PS5 Exploit Guide

zebrone · 2026-09-25T21:39:36+0100

solitaire4eva said:
I just been using them 4 files in that order below in my autoloader so I dont have to think about what's going on lol. Now drakmor is constantly updating so better versions with better options are probably out. I'm not changing unless a game comes out that is not compatible.

kstuff-1.12-dr-test8-1.elf

a53_ppr_install_fast_15.09-1.elf

shadowmountplus 1.7alpha13fix1-2

ps5-backpork (1)-1.elf

Am i wrong or new kstuff of Drakmor has a53_ppr inside?

playerman · 2026-09-25T21:44:00+0100

Adam512 said:
I sold my PS5 (firmware 6.50) and bought a new PS5 Pro, updating it to 13.60. Now I'll be keeping an eye on Linux-related news in the scene

Im also thinking about selling my 6.50 for a good price. I have bought almost new banned 13.40 few months ago for so cheap that i couldnt resist and now i will be able to use it

. Then sell my old one and get some proper cash. I basically just play games on it so i will not loose anything (maybe fpkg but im used to external drive by now). Was thinking about PRO but i have a good PC so dont need it.

Davide6 · 2026-09-25T21:58:32+0100

playerman said:
Im also thinking about selling my 6.50 for a good price. I have bought almost new banned 13.40 few months ago for so cheap that i couldnt resist and now i will be able to use it . Then sell my old one and get some proper cash. I basically just play games on it so i will not loose anything (maybe fpkg but im used to external drive by now). Was thinking about PRO but i have a good PC so dont need it.

My PS5 auction ended today; I managed to sell my PS5 (firmware 6.50) with the disc drive for a pretty high price.

Tomorrow, I’m going to buy a PS5 Pro and pair the disc drive to firmware 13.60. I’ll buy console in person at a store because I don't have much time left to handle drive pairing process for 13.60

Post automatically merged: Yesterday at 9:59 PM

I'll keep it offline then and try to sell it after some time.

Kanarico · 2026-09-25T22:13:46+0100

zebrone said:
Am i wrong or new kstuff of Drakmor has a53_ppr inside?

That's correct. Starting with 1.13. Also solitaire4eva shouldn't be including the backport payload when using sm+ since it's already included and having the separate payload may conflict.

ViRGE · 2026-09-25T22:26:35+0100

BobaFett_UK said:
Chaps, when we have a FPKG and Drakmor releases say a new ampr-emu file... then where do we place it? Pre FPKG, I was using the native dump and it was was to replace any files into the dumps folder...?.

You don't place it anywhere. ampr_emu is not needed for fPKG games. Since we're using Sony's native package format and execution flow, we don't have to emulate ampr; we have the real thing.

This is one of the many (many) perks of fPKGs.

Adamos_22 said:
nanoDNS 0.4

IPv6 support

Quiet mode

Yandex.DNS fix (remove old nanodns.ini)

FW PS5 1.00-13.60, PS4 1.00-13.52
source: https://github.com/drakmor/nanoDNS/releases/tag/0.4

I'm a bit confused. NanoDNS 0.4 is almost two months old. Why is this being posted now?

TheStonedModder said:
To be fair that root key is buried in there. Theres like 8 hoops you gotta jump through to get there

And that super duper low FW to get them.

But with PUP keys you can sign FW from what I was told which need the same requirements to get afaik unless someone has another way

I'm probably missing something basic here, but why would firmware signing keys even be on the consoles? The public key needed to validate the firmware, sure. But the private key to sign firmwares should never be leaving Sony HQ. The only signing keys a console should have are for saves and the extra layer of encryption used on games copied to an external USB drive.

HS2005 · 2026-09-25T22:43:23+0100

ViRGE said:
I'm a bit confused. NanoDNS 0.4 is almost two months old. Why is this being posted now?

I've already posted it a few days back.

The source code and link so version 0.4 are from august 4th. However the 2 .elf files are updated. The PS4 elf file has been updated to FW 13.52. I already checked that one on my PS4. Works fine.
The PS5 .elf file has been updated to work with FW 13.60.

Post automatically merged: Yesterday at 10:44 PM

zebrone said:
Am i wrong or new kstuff of Drakmor has a53_ppr inside?

Yup. Since kstuff-fpkg-1.13-dr-test1.elf (23-09)
Most reccent version from today is: kstuff-1.13-fpkg-dr-test4.elf

ViRGE · 2026-09-25T22:52:19+0100

HS2005 said:
I've already posted it a few days back.

The source code and link so version 0.4 are from august 4th. However the 2 .elf files are updated. The PS4 elf file has been updated to FW 13.52. I already checked that one on my PS4. Works fine.
The PS5 .elf file has been updated to work with FW 13.60.

View attachment 592523

Gotcha. Thanks for the clarification!

Bigoroth · 2026-09-25T23:19:24+0100

At this point we're gonna have most of the important apps already updated for 13.60 support before de JB releases, but hey, I'm not complaining. Better be ready beforehand!

kam821 · 2026-09-25T23:28:03+0100

I Have 3 PS5 on software 11.60 that i have jailbroken using webkit userland exploit. All of them shutdown randomly and completely unstable if i download a lot of ps4 games on them, but if keep only 2 - 3 games they won't shutdown at all. What could be causing this?

I stumbled upon such post on Facebook with a lot of replies from people with the same firmware version reporting the exact same issue.
Does anyone know what this might be?
Does it affect other firmware versions as well?
Does if affect only the webkit exploit chain or others like BD-JB as well?

Kanarico · 2026-09-26T00:10:28+0100

Bigoroth said:
At this point we're gonna have most of the important apps already updated for 13.60 support before de JB releases, but hey, I'm not complaining. Better be ready beforehand!

This is a very rare time that will probably never happen again. We have an kernel and hv exploit up to the second last firmware, kstuff and a ton of other payloads have already been updated to 13.60 so hopefully things are good to go right when the new jailbreak drops.

Remember when a new jailbreak method was released it took weeks or sometimes months for kstuff and others to be updated? I think it was 11.xx or maybe 12.xx where things really changed so it took EchoStretch and friends much longer to figure it out.

_iggyman_ · 2026-09-26T03:01:17+0100

ShintaiUS · 2026-09-26T06:09:22+0100

I've always been skeptical about these "keys" or perhaps the interpretation of it.

There is no way in hell, a group of security engineers for a modern console would design a security model in which would be satisfied with the assumption that a user whom decides to not update their console, their launch rushed and potentially vulnerable console will eventually hold the key to the entire business and life of the console. What are they? Fucking monkeys?

Modern CPUs offer a secure context, memory and storage isolated from the normal world even at kernel level privileges, is an execution context in which you can trivially reverse engineer the binaries it executes, see what it does but the normal world can't see, access or read the secrets and its execution at runtime. But even then, I highly doubt Sony will rely on it alone to protect the games/content, a highly motivated and skilled reverse engineer will want to find their way in through a vulnerability, it has happened before, I am sure Sony would have assumed that too.

Sony's ability to have a server side secret (public/private key) can help Sony mitigate the damage and protect future content should current secrets are exposed. This makes a lot of sense in today's world than just having the console securely store a highly valuable key.

I speculate that, some people may have found a vulnerability to the PSP and have managed to extract or read firmware-specific private key(s), such key or maybe a combination of secrets are probably used by the console during game license acquisition (ie. When the user downloads a digital game they bought) or disc license verification at the time of reading/installing a disc game into the console. They may facilitate or allow to derive a common "game decryption key" that ultimately would allow to turn a .PKG or a disc encrypted by Sony into a FFPKG.

So in theory given:
1) A valid account with a digital purchased game
2) Reversing the console-server interaction during license acquisition.
3) And such private key

Someone would impersonate the requests made by the console, request a game license signed/encrypted by Sony's public key, download the encrypted game blob, derive such common game key and decrypt the game into a FFPKG without touching the console. This is a very plausible case of what they MAY potentially have access to.

Even in such a case I would argue that there is nothing stopping Sony from enforcing a firmware-specific private key(s), that is, Sony can only issue you a license to decrypt the game if the firmware private key hasn't been exposed or is recent enough. Ie. If your extracted private key is from Firmware 5 or 6, and you are requesting a game license today, it would be rejected or issue but you wouldn't be able to derive the game decryption key from it. So while it would enable piracy, it would be short lived or meaningless depending on when these keys where extracted.

This is obviously my theory, Sony's security engineers could be really a bunch of morons and have included a highly valuable key in every shipped console. BUT i extremely doubt it, and I would love to see a POC that demonstrate it, not the key, but how Sony was stupid enough to allow it to happen.

And to be clear, I don't give a damn about a POC. BUT it's worth noting that demonstrating the power of such keys if they are firmware, app or game singing keys, is fairly trivial and unlikely to bring any legal trouble to prove it. As I've suggested before they can write, package and sign a Hello World .pkg to demonstrate it, if the console can launch it after restart, then there is the proof. A jailbroken console still will be needed to install it, that throws the whole legal talk out of the window. It is not like you can get this signed app to a legitimate user on the latest firmware, since the only way to install a package is via the PlayStation Store or through your account download history.

schatzi24 · 2026-09-26T06:12:54+0100

Dreamcastfan69 · 2026-09-26T06:59:38+0100

Is anyone here daily driving Linux on PS5? I have been wanting to set it up for a while as a equivalent steam machine to play on my sofa but the amount of information I can find on how it run's is pretty limited. Seem's like there were some driver issues with some games early on but I have no idea if those are fixed now? My ideal use case is like a steam machine that I can play on my TV then play on the go on my deck.

There is a linux distro that is based on steam machine if I remember correctly ?

alfatoria · 2026-09-26T10:35:37+0100

Hi, can you recommend a version of y2jb for a PS5 on firmware 4.50? I'm getting a lot of failures with itsPLK's version.

salope · 2026-09-26T10:38:59+0100

Dreamcastfan69 said:
Is anyone here daily driving Linux on PS5? I have been wanting to set it up for a while as a equivalent steam machine to play on my sofa but the amount of information I can find on how it run's is pretty limited. Seem's like there were some driver issues with some games early on but I have no idea if those are fixed now? My ideal use case is like a steam machine that I can play on my TV then play on the go on my deck.

There is a linux distro that is based on steam machine if I remember correctly ?

I've been rocking ubuntu on my 3.00 ps5 for a while now

I chose ubuntu because it's the most "noob friendly" distro IMO because of how popular and documented it is.

You just run lutris for your steam games (you don't need to buy the games btw but I won't talk about that here) and any issue you have you just copy and paste the commands that chatgpt gives you in your command prompt.

Never tell chatgpt that you don't have steam installed.

thekarter104 · 2026-09-26T11:04:20+0100

salope said:
Never tell chatgpt that you don't have steam installed.

Never tell ChatGPT (or any other for that matter) because it's AI...

Anyway, for me personally I love Linux Mint. Ubuntu is very nice too.
SteamOS is fine, but I'm not a fan of KDE. PS5 is a great Steam Machine.

Btw since you have experienced with Linux in PS5 I have always a concern about usage. How does the process when you want to use it (or not), do you just boot the normal PS5 OS fine? Do you choose a Linux Loader something inside PS5 homebrew program or does it boot into it directly?

HS2005 · 2026-09-26T11:34:09+0100

Somebody wants KODI for their PS5?

Kodi for PlayStation 5 (homebrew)

A native ps5 platform port of Kodi 22 for jailbroken PS5 consoles, built on the open-source ps5-payload-dev toolchain and ps5-opengl, and installed as a regular home-screen title via ShadowMountPlus.

Unofficial. This project is not affiliated with or endorsed by Team Kodi / the XBMC Foundation or Sony. "Kodi" and the Kodi logo are trademarks of the XBMC Foundation.

This repository contains no exploit, no Sony SDK code and no firmware files. The Sony library prototypes in overlay/xbmc/platform/ps5/sce/ are clean-room declarations of the handful of functions Kodi needs.

Hardware decoding
What's new

Native 3840×2160 rendering.
Refresh-rate switching between 59.94 and 119.88 Hz through Kodi's Adjust display refresh rate: films at 23.976/24 fps play with an even 5:1 cadence.
The real 59.94 Hz output rate and a display vsync clock for Sync playback to display.
Video frame uploads 6× faster (rectangle textures).
No more ghosted GUI text.

Install: extract into /data/homebrew/, then register with ShadowMountPlus. Recommended settings are in the README.

Known limits: 25/50 fps content stays at 59.94 Hz; HEVC 10-bit decodes in software; no internet access yet. decodes in software; no internet access yet.

Link: https://github.com/VivaLaVent/kodi-ps5/releases/tag/0.6

Post automatically merged: 11 minutes ago

New update regarding RetroArch. Dolphin emu added.

PS5 RetroArch — Alpha 3

This release adds Dolphin (GameCube) to PS5 RetroArch, with support for up to 6× internal resolution through PS5_Vulkan. It also fixes save-state loading, frame pacing and several driver issues found while bringing Dolphin to the PS5.

What's new

Dolphin at up to 6× internal resolution. Lower the resolution in Quick Menu → Core Options if a game or setting is too demanding.
Resident Evil 4's large save state now loads without crashing. RetroArch's large buffers use a separate memory pool, leaving room for Dolphin's compiled code.
More even frame pacing in Wind Waker. Dolphin supplies one frame for each frame step, including repeated frames.
Fixed slowdown at 120 Hz. RetroArch can request five swapchain images when displaying each game frame twice. This removed a measured 4–12% speed loss in heavier settings.
Fixed a texture leak when reloading a core or changing video settings. Each reload had left behind two textures and 13 driver memory mappings.
FTP access to saves, states and configuration files. At launch, RetroArch sets directories under PPSA99169 to 0777 and files to 0666, including existing files. Files that previously returned 550 Permission denied are now accessible.

Link: https://github.com/mihawk-99/PS5_RetroArch/releases/tag/v0.3.0-alpha.3

Post automatically merged: 7 minutes ago

Twiso — PS2 ISO Launcher

A native PlayStation 5 homebrew front-end that browses your PS2 ISOs and boots them through selectable PS2 emulator packages — all from a clean, PS5-styled UI.

Status: work in progress / experimental homebrew. Not affiliated with or endorsed by Sony. Requires a jailbroken console (see Requirements).

This repository ships no emulator runtimes and no packaged backends. It contains only the front-end, its build tooling, and documentation. You must supply your own emulator packages (see Bring your own backends).

Link: https://github.com/Swordpdf/Twiso/releases/tag/v01.00

Post automatically merged: 5 minutes ago

From our trusted developer Gezine:

Luac0re 2.4b

Fixed PS4 14.00 socket error

Changelog 2.4
Fixed get_title_id crashing PS4

Changelog 2.3
Rewrote poops and p2jb to jit C
Now p2jb 2.0 runs under 1 hour
Deprecated GPU RW
Deprecated PS5 firmware specific offsets
Merged ufm42's kexp PS5 post JB all in one shellcode
Changed elfldr to official repo's 0.23 version

Read README for instruction
https://github.com/Gezine/Luac0re

Link: https://github.com/Gezine/Luac0re/releases/tag/2.4b

Inaki · 2026-09-26T11:43:23+0100

alfatoria said:
Hi, can you recommend a version of y2jb for a PS5 on firmware 4.50? I'm getting a lot of failures with itsPLK's version.

Feyzee61's Y2JB Autoloader: https://github.com/Feyzee61/ps5-y2jb-autoloader/releases

PS5 Hack Status:

Preparing Your Console:

Select Your Jailbreak:

Additional Information:

Warnings:

Archived Information

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

The destroyer of worlds

Well-Known Member

Member

Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Member

Member

Member

Well-Known Member

The destroyer of worlds

Kodi for PlayStation 5 (homebrew)​

PS5 RetroArch — Alpha 3 ​

What's new​

Twiso — PS2 ISO Launcher​

Luac0re 2.4b​

Well-Known Member

Similar threads

Popular threads in this forum

Kodi for PlayStation 5 (homebrew)

PS5 RetroArch — Alpha 3

What's new

Twiso — PS2 ISO Launcher

Luac0re 2.4b