This repository contains the ps5-linux-loader, a PS5 payload that exploits hypervisor vulnerabilities to boot Linux on PlayStation 5 consoles (firmware 3.00-7.61). The payload runs in kernel context, defeats the hypervisor using firmware-specific techniques (TMR relaxation, VMCB patching, ROP chains), loads a Linux kernel and initrd from USB storage, configures GPU/VRAM, disables IOMMU, and triggers a resume from rest mode to boot Linux in bare metal. The code is structured as a monolithic ELF binary with embedded shellcode components for kernel and hypervisor execution. It demonstrates sophisticated low-level system programming, including GPU DMA for physical memory access, IOMMU command submission, and custom page table manipulation. The project is actively maintained with support for multiple firmware versions and includes utilities for dumping device firmwares.
This repository contains a proof-of-concept exploit for CVE-2023-3269 (StackRot), a use-after-free vulnerability in the Linux kernel's maple tree implementation for managing virtual memory areas (VMAs). The exploit demonstrates privilege escalation from an unprivileged local user to root, and also container escape, targeting kernel version 6.1.25. It is verified to work in the Google kCTF VRP environment and is built and tested via GitHub CI using QEMU. The exploit is structured into three main components: node_master (orchestrator), node_free (triggers the UAF), and node_use (reads /proc/self/maps to leak addresses and control execution). It uses a deep directory tree to prolong VMA iteration, allowing the RCU grace period to expire and convert a use-after-free-by-RCU into a genuine use-after-free. Then it employs slab feng shui to gain control of freed maple nodes, leaks kernel addresses via /proc/self/maps, and executes a ROP chain to gain root privileges and escape containers. The code is well-crafted with a custom minimal libc (nolibc) and inline assembly for syscalls. The syscall wrappers and clone helper are cleanly implemented and could be reused in other kernel exploit projects. The repository includes a Makefile, CI configuration, and environment files (kernel image, initramfs) for easy reproduction.
Bloopair is a Wii U homebrew project that enables the use of third-party Bluetooth controllers (Nintendo Switch Pro/Joy-Con, Xbox One, DualShock 3/4, DualSense) on the console. It achieves this by patching the Wii U's IOS (the ARM-based operating system that handles Bluetooth) at runtime via a kernel exploit. The project consists of four main components: a loader that triggers the exploit and installs custom ARM code into IOS; an IOS kernel module that patches kernel error handlers and maps memory; an IOS pad module that intercepts Bluetooth HID reports, converts them to the Wii U Pro Controller format, and manages controller pairing and configuration; and a companion GUI application (Koopair) that allows users to test controllers, remap buttons and sticks, and manage per-controller settings. The system communicates between the PowerPC (PPC) application and the patched IOS via a custom IPC library (libbloopair). The architecture is modular: the loader is a one-shot exploit, the IOS modules are injected binary blobs, and the Koopair app is a standard SDL2-based homebrew application. The controller drivers are implemented as a set of function pointers (init, data, rumble, etc.) per controller type, providing a clean abstraction. The configuration system uses a linked list of entries with fallback logic, supporting per-controller-type and per-BDA settings. The project demonstrates significant reverse engineering of the Wii U's Bluetooth stack, including Wiimote cryptography, SDP, and HID report parsing. It is actively maintained with recent commits and CI builds, though it relies on hardcoded memory addresses specific to certain firmware versions, making it fragile but stable on the frozen Wii U platform.