6.72 固件新 Jailbreak 发布：增强 race condition 安全性（2025）

As a computer science student, I have picked Sleirsgoevy git, and read his code for 6.72 firmware, I have improved thread rate success by enhancing race condition security for this exploit, as the ip6_pktopts socket is freed, additional code could be needed to ensure correct thread allocation to the ROP chain to avoid heap corruption, which could lead to a kernel panic or unanticipated behaviors of the operating system of the console, by enabling correct CPU thread to the spray_map, this will ensure correct write_cr0 and elevated user privilege to enable load of external payloads.

I have tried for more than 2 weeks this new Jailbreak for 6.72 , and haven't had a single problem with it, this new Jailbreak is raw with the commentaries of the compiler, which can be easily removed with notepad++.

Excellent!

This is interesting, so you’re saying that 6.72 is now finally stable, after being proven to not be stable?

@xalfie will be pleased

I will check it, but in 100 times that you load sleir's kernel exploit, 'maybe' you will see one OOM. Maybe, because in 3 years I haven't seen any OOM. But of course, sleir's version is not complete, I mean, it require work on both exploits to achieve what I am saying, webkit part and kernel part.

I did forget to say about KP, because I said about OOM, because KP in 3 years, never got one... So if this is some kind of improvement will be welcome, like always, but I am curious to know and I wonder if others with 6.72 machine have some KP with that kernel exploit...

Last edited by xalfie, Jul 26, 2025

My very own Jailbreak host with latest GoldHen, single line with newer Jailbreak, I use my own ESP8266 to upload, but easily done with a local server

New JB 2025.zip
404 KB · Views: 75

My very own Jailbreak host with latest GoldHen, single line with newer Jailbreak, I use my own ESP8266 to upload, but easily done with a local server

Thank you very much — I’ll give it a try, even though 6.72 has actually been working quite well… and 5.05 also has its issues sometimes :-)

What I can recommend: if you don’t necessarily need the latest GoldHen version, it’s best to use GoldHen v2.3 (the stable version) for firmware 6.72.

Thanks again for your work!

Post automatically merged: Jul 28, 2025

I will check it, but in 100 times that you load sleir's kernel exploit, 'maybe' you will see one OOM. Maybe, because in 3 years I haven't seen any OOM. But of course, sleir's version is not complete, I mean, it require work on both exploits to achieve what I am saying, webkit part and kernel part.
I did forget to say about KP, because I said about OOM, because KP in 3 years, never got one... So if this is some kind of improvement will be welcome, like always, but I am curious to know and I wonder if others with 6.72 machine have some KP with that kernel exploit...

It always depends on what you’re doing with it...

If you're only using GoldHEN, the exploit is very stable. But as soon as you start messing around with other payloads, you do sometimes get kernel panics.

In my case, the FTP payload causes problems in particular — sometimes the console crashes as soon as I start uploading something to the PS4.

Post automatically merged: Jul 28, 2025

Last edited by mircoho, Jul 28, 2025

Me too gonna switch for GoldHEN 2.3, also ready somewhere a particular version was more stable with 6.72, didn't know it was 2.3

i have little testet and i think its realy better i dont have anymore crashes but i just setup my host normaly sometimes the console was crashing just on loading exploit ... this is now not happend

it would be nice if you can help me to make this better so he only loads one time the Jailbreak per session

https://ps4boot.github.io/672/index.html
https://github.com/ps4boot/ps4boot.github.io

Post automatically merged: Jul 28, 2025

Me too gonna switch for GoldHEN 2.3, also ready somewhere a particular version was more stable with 6.72, didn't know it was 2.3

the only missing part is the GAME Overlay
v2.3 only FPS
v2.4Betas , CPU, GPU, Vram ....

Unfortunately, GoldHEN is closed source, and I don't want to bother asking if the game overlay could be added to version 2.3...

Last edited by mircoho, Jul 28, 2025

But I read newer Goldhen which is now on beta version, is going to have an important feature, the infamous clock bug, which after your battery dies, or better known as CMOS, every time you boot the console you need to manually insert the date, as for FW 6.72 this happens and is happening with me, don't know if newer firmware keeps date on the system, but this newer setting really fixes that annoying time issue.

Yeah, if your CMOS battery is dead, you need the new version of GoldHEN.
I'm not sure if the new kernel clock payload can fix the issue as well.
But i think this only works if your PS4 is connected to the Internet . if not he set not the right time, i think just a Fake Date and Time, he's got to be getting the time from somewhere, right? but yes we will see next GoldHEN version release in next 4-6 Day`s.

but if it only added a Fake Date and Time ... is it not possible to do that with the exploit self?

In any case, the "real kernel clock" payload only works on lower firmware as 5.07.

Luckily, my CMOS battery is still holding up, so I haven't had the issue with the wrong system time yet.
only under Linux in the initramfs, but this is because we dont have a driver and no rights to read it SAMU.

here you can selected the GoldHEN Version i only set v2.3 as default and it does remember your last used Version.
https://github.com/ps4boot/ps4boot.github.io

but thanks it looks like the Exploit is realy more stable now :-) )

Last edited by mircoho, Jul 28, 2025

^the only solution for that is to refresh the kernel clock before it dies. The time lapse for that operation it is safe to be made each 7 years until the console owner get bored or forget to do it.
The kernel clock in 6.72 is a must have to avoid those problems.

my ps4 pro is 9 years old and still doesnt have this issue ... but is it possible to change the battery without losing the function??

my ps4 pro is 9 years old and still doesnt have this issue ... but is it possible to change the battery without losing the function??

If you ran wires from a secondary battery to the battery holder terminals or test points for them, so the voltage wasn't interrupted while you took out and replaced the main battery, it should keep working like nothing happened.

As a computer science student, I have picked Sleirsgoevy git, and read his code for 6.72 firmware, I have improved thread rate success by enhancing race condition security for this exploit, as the ip6_pktopts socket is freed, additional code could be needed to ensure correct thread allocation to the ROP chain to avoid heap corruption, which could lead to a kernel panic or unanticipated behaviors of the operating system of the console, by enabling correct CPU thread to the spray_map, this will ensure correct write_cr0 and elevated user privilege to enable load of external payloads.
I have tried for more than 2 weeks this new Jailbreak for 6.72 , and haven't had a single problem with it, this new Jailbreak is raw with the commentaries of the compiler, which can be easily removed with notepad++.

I did a lot of work on the PS4 today, and I have to quietly admit... the kernel exploit for firmware 6.72 is now better than for 5.05.
No idea what you did, but the FTP payload finally works properly now and doesn't act up like it did before.
In any case, thank you very much!

i was building my initramfs. so i restartet alot the PS4 and used FTP, normaly the ps4 was crashing ... but now not one crash thx

Last edited by mircoho, Jul 29, 2025

Only thing I added was thread security, I'm still on computer science, we have two subjects "operating system" and
"data structure" these two subjects teach about, threads, heaps, stacks, these are the cornerstone on which all computers work, since this is an attack to the IDT of the kernel and of the heap, just needs some extra protections, since the exploit is very well done by Sleirsgoevy.

Only thing I added was thread security, I'm still on computer science, we have two subjects "operating system" and
"data structure" these two subjects teach about, threads, heaps, stacks, these are the cornerstone on which all computers work, since this is an attack to the IDT of the kernel and of the heap, just needs some extra protections, since the exploit is very well done by Sleirsgoevy.

In the Linux Payload they change the write protection too
https://github.com/ps4boot/PS4-Linux-Loader/blob/6.72/source/main.c#L78C1-L80C30

Should it be reverted ?after the job is done?Or does it make no difference, as the console will be rebooted at some point anyway?

for the game overlay you can use Orbis Toolbox payload that brings the same.

In the Linux Payload they change the write protection too
https://github.com/ps4boot/PS4-Linux-Loader/blob/6.72/source/main.c#L78C1-L80C30
Should it be reverted ?after the job is done?Or does it make no difference, as the console will be rebooted at some point anyway?

That´s a complete different story, on payploads, you already have root access,and full access to the system, the hard part is already done, don´t need to revert since, on reboot the write protection is active again.

That´s a complete different story, on payploads, you already have root access,and full access to the system, the hard part is already done, don´t need to revert since, on reboot the write protection is active again.

Well, then I wonder why it's done again in the Linux Loader payload if the 'hard part' is already done ?? so technically, could or should I delete this line in the main.c

Well, maybe that depends on the specific firmware and which jailbreak you're using...

EDIT:
hope one day the ps4 will se a CFW ... so all are on the same firmware this multifirmware brings alot of work and issues ...

Last edited by mircoho, Jul 30, 2025

I have updated the jailbreak, I believe now this new version is extremely stable, as it checks the dangling pointer, the fake data structure and the IDT offset before attacking the heap memory, none of these can fail before going to the heap, would say is practically flawless.

https://github.com/viggen66/ps4jb2

Last edited by viggen66, Jul 31, 2025