OnionHEN
An all-in-one homebrew enabler and Toolbox for PlayStation 5

简体中文 · English

Features · Comparison · Run · Build · Configuration · Credits

---

OnionHEN is a modular PS5 payload stack that combines system preparation, a ShellUI Toolbox,
payload management, game overlays, cheats, and runtime services behind one entry payload.

Features

OnionHEN focuses on a practical, maintainable homebrew environment for exploited PS5 systems.

• ShellUI Toolbox — an integrated settings interface injected into the PS5 ShellUI
• System preparation — privilege setup, filesystem remounting, and update-partition blocking
• fSELF / fPKG support — optional kernel functionality provided by the embedded kstuff payload
• Payload manager — launch and stop bare .elf payloads, with optional automatic startup
• Game overlay — configurable CPU, GPU, RAM, temperature, usage, and network information
• Cheat engine — local JSON, SHN, MC4, and ShnExt files with runtime toggle support
• Console tools — Rest Mode controls, Remote Play options, external HDD tools, title IDs, fan settings, shortcuts, and game options
• App jailbreak — whitelist homebrew can request privilege escape via daemon sandbox FIFO
• Resilient runtime — critical and utility daemons are separated; the main daemon can restart the utility daemon
• Centralized configuration — Toolbox and daemon settings share one versioned config.ini schema

Feature comparison with etaHEN

Compared with the original etaHEN:

Feature	OnionHEN	etaHEN
Toolbox	✅	✅
Simplified Chinese UI	✅	❌
Home screen top-bar shortcut	✅	❌
fSELF / fPKG support	✅	✅
kstuff management	✅	✅
Update blocker	✅	✅
Package Installer	✅	✅
Add-on Content Manager	✅	✅
Homebrew Store installer	❌	✅
Remote PKG installer	❌	✅
ELF payload manager	✅	✅
Payload auto-start	✅	✅
etaHEN SDK plugins	❌	✅
JSON / SHN / MC4 cheats	✅	✅
ShnExt cheats	✅	❌
Online cheat downloads	❌	✅
Game status overlay	✅	✅
FPS display	❌	✅
Rest Mode options	✅	✅
Remote Play tools	✅	✅
External HDD tools	✅	✅
Title ID display	✅	✅
Fan control	✅	✅
Controller shortcuts	✅	✅
Custom game options	✅	✅
Blu-ray license activation	✅	✅
Automatic disc eject	❌	✅
App jailbreak	✅	✅
FTP server	❌	✅
Klog server	❌	✅
PS5Debug	❌	✅
Discord RPC	❌	✅
Itemzflow / game dumper integration	❌	✅
PS5 webMAN games	❌	✅
Custom system information	❌	✅

OnionHEN intentionally does not bundle a kernel exploit. It still needs an external elfldr on 9021 for the initial bootstrap, then starts its own private embedded loader on 9020 for runtime ELF and user payload launches.

Run

Requirements

1. A PS5 running a compatible kernel exploit
2. An external PS5 elfldr listening on port 9021 for the initial bootstrap
3. A firmware-compatible kstuff build when fSELF / fPKG functionality is required

Important

Firmware and exploit compatibility are determined by the exploit chain, PS5 payload SDK, and kstuff version. Do not assume that a payload built for one firmware is safe on another.

Load OnionHEN

1. Run the kernel exploit and start the external elfldr service.
2. Send OnionHEN.elf through the loader provided by your exploit host.
3. Wait for the utility daemon, kstuff, and main daemon to start in sequence.
4. Open the PS5 settings area to access the OnionHEN Toolbox.

The runtime launch order is deliberately serialized. After bootstrap, onion_elfldr.elf on 9020 is the required runtime loader. Port 9021 is reserved for initial bootstrap and recovery of the private loader; user payloads never fall back to it. The daemon supervises 9020, recovers it through 9021 when necessary, and only then recovers util.elf through 9020.

OnionHEN.elf → bootstrapper → onion_elfldr.elf (:9020) → util.elf → kstuff.elf → daemon.elf → Toolbox

Payloads

Place standalone payloads in:

/data/OnionHEN/payloads/

Only bare .elf payloads are supported. Automatic startup can be enabled from the Toolbox; OnionHEN records that choice with a sibling .auto_start marker.

User payload launches require a healthy private loader on 9020 and its exact reported process ID. If 9020 is unavailable or no valid PID is returned, the request fails without a process snapshot, retry, or fallback to 9021.

Cheats

Place cheat files in the flat cheat directory using the title ID and game version:

/data/OnionHEN/cheats/<TITLE_ID>_<VERSION>.json
/data/OnionHEN/cheats/<TITLE_ID>_<VERSION>.shn
/data/OnionHEN/cheats/<TITLE_ID>_<VERSION>.mc4
/data/OnionHEN/cheats/<TITLE_ID>_<VERSION>.ShnExt

Cheat files are loaded locally. Changes are detected and reloaded without restarting the full stack.

Build

Dependencies

Dependency	Purpose
PS5 Payload SDK	Prospero compiler, target headers, runtime, and CMake wrapper
CMake 3.20+ and Ninja	Configure and build the payload graph
Clang / LLVM	Compile the x86_64-sie-ps5 targets
rsvg-convert or ImageMagick	Rasterize bootstrapper SVG icons during the build
lzma or xz	Compress the bootstrapper
Git and curl or wget	Initialize submodules and fetch external payload inputs

Full build

git submodule update --init --recursive

export PS5_PAYLOAD_SDK=/path/to/ps5-payload-sdk
./scripts/build.sh --jobs 8

The build script configures the project, synchronizes external dependencies, and builds the complete embedding chain in the required order.

Common options

Option	Description
--build-type Debug|Release	Select the CMake build type
--build-dir <path>	Override the default build/ directory
--cache-dir <path>	Override .cache/dependencies/
--stub-missing	Use compile-only placeholder external ELFs; never use on hardware
--skip-unpacker	Stop after building the bootstrapper
--init-submodules	Initialize submodules before dependency sync

Run ./scripts/build.sh --help for the complete option list.

Outputs

Path	Description
build/bin/OnionHEN.elf	Final payload sent to the console
build/bin/bootstrapper.elf	Uncompressed bootstrapper
build/bin/bootstrapper.elf.lzma	Bootstrapper embedded by the final payload
build/bin/daemon.elf	Critical daemon
build/bin/util.elf	Utility daemon
build/bin/shellui.elf	Toolbox injection payload
build/lib/*.a	First-party static libraries

All generated files stay under build/; downloaded inputs are cached under .cache/dependencies/. Bootstrapper icon sources live in source/bootstrapper/assets/icons/ and are rasterized to build/bootstrapper/generated/assets/ automatically. The source/ tree is not used as an artifact directory.

Tests

Host tests cover settings, IPC framing, payload helpers, cheat parsers, relocation, Toolbox routing, and shared platform code:

make -C source/util/tests clean
make -C source/util/tests test -j8

The host test link expects Keystone to be available through KEYSTONE_PREFIX (default: /opt/homebrew).

Configuration

OnionHEN creates and shares the same schema through these runtime views:

/data/OnionHEN/config.ini
/user/data/OnionHEN/config.ini

Most settings can be changed directly from the Toolbox. The semantic schema starts at schema_version=1. When no config exists, OnionHEN writes an annotated default based on config.ini.example. toolbox.language also controls plain and icon-rich notification text.

Key	Default	Values
meta.schema_version	1	1
toolbox.language	system	system, zh-Hans, en
logging.level	info	off, error, warn, info, debug, trace (trace requires a debug build)
home_screen.show_title_ids	false	true, false
game_menu.show_onionhen_options	true	true, false
rest_mode.resume_reinject_delay_seconds	10	seconds
cheats.memory_backend	default	default, libhijacker
app_jailbreak.enabled	true	true registers App lifecycle/sandbox event listeners; false leaves them inactive
app_jailbreak.debug_notifications	false	true, false
app_jailbreak.exact_title_ids	ITEM00001,NPXS39041,PKGI13337,PKGI12345,TOOL00001	comma-separated exact Title IDs, or none
app_jailbreak.title_id_prefixes	LAPY	comma-separated uppercase prefixes, or none
cooling.fan_control	automatic	automatic, temperature_threshold
cooling.temperature_threshold_celsius	77	0 through 100
overlay.enabled	true	true, false
overlay.edge	top	top, bottom
overlay.show_cpu / overlay.show_gpu / overlay.show_memory	true	true, false
overlay.cpu_usage_mode	average	average, per_core
overlay.show_ip_address	false	true, false
shortcuts.cheats_menu	off	off, r3_l3, l2_triangle, long_options, long_share, share
shortcuts.toolbox	off	off, l2_r3, long_share, share

Runtime data

Path	Purpose
/data/OnionHEN/payloads/	User payload ELFs
/data/OnionHEN/cheats/	Flat cheat files
/data/OnionHEN/kstuff.elf	Optional runtime override for embedded kstuff
/data/OnionHEN/OnionHEN.log	Main runtime log
/data/OnionHEN/OnionHEN_util_daemon.log	Utility daemon log

Both logs append across process restarts. Each live file rotates at 256 KiB and retains three numbered generations (.1 is newest, .3 is oldest).

Host tools

Tool	Purpose
scripts/daemon_log.py	Stream daemon logs from the console
scripts/shutdown_onion.py	Shut down the OnionHEN userland stack without killing kstuff
scripts/ps5_cmake.sh	Run CMake through the PS5 payload SDK
scripts/sync_dependencies.sh	Fetch or build external payload inputs

Repository layout

.
├── assets/                    Project artwork
├── docs/                      Architecture and technical notes
├── scripts/                   Build, dependency, and host-side helpers
├── source/                    First-party PS5 source tree
│   ├── bootstrapper/          Startup and embedded payload chain
│   ├── daemon/                Critical daemon and Toolbox injection
│   ├── util/                  Utility daemon, IPC, and cheat engine
│   ├── shellui/               Toolbox and ShellUI hooks
│   ├── unpacker/              Final OnionHEN payload wrapper
│   ├── libonion_*/            Shared first-party libraries
│   ├── common/                Shared low-level implementations
│   └── platform/ps5/stubs/    PS5 system-library link stubs
├── third_party/               External source, archives, and submodules
├── tools/                     Repository-side generators
├── build/                     Generated build outputs (ignored)
└── .cache/dependencies/       Downloaded external inputs (ignored)

See the architecture document for the complete module and IPC map.

Troubleshooting

1. Confirm the external bootstrap elfldr service is reachable on port 9021 before loading OnionHEN.
2. Confirm the payload was built for the intended firmware and with a complete PS5 payload SDK.
3. If the Toolbox does not appear, wait for the serialized util → kstuff → daemon launch chain and inspect the logs.
4. If a full build cannot obtain kstuff.elf, retry ./scripts/sync_dependencies.sh or initialize the submodule.
5. When reporting a problem, include firmware, exploit host, SDK version, build type, logs, and reproducible steps.

Contributing

• Keep changes focused and follow the existing snake_case naming convention.
• Preserve third-party file names when syncing upstream code.
• Run the full PS5 build and host tests before submitting a pull request.
• Update docs/arch.md when changing module responsibilities, IPC, runtime paths, or dependencies.

Credits

OnionHEN is possible because of the PS5 homebrew and reverse-engineering community.

• etaHEN — LightningMods and contributors; original open-source foundation
• GoldHEN — SiSTR0 and contributors; inspiration for a polished all-in-one HEN
• PS5 Payload SDK and the PS5 payload development community
• kstuff-lite — EchoStretch, sleirsgoevy, and contributors
• cJSON, 7-Zip SDK, and Keystone
• All OnionHEN contributors, testers, researchers, and users who provide actionable feedback

License

This project is licensed under the GNU General Public License v3.0. Third-party components retain their respective licenses and notices.

OnionHEN is an unofficial homebrew project and is not affiliated with Sony Interactive Entertainment. Use it only on hardware you own and at your own risk. No warranty is provided.