PS5 Exploit Guide

solitaire4eva · May 21, 2026

55 minutes ahhhhhh that's a no for me. Gonna have to take off one of them 5s to get me to consider using it. Yes I'm spoil.

dsos9001 · May 21, 2026

does anyone know where I can get support for homebrew on 4.03? The discord server is kind of cancer. The PS5 channel just has a bunch of idiots trolling and fighting each other.

I'm having issues with some homebrew apps. The first is that homebrew store does not launch at all, usually throwing various errors. It wouldn't launch with etahen, and now that I have switched over my workflow to sonic loader it still doesn't load EDIT home brew store now works if I just load ETA hen. My second issue is that itemzflow launches, but it does not apply any patches or cheats. I guess I could go to the GitHub directly, but I don't wanna bother them unless it's an actual bug that they can fix and I can't find help anywhere else.

Is this a good place to get support? Do any of y'all know what might be happening here? I am on a 4.03 launch PS5 by the way. Everything else works fine, I even run Linux off an external SSD.

zebrone · May 21, 2026

Theone5000 said:
HBL has more issues in regards to shadowmount + kstuff + phu. Why not use my autoload and see if it works.

Code:

elfldr-ps5.elf !3000 garlic-savemgr.elf !3000 shadowmountplus.elf !3000 kstuff.elf !3000 phu_overlay.elf

Used your config:

Even if ive disabled kstuff pause
(put it on 0 on shadowmount config.ini),it continues to stop after 25 seconds...why
There is also an autotune.ini...

lufeig · May 21, 2026

P2JB-Y2JB working!

I was just waiting for this to try to BD-UN-JB my fat PS5 Spiderman 2 edition to sell it!

https://github.com/matem6/P2JB-Y2JB-Porting

HS2005 · May 21, 2026

zebrone said:
Used your config:

Even if ive disabled kstuff pause
(put it on 0 on shadowmount config.ini),it continues to stop after 25 seconds...why
There is also an autotune.ini...

You don't have to disable kstuff. It's all auto. autotune.ini is for specific games... To pauze kstuff > so kstuff_delay after x seconds.

My config:

Code:

# ShadowMount runtime config example
# Place as: /data/shadowmount/config.ini
#
# This file is a template.
# Nothing below is active until you remove the leading '#'.
#
# How to use this file:
# 1. Uncomment only the parameters you really want to override.
# 2. Lines that start with '# key=value' are real parameters you can uncomment directly.
# 3. Lines that start with '##' are examples/templates only. Edit them before use.

# Debug logging:
# 1/true/yes/on  -> enable log_debug output to console and /data/shadowmount/debug.log
# 0/false/no/off -> disable log_debug output
# Default: 1
# debug=1

# Quiet mode:
# 1/true/yes/on  -> only show the startup version popup and runtime errors
# 0/false/no/off -> also show normal informational popups
# Default: 0
# quiet_mode=0

# Global mount mode:
# 1/true/yes/on/ro  -> read-only mounts
# 0/false/no/off/rw -> read-write mounts
# Default: 1
# mount_read_only=1

# Mounting even damaged file systems:
# 1/true/yes/on  -> include force option
# 0/false/no/off -> default mount options
# Default: 0
# force_mount=0

# Use batch registration for newly staged titles:
# 1/true/yes/on  -> submit queued installs through sceAppInstUtilAppInstallAll
# 0/false/no/off -> register each title directly
# Default: 0 on FW below 12.00, forced to 1 on FW 12.00 and newer
# app_install_all=0

# Scan depth relative to each scan root:
# 1 -> scan only first-level subdirectories
# 2 -> also scan one additional nested level
# Default: 1
# scan_depth=1

# Legacy compatibility:
# recursive_scan=1 forces scan_depth=2
# Default: disabled
# recursive_scan=0

# Full scan loop interval (seconds), range: 1..3600
# Default: 60
# scan_interval_seconds=60

# Source stabilization wait window (seconds), range: 0..3600
# If source mtime/ctime is newer than this window, it will be deferred to next scan.
# Default: 10
# stability_wait_seconds=10

# Backend selection per filesystem:
# lvd   -> /dev/lvdctl -> /dev/lvdN
# md    -> /dev/mdctl  -> /dev/mdN
# Defaults: exfat=lvd, ufs=lvd
# exfat_backend=lvd
# ufs_backend=lvd

# Sandbox fakelib backport watcher:
# 1/true/yes/on  -> mount /mnt/sandbox/<TITLE_ID>_XXX/app0/fakelib into common/lib
# 0/false/no/off -> disable fakelib watcher
# Default: 1
backport_fakelib=1

# Auto-manage kstuff around game launches:
# 1/true/yes/on  -> pause kstuff after game launch, resume immediately on stop
# 0/false/no/off -> leave kstuff state untouched
# Default: 1
kstuff_game_auto_toggle=0

# Detect likely early crashes after auto-pause and autotune pause delay:
# 1/true/yes/on  -> enable crash heuristic and autotune updates
# 0/false/no/off -> disable crash detection/autotune logic
# Default: 0
kstuff_crash_detection=0

# Delay before pausing kstuff for image-backed titles.
# Default: 25
kstuff_pause_delay_image_seconds=45

# Delay before pausing kstuff for direct/non-image launches.
# Default: 15
kstuff_pause_delay_direct_seconds=45

# Backend-specific sector size overrides:
# Defaults: lvd_exfat=512, lvd_ufs=4096, lvd_pfs=32768, md_exfat=512, md_ufs=512
# lvd_exfat_sector_size=512
# lvd_ufs_sector_size=4096
# lvd_pfs_sector_size=32768
# md_exfat_sector_size=512
# md_ufs_sector_size=512

# Optional custom scan roots (can be repeated):
# If at least one scanpath=... is present, only these paths are used.
# "/mnt/shadowmnt" is always added automatically.
# Default: use built-in scan path list
# scanpath=/data/homebrew

## Per-image mount mode override by file name (repeatable):
## image_ro=<image_filename>
## image_rw=<image_filename>
## image_sector=<image_filename>:<sector_size>
##
## Examples:
## image_ro=PPSA12345.ffpfs
## image_rw=My Game Dump.exfat
## image_sector=My Game Dump.exfat:65536

## Keep kstuff enabled for specific title IDs (repeatable):
## kstuff_no_pause=PPSA12345

## Override pause delay for specific title IDs (repeatable):
## Format: TITLEID:SECONDS
## kstuff_delay=PPSA12345:30

## More custom scan root examples:
## scanpath=/data/homebrew
## scanpath=/data/etaHEN/games

enomao94 · May 21, 2026

lufeig said:
P2JB-Y2JB working!

I was just waiting for this to try to BD-UN-JB my fat PS5 Spiderman 2 edition to sell it!

https://github.com/matem6/P2JB-Y2JB-Porting

i still not recieved my bluray burner, can i use this after the lua process? i dont have youtube app downloaded.

otherwise i can wait a few days

TheStonedModder · May 21, 2026

enomao94 said:
i still not recieved my bluray burner, can i use this after the lua process? i dont have youtube app downloaded.

otherwise i can wait a few days

I recommend the iso I forked it has the latest poops and curse fixes

https://github.com/StonedModder/Themed-BD-UN-JB-Poops-Autoloader/releases

zebrone · May 21, 2026

Theone5000 said:

You don't have to disable kstuff. It's all auto. autotune.ini is for specific games... To pauze kstuff > so kstuff_delay after x seconds.

My config:

Code:

# ShadowMount runtime config example
# Place as: /data/shadowmount/config.ini
#
# This file is a template.
# Nothing below is active until you remove the leading '#'.
#
# How to use this file:
# 1. Uncomment only the parameters you really want to override.
# 2. Lines that start with '# key=value' are real parameters you can uncomment directly.
# 3. Lines that start with '##' are examples/templates only. Edit them before use.

# Debug logging:
# 1/true/yes/on  -> enable log_debug output to console and /data/shadowmount/debug.log
# 0/false/no/off -> disable log_debug output
# Default: 1
# debug=1

# Quiet mode:
# 1/true/yes/on  -> only show the startup version popup and runtime errors
# 0/false/no/off -> also show normal informational popups
# Default: 0
# quiet_mode=0

# Global mount mode:
# 1/true/yes/on/ro  -> read-only mounts
# 0/false/no/off/rw -> read-write mounts
# Default: 1
# mount_read_only=1

# Mounting even damaged file systems:
# 1/true/yes/on  -> include force option
# 0/false/no/off -> default mount options
# Default: 0
# force_mount=0

# Use batch registration for newly staged titles:
# 1/true/yes/on  -> submit queued installs through sceAppInstUtilAppInstallAll
# 0/false/no/off -> register each title directly
# Default: 0 on FW below 12.00, forced to 1 on FW 12.00 and newer
# app_install_all=0

# Scan depth relative to each scan root:
# 1 -> scan only first-level subdirectories
# 2 -> also scan one additional nested level
# Default: 1
# scan_depth=1

# Legacy compatibility:
# recursive_scan=1 forces scan_depth=2
# Default: disabled
# recursive_scan=0

# Full scan loop interval (seconds), range: 1..3600
# Default: 60
# scan_interval_seconds=60

# Source stabilization wait window (seconds), range: 0..3600
# If source mtime/ctime is newer than this window, it will be deferred to next scan.
# Default: 10
# stability_wait_seconds=10

# Backend selection per filesystem:
# lvd   -> /dev/lvdctl -> /dev/lvdN
# md    -> /dev/mdctl  -> /dev/mdN
# Defaults: exfat=lvd, ufs=lvd
# exfat_backend=lvd
# ufs_backend=lvd

# Sandbox fakelib backport watcher:
# 1/true/yes/on  -> mount /mnt/sandbox/<TITLE_ID>_XXX/app0/fakelib into common/lib
# 0/false/no/off -> disable fakelib watcher
# Default: 1
backport_fakelib=1

# Auto-manage kstuff around game launches:
# 1/true/yes/on  -> pause kstuff after game launch, resume immediately on stop
# 0/false/no/off -> leave kstuff state untouched
# Default: 1
kstuff_game_auto_toggle=0

# Detect likely early crashes after auto-pause and autotune pause delay:
# 1/true/yes/on  -> enable crash heuristic and autotune updates
# 0/false/no/off -> disable crash detection/autotune logic
# Default: 0
kstuff_crash_detection=0

# Delay before pausing kstuff for image-backed titles.
# Default: 25
kstuff_pause_delay_image_seconds=45

# Delay before pausing kstuff for direct/non-image launches.
# Default: 15
kstuff_pause_delay_direct_seconds=45

# Backend-specific sector size overrides:
# Defaults: lvd_exfat=512, lvd_ufs=4096, lvd_pfs=32768, md_exfat=512, md_ufs=512
# lvd_exfat_sector_size=512
# lvd_ufs_sector_size=4096
# lvd_pfs_sector_size=32768
# md_exfat_sector_size=512
# md_ufs_sector_size=512

# Optional custom scan roots (can be repeated):
# If at least one scanpath=... is present, only these paths are used.
# "/mnt/shadowmnt" is always added automatically.
# Default: use built-in scan path list
# scanpath=/data/homebrew

## Per-image mount mode override by file name (repeatable):
## image_ro=<image_filename>
## image_rw=<image_filename>
## image_sector=<image_filename>:<sector_size>
##
## Examples:
## image_ro=PPSA12345.ffpfs
## image_rw=My Game Dump.exfat
## image_sector=My Game Dump.exfat:65536

## Keep kstuff enabled for specific title IDs (repeatable):
## kstuff_no_pause=PPSA12345

## Override pause delay for specific title IDs (repeatable):
## Format: TITLEID:SECONDS
## kstuff_delay=PPSA12345:30

## More custom scan root examples:
## scanpath=/data/homebrew
## scanpath=/data/etaHEN/games

I might not have explained myself clearly before. By default, due to the .ini file settings in Shadow Mount Plus, the k-stuff function was being disabled automatically after 30 seconds.
To prevent this, I went into the Shadow Mount Plus configuration file and set the value to 0, because I do not want it to be disabled automatically; I want to disable it manually myself.
So, in the .ini file, I set k-staff_pause = 0 (or disable_key_staff = 0). The problem is that it keeps disabling itself automatically anyway, which is exactly what I don't want, even though I configured the value to zero in the config file.

On Ini file, my string:

kstuff_game_auto_toggle=0

Is set to zero.

But it continues to automatically disables itself...

enomao94 · May 21, 2026

TheStonedModder said:
I recommend the iso I forked it has the latest poops and curse fixes

https://github.com/StonedModder/Themed-BD-UN-JB-Poops-Autoloader/releases

if i need a burner then nothing can i do until tomorrow or saturday

HS2005 · May 21, 2026

zebrone said:
I might not have explained myself clearly before. By default, due to the .ini file settings in Shadow Mount Plus, the k-stuff function was being disabled automatically after 30 seconds.
To prevent this, I went into the Shadow Mount Plus configuration file and set the value to 0, because I do not want it to be disabled automatically; I want to disable it manually myself.

But it continues to automatically disables itself...

I understand you. You explained it clear enough.
With my setup I can't enable / disable kstuff. Don't need to because it's auto disabled and works fine in games. That is what phu does and is prob. needed. That's what I try to tell is to keep everything basic. So standard settings.

Try this latest version: https://cdn.discordapp.com/attachme...f7e1b64727c430ddda07e65b07fec0ff6be4bcc0dce6&

Post automatically merged: May 21, 2026

TheStonedModder said:
I recommend the iso I forked it has the latest poops and curse fixes

https://github.com/StonedModder/Themed-BD-UN-JB-Poops-Autoloader/releases

These themes are quite nice

enomao94 · May 21, 2026

got this using the new lua after the process is done, is this error?

szczuru · May 21, 2026

lufeig said:
P2JB-Y2JB working!

I was just waiting for this to try to BD-UN-JB my fat PS5 Spiderman 2 edition to sell it!

https://github.com/matem6/P2JB-Y2JB-Porting

Does anyone have backup with youtibe app installed which i can restore? I'm on 12.40.

lufeig · May 21, 2026

szczuru said:
Does anyone have backup with youtibe app installed which i can restore? I'm on 12.40.

y2jb github page has it

Henry1887 · May 21, 2026

enomao94 said:
View attachment 574172
got this using the new lua after the process is done, is this error?

getting the same error consistently

enomao94 · May 21, 2026

Henry1887 said:
getting the same error consistently

fw 11.60 here, using garlicsaves to do the save stuff :/

Galima · May 21, 2026

Hello is this Good ,after finish i can load bd jb autoloader newest to skip kernel panic after close you tube ,is that right

ThePSGuy · May 21, 2026

Theone5000 said:
Other source:

PlayStation 5 jailbreak (firmware 9.00 – 12.40, tested on 11.60) — a port of Gezine / cheburek3000's p2jb kernel exploit (cr_ref overflow via kqueueex) from the luac0re (lua-loader) host to Y2JB (YouTube / V8 JavaScript host).

Confirmed working: jailbreak end-to-end + debug menu + USB-loaded elfldr_1320 + persistent unpatcher delivery.

Link: https://github.com/matem6/P2JB-Y2JB-Porting

Amazing news, finally my time has come!

I can confirm it worked first try on my 12.00 console with an estimated wait time of 1 hour and 50 minutes (didn’t timed it exactly) and I was able to unpatch the Blu-ray afterwards.

As mentioned in the GitHub description, don’t immediately send the P2JB after launching the YouTube app, it is recommended to wait 1 minute, I waited 2-3 minutes in my case just to be extra safe.

Unfortunately I don’t have a Blu-ray burner at hand so I express ordered one for tomorrow and I will get back to you guys to confirm but it should work fine, the hardest part is done.

Also, while I am at it, I asked on this thread before but couldn’t get a clear answer: I made a backup before using the Y2JB one and just restored it after unpatching the Blu-ray. Will that erase the unpatching? I hope not…

littlemisskittn · May 21, 2026

Question for those in the know. For people like me on 12.40 with a Pro that has a paired blu ray drive, wouldn’t loading that backup for Y2JB unpair the drive?

ThePSGuy · May 21, 2026

Galima said:
Hello is this Good ,after finish i can load bd jb autoloader newest to skip kernel panic after close you tube ,is that right

Don’t forget to send the BD JB unpatch payload before closing the app.

But yes, the console will kernel panic and you will have a storage maintenance popup upon next boot (nothing to fear).

Draco_011 · May 21, 2026

Damn keys.. I guess I will hold 3.21 a little longer... However does anyone know if there is or there will be a way to use the m2 in this 3.21 version? this is the last week that I can return it to Amazon :rofl2:

PS5 Hack Status:

Preparing Your Console:

Select Your Jailbreak:

Additional Information:

Warnings:

Archived Information

Fickly Member

New Member

Well-Known Member

Well-Known Member

The destroyer of worlds

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

The destroyer of worlds

Well-Known Member

Well-Known Member

Well-Known Member

Member

Well-Known Member

Member

Attachments

Well-Known Member

SQUIRRELY WRATH!

Well-Known Member

Member

Similar threads

Popular threads in this forum