Decided I was fed up with my old blog being clunky so I transitioned it to an Astro blog and so far it's been amazing!
Check out the new series page for RetailKit:
hackingadventures.ca/series/…
For anyone curious about the internals, this is the AMD64 Architecture Programmer's Manual Volume 2: System Programming I've been digging through. Truly a wealth of information for AMD SVM! docs.amd.com/v/u/en-US/24593…
I also pushed the improvements for the npt walk to my fork of ps5-hen so folks can mess around with it and see what else they can come up with too.
github.com/OSM-Made/ps5-hen/…
I noticed the recent PS5 HEN defeats XOTEXT by just disabling the NPT on all cores. This works, but it comes with a performance tradeoff, without NPT the HV seems to fall back to shadow page tables. Games seem to have 3x slower loads.
My solution is to just walk the nested CR3 and clear XOTEXT and set the RW flags. Gives essentially the same effect as the Bypervisor bug did with the QA flags. I'll make a PR on Cragson's repo once I get some time :D
If you told me I would be writing .NET Framework in 2026 I would not have believed you 🤣
Yet here I am doing just that for the PS4. You can check out what I have so far if you are interested. 😄
github.com/AetherPS/Fusion/t…
I've been going down my sort of bucket list from when I first started looking at the PS4. Now the real challenge would be if I could get AOT working not just JIT but I think that would require rebuilding the .dll.sprx format 😅
At least this proves it is possible. 😃
So I guess I should have spent more time looking at some of the PSM stuff.
Turns out you can just make this INI file "/app0/sce_psm.ini" with "mono jit true" in it. That just works to enable JIT as long as PsmIntDevMode is enabled.
I had actually forgot I had been working on a POC for folks to test with the RTC. I had some issues because I couldn't find a time authority that worked with the ps4 because of the limited TLS version.
If folks can try the following and let me know if it works.
gist.github.com/OSM-Made/08e…
This was tested being called from SceShellCore similar to how the official way does as I traced the code when there was a method to set the clock via official servers.
I dont have a machine that has the RTC problem so I'm interested if it works :)
Simple approach for PS4 kernel driver visibility in jailed vnodes, hook vnode creation and inject your ruleset directly.
I had issues with my devfs rule not always getting added to the jails vnode. This is a simple yet effective solution. 😀
github.com/AetherPS/Fusion/b…
I also made my own take on a FTP server :) I took some time to work on a listener that can handle some of the weird network states that happen on the PS4.
github.com/AetherPS/Fusion-F…
Thought I would share a project I had been working on for a bit that I use for some research on the PS4. Not really useful for end users but I wanted to publish this open source in case others can learn from it. :)
github.com/AetherPS/Fusion
I created an API layer that interfaces with the kernel driver to allow userland processes to do fun things :D
github.com/AetherPS/libFusio…
Its not all perfect and there is likely some silly mistakes but with so much being closed source anymore I thought I would share. :)
Something a bit different from my normal post but I recently put together a blog post on a vulnerability I discovered in Samsung's Account API. With just the username an attacker would get information disclosure that lead to a 2FA bypass.
hackingadventures.ca/posts/s…