[PS4] CTurt décrit la procédure pour lancer Linux

To create your own Linux distro, you'll need to compile fail0verflow's fork of the Linux kernel, and then create your own initramfs.

 

The easiest way to get these files into RAM is to copy them to a USB flash drive formatted as FAT32, which can then be read from once you've broken out of sandbox as explained earlier (/mnt/usb0/). You could also download them over the network if you prefer.

 

You'll also need to compile the ps4-kexec system call implementation as a relocatable binary and include it in your kernel exploit.

 

For your kernel payload you should copy the system call somewhere into kernel address space (like DT_HASH_SEGMENT), and run kexec_init to install it (which is guaranteed to be at offset 0 from the binary):

 

void *DT_HASH_SEGMENT = (void *)0xffffffff82200160;

memcpy(DT_HASH_SEGMENT, kexec, kexecSize);

 

void (*kexec_init)(void *, void *) = DT_HASH_SEGMENT;

kexec_init(NULL, NULL);

Once you return to userland, you can load the kernel and initramfs from USB, pass them to kexec, and finally reboot!

 

FILE *fkernel = fopen("/mnt/usb0/bzImage", "r");

...

 

FILE *finitramfs = fopen("/mnt/usb0/initramfs.cpio.gz", "r");

...

 

char *cmdLine = "panic=0 clocksource=tsc radeon.dpm=0 console=tty0 console=ttyS0,115200n8 "

"console=uart8250,mmio32,0xd0340000 video=HDMI-A-1:1920x1080-24@60 "

"consoleblank=0 net.ifnames=0 drm.debug=0";

 

syscall(153, kernel, kernelSize, initramfs, initramfsSize, cmdLine);

 

free(kernel);

free(initramfs);

 

// Reboot

int evf = syscall(540, "SceSysCoreReboot");

syscall(546, evf, 0x4000, 0);

syscall(541, evf);

syscall(37, 1, 30);