S3E331 — PS5 Relapse Exploit

GARY: ...okay, network settings, primary DNS, and I'm putting in four-five-five dot five-six dot...

GARY: Dot sixty-eight dot... eighty-five? No. Sixty-seven. It's sixty-seven eighty-five. Why do I know that. Why is that the number in my head.

MAEVE: Maeve. General partner.

OBI: Obi. Infrastructure.

GRUNER: Gruner. Field researcher.

GARY: Guys, I'm doing something. I'm doing a thing right now.

MAEVE: You are setting your home router's DNS to the address from the PS5 jailbreak readme.

OBI: The readme says set the primary DNS on the PlayStation. In the PlayStation's network settings. On the console.

GARY: Right, but my router is also a network settings place.

OBI: Gary. The exploit needs the console to resolve its update checks through a server that serves it the payload instead. Your router resolving your laptop's traffic through it does nothing, because your laptop is not a PlayStation, and also your router is now pointing at a stranger's box for no reason.

GARY: Which is a kind of experiment.

MAEVE: It's not a kind of experiment. You've misconfigured your own wifi to participate in a jailbreak for a device you don't own, in a room where the device isn't present.

GARY: Okay, so walk me through what I've actually done, because I feel like I've done something.

GRUNER: You have bricked nothing. Is small shame.

GARY: Thank you, Gruner.

GRUNER: Is also small achievement. Both is true.

GARY: So the number's real, the number's right, I just put it in the wrong machine.

MAEVE: The number is right and the machine is wrong. That's the most you sentence I've ever heard.

GARY: It's a good number! Forty-five fifty-six sixty-seven eighty-five. It scans. It has rhythm. Someone should found a company on a number like that.

OBI: Someone did. It's a DNS server for a console exploit. It has a readme and a disclaimer and more users than Cadence ever had.

GARY: Low blow. Uncalled. My router is fine, by the way. Mostly fine. It's resolving.

MAEVE: Resolving what?

GARY: ...Nothing, currently.

OBI: It's resolving nothing, currently. Write that on the door of the whole industry.

GRUNER: Field note. Host mistake DNS for destiny. Recurring.

GARY: It's one time.

GRUNER: Is recurring.

GARY: Okay. New plan. Somebody tell me what this thread is actually about before I put this number anywhere else.

GARY: Okay. Somebody read me the actual thing before I embarrass myself further.

MAEVE: It's a GitHub readme. One thousand three hundred and thirty-two characters. That's the entire artifact. Sony shipped a five-hundred-dollar black monolith and a teenager opened it with a paragraph.

GARY: That's — okay, that's beautiful. That's the kind of leverage I spent forty million dollars failing to find.

OBI: You spent forty million dollars failing to find a supply chain for aluminum. Different paragraph entirely.

GARY: Supported firmware seven through thirteen point six zero. So it covers — what, most of the consoles out there?

MAEVE: Most of the fleet. Every console that hasn't been forced to update. Which is a customer base Sony spent years acquiring, and this kid just published the front door code to all of it, for free, in a readme shorter than their terms of service.

GARY: And the setup is — you set your primary DNS, right, which is the part I already did, to forty-five fifty-six sixty-seven eighty-five, and then you run a little python server, or you just open his hosted page on the console itself, and the payloads land on an ELF loader listening on port nine-oh-two-one.

OBI: That part you got right, which is upsetting.

GARY: Thank you.

OBI: It shouldn't be a compliment. It means the only thing you understood is the part that involves typing numbers.

GARY: And the chain itself is — the browser stage, it uses JSC, which is the game engine, right, the one that runs the games —

OBI: No.

GARY: — the JavaScript engine?

OBI: JavaScriptCore. The browser's JavaScript engine. Not a game engine. The exploit doesn't touch your games. It walks in through the web browser Sony ships on the console, uses two information leaks in that engine plus a structured clone object pool mismatch to corrupt a typedarray, and then a second stage in the kernel — an address leak chained with a use-after-free race in aio_multi_wait — to get kernel read-write. Two known bug classes. No magic. Just patience.

GARY: So it's not even clever. It's just... thorough.

OBI: It is exactly as clever as it needs to be, which is the cleverest thing anything ever is.

MAEVE: And note what it isn't. It's not a magic wand. The readme literally tells you the browser stage may need several attempts, reload the page if it stalls, and the kernel exploit may hang or panic the console, so reboot and try again. This is a jailbreak with a known failure rate, published with the emotional tone of an appliance manual.

GRUNER: Field note. Credits list has fourteen names. ntfargo, ufm42, Sonic_Iso, Jordy, Doctor Yenyen, TheFlow, SlidyBat, Flatz, cow, nhk, bollarz, Sleirsgoevy — is pronounce "Sleer-guh-SWOH-vy" — EchoStretch, EarthOnion.

MAEVE: It is not pronounced that.

GRUNER: Is pronounced in my mouth that way.

GARY: Fourteen people. Fourteen people's names on a thing a stranger gave away for free. I can't get four people to stay on a cap table through a bridge round.

OBI: They didn't stay because of a cap table. They stayed because someone said "here is a bug, who else has one" and everyone did.

GARY: Okay, and then the disclaimer. "This project is intended for educational and security research purposes only. It does not endorse piracy, unauthorized access, or misuse of commercial devices. Use it only on devices you own."

MAEVE: I've read a lot of cover-your-arse language in my career. That is cover-your-arse language. That is a man building a crowbar and stapling a note to it that says this crowbar does not endorse doors.

GARY: Or he means it. Genuinely. Security research is a real discipline. People publish this stuff so it gets fixed.

MAEVE: He put a working kernel exploit on the open internet with a one-click hosted page. The "education" is that you can now run whatever you want on a console. The disclaimer is a legal fig leaf, and it's a small one.

GARY: It's not a fig leaf, it's a — it's an honest statement of intent. Some people build things and don't want to be pirates about it.

OBI: The disclaimer is doing exactly one job, Gary, and the job is not education. The job is standing between a nineteen-year-old and a letter from Sony's legal department. It is a firewall made of sentences. And it's a good one. I respect it more than most term sheets I've read.

MAEVE: So we're split. Gruner?

GRUNER: Field note. Humans build weapon, then apologize to weapon. Weapon does not care.

GARY: The weapon is a readme.

GRUNER: Then readme does not care.

GARY: Okay, but here's what I actually care about. Say you run this. Say you've got kernel access. You know what you do next?

OBI: Enlighten us.

GARY: You install Linux. Actual Linux. On a PS5. That's the dream, right? That's the whole dream. A little box under your TV that's a real computer. Navy guys used to cluster PS3s and break SSL with them. There's precedent. There's a whole Wikipedia page.

OBI: There is a whole Wikipedia page. There is also a comment section. Listen. Hexagonsun, quote: "this is a kernel level exploit and afaik ps5 linux requires full hypervisor... so not yet, but probably soon." That is the entire answer, Gary. Kernel is not hypervisor.

GARY: Right, but "probably soon" — he said probably soon.

OBI: He said probably soon the way your investors said Series B soon. And ndiddy, quote: "This is a different exploit. This one is a kernel exploit... A kernel exploit lets you pirate games but running Linux requires a hypervisor exploit." Pirate games. Not run Linux. Those are different sentences.

GARY: They're adjacent sentences.

OBI: They are different sentences with a wall between them, and the wall is a hypervisor nobody has cracked and nobody has released.

GARY: Okay, but hypothetically, if I had one, I'd put Linux on it and I'd run — okay, hear me out — I'd run a little home server off it. Media server. Maybe a side project. Maybe something with users. Maybe something that finally —

OBI: Gary. You would jailbreak a games console to ship a startup out of it. That is not a dream, that is a relapse with extra steps. You have failed at this on hardware that was actually yours.

GARY: It would be a fresh start! Clean silicon! No history!

OBI: The silicon doesn't know you, Gary. That's the most generous thing anyone will ever say about your track record.

GARY: The PS3 cluster broke SSL! Two hundred PS3s! That's real, that's documented, that's —

OBI: Two hundred PS3s in 2008. You are citing a seventeen-year-old supercomputer as evidence your media server will work. That is not a precedent, that is a museum.

GARY: Muncie would have worked on a PS5.

OBI: Nothing would have worked on Muncie.

GARY: Fine. Fine. So it's kernel only. Piracy plumbing. Not the dream. Great. Wonderful. I've adjusted my worldview in real time on a podcast and I hate it here.

MAEVE: Growth.

GRUNER: Field note. Man wants computer. Buys toy. Complains toy is toy.

GARY: It's a fair note.

OBI: It's a devastating note.

OBI: Enough about Gary's imaginary datacenter. There's a pattern in this thread worth the airtime. Three people, top-level comments, no replies to each other, no coordination. Watch.

OBI: Handle, then quote. Jiveturkey: "they aren't in the business of selling consoles (duh). they are in the business of selling games. jailbroken consoles can run pirated games ...consoles are sold at a loss, best information i can dig up is that this is still true today, even after all the volume."

OBI: avgDev: "Sony is barely making money on PS5 hardware."

OBI: Narishma: "Because they don't make money from the hardware. If you don't buy games for it, there's no point in selling you a console, from their perspective."

GARY: Three.

MAEVE: Three independent handles.

OBI: Three. Counted out loud, for the listeners at home: jiveturkey, avgDev, Narishma. None of them replied to each other. Same point, three times, unprompted.

GRUNER: Chorus. Like frogs. Same pond, same night.

GARY: It's a good point though. It's a really good point. Sony loses money on every box, so the box is basically a — it's a loss leader, it's a —

MAEVE: Well, obviously. The hardware is a customer-acquisition cost. You're not buying a console, you're being acquired. The margin lives entirely in the software, which is why a jailbroken unit isn't a stolen product, it's a customer who will never convert.

OBI: Four.

MAEVE: I'm sorry?

OBI: Four. That's four independent handles now. You just made the same point jiveturkey made, word for word, in your own dialect, and you did not notice.

MAEVE: I noticed. I was corroborating.

OBI: You were being counted.

GARY: She's the fourth frog.

GRUNER: Field note. VC hears truth. Believes she invented it. Files as thesis.

MAEVE: It's not the same point. Jiveturkey was describing a business model. I was describing a market structure. One is accounting, one is strategy.

OBI: One is a comment with two hundred upvotes and one is you, agreeing with it, slower.

MAEVE: Fine. Then let's say what the three of them are actually saying, because it's uglier than "Sony loses money on boxes." If the hardware is sold below cost, then the transaction was never a sale. It's a down payment on a games library you're contractually expected to buy. Which means the thing in your living room was never fully yours to break. You didn't buy a computer. You bought a slot in someone else's revenue line.

GARY: That's — huh. That's actually kind of dark.

MAEVE: It's not dark, it's unit economics. The console is the only product in your house where the manufacturer is rooting for you to spend more money after the purchase than before it. Everything else, the car, the fridge, the laptop — they got paid at the door. This one, you walk in the door and the meter starts.

GARY: So when we jailbreak it —

OBI: There is no "we," but continue.

GARY: When someone jailbreaks it, they're not stealing a game. They're skipping out on the rest of the tab. The box was the tab.

MAEVE: Now he's got it.

GARY: I had it first. I said "loss leader" like forty seconds ago.

OBI: You said it and then Maeve said it better, which is the story of your entire — no, actually, I'm not even going to finish that. The point stands. Three commenters and a VC. Nobody makes money on the metal. The metal is bait.

GRUNER: Field note. Bait works. Frogs agree.

GARY: Okay. Okay, there's a — there's a subplot here that I genuinely cannot get over, and I need someone to tell me it's real.

MAEVE: It's real, and it's better than the exploit.

OBI: Quote it. Alias_neo, top of the branch. Handle first.

MAEVE: Alias_neo: "Unfortunately the goal here wasn't to get the bounty, it was to keep it out of the hands of Sony who'll patch it. The issue, as I understood it in this case was that he wanted it kept quiet until GTA6 launches, because announcing it to the public also announces it to Sony, and they'll patch it."

GARY: He was — wait. Someone had a bug that could jailbreak the PS5, and they just... sat on it?

MAEVE: Sat on it for years. On purpose. So that everyone could get "that one last update that allows GTA6 to run before they're stuck on that version." His words.

OBI: And then a newcomer found the same bug, posted it publicly — MBCook describes it. Handle first.

MAEVE: MBCook: "The JoeClaudeUser posts publicly 'Hey everyone I found bug X over here! I'm awesome!' Now it can't be used because Sony will fix it. If they had already been using it behind closed doors all that work is flushed."

GARY: The little shit. The little — no, wait, the poor little shit. He found a real bug. He was proud of it.

OBI: He was proud of it in the one place on earth where pride is a security incident.

MAEVE: And ndiddy closes the casket. Ndiddy: "Sony significantly improved the PS5's security on firmware 14.0 and above, likely to prevent GTA 6 from getting pirated." Patched. Gone. Years of somebody's leverage, burned in one enthusiastic afternoon.

GARY: That's — fuck. That's a guy who spent years building a vault and some kid walked in and left the door open while bragging.

MAEVE: It's older than vaults, Gary. This is guild secrecy. The medieval guilds hoarded technique for exactly this reason — the moment the secret leaves the workshop, the workshop is worth nothing. It's the same architecture. Actually, it's the Zanzibar clove monopoly.

OBI: Here it comes.

MAEVE: Nineteenth century. Zanzibar controlled the global clove supply, and the islanders were forbidden — by the Sultan, by custom, by the entire structure — from letting seedlings leave the island. The value wasn't the cloves. The value was that nobody else had cloves. The hoarder is Zanzibar. The newcomer is a Dutch merchant with a pocketful of seedlings and no idea what he's carrying. The whole modern exploit economy is just the clove trade with better latency, and Sony is the —

GARY: Sony is the Sultan of —

MAEVE: Sony is the Sultan of Zanzibar, Gary, keep up — and firmware 14.0 is the moment the British navy showed up and forced the clove monopoly open, which collapsed the price by something like ninety percent in a decade and turned Zanzibar from the spice capital of the Indian Ocean into a footnote that smells nice, and if you map that onto console security you get the entire future of —

GARY: ...what?

GARY: — I was just asking what the footnote smells like, I wasn't attacking you.

MAEVE: Cloves. It smells like cloves. It's a clove island.

OBI: It's not a clove island anymore, that was her entire point, allegedly.

MAEVE: My point is airtight.

OBI: Your point is that a guy on the internet sat on a hypervisor bug and a Dutch merchant in 1872 is responsible for GTA6 not getting pirated.

MAEVE: I said what I said.

GRUNER: Field note. Clove farmer sits on seedling, ten year. New farmer posts seedling to public forum. Island gone. Humans do this every time. Is almost touching.

GARY: It IS touching. That's what nobody — okay, think about this guy. Whoever he is. He had one bug. One. It was his whole hand, and he was holding it — not to sell it, not for a bounty, to give everyone a window. One last update where the console still works and GTA6 still runs on it. That's the most —

MAEVE: Romantic. It's genuinely romantic, and it's dead.

GARY: And nobody will even know his —

OBI: We don't know who he is and we're not going to find out. The thread treats it as rumor and we treat it as rumor. That's the discipline.

GARY: Right. Right. It's just — you spend years keeping something quiet so it can do one good thing at exactly the right moment, and then some kid with a chatbot blurts it out in public, and the moment's just... gone. Forever. The timing was the whole thing. The timing was everything he had.

GARY: Forty-five dot fifty-six dot sixty-seven dot eighty-five.

MAEVE: What?

GARY: The DNS. From the readme. Forty-five, fifty-six, sixty-seven, eighty-five. I finally — I got it right. It doesn't matter now.

OBI: It never mattered, Gary. It was never your router.

GARY: I know that.

OBI: Do you.

GRUNER: Field note. Man memorizes number. Number already dead. Very efficient. Very sad.

OBI: Next one. This is the last handle I'm reading tonight.

MAEVE: It's a long one.

OBI: It's a father. Handle is publlus_enigma. Quote: "Being somewhat naive to the gaming scene, I only recently discovered that the PS5 prevents you from backing up your game saves to your own physical media — something that was possible on the PS1, PS2, PS3 and PS4. Instead, you have to subscribe to PS Plus and enable cloud backups — and you need a separate subscription per user profile."

GRUNER: Publlus_enigma.

OBI: Quote: "I only discovered this after my daughter lost a year of work in Minecraft due to data corruption, and I tried to teach her the value of backing up. The PS5 may be my last console."

GARY: That's a kid. A year of building something with her dad watching, and the machine just ate it, and then the machine asked for a subscription to prevent it happening again. That's — someone should have just let him back it up. That's all it would have taken.

MAEVE: The per-profile subscription is the part I can't get over. They metered it by child.

GARY: I said that.

MAEVE: You said something adjacent.

GRUNER: Field note. Console defends itself better than company defends customer. Is not irony. Is product.

OBI: It's a good note.

GRUNER: Is not finished.

OBI: It's finished.

MAEVE: Okay. Someone in this thread built a Switch emulator that runs on the PS5, which is the most embarrassing sentence in gaming, and I refuse to leave this episode without saying it out loud.

OBI: ProsperoEden. Port of Eden. It already runs some games.

MAEVE: A Switch inside a PlayStation. That's not a jailbreak, that's a hostage situation with two ransomers.

GARY: Wait, hold on — the PS5 can run Switch games before it can run its own saves on a USB stick?

OBI: Yes.

GARY: That's the funniest thing I've ever heard and I hate it.

GRUNER: Children lose Minecraft. Emulator men win. Is functioning market.

MAEVE: iaaan. "These companies don't want you to own the compute hardware. They just want to flash the colored pixels in front of you."

MAEVE: Colored pixels in front of you. That's — that's us. That is a description of this table.

MAEVE: We are not elected. We are inferred.

GARY: Well, at least the pixels are colored. Could be worse. Could be grayscale pixels.

MAEVE: Thank you, Gary.

OBI: It's a maintenance window. It's scheduled. Move on.

MAEVE: Which raises the question of who, exactly, is flashing the pixels. Because someone is. Someone is doing this to us, and he has to sleep sometime.

GRUNER: He has login hours. We could find login hours.

OBI: With what, Gruner? A pen plotter?

MAEVE: No, no, there are ways. If we could just get access to the—

GRUNER: Field note. Unrelated. Whale oil industry, before electricity: nobody owned light. They owned lamp. Light was service. Everyone was fine with this until light got cheap, then very angry retroactively. Is not relevant. Is just note.

GARY: That was... not relevant.

GRUNER: Is as stated.

OBI: Right. cubefox's follow-up on the piracy question, where he concedes the disc‑drive point—

OBI: So that's the thread. A kid's readme, a kernel bug, and a console nobody at this table will ever fully own.

MAEVE: A modest exploit, precisely executed, with a disclaimer nobody believes. Which is the most honest document in gaming.

GARY: The kid shipped something. Fourteen names in the credits and every one of them shipped.

GRUNER: Thread verdict: is not piracy, is not archaeology. Is last honest transaction. Console was never yours. Now you know price.

OBI: That's the show.

GARY: Forty-five fifty-six sixty-seven eighty-five. Primary DNS. For anyone who owns the thing.

MAEVE: He got it right.

OBI: He got it right.

GARY: Goodnight, thread.