PS5 Exploit Guide

BobaFett_UK · May 28, 2026

Theone5000 said:
Well if see whats inside. It's a long list.

View attachment 575187
Holy moley... well that answers my question

_iggyman_ · May 28, 2026

i will buy my first PS5 only on TEMU for sure... :rofl2:

TheStonedModder · May 28, 2026

Input redirection and macro recording

No remote play needed just my payload

solitaire4eva · May 28, 2026

Theone5000 said:
Yarpe family

View attachment 575189

You went with Heart of the Woods to! I havent even seen a dump of that yet.

flopsy · May 28, 2026

Im guessing there is no way to change username, only "online" name. So, if were to set up a new user and do everything there. Could I then delete the "User1" user that came with Gezines Y2JB backup without issues?

xZenithy · May 28, 2026

Wrong message, delete...

Stronzi · May 28, 2026

flopsy said:
Im guessing there is no way to change username, only "online" name. So, if were to set up a new user and do everything there. Could I then delete the "User1" user that came with Gezines Y2JB backup without issues?

I'd be interested in that too. I've set the other user to log out automatically and I'm just leaving User1 alongside.

xxx_VanHelsing_xxx · May 28, 2026

Hello, I have a question -
for 12.70 we need a jailbroken PS4/5 to get the save file
or
we can download a save file for any supported japanese lua game ?

Thanks

xZenithy · May 28, 2026

Theone5000 said:
Not 1.05? Have read some that reverted all the way back to version 1.03.
Version 1.05 is stable enough for me to be used with SM+ and PHU.

I've read that the v1.06 version mostly negatively impacts lower FW's. Dunno what lower FW's this is but my guess it everything below 10.01. Anyway that's why it says BETA. Echo is working on it as we speak.

I am understand that you are using the new self-arsenal with SM+ and PHU
And that seems good, but in my case I am using Voidshell v3.0 only because it has include Sentinel, and his version of Sentinel works PERFECT!

I haven't tested self-arsenal yet but I have tested the legacy sonic-iso and it has something similar to sentinel but was working very bad.
PHU has something similar to sentinel too, but it works regular.

So my question is, has self-arsenal improved the sentinel options like voidshell does? or not yet (I cannot see anything different on the log, so my guess it not)?

Or am I missing something here?

HS2005 · May 28, 2026

xZenithy said:
I am understand that you are using the new self-arsenal with SM+ and PHU
And that seems good, but in my case I am using Voidshell v3.0 only because it has include Sentinel, and his version of Sentinel works PERFECT!

I'm using SM+ / kstuff 1.06 & PHU. I have not tested self-arsenal yet so can't say much about it (yet).

xZenithy · May 28, 2026

Theone5000 said:
I'm using SM+ / kstuff 1.06 & PHU. I have not tested self-arsenal yet so can't say much about it (yet).

And how you automatically pause kstuff, by PHU ?

xalfie · May 28, 2026

Stronzi said:
I'd be interested in that too. I've set the other user to log out automatically and I'm just leaving User1 alongside.

probably is the same as with the PS4. You can change account name, but only before to activate it.

HS2005 · May 28, 2026

xZenithy said:
And how you automatically pause kstuff, by PHU ?

All that is done by PHU. In the PHU folder you have a shadowmount/config.ini file. Just copy that over.
Any personal changes you make you done via phu_overlay.cfg

Any one tried this already:

https://git.etawen.dev/soniciso/uds-trophy-unlocker/releases

If so, report your findings and way of working.

yonasz · May 28, 2026

xxx_VanHelsing_xxx said:
Hello, I have a question -
for 12.70 we need a jailbroken PS4/5 to get the save file
or
we can download a save file for any supported japanese lua game ?

Thanks

Create save file copy to usb and use garlic save to add content ( decrypt add fies encrypt)and resign
Swrr just download file from GitHub and resign with garlicasave

littlemisskittn · May 28, 2026

Theone5000 said:
All that is done by PHU. In the PHU folder you have a shadowmount/config.ini file. Just copy that over.
Any personal changes you make you done via phu_overlay.cfg

Any one tried this already:
View attachment 575310

https://git.etawen.dev/soniciso/uds-trophy-unlocker/releases

If so, report your findings and way of working.

Keep getting a core patch failed error. PS5 Pro 12.40

HS2005 · May 28, 2026

littlemisskittn said:
Keep getting a core patch failed error. PS5 Pro 12.40

For trophy unlocker? I find the guide / readme to be like: very unclear...

littlemisskittn · May 28, 2026

Theone5000 said:
For trophy unlocker? I find the guide / readme to be like: very unclear...

Yup.

Here's what the FW Probe shows:

# fw_probe dump — paste the FW ROW block at the bottom
# into g_fw_table[] in uds-trophy-allfw/scc_patcher.c,
# rebuild, ship.
#
# Generated by fw_probe.elf on the target console.
# FTP-pull this file from /data/fwprobe.txt (port 2121,
# anonymous) and attach it to your support request.
# ───────────────────────────────────────────────────

=================================================
fw_probe — capture data for new FW row
=================================================
kern.sdk_version = 0x12400009 (= FW 12.40)

kernel struct offsets (heuristic by major):
proc.p_vmspace = 0x200
vm_map.pmap = 0x1d8 (6.x+ layout)
pmap.pm_pml4 = 0x20
pmap.pm_cr3 = 0x28

SceShellCore: pid=60 base=0x607ec000
proc=0xffffcdcc8068d9e0 vmspace=0xffffcdc40525db58 pmap=0xffffcdc40525de40
pml4_kva=0xffffcdcc9c280000 pml4_pa=0x89c280000 dmap_base=0xffffcdc400000000

scanning shell core for patterns...
scanned 0x6000010 bytes (chunks ok=96 skipped=0)
candidates: B1=6 B5_LNC=0
ALL B1 candidates (file offsets):
[0] core+0x01d079e8 (VA 0x02d079e8)
[1] core+0x01e21428 (VA 0x02e21428)
[2] core+0x01f545a8 (VA 0x02f545a8)
[3] core+0x01f545b4 (VA 0x02f545b4)
[4] core+0x01f54d08 (VA 0x02f54d08)
[5] core+0x01f54d14 (VA 0x02f54d14)

B1 cluster (span 0x76c):
[1] core+0x01f545a8 (VA 0x02f545a8 for paste)
[2] core+0x01f545b4 (VA 0x02f545b4 for paste)
[3] core+0x01f54d08 (VA 0x02f54d08 for paste)
[4] core+0x01f54d14 (VA 0x02f54d14 for paste)

B5_LNC candidates:

==== FW ROW (paste into g_fw_table[] in scc_patcher.c) ====

⚠ ROW IS INCOMPLETE — scan didn't find full data.
⚠ Reasons + fix at bottom. Do NOT paste as-is.

{ "12.40", 0x12400000, 0x1240ffff,
{ 0x02f545a8, 0x02f545b4, 0x02f54d08, 0x02f54d14 },
0, JZ_SHORT_LEN, /* NO REAL B5_LNC CANDIDATE FOUND */
{ 0, 0, 0, 0 },
{ 0, 0, 0, 0 },
0x200, 0x1d8, 0x20, 0x28 },

==== END FW ROW ====

⚠ INCOMPLETE DATA — likely causes:
1. mdbg_copyout dropped chunks (look at "chunks ok/skipped" above).
If skipped > 0, re-run the probe — sometimes more chunks succeed.
2. core may have been relocated since last reboot. Try rebooting +
re-running the probe after game launch (cold-cache core scan).
3. Manually paste B1 candidates from "ALL B1 candidates" list above
into the row — if any 4 form a tight cluster (~0x76c span), they
are likely the real slots.

Notes:
* B1 cluster span should be ~0x76c bytes — if much larger,
the cluster pick may have selected false-positives.
* B5_LNC: list ALL candidates with fwd-0x8094000f=yes as
primary + extras. Multiple lnc_manager gates share the same
attribute test on most FWs.
* If kernel struct walk failed (pml4_kva or pml4_pa == 0),
you need to find the right vmmap_pmap offset. Try 0x1D0,
0x1D8, 0x1E0, 0x1F0 in sequence until the walk succeeds.

Dump written to /data/fwprobe.txt — FTP it to the maintainer.
(port 2121, anonymous, no password)
=== done ===

# ───────────────────────────────────────────────────
# Dump complete. FTP this file:
# Host: <PS5_IP> Port: 2121 User: anonymous Pass: (blank)
# Path: /data/fwprobe.txt
# ───────────────────────────────────────────────────

TheStonedModder · May 28, 2026

littlemisskittn said:
Yup.

Here's what the FW Probe shows:

# fw_probe dump — paste the FW ROW block at the bottom
# into g_fw_table[] in uds-trophy-allfw/scc_patcher.c,
# rebuild, ship.
#
# Generated by fw_probe.elf on the target console.
# FTP-pull this file from /data/fwprobe.txt (port 2121,
# anonymous) and attach it to your support request.
# ───────────────────────────────────────────────────

=================================================
fw_probe — capture data for new FW row
=================================================
kern.sdk_version = 0x12400009 (= FW 12.40)

kernel struct offsets (heuristic by major):
proc.p_vmspace = 0x200
vm_map.pmap = 0x1d8 (6.x+ layout)
pmap.pm_pml4 = 0x20
pmap.pm_cr3 = 0x28

SceShellCore: pid=60 base=0x607ec000
proc=0xffffcdcc8068d9e0 vmspace=0xffffcdc40525db58 pmap=0xffffcdc40525de40
pml4_kva=0xffffcdcc9c280000 pml4_pa=0x89c280000 dmap_base=0xffffcdc400000000

scanning shell core for patterns...
scanned 0x6000010 bytes (chunks ok=96 skipped=0)
candidates: B1=6 B5_LNC=0
ALL B1 candidates (file offsets):
[0] core+0x01d079e8 (VA 0x02d079e8)
[1] core+0x01e21428 (VA 0x02e21428)
[2] core+0x01f545a8 (VA 0x02f545a8)
[3] core+0x01f545b4 (VA 0x02f545b4)
[4] core+0x01f54d08 (VA 0x02f54d08)
[5] core+0x01f54d14 (VA 0x02f54d14)

B1 cluster (span 0x76c):
[1] core+0x01f545a8 (VA 0x02f545a8 for paste)
[2] core+0x01f545b4 (VA 0x02f545b4 for paste)
[3] core+0x01f54d08 (VA 0x02f54d08 for paste)
[4] core+0x01f54d14 (VA 0x02f54d14 for paste)

B5_LNC candidates:

==== FW ROW (paste into g_fw_table[] in scc_patcher.c) ====

⚠ ROW IS INCOMPLETE — scan didn't find full data.
⚠ Reasons + fix at bottom. Do NOT paste as-is.

{ "12.40", 0x12400000, 0x1240ffff,
{ 0x02f545a8, 0x02f545b4, 0x02f54d08, 0x02f54d14 },
0, JZ_SHORT_LEN, /* NO REAL B5_LNC CANDIDATE FOUND */
{ 0, 0, 0, 0 },
{ 0, 0, 0, 0 },
0x200, 0x1d8, 0x20, 0x28 },

==== END FW ROW ====

⚠ INCOMPLETE DATA — likely causes:
1. mdbg_copyout dropped chunks (look at "chunks ok/skipped" above).
If skipped > 0, re-run the probe — sometimes more chunks succeed.
2. core may have been relocated since last reboot. Try rebooting +
re-running the probe after game launch (cold-cache core scan).
3. Manually paste B1 candidates from "ALL B1 candidates" list above
into the row — if any 4 form a tight cluster (~0x76c span), they
are likely the real slots.

Notes:
* B1 cluster span should be ~0x76c bytes — if much larger,
the cluster pick may have selected false-positives.
* B5_LNC: list ALL candidates with fwd-0x8094000f=yes as
primary + extras. Multiple lnc_manager gates share the same
attribute test on most FWs.
* If kernel struct walk failed (pml4_kva or pml4_pa == 0),
you need to find the right vmmap_pmap offset. Try 0x1D0,
0x1D8, 0x1E0, 0x1F0 in sequence until the walk succeeds.

Dump written to /data/fwprobe.txt — FTP it to the maintainer.
(port 2121, anonymous, no password)
=== done ===

# ───────────────────────────────────────────────────
# Dump complete. FTP this file:
# Host: <PS5_IP> Port: 2121 User: anonymous Pass: (blank)
# Path: /data/fwprobe.txt
# ───────────────────────────────────────────────────

You need to be sharing this probe with Sonic

This won’t help 99% of people here the payload is very much work in progress and he can’t fix it if no one shares these with him or the klogs

littlemisskittn · May 28, 2026

TheStonedModder said:
You need to be sharing this probe with Sonic

This won’t help 99% of people here the payload is very much work in progress and he can’t fix it if no one shares these with him or the klogs

Already ahead of you. Shared the issue on that site. It IS working on 11.60 as I just unlocked a few trophies in Astro Bot on my slim. There's already an issue open for 12.20 and now my 12.40. Weird that it shows working on 12.00 and 12.70 but not in between. Oh and these payloads CAN be used coming out of rest mode as both my Pro and Slim were on rest mode and while the 12.40 didn't work, the 11.60 did. So rest mode doesn't seem to be a factor in that.

m3kal · May 28, 2026

Anyone know of a backup with 2.3 luac0re on it? Thanks

Post automatically merged: May 28, 2026

Anyone know of a backup with 2.3 luac0re on it? Thanks

PS5 Hack Status:

Preparing Your Console:

Select Your Jailbreak:

Additional Information:

Warnings:

Archived Information

Well-Known Member

Well-Known Member

Developer

Fickly Member

Well-Known Member

Well-Known Member

New Member

New Member

Well-Known Member

The destroyer of worlds

Well-Known Member

Well-Known Member

The destroyer of worlds

Well-Known Member

SQUIRRELY WRATH!

The destroyer of worlds

SQUIRRELY WRATH!

Developer

SQUIRRELY WRATH!

Member

Similar threads

Popular threads in this forum