Byepervisor: How We Broke The PS5 Hypervisor
summary
Claims a full hypervisor break on PS5 v2 (firmware ≤2.70) by combining a kernel read/write primitive with jump-table mirroring and ROP-style chains to hijack VMM call handlers, disable nested paging and clear execute-only bits, letting kernel text be written and read. A second, easier path abuses sleep-resume QA flag persistence to have the hypervisor rebuild nested page tables without XOM. Code, dumps and a working demo (homebrew loader, visible payload) are promised; needed offsets drop from ~27 to ~5.
AI-written summary · about
chapters (20)
- 0:00Introduction to PS5 security
- 1:27PS5 security model overview
- 4:40Current PS5 console hacking state
- 9:53User mutex vulnerability impact
- 10:38Hypervisor development timeline
- 11:20Hypervisor embedded in kernel flaw
- 12:47Mirroring technique for write access
- 13:29Hypervisor code execution challenges
- 14:11Register preservation across VM exits
- 15:13Jump table hijacking via VMM calls
- 16:16ROP chain setup for hypervisor control
- 18:23Thread-based ROP chain triggering
- 19:24Full hypervisor break demonstration
- 20:28Challenges of porting the exploit
- 20:48Debug flag bypass in nested page tables
- 21:52Sleep state boot path exploitation
- 24:18Live demo setup and execution
- 27:35Homebrew payload installation
- 28:56Conclusions and future research
- 31:25Acknowledgments and thanks
related talks
30mNext-Gen Exploitation: Exploring The PS5 Security Landscape
36mLost Control-Breaking Hardware-Assisted Kernel Control-Flow Integrity with Page-Oriented Programming
53mXenpwn: Breaking Paravirtualized Devices
48mNext Level Cheating and Leveling Up Mitigations
25mOne Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks...
49mBreaking Hardware-Enforced Security With Hypervisors
55mLessons Learned from Eight Years of Breaking Hypervisors
01h 03mret2dir: Deconstructing Kernel Isolation