PS5 Exploit Guide

solitaire4eva · Nov 15, 2023

EchoStretch said:
I've tested a few physical copies and they all failed. This doesn't mean it won't work and really makes no sense. The weekend I'll have more time and I will compare files from both same game digital/physical and see if I can find something or if it's just the game.

Thanks for all your hard work!

taisoon · Nov 16, 2023

lotnybartek said:
I installed this PKG:

Run it once to cache everything then disable PS5 Internet access - either disable WiFi or unplug RJ45 cable. Now you're running everything offline

Thanks for sharing.
May I know what is your success rate of using this jailbreak site?

I tried it yesterday, cached properly and it pass on first try.
Today, i tried twice and it crashed at different areas.

Is there some tips that can help increase success rate? I saw some people using different jailbreak and provide payload separately which have higher success rate?

shano · Nov 16, 2023

Any news on 5.00/5.02?

KiiWii · Nov 16, 2023

shano said:
Any news on 5.00/5.02?

If there was it would be posted here

lotnybartek · Nov 16, 2023

@taisoon

It's complicated.

In my case, I assumed that I have to put the console to sleep all the time - I just got tired of restarting the console while executing code on the page.

As for the "success rate".

The first time after upgrading the console to version 4.03 I tried to execute the code on the site (this was right after the announcement that FPKG was even possible) - it worked the first time. I was amazed and happy.

But over time, as I started testing different things and executing the code more often, I noticed that executing the code correctly was a pure lottery. Sometimes the console can execute the code correctly 10x in a row. Sometimes the console restarts 10x while executing the code.

Subjectively speaking, I think the "success rate" increased a bit with the subtle changes that were made to the executed code (4.03).

From the beginning, I aimed to execute the code in full offline version.

The biggest problem for me at first was AlAzif's disabling of DNS as I was mainly using the redirect from the manual.

Then I tried to set up a DNS server myself, which is quite simple but clunky. Imagine coming home and having to turn on some services, change some IP addresses, etc. just to play around.

Then I tried the BDJPlus by Euro Ali solution. Everything worked, but again you had to use NetCat to send the payload to the console - which also requires the console to be connected to the Internet and you have to have your computer on to do it.

Along the way, I also tried solutions from MODDED WARFARE - that is, manually editing the console notification database file to be able to directly connect to the site with code execution. This also involved some clunkiness in the solution. Don't get me wrong, it all worked, but it was clunky.

As an aside, I have also tried etaHEN in different versions (mainly because it has solutions to block updates, run FTP server and others) but I have such a problem with it that after resuming the console from sleep everything is very slow. Moving through menus is slow, resuming hibernated games is slow.

With the standard solution I don't have these problems.

In the end, I found an installation package from "GamerHack", which I provided here.

It basically solves all the problems as for me.

- It loads all the code into the cache
- does not require an internet connection (except the first time)
- simply works

As I wrote at the beginning, put the console to sleep every time. It uses so little power and in return gives you such great convenience that there is nothing to think about.

Paiky · Nov 16, 2023

KiiWii said:
At This time it seems only digital games will work

Dump Game ( Opened Game ) /mnt/sandbox/pfsmnt https://github.com/logic-68/pfsmnt-dumper

Dump Game Files (copy folder content (files and folders))
/user/appmeta/PPSAXXXXX -->> PPSAXXXXX-appo\sce_sys

Dump Game Files (copy folder content)
/system_data/priv/appmeta/PPSAXXXXX/ =->> PPSAXXXXX-appo\sce_sy\

Open npbind.dat to see uds and trophy folder 000000080->04->0F

uds00.ucp ( named uds.ucp ) /user/np_uds/nobackup/conf/NPWRXXXXX_00/uds.ucp =~>>PPSAXXXXX-appo\sce_sys\uds\uds00.ucp

trophy00.ucp (named trophy.ucp ) /user/trophy2/nobackup/conf/NPWRXXXXX_00/trophy.ucp -->>PPSAXXXXX-app0\sce_sys\trophy2\trophy00.ucp

Decyrpt self files with sleirs ps5-self-dumper then copy files to game dir https://github.com/sleirsgoevy/ps4jb-payloads/tree/bd-jb/ps5-self-dumper

Download socat:
https://github.com/tech128/socat-1.7.3.0-windows

Place ps5-self-dumper payload in socat folder
https://www.sendspace.com/file/k87zug

Open PS5 browser to Specter host

Open windows cmd in socat folder and type both commands:

socat -u FILE:dumpgame. bin TCP:<ps5 ip>:9020

socat -u -d -d -d TCP: <ps5 ip>:9023, reuseaddr OPEN: game. tar, creat

Open game. tar and copy/replace files in PPSAXXXXX-appo

Via @EchoStretch

what am I doing wrong? :/

the first command works, the payload went through. But something is wrong with the second command

EDIT: Ignore my post. I had a wrong format

This is the right format without empty spaces

Code:

socat -u -d -d -d TCP:<PS5IP>:9023,reuseaddr OPEN:ra.tar,creat

taisoon · Nov 16, 2023

lotnybartek said:
@taisoon

As I wrote at the beginning, put the console to sleep every time. It uses so little power and in return gives you such great convenience that there is nothing to think about.

@lotnybartek

Thanks for your detailed response!
I think will do the same with keeping it in sleep mode then since you have done extensive testing.
Don't like the PS5 keep crashing.

solitaire4eva · Nov 17, 2023

taisoon said:
@lotnybartek

Thanks for your detailed response!
I think will do the same with keeping it in sleep mode then since you have done extensive testing.
Don't like the PS5 keep crashing.

I just use the 2in1 image by echosketch for ESP32-2. Has a high success rate and when I want to send an elf if need be, I just connect to the same network as the micro controller.

White_Raven_X · Nov 17, 2023

Is there any way to remove a pending update on 7.01 currently?

Adam512 · Nov 17, 2023

lotnybartek said:
@taisoon

It's complicated.

Then I tried the BDJPlus by Euro Ali solution. Everything worked, but again you had to use NetCat to send the payload to the console - which also requires the console to be connected to the Internet and you have to have your computer on to do it.

so BD-JB was 100% stable?

lotnybartek · Nov 17, 2023

Yes, as for me, BD-JB is/was 100% stable. I tried it many times, never had a single crash.

Just follow this guide:

Of course you need Blu-Ray burner and one BD-RE disc. I'm using this one:

schatzi24 · Nov 17, 2023

KiiWii · Nov 17, 2023

https://github.com/hammer-83/ps5-jar-loader

This project uses vulnerabilities discovered in BD-J layer of PS5 firmware version 7.61 and earlier to deploy a loader that is able to listen to JAR files and execute their main class. This makes it easy to burn the BD-R disc with the loader just once and then keep on running new versions of the experimental code. This repository provides all the necessary setup needed to create both the loader BD-R disc filesystem and the JAR to send to the PS5.

roice2000 · Nov 17, 2023

Do i need a BluRay Burner or can i Just buy i disc from someone else Who burned the right Image on the disc?

lotnybartek · Nov 17, 2023

You can use any Blu-Ray disc with a movie (that has a menu) - you don't need to burn your disc.

So why burn your Blu-Ray disc?

It's mainly to affect the operation of the disc player in the console - how "hard" it will work. When you burn such a disc yourself, there will only be a bootable image on it and nothing else. The drive in the console will simply work shorter. It will read the contents, display the text (I don't remember anymore, I think "Hello world") and that's it.

When you put a movie disc in the drive, the disc player in the console will work harder because it simply has a lot more information to process/read.

genf · Nov 17, 2023

Btw can you remote play locally with a PS5 on FW<5?

Hayato213 · Nov 17, 2023

genf said:
Btw can you remote play locally with a PS5 on FW<5?

I believe you can, but not with the portal if you are trying that.

genf · Nov 17, 2023

Hayato213 said:
I believe you can, but not with the portal if you are trying that.

You guessed right, I already successfully tested from Android 10. I actually meant with the Portal… What’s the bottleneck?

Hayato213 · Nov 17, 2023

genf said:
You guessed right, I already successfully tested from Android 10. I actually meant with the Portal… What’s the bottleneck?

Probably to do with the fact the portal has it own firmware, so Sony can push update to block older firmware.

genf · Nov 17, 2023

Hayato213 said:
Probably to do with the fact the portal has it own firmware, so Sony can push update to block older firmware.

Makes sense. Even in the local network scenario?
That thread is not conclusive on it:

Well-Known Member

New Member

Well-Known Member

Editorial Team

Active Member

Member

New Member

Well-Known Member

Hack everything, hack the world!

Well-Known Member

Active Member

Well-Known Member

Editorial Team

Well-Known Member

Active Member

Well-Known Member

Newcomer

Well-Known Member

Newcomer

Well-Known Member

Similar threads

Popular threads in this forum