This is an ELF loader for PS5 systems that have been jailbroken using either the BD-J ps5-payload-loader, or the webkit approached from Specter. Unlike the ELF loaders bundled with those exploits, this one uses the ptrace syscall to load itself into the ScePartyDaemon process, hence will continue running in the background even when playing games. Furthermore, this ELF loader will also resume its execution when the PS5 returns from rest mode. Payloads that are loaded are executed in induvidual processes, so if the payload crashes, the ELF loader will keep on running.

Building

Assuming you have the ps5-payload-sdk installed on a POSIX machine, the ELF loader can be compiled using the following two commands:

john@localhost:ps5-payload-elfldr$ export PS5_PAYLOAD_SDK=/opt/ps5-payload-sdk
john@localhost:ps5-payload-elfldr$ make

Usage

To deploy the ELF loader itself, we first bootstrap via the ELF loader bundled with the exploit of your choice.

john@localhost:ps5-payload-elfldr$ nc -q0 PS5_HOST 9020 < bootstrap.elf

Note: recent versions of the BD-J ps5-payload-loader include a binary version of this ELF loader which can be launched directly from the menu system.

Once the payload has been launched, a new socket server is started from the ScePartyDaemon process that accepts ELFs on port 9021:

john@localhost:ps5-payload-elfldr$ nc -q0 PS5_HOST 9021 < hello_world.elf

Reporting Bugs

If you encounter problems with ps5-payload-elfldr, please file a github issue. If you plan on sending pull requests which affect more than a few lines of code, please file an issue before you start to work on you changes. This will allow us to discuss the solution properly before you commit time and effort.