Update: in an earlier version of this article we wrote “ZNullPtr is one of the developers behind the latest PS4 9.03 Jailbreak”. This was a very unfortunate typo. We meant of course the 9.00 Jailbreak, not 9.03.

PS4/PS5 scene dev ZNullPtr has shared a bit of insight on his (and others) work to exploit the PS5, while also venting a bit of frustration toward the scene.

ZNullPtr is, among other things, one of the developers behind the latest PS4 9.00 Jailbreak, as well as one of the few hackers who have been working on a potential PS5 Jailbreak. In particular, he released with fellow developer Chendochap the PS5 4.03 ROP Execution toolkit, to this date the only publicly released way to run unsinged code on the PS5.

That was back in January, not so long ago! Unfortunately, the scene tends to forget people’s contributions quickly, and demand more every single day. A lot of people have been asking for a Jailbreak release for the PS5, or for the latest 9.03/9.04 PS4 firmware, without pausing to think about the tremendous amount of work required to find, develop, and release such exploits.

The PlayStation scene has a lot of ungrateful folks…

From the people asking daily for a 9.03/9.04 PS4 Jailbreak, to those literally insulting developers because they don’t get what they want instantly, the PlayStation hacking scene is unfortunately made of a lot of ungrateful folks. It’s always been the case, and it always will be.

We’re probably a minority of folks who basically marvel at the idea that a handful of individuals can defeat the security measures designed by one of the biggest companies in the world. People like me who have scratched the surface of computer security, just to understand the sheer amount of work required, came out with a tremendous amount of respect for the hackers who manage to pull it off from start to finish. Unfortunately, a majority of the “scene” just don’t care about what goes on under the hood, and that’s a fact we have to live with. I’ve decided a long time ago to only cater to the 5% of people who are actually interested in the ins and outs, and ignore the rest. I strongly advise hackers to do the same, and simply ignore the noise.

PS5 Exploits – The Status

With all of this being said, we can dig into some of the stuff ZNullPtr has revealed in the past few days:

• A reminder that he and a few other hackers are actively working on the PS5, and that he intends to continue
• He’s been working on an exploit involving nvme (the SSD interface), which requires hardware and has become costly (he’s seeking donations for that, check his twitter account for details)
  • He hinted that he’s also working on a more “traditional” kexploit approach
• A confirmation that PlayStation have been ok with disclosure (something that Cturt also emphasized recently), although they’ve been…slow when it comes to the PS5
• Stated something that I couldn’t agree more with: If you want to hack your PS4/PS5, but also want to play the latest games online, you need two machines. One for the hacks, one that you’ll keep on the latest firmware.
• Shared a bit of details on PS5 security and how it’s different from the PS4

I am working on an exploit

— Z (@Znullptr) March 29, 2022

Again, I think people are misreading, I was still continuing to work on it : just cancelling one possible avenue that involved me paying money out of pocket. I’m happy to be transparent as they like, if people that donated wanted an itemized receipt I really don’t care.

— Z (@Znullptr) March 28, 2022

Sony allows disclosure, tho all the ps5 stuff seems to to be … late, in being disclosed. So I don’t know what’s going on.
You’re also talking about something you don’t know about, I only have one bounty from Sony vs the playstation stuff I released. So *** talking basically

— Z (@Znullptr) March 28, 2022

Anyone around long learns: If you want both you need 2 machines.

9.00 was the closest to current fw ever, someone that had an active psn token could still get on psn with it.

Something Sony takes great care never happens.
We play along really, I won’t release anything psn.

— Z (@Znullptr) March 28, 2022

They tried to make it similar to xbox security, where there is a HV + virtualized app container. So even if you get a kernel exploit, you can’t immediately pirate the games. However, hypervisor locking up registers and other mitigations make it 100x harder to get there even

— Z (@Znullptr) March 28, 2022

No worries, your donation helped get to where we are. My promise? I said I’d work on an exploit, which I have and continue to do. As you see with the userland exploit and the work I’m doing now trying to get around hv page mappings. Or a ‘normal’ kernel exploit for now.

— Z (@Znullptr) March 28, 2022

Some of them aren’t new, annoy on purpose; think they can pester you into releasing something.

Also the point here is: I’m not going to spend both my time and money ; was going to drop a specific angle of exploit that required hardware for nvme and usb : fgpa … etc

— Z (@Znullptr) March 28, 2022

In case you’re interested to support ZNullPtr’s ongoing work, you can donate to him through the following means:

• Github Sponsor Page
• PayPal:lmiller47@hotmail.com
  
• Btc: 3BgHszsWVW2zDpKEmRPuJZbpu7T6usVvYw
• Eth: 0xA60c8f69bcEfB902F27586db4d2f67419D7ACb2A