- Introduction
- GoldHEN Compatibility
- PS4HEN Compatability
- GUI custom options
- Windows GUI Download and Usage Instructions
- Linux GUI Download and Usage Instructions
- macOS GUI Download and Usage Instructions
- Troubleshooting
PPPwn-Tkinter-GUI was crafted with the goal of extending the functionality of the current PPPwn solutions. By altering the way in which the exploit is deployed and run, one can increase reliability of Scanning for corrupted object to nearly 100%. This is often console-dependent, but it's better to experiment than not.
This tool is open-source and provided as-is. Under the hood it utilizes new functionality added to PPPwn_cpp by nn9dev with the help of Borris_ta (and is also open source!) and additionally a Rust rewrite made by fedebuonco and the original version made by TheFlow
Please be sure to read the instructions carefully, and happy tinkering!
Furthermore, the pppwn_cpp additions can be integrated into other pppwn solutions (raspi, luckfox, etc.) with just a few extra command line arguments. Using this fork, grab the latest release and run pppwn --help to see the additional flags.
- The GUI allows for a custom background
- The empty background in the GUI can be swapped with one of your choice it has to be in the "imgs" folder and be in "png" format.
Current supported versions
8000
9.00 9.03 9.60 10.00 10.01 10.50 10.70 10.71 11.00
7.00 to 11.00 But Goldhen will be used where available
Although it has less features than goldhen PS4hen vtx is still good below are the differences
- Corrupt Num increases the is the amount of overflow packets sent to the PS4. Enter in hex OR decimal. (Default: 0x1 or 1) The reccomended HEX values are 0x1 0x2, 0x4, 0x6, 0x8, 0x10, 0x14, 0x20, 0x30, 0x40 but you are free to test and find out what works best for your console. Ocassionally values too high may cause console crashes work back down to something stable.
- No information about it untested if it helps but is available if you'd like to try. Enter in hex OR decimal. (Default: 0x1000 or 4096)
- When spray is higher the scan range is larger. Enter in hex OR decimal. (Default: 0x1000 or 4096)(pending better description)
The reccomended HEX values are 0x1000, 0x1050, 0x1100, 0x1150, 0x1200, 0x1250 but you are free to test and find out what works best for your console.
- During a quick initial test of the C++ additions by nn9dev i accidentally typed in decimal only values Spray Num 1100 and Corrupt Num 20 instead of HEX values 0x1100 and 0x20.
- This led to an extremely quick and highly successful result.
- if you'd like to try this start with Spray Num 1100 in decimal for Corrupt Num 2 in decimal and work around these values to see what works for you.
- This allows for a custom ipv6 to be used in the following format 4141:4141:4141:4141 or 1e1e:1e1e:1e1e:1e1e
- It has been added for people to Tinker with no strats are known beyond that changing it allows for the exploit to actually work on some consoles.
- Can be set to use the original ipv6 by TheFlow which is 4141:4141:4141:4141 in case the default by Borris-ta gives negative results.
- The fe80:: part of the address is handled internally.
- no wait for padi tickbox
- Network settings shortcut button
- CMD ipconfig button
- It is recommended to use C++ as the primary way of running the jailbreak.
- Download and install Npcap if running on older hardware try 1.70 and below.
- Download and install Npcap if running on older hardware try 1.70 and below.
- Download and install Npcap if running on older hardware try 1.70 and below.
- Download and install Python
Make sure to add it to path and install as admin
- Then run the following commands in a CMD window
python -m ensurepip --default-pip
pip install scapy
- Go to Releases download the latest Windows version and extract all the files to your folder of choice
- if Windows Defender flags the zip or any files allow them through.
This is because GUI tools house the the exploit which is known by security software https://hackerone.com/reports/2177925 - Turn on your PS4 and connect it to your PC via ethernet.
- Double-click on PPPwn Tinker.exe
From inside the Goldhen and VTX folder grab the goldhen.bin or payload.bin corresponding to your firmware version.
- Format a usb drive to exFAT
- Find the folder for your firmware and from inside of it copy the goldhen.bin file onto your usb drive for Goldhen
- Find the folder for your firmware and from inside of it copy the payload.bin file onto your usb drive For VTX
- Then plug the usb into your PS4
On your PS4
- Go to Settings and then Network
- Select Set Up Internet connection and choose Use a LAN Cable
- Choose Custom setup and choose PPPoE for IP Address Settings
- Put in anything as Username and Password it is recommended for it to be 1 letter that's the same in both fields for better compatibility.
- Choose Automatic for DNS Settings and MTU Settings
- Choose Do not use for Proxy Server
- Go back and be ready to press on Test internet connection
- Choose your ethernet interface
To find it you can look in
Settings>Network & Internet>Ethernet on the left menu>Then Click on the connection name scroll down and find the Description - Select the firmware version your PS4 is on
- Select C++ from Select PPPwn Version
- Usually not using the old IPV6 version is reccomended but if your console experienses crashes with no progress past Stage 2 type 4141:4141:4141:4141 in the custom ipv6 field.
- You can tweak the Num settings in all 3 fields based on the instructions above. Or leave them blank to use the defaults.
- You can press the Run PPPwn button and on your PS4 press on Test internet connection
- See Troubleshooting for help
- Choose your ethernet interface
To find it you can look in
Settings>Network & Internet>Ethernet on the left menu>Then Click on the connection name scroll down and find the Description - Select the firmware version your PS4 is on
- To select the Rust version click on the dropdown menu and choose Rust
- You can press the Run PPPwn button and on your PS4 press on Test internet connection
- The Rust version will receive further improvements when possible.
- See Troubleshooting for help
- Choose your ethernet interface
To find it you can look in
Settings>Network & Internet>Ethernet on the left menu>Then Click on the connection name scroll down and find the Description - Select the firmware version your PS4 is on
- To select the Python version click on the dropdown menu and choose Python
- Python does not have the option to change the ipv6.
- Python does not have support for tweaking the Num values left blank or with writing in it will not result in errors or additions to the command.
- You can press the Run PPPwn button and on your PS4 press on Test internet connection
- See Troubleshooting for help
- Python version is only available for sanity checks and in case of crazy situtations where Windows cannot run the C++ or Rust versions reliably.
- Python version can be easily edited notepad++ and etc.
- Scapy.
-
Go to Releases download the latest Linux version and extract all the files to your folder of choice
-
Turn on your PS4 and connect it to your PC via ethernet.
-
In the directory where the files have been extracted open a terminal and run
sudo chmod -R 777 .
- Then double-click on PPPwn Tinker.bin
From inside the Goldhen and VTX folder grab the goldhen.bin or payload.bin corresponding to your firmware version.
- Format a usb drive to exFAT
- Find the folder for your firmware and from inside of it copy the goldhen.bin file onto your usb drive for Goldhen
- Find the folder for your firmware and from inside of it copy the payload.bin file onto your usb drive For VTX
- Then plug the usb into your PS4
On your PS4
- Go to Settings and then Network
- Select Set Up Internet connection and choose Use a LAN Cable
- Choose Custom setup and choose PPPoE for IP Address Settings
- Put in anything as Username and Password it is recommended for it to be 1 letter that's the same in both fields for better compatibility.
- Choose Automatic for DNS Settings and MTU Settings
- Choose Do not use for Proxy Server
- Go back and be ready to press on Test internet connection
- Choose your ethernet interface usually starts with "en" or similair
- Select the firmware version your PS4 is on
- Select C++ from Select PPPwn Version
- Usually not using the old IPV6 version is reccomended but if your console experienses crashes with no progress past Stage 2 type 4141:4141:4141:4141 in the custom ipv6 field.
- You can tweak the Num settings in all 3 fields based on the instructions above. Or leave them blank to use the defaults.
- You can press the Run PPPwn button and on your PS4 press on Test internet connection
- A new terminal will open and ask for your password put it in and the jailbreak process will begin.
- See Troubleshooting for help
- Choose your ethernet interface usually starts with "en" or similair
- Select the firmware version your PS4 is on
- To select the Rust version click on the dropdown menu and choose Rust
- You can press the Run PPPwn button and on your PS4 press on Test internet connection
- A new terminal will open and ask for your password put it in and the jailbreak process will begin.
- The Rust version will receive further improvements when possible.
- See Troubleshooting for help
- Choose your ethernet interface usually starts with "en" or similair
- Select the firmware version your PS4 is on
- To select the Python version click on the dropdown menu and choose Python
- Python does not have the option to change the ipv6.
- Python does not have support for tweaking the Num values left blank or with writing in it will not result in errors or additions to the command.
- You can press the Run PPPwn button and on your PS4 press on Test internet connection
- A new terminal will open and ask for your password put it in and the jailbreak process will begin.
- See Troubleshooting for help
- Python version is only available for sanity checks and in case of crazy unheard of situtations where Linux cannot run the C++ or Rust versions reliably.
- Python version can be easily edited via notepad++ and etc.
- Go to Releases download the latest macOS version for your architechture Intel or Apple Silicon and extract all the files to your folder of choice
- Turn on your PS4 and connect it to your PC via ethernet.
- After downloading and unpacking the release for your architechture (Intel or Apple silicon)
- Open a terminal and cd to the location where you extracted the files.
- Run the following commands.
sudo chmod -R 777 .
- Right click on PPPwnTinker and choose open you will be prompted to confirm you want to run it choose Open
- The GUI will open along with a new terminal.
From inside the Goldhen and VTX folder grab the goldhen.bin or payload.bin corresponding to your firmware version.
- Format a usb drive to exFAT
- Find the folder for your firmware and from inside of it copy the goldhen.bin file onto your usb drive for Goldhen
- Find the folder for your firmware and from inside of it copy the payload.bin file onto your usb drive For VTX
- Then plug the usb into your PS4
On your PS4
- Go to Settings and then Network
- Select Set Up Internet connection and choose Use a LAN Cable
- Choose Custom setup and choose PPPoE for IP Address Settings
- Put in anything as Username and Password it is recommended for it to be 1 letter that's the same in both fields for better compatibility.
- Choose Automatic for DNS Settings and MTU Settings
- Choose Do not use for Proxy Server
- Go back and be ready to press on Test internet connection
- Choose your ethernet interface usually starts with "en" or similair
- Select the firmware version your PS4 is on
- Select C++ from Select PPPwn Version
- Usually not using the old IPV6 version is reccomended but if your console experienses crashes with no progress past Stage 2 type 4141:4141:4141:4141 in the custom ipv6 field.
- You can tweak the Num settings in all 3 fields based on the instructions above. Or leave them blank to use the defaults.
- You can press the Run PPPwn button and on your PS4 press on Test internet connection
- A new terminal will open and ask for your password put it in and the jailbreak process will begin.
- See Troubleshooting for help
- Choose your ethernet interface usually starts with "en" or similair
- Select the firmware version your PS4 is on
- To select the Rust version click on the dropdown menu and choose Rust
- You can press the Run PPPwn button and on your PS4 press on Test internet connection
- A new terminal will open and ask for your password put it in and the jailbreak process will begin.
- The Rust version will receive further improvements when possible.
- See Troubleshooting for help
- Python has been excluded from the GUI while on MacOS to keep it simple to run and the python version does not provide benefits justify the setup.
- For more detailed steps visit the Troubleshooting page
- If you get the PPPwned message but no goldhen reformat your usb drive or try another one.
- If the script gets stuck at [*] Waiting for interface to be ready... restart the exploit process
- If the script gets stuck at [+] Pinning to CPU XX...done restart the exploit process
- If the script is stuck on [+] Scanning for corrupted object...found fe80::0fdf:4141:4141:4141 [+] STAGE 2: KASLR defeat [*] Defeating KASLR... and your console crashes try changing to the old IPV6
- If the script is stuck on [*] Waiting for IPCP configure ACK... and your console crashes try changing to the old IPV6
- If the script gets stuck on any of the following
[] Sending LCP configure ACK...
[] Sending LCP configure request...
[] Waiting for LCP configure ACK...
[] Waiting for IPCP configure request...
[] Sending IPCP configure NAK...
[] Waiting for IPCP configure request...
[] Sending IPCP configure ACK...
[] Sending IPCP configure request...
[] Waiting for IPCP configure ACK...
[] Waiting for interface to be ready...
Restart the exploit process - If you are on a newly set-up machine you may need to install the latest .Net framework
- Any further problems you can open an Issue if you'd like or contact me on Twitter Dr.Yenyen
- Have python and npcap installed via the instructions above.
- install pyinstaller copy the pyinstaller exe to the same folder as the source code.
- CD into the folder via CMD and compile it using this command (optional "--icon imgs/icon.ico" after --onefile)
pyinstaller --onefile --noconsole --icon=imgs/icon.ico PPPwnTinker.py
- pyinstaller docs
- Unless changed the GUI then requires the following folders and files
- In the same folder as the compiled PPPwnTiker file create a folder called pppwn
- Bins Stage1 and Stage2 have to be in a folder path of firmware version followed by stage files example
- pppwn/bins/1100/stage1/stage1.bin (can be compiled from original POC by TheFlow linked below or can be downloaded elsewhere premade)
- pppwn/bins/1100/stage2/stage2.bin (has to be the premade from Goldhen or VTX)
- in the pppwn folder place the C++ version by nn9dev (depending on your system) the Rust rewrite by fedebuonco (depending on your system) and TheFlow python pppwn.py and offsets.py all linked below
- Download source code from https://github.com/DrYenyen/PPPwn-Tinker-GUI/blob/main/PPPwnTinker.py
- Python, pip and Nuitka are required.
python -m pip install --upgrade pip
pip install nuitka
nuitka --onefile --enable-plugin=tk-inter PPPwnTinker.py
- Unless changed the GUI then requires the following folders and files
- In the same folder as the compiled PPPwnTiker file create a folder called pppwn
- Bins Stage1 and Stage2 have to be in a folder path of firmware version followed by stage files example
- pppwn/bins/1100/stage1/stage1.bin (can be compiled from original POC by TheFlow linked below or can be downloaded elsewhere premade)
- pppwn/bins/1100/stage2/stage2.bin (has to be the premade from Goldhen or VTX)
- in the pppwn folder place the C++ version by nn9dev (depending on your system) the Rust rewrite by fedebuonco (depending on your system) and TheFlow python pppwn.py and offsets.py all linked below
- Download source code from https://github.com/DrYenyen/PPPwn-Tinker-GUI/blob/main/PPPwnTinker.py
- Python, pip and pyinstaller are required.
python -m pip install --upgrade pip
pip install pyinstaller
pyinstaller --onefile --target-arch=universal2 PPPwnTinker.py
- Unless changed the GUI then requires the following folders and files
- In the same folder as the compiled PPPwnTiker file create a folder called pppwn
- Bins Stage1 and Stage2 have to be in a folder path of firmware version followed by stage files example
- pppwn/bins/1100/stage1/stage1.bin (can be compiled from original POC by TheFlow linked below or can be downloaded elsewhere premade)
- pppwn/bins/1100/stage2/stage2.bin (has to be the premade from Goldhen or VTX)
- in the pppwn folder place the C++ version by nn9dev (depending on your system) the Rust rewrite by fedebuonco (depending on your system) and TheFlow python pppwn.py and offsets.py all linked below
TheOfficialFloW for PPPwn
xfangfang for C++ rewrite
nn9dev for the C++ changes
fedebuonco for Rust Rewrite
EchoStretch for VTX hen
Sistro for GoldHEN
Borris-ta for his help
All the people in the scene :)
Thank you to Beta testers of the GUI Sausig, Rust, and nn9dev.