PS5 Exploit Guide

HS2005 · Mar 5, 2026

BobaFett_UK said:
Ermmm, i just went into the PS5 into the prospero saves folder and for PPSA23226 I see the following

View attachment 560522

View attachment 560521

Post automatically merged: Mar 5, 2026

Edit:

It won't let me send you a message with the zipped files..

You can use https://www.swisstransfer.com/ or another hoster like Google drive and share it.

realtimesave · Mar 6, 2026

Blythe93 said:
Someone on Reddit recommended me this one few months ago: https://graugear.de/en/portfolio-item/g-m2dk-ac-10g/ I'm still looking to buy one myself but can't find a reasonable shipping to my country, sadly. Might have to take a look into some other enclosures with active cooling.

wow that looks cool

iguanoPT · Mar 6, 2026

Just keep in mind that nand flash performs better when hot. It's only the controller that may need a heatsink to avoid thermal throttling on sustained workloads (like big file transfers).

NVMe SSD's can actually run slower if nand is cooled too much

Optimal Write Efficiency: NAND flash memory writes data by moving electrons through a layer, and higher temperatures improve this process, reducing the voltage required to set/erase cells, which can slightly reduce wear during write cycles.

Lower Error Rates: Writing to flash cells at temperatures below 25°C can actually lead to earlier, more frequent errors in data retention compared to writing at higher temperatures (e.g., up to 85°C).

Performance: A warmer NAND chip (around 45-50°C is often considered optimal, though higher is fine) performs more reliably than a cold one, preventing issues that arise from excessive cold during write tasks.

BobaFett_UK · Mar 6, 2026

Interesting article here about whether jailbreaking a PS5 is worth doing as it more or let's cut's one off a crucial aspect of console gaming namely the online aspect! Article is also a tad skewed as it implies SWRR is needed and fails to mention firmwares upto 10.01 are already jailbroken without using SWRR or other Unicorn games... Maybe he needs to rewrite this article...!! But then again do we care?

https://www.autoevolution.com/news/...in-a-live-service-dominated-world-263552.html

Blythe93 · Mar 6, 2026

BobaFett_UK said:
Interesting article here about whether jailbreaking a PS5 is worth doing as it more or let's cut's one off a crucial aspect of console gaming namely the online aspect! Article is also a tad skewed as it implies SWRR is needed and fails to mention firmwares upto 10.01 are already jailbroken without using SWRR or other Unicorn games... Maybe he needs to rewrite this article...!! But then again do we care?

https://www.autoevolution.com/news/...in-a-live-service-dominated-world-263552.html

View attachment 560605

It seems like the author just got into jailbreaking scene.

xalfie · Mar 6, 2026

BobaFett_UK said:
Interesting article here about whether jailbreaking a PS5 is worth doing as it more or let's cut's one off a crucial aspect of console gaming namely the online aspect! Article is also a tad skewed as it implies SWRR is needed and fails to mention firmwares upto 10.01 are already jailbroken without using SWRR or other Unicorn games... Maybe he needs to rewrite this article...!! But then again do we care?

https://www.autoevolution.com/news/...in-a-live-service-dominated-world-263552.html

View attachment 560605

yes, totally. Avoid to pay anything that isn't physic format. Or, take the Microshit way, straight into oblivion.
Avoid to pay anything that is 100% online. Avoid all that shit.

Blythe93 · Mar 6, 2026

As promised, here's how I switched to Y2JB Autoloader from UMTX2 webkit exploit on my PS5, firmware 5.00. Hopefully, it'll be useful for someone. If you're on a higher firmware, you might be able to do the same thing except for the initial jailbreak method which might be different. Also note that there's an easier way to get Y2JB up and running and it's by restoring a backup which, sadly, removes all of you games, save data, profiles and all that stuff. At some point during the switch my saved games and trophies got removed so make sure to make backups before proceeding (make sure that your account is activated, offline or online, and backup your saves the official way; not sure about trophies, though).

DISCLAIMER: I am not responsible for any issues that may occur if you damage your console setup, lose save data or encounter other problems while following this guide. I created this guide because I couldn’t find a clear written guide or video that demonstrates how to install Y2JB Autoloader + ShadowMount + Backpork together. I did my best to document everything I did during the process, but it’s possible that I may have missed a step or two (hopefully not). If you notice anything that should be corrected or improved, feel free to let me know.

Please don’t follow this guide blindly if you’re unsure about what you’re doing. I highly recommend watching the videos by Modded Warfare and taking notes along the way. It can be a bit tricky to piece everything together but the learning process can be rewarding in its own way.

Anyway, in my case I've used Zeco's UMTX2 webkit exploit site which has the latest etaHEN v2.5B payload. This was the primary DNS that I was using: 62.210.38.117 (allowed me to get to the exploit page via User's Guide). At that time idlesauce's webkit exploit had etaHEN v2.4B payload and it didn't work properly on my console for some reason. Could be related to the WiFi issues I was having at that time, maybe the website didn't cache properly.

Once my console was jailbroken, I've sent the np-fake-signin-ps5.elf (get it here) with the NetCat GUI v1.3 (grabbed from the decription in one of the Modded Warfare videos) in order to activate my account offline as it will be required by Y2JB Autoloader later sometime.

I've updated kstuff to the latest v1.6.7 which is required by ShadowMount+. The easiest way to do so while you still have a valid Internet connection is to go to Debug Settings > Settings > Kstuff Menu > Replace kstuff with the latest Kstuff via Github. Check this video for more info.

I've used FileZilla in order to copy some files to the console. Adjust the guide accordingly if you're using another app.

Once done, I've rebooted the console and run the webkit exploit again in order to jailbreak the console.

USB setup:

Format the USB drive as exFAT and copy the following files to it:
- YouTube app (Got it from Modded Warfare, not sure if I can link to it here.)
- latest PS5 Xplorer from here.
- latest download0.dat from here.
- latest appinfo_editor.py script from here. (Required for blocking the YouTube app updates, it sets the version number to 99.999.999 which fools the PS servers into thinking that a newer version is already on the console. WARNING: It can lead to the database corruption so make sure to make a backup of your saves and everything else you care about.)
- latest y2jb_update.zip from here.
  - Before copying it to the USB drive, I suggest editing the autoload.txt and placing whichever payloads you want to load. In my case, I needed etaHEN-2.5B.bin, shadowmountplus.elf and ps5-backpork.elf and this is the order in autoload.txt that worked well in my case:
    Code:
    shadowmountplus.elf !1000 ps5-backpork.elf !1000 etaHEN-2.5B.bin
    !1000 = Wait 1000ms before launching the next payload. Loading a payload too soon sometimes lead to KP in my use cases so feel free to experiment, loading etaHEN the last resulted in less KPs for me at least.
  - Once done, ZIP the whole thing and name it y2jb_update.zip before you copy it to the root of the USB drive.
- Copy the ps5_autoloader folder to the root of the USB folder as well just so that you can copy it later to the internal HDD when the time is right.

Your USB setup should look like this now:

Code:

ps5_autoloader/autoload.txt
ps5_autoloader/etaHEN-2.5B.bin
ps5_autoloader/ps5-backpork.elf
ps5_autoloader/shadowmountplus.elf
y2jb_update.zip
download0.dat
appinfo_editor.py
UP4381-PPSA01650_00-YOUTUBESIEA00000.pkg <- YouTube app.
PS5_LAPY20011_v1.04.pkg <- PS5 Xplorer

After that, I've mostly followed the instructions from these two [1][2] Modded Warfare's videos on how to install Y2JB Autoloader.
Here's the summary of those two videos (make sure to check those two videos before attempting the following steps as I might have missed a step or two):

Install the YouTube and PS5 Xplorer app if you don't have them already.
You need to setup the Internet connection so that YouTube app doesn't get updated. Simply set the primary DNS to 127.0.0.2. After that, make sure that you have a valid IP address so that you can send some files via FTP server. In my case, I've already had etaHEN payload running, so I've used port 1337.
Run the YouTube app for the first time so that some specific folders get created on the internal storage. Keep it running for now, don't close it yet.
On PC, run FileZilla or similar app and connect to the console on port 1337. Go to mnt/sandbox/ and there should be PPSA01650_00 folder. If it's there, open it and select download0 folder and, if using FileZilla, right-click on it and select File Permissions. Next you need to set its numeric value to 777 and Recurse into subdirectories, Apply to all files and directories and click OK. After that, go into cache/splash_screen/aHR0cHM6Ly93d3cueW91dHViZS5jb20vdHY= and, once there remove all of the files except for the bXVzaWM folder.
Now you need to copy new set of files from this repository i.e. go to Code > Download ZIP, extract it and go into download0/cache/splash_screen/aHR0cHM6Ly93d3cueW91dHViZS5jb20vdHY=.
Before you copy the files, you can remove the ps5_autoloader folder and copy the one from the USB drive with your desired payloads and autoload.txt. Once done, copy the files to the console via FTP and while in FileZilla right-click on splash.html and go to File Permissions and enter 444. You only need to do this with the splash.html file, nothing else. (Info: I'm not sure how to update these files later sometime but since Y2JB Autoloader check on USB drive first, HDD second and splash_screen folder third, all you have to do is keep the files on HDD up-to-date and, when updating, plug in the USB drive so that those get loaded during jailbreak instead of the HDD ones which you can update afterwards.)
Launch PS5 Xplorer and copy the download0.dat file from USB drive to user/download/PPSA01650 folder, overwritting the existing file.

The following steps are optional but useful to prevent accidental YouTube app updates:

While in PS5 Xplorer, go to system_data/priv/mms and copy the appinfo.db file to the USB drive. Close the PS5 Xplorer and unplug the USB drive from your PS5.
Once you're back on PC, open the root of the USB drive where you appinfo.db file is located. While holding the Shift button, right-click and select the Open in Terminal option. Type: python appinfo_editor.py and run it. If successful, you should have appinfo.db and appinfo.org.db (this is the original file). WARNING, once again: Modifying the appinfo.db can potentially lead to database corruption if done incorrectly, resulting in loss of apps and save data.
Plug the USB drive back into the console and run PS5 Xplorer. Copy the new appinfo.db file to system_data/priv/mms, overwritting the existing. Once done, close PS5 Xplorer and reboot.
If everything's went well, if you press the Options button above YouTube app and select Information, it should say Version 99.999.999.Congrats, now your YouTube app updates are blocked!
While you still have the USB drive plugged in, run the YouTube app and, if successful, it should auto-close and have its default YouTube icon changed to the Y2JB Autoloader's one.
By now, you should have a fully working Y2JB Autoloader + ShadowMount+ + Backpork running on your console. All you need to do now is to copy the ps5_autoloader files from the USB to the /data/ps5_autoloader so that next you reboot and re-run the Y2JB Autoloader without USB drive inserted, it'll use the files from the internal HDD.

Creating the FFPKG files with fakelibs:

I'll use Astro Bot as an example in this guide.

In order to create a working Astro Bot FFPKG file, you need the dump (i.e. version of the game in extracted format with folders and files), and the backport files for your firmware (4.03 is the lowest one publicly available which works well on my 5.00 console).
For creating FFPKG files, I've used dump2ufs-gui. In case you can't find backport files for the game you want to make a FFPKG of, try PS5 Backpork Kitchen. ShadowMount+ expects FFPKGs created with fragment size set to 4096, while dump2ufs-gui sets that value automatically (in my case it was set to 2048) so just keep that in mind if the game doesn't show up once you copy it over. From what I can see, there's no way to change the fragment size in dump2ufs-gui, but you can use dump2ufs instead.

dump2ufs-gui accepts extracted game as input so you'll need to extract the game files first if you haven't dumped the game yourself. For example, Astro Bot is being distributed as 30-40GB ZIP archive which, when extracted takes around 148GB of space. Once you extract the dump, make sure to copy over the backport files, overwriting the existing files. Once done, send that folder to the dump2ufs-gui and create a FFPKG file. The bigger the dump size, the more time and space it'll take. Astro Bot FFPKG file was around 165 GB in size in the end.

Now all you have to do is copy the file to the internal storage for example. I've placed my FFPKG file in data/etaHEN/games folder. Once done, the game should appear on home screen. If not, reboot and let ShadowMount+ do its thing. If successful, it shouldn't take long for the game to appear. In my case, the game wasn't showing up on my console because the FFPKG file that I've created with dump2ufs-gui had fragment size set to 2048 while ShadowMount+ by default expects 4096. Therefore, by setting the lvd_ufs_sector_size=2048 the game in ShadowMount+ config.ini file the game finally installed and showed up properly.

Well, that's it, I guess. Have a nice day!

Rasa39 · Mar 6, 2026

For those talking earlier about m.2 enclosures, if you have a smaller 2230 or 2242 like I do, stay clear of those tiny enclosures like the one I showed earlier.

It very quickly went over 75c when using NTFS, using exFAT wasn't as bad, but it still hit 70c (speed is lower on exfat in windows, so lower temp).

I was skeptical because of the size, but it advertised max of 50-60c range, nvme's start to degrade if used at 70c for long periods, had to use extra heatsinks I had to stick on it which dropped temps by 10c but it's jank and sucks, so I'm getting a mini enclosure with a fan next.

Big passive ones work well though so long as they have decent chunks of metal like my rog arion. They sell third-party clone versions which I assume would probably perform similarly depending on build quality.

And they've got rgb for extra performance.

Tilde88 · Mar 6, 2026

hi, everyone. exciting times, eh?

BobaFett_UK · Mar 6, 2026

Blythe93 said:
As promised, here's how I switched to Y2JB Autoloader from UMTX2 webkit exploit on my PS5, firmware 5.00. Hopefully, it'll be useful for someone. If you're on a higher firmware, you might be able to do the same thing except for the initial jailbreak method which might be different. Also note that there's an easier way to get Y2JB up and running and it's by restoring a backup which, sadly, removes all of you games, save data, profiles and all that stuff. At some point during the switch my saved games and trophies got removed so make sure to make backups before proceeding (make sure that your account is activated, offline or online, and backup your saves the official way; not sure about trophies, though).

DISCLAIMER: I am not responsible for any issues that may occur if you damage your console setup, lose save data or encounter other problems while following this guide. I created this guide because I couldn’t find a clear written guide or video that demonstrates how to install Y2JB Autoloader + ShadowMount + Backpork together. I did my best to document everything I did during the process, but it’s possible that I may have missed a step or two (hopefully not). If you notice anything that should be corrected or improved, feel free to let me know.

Please don’t follow this guide blindly if you’re unsure about what you’re doing. I highly recommend watching the videos by Modded Warfare and taking notes along the way. It can be a bit tricky to piece everything together but the learning process can be rewarding in its own way.

Anyway, in my case I've used Zeco's UMTX2 webkit exploit site which has the latest etaHEN v2.5B payload. This was the primary DNS that I was using: 62.210.38.117 (allowed me to get to the exploit page via User's Guide). At that time idlesauce's webkit exploit had etaHEN v2.4B payload and it didn't work properly on my console for some reason. Could be related to the WiFi issues I was having at that time, maybe the website didn't cache properly.

Once my console was jailbroken, I've sent the np-fake-signin-ps5.elf (get it here) with the NetCat GUI v1.3 (grabbed from the decription in one of the Modded Warfare videos) in order to activate my account offline as it will be required by Y2JB Autoloader later sometime.

I've updated kstuff to the latest v1.6.7 which is required by ShadowMount+. The easiest way to do so while you still have a valid Internet connection is to go to Debug Settings > Settings > Kstuff Menu > Replace kstuff with the latest Kstuff via Github. Check this video for more info.

I've used FileZilla in order to copy some files to the console. Adjust the guide accordingly if you're using another app.

Once done, I've rebooted the console and run the webkit exploit again in order to jailbreak the console.

USB setup:

Format the USB drive as exFAT and copy the following files to it:

YouTube app (Got it from Modded Warfare, not sure if I can link to it here.)

latest PS5 Xplorer from here.

latest download0.dat from here.

latest appinfo_editor.py script from here. (Required for blocking the YouTube app updates, it sets the version number to 99.999.999 which fools the PS servers into thinking that a newer version is already on the console. WARNING: It can lead to the database corruption so make sure to make a backup of your saves and everything else you care about.)

latest y2jb_update.zip from here.

Before copying it to the USB drive, I suggest editing the autoload.txt and placing whichever payloads you want to load. In my case, I needed etaHEN-2.5B.bin, shadowmountplus.elf and ps5-backpork.elf and this is the order in autoload.txt that worked well in my case:

Code:

shadowmountplus.elf !1000 ps5-backpork.elf !1000 etaHEN-2.5B.bin

!1000 = Wait 1000ms before launching the next payload. Loading a payload too soon sometimes lead to KP in my use cases so feel free to experiment, loading etaHEN the last resulted in less KPs for me at least.

Once done, ZIP the whole thing and name it y2jb_update.zip before you copy it to the root of the USB drive.

Copy the ps5_autoloader folder to the root of the USB folder as well just so that you can copy it later to the internal HDD when the time is right.

Your USB setup should look like this now:

Code:

ps5_autoloader/autoload.txt ps5_autoloader/etaHEN-2.5B.bin ps5_autoloader/ps5-backpork.elf ps5_autoloader/shadowmountplus.elf y2jb_update.zip download0.dat appinfo_editor.py UP4381-PPSA01650_00-YOUTUBESIEA00000.pkg <- YouTube app. PS5_LAPY20011_v1.04.pkg <- PS5 Xplorer

After that, I've mostly followed the instructions from these two [1][2] Modded Warfare's videos on how to install Y2JB Autoloader.
Here's the summary of those two videos (make sure to check those two videos before attempting the following steps as I might have missed a step or two):

Install the YouTube and PS5 Xplorer app if you don't have them already.

You need to setup the Internet connection so that YouTube app doesn't get updated. Simply set the primary DNS to 127.0.0.2. After that, make sure that you have a valid IP address so that you can send some files via FTP server. In my case, I've already had etaHEN payload running, so I've used port 1337.

Run the YouTube app for the first time so that some specific folders get created on the internal storage. Keep it running for now, don't close it yet.

On PC, run FileZilla or similar app and connect to the console on port 1337. Go to mnt/sandbox/ and there should be PPSA01650_00 folder. If it's there, open it and select download0 folder and, if using FileZilla, right-click on it and select File Permissions. Next you need to set its numeric value to 777 and Recurse into subdirectories, Apply to all files and directories and click OK. After that, go into cache/splash_screen/aHR0cHM6Ly93d3cueW91dHViZS5jb20vdHY= and, once there remove all of the files except for the bXVzaWM folder.

Now you need to copy new set of files from this repository i.e. go to Code > Download ZIP, extract it and go into download0/cache/splash_screen/aHR0cHM6Ly93d3cueW91dHViZS5jb20vdHY=.

Before you copy the files, you can remove the ps5_autoloader folder and copy the one from the USB drive with your desired payloads and autoload.txt. Once done, copy the files to the console via FTP and while in FileZilla right-click on splash.html and go to File Permissions and enter 444. You only need to do this with the splash.html file, nothing else. (Info: I'm not sure how to update these files later sometime but since Y2JB Autoloader check on USB drive first, HDD second and splash_screen folder third, all you have to do is keep the files on HDD up-to-date and, when updating, plug in the USB drive so that those get loaded during jailbreak instead of the HDD ones which you can update afterwards.)

Launch PS5 Xplorer and copy the download0.dat file from USB drive to user/download/PPSA01650 folder, overwritting the existing file.

The following steps are optional but useful to prevent accidental YouTube app updates:

While in PS5 Xplorer, go to system_data/priv/mms and copy the appinfo.db file to the USB drive. Close the PS5 Xplorer and unplug the USB drive from your PS5.

Once you're back on PC, open the root of the USB drive where you appinfo.db file is located. While holding the Shift button, right-click and select the Open in Terminal option. Type: python appinfo_editor.py and run it. If successful, you should have appinfo.db and appinfo.org.db (this is the original file). WARNING, once again: Modifying the appinfo.db can potentially lead to database corruption if done incorrectly, resulting in loss of apps and save data.

Plug the USB drive back into the console and run PS5 Xplorer. Copy the new appinfo.db file to system_data/priv/mms, overwritting the existing. Once done, close PS5 Xplorer and reboot.

If everything's went well, if you press the Options button above YouTube app and select Information, it should say Version 99.999.999.Congrats, now your YouTube app updates are blocked!

While you still have the USB drive plugged in, run the YouTube app and, if successful, it should auto-close and have its default YouTube icon changed to the Y2JB Autoloader's one.

By now, you should have a fully working Y2JB Autoloader + ShadowMount+ + Backpork running on your console. All you need to do now is to copy the ps5_autoloader files from the USB to the /data/ps5_autoloader so that next you reboot and re-run the Y2JB Autoloader without USB drive inserted, it'll use the files from the internal HDD.

Creating the FFPKG files with fakelibs:

I'll use Astro Bot as an example in this guide.

In order to create a working Astro Bot FFPKG file, you need the dump (i.e. version of the game in extracted format with folders and files), and the backport files for your firmware (4.03 is the lowest one publicly available which works well on my 5.00 console).
For creating FFPKG files, I've used dump2ufs-gui. In case you can't find backport files for the game you want to make a FFPKG of, try PS5 Backpork Kitchen. ShadowMount+ expects FFPKGs created with fragment size set to 4096, while dump2ufs-gui sets that value automatically (in my case it was set to 2048) so just keep that in mind if the game doesn't show up once you copy it over. From what I can see, there's no way to change the fragment size in dump2ufs-gui, but you can use dump2ufs instead.

dump2ufs-gui accepts extracted game as input so you'll need to extract the game files first if you haven't dumped the game yourself. For example, Astro Bot is being distributed as 30-40GB ZIP archive which, when extracted takes around 148GB of space. Once you extract the dump, make sure to copy over the backport files, overwriting the existing files. Once done, send that folder to the dump2ufs-gui and create a FFPKG file. The bigger the dump size, the more time and space it'll take. Astro Bot FFPKG file was around 165 GB in size in the end.

Now all you have to do is copy the file to the internal storage for example. I've placed my FFPKG file in data/etaHEN/games folder. Once done, the game should appear on home screen. If not, reboot and let ShadowMount+ do its thing. If successful, it shouldn't take long for the game to appear. In my case, the game wasn't showing up on my console because the FFPKG file that I've created with dump2ufs-gui had fragment size set to 2048 while ShadowMount+ by default expects 4096. Therefore, by setting the lvd_ufs_sector_size=2048 the game in ShadowMount+ config.ini file the game finally installed and showed up properly.

Well, that's it, I guess. Have a nice day!

Blooming heck! I’m gonna need a couple of whiskies first before I start reading this!

Have to say, on first glance….

Wolf85 · Mar 6, 2026

BobaFett_UK said:
Interesting article here about whether jailbreaking a PS5 is worth doing as it more or let's cut's one off a crucial aspect of console gaming namely the online aspect! Article is also a tad skewed as it implies SWRR is needed and fails to mention firmwares upto 10.01 are already jailbroken without using SWRR or other Unicorn games... Maybe he needs to rewrite this article...!! But then again do we care?

https://www.autoevolution.com/news/...in-a-live-service-dominated-world-263552.html

View attachment 560605

Paid lackey. Doesn't realize we the people don't want their live service bullshit. That's the reason their bullshit industry is failing.

Post automatically merged: Mar 6, 2026

Blythe93 said:
As promised, here's how I switched to Y2JB Autoloader from UMTX2 webkit exploit on my PS5, firmware 5.00. Hopefully, it'll be useful for someone. If you're on a higher firmware, you might be able to do the same thing except for the initial jailbreak method which might be different. Also note that there's an easier way to get Y2JB up and running and it's by restoring a backup which, sadly, removes all of you games, save data, profiles and all that stuff. At some point during the switch my saved games and trophies got removed so make sure to make backups before proceeding (make sure that your account is activated, offline or online, and backup your saves the official way; not sure about trophies, though).

DISCLAIMER: I am not responsible for any issues that may occur if you damage your console setup, lose save data or encounter other problems while following this guide. I created this guide because I couldn’t find a clear written guide or video that demonstrates how to install Y2JB Autoloader + ShadowMount + Backpork together. I did my best to document everything I did during the process, but it’s possible that I may have missed a step or two (hopefully not). If you notice anything that should be corrected or improved, feel free to let me know.

Please don’t follow this guide blindly if you’re unsure about what you’re doing. I highly recommend watching the videos by Modded Warfare and taking notes along the way. It can be a bit tricky to piece everything together but the learning process can be rewarding in its own way.

Anyway, in my case I've used Zeco's UMTX2 webkit exploit site which has the latest etaHEN v2.5B payload. This was the primary DNS that I was using: 62.210.38.117 (allowed me to get to the exploit page via User's Guide). At that time idlesauce's webkit exploit had etaHEN v2.4B payload and it didn't work properly on my console for some reason. Could be related to the WiFi issues I was having at that time, maybe the website didn't cache properly.

Once my console was jailbroken, I've sent the np-fake-signin-ps5.elf (get it here) with the NetCat GUI v1.3 (grabbed from the decription in one of the Modded Warfare videos) in order to activate my account offline as it will be required by Y2JB Autoloader later sometime.

I've updated kstuff to the latest v1.6.7 which is required by ShadowMount+. The easiest way to do so while you still have a valid Internet connection is to go to Debug Settings > Settings > Kstuff Menu > Replace kstuff with the latest Kstuff via Github. Check this video for more info.

I've used FileZilla in order to copy some files to the console. Adjust the guide accordingly if you're using another app.

Once done, I've rebooted the console and run the webkit exploit again in order to jailbreak the console.

USB setup:

Format the USB drive as exFAT and copy the following files to it:

YouTube app (Got it from Modded Warfare, not sure if I can link to it here.)

latest PS5 Xplorer from here.

latest download0.dat from here.

latest appinfo_editor.py script from here. (Required for blocking the YouTube app updates, it sets the version number to 99.999.999 which fools the PS servers into thinking that a newer version is already on the console. WARNING: It can lead to the database corruption so make sure to make a backup of your saves and everything else you care about.)

latest y2jb_update.zip from here.

Before copying it to the USB drive, I suggest editing the autoload.txt and placing whichever payloads you want to load. In my case, I needed etaHEN-2.5B.bin, shadowmountplus.elf and ps5-backpork.elf and this is the order in autoload.txt that worked well in my case:

Code:

shadowmountplus.elf !1000 ps5-backpork.elf !1000 etaHEN-2.5B.bin

!1000 = Wait 1000ms before launching the next payload. Loading a payload too soon sometimes lead to KP in my use cases so feel free to experiment, loading etaHEN the last resulted in less KPs for me at least.

Once done, ZIP the whole thing and name it y2jb_update.zip before you copy it to the root of the USB drive.

Copy the ps5_autoloader folder to the root of the USB folder as well just so that you can copy it later to the internal HDD when the time is right.

Your USB setup should look like this now:

Code:

ps5_autoloader/autoload.txt ps5_autoloader/etaHEN-2.5B.bin ps5_autoloader/ps5-backpork.elf ps5_autoloader/shadowmountplus.elf y2jb_update.zip download0.dat appinfo_editor.py UP4381-PPSA01650_00-YOUTUBESIEA00000.pkg <- YouTube app. PS5_LAPY20011_v1.04.pkg <- PS5 Xplorer

After that, I've mostly followed the instructions from these two [1][2] Modded Warfare's videos on how to install Y2JB Autoloader.
Here's the summary of those two videos (make sure to check those two videos before attempting the following steps as I might have missed a step or two):

Install the YouTube and PS5 Xplorer app if you don't have them already.

You need to setup the Internet connection so that YouTube app doesn't get updated. Simply set the primary DNS to 127.0.0.2. After that, make sure that you have a valid IP address so that you can send some files via FTP server. In my case, I've already had etaHEN payload running, so I've used port 1337.

Run the YouTube app for the first time so that some specific folders get created on the internal storage. Keep it running for now, don't close it yet.

On PC, run FileZilla or similar app and connect to the console on port 1337. Go to mnt/sandbox/ and there should be PPSA01650_00 folder. If it's there, open it and select download0 folder and, if using FileZilla, right-click on it and select File Permissions. Next you need to set its numeric value to 777 and Recurse into subdirectories, Apply to all files and directories and click OK. After that, go into cache/splash_screen/aHR0cHM6Ly93d3cueW91dHViZS5jb20vdHY= and, once there remove all of the files except for the bXVzaWM folder.

Now you need to copy new set of files from this repository i.e. go to Code > Download ZIP, extract it and go into download0/cache/splash_screen/aHR0cHM6Ly93d3cueW91dHViZS5jb20vdHY=.

Before you copy the files, you can remove the ps5_autoloader folder and copy the one from the USB drive with your desired payloads and autoload.txt. Once done, copy the files to the console via FTP and while in FileZilla right-click on splash.html and go to File Permissions and enter 444. You only need to do this with the splash.html file, nothing else. (Info: I'm not sure how to update these files later sometime but since Y2JB Autoloader check on USB drive first, HDD second and splash_screen folder third, all you have to do is keep the files on HDD up-to-date and, when updating, plug in the USB drive so that those get loaded during jailbreak instead of the HDD ones which you can update afterwards.)

Launch PS5 Xplorer and copy the download0.dat file from USB drive to user/download/PPSA01650 folder, overwritting the existing file.

The following steps are optional but useful to prevent accidental YouTube app updates:

While in PS5 Xplorer, go to system_data/priv/mms and copy the appinfo.db file to the USB drive. Close the PS5 Xplorer and unplug the USB drive from your PS5.

Once you're back on PC, open the root of the USB drive where you appinfo.db file is located. While holding the Shift button, right-click and select the Open in Terminal option. Type: python appinfo_editor.py and run it. If successful, you should have appinfo.db and appinfo.org.db (this is the original file). WARNING, once again: Modifying the appinfo.db can potentially lead to database corruption if done incorrectly, resulting in loss of apps and save data.

Plug the USB drive back into the console and run PS5 Xplorer. Copy the new appinfo.db file to system_data/priv/mms, overwritting the existing. Once done, close PS5 Xplorer and reboot.

If everything's went well, if you press the Options button above YouTube app and select Information, it should say Version 99.999.999.Congrats, now your YouTube app updates are blocked!

While you still have the USB drive plugged in, run the YouTube app and, if successful, it should auto-close and have its default YouTube icon changed to the Y2JB Autoloader's one.

By now, you should have a fully working Y2JB Autoloader + ShadowMount+ + Backpork running on your console. All you need to do now is to copy the ps5_autoloader files from the USB to the /data/ps5_autoloader so that next you reboot and re-run the Y2JB Autoloader without USB drive inserted, it'll use the files from the internal HDD.

Creating the FFPKG files with fakelibs:

I'll use Astro Bot as an example in this guide.

In order to create a working Astro Bot FFPKG file, you need the dump (i.e. version of the game in extracted format with folders and files), and the backport files for your firmware (4.03 is the lowest one publicly available which works well on my 5.00 console).
For creating FFPKG files, I've used dump2ufs-gui. In case you can't find backport files for the game you want to make a FFPKG of, try PS5 Backpork Kitchen. ShadowMount+ expects FFPKGs created with fragment size set to 4096, while dump2ufs-gui sets that value automatically (in my case it was set to 2048) so just keep that in mind if the game doesn't show up once you copy it over. From what I can see, there's no way to change the fragment size in dump2ufs-gui, but you can use dump2ufs instead.

dump2ufs-gui accepts extracted game as input so you'll need to extract the game files first if you haven't dumped the game yourself. For example, Astro Bot is being distributed as 30-40GB ZIP archive which, when extracted takes around 148GB of space. Once you extract the dump, make sure to copy over the backport files, overwriting the existing files. Once done, send that folder to the dump2ufs-gui and create a FFPKG file. The bigger the dump size, the more time and space it'll take. Astro Bot FFPKG file was around 165 GB in size in the end.

Now all you have to do is copy the file to the internal storage for example. I've placed my FFPKG file in data/etaHEN/games folder. Once done, the game should appear on home screen. If not, reboot and let ShadowMount+ do its thing. If successful, it shouldn't take long for the game to appear. In my case, the game wasn't showing up on my console because the FFPKG file that I've created with dump2ufs-gui had fragment size set to 2048 while ShadowMount+ by default expects 4096. Therefore, by setting the lvd_ufs_sector_size=2048 the game in ShadowMount+ config.ini file the game finally installed and showed up properly.

Well, that's it, I guess. Have a nice day!

Thanks for the effort, I'll have to look into this later when I decide to update.

iguanoPT · Mar 6, 2026

BobaFett_UK said:
Blooming heck! I’m gonna need a couple of whiskies first before I start reading this!

Have to say, on first glance….

View attachment 560637

Sorry mate, I have to ask...

Is your liver ok?

yonasz · Mar 6, 2026

Looks like Linux is coming to ps5 with hypervisor defeated

KiiWii · Mar 6, 2026

yonasz said:
Looks like Linux is coming to ps5 with hypervisor defeated

That’s huge news

Note that no firmware version is stated, so I wonder if it’s 4.5X or 6.XX as hinted at for Linux in the past.

.. or… perhaps it’s higher. Only one man knows.

salope · Mar 6, 2026

yonasz said:
Looks like Linux is coming to ps5 with hypervisor defeated

Finally the PS5 will have games

Adam512 · Mar 6, 2026

KiiWii said:
That’s huge news

Note that no firmware version is stated, so I wonder if it’s 4.5X or 6.XX as hinted at for Linux in the past.

.. or… perhaps it’s higher. Only one man knows.

jj that's a big news, could give more information like for which FW will support be close etc..

As far as I know it could easily be on FW 12.xx because the developers have a private HV exploit for the latest FW too, of course we know that they probably won't release HV or will only release it for 1-4.xx or 1-7.xx ... Without HV, Linux is supposedly more difficult to implement but it is theoretically possible up to FW 6.xx as you write

zebrone · Mar 6, 2026

OMG

Post automatically merged: Mar 6, 2026

KiiWii said:
That’s huge news

Note that no firmware version is stated, so I wonder if it’s 4.5X or 6.XX as hinted at for Linux in the past.

.. or… perhaps it’s higher. Only one man knows.

"ETA before GTA 6.This only works with a full chain exploit like https://github.com/PS5Dev/Byepervisor…, thus only available on older FWs."

He stated...

playerman · Mar 6, 2026

He also said that he write this post on ps5 pro so it must be quite high firmware

Kanarico · Mar 6, 2026

He's using a PS5 Slim. Slims only come with 7.XX and higher.

KiiWii · Mar 6, 2026

zebrone said:
OMG

Post automatically merged: Mar 6, 2026

"ETA before GTA 6.This only works with a full chain exploit like https://github.com/PS5Dev/Byepervisor…, thus only available on older FWs."

He stated...

Yeah, so a slim with bypervisor? Doesn’t add up.

Has to be 6.xx - 7.xx at least.

Edit: yeah 7.40 approx min

PS5 Hack Status:

Preparing Your Console:

Select Your Jailbreak:

Additional Information:

Warnings:

Archived Information

The destroyer of worlds

///AMG

Well-Known Member

Well-Known Member

The Treasure Tracker

Well-Known Member

The Treasure Tracker

Pervert Deluxe

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Editorial Team

Member

Well-Known Member

Well-Known Member

Attachments

Active Member

Well-Known Member

Editorial Team

Similar threads

Popular threads in this forum