INTRODUCING: "Wake & Break" - a PSP Exploit for @AMD navi31 cards.

Ever wanted to fuck around with firmware components running on your @AMD GPU that @AMD believes you have no business messing around with? Me neither! But the @tinygrad people might have!

github.com/blasty/wake-an…

Method we used (>5 years ago, now) on ps5 to fiddle with mp4 and hv memory: github.com/fail0verflow/p…
hope it helps for linux!

I ported Linux to the PS5 and turned it into a Steam Machine. Running GTA 5 Enhanced with Ray Tracing. 🤯

This is funny, just found an easter egg in Siglent oscilloscope that contains Super Mario game available through Web interface.

Here's the link to the tool I meant to release at the end: github.com/symbrkrs/ps5-u…
It makes fiddling with EMC/EFC/EAP easy, have fun!

Having a great time at #TheSAS2024 ! You find find slides for my talk here: symbrk.rs/presentations/… I didn't get through all slides...😅

Living legend Shawn Hoffman @shuffle2, who extracted all keys from crypto processors of all video game consoles, talks at #TheSAS2024 about hacking PlayStation 5 chips

Lars Fröder @opa334dev, creator of the Dopamine jailbreak, on stage to talk about iOS hacking in 2024 #TheSAS2024

There are a few ways on PS5 to defeat HV. One of methods that I've found was related to APIC: struct apic_ops is located in RW segment of kernel data. With KRW you can overwrite a function pointer inside it like xapic_mode and get into ROP, for example (just need to bypass CFI).

Then, after you do suspend/resume cycle your code will be executed before HV restarts and you can apply kernel patches, etc.

By the way, it's not the method that has been patched in 5.00. Actually I'm not even sure if has been patched at all, needs testing for which I don't have spare time now. Maybe someone can do it.

Beyond Oberon: Exploiting PlayStation 5's EFC and EMC by Shawn Hoffman @shuffle2 #TheSAS2024 thesascon.com 👀

PS5's umtx exploit for Lua?gist.github.com/flatz/5e12f75c…

Well, this is PS5's umtx exploit for BD-J (a part related to the exploit actually): gist.github.com/flatz/89dfe9ed…

want to play with the fbsd umtx exploit? check out github.com/fail0verflow/p…

Hello, folks. I'm in Serbia/UAE nowadays and looking for new job opportunities in info security. Remote jobs are currently preferred. CV: github.com/flatz/cv

Decided to publish PPPwn early. The first PlayStation 4 Kernel RCE. Supporting FWs upto 11.00.

github.com/TheOfficialFlo…

On 4800s the Nuvoton chip marked 5565D-M was used as multi-controller. Unfortunately, there is no datasheet for it and its pinout very differs from all public datasheets of similar chips that I can find.

After a week of guessing, bruteforcing, reflashing BIOS (where I put my PSP payload) and observing LPC bus using Logic Analyzer, I was able to find a combination of register/bits that needed to be toggled to activate UART.

Finally, I have proper read/write/call primitives running via UART server from my PSP payload that works in SVC mode.