.c: -------------------------------------------------------------------------------- 1 | #include "ps4.h" 2 | #include "patch.h" 3 | 4 | unsigned int long long __readmsr(unsigned long __register) { 5 | unsigned long __edx; 6 | unsigned long __eax; 7 | __asm__ ("rdmsr" : "=d"(__edx), "=a"(__eax) : "c"(__register)); 8 | return (((unsigned int long long)__edx) << 32) | (unsigned int long long)__eax; 9 | } 10 | 11 | #define X86_CR0_WP (1 << 16) 12 | 13 | static inline __attribute__((always_inline)) uint64_t readCr0(void) { 14 | uint64_t cr0; 15 | 16 | asm volatile ( 17 | "movq %0, %%cr0" 18 | : "=r" (cr0) 19 | : : "memory" 20 | ); 21 | 22 | return cr0; 23 | } 24 | 25 | static inline __attribute__((always_inline)) void writeCr0(uint64_t cr0) { 26 | asm volatile ( 27 | "movq %%cr0, %0" 28 | : : "r" (cr0) 29 | : "memory" 30 | ); 31 | } 32 | 33 | 34 | int patcher(struct thread *td){ 35 | 36 | struct ucred* cred; 37 | struct filedesc* fd; 38 | 39 | fd = td->td_proc->p_fd; 40 | cred = td->td_proc->p_ucred; 41 | 42 | void* kernel_base = &((uint8_t*)__readmsr(0xC0000082))[-0x1C0]; 43 | uint8_t* kernel_ptr = (uint8_t*)kernel_base; 44 | void** got_prison0 = (void**)&kernel_ptr[0x10986A0]; 45 | void** got_rootvnode = (void**)&kernel_ptr[0x22C1A70]; 46 | 47 | cred->cr_uid = 0; 48 | cred->cr_ruid = 0; 49 | cred->cr_rgid = 0; 50 | cred->cr_groups[0] = 0; 51 | 52 | cred->cr_prison = *got_prison0; 53 | fd->fd_rdir = fd->fd_jdir = *got_rootvnode; 54 | 55 | // escalate ucred privs, needed for access to the filesystem ie* mounting & decrypting files 56 | void *td_ucred = *(void **)(((char *)td) + 304); // p_ucred == td_ucred 57 | 58 | // sceSblACMgrIsSystemUcred 59 | uint64_t *sonyCred = (uint64_t *)(((char *)td_ucred) + 96); 60 | *sonyCred = 0xffffffffffffffff; 61 | 62 | // sceSblACMgrGetDeviceAccessType 63 | uint64_t *sceProcType = (uint64_t *)(((char *)td_ucred) + 88); 64 | *sceProcType = 0x3801000000000013; // Max access 65 | 66 | // sceSblACMgrHasSceProcessCapability 67 | uint64_t *sceProcCap = (uint64_t *)(((char *)td_ucred) + 104); 68 | *sceProcCap = 0xffffffffffffffff; // Sce Process 69 | 70 | // Disable write protection 71 | uint64_t cr0 = readCr0(); 72 | writeCr0(cr0 & ~X86_CR0_WP); 73 | 74 | // Restore write protection 75 | writeCr0(cr0); 76 | 77 | return 0; 78 | } 79 | 80 | -------------------------------------------------------------------------------- /DB_SG_Backup/source/main.c: -------------------------------------------------------------------------------- 1 | #include "ps4.h" 2 | #include "patch.h" 3 | 4 | int nthread_run; 5 | char notify_buf[1024]; 6 | 7 | void *nthread_func(void *arg) 8 | { 9 | time_t t1, t2; 10 | t1 = 0; 11 | while (nthread_run) 12 | { 13 | if (notify_buf[0]) 14 | { 15 | t2 = time(NULL); 16 | if ((t2 - t1) >= 15) 17 | { 18 | t1 = t2; 19 | systemMessage(notify_buf); 20 | } 21 | } 22 | else t1 = 0; 23 | sceKernelSleep(1); 24 | } 25 | 26 | return NULL; 27 | } 28 | 29 | 30 | int _main(struct thread *td) { 31 | initKernel(); 32 | initLibc(); 33 | initPthread(); 34 | syscall(11,patcher,td); 35 | initSysUtil(); 36 | nthread_run = 1; 37 | notify_buf[0] = '\0'; 38 | ScePthread nthread; 39 | scePthreadCreate(&nthread, NULL, nthread_func, NULL, "nthread"); 40 | int usbdir = open("/mnt/usb0/.dirtest", O_WRONLY | O_CREAT | O_TRUNC, 0777); 41 | if (usbdir == -1) 42 | { 43 | usbdir = open("/mnt/usb1/.dirtest", O_WRONLY | O_CREAT | O_TRUNC, 0777); 44 | if (usbdir == -1) 45 | { 46 | copy_File("/system_data/priv/mms/app.db", "/system_data/priv/mms/app.db_backup"); 47 | copy_File("/system_data/priv/mms/addcont.db", "/system_data/priv/mms/addcont.db_backup"); 48 | copy_File("/system_data/priv/mms/av_content_bg.db", "/system_data/priv/mms/av_content_bg.db_backup"); 49 | copy_File("/user/system/webkit/secure/appcache/ApplicationCache.db", "/user/system/webkit/secure/appcache/ApplicationCache.db_backup"); 50 | copy_File("/user/system/webkit/webbrowser/appcache/ApplicationCache.db", "/user/system/webkit/webbrowser/appcache/ApplicationCache.db_backup"); 51 | systemMessage("Internal backup complete.\nThis was only a database backup use a usb drive for full backup."); 52 | nthread_run = 0; 53 | return 0; 54 | } 55 | else 56 | { 57 | close(usbdir); 58 | systemMessage("Backing up to USB1"); 59 | unlink("/mnt/usb1/.dirtest"); 60 | mkdir("/mnt/usb1/DB_Dackup/", 0777); 61 | copy_File("/system_data/priv/mms/app.db", "/mnt/usb1/DB_Dackup/app.db"); 62 | copy_File("/system_data/priv/mms/addcont.db", "/mnt/usb1/DB_Dackup/addcont.db"); 63 | copy_File("/system_data/priv/mms/av_content_bg.db", "/mnt/usb1/DB_Dackup/av_content_bg.db"); 64 | mkdir("/mnt/usb1/UserData/", 0777); 65 | mkdir("/mnt/usb1/UserData/system_data/", 0777); 66 | mkdir("/mnt/usb1/UserData/system_data/savedata", 0777); 67 | mkdir("/mnt/usb1/UserData/system_data/priv", 0777); 68 | mkdir("/mnt/usb1/UserData/system_data/priv/home", 0777); 69 | mkdir("/mnt/usb1/UserData/system_data/priv/license", 0777); 70 | mkdir("/mnt/usb1/UserData/system_data/priv/activation", 0777); 71 | mkdir("/mnt/usb1/UserData/user/", 0777); 72 | mkdir("/mnt/usb1/UserData/user/home/", 0777); 73 | mkdir("/mnt/usb1/UserData/user/trophy", 0777); 74 | mkdir("/mnt/usb1/UserData/user/license", 0777); 75 | mkdir("/mnt/usb1/UserData/user/settings", 0777); 76 | mkdir("/mnt/usb1/UserData/user/system", 0777); 77 | mkdir("/mnt/usb1/UserData/user/system/webkit", 0777); 78 | mkdir("/mnt/usb1/UserData/user/system/webkit/secure", 0777); 79 | mkdir("/mnt/usb1/UserData/user/system/webkit/webbrowser", 0777); 80 | sprintf(notify_buf, "Copying: User Data\nPlease wait."); 81 | copy_Dir("/system_data/savedata","/mnt/usb1/UserData/system_data/savedata"); 82 | copy_Dir("/user/home", "/mnt/usb1/UserData/user/home"); 83 | copy_Dir("/user/trophy", "/mnt/usb1/UserData/user/trophy"); 84 | copy_Dir("/user/license", "/mnt/usb1/UserData/user/license"); 85 | copy_Dir("/user/settings", "/mnt/usb1/UserData/user/settings"); 86 | copy_Dir("/user/system/webkit/secure","/mnt/usb1/UserData/user/system/webkit/secure"); 87 | copy_Dir("/user/system/webkit/webbrowser","/mnt/usb1/UserData/user/system/webkit/webbrowser"); 88 | copy_Dir("/system_data/priv/home","/mnt/usb1/UserData/system_data/priv/home"); 89 | copy_Dir("/system_data/priv/license","/mnt/usb1/UserData/system_data/priv/license"); 90 | copy_Dir("/system_data/priv/activation","/mnt/usb1/UserData/system_data/priv/activation"); 91 | notify_buf[0] = '\0'; 92 | nthread_run = 0; 93 | systemMessage("USB Backup Complete."); 94 | } 95 | } 96 | else 97 | { 98 | close(usbdir); 99 | systemMessage("Backing up to USB0"); 100 | unlink("/mnt/usb0/.dirtest"); 101 | mkdir("/mnt/usb0/DB_Dackup/", 0777); 102 | copy_File("/system_data/priv/mms/app.db", "/mnt/usb0/DB_Dackup/app.db"); 103 | copy_File("/system_data/priv/mms/addcont.db", "/mnt/usb0/DB_Dackup/addcont.db"); 104 | copy_File("/system_data/priv/mms/av_content_bg.db", "/mnt/usb0/DB_Dackup/av_content_bg.db"); 105 | mkdir("/mnt/usb0/UserData/", 0777); 106 | mkdir("/mnt/usb0/UserData/system_data/", 0777); 107 | mkdir("/mnt/usb0/UserData/system_data/savedata", 0777); 108 | mkdir("/mnt/usb0/UserData/system_data/priv", 0777); 109 | mkdir("/mnt/usb0/UserData/system_data/priv/home", 0777); 110 | mkdir("/mnt/usb0/UserData/system_data/priv/license", 0777); 111 | mkdir("/mnt/usb0/UserData/system_data/priv/activation", 0777); 112 | mkdir("/mnt/usb0/UserData/user/", 0777); 113 | mkdir("/mnt/usb0/UserData/user/home/", 0777); 114 | mkdir("/mnt/usb0/UserData/user/trophy", 0777); 115 | mkdir("/mnt/usb0/UserData/user/license", 0777); 116 | mkdir("/mnt/usb0/UserData/user/settings", 0777); 117 | mkdir("/mnt/usb0/UserData/user/system", 0777); 118 | mkdir("/mnt/usb0/UserData/user/system/webkit", 0777); 119 | mkdir("/mnt/usb0/UserData/user/system/webkit/secure", 0777); 120 | mkdir("/mnt/usb0/UserData/user/system/webkit/webbrowser", 0777); 121 | sprintf(notify_buf, "Copying: User Data\nPlease wait."); 122 | copy_Dir("/system_data/savedata","/mnt/usb0/UserData/system_data/savedata"); 123 | copy_Dir("/user/home", "/mnt/usb0/UserData/user/home"); 124 | copy_Dir("/user/trophy", "/mnt/usb0/UserData/user/trophy"); 125 | copy_Dir("/user/license", "/mnt/usb0/UserData/user/license"); 126 | copy_Dir("/user/settings", "/mnt/usb0/UserData/user/settings"); 127 | copy_Dir("/user/system/webkit/secure","/mnt/usb0/UserData/user/system/webkit/secure"); 128 | copy_Dir("/user/system/webkit/webbrowser","/mnt/usb0/UserData/user/system/webkit/webbrowser"); 129 | copy_Dir("/system_data/priv/home","/mnt/usb0/UserData/system_data/priv/home"); 130 | copy_Dir("/system_data/priv/license","/mnt/usb0/UserData/system_data/priv/license"); 131 | copy_Dir("/system_data/priv/activation","/mnt/usb0/UserData/system_data/priv/activation"); 132 | notify_buf[0] = '\0'; 133 | nthread_run = 0; 134 | systemMessage("USB Backup Complete."); 135 | } 136 | 137 | return 0; 138 | } 139 | 140 | 141 | -------------------------------------------------------------------------------- /exploit.template: -------------------------------------------------------------------------------- 1 | #NAME#
2 | 3 | --------------------------------------------------------------------------------