PS5 Exploit Guide

AtelierRyza · Oct 3, 2025

Emris93 said:
You can do it by installing pkg file also.

How can you install pkg file without debug settings available?

Rasa39 · Oct 3, 2025

lufeig said:
His finding is out of scope of hackerone, since the games affected by LUA exploit are developed by third party entities, not Sony.

So, that also includes the Y2JB now too doesn't it, since it's third party...well, shot themselves in the foot with that one huh, I wonder if that's why for ps5 they didn't bother adding licences to the media apps for ps5.

Kinda scummy really though, like do you want to secure your console or not? Devs are not gonna care at all to conceal an exploit they find and later ask for disclosure, if they know there isn't gonna be a pay out at all...unless they wanna wait to check for higher firmware compatibility etc.

I'm sure their investors will be over the moon if any of this hard work can be used to exploit next-gen consoles, when Sony turns around and says "uh yeah but we don't pay for bugs on third party apps so, with no incentive for collaboration from these developers...we just wait for them to release publicly, then panic trying to patch it out"

I bet they are going crazy with security on the PS6 with 2 huge third party enabled exploits that are mostly firmware agnostic.

Shit they might even switch to those new fancy nvidia APU's that are on the horizon.

lufeig · Oct 3, 2025

Rasa39 said:
So, that also includes the Y2JB now too doesn't it, since it's third party...well, shot themselves in the foot with that one huh, I wonder if that's why for ps5 they didn't bother adding licences to the media apps for ps5.

Kinda scummy really though, like do you want to secure your console or not? Devs are not gonna care at all to conceal an exploit they find and later ask for disclosure, if they know there isn't gonna be a pay out at all...unless they wanna wait to check for higher firmware compatibility etc.

I'm sure their investors will be over the moon if any of this hard work can be used to exploit next-gen consoles, when Sony turns around and says "uh yeah but we don't pay for bugs on third party apps so, with no incentive for collaboration from these developers...we just wait for them to release publicly, then panic trying to patch it out"

I bet they are going crazy with security on the PS6 with 2 huge third party enabled exploits that are mostly firmware agnostic.

Shit they might even switch to those new fancy nvidia APU's that are on the horizon.

being out of scope of hackerone doesn't mean sony won't fix the bug.

it means they won't pay a dev for discovering a bug not caused by their own software, which I consider very plausible according to the rules.

Emris93 · Oct 3, 2025

AtelierRyza said:
How can you install pkg file without debug settings available?

Oh, you will need the backup, so yes, this will erase the entire console unfortunately.

Rasa39 · Oct 3, 2025

lufeig said:
being out of scope of hackerone doesn't mean sony won't fix the bug.

it means they won't pay a dev for discovering a bug not caused by their own software, which I consider very plausible according to the rules.

Oh yeah I understand that, I just mean it seems in their best interest to include those types of fixes within hackerone, even if they end up giving lower payouts or different types of incentives etc.

I guess they'd probably just sue the company if it was gonna cause Sony so much grief, say in this instance, blaming google for "allowing" an exploitable version of their app to be submitted to the psn network. But I'm no big city lawyer now so I'm just blabbing.

HS2005 · Oct 3, 2025

Emris93 said:
You can do it by installing pkg file also.

And how would you install the PKG that has been released on a non-jailbroken PS5?

UnderJinx · Oct 3, 2025

Theone5000 said:
And how would you install the PKG that has been released on a non-jailbroken PS5?

He already explained that 2 posts ago

lufeig · Oct 3, 2025

Rasa39 said:
Oh yeah I understand that, I just mean it seems in their best interest to include those types of fixes within hackerone, even if they end up giving lower payouts or different types of incentives etc.

I guess they'd probably just sue the company if it was gonna cause Sony so much grief, say in this instance, blaming google for "allowing" an exploitable version of their app to be submitted to the psn network. But I'm no big city lawyer now so I'm just blabbing.

me too! lol

autumns · Oct 3, 2025

here’s everything y’all need to know about Y2JB:

1. it hasn’t been released yet. the backup gezine posted just crashes the app to test if the vulnerable code works correctly on all firmwares, which it does.

2. when the exploit does release there will be 2 ways to use it. the first is if you already have a JB and want to preserve your data, you can install the affected youtube pkg and then add the exploit files over FTP. the second is if you cannot FTP, you’ll have to use a backup and wipe your console. there is unfortunately no way around that right now. yes, you could get the youtube app by using external storage but you can’t add the exploit without FTP.

3. the patch gezine posted to bypass the psn pop-up is not related to the exploit, the exploit will run automatically even without this patch. they just developed the patch to make debugging less annoying for them and decided to share it in case you want to use the youtube app normally.

4. if you want to prepare your console and you already have JB, you can install the youtube 1.000.003 pkg from prospero-patches as this is probably the update the exploit will use. you will need to add the exploit over FTP when it is released. when downloading from prospero-patches you need to merge the sc file and the pkg file, look up a tutorial on youtube (lol).

5. if you want to prepare your console and you don’t have JB already just wait. you will need a special backup with the exploit built-in created by gezine which doesn’t exist yet. there is no reason to install a backup right now as you’ll need to overwrite it when the exploit does drop, and if you have an activated console it’s worth waiting on the off-chance they find a way to install the exploit without wiping the console when it releases.

6. the reason people are very confident that youtube will lead to a userland exploit is that each update can be installed on any console with no license, and each update comes with a specific build of a browser built in. the 1.000.003 update is built on a 5 year old chrome-based browser with dozens of known exploits. we have a working POC of one bug from 2021 already working which is what we’re testing. but even if this particular bug doesn’t end up panning out for one reason or another, there are dozens of other known bugs in this version of the browser to try. and if there are no exploitable bugs in 1.000.003 there are 5 other updates from the past 5 years that each have their own set of dozens of possible exploits. the attack surface here is huge and with enough time it’s practically guaranteed that one of the known exploits for this browser will work with the stripped down version in the youtube app. it’s almost as if we could just downgrade the ps5 browser to one that we know has exploits whenever we want. that’s why it’s so crazy good.

solitaire4eva · Oct 3, 2025

All this cause of a big billionaire dollar company screwed over a legit by the book developer.

Rasa39 said:
Also I have been saying it as "Ge-zeen", like magazine, brit innit...

I swear I thought they were talking about somebody else cause just like you he been "Ge-Zeen" in my head for longest time!

CyberMarco · Oct 4, 2025

Following the tutorial for LUA, I can't get the following to work:

5. Join the HTOS Discord group: HERE type "/decrypt", select "FALSE" for including SCE_SYS, paste or type in the Google Drive link, and press enter. The bot should begin mounting your save. (If it doesn't, paste in the link again.)
6. Click "ENCRYPTED" to remove the Sony PFS layer. Download the generated files and extract the folder to your desktop (you should have 4 files in there and be named dec_savedata_CUSA[GAME ID]).

I don't get any ''ENCRYPTED'' option to click. Only Download, that let's me download a .zip file (dec_savedata_CUSA17112_MxfcqjHK40.zip)

PS5 Phat FW 9.40, with activated PSN account

madbrainx · Oct 4, 2025

@CyberMarco try this one:
https://gbatemp.net/threads/ps5-exploit-guide.613891/post-10675109

Wolf85 · Oct 4, 2025

solitaire4eva said:
LOL I said like two months ago, this was gonna happen. I just got my Lua game working like a week or two ago and now this. Well at least I only paid $34 for it. Now its worth 3 Fiddy. $3.50

Tree fiddy. Lol

Post automatically merged: Oct 4, 2025

autumns said:
here’s everything y’all need to know about Y2JB:

1. it hasn’t been released yet. the backup gezine posted just crashes the app to test if the vulnerable code works correctly on all firmwares, which it does.

2. when the exploit does release there will be 2 ways to use it. the first is if you already have a JB and want to preserve your data, you can install the affected youtube pkg and then add the exploit files over FTP. the second is if you cannot FTP, you’ll have to use a backup and wipe your console. there is unfortunately no way around that right now. yes, you could get the youtube app by using external storage but you can’t add the exploit without FTP.

3. the patch gezine posted to bypass the psn pop-up is not related to the exploit, the exploit will run automatically even without this patch. they just developed the patch to make debugging less annoying for them and decided to share it in case you want to use the youtube app normally.

4. if you want to prepare your console and you already have JB, you can install the youtube 1.000.003 pkg from prospero-patches as this is probably the update the exploit will use. you will need to add the exploit over FTP when it is released. when downloading from prospero-patches you need to merge the sc file and the pkg file, look up a tutorial on youtube (lol).

5. if you want to prepare your console and you don’t have JB already just wait. you will need a special backup with the exploit built-in created by gezine which doesn’t exist yet. there is no reason to install a backup right now as you’ll need to overwrite it when the exploit does drop, and if you have an activated console it’s worth waiting on the off-chance they find a way to install the exploit without wiping the console when it releases.

6. the reason people are very confident that youtube will lead to a userland exploit is that each update can be installed on any console with no license, and each update comes with a specific build of a browser built in. the 1.000.003 update is built on a 5 year old chrome-based browser with dozens of known exploits. we have a working POC of one bug from 2021 already working which is what we’re testing. but even if this particular bug doesn’t end up panning out for one reason or another, there are dozens of other known bugs in this version of the browser to try. and if there are no exploitable bugs in 1.000.003 there are 5 other updates from the past 5 years that each have their own set of dozens of possible exploits. the attack surface here is huge and with enough time it’s practically guaranteed that one of the known exploits for this browser will work with the stripped down version in the youtube app. it’s almost as if we could just downgrade the ps5 browser to one that we know has exploits whenever we want. that’s why it’s so crazy good.

How does the external storage method work, do you transfer the app from one ps5 to another using external drive? I suppose if that's the case they both have to be on the same firmware correct? I have the lua demos on my psn 12.02 but my main jailbreak ps5 is on 2.50. I will try to use the lower firmwares system to install the affected app and see if I can use that external drive to transfer to the updated system, haven't tried that yet, but I know that the external drive from my updated system wants to update the jailbreak system when plugged in. I will just have to do some experimenting.

solitaire4eva · Oct 4, 2025

Wolf85 said:
Tree fiddy. Lol

Post automatically merged: Oct 4, 2025

How does the external storage method work, do you transfer the app from one ps5 to another using external drive? I suppose if that's the case they both have to be on the same firmware correct? I have the lua demos on my psn 12.02 but my main jailbreak ps5 is on 2.50. I will try to use the lower firmwares system to install the affected app and see if I can use that external drive to transfer to the updated system, haven't tried that yet, but I know that the external drive from my updated system wants to update the jailbreak system when plugged in. I will just have to do some experimenting.

I heard the minimal FW requirement was 4.03

when the exploited version was released.

ccfman2004 · Oct 4, 2025

The affected YT app version requires 4.03 or higher.

Wolf85 · Oct 4, 2025

Well I got the app to install on my 2.50 but I can't get into the storage option on the system to move it to external, I will try ftp

I suppose I should also try the crash test file.

BobaFett_UK · Oct 4, 2025

Jeeze what have I missed since my last log on here. YouTube? I’m still patiently waiting for my over priced Lua game to arrive from PlayAsia

Talking of which I thought I’d play around with my 11.6 system when a Hamidashi demo. Used the instructions on the beginning of this thread. When I started the demo again on the PS5 I hit a screen which said Lua loading (or something like that) and pressed the OK button. Then just a blank screen. Nothing. Pressed the PS button and all I could see was the bottom menu then got back to the Home Screen. Checked in settings and couldn’t see any hen status.

AlphaBravo · Oct 4, 2025

Not to fussed about Gezine nick. Just call him "G Money" now. Not fussed about selling my LUA game. Was one of the first batch of supported games. Will keep as a Keepsake, memory of this fascinating chapter in ps5 scene where the floodgates started to open. I said many times that 2025 would be a great year. Will there be time for Hen2 though? Only Flatz knows...

Rasa39 · Oct 4, 2025

AlphaBravo said:
Not to fussed about Gezine nick. Just call him "G Money" now. Not fussed about selling my LUA game. Was one of the first batch of supported games. Will keep as a Keepsake, memory of this fascinating chapter in ps5 scene where the floodgates started to open.

Yeah not sure if I'll bother selling it either, probably should but...I still have my boxed gateway 3DS cards so... Plus I sold cubic ninja for £8 (It was my first 3ds game cos it was the cheapest one I could afford, had no idea what it was gonna turn into), turns out my timing sucks for selling at high value lol.

I did make sure to get the platinum trophy for Jinki, just so people know I'm definitely playing it as a weeb...nothing else...

PhantonXX360 · Oct 4, 2025

I'm yet to see a firmware more ignored than 3.00, everything requires 4.03, I've been holding the wave for 2 years now, I don't think I can take it anymore, even if I had HV, what would change? Whoever is on 2xx is worse off than me.

Post automatically merged: Oct 4, 2025

solitaire4eva said:
I heard the minimal FW requirement was 4.03 when the exploited version was released.

Why are you in which one? I'm in 3.00

Post automatically merged: Oct 4, 2025

Wolf85 said:
Well I got the app to install on my 2.50 but I can't get into the storage option on the system to move it to external, I will try ftp

I suppose I should also try the crash test file.

How long have you been at 2.50, friend? Will you continue?

PS5 Hack Status:

Preparing Your Console:

Select Your Jailbreak:

Additional Information:

Warnings:

Archived Information

Well-Known Member

Pervert Deluxe

Well-Known Member

Well-Known Member

Pervert Deluxe

The destroyer of worlds

Well-Known Member

Well-Known Member

Well-Known Member

Fickly Member

New Member

Well-Known Member

Well-Known Member

Fickly Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Pervert Deluxe

Active Member

Similar threads

Popular threads in this forum