Tutorial  Updated

PS5 Exploit Guide

PS5 HACK STATUS:

Recommended FW: 4.51 for etaHEN or HV exploit.
Highest Hypervisor exploit: 1.00-4.51 (FlatZ confirmed)
Highest Public Hypervisor exploit: 1.xx-2.50/2.70 (byepervisor by Specter dev)
Highest public kernel exploit: 5.50 UMTX
Highest private kernel exploit:
*7.61 UMTX*
KEX offsets found: 1.00-5.50
Highest webkit entry point: 5.XX
Mast1C0re entrypoint: up to 8.00 (7.61 for PS2 backups)
Highest BD-JB entrypoint: 7.61
Highest Lua entrypoint: 7.61
Homebrew Enabler: etaHEN (3.XX-4.5X) latest
HERE
PS5 backup loading: Itemzflow for 3.XX-4.5X HERE
PS4 backup loading: FPKG Enabler 2.XX-4.5X (rest mode & backports work, can crash).
PS5debug released:
HERE
PS5 trainers/cheats: Work
PS5 dumper: 3.XX-4.5X works with most games, use Itemzflow
(Dumps need rebuilding/cracking to avoid crashing)

UART:
HERE
Full chain exploit: 1.00-2.70 (byepervisor)
PSN access: NEVER
Latest OFW: 10.20 (23/10/24)
Latest beta OFW: 10.00 b2 (25/07/24)
OFW Updates:
HERE
Legit PKG Updates: HERE

https://github.com/PS5Dev/PS5-UMTX-Jailbreak/releases/tag/v1.2

UMTX 1.2 exploit works on 1.00-5.xx with WebKit:
https://zecoxao.github.io/umtx/ or https://es7in1.site/ (payloads not working on 5.xx yet)

UMTX 6.xx-7.61 will require a new webkit exploit for digital consoles

PS5 Itemzflow compatibility list:

Recommended hosts:
AL-AZIF WEB HOST:
DNS 1: 165.227.83.145
DNS 2: 192.241.221.79

https://cthugha.thegate.network/
https://ithaqua.thegate.network/

NOMADIC20000 HOST:
DNS 1: 62.210.38.117

(Leave DNS 2 blank)
http://es7in1.site/
https://zecoxao.github.io/ps5jb/

https://ps5jb.pages.dev/
https://sleirsgoevy.github.io/ps4jb2/ps5-403/index.html

PS5 game updates: https://psxpatches.com/

Summarised OFW/Model guide: HERE

1.XX-7.61 game compatibility list: HERE

Update OFW manually via USB by getting the firmware file from HERE and installing from <USB>:/PS5/UPDATE/PS5UPDATE.PUP

SYSTEM UPDATES:
7.61 SYS MD5: d5eca8b171a8d7df7ba225167f77e645 (ready for exploit)
6.50 SYS MD5: 98db854ba47a75dff0cb09355bca9025 (ready for exploit)
5.50 SYS MD5: edb3513ec531b2bd28f3a0b52a82a54f (exploited)
4.51 SYS MD5: 1330b7bf63bf5c93d809b1eb1f4e1f01 (exploited)
4.03 SYS MD5: 3716e4e6e0d223cd94cd4a8e5bd4fb94 (exploited)

RECOVERY UPDATES (wipes all data):

7.61 REC MD5: 932f24e934723050fe49561b67e95226 (ready for exploit)
6.50 REC MD5: 4305223c12bd6dda9b944c0ee49c94c0 (ready for exploit)
5.50 REC MD5: c939ac8b37e07bbc129816a61002d30a (exploited)
4.51 REC MD5: da78ca268da90a963d89b0f45db0f061 (exploited)
4.03 REC MD5: e6dcc800d8d1dcada4f2bcd6e7ff162c (exploited)


PS5 OFW 3.xx runs PS4 games up to 8.50
PS5 OFW 4.xx runs PS4 games up to 9.00

PS4 backported FPKGs work perfectly on PS5.

To determine your OFW version:
Go to settings > system > console information.

Version string info:
Year.Half (1st/2nd half of the year)-Major Version No.Minor Version No.Extended info-Further Info.Retail/Debug

21.02-04.03.00.00-00.00.00.0.1

First BD-J + Kernel access exploit provided by Sleirsgoevy (29/9/22)


Note: There are several USERLAND exploits, a couple of KERNEL exploits, and there is now a public HYPERVISOR exploits available for 1.xx-2.70 to complete the full exploit chain (23/10/24).

Recently Flatz confirmed he has developed his own HV exploit (1.xx-4.51 which is kept private) which was chained from a PS4 save game, and has successfully dumped PlayStation Secure Processor (27/07/23).


As of August 4th 2022: We can now install PS4/PS5 PKG games and updates (and by extension FPKGs) however official PKGs cannot be run unless you legitimately owned them previously digitally and have a licence for them on your current console, or if you own the disc (for update pkgs).

As of October 6th PS4 FPKG can be played on 4.03 OFW thanks to Sliersgoevy FPKG enabler!

Payload: https://gbatemp.net/download/4-03-fpkg-enabler-hen.38248/

As of October 21st PS4 FPKG can be played on 4.50 thanks to cheburek3000 porting offsets.

Payload: https://gbatemp.net/download/4-50-fpkg-enabler-hen.38279/

As of October 25th theflow0 fixes BD-J path traversal and native code execution for 7.61
https://x.com/theflow0/status/1717088032031982066?s=46&t=PIYQV4jmWEyCbVfx3Nx26g

As of November 4th ktuff is fixed for 4.51:

Payload: https://gbatemp.net/download/fpkg-enabler-4-51-hen.38306/

Nov 7th PS5 backups loaded via Itemzflow by Lightningmodz and Echostretch. Fully decrypted dumps require system files bundled into them in order to run without crashing with Libhijacker (no hen required), details here: https://gbatemp.net/threads/ps5-exploit-guide.613891/page-109#post-10290677

As of November 30th ps5debug has been released by SiSTR0: https://github.com/GoldHEN/ps5debug
Mirror: https://gbatemp.net/download/ps5debug.38333/

Dec 1st: first PS5 trainer (Dark Souls) is completed ready for the imminent release of REAPER Multi Trainer II by CTN.

Dec 25th: PS5 back up loading via ITEMZFLOW now released: https://pkg-zone.com/details/ITEM00001

As of Jan 2nd 2024 Sleirsgoevy has ported K-Stuff offsets for 3.xx firmwares.

As of Jan 4th 2024 LM had added 3.XX Kstuff to Itemzflow meaning 3.XX-4.51 is now supported for PS4/PS5 backups and dumping.


Oct 8th 2024: BD-JB + Kernel works on 7.61 thanks to user Hammer.
1: Never enable IDU mode.
If you do you will need to enter staff mode by holding L1 + L2 and tapping this combo: circle, cross, square, triangle, right D-Pad. Release L1 + L2 and you can access settings to exit IDU.

2: Try to stay on the lowest FW possible and wait it out for hacks on that firmware.

3: PS5 FPKGs cannot work as a hack for the a53 processor does not publicly exist to enable PS5 content as FPKG/PKG.

4: Installing legit game PKGs you do not own will not work, even if spoofed.

5: If you get stuck in a boot loop at the PS logo, this means the SNVS is corrupted (if hash check fails on boot this causes a “soft brick”).

It’s not “bricked”, just reinstall your current firmware RECOVERY PUP in safe mode!

USB: PS5 > UPDATE > PS5UPDATE.PUP

WEBKIT EXPLOIT:
Webkit > Kernel exploit chain for 3.00-4.51 via SpectreDev & ChendoChap:
https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit

https://github.com/ChendoChap/PS5-IPV6-Kernel-Exploit/tree/wip_branch

4.03 only: https://sleirsgoevy.github.io/ps4jb2/ps5-403/index.html

BD-JB EXPLOIT:
BD-JB > Kernel exploit chain for 4.51 via Sleirsgoevy:
https://github.com/sleirsgoevy/bd-jb/commit/159253464afde59c3007a706210bec65b91f38f3

PS2 CLASSICS EXPLOIT:
PS2 Classics > Userland via CTurt:
(Implementation by McCaulay)

Note: this is currently limited to swapping the loaded PS2 iso, or loading PS2 elf homebrew on PS5 (or PS4) for emulators or basic PS2 brew.

Mast1c0re PS2 exploit for PS2 homebrew:
https://cturt.github.io/mast1c0re.html

Mast1c0re part 2:
https://cturt.github.io/mast1c0re-2.html

Mast1c0re payload framework:
https://github.com/McCaulay/mast1c0re

Okrager save game exploit generator for Okage:
https://github.com/McCaulay/okrager

Mast1c0re payloader TCP Client GUI for PS5 6.50:
https://github.com/Master-s/PS4-PS5-Mast1c0re-Payloader/releases

TCP network ISO loader:
https://github.com/McCaulay/mast1c0re-ps2-network-elf-loader/releases

ExFat USB ISO loader:
https://github.com/McCaulay/mast1c0re-ps2-usb-game-loader/releases

4.03 PAYLOADS:
PS5 self dumper (Sleirsgoevy):
https://github.com/sleirsgoevy/ps4jb-payloads/tree/bd-jb/ps5-self-dumper

PS4 FPKG Enabler (Sleirsgoevy):
https://gbatemp.net/download/4-03-fpkg-enabler-hen.38248/

4.5X PAYLOADS:
(Coming soon)

MISC PAYLOADS + TOOLS:
PS5 version display payload by SiSTR0 (compiled by Logic-68):
https://github.com/logic-68/Portage_PS5Version_Mast1c0re/releases/tag/V1.0.0

Libhijacker (by Astrelsky):
https://github.com/astrelsky/libhijacker

60 FPS patches for Libhijacker (by illusion0001):
https://github.com/illusion0001/libhijacker
Console/exploit information:

PS5 SDK REPO:

https://github.com/PS5Dev

PS5 factory mode PUP installation path:
/usb/PROSPERO/UPDATE/PROSPEROUPDATE.PUP

You can install free/demo PKGS (legit pkgs) via debug pkg installer, providing you have all the files/json/licences required.

(Astro’s Playroom has no licences and can be installed and played from official pkgs and update up to 1.60)
 
Last edited by KiiWii,

ccfman2004

Well-Known Member
Member
Joined
Mar 5, 2008
Messages
2,955
Trophies
2
XP
3,709
Country
United States
Even if the exploit for PS5 does become available. Those who on PS5 4.51 or lower, how many of you can honestly say that you'll update?
While I have a PS5 on 4.51 I also have one 5.02.

I'm sure the PS5's above 4.51 and below 8.20 far outnumber the ones on 4.51 or lower. Also I like the idea of having a PS4 Slim that you can hack as it is likely more reliable than the Huge (Seto Kaiba edition) PS5s.

Plus we will get access to newer games.

Me personally, I just want to be able to dump and decrypt my purchased PS4 content from my 4.51 PS5 since it's my primary active PS5 while my PS4 is not so I can only dump Disc based games.
 

FateNightroad

Well-Known Member
Member
Joined
Jul 19, 2023
Messages
134
Trophies
0
Age
37
XP
398
Country
Canada
I'm sure the PS5's above 4.51 and below 8.20 far outnumber the ones on 4.51 or lower.
And I have a feeling that the PS5's owners on the latest firmware outnumber the ones on 8.20. People always feel the need to update then complain that their current firmware is not jailbreakable.
 

Stoned

Well-Known Member
Member
Joined
Mar 26, 2014
Messages
2,798
Trophies
2
Age
46
XP
4,691
Country
Germany
It's also possible that they may not be allowed to share anything yet. For all we know it's TheFloW who's Jose Coixao "friend" and isn't allowed to go into further details until a certain date.

Everything can be hacked, it's just a matter of difficulty.
That´s wrong.
His "Friend" is Flat_z
Flat_z has Confirmed it already on discord. ;)
 

FateNightroad

Well-Known Member
Member
Joined
Jul 19, 2023
Messages
134
Trophies
0
Age
37
XP
398
Country
Canada
and what makes you think he doesn't have a nondisclosure agreement? ;)
Because unlike TheFloW, he didn't submit his finding to HackerOne. He also mentioned that he was going to keep some exploits for the community.
Isn’t flat_z the one who has a 2.50 hypervisor exploit that he prefers to keep private?
Whether or not he really did have a 2.50 hypervisor exploit, I don't know. But if he did, I can see why since it's not practical to release it, anyways. Very few have PS5s on that firmware and the hypervisor exploit might have not been patched yet. So, keeping it private would've been a smart move.
 

Axido

Maker of TRASLApp
Member
Joined
Feb 12, 2014
Messages
1,382
Trophies
3
Age
33
XP
4,692
Country
Germany
Because unlike TheFloW, he didn't submit his finding to HackerOne. He also mentioned that he was going to keep some exploits for the community.

Whether or not he really did have a 2.50 hypervisor exploit, I don't know. But if he did, I can see why since it's not practical to release it, anyways. Very few have PS5s on that firmware and the hypervisor exploit might have not been patched yet. So, keeping it private would've been a smart move.

What a weird way of reasoning. So, you hold it against TheFlow that he participates in a program that allows him to release his findings to the public half a year after the exploits he found have been patched, which he doesn't even have to do, but still does? That must be the most useless NDA I have ever seen.

And what makes you think the lack of one suggests there is any chance for a release. Let's assume two scenarios and see how they'd play out.
1 - The 2.50 hypervisor exploit has been patched -> there is no need to hold it back anymore. Why not release it then, even if it's not that useful?
2 - It hasn't been patched. That would mean it has been held back until now and might still be present in 9.20. Why release a perfectly fine hypervisor exploit if it would get patched immediately by Sony, locking out future firmwares in the process? That would only be reasonable if there was some kind of "spare hypervisor exploit" to burn. If there was one, wouldn't we have any tweets showing off some of its results by now?

That being said, are there any logical explanations as to why you'd have to expect this is one of the exploits Flat_z keeps for the community?
 

Adam512

Well-Known Member
Member
Joined
Aug 10, 2018
Messages
362
Trophies
0
XP
661
Country
Czech Republic
What a weird way of reasoning. So, you hold it against TheFlow that he participates in a program that allows him to release his findings to the public half a year after the exploits he found have been patched, which he doesn't even have to do, but still does? That must be the most useless NDA I have ever seen.

And what makes you think the lack of one suggests there is any chance for a release. Let's assume two scenarios and see how they'd play out.
1 - The 2.50 hypervisor exploit has been patched -> there is no need to hold it back anymore. Why not release it then, even if it's not that useful?
2 - It hasn't been patched. That would mean it has been held back until now and might still be present in 9.20. Why release a perfectly fine hypervisor exploit if it would get patched immediately by Sony, locking out future firmwares in the process? That would only be reasonable if there was some kind of "spare hypervisor exploit" to burn. If there was one, wouldn't we have any tweets showing off some of its results by now?

That being said, are there any logical explanations as to why you'd have to expect this is one of the exploits Flat_z keeps for the community?
usually it is half a year, but I feel that company must give permission to publish, otherwise it is out of luck (I am not sure, but I think it is so).

Anyway, I dont know why he kept 2.x private, maybe it was only partially fixed or maybe it's pointless to share because all the benefits of HV exploit will be transferred to bigger FW.. I don't know just guessing.. anyway not many people had 2.x because chip crisis at this time.

discussion is pointless, let's just be patient and see what comes, I'm sure something amazing it will be released soon for PS5 :yayps3:
 

acesmokemall

Well-Known Member
Member
Joined
Oct 3, 2016
Messages
236
Trophies
0
Age
47
XP
825
Country
United States
Hi does anyone know where I can find PS5 trainers? When I run multitrainer it will not auto load any trainers from the Internet and Idk why any help would be appreciated
 

FateNightroad

Well-Known Member
Member
Joined
Jul 19, 2023
Messages
134
Trophies
0
Age
37
XP
398
Country
Canada
@Axido
That's just your assumption of what I wrote when I included TheFlow. My reasoning was pretty straight forward. If flat_z was under non disclosure, his name would mostly likely be listed on Hackerone.

Furthermore, what makes your think there are only two scenarios? What's to say that there aren't more?

For one, what if it has just recently patched, so make makes very little sense to release 2.50 when there's 8.20.

Or two, what if there was no hypervisor 2.50 exploit to begin with?

And lastly, I only said, it "will come to fruition". Nowhere did I mention anything about releases.
 

brollikk

Well-Known Member
Member
Joined
Mar 8, 2018
Messages
355
Trophies
0
XP
1,194
Country
United States
it's been a little tough to see exactly what the state of ps5 hacking is -

from what I've read, 4.51 is the highest firmware that is hackable?

assuming you have one on this firmware, using itemzflow you can install fpkgs for ps5 games?

Are there any limitations to this or are games pretty much playable on ps5 assuming you just have the right firmware? Are there games that just don't work? or am I reading this all wrong?
 

ccfman2004

Well-Known Member
Member
Joined
Mar 5, 2008
Messages
2,955
Trophies
2
XP
3,709
Country
United States
it's been a little tough to see exactly what the state of ps5 hacking is -

from what I've read, 4.51 is the highest firmware that is hackable?

assuming you have one on this firmware, using itemzflow you can install fpkgs for ps5 games?

Are there any limitations to this or are games pretty much playable on ps5 assuming you just have the right firmware? Are there games that just don't work? or am I reading this all wrong?
We do not have FPKGs for PS5 games yet. The process of getting PS5 backups working is quite a bit more involved than PS4 game for now. There are games that do not work. Some because can't decrypt the eboot.bin. Some for other reasons.

Check out the following videos for more information.



 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    SylverReZ @ SylverReZ: @Psionic Roshambo, Response was "No."