PS5 Exploit Guide

TaylorJones · Tuesday at 11:20 PM

HS2005 said:
New video from Michael

If you watch the video. Hes installing a ps4 game xD

flopsy · Tuesday at 11:21 PM

@HS2005 Concerning backports. How are you sure eboot.bin, *.srx or *.sprx hasn't been modified? There is some dumps with versions than needs much higher firmware than stated for that specific version. Yet it comes with 4.xx support without mentioning backports for ex, or it does mention it but there is no other dump to reference. It can't be SDK compatability I reckon. And some backports do modify eboot.bin for ex. Am I missing something?

Edit: What I mean is sometimes there is no other dump to compare to and i'm not sure if the eboot.bin etc been modified at all and need fakelib stuff to work even as a fpkg.

Eva888 · Tuesday at 11:31 PM

Sometimes even stuff that weren't modified are flawed because an old version of dump tool was used—one that wasn't very good and was subsequently patched and improved in various ways... so, ideally, we would create a completely new database

but unfortunately, no one likely has time for that...

ViRGE · Tuesday at 11:31 PM

cearp said:
Fantastic, but why couldn't the guy just make a pull request lol.
No need for a whole new project (or, is there?)

TheFlow is currently on a hiatus, isn't he? So there is no one to accept pull requests on the original PS5 Linux project; a fork (or other separate project) is all but required at this time.

kam821 said:
I don't quite understand this desire to replace all formats with fpkg.
It can't be run from an external USB drive, also installing anything on an internal drive increases the chance of catastrophic kernel panic.
I would like to see fpkg as a main format + some A53 accelerated, Kraken based format that can be run from any drive (ArkSama, I'm counting on you), then everyone should be happy.

fPKG has the best performance and compatibility by far. Not only does it get the benefit of direct access to the system's accelerated I/O pathways and dedicated decoder blocks, but that means games can be run without modification, backports notwithstanding. Everything up until now has been a workaround for the inability to use fPKGs, with the ability to load games over USB being one of the handful of things that actually exceeds what a fPKG can do.

Meanwhile, I would say that the risk for a kernel panic with fPKGs to be overblown. With dumps it's an issue because we're doing all sorts of janky things with UnionFS and other techniques to map games into the file system hierarchy in order to run them. Official games (and fPKGs) are doing something a bit different and safer, and on a much better validated code path.

That said, don't forget that M.2 storage is an option here. With the PS4 we needed external storage because that was the only other option. On the PS5 we can put an M.2 drive in the system and have a storage drive that is distinct from the internal storage while still getting full support from the OS to use the accelerated I/O pathways.

Perhaps one day someone will get fPKGs working off of USB storage. But the bandwidth differential is pretty extreme: it's 1GB/second (at best) versus 7GB/sec for the M.2 slot.

flopsy said:
This is the reason I wished for clean dumps, aswell, at the same time modified ones can be released. But right now it's very hard to find clean dumps/knowing they are clean unless you do them on your own, and it's not to easy to make them clean since eboot.bin etc been modified. Sometimes for good reason for ex Pro fix or something game breaking perhaps, but still. For long term archivation and perservation it would be nice with clean dumps as reference atleast.

For long-term preservation we have the Redump project, which is focused on making 1:1 clean dumps of discs. That doesn't cover digital-only releases, of course, but there is some thought being put in to long-term archiving, even if it's not something that's immediately user-accessible.

hsaitou · Tuesday at 11:37 PM

enomao94 said:
anyone got error with belmonts curse dump when starting?

Try to convert to a different format.

TaylorJones said:
If you watch the video. Hes installing a ps4 game xD

How he didn't realize that? lol

Dmafra · Tuesday at 11:43 PM

HS2005 said:
New video from Michael

HV isnt needed for PS4 PKG

flopsy · Tuesday at 11:51 PM

ViRGE said:
For long-term preservation we have the Redump project, which is focused on making 1:1 clean dumps of discs. That doesn't cover digital-only releases, of course, but there is some thought being put in to long-term archiving, even if it's not something that's immediately user-accessible.

I knew about this, but not something that is playable today for all systems

And maybe not in the forseeable future either. But still great for these systems either way.

Blythe93 · Wednesday at 12:53 AM

hsaitou said:
How he didn't realize that? lol

Just a clickbait, I guess, but I'm not sure why he would do that. He usually makes informative videos about things that are happening in PS4 and PS5 hacking scene, no? Thankfully, Modded Warfare does a pretty good job covering those news.

Seraphic · Wednesday at 2:35 AM

someone is working on a fakePSN

_iggyman_ · Wednesday at 2:53 AM

itsPLK ps5-payload-manager v0.6.0
https://github.com/itsPLK/ps5-payload-manager/releases

and

HyperHEN - An all-in-one HEN and Toolbox for PlayStation 5
https://github.com/Michele-M-Media/HYPERHEN

cvskid · Wednesday at 4:04 AM

_iggyman_ said:
itsPLK ps5-payload-manager v0.6.0
https://github.com/itsPLK/ps5-payload-manager/releases

and

HyperHEN - An all-in-one HEN and Toolbox for PlayStation 5
https://github.com/Michele-M-Media/HYPERHEN

Is it possible to downgrade the payload manager back to 0.5.2? The new one crashes on the 6th and 7th payload no matter what order i set the paylopads in.

ViRGE · Wednesday at 4:39 AM

_iggyman_ said:
HyperHEN - An all-in-one HEN and Toolbox for PlayStation 5
https://github.com/Michele-M-Media/HYPERHEN

I like the energy. But I think we're still a bit early for an all-in-one HEN.

There are still too many things going on and changing in the PS5 jailbreak ecosystem right now. It would be better to wait a few months for everything to settle down and all of the necessary payloads for 13.60 get released, refined, and tested, before going on and bundling that all together as a single package.

etaHen bundled kstuff, and that aged like milk. Never mind all the problems with Elf Arsenal.

cvskid said:
Is it possible to downgrade the payload manager back to 0.5.2? The new one crashes on the 6th and 7th payload no matter what order i set the paylopads in.

It should be possible to just install the 0.5.2 ELF over the current one. Worst case scenario, I should think you'd be able to delete the ELF, which would cause the version installed with your jailbreak application to load instead.

truemaster · Wednesday at 7:04 AM

HS2005 said:
New video from Michael

i do what he did exacly with ps5 fpkg on 13.60 and didint work. cant believe crump did that.

Blythe93 · Wednesday at 7:13 AM

truemaster said:
i do what he did exacly with ps5 fpkg on 13.60 and didint work. cant believe crump did that.

Coming up next: PS5 13.60 Console Reboot test.

Yeah, I don't know why he did that either other than for clickbaiting people into checking it out.

truemaster · Wednesday at 7:15 AM

but thats looks promising for ps5 fpkg in the future https://github.com/Michele-M-Media/HYPERHEN

peteruk · Wednesday at 7:53 AM

synderella · Wednesday at 8:02 AM

AlphaBravo said:
Yes sideloading is fine with that sm+ directory. I prefer that method to installing backports via .PKG. Very handy because sometimes backport needs a fix and who wants to deal with the whole process again from scratch.

Guys, I'm sorry to be bumping my own thread but just want to confirm that info again.
What we have:
4.50 console with webkit 0.5.2 autoloader with latest kstuff from drakmor and latest shadowmount. Mortal Kombat 1 in fpkg format (PPSA07571) with preinstalled (baked-in) backport for 7.xx systems. Trying to start this game "as is" gives CE-100099-9 error which is "App has higher firmware than your console"
What was done:
Downloaded backport for 4.xx systems for PPSA07570 (its actually universal for both US and EU releases) and all files put in data/homebrew/backports/PPSA07571/
Result:
Shadowmount sees actual executables in backport location and overrides those, that are baked-in fpkg file. You dont have to redownload/repack/reinstall fpkg. Game works perfectly as if native pkg format.

Nothing new probably but maybe this info may help anyone who will face that error code (CE-100099-99).

HS2005 · Wednesday at 8:23 AM

TaylorJones said:
If you watch the video. Hes installing a ps4 game xD

Wait Wut?

I only saw like the beginning with kfstuff NG and Byepervisor and then CUSA on PS5... lol

Dmafra said:
HV isnt needed for PS4 PKG

Indeed it is not. Or he messed up the video himself or he was not thinking straight.

Blythe93 said:
Just a clickbait, I guess, but I'm not sure why he would do that. He usually makes informative videos about things that are happening in PS4 and PS5 hacking scene, no? Thankfully, Modded Warfare does a pretty good job covering those news.

Indeed. I also find his videos informative, next to Modded. What Modded covers sometimes Michael does not cover and it's the other way around. This is just a huge screwup on his part.

flopsy said:
@HS2005 Concerning backports. How are you sure eboot.bin, *.srx or *.sprx hasn't been modified? There is some dumps with versions than needs much higher firmware than stated for that specific version. Yet it comes with 4.xx support without mentioning backports for ex, or it does mention it but there is no other dump to reference. It can't be SDK compatability I reckon. And some backports do modify eboot.bin for ex. Am I missing something?

Edit: What I mean is sometimes there is no other dump to compare to and i'm not sure if the eboot.bin etc been modified at all and need fakelib stuff to work even as a fpkg.

True. That's why I advise using a clean folder. If that's not possible use https://github.com/strongt1me/PS5-Dump-Image-Converter/releases/tag/v1.9.75 and recompile it. This program will mention if there are any errors in your build and you can also remove APR-EMU and select a backport version or not if you want.

In other news, for those of you who are making emulators:

MihawkGen v1.0.0: the network

Download mihawkgen-network-v1.0.0.fgw (1.7 MB, 432,308 parameters). It is the network the generator loads with fg_context_load_network; it pairs with the shaders and code of this tag.

SHA-256 31ecc7d69af1e9de… (full sum in SHA256SUMS).

What it does

Two colour frames in, the picture between them out. 30 or 60 fps to 120 fps on a base PS5: one generated picture between two real frames at 60 fps, three at 30 fps. Compute shaders, about 2.2 ms of the PS5's GPU at 3840×2160; no engine data and no motion vectors.

Benchmarks (never-trained games, middle picture, PSNR in dB)

Method
MihawkGen
plain average of the two frames
FSR 3.1 frame interpolation (no engine data)
BiM-VFI (6.9 M parameters)
SGM-VFI (20.9 M)
GIMM-VFI-R (19.8 M)

SSIM and LPIPS tables, the x4 results and the 70 controlled situations are in the README and train/.

Use it

framegen/tests/run.sh # tests, seconds
tools/lab.sh pixels # the pixel-art motion pass
tools/lab.sh host # FrameGen Lab on this PC

The file is plain weights: a short header (FGW1, the block sizes) and float tensors. Licence: GPL-3.0-or-later, like the generator.

Link: https://github.com/mihawk-99/PS5_MihawkGen/releases/tag/v1.0.0

cloudfe · Wednesday at 9:12 AM

I'm in disbelief of all the progress made with emulators and re/de-compilers now available for the PS5...
Huge props to the devs (and their tools)!

It's quite fitting that the PS5 will be my last (non-Nintendo) console.

ayechief · Wednesday at 9:40 AM

HS2005 said:
Report it to ItsPLK - not here. It not a page of ALL the payloads that are out there.

Post automatically merged: Tuesday at 5:28 PM

Well it's not that complicated thankfully. I'll explain you some methods.

1. You can either unpack a .exfat or other format to folder and then remove the backport files.
2. Download a folder format first and then remove the backport files. Then rebuild to your desired format.

Result: No backport loading message.

Typical backport folder structure

Code:

Game/ ├── eboot.bin ├── sce_sys/ │ └── param.json ├── sce_module/ │ └── *.prx ├── sce_modules/ │ └── *.sprx ├── fakelib/ │ └── patched system libraries └── backport/ └── optional metadata or patch files

What files do

File or directory Purpose
eboot.bin Main game executable; may be modified to adjust its SDK requirement or compatibility.
sce_sys/param.json Contains application metadata, including the title ID and title name.
sce_module/ or sce_modules/ May contain game-specific modules and system libraries, depending on the dump.
fakelib/ Can hold patched compatibility libraries used by particular backport methods.
.bps files Binary patch files that describe changes to apply to a target file.
.bak or backup folders Preserve original files before modification.
Readme or metadata files Document the target firmware, patch version, or installation instructions.

Where backports are stored with ShadowMountPlus
The location matters because a backport overlay does not necessarily belong inside the original game folder.

Code:

/data/ ├── homebrew/ │ ├── PPSA12345/ │ │ └── sce_sys/ │ │ └── param.json │ └── backports/ │ └── PPSA12345/ │ └── [backport files] └── etaHEN/ └── games/ └── [other game folders]

I'm a big fan of using option 2.It's the easiest part / method. Good luck and have fun.

Post automatically merged: Tuesday at 5:32 PM

EDIT: Should you still have issues. Just download a full folder 13.60 game and seperate backport. Check the files from the backport folder to see what you can remove and how the layout and files are used.

Thanks but yet I got a question because it sounds kinda unclear to me:
With the first method - do i delete just what's in /backport/ folder or also eboot.bin, param.json, *.prx, *.srpx and /fakelib/ catalog? I think the game wouldn't run if i deleted all of those.
And about the second method - i don't see /backports/ folder in /data/ at all

I've seen info about mounting a backport to a game previously but don't have it anymore with any (of little just 3 titles).
Although it says now for each game: 'Mounting emulators' - I believe this is just about fakelibs, right?

What would be the cases (in ShadowMountPlus) to change `Mount fakelibs` feature from Default (Full) to 'Just emulators' or to 'Off'?

Also - when payloads load (I am a simple man and run just kstuff and ShadowMount+) it says launching PPR and then PPR installation failed - should i be concerned?

And last two questions I have - what even is that PPR? And also I've seen a different times (in here and not only) something called 'a53' - I've only found that it's some exploit like HV but for lower fw's?

File or directory	Purpose
eboot.bin	Main game executable; may be modified to adjust its SDK requirement or compatibility.
sce_sys/param.json	Contains application metadata, including the title ID and title name.
sce_module/ or sce_modules/	May contain game-specific modules and system libraries, depending on the dump.
fakelib/	Can hold patched compatibility libraries used by particular backport methods.
.bps files	Binary patch files that describe changes to apply to a target file.
.bak or backup folders	Preserve original files before modification.
Readme or metadata files	Document the target firmware, patch version, or installation instructions.

PS5 Hack Status:

Preparing Your Console:

Select Your Jailbreak:

Additional Information:

Warnings:

Archived Information

New Member

Well-Known Member

Active Member

Well-Known Member

Member

Well-Known Member

Well-Known Member

The Treasure Tracker

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

The Treasure Tracker

Well-Known Member

DMT hyperspace

Member

The destroyer of worlds

MihawkGen v1.0.0: the network​

What it does​

Benchmarks (never-trained games, middle picture, PSNR in dB)​

Use it​

Well-Known Member

Member

What files do​

Where backports are stored with ShadowMountPlus​

Similar threads

Popular threads in this forum

MihawkGen v1.0.0: the network

What it does

Benchmarks (never-trained games, middle picture, PSNR in dB)

Use it

What files do

Where backports are stored with ShadowMountPlus