PS5 Exploit Guide

Wolf85 · Apr 8, 2025

elroche said:
With the ps4 we always had a webkit ready so you are right we used to wait for a kernel not for a webkit, now let's talk about this. The last webkit we have ( Psfree ) was patched in 2022 nearly 3 years ago, and then nothing after that we had a lot of bugs but they end up being useless for us. Theflow released pppwn up to 11.0 last year and it doesnt require a webkit, now we ask ourselves this : what if this vulnerability needed a webkit ? you think we would stay a year without a webkit for 11.0 ? No chance. Again this is just a theory on my part that I believe its tied to the ps4, if the webkit bug is not patched they aren't going to release it for the ps5 otherwise they wouldve already for the umtx kernel up to 7.61, so I think they wait to match it with the last kernel vulnerability of the ps4. If my theory is correct and we get a kernel for 12.00, a webkit will appear that its going to match that kernel so 12.00. OR this webkit thingy is starting to play with my head and I turned into a conspiracy theorist

You're still missing the process of it all.... the "webkit" is just the entry point for an exploit. Psfree as you mentioned was how they were able to get kernel access, if we had custom firmware there wouldn't be any need for any exploits because the software would be fully controllable by the user rather than the proprietor. Like windows pretends to be but Linux and other freebsd based operating systems more accurately emulate. Imagine if you bought the ps6 without any operating system and you could opt out of Sony's software in order to install your own. You wouldn't be able to connect to Sony servers but you could then just emulate your own. It's Kind of like buying a vehicle that onstar has locked out until you pay them to start the engine... it's all about greed and how it keeps our species from reaching the stars.

madbrainx · Apr 8, 2025

elroche · Apr 8, 2025

Wolf85 said:
You're still missing the process of it all.... the "webkit" is just the entry point for an exploit. Psfree as you mentioned was how they were able to get kernel access, if we had custom firmware there wouldn't be any need for any exploits because the software would be fully controllable by the user rather than the proprietor. Like windows pretends to be but Linux and other freebsd based operating systems more accurately emulate. Imagine if you bought the ps6 without any operating system and you could opt out of Sony's software in order to install your own. You wouldn't be able to connect to Sony servers but you could then just emulate your own. It's Kind of like buying a vehicle that onstar has locked out until you pay them to start the engine... it's all about greed and how it keeps our species from reaching the stars.

you didn't understand my message, you are talking like I don't know what a webkit is or how we use it. Im not missing the process its simple really, we all know that webkit is a userland exploit that needs to be chained to a kernel so we get what we call a jailbreak.

You're still missing the process of it all.... the "webkit" is just the entry point for an exploit. Psfree as you mentioned was how they were able to get kernel access

Did I insinuate otherwise in my previous messages ? if yes then show me, because thats exactly what Im talking about, we dont have a webkit because psfree was patched in 2022 (5.50) thats the reason we are waiting for a webkit to use for 6.xx and 7.xx.
We got a kernel "umtx" late 2024 on the ps5 that supports up to "7.61", the scene knew about it years ago just by seeing a line of code or something, but only up to 5.50 have a webkit (psfree) so 6.xx and 7.xx must use other userlands like LUA and BDJ.

For my theory, I believe if theflow or anyone manages to find a kernel for ps4 12.00, that needs a webkit unlike 11.0, someone somewhere sitting on a webkit vulnerability might release it so we can have a 12.00 jailbreak. We never had this much time without discovering a webkit, we were spoiled with the ps4 that we didn't think we could have a hard time discovering a webkit vulnerability. Ps4 5.05, 6.72, 7xx and 9.00 needed a webkit unlike 11.0 "pppwn" so my theory is the fact that it didn't need one so the people sitting on a vulnerabily won't release it now. Long story short my theory is that the scene is tied to the ps4 not the ps5 for now

Wolf85 · Apr 8, 2025

elroche said:
you didn't understand my message, you are talking like I don't know what a webkit is or how we use it. Im not missing the process its simple really, we all know that webkit is a userland exploit that needs to be chained to a kernel so we get what we call a jailbreak.

Did I insinuate otherwise in my previous messages ? if yes then show me, because thats exactly what Im talking about, we dont have a webkit because psfree was patched in 2022 (5.50) thats the reason we are waiting for a webkit to use for 6.xx and 7.xx.
We got a kernel "umtx" late 2024 on the ps5 that supports up to "7.61", the scene knew about it years ago just by seeing a line of code or something, but only up to 5.50 have a webkit (psfree) so 6.xx and 7.xx must use other userlands like LUA and BDJ.

For my theory, I believe if theflow or anyone manages to find a kernel for ps4 12.00, that needs a webkit unlike 11.0, someone somewhere sitting on a webkit vulnerability might release it so we can have a 12.00 jailbreak. We never had this much time without discovering a webkit, we were spoiled with the ps4 that we didn't think we could have a hard time discovering a webkit vulnerability. Ps4 5.05, 6.72, 7xx and 9.00 needed a webkit unlike 11.0 "pppwn" so my theory is the fact that it didn't need one so the people sitting on a vulnerabily won't release it now. Long story short my theory is that the scene is tied to the ps4 not the ps5 for now

Right, ps4 makes it easier to find those user land entry points, but you're missing the point that the user land exploits are the jailbreak. Which is just breaking out of the software prison that the system employs. This is the first step in giving the user read and write privileges to the system kernel. "Webkit" simple refers to the method of gaining higher. Privileges. With the ps4 there were easier ways to discover this user land vulnerabilities but with the ps5 that only affects the ps4 version of the software. The ps5 was actually first exploited with an internet protocol vulnerability, the webkit "psfree" was not discovered until a vulnerability in the system software itself was disclosed. There may be many methods to gain control of the hardware but they are only hyping up the webkit entry points due to the lack of disc drive for most systems. The entry points don't matter if they can't grant higher access and the quicker the better. The switch for example had a chip vulnerability that could bypass Nintendo checks to install custom firmware in the form of Emunand. Now imagine if someone could Crack the ps5 wide open with just jailbroken television and rest mode...I discovered that if you have your system in rest mode and then start it back up but switch the TV source manually it will go right back into rest mode so maybe we don't even need any webkit entry points. You seem to be making the claim that the webkit is the holy grail of jailbreaking when custom firmware is the highest goals..."Linux on ps6 day one"...

elroche · Apr 8, 2025

Wolf85 said:
Right, ps4 makes it easier to find those user land entry points, but you're missing the point that the user land exploits are the jailbreak. Which is just breaking out of the software prison that the system employs. This is the first step in giving the user read and write privileges to the system kernel. "Webkit" simple refers to the method of gaining higher. Privileges. With the ps4 there were easier ways to discover this user land vulnerabilities but with the ps5 that only affects the ps4 version of the software. The ps5 was actually first exploited with an internet protocol vulnerability, the webkit "psfree" was not discovered until a vulnerability in the system software itself was disclosed. There may be many methods to gain control of the hardware but they are only hyping up the webkit entry points due to the lack of disc drive for most systems. The entry points don't matter if they can't grant higher access and the quicker the better. The switch for example had a chip vulnerability that could bypass Nintendo checks to install custom firmware in the form of Emunand. Now imagine if someone could Crack the ps5 wide open with just jailbroken television and rest mode...I discovered that if you have your system in rest mode and then start it back up but switch the TV source manually it will go right back into rest mode so maybe we don't even need any webkit entry points. You seem to be making the claim that the webkit is the holy grail of jailbreaking when custom firmware is the highest goals..."Linux on ps6 day one"...

Stop bro for the love of god READ what Im saying JESUS. I literally said : "we all know that webkit is a userland exploit that needs to be chained to a kernel so we get what we call a jailbreak". this is eactly what i said.
and you responded with :

but you're missing the point that the user land exploits are the jailbreak.

I feel like you are trolling me at this point. Who said the userlands are the jailbreak ? BECAUSE I CLEARLY SAID IT NEEDS TO BE CHAINED!!!. Focus for the love of god we have a kernel exploit up to 7.61, we need a webkit so the digital PS5 users can use it since they can't use BDJ. This is why everyone is waiting for the webkit so we can utilize the umtx kernel on digital ps5s

Wolf85 · Apr 8, 2025

elroche said:
Stop bro for the love of god READ what Im saying JESUS. I literally said : "we all know that webkit is a userland exploit that needs to be chained to a kernel so we get what we call a jailbreak". this is eactly what i said.
and you responded with :

I feel like you are trolling me at this point. Who said the userlands are the jailbreak ? BECAUSE I CLEARLY SAID IT NEEDS TO BE CHAINED!!!. Focus for the love of god we have a kernel exploit up to 7.61, we need a webkit so the digital PS5 users can use it since they can't use BDJ. This is why everyone is waiting for the webkit so we can utilize the umtx kernel on digital ps5s

My point was that there is a difference between software exploits and hardware exploits... you need kernel access with software exploits, but with hardware exploits like the Tegra vulnerabilities you could simply bypass the need to gain kernel access. This is why ps5 uses 3 chips for authentication instead of just the processor chip. It mitigates all those ps4 vulnerabilities to be ps4 specific and while we can play some ps5 backups that are firmware specific we cannot use kernel access to run the newest games even though we can install them from disc after the kernel is exploited. Waiting for a new webkit exploit would not be necessary if there was a hardware based chip exploit like the switch has. That's all I was trying to say. You don't need userland chains with hardware exploits. What will they do if their internet chips stop working??? Wait for a new hardware based vulnerability of course.

elroche · Apr 8, 2025

Wolf85 said:
My point was that there is a difference between software exploits and hardware exploits... you need kernel access with software exploits, but with hardware exploits like the Tegra vulnerabilities you could simply bypass the need to gain kernel access. This is why ps5 uses 3 chips for authentication instead of just the processor chip. It mitigates all those ps4 vulnerabilities to be ps4 specific and while we can play some ps5 backups that are firmware specific we cannot use kernel access to run the newest games even though we can install them from disc after the kernel is exploited. Waiting for a new webkit exploit would not be necessary if there was a hardware based chip exploit like the switch has. That's all I was trying to say. You don't need userland chains with hardware exploits. What will they do if their internet chips stop working??? Wait for a new hardware based vulnerability of course.

OK

cragson · Apr 8, 2025

Just updated Nihonium with a first basic hex viewer for memory of the PS5.
The frontend part of it is based on a Python Flask app, which means you can run this on any device that can run python.
So in theory you can now reverse engineer the memory of your PS5 from your browser on a Windows PC, Macbook, Mobile phone etc.

It is a very early version I finished today, so a lot of things aren't very polished but I hope it will be helpful to some of you.

Regards,
cragson

E: I can't link it here nor can I attach some preview images or my preview/setup video of youtube - sorry!

zebrone · Apr 8, 2025

What's mp4?

KiiWii · Apr 8, 2025

zebrone said:
What's mp4?

A53 file structure.. so possible FPKG memes soon.

wonic · Apr 9, 2025

KiiWii said:
A53 file structure.. so possible FPKG memes soon.

Hi, hypothetically speaking if this chip is defeated, there would be no need for kstuff or etahen for versions 7.xx. I believe most people are waiting for these versions

ccfman2004 · Apr 9, 2025

wonic said:
Hi, hypothetically speaking if this chip is defeated, there would be no need for kstuff or etahen for versions 7.xx. I believe most people are waiting for these versions

You still need etaHEN and kstuff to run PS4 fPKGs and PS4 homebrew stuff like Itemzglow, the Homebrew store, etc. Defeating the A53 chip may allow PS5 fPKGs.

wonic · Apr 9, 2025

ccfman2004 said:
You still need etaHEN and kstuff to run PS4 fPKGs and PS4 homebrew stuff like Itemzglow, the Homebrew store, etc. Defeating the A53 chip may allow PS5 fPKGs.

but in this case this fpkg ps5 would only be for versions 4xx and below, correct?

AlphaBravo · Apr 9, 2025

zebrone said:
What's mp4?

Taken from twitter post. Was in Spanish.

TeRex777 said:
"mp4 handles package management (PKG), installation, decompression, and verification.

a53 (Secure Processor) handles security tasks, content validation, key management, and system integrity monitoring"

Adam512 · Apr 9, 2025

I don't think anyone is working on ps5 fpkg

AlphaBravo · Apr 9, 2025

Adam512 said:
I don't think anyone is working on ps5 fpkg

Adam512 · Apr 9, 2025

and?
this picture didn't change my opinion. In my opinion, just because someone made a simple dump doesn't mean they're working on ps5 fpkg.

It's better not to expect anything so you don't get disappointed.

I look at the screen again and it even says "someone still needs to find a bug"

in addition:
screenshots are from someone on the internet so I don't know if they actually wrote it on Discord but I believe they are true screenshots. I don't have Discord

---

---

AlphaBravo · Apr 9, 2025

Adam512 said:
and?
this picture didn't change my opinion. In my opinion, just because someone made a simple dump doesn't mean they're working on ps5 fpkg.

It's better not to expect anything so you don't get disappointed.

I look at the screen again and it even says "someone still needs to find a bug"

in addition:
screenshots are from someone on the internet so I don't know if they actually wrote it on Discord but I believe they are true screenshots. I don't have Discord

---

---

---

I think the attachment was self explanatory. No one was really talking much about Zeco a53 meme post so I assumed there wasn't much in it. Otherwise MW, Crump and whole of ps5 scene news would have been on fire. I don't have discord either but just posted what I happen to find. If it's wrong, someone can correct me

PS5 Hack Status:

Preparing Your Console:

Select Your Jailbreak:

Additional Information:

Warnings:

Archived Information

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Member

Well-Known Member

Member

Well-Known Member

Member

New Member

Well-Known Member

Attachments

Editorial Team

Member

Well-Known Member

Member

Well-Known Member

Well-Known Member

Well-Known Member

Attachments

Well-Known Member

Well-Known Member

Similar threads

Popular threads in this forum