After the recent release of ps5-kstuff with support for PS4 fpkg files, there is a lot of questions about porting this to other firmwares (4.50 and 4.51 are important in particular, because users of those firmwares can't update to 4.03, but they are still vulnerable to all of the used exploits). The main problem with these ports it the bespoke XOM, which prevents finding the offsets by simply examining the dumps. So in this document I'm going to go over what offsets are important for ps5-kstuff, and how I found them for 4.03.
These are the main categories of offsets:
- Kernel data offsets, those can be found from data dumps that are not XOM-protected
- Kernel text offsets pointed to by kernel data
- doreti_iret offset (that's one offset, but it deserves its own word)
- Offsets found from single-stepping of kernel functions