Tutorial  Updated

PS5 Exploit Guide

PS5 HACK STATUS:

Golden FWs: 4.50 = etaHEN / 2.50 = HV

(5.xx-7.61 can be exploited to dump games. EtaHEN is required to play backups, but is unavailable for > 4.51 yet)

Hypervisor:
Highest Private HV exploit: 1.00-4.51 (FlatZ)
Highest Public HV exploit: 1.00-2.50/2.70 (byepervisor Specter)
*unreleased

Kernel:
Highest public KEX:
1.00-7.61 (UMTX)
KEX offsets found: 1.00-7.61
*unreleased

Userland:
BD-JB: 1.00-7.61 (jar loader 4.0.1 + debug + UMTX)
Lua entry point: 2.00-Latest (7.61 + debug + UMTX using PS4 game)
Webkit: 1.00-5.50 (PSFREE. New WebKit required for 6.XX-7.XX)
Mast1C0re: 1.00-7.61 (PS2 backups)
PPPWN: 1.00-8.20 (mitigations on PS5)

Game dumping:
Up to 7.61 (self decryptor) latest HERE

Game backports: NOW POSSIBLE

Homebrew Enabler: etaHEN (3.XX-4.5X) latest HERE

PS5 backup loading: Itemzflow for 3.XX-4.5X HERE
PS4 backup loading: FPKG Enabler 2.XX-4.5X (rest mode & backports work, can crash).
PS5debug released:
HERE
PS5 trainers/cheats: Work
PS5 dumper: 3.XX-4.5X works with most games, use Itemzflow
(Dumps need rebuilding/cracking to avoid crashing)

UART:
HERE
Full chain exploit: 1.00-2.70 (byepervisor)
Linux Kexec: Coming Soon
PSN access: NEVER
Latest OFW: 10.60 (23/01/25)
Latest beta OFW: 10.00 b2 (25/07/24)
OFW Updates:
HERE
Legit PKG Updates: HERE

https://github.com/PS5Dev/PS5-UMTX-Jailbreak/releases/tag/v1.2

UMTX 1.2 exploit works on 1.00-5.xx with WebKit:
https://zecoxao.github.io/umtx/ or https://es7in1.site/ (payloads not working on 5.xx yet)

PS5 Itemzflow compatibility list:

Recommended hosts:
AL-AZIF WEB HOST:
DNS 1: 165.227.83.145
DNS 2: 192.241.221.79

https://cthugha.thegate.network/
https://ithaqua.thegate.network/

NOMADIC20000 HOST:
DNS 1: 62.210.38.117

(Leave DNS 2 blank)
http://es7in1.site/
https://zecoxao.github.io/ps5jb/

https://ps5jb.pages.dev/
https://sleirsgoevy.github.io/ps4jb2/ps5-403/index.html

PS5 game updates: https://psxpatches.com/

Summarised OFW/Model guide: HERE

1.XX-7.61 game compatibility list: HERE

Update OFW manually via USB by getting the firmware file from HERE and installing from <USB>:/PS5/UPDATE/PS5UPDATE.PUP

SYSTEM UPDATES:
7.61 SYS MD5: d5eca8b171a8d7df7ba225167f77e645 (Exploited - No HEN Yet)
6.50 SYS MD5: 98db854ba47a75dff0cb09355bca9025 (Exploited - No HEN Yet)
5.50 SYS MD5: edb3513ec531b2bd28f3a0b52a82a54f (Exploited - No HEN Yet)
4.51 SYS MD5: 1330b7bf63bf5c93d809b1eb1f4e1f01 (Exploited + HEN)
4.03 SYS MD5: 3716e4e6e0d223cd94cd4a8e5bd4fb94 (Exploited + HEN)

RECOVERY UPDATES (wipes all data):

7.61 REC MD5: 932f24e934723050fe49561b67e95226 (Exploited - No HEN Yet)
6.50 REC MD5: 4305223c12bd6dda9b944c0ee49c94c0 (Exploited - No HEN Yet)
5.50 REC MD5: c939ac8b37e07bbc129816a61002d30a (Exploited - No HEN Yet)
4.51 REC MD5: da78ca268da90a963d89b0f45db0f061 (Exploited + HEN)
4.03 REC MD5: e6dcc800d8d1dcada4f2bcd6e7ff162c (Exploited + HEN)

PS4 GAME INFORMATION:


OFW 1.xx cannot run PS4 games.
OFW 2.xx runs PS4 games up to 8.03
OFW 3.xx runs PS4 games up to 8.52
OFW 4.xx runs PS4 games up to 9.04
OFW 5.xx runs PS4 games up to 9.60
OFW 6.xx runs PS4 games up to 10.50
OFW 7.xx runs PS4 games up to 11.00
OFW 8.xx/9.xx runs PS4 games up to 11.50

PS4 backported FPKGs also work perfectly on PS5!

To determine your OFW version:
Go to settings > system > console information.

Version string info:
Year.Half (1st/2nd half of the year)-Major Version No.Minor Version No.Extended info-Further Info.Retail/Debug

21.02-04.03.00.00-00.00.00.0.1

First BD-J + Kernel access exploit provided by Sleirsgoevy (29/9/22)


Note: There are several USERLAND exploits, a couple of KERNEL exploits, and there is now a public HYPERVISOR exploits available for 1.xx-2.70 to complete the full exploit chain (23/10/24).

Recently Flatz confirmed he has developed his own HV exploit (1.xx-4.51 which is kept private) which was chained from a PS4 save game, and has successfully dumped PlayStation Secure Processor (27/07/23).


As of August 4th 2022: We can now install PS4/PS5 PKG games and updates (and by extension FPKGs) however official PKGs cannot be run unless you legitimately owned them previously digitally and have a licence for them on your current console, or if you own the disc (for update pkgs).

As of October 6th PS4 FPKG can be played on 4.03 OFW thanks to Sliersgoevy FPKG enabler!

Payload: https://gbatemp.net/download/4-03-fpkg-enabler-hen.38248/

As of October 21st PS4 FPKG can be played on 4.50 thanks to cheburek3000 porting offsets.

Payload: https://gbatemp.net/download/4-50-fpkg-enabler-hen.38279/

As of October 25th theflow0 fixes BD-J path traversal and native code execution for 7.61
https://x.com/theflow0/status/1717088032031982066?s=46&t=PIYQV4jmWEyCbVfx3Nx26g

As of November 4th ktuff is fixed for 4.51:

Payload: https://gbatemp.net/download/fpkg-enabler-4-51-hen.38306/

Nov 7th PS5 backups loaded via Itemzflow by Lightningmodz and Echostretch. Fully decrypted dumps require system files bundled into them in order to run without crashing with Libhijacker (no hen required), details here: https://gbatemp.net/threads/ps5-exploit-guide.613891/page-109#post-10290677

As of November 30th ps5debug has been released by SiSTR0: https://github.com/GoldHEN/ps5debug
Mirror: https://gbatemp.net/download/ps5debug.38333/

Dec 1st: first PS5 trainer (Dark Souls) is completed ready for the imminent release of REAPER Multi Trainer II by CTN.

Dec 25th: PS5 back up loading via ITEMZFLOW now released: https://pkg-zone.com/details/ITEM00001

As of Jan 2nd 2024 Sleirsgoevy has ported K-Stuff offsets for 3.xx firmwares.

As of Jan 4th 2024 LM had added 3.XX Kstuff to Itemzflow meaning 3.XX-4.51 is now supported for PS4/PS5 backups and dumping.

Oct 8th 2024: BD-JB + Kernel works on 7.61 thanks to user Hammer.
1: Never enable IDU mode.
If you do you will need to enter staff mode by holding L1 + L2 and tapping this combo: circle, cross, square, triangle, right D-Pad. Release L1 + L2 and you can access settings to exit IDU.

2: Try to stay on the lowest FW possible and wait for hacks on that firmware.

3: PS5 FPKGs cannot work as a hack for the A53 processor does not publicly exist to enable installing PS5 content as FPKG/PKG.

4: Installing legit game PKGs you do not own will never work, even if spoofed.

5: If you get stuck in a boot loop at the PS logo the SNVS is corrupted (if the hash check fails on boot this causes a “soft brick”).

It’s not “bricked”. Simply reinstall your current firmware RECOVERY PUP in safe mode.

USB: PS5 > UPDATE > PS5UPDATE.PUP

WEBKIT EXPLOIT:
Webkit > Kernel exploit chain for 3.00-4.51 via SpectreDev & ChendoChap:
https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit

https://github.com/ChendoChap/PS5-IPV6-Kernel-Exploit/tree/wip_branch

4.03 only: https://sleirsgoevy.github.io/ps4jb2/ps5-403/index.html

BD-JB EXPLOIT:
BD-JB > Kernel exploit for 4.51 via Sleirsgoevy:
https://github.com/sleirsgoevy/bd-jb/commit/159253464afde59c3007a706210bec65b91f38f3

UMTX Kernel exploit 7.61 JAR loader by Hammer83:
https://github.com/hammer-83/ps5-jar-loader/releases

PS2 CLASSICS EXPLOIT:
PS2 Classics > Userland via CTurt:
(Implementation by McCaulay)

Note: this is currently limited to swapping the loaded PS2 iso, or loading PS2 elf homebrew on PS5 (or PS4) for emulators or basic PS2 brew.

Mast1c0re PS2 exploit for PS2 homebrew:
https://cturt.github.io/mast1c0re.html

Mast1c0re part 2:
https://cturt.github.io/mast1c0re-2.html

Mast1c0re payload framework:
https://github.com/McCaulay/mast1c0re

Okrager save game exploit generator for Okage:
https://github.com/McCaulay/okrager

Mast1c0re payloader TCP Client GUI for PS5 6.50:
https://github.com/Master-s/PS4-PS5-Mast1c0re-Payloader/releases

TCP network ISO loader:
https://github.com/McCaulay/mast1c0re-ps2-network-elf-loader/releases

ExFat USB ISO loader:
https://github.com/McCaulay/mast1c0re-ps2-usb-game-loader/releases

4.03 PAYLOADS:
PS5 self dumper (Sleirsgoevy):
https://github.com/sleirsgoevy/ps4jb-payloads/tree/bd-jb/ps5-self-dumper

PS4 FPKG Enabler (Sleirsgoevy):
https://gbatemp.net/download/4-03-fpkg-enabler-hen.38248/

MISC PAYLOADS + TOOLS:
PS5 version display payload by SiSTR0 (compiled by Logic-68):
https://github.com/logic-68/Portage_PS5Version_Mast1c0re/releases/tag/V1.0.0

Libhijacker (by Astrelsky):
https://github.com/astrelsky/libhijacker

60 FPS patches for Libhijacker (by illusion0001):
https://github.com/illusion0001/libhijacker
Console/exploit information:

PS5 SDK REPO:

https://github.com/PS5Dev

PS5 factory mode PUP installation path:
/usb/PROSPERO/UPDATE/PROSPEROUPDATE.PUP

You can install free/demo PKGS (legit pkgs) via debug pkg installer, providing you have all the files/json/licences required.

(Astro’s Playroom has no licences and can be installed and played from official pkgs and update up to 1.60)
 
Last edited by KiiWii,

xZenithy

Well-Known Member
Member
Joined
Mar 4, 2019
Messages
230
Trophies
0
Age
46
XP
2,023
Country
United Kingdom
A few words about bdj-ipv6-hen/releases/tag/v0.3.

On my console the ipv6 version runs very unstable. Interestingly, after the kernel panic, I have to unplug the console because while you can hear a sound when you press the buttons on the console - the console does not respond to anything.

When, on the other hand, I try jailbreak using web browser and UMTX - everything runs stable. UMTX has the advantage over ipv6 that even if jailbreaking fails the console still responds and the script tries again to jailbreak.
Which FW version?
 
  • Like
Reactions: schatzi24

Adam512

Well-Known Member
Member
Joined
Aug 10, 2018
Messages
378
Trophies
0
XP
714
Country
Czech Republic
Most likely the lua loader method... if only more regional games used that function...
I didn't mean Lua, developers have another better method but they want to keep it private for as long as possible.

I have a PS4 and a PS5 myself and I'm glad I can be part of this scene. It's just a shame that PS5 doesn't have many games, it's generally past halfway point of the cycle and there aren't many games... thank gods there is this scene that can do interesting things with PS5 (Linux, homebrew etc.). I'm just waiting with my PS5 6.50

But I don't know if I'll get PS6, is it even worth it when so few exclusive games are coming out? The price will be too high again in 2027-2028... I can already see them promising 4k and 8k for PS6... which they promised for PS5 too :rofl2: They even removed the 8K logo from the boxes for the current PS5...previous boxes had 8K logo. Quite embarrassing. So far only reason I'm thinking about the PS6 is this scene (GoldHen, Linux, HomeBrew, etc.).Of course, nothing is certain with PS6 scene
 

Randqalan

The Wheel of Time Turns
Member
Joined
Jan 25, 2014
Messages
1,231
Trophies
3
Location
M00N Base quanto
XP
3,149
Country
United States
Screenshot 2025-01-25 at 15-59-19 Home _ X.png

https://x.com/aldostools/status/1883257775683404275
https://x.com/psgocn/status/1883254564805386662
 

kaeseins

Active Member
Newcomer
Joined
Dec 26, 2018
Messages
31
Trophies
0
Age
61
XP
655
Country
Germany
A few words about bdj-ipv6-hen/releases/tag/v0.3.

On my console the ipv6 version runs very unstable. Interestingly, after the kernel panic, I have to unplug the console because while you can hear a sound when you press the buttons on the console - the console does not respond to anything.

When, on the other hand, I try jailbreak using web browser and UMTX - everything runs stable. UMTX has the advantage over ipv6 that even if jailbreaking fails the console still responds and the script tries again to jailbreak.
Have you tried waiting for 10-20 seconds and then press the power button agaim?
 

KiiWii

Editorial Team
OP
Editorial Team
Joined
Nov 17, 2008
Messages
17,533
Trophies
3
Website
defaultdnb.github.io
XP
31,744
Country
United Kingdom
https://github.com/ps5-payload-dev/bdj-ipv6-hen/releases

V0.4

Changes

  • Cosmetic improvements to UI
  • Rebuild iso with improved version of kstuff
Known issues

  • Notification from kstuff is not displayed until the disc player is terminated
  • The kstuff payload may slows down other payloads significantly
 

KiiWii

Editorial Team
OP
Editorial Team
Joined
Nov 17, 2008
Messages
17,533
Trophies
3
Website
defaultdnb.github.io
XP
31,744
Country
United Kingdom
I have a 5.50 PS5. I understand exploits exist, just not at a hypervisor level? Is it worth it to homebrew it in anticipation for future HV exploits? Or should I wait because the process may change for when HV is introduced?
5.50 exploit (userland>kernel) will be happening eventually, but HV won’t be likely on >2.70 for a while.

Recently Specter said that a solution to MMAP fixed has been found so hang tight on 5.xx

IMG_2051.jpeg
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    BigOnYa @ BigOnYa: Google the build id then.