PS5 Exploit Guide

HS2005 · May 23, 2026

le237qk1boglz67w8il1 said:
https://github.com/matem6/P2JB-Y2JB-Porting/issues/4#issuecomment-4525990306
"Running PS5 Dumps from a USB device will lead to a Kernel Panic .If anyone moved the dump to the internal storage kindly share us some update about its functionality"

So where not alone.

Adam512 · May 23, 2026

Theone5000 said:
Think I got plenty of options now:

Portable BD Burner (Pioneer BDR-XD07TB)

Rewritable Blu-Ray discs (Verbatim BD-RE SL 25GB)

Lua games (Hamidashi Creative - CUSA27389 & Raspberry Cube - CUSA16074)

LuaC0re game

View attachment 574393
View attachment 574394

nice collection, but one of the best userland is missing... yarpe

I was looking a while ago and it's almost a problem to get the game arcade spirit which was super cheap

I have the same bdrw discs as you, unfortunately I only have a CD/DVD burner... so I have to borrow a bd burner.

DuckNoir · May 23, 2026

Hey, I'm currently on firmware 10.01 using the Y2JB Autoloader (itsPLK). Is it possible yet to safely update to a higher firmware version like 12+? Also, is there any tutorial available that would make this easier for me, starting from updating the console to version 12 all the way to installing a jailbreak that runs similarly to the itsPLK autoloader?

djnino · May 23, 2026

DuckNoir said:
Ciao, attualmente ho il firmware 10.01 e utilizzo l'autoloader Y2JB (itsPLK). È già possibile aggiornare in sicurezza a una versione del firmware superiore, come la 12 o successiva? Esiste un tutorial che mi semplifichi la procedura, dall'aggiornamento della console alla versione 12 fino all'installazione di un jailbreak simile all'autoloader itsPLK?

If you really want to update, do it to version 12.00.

Search on Google for "PS5 firmware download".
Among the first results, you'll find Darthsternie's website (I don't know if I'm allowed to post external links).

Download the firmware update you want from there and update via USB.

cearp · May 23, 2026

TheStonedModder said:
I got input redirection working! No remote play needed.

Great, I remember you said here you were having trouble with it!
What's the benefit / use case of this though? Honestly asking, I haven't really touched remote play etc.

enomao94 · May 23, 2026

Well i screwed up all, cant even connect to ps5 via filezilla anymore....

HS2005 · May 23, 2026

Well it took some bloody time. Rebooting and testing, but I got it to work again.

So in general:

It's not a kstuff problem
It's not a PHU issue
It's not a SM+ problem

The problem either lies in:

The v0.6-beta1 of itsPLK autoloader
Or the download0.dat of Y2JB 1.4

Steps taken:

I always make backups of everything, so it was not that hard. Only took some time.
Back to basic. I deinstalled the YT app. Got back to v1 of Y2JB application and also the itsPLK autoloader and build up from there. If somebody wants to know the basic steps you can follow this guide:

verjanko · May 23, 2026

Theone5000 said:
Well it took some bloody time. Rebooting and testing, but I got it to work again.

So in general:

It's not a kstuff problem

It's not a PHU issue

It's not a SM+ problem

Can u play game dumps now without kp?

HS2005 · May 23, 2026

verjanko said:
Can u play game dumps now without kp?

Yes. I have added additional info what causes this and the steps I have taken.

Post automatically merged: May 23, 2026

littlemisskittn said:
And things like this is why I’m waiting for this to be more steady before trying it. Got my 11.60 slim in the meantime.

I hate to say this: but you are right. I've / we have brought this on ourselves. But hey: that's the leaning game.

TheStonedModder · May 23, 2026

cearp said:
Great, I remember you said here you were having trouble with it!
What's the benefit / use case of this though? Honestly asking, I haven't really touched remote play etc.

I like these things for making macros and bots. So that is a simple usecase. Plus with avoiding remote play more folks can use it, and there willbe a lot less latency and dropped inputs.

You could tie this in with OBS and make a bot that works in real time with games with a capture card. Kinda like the pokemon 3ds and nintendo switch bots

This can also make a PSVR2 controller..so maybe it will allow PSVR games to be played without a headset. Like the PC NOVR mods that float around.

Since I am also patching the system file directly...maybe someone can also fork my code to make something like mission control and allow xbox controllers and the like work nativly. Maybe I am also being too hopeful with the use cases lmao

flopsy · May 23, 2026

enomao94 said:
gonna try another game, in prosperopatches says my game needs another FW, so maybe its firmware related.

Ok

In case you didnt, when looking at prosperopatches its the patch version that matters and in many cases it still able to run on fw with the same SDK version/can be able to run with backporting one SDK lower (not backpork/fakelib). So you can't always go by PP alone, and instead see whats stated on the site you downloaded or .nfo.

I could be wrong about the transfer thou, and it is related to same prob as @Theone5000.

HS2005 · May 23, 2026

flopsy said:
Ok In case you didnt, when looking at prosperopatches its the patch version that matters and in many cases it still able to run on fw with the same SDK version/can be able to run with backporting one SDK lower (not backpork/fakelib). So you can't always go by PP alone, and instead see whats stated on the site you downloaded or .nfo.

I could be wrong about the transfer thou, and it is related to sme prob as @Theone5000.

I figured it out. Well isolated the issue (more or less) see my previous post. And provided a solution.

verjanko · May 23, 2026

Theone5000 said:
Yes. I have added additional info what causes this and the steps I have taken.

Post automatically merged: May 23, 2026

I hate to say this: but you are right. I've / we have brought this on ourselves. But hey: that's the leaning game.

Im using Firmware 12.40 Y2JB-P2JB V2.2+Kstuff Lite 1.05 + ShadowMountPlus 1.6test11
Not using autolader but it seems that fw 12.40 and above go kp when booting game dumps

enomao94 · May 23, 2026

flopsy said:
Ok In case you didnt, when looking at prosperopatches its the patch version that matters and in many cases it still able to run on fw with the same SDK version/can be able to run with backporting one SDK lower (not backpork/fakelib). So you can't always go by PP alone, and instead see whats stated on the site you downloaded or .nfo.

I could be wrong about the transfer thou, and it is related to sme prob as @Theone5000.

At this point im not even able to run ftp again, i screwed up all i think

TheStonedModder · May 23, 2026

Heres the shit source

https://github.com/StonedModder/Ghostpad/tree/main

zebrone · May 23, 2026

Theone5000 said:
You must find and use the elfloader.js file so you can send your .elf files. The Netflix-N-Hack uses this. When my Y2JB app is broken I use this method. As an alternative method you can also use payload_sender.py via a terminal to send files.

Dont have free space for N'Hack.
ive used payload sender.py.
I have jaibroken successfully with lapse.js..but now i need elfloader.js and ftp.js loader. Where find them?

littlemisskittn · May 23, 2026

Theone5000 said:
I hate to say this: but you are right. I've / we have brought this on ourselves. But hey: that's the leaning game.

First off, thank you for saying that. It’s so refreshing to see someone tell me that rather than just take credit and act like it was their opinion all along. So thank you. Truly.

But to go along with that, it’s more that if it confuses me or if there’s too much risk, I try not to do it. While I do like to test things (like I do with the MiSTer cores and right now the Thor with Cocoon 3), I only do so if I understand how it works. With these latest P2JB and post 12.00 developments, there’s just too much uncertainty for me to want to chance it.

KiiWii · May 23, 2026

enomao94 · May 23, 2026

restored system settings and i lost my paired disc on ps5 slim, i think its a bye bye for me

foxomok · May 23, 2026

Using independent counters should also speed up p2jb (and avoid mutex lock slowdown). My suggested changes to p2jb lua:

prepare_fds() function

Code:

    local function prepare_fds()
        -- 1. Expand the cores table to use more system threads (avoiding core 11)
        local OVERFLOW_CORES = { 0, 1, 2, 3, 4, 5, 6 }

        local core_counters = {}
        local overflow_threads = {}

        if not DEBUG_RUN_WAIT_FOR_BUMP_FROM_ELF then
            -- 2. Calculate the mathematically perfect split per core
            local num_cores = #OVERFLOW_CORES
            local amnt_per_core = math.floor(KQUEUE_EX_AMNT / num_cores)
            local remainder = KQUEUE_EX_AMNT % num_cores

            for i = 1, num_cores do
                -- Allocate an isolated 8-byte buffer for each core's private counter
                core_counters[i] = memory.alloc(8)
                memory.write_qword(core_counters[i], 0)

                -- Give the last core any remainder from the division so the total matches exactly
                local target_amount = amnt_per_core
                if i == num_cores then
                    target_amount = amnt_per_core + remainder
                end

                -- Pass the distinct buffer and the divided amount to the thread builder
                local chain = prep_kqueuex_calling(OVERFLOW_CORES[i], core_counters[i], target_amount)
                overflow_threads[i] = prim_thread:new(chain)
            end
        end

        syscall.setuid(1)

        if not DEBUG_RUN_WAIT_FOR_BUMP_FROM_ELF then
            sleep(10)

            local tids = {}
            for i = 1, #OVERFLOW_CORES do
                tids[i] = string.format("%x", overflow_threads[i]:run())
            end

            printf("overflow_chain tids: %s", table.concat(tids, ", "))

            -- 3. Monitoring helper that pools the isolated counters together
            local function get_total_count()
                local total = 0
                for i = 1, #OVERFLOW_CORES do
                    total = total + memory.read_qword(core_counters[i]):tonumber()
                end
                return total
            end

            local cur_num = get_total_count()
            local start_time = os.time()

            -- 4. Streamlined status monitoring loop
            while cur_num < KQUEUE_EX_AMNT do
                -- Sleep longer (e.g., 15 seconds) to reduce management overhead on the main core
                sleep(15)
               
                cur_num = get_total_count()

                local elapsed = os.time() - start_time
                local rate = elapsed > 0 and cur_num / elapsed or 0
                local eta_secs = rate > 0 and math.floor((KQUEUE_EX_AMNT - cur_num) / rate) or 0

                printf("overflow total: %x / %x [elapsed %is, eta %is]",
                    cur_num, KQUEUE_EX_AMNT, elapsed, eta_secs)
            end

            local elapsed = os.time() - start_time
            printf("Target overflow hit exactly! Took: %i seconds total", elapsed)
        else
            printf("waiting for a 20 seconds, for you to send the elf...")
            sleep(20)
        end
       
        -- The remainder of the original prepare_fds() function continues below...

prep_kqueuex_calling function

Code:

    local function prep_kqueuex_calling(core, cnt_buf, amnt)
        local chain = ropchain()

        -- Pin this specific worker thread to its assigned CPU core
        rop_pin_to_core(chain, core)
       
        -- Elevate its priority to real-time to avoid OS interruptions
        rop_set_rtprio(chain, 0x100)

        -- Pass the private core buffer and its specific divided limit (amnt)
        -- The loop will run safely until this core's private counter hits its quota.
        chain:gen_loop(cnt_buf, "<", amnt, function()
            -- Execute the target system call
            chain:push_syscall(syscall.kqueueex, 0x800000000000)
           
            -- Increment this thread's private counter address
            chain:push_increment_atomic_qword(cnt_buf)
        end)

        return chain
    end

PS5 Hack Status:

Preparing Your Console:

Select Your Jailbreak:

Additional Information:

Warnings:

Archived Information

The destroyer of worlds

Well-Known Member

Well-Known Member

Member

瓜老外

Well-Known Member

The destroyer of worlds

Member

The destroyer of worlds

Developer

Well-Known Member

The destroyer of worlds

Member

Well-Known Member

Developer

Well-Known Member

Attachments

SQUIRRELY WRATH!

Editorial Team

Well-Known Member

New Member

Similar threads

Popular threads in this forum