Let's see if we can develop a jailbreak for 11.00 based on TheFloW disclosed exploit

[ultimaweapon]

Not sure if someone already started working on this. Here: https://twitter.com/theflow0/status/1783620012994945437

[ultimaweapon]

My test subject:

[ultimaweapon]

The offset of sppp_ipcp_RCR function on 9.0 is 0x328A30.

[ultimaweapon]

Found the location to cause heap buffer overwrite with bcopy. The first step is I'll try to crash the PS4 with this bug to see if it work on 10.50.

[ultimaweapon]

No, what I need to do first should be build a PPPoE server that is able to craft this malicious header.

[SoffiMeower]

@ultimaweapon If you get it working, then I guess I'll upgrade to 11.00 :P

[SoffiMeower]

Pspspspsps. @ultimaweapon

https://github.com/TheOfficialFloW/PPPwn

[ultimaweapon]

Thanks!

[ultimaweapon]

Seems like this is very reliable. I just managed to success in a single run without any crashes.

[SoffiMeower]

To be fair, FloW is the one who discovered the exploit, told Sony so they could patch for later FW for legal reasons, then announced the exploit publicly just a week ago xD