PS5 Release: PS5 Payload ELF Loader v0.3 by John tornblom + FTP Server that survives Rest mode

PS5 Developer John Tornblom has updated one of his payloads, an ELF Loader that is compatible with both the BD-JB and the Webkit versions of the PS5 exploits for 3.00-4.51. This new release of the ELF Loader now survives rest mode, making it a very interesting addition to the payload collection for the PS5. No need to re-run the exploit!

Speaking of surviving Rest mode, the developer also has an FTP Server that should work when waking up the PS5 From Rest mode. (Download links below)

What is PS5 Payload ELF Loader

From the Readme:

This is an ELF loader for PS5 systems that have been jailbroken using either the BD-J ps5-payload-loader, or the webkit approached from Specter. Unlike the ELF loaders bundled with those exploits, this one uses the ptrace syscall to load itself into the ScePartyDaemon process, hence will continue running in the background even when playing games. Furthermore, this ELF loader will also resume its execution when the PS5 returns from rest mode.

The existing exploits both start they own ELF Loader, so you might ask why you would need to load a different ELF Loader from your ELF Loader. The answer is that this one can run in the background even when you’re exiting the original hacked process (BD Player or Webkit), which allows you to run this ELF loader e.g. when playing a game. Additionally, this latest release will survive the PS5 being put in Rest mode.

Download PS5 ELF Loader

You can download the latest release from the project’s github here.

Note that this ELF Loader runs on port 9021 (while the default ELF Loaders for the PS5 exploits are on 9020)

Usage:

To deploy the ELF loader itself, we first bootstrap via the ELF loader bundled with the exploit of your choice.

john@localhost:ps5-payload-elfldr$ nc -q0 PS5_HOST 9020 < elfldr.elf

Note: recent versions of the BD-J ps5-payload-loader include a binary version of this ELF loader which can be launched directly from the menu system.

Once the payload has been launched, a new socket server is started from the ScePartyDaemon process that accepts ELFs on port 9021:

PS5 FTP Payload

You can also download John’s FTP Server here. This payload is also compatible with both BD-JB and Webkit exploits, and is running by default on port 2121.

Client software that has been testing include gFTP, Filezilla, and Thunar. Furthermore, the payload supports a couple of custom SITE commands specifically for the PS5 (executed without prepending SITE). In particular:

• KILL – kill the FTP server. This allows you to launch other payloads.

• MTRW – remount /system and /system_ex with write permissions.