The PS5 Kernel exploit was released in October, a bit less than 2 months ago, impacting PS5 firmwares 3.00 to 4.51 included. Although progress has been made since the initial release, it’s become clear that a “kernel exploit” isn’t the holy grail it used to be on previous console generations: Hackers have read and write access to parts of the system, but not enough to run significant unsigned code at the moment.

A bit of PS5 Exploit history

Hacker TheFloW dropped a bomb on the PS5 scene back in September, when he disclosed the first ever Kernel exploit for the PS5. Based on an older PS4 vulnerability that somehow managed to make its way to the PS5, this initially appeared to have fully unlocked the PS5. But it turned out that with additional security in place, the PS5 remains reasonably secure even after a Kernel exploit.

In concrete terms, the exploit gives us read/write in some parts of kernel memory, but no execution.

PS5: Two versions of the same exploit

There exists two “version” of the PS5 exploit floating around. The Webkit version, and the BD-JB version. These two variants use the same kernel exploit, but rely on two different vulnerabilities as entry points (either a Webkit vulnerability in the PS5’s browser, or an exploit in the BluRay implementation of the PS5). Both have their pros and cons, although from most use cases they are pretty much equivalent. People with a Digital Edition of the console are of course constrained to the Webkit exploit.

What’s possible with a hacked PS5 today

Here is a roundup of the tools that have been released for hacked PS5s:

• The exploits themselves (John Tornblom’s implementation for BD-JB, SpecterDev’s implementation for Webkit), which turn off some of the security of the PS5 and allow to send a payload to the console, either as an ELF file, a raw binary, or a JAR file (BD-JB only for the JAR loader)
• Both Exploits allow access to the Debug Menu on the PS5, a QA utility that lets you display interesting information about the console.

• Among available payloads, possibly the most interesting one is an FTP Server, which lets you access the PS5s hard drive, and copy files from/to it. (FTP Server for Webkit, FTP Server for BD-JB)

• Redis Server Interface. The PS5 uses a Redis server to store/retrieve some configuration entries, and we have access to that.
• There are a few unencrypted files you can modify for fun and profit on the PS5. Among them, the notifications database, which can be tweaked to let you do various things (launch the hidden browser, shortcut to the exploit, etc…)

• Last but not least, there is a Homebrew SDK, to help developers create ELF files that can be loaded on their hacked console

We’re still far from  “full fledged homebrew environment” as you can see, but things could evolve quickly if hackers find new vulnerabilities in other layers of the PS5 security. To stay up to date on future developments, check our PS5 Jailbreak page.

Any release we’re forgetting in the list above? Let us know in the comments!