ps5-hen

Firmware 10.01 is an in-progress research port, not a supported HEN release. No 10.01 HEN, fSELF, PS4 fPKG, or PS5 package capability is live-qualified. See the current status map, port index, and repository layout before building or testing.

Homebrew Enabler for the PlayStation 5.

Defeats the Hypervisor on firmware <= 4.51 and enables supports for homebrew and ps4 fpkg's.

Supports firmwares:

• 1.xx - 1.00 1.01 1.02 1.05 1.10 1.11 1.12 1.13 1.14

• 2.xx - 2.00 2.20 2.25 2.26 2.30 2.50 2.70

• 3.xx - 3.00 3.10 3.20 3.21

• 4.xx - 4.00 4.02 4.03 4.50 4.51

Download

How can I use this?

• Download the payload from button above
  • its automatically the latest dev build
• Start elfldr by running UMTX or Y2JB
• Close application
  • Y2JB, UMTX etc. to allow pinning to all cores
• Send the HEN payload and wait until the notification popup occurs
  • netcat, socat, host everything works
• Have fun

Changelog

• For full changelog see CHANGELOG.md
• Latest 1.3 (04/15/26)
  • PR: replace std::print with printf macro
  • PR: Simplify compilation on platforms other than x86_64
  • Feature: Added Testkit/Devkit support

Known Issues

• All firmwares have crashes after launching multiple ps4 fpkgs (needs to be investigated)
• Currently does not support Restmode
• Speed can be improved for ps4 fpkg loading (already commented out logging)

Credits

• fail0verflow
• flat_z
• c0w
• TheOfficialFloW
• EchoStretch
• idlesauce
• Z80
• John Törnblom
• Specter
• zeco
• ChendoChap
• everyone who helped testing and debugging

Thanks to every single one of you - without your help it wouldn't be possible.

How It Works

Stage	Name	Description
0	Discovery	Detect firmware, locate kernel base, map HV structures
1	TMR Relaxation	Patch IOMMU for unrestricted memory access
2	VMCB Discovery	Locate Virtual Machine Control Blocks
3	VMCB Patching	Disable HV intercepts and nested paging
3b	XOTEXT Removal	Remove execute-only page protections
4	Verification	Confirm successful HV bypass
5	Kernel Patching	Apply firmware-specific kernel patches
6	Kexec Install	Install kernel execution primitive
7	HEN Payload	Load HEN kernel module for homebrew/ps4 fpkg support

Building

Requires the PS5 Payload SDK. Set PS5_PAYLOAD_SDK to your SDK path.

make          # build everything
cd hen && make  # build HEN module only

Firmware 10.01 port status

Firmware 10.01 HEN support is not complete. The repository now contains a separate, hardware-validated post-Byepervisor evidence gate, transactional patch infrastructure, and a fresh-page executable-alias path for an original/fat retail PS5. The alias path has passed read-only topology, page lease, deterministic image staging, and publish/walk/restore qualification on hardware without dereferencing or executing the alias. A relocation-free S3/AP carrier extension, fixed CPL0 bootstrap, boot-bound package builder, and pinned Byepervisor integration overlay are host-validated and target-linked. The first integrated hardware attempt durably armed but produced no post-resume evidence, so it is incomplete and does not qualify the execution path. The second integrated attempt completed the 16-VMCB strike and restored all owned state, but its carrier extension rejected the live low AP-start RSP before publishing the executable alias. Preserved run-unique evidence traced that safe rejection to an incorrect high-half stack-address assumption; prior same-firmware telemetry records the stock RSP as 0x000000007fb97f78. The contract now accepts only a nonzero, qword-aligned low-32-bit stock RSP, gives the early request/pointer/RSP and launcher-size failures distinct codes, and persists terminal carrier diagnostics even when no realtime S3 gap is seen. The first userland-only S3 witness displayed its exact success message, but FTP still exposed only its armed fixed-path record. A descriptor-preserving two-slot retry then completed with exact read-back and independently repeated FTP bytes, qualifying ordinary elfldr process/file-descriptor continuity across the tested S3 cycle. The integrated retry now uses run-unique evidence files, retained descriptors, exact read-back, two-slot session/watchdog journals, and bounded pre/post-resume observation. The corrected complete-path artifact was used for attempt 03, but the console failed during wake. Its recovered records contain only the valid armed/pre-resume slots and no durable post-resume transition. That combined path is paused. The transition is now split into four fail-closed diagnostic rungs; both host validation matrices pass. Two rung-1 runs completed the validation-only AP carrier and exact cleanup but failed the independent realtime-gap gate; the second displayed a system-software error after a 15-second rest dwell. Attempt 06 then proved a 107.31-second adjacent realtime gap and complete rung-1 carrier, but failed closed when its post-resume durability transactions reported errors. The replacement defers filesystem work until every temporary hook/permission is restored, retries write/sync/readback transactions within a fixed bound, and persists per-artifact attempt/phase/errno telemetry. Attempt 07 fully qualified that hardened rung 1: its watchdog transaction recovered on attempt 2, the other four mutable artifacts completed on attempt 1, and the isolated bundle passed with exact cleanup. Attempt 08 then qualified rung 2 through alias publication and bounded data readback, but failed closed during teardown. The hardware page walk set the architectural Accessed bit in the published non-leaf PDPTE, so the old exact-value restore CAS rejected its own one-bit drift, retained the page lease, and required a cold reboot. The replacement restore accepts ownership of only that Accessed-bit transition, CASes the exact observed value to zero with a two-attempt bound, and still rejects every other address or flag change. Attempt 09 fully qualified that correction: the same Accessed transition was observed, the slot restored to zero, the lease was released, all cleanup and durability checks passed, and the isolated bundle validates. Attempt 10 then hard-failed during the first rung-3 rest transition and required a reboot. Its double-read evidence is valid but stops at the armed/pre-resume boundary: the terminal session/watchdog slots and the call, receipt, carrier-result, and strike records are all zero. Because that run introduced a leading CLI plus a probe that both fetched and wrote through the alias, the artifact was retired. Attempt 11 fully qualified a CLI-first rung-2 control with a 59.58-second resume gap, exact zero restoration, complete cleanup, and successful persistence telemetry. CLI is therefore not the cause. Attempt 12 then hard-failed during wake with the replacement rung-3 artifact whose aliased body was only JMP R11; its recovered bundle again ends at the armed/pre-resume boundary and does not prove that the AP hook or alias fetch was reached. That artifact is retired. Rung 4 remains blocked. Attempt 13 then fully qualified a rung-3 carrier-local differential control: it published and restored the candidate alias, but its wrapper executed an equivalent carrier-resident JMP R11. The accepted record sets LOCAL_EXEC_RETURNED, leaves ALIAS_EXEC_RETURNED clear, restores every owned resource, and passes the run-bound verifier. This strongly isolates the remaining attempt-11/12 difference to fresh-alias execution, but attempt 12 contains no post-resume carrier record, so the exact fault and even arrival at the alias branch remain unobserved. A post-resume Home UI mounting anomaly was also retained in klog without a panic or ShellUI-process-death signature. Attempt 14 has since qualified a same-value CR3 reload on the data-only rung-2 path, with exact publication, Accessed-aware rollback, and cleanup. Attempt 15 then exercised the corresponding rung-3 candidate but rejected before the strike after finding a duplicate VMCB population. Attempt 16 used the intended read-only survey and hard-failed during wake. Offline disassembly found that its C++ entry had embedded the absolute low pointer 0xf00 instead of a carrier-relative parameter address. That deployed artifact is retired. Attempt 17 ran the corrected RIP-relative survey, returned through the expected rejected -8 path, and preserved a complete 32-candidate read-only inventory. It observed two exact 16-entry runs (ASID 2 and ASID 1), uniquely located the self VMCB in the ASID-1 run, and performed no VMCB write or alias publication. This normal-topology control does not reproduce attempt 15's duplicate generation, so it did not by itself authorize a production selector. Attempt 18's later owner-graph result and the mutation-disabled preflight are described below. The offline validation entry points are:

make check
make check-sanitize
make ps4-fpkg-core-contract
make resume-bootstrap-image
make resume-carrier-extension
make resume-carrier-record-dump
make resume-session-record-dump
make resume-watchdog-record-dump
make resume-evidence-bundle-verify
make resume-evidence-pair-verify
make resume-diagnostic-ladder-1001
make resume-diagnostic-rung2-cli-control-1001
make resume-diagnostic-rung2-cr3-reload-control-1001
make resume-diagnostic-rung3-fetch-only-1001
make resume-diagnostic-rung3-carrier-control-1001
make resume-diagnostic-rung3-cr3-reload-1001
make resume-diagnostic-rung3-vmcb-survey-1001
make resume-diagnostic-rung3-vmcb-owner-survey-1001
make resume-diagnostic-rung3-vmcb-owner-preflight-1001
make resume-diagnostic-rung1-vmcb-owner-strike-1001
make vmcb-owner-strike-1001-dump
make s3-userland-witness
make s3-userland-witness-dump
make fw1001-hen-static-check
make fw1001-shellcore-static-check
make byepervisor-ps5hen-1001
make PS5_PAYLOAD_SDK=/opt/ps5-payload-sdk probe
make PS5_PAYLOAD_SDK=/opt/ps5-payload-sdk entry-preflight
make PS5_PAYLOAD_SDK=/opt/ps5-payload-sdk entry-qualification
make PS5_PAYLOAD_SDK=/opt/ps5-payload-sdk exec-alias-preflight
make PS5_PAYLOAD_SDK=/opt/ps5-payload-sdk page-lease-preflight
make PS5_PAYLOAD_SDK=/opt/ps5-payload-sdk exec-alias-stage

entry-qualification is deliberately built with kernel mutation compiled out unless ENTRY_QUALIFICATION_MUTATION=1 is explicitly supplied. Separate, mutually exclusive opt-ins produce a one-byte write test (ENTRY_QUALIFICATION_MUTATION=1), a full image staging test (ENTRY_QUALIFICATION_STAGING=1), a process-local private-vector publication test (ENTRY_QUALIFICATION_VECTOR=1), or the fixed one-shot kernel probe (ENTRY_QUALIFICATION_EXECUTION=1). The first three mutation rungs passed once with exact restoration. The fixed probe was then invoked once and failed safely with ENOSYS: the helper made no progress, instruction fetch still saw the stock 0xcc, and the lease plus private process vector were restored. That direct kernel-text execution route is closed and must not be retried.

The selected replacement enters from Byepervisor's existing one-shot AP resume carrier after its verified 16-VMCB strike. The former complete ELF was the 637,480-byte attempt-03 artifact with SHA-256 3b2e10a743211a9732c3cdc9496bd62727bf42709f3559c2bf0e82e67edacbd2; do not rerun it. The prior 639,032-byte attempt-06 artifact and hardened 651,472-byte successful attempt-07 rung-1 artifact are also retired. The 651,984-byte attempt-08 rung-2 artifact is retired after its safe restoration failure. The corrected 652,280-byte attempt-09 rung-2 artifact is retired as passed. The 652,328-byte attempt-10 rung-3 artifact is retired after its hard failure. The 652,280-byte CLI-first rung-2 control passed as attempt 11. The 652,304-byte attempt-12 fetch-only artifact is retired after its hard wake failure. The 652,384-byte carrier-local artifact then passed as attempt 13: build-host-rung3-carrier-control/ps5-hen-byep-1001.elf, 652,384 bytes, SHA-256 5c12532fbd718a9edea37cb15c4b73f168631cadac02ac60d2f182328df60cc0. It tests only the carrier-local invocation/return path and explicitly records LOCAL_EXEC_RETURNED, not ALIAS_EXEC_RETURNED; it enables no HEN, fSELF, or fPKG patch. It is now retired as passed. Attempt 14 then passed the 652,560-byte rung-2 CR3-reload control, SHA-256 fb2683a336d80111e8b1f567585954036fb5c94faf62eee6b6891819df658b6a. Attempt 15 safely rejected before the strike because its read-only preflight found 64 structural VMCB candidates rather than the expected 32: 32 for each ASID, with exactly one RIP/CR3 self match. It performed no VMCB store, alias publication, CR3 reload, or alias fetch, so the rung-3 candidate is retired without a rung-3 result. Attempt 16 deployed the read-only duplicate-VMCB survey as run 0xcb3e0e199d96b32f; the console hard-failed during wake and the recovered files stop at the armed/pre-resume boundary. The deployed 652,960-byte ELF, SHA-256 47fac210..., is permanently retired. Its survey entry disassembles to mov edi,0xf00, an invalid absolute pointer after the carrier is relocated into kernel text. This is a concrete fatal defect and is consistent with the failure, but there is no crash RIP with which to prove the fault site.

The corrected entry uses RIP-relative assembly and is guarded by object- relocation and final-disassembly checks. The resulting corrected ELF was 652,976 bytes, SHA-256 ef13a1cd1e00915488440befa8d91558e0a0378afb79f7e886e8df31dca4d057; its 2,830-byte survey carrier is SHA-256 cad3e4b594b4d34c6e4f104fb2a9c14ab5f3871ffbb42f9dfd280d7b399614a4. Two independent builds match, and normal plus sanitized suites pass. Attempt 17 consumed its one-run authorization as run 0xc1857009f258b6e4. The survey record has flags 0x3f, 32 candidates, a unique exact-16 self run at 0x62a57000, and zero write/verify/rollback counts. It deliberately rejected before publication; its strict rung-3 bundle remains incomplete because no terminal watchdog slot was committed. Follow the diagnostic ladder.

The replacement target-selection design is implemented as a two-pass, ownership-derived verifier plus a separate rejection-only carrier. They follow the capture-backed pcpus[] -> pcpu_t -> vcore_t.m_vmcb graph, bind the incoming AP core to the exact self VMCB, and publish no target addresses on failure. Attempt 18 exercised the exact carrier as run 0x28f4760fcc3ef3b5: the sealed record passed with error zero, stable owner fingerprint 0x09b6044c10f7688a, sixteen unique/disjoint owners for both VM roles, core-1/self binding at 0x62a59000, and both nested-page masks 0xffff. The carrier deliberately rejected before any mutation or alias publication. No VMCB writer or kernel bootstrap is linked. See the VMCB owner-set gate and the owner-survey contract.

The mutation-disabled production-preflight profile is now hardware-qualified as attempt 19. It emits the final sealed VMSTK101 transaction ABI after two stable owner/value passes, retains every original primary clean field, and always returns HVS1/rejected. Its 2,706-byte carrier contains no writer and passes a final linked-image audit that confines all 89 explicit stores to its private stack or result record. A separate disconnected transaction engine implements immediate prewrite revalidation, full-width writes/readback, and reverse rollback under explicit I/O/exclusion capabilities, but is not called by the live profile. The reproducible candidate ELF is 652,848 bytes with SHA-256 f02068f541aa47c27e126604d113c25a1d696f745d8cd7d7321d886820093120. Run 0x6933d3faa24d78b7 returned through the expected rejection path with an error-zero sealed record, all owner/preflight/stable masks 0xffff, stable owner and transaction fingerprints, one barrier, 32 owner validations, and zero mutation/write/rollback activity. It enables no HEN feature. See the owner-preflight and transaction contract. The profile-bound eight-artifact verifier now accepts this hardware bundle as bundle_valid=1; its armed-only watchdog policy is opt-in and does not relax the generic rung verifier's observed-resume requirement.

Attempt 20 hardware-qualified the owner-derived mutation path. It keeps the exact attempt-19 read-only scanner, replaces that scanner only after return with a 2,926-byte rung-1 extension, revalidates all sixteen owners before and after mutation, and writes only primary VMCB +0x90 (9 -> 8) and low-32 +0xc0 (-> 0), and performs reverse verified rollback on detected partial failure. A final linked-image audit permits only the five required VMCB store instruction sites. Invalid terminal evidence or incomplete rollback latches reboot-required, persists evidence, retains the page lease, and refuses to return to elfldr. Two independent builds produce a 706,312-byte ELF with SHA-256 b9230dbdcaa0e8bd24a400a53f20bf22e406abe6c7951a1c01562b52ff0a0bed. Run 0x11e1e2081ed01e4e completed every 0xffff preflight/write/readback mask, 64 owner validations, 16 mutations, the resume witness, diagnostic rung 1, complete cleanup, and durable evidence with bundle_valid=1. It enables no HEN, fSELF, or fPKG functionality. See the owner-strike contract.

Attempt 21 hardware-qualified the separate owner-reentry diagnostic. It preserves the exact attempt-20 scanner and strike, issues one firmware-10.01 NOP VMMCALL, and returned from the VMEXIT/VMRUN boundary with zero RAX, the same CPU/CR3, and the alias slot still empty. The complete run-bound bundle validates. The reproducible ELF is 706,784 bytes with SHA-256 caf380a7aa659b3526d290214470a727b96e4cfc75d1bd48a00c9ec84929fa2b. The captured common handler writes the current VMCB CLEAN=-1 before dispatch, so this proves the round trip but not that NESTED_CTRL=8 was loaded or that NPT is functionally disabled. This remains a diagnostic, not a kernel executor or HEN. See the owner-reentry contract.

The new alias mutation artifact is additionally gated behind EXEC_ALIAS_PUBLICATION=1; it publishes only the prepared page-table entry, walks the mapping through physical memory, restores zero, and never accesses the alias. None of these artifacts installs HEN or enables fSELF/fPKG loading. See the 10.01 post-exploit interface for the exact preconditions, checks, and limitations. The separate HEN readiness gate records which fSELF, PS4 fPKG, ShellCore, and plugin prerequisites are actually supported by static or runtime evidence; it does not enable any of those features. The disabled syscall-622/IPMI observer locks the 10.01 create-server/create-client ownership boundary without granting live capture, hook, mutation, policy, or continuation authority. Its new host-only ShellCore verifier checks the exact retail-10.01 file identity externally and all fourteen semantically reviewed original instruction/branch windows internally. It includes neither replacement bytes nor a live writer, so this improves preflight evidence without enabling a ShellCore patch. The recovered firmware-10.01 SMP rendezvous path also has a host-tested, read-only live verifier, but it is intentionally disconnected from the target and does not call a callback or claim cross-core patch exclusion.

The port also includes a disconnected, host-tested 4 KiB structured diagnostic journal. It preserves committed events across a torn append but is not yet a console persistence or panic-capture implementation.

Package-path observations use a separate host-tested 4 KiB per-CPU capture ring. Its fixed C ABI is allocation-free, pointer-free, authority-zero, and binds each record checksum to its publication sequence. It is not connected to a target allocator, hook, trusted token issuer, exporter, or any AppInst/PFS/ AuthMgr producer, so it does not yet constitute live fSELF/fPKG evidence. Live qualification additionally requires wired page alignment, disciplined per-CPU selection, immutable inputs, authenticated replay analysis, and zero dropped records.

A separate host-tested constrained kernel-service contract defines bounded status, read, catalog-bound feature-control, and sealing operations without raw kernel write or call capabilities. It is not included in the target ELF and does not yet satisfy the persistent-executor gate.

The host-tested resident kernel-runtime contract defines the firmware-neutral handoff around that service: a derived RX/RO-NX/RW-NX image layout, guarded private stack, boot/run-bound request, immutable initialization receipt, and conservative externally owned lifecycle record. It is also disconnected from the target ELF; it is the destination ABI for a future owned-alias loader, not evidence that the loader exists.

Deploying

make test     # send payload to PS5
make debug    # deploy with GDB support