PS4/PS5: BD-JB gets significant updates

PlayStation hacker TheFloW has brought some updates to the BD-JB hack. In particular, access to the Kernel API directly from within the BD-JB code, as well as code improvements which, according to the developer, makes most calls twice as fast.

What is BD-JB for PS4/PS5

The BD-JB exploit is a usermode exploit chain on the PS4/PS5 that allows unsigned code execution. On PS5, it was initially known to run up to Firmware 4.51 (included) only. But hacker TheFloW, behind the original release, has updated the exploit chain with a new path traversal flaw, which allowed to “revive” the exploit up to Firmware 7.61 included. Although this is only a usermode exploit (it needs to be coupled with a Kernel exploit for an actual console Jailbreak, such a kernel exploit is currently only publicly known up to Firmware 4.51), it allows some experimentation with the PS5 for tinkerers, and could potentially open the console for more if a kernel exploit is ever found for these higher firmwares.

Since BD-JB relies on vulnerabilities in the Blu-Ray layer of the PS5, it requires to burn BD Discs to run the code. A tool named JAR Loader makes it so that only one disc needs to be created (the one with JAR Loader), which will in return be able to load and run more payloads at runtime, sent via a TCP connection. Remote JAR Loader is now integrated in BD-JB itself, in recent iterations of BD-JB.

What’s new in BD-JB

The most significant changes brought in the past few days by TheFloW include this one which optimizes calls, and according to the developer, makes every call twice as fast. Depending on your use cases for BD-JB (and the tools you use that rely on BD-JB under the hood), this might be very interesting.

Additionally, the hacker has recently integrated Remote JAR Loader into BD-JB, meaning that it should now be “self contained” as a loading tool for further payloads (prior to that, you needed to burn it on disc with the JAR loader code added, so this simplifies that step)

Last but not least, TheFloW added support for the Kernel API (kread and kwrite). This would still require an accompanying kernel exploit to be used as far as I understand, but I’m guessing the API has been added within BD-JB for additional convenience to users of a Kernel exploit.

These changes are significant, in particular because TheFloW hadn’t updated BD-JB in almost two years. I am eager to see if this rekindled interest on his end leads to more commits or announces.