PS4/PS5 exploit that is “essentially unpatchable” | Hacker News Reader

PS4/PS5 exploit that is “essentially unpatchable”

arstechnica.com

123 pointstosh48 comments

A bit of a stretch to call it “unpatchable”. The end of the article concedes it’s more that Sony doesn’t seem interested in patching it, presumably they don’t think it’s a sufficient threat (I tend to agree).

Yes, the PS2 emulator is bundled with the game but given most are digital downloads, it’s trivial to patch those. If Sony wanted, they could push firmware updates to block the few disc games from running without downloading the latest patched version.

So yes, it’s unpatchable if by that you mean there’s no way for Sony to force their way into your home and patch it if you’re willing to live with a console disconnected from PSN. Enjoy running that N64 emulator on your now mostly useless PS5 - I guess.

> Enjoy running that N64 emulator on your now mostly useless PS5 - I guess

Give it time. This stuff always gets better. The og Xbox hacked was great and I've heard good things about the Wii.

> if you’re willing to live with a console disconnected from PSN. Enjoy running that N64 emulator on your now mostly useless PS5

I wait for prices to go down to sane levels before buying consoles and games, so I don't have a PS4 yet. However, offline is how I run all my consoles.

Just double checked, and physical media is still a thing on the PS4. What do you mean "useless"? As in the games need patching before being playable, or is it just the online features you deem essential?

No patches, no online features, no digital-only games.

As a side note, they stopped manufacturing the PS4, the price is unlikely to go down much further at this point.

I have notice that the price is usually the lowest when a console is two generations behind. After that there is a bit of resurgence from nostalgia collecting.

Thanks, that's good to know. Probably off to buy one soon then ;)

The online features can go jump off a bridge. I play games to get _away_ from people. If the patches are required to play the game, I think I'll skip post-PS3 consoles. Though that makes me wonder if I'd have a good law-suit for the publishers, since they'd be selling something that's not fit for purpose.

Physical PS4 discs can contain firmware updates the must be installed before the game can be played (unless the OS version is newer). But as a practical matter, playing modern games without getting any updates can be a real coinflip of quality.

I love that we can get day one patches that make games better, but it’s infuriating when games like Call of Duty are sold physically with a disc that’s essentially empty and they just tell you to go download the game. I don’t think it’s actually possible to play the newest COD without an internet connection for that initial download.

I’m trying to get rid of my ps4. If you live in the bay area let me know.

I only recently got a PS4 Pro 1TB. New in box and last production run. Its the most bare bone version. If you don't want second hand unit you probably need to be quick. Prices are probably only going to go up for PS4s from now on.

I think there might be a use case for these jailbreaks that doesn’t have to do with games (and online updates) though. Scientific computing was a huge thing for PS3, though not sure if the price/performance is still there for the newer PSs, especially with limited availability.

Probably wouldn’t be as useful to run compute tasks on a PS5. It mostly uses off the shelf hardware so I can’t imagine it’s better than just buying say the latest AMD Ryzen or Nvidia GPU.

With the PS3, particularly the CPU, it was quite ahead of consumer CPUs at the time at least for some compute tasks. But that was an entirely custom design, console manufactures have gotten away from that ever since.

Yes the author says specifically that it's a stretch to call it unpatchable.

Everything you just said is all covered fully in the article.

The title seems like clickbait from the article.

It’s a partial exploit of the PS2 emulator inside a PS4 game that may not be patchable without removing those titles, that can lead to partial exploitation of the PS4 emulation to run other PS4 games. It does not exploit the PS5 hypervisor, so at its best allows running homebrew inside the PS4 emulator unless someone has another exploit that would lead to arbitrary execution on the PS5 - but if that was the case then this would likely be moot anyway.

Flashing back to the way Sony handled the PS3 OtherOS exploits, I think its likely if they can't fix an issue with the PS2 emulation, they'll remove/block the feature. I won't be surprised if the ability to emulate PS2 games is removed citing 'security concerns'.

I wouldn't be surprised if there's an update that removes PS2 emulation very soon. Small blast radius anyway as it's unlikely there are many users who use this functionality.

It would also be a pretty open-and-shut case of false advertising.

I play some PS2 games on PS4. There's one game in particular that I really like: Ace Combat 5. If I get an update and my PS4 becomes unable to play this game, I will never purchase anything from them ever again.

It’s not arbitrary PS2 emulation. They have a PS2 emulator that they customize and bundle with classic PS2 games. Some of those games have been published physically and will have an unpatched emulator on disc.

The PS4/5 don’t have PS2 emulators as part of their OS like some versions of the PS3 did.

Edit to clarify: you can’t put in a PS2 disc into a PS4/5 and play it. You purchase a PS4/5 release of some previously PS2 era game that comes with an emulator.

Thank you for clarifying, I guess that would mean there's nothing to patch.

The patch is to block playing those physical discs without an emulator update via PSN

Some versions of the PS3 had PS2 hardware inside, that's how they were able to play PS2 games.

And some had partial hardware and partial software emulation.

> a specially formatted save file on the memory card, leading to a buffer overflow that gives access to otherwise protected memory

> ... Then CTurt used the system's USB save import feature to get that file onto the target system.

> ... one of the few PS2 games released as physical, PS4-compatible discs

As the number of such games is limited, it would be trivial to implement a save-file validation parser in the USB save import feature for these games and push it as a mandatory update. For digitally delivered titles, then you can patch the emulator. (EDIT: unless, the save file contains executable code. Seen it before, done as an obfuscation technique. Next point still apllies, though)

Also,

> had to use an already-hacked PS4 to digitally sign a modified Okage Shadow King save file, letting it work with his PSN ID.

For that, change the workflow so that at each SW update you generate a new certificate. Upon releasing a new FW version, revoke all previous certificates.

For the benefit of those who prudently read HN comments first so as not to fall for clickbait, here is what "unpatchable" means:

> that means the exploit should continue to work as long as you refuse any online updates before playing. And for digital releases, even if the exploit is later patched out, there are methods to downgrade to a stored, exploitable version using proxy HTTP traffic from a local server.

Good. It'll reduce the e-waste when Sony abandons these consoles.

“essentially unfixable”? Ars are essentially liars.

"essentially unfixable" or "essentially unpatchable" feel right in the sense that you can't block it for good without removing the PS2 emulator's ability to JIT arbitrary code. But you can just remove the emulator, which is a solution for the fact that you can't really "patch" or "fix" the hole since it's a design hole.

For most developers removing it would not be an acceptable fix or patch, but Sony has historically been happy to shoot products in the head even after people paid for them, so it's probably not off-limits here.

They could also just patch the ps2 game embedded in the emulator. Just like they’d presumably do if they found an exploitable bug in a native PS4/PS5 game.

"Just" always does a lot of work, but "just" is doing a hell of a lot of work in this case. Who's doing the work to create the patch? Who's paying for the work? Who's doing QA, and who's paying for that? What makes you think the source code and assets even exist for all exploitable games, let alone that all can be rebuilt, let alone that all can be meaningfully retested?

For what it's worth, adding a bounds check could be reasonably added to the compiled binary directly. Even if it can't be rebuilt from source.

It is nonetheless doable. A bit expensive but not much moreso than any other game-specific intervention. To call it unpatchable is quite hyperbolic.

You don’t need source to patch bugs like this lol, this is trivial to achieve by editing the binary. The same arguments would work against fixing a bug in literally any game on the platform, yet it seems to be frequently done.

Previously: https://news.ycombinator.com/item?id=32855476

why don’t they just let me install linux on my ps4. what’s the danger here take to their business?

piracy.

my best guess is that they don't make enough profit on the console and expect to sell games

I see this as a good excuse to no longer be backwards compatible by Sony.

Yeah, I was gonna say … Sony was willing to sell PS3 on the promise you could run Linux on it, then take that capability away after the fact, so why would they not be willing to kill backward compatibility just as readily? Not "unpatchable" at all if Sony's willing to take that path.

There are much, much, much easier ways to patch this.

True, but Sony may be looking for an excuse to no longer support older consoles and this could be that excuse.

To be a fly on the wall at Geohotz's office right now..

"a proof-of-concept method that should allow for the installation of arbitrary homebrew applications on the consoles."

Good. That should be allowed anyway.

The JIT emulator for PS2 sounds fascinating - are there many public details about it?

Does anyone else remember that magical moment when you could physically insert a Gameshark[0] into the back of the Playstation and achieve basically the same thing?

It used to be a literal, physical device, similar to the technology used by Sonic & Knuckles[0].

I remember someone explained to me, after the family PC got infected with some malware that folks get MUCH angrier if you're messing around in a networked game like Starcraft than something offline like... Pokemon.

This was back when they were transitioning to CD-ROMs to distribute the games, and IMHO understandably afraid they'd spend R&D money on things like which controller designs work best, then go pirate all the games.

Anyways, I suspect of years of treating minors abusively is catching up with the world, as you see things like this exploit, Solarwinds[2], the Texas grid failure[2]... these are all separate "cyber" issues connected by a common thread: the United States has some that have a state income tax, and some that don't, and people can move freely between them.

Like... seriously... did people not plan for a future when people sigh, pretend not to understand your weird Myspace drama, and pay for a quad espresso in cash so they can go do whatever they want on the wifi?

I've seen so many people say that X shouldn't be done because something could be a server for a hospital, or an airport or something.

But I don't think any hospitals are running the FTP server to upload crime scene photos on a Playstation.

Maybe for Devil's night someone should brick every single one of them to cut down on the amount of bored teenagers running around with... command line skills.

(Sorry to ramble, I'm doing what I started sarcastically referring to as my "executive time" during the Trump administration -- if the signal is sometimes useful you can't complain it's also sometimes weird as hell.)

- Greg.

-- [0] https://en.wikipedia.org/wiki/GameShark [1] https://en.wikipedia.org/wiki/Sonic_%26_Knuckles#Lock-on_tec... [2] https://www.npr.org/2021/02/17/968577281/what-went-wrong-wit...

You gotta clarify on some of the connections you're making. They're the kind of connections that people usually soft-lobotomize themselves into not making

> (Sorry to ramble, I'm doing what I started sarcastically referring to as my "executive time" during the Trump administration -- if the signal is sometimes useful you can't complain it's also sometimes weird as hell.)

"Executive time", a/k/a fuck off time, is perhaps one of the few great things Trump gave us. I'm legitimately not kidding. More people need to engage in fuck off time on a regular basis. It is refreshing for the mind.

That's what I like to hear, for you, shit company Sony.

Reply on news.ycombinator.com