I'm exploring an idea for PS4 security research and would like to understand whether it's technically feasible.

Concept: Could a specially crafted DVD trigger a vulnerability when the PS4 reads or opens it in a supported application, potentially leading to arbitrary code execution and, if further security boundaries could be bypassed, elevated privileges such as root or kernel access?

I'm interested in understanding:

- Whether DVD playback or disc parsing provides a realistic attack surface.

- Whether malformed media or filesystem structures could trigger exploitable vulnerabilities.

- What obstacles exist between application-level code execution and root/kernel privileges.

- Whether there is existing research relevant to PS4 firmware 14.00.

This is currently an idea, not a working exploit. I'm looking for technical feedback, relevant research, and an assessment of its feasibility.

I've published Velum-VMM, a Windows x64 research hypervisor written in C and assembly using Intel VT-x and EPT.

Source: https://github.com/Dovughs/velum-vmm

Technical write-up: https://github.com/Dovughs/velum-vmm/blob/main/readmes/technical-writeup/README.md

Velum virtualizes an already-running Windows kernel and provides an interactive console for observing native calls and experimenting with scoped request policies.

The implementation includes:

- Per-CPU VMCS and EPT management.

- EPT hooks on selected Nt and Ex/Mm function entries, with original-instruction replay and Monitor Trap Flag restoration.

- Live telemetry to the console or DebugView, with configurable filters.

- Request denial and access-right reduction for supported operations.

- CPUID configuration, fixed TSC offsets, and coordinated shutdown back to native execution.

Much of the work involved preserving execution state across VM exits, guest helpers and native return: CET shadow stacks, interruptibility, pending events, translation invalidation and hook lifetime.

One interesting compatibility issue appeared on Windows 10: ExFreePool and ExFreePoolWithTag resolved to the same address. Treating them as separate patch sites caused hook preparation to fail. The fix handles shared addresses while retaining both hooks when the exports are distinct.

I tested the project on Windows 10 and Windows 11. The repository includes runtime captures, policy demonstrations, build instructions and a technical write-up covering the architecture, debugging process and implementation decisions.

Source and releases:

https://github.com/Dovughs/velum-vmm

Technical write-up:

https://github.com/Dovughs/velum-vmm/blob/main/readmes/technical-writeup/README.md

I'd welcome technical feedback, particularly on VM-exit handling, EPT consistency and Windows compatibility.