What is Ghostpad?
Ghostpad is a payload + Windows desktop app that creates a virtual DualSense controller on a jailbroken PS5 and forwards keyboard, on-screen, or scripted input to it over your local network. The PS5 shell and games see it as a real, physical controller — no PSN account, no Remote Play, no Sony software required.
Download on GitHub
First-Time Setup
Make sure you disconnect any physical controllers before using Ghostpad! Otherwise you may get stuck with an un-dismissible "Who's using this controller" assignment screen. This is a known bug — any help solving it is appreciated.
Getting started is straightforward:
- Start the ELF loader on your PS5.
- Open the Ghostpad app on your PC and go to Settings.
- Add your PS5 using its local IP address and confirm the resolved payload path points to
ghostpad.elf. - Click Deploy Payload, then Connect.
Input Redirection
Open Input Redirection to control the PS5 in real time. Ghostpad supports five input methods:
- On-screen controller (built-in)
- XInput gamepad (any compatible controller)
- Keyboard bindings
- Mouse look for analog stick movement
- Auto-clicker for repeated button presses
W/A/S/D → D-pad, I/J/K/L → face buttons, U/O → L1/R1, Q/E → L2/R2, Enter → Options, Backspace → Create, Space → PS button. All bindings are fully remappable from within the app.Macro Recording & Projects
Ghostpad includes a full macro system via the Projects screen:
- Create a project and add a command.
- Hit the red Record button and perform your inputs (controller, keyboard, mouse, or on-screen).
- Save the macro.
Optional Tools
Ghostpad ships with two optional companion payloads:
- Beeper & LED (requires firmware 8.0+ and
beeper_server.elf) — control the PS5's beeper and LED brightness from your PC. - System State (requires
SystemStateManager.elf) — send reboot, shutdown, rest mode, and disc eject commands remotely. This is bundled with the Windows app and does not need to be installed separately.
How It Works — Technical Details
The core challenge:
Ghostpad bypasses this with a 10-byte code-cave patch inside
The assignment screen still pops up — Ghostpad dismisses it programmatically by calling the same MBus pair the OS uses when a real user accepts a controller (
scePadVirtualDeviceAddDevice always returns error 0x803B0006 ("assignment screen pending") when called from a payload.Ghostpad bypasses this with a 10-byte code-cave patch inside
SceShellCore's libScePad.sprx. It locates the IPC dispatch call just before the function's canary epilogue, redirects it through a cave in the function's tail-padding, and patches the return value to 0. The virtual device is then accepted as real.The assignment screen still pops up — Ghostpad dismisses it programmatically by calling the same MBus pair the OS uses when a real user accepts a controller (
sceMbusDisconnectDevice + sceMbusBindDeviceWithUserId). From that point, every 16-byte GPAD packet the PC sends over TCP port 6967 is forwarded directly into scePadVirtualDeviceInsertData, and the shell and games react as if you pressed a real button.Wire Protocol
Input is sent over TCP port 6967 as a fixed 16-byte GPAD packet:
- 4-byte magic header
- Big-endian 32-bit button bitmask
- Four analog bytes (LX, LY, RX, RY — centred at 128)
- Two analog trigger bytes (L2, R2)
- Two reserved bytes
Known Limitations
- The VDA patch relies on firmware-specific byte patterns — other
libScePadbuilds may need the scan updated. - Only a single virtual DualSense can be active at a time.
- Touchpad XY motion is not yet wired through (button click works).
- No haptics or rumble feedback from the PS5 back to the PC.
mdbg_copyinintoSceShellCorefails witherrno=1, which is why VDI usespt_call_with_copyinstead of a shared-memory path.
