Miraros esta que he puesto antes:
https://www.reddit.com/r/PS5_Jailbreak/ ... ware_1410/Pongo resumen, pero está entero en el enlace, lo han puesto en reddit hace un rato, estaba un dev por ahí:
I'm ng643, one of the devs working on the public PS5-14.10-Research repo.
On 14.00/14.10 we have reliable userland code execution (a Lua loader over TCP). What we do not have is a kernel bug. Every wall we hit has been documented and closed one by one. The wall that usually matters most after a code exec is KASLR. Even with a working primitive, you will still need to know where the kernel is.
I'm happy to say that's no longer true. I found a way to defeat KASLR on this 14.10 (should work on 14.00). We can now recover on every boot where the kernel was placed this time, and how big it is (exactly 98 MB, 2 MB aligned).
This does not mean we have a jailbreak, not yet. Those pages answer "present" but a user mode load still faults, so we cannot read them. But it is one of the main walls down and now finding the kernel address is no longer the main problem. What we need now is a single kernel read primitive and when we get one we will know exactly what to point it at.
Questions welcome. I'll answer what I can