PS4 PKGToolBox, New PS4 FPKG Games, PS5 Jailbreak & TGS 2024 Updates

Following the AutoBackPort Mod for PS4 9.00, this week's PS4Scene / PS5Scene updates kick off with a PS4PkgToolBox fork for analyzing and editing PKG application files from @SeregonWar on Github via X Post proceeding the Overflow WebKit Memory Leak PoC fork and some more PS5 UMTX Jailbreak Updates with @zecoxao stating via X Post, "some heads up about PS5 PKG installation and hypervisor being defeated: defeating the hypervisor won't automatically make you able to install PS5 PKGs, even if you have access to kernel .text read and write. You can however use the added power to try and defeat the a53io core processor that separately handles the PS5 PKGs, but nobody has tried that yet."

Notnotzecoxao went on to remind users, "PS4 PKG installation on PS5 has a lot less security than its PS5 PKG installation counterpart" clarifying in another X Post, "not all games are supported. an increasing number of PS5 games is using more and more the a53io core."

He also shared via X an archive from anonymous for porting either webkit clobber exploit or bd-jb to 7.61:

• 761_cheatcodespack.rar (18.67 MB - includes 761_libkernel_sys.sprx, 761_libkernel_web.sprx, 761_libSceLibcInternal.sprx and 761_libSceNKWebKit.sprx)

For those just joining us, PS4 Fake PKGs (FPKGs) can be ran on Jailbroken PS5 consoles with 4.03 PS5HEN PS4 FPKG Enabler, 4.50 PS5HEN PS4 FPKG Enabler, 4.51 PS5HEN PS4 FPKG Enabler or PS5 Kstuff Porting Tool payloads while the first Backported PS5 Game PKG is playable via Itemzflow for PlayStation 5.

In PS4 News / PS5 News, Sony shared a TGS 2024 PlayStation Booth Recap hands-on report of the Tokyo Game Show 2024 which runs from September 25-29th featuring new screens from Metal Gear Solid Delta: Snake Eater, Dragon Quest III HD-2D Remake, Metaphor: ReFantazio, and Sonic x Shadow Generations.

They also unveiled the all-new iridescent Chroma Collection line of PS5 accessories available to pre-order October 3rd featuring Chroma Pearl, Chroma Indigo, and Chroma Teal coming soon to DualSense wireless controllers and PS5 console covers:

Chroma Collection | PS5

Also below is the livestream from CyberSaiyan on YouTube featuring Andy Nguyen's PlayStation 4 Remote Kernel Exploitation presentation from the RomHack Conference 2024 that took place on Saturday, September 28th, 2024 (17:15-18:05) in Rome, Italy via cybersaiyanIT:

RomHack Conference 2024 - Live Stream

This talk is about successful exploitation of kernel vulnerabilities in a network protocol on the PlayStation 4 which is based on FreeBSD. Andy will show how internals of the IPv6 protocol can be abused to achieve an information leak and to redirect control flow to get RCE with kernel privileges on the console.

From @SpecterDev via X Post comes a protip: "Feels great when an idea can finally be tested and works out after like a year Shouts to ChendoChap for working out the ROP chain. Protip: staying < 3.00 is a good idea."

• AMD-V Hypervisor Development - A Brief Explanation

Talk Title:

• Byepervisor: How We Broke the PS5 Hypervisor (Hardwear.io, October 21st-25th, 2024 at Amsterdam Marriott Hotel, Netherlands talk by @SpecterDev)

Abstract: Although a kernel exploit for the PlayStation 5 (PS5) has been public for years, the hypervisor-based security architecture has largely succeeded in preventing reverse engineering of the system and maintaining kernel integrity across all firmware versions—until now.

We will explore methods used to circumvent the hypervisor, enabling custom code execution and system library decryption. Additionally, we will reveal two previously undisclosed vulnerabilities in hypervisor firmware versions up to 2.50, which can be exploited for a full hypervisor compromise and the bypass of eXecute Only Memory (XOM) protection. Furthermore, we will release scripts to assist in reverse engineering the system, which will be made publicly available following the presentation.

Speaker Bio: SpecterDev is a security researcher who specializes in kernel exploitation, and is a previous speaker at hardwear.io. He started doing console research six years ago on the PlayStation 4, and has recently been focusing on the PlayStation 5 and the AMD Secure Processor on the side. He also co-hosts a weekly podcast and media channel called dayzerosec, which keeps up with and discusses various recent vulnerabilities, exploits, and research.

Schedule: 15:30-16:10 on October 24, 2024.

Finally in PS4 FPKG Game news, we'll continue adding new releases below throughout the next week so refresh this page periodically for the latest updates.

From @opoisso893 (backport893 on X to support via donation ) with help from @golemnight and thanks to Peoples92 comes:

• Shenmue III (CUSA12257) v1.06 PS4 FPKG
• Shenmue III (CUSA12257) DLC PACK [19] PS4 FPKGs

Shenmue III - CUSA12257 DLC PACK [19] by OPOISSO893

Steps:
    - Install Shenmue III - Opoisso893/Golemnight release
    - Install v1.06
    - Install DLC

Note:
    - v1.00: release with original keystone by Opoisso893/Golemnight
    - Dumped by Opoisso893/Golemnight

DLC:
    - Some DLC appears from Main Menu, others when you start from your previous saves and last one after entering Backer Code from "Settings Page 2" menu

    - Shenmue III - Battle Rally
    - Shenmue III - Big Merry Cruise
    - Shenmue III - Blazing Kick - Advanced Technique Scroll
    - Shenmue III - Burning Sandstorm - Advanced Technique Scroll
    - Shenmue III - Capsule Toys Reward
    - Shenmue III - Capsule Toys Rewards
    - Shenmue III - Dreams Come True Reward
    - Shenmue III - Gacha Tickets
    - Shenmue III - Hanamoji Reward
    - Shenmue III - Kenpogi Training Wear
    - Shenmue III - Otoshidama Ticket
    - Shenmue III - Peking Power Starter Pack
    - Shenmue III - Rod and Lure
    - Shenmue III - Ryo's Flight Jacket
    - Shenmue III - Senjafuda Reward
    - Shenmue III - Skin & Arcane Technique Scroll
    - Shenmue III - Snake Spirit Starter Pack
    - Shenmue III - Story Quest Pack
    - Shenmue III - World Telecom Reward

Backer Codes:
        - RFH33
        - ZZ4U9

• EA SPORTS FC 25 (CUSA46399) v1.03 PS4 FPKG
• EA SPORTS FC 25 (CUSA46399) v1.03 BACKPORT v2 PS4 FPKG
• EA SPORTS FC 25 (CUSA46399) AUDIO PACK [12] PS4 FPKGs
  • EP0006-CUSA46399_00-EASPORTSFC2025BG-A0103-V0100 (PS5 Merged DLC Esp-Mx).pkg (Patch-merged FPKG update for PS5 by @Bumblecito)
  • EP0006-CUSA46399_00-EASPORTSFC2025BG-A0105-V0100.pkg (Patch-merged FPKG update v1.05 for PS5 by @Ayden3011)
  • EP0006-CUSA46399_00-EASPORTSFC2025BG-A0105-V0100.pkg (Patch-merged FPKG update v1.05 for PS5 by @bulld0ze)
• Port Royale 4 (CUSA17475) v1.14 PS4 FPKG
• Port Royale 4 (CUSA17475) Buccaneers DLC PS4 FPKGs

Port Royale 4 - CUSA17475 Buccaneers DLC by OPOISSO893

Steps:
    - Install Port Royale 4 - Opoisso893/Golemnight release
    - Install v1.14
    - Install DLC

Note:
    - Release with original Keystone by Opoisso893/Golemnight
    - Dumped by Opoisso893/Golemnight

• Air Conflicts: Pacific Carriers (CUSA02866) v1.00 PS4 FPKG
• Celebrities Hacked Premium Edition (CUSA45109) v1.02 PS4 FPKG
• Exit the Gungeon (CUSA19037) v1.01 PS4 FPKG
• Construction Simulator 2 US Console Editon (CUSA10533) v1.03 PS4 FPKG
• NBA 2K25 (CUSA48139) v1.03 PS4 FPKG
• ELDEN RING (CUSA18723) v1.21 PS4 FPKG
  • ELDEN.RING_CUSA18723_v1.21_MOD_[9.00-11.00]_LAPY.pkg
  • ELDEN.RING_CUSA18723_v1.21_MOD_[5.05-6.72-7.xx]_LAPY.pkg
    • Elden Ring Mod Tool for Update 1.21.rar (5.3 MB - by @Lapy aka Lapy05575948 on X)
• Constructor (CUSA04035) v1.09 PS4 FPKG
• Disney Epic Mickey: Rebrushed (CUSA42649) v1.03 PS4 FPKG
• Disney Epic Mickey: Rebrushed (CUSA42649) Costume Pack DLC PS4 FPKGs

Disney Epic Mickey: Rebrushed - CUSA42649 Costume Pack DLC by OPOISSO893

Steps:
    - Install Disney Epic Mickey: Rebrushed - Opoisso893/Golemnight release
    - Install v1.03
    - Install DLC

Note:
    - Release with original keystone by Opoisso893/Golemnight
    - Dumped by Opoisso893/Golemnight

DLC:
    - Disney Epic Mickey: Rebrushed - Costume Pack

And from @CyB1K (Cyberpt1000 on X to support via donation ) with help from TRIFECTA (@Grief247allday, @jwooh and @stripnwild, support via Grief247allday's Profile Page ), @Archi55 and The World ismine comes:

• [CUSA47364] The Karate Kid Street Rumble Update v1.01 Fully Backported PS4 FPKG
• [CUSA16596] Cyberpunk 2077 Update v1.61 Fully Backported PS4 FPKG
• [CUSA18278] Cyberpunk 2077 Update v1.61 Fully Backported PS4 FPKG
• [CUSA16579] Cyberpunk 2077 Update v1.61 Fully Backported PS4 FPKG
• [CUSA36582] Prince of Persia The Lost Crown Complete Edition Update v1.40 + DLC Fully Backported PS4 FPKGs
• [CUSA36581] Prince of Persia The Lost Crown Complete Edition Update v1.40 + DLC Fully Backported PS4 FPKGs

_________        __________  ____ ____  __.
\_   ___ \___.__.\______   \/_   |    |/ _|
/    \  \<   |  | |    |  _/ |   |      <
\     \___\___  | |    |   \ |   |    |  \
\______  / ____| |______  / |___|____|__ \
        \/\/             \/              \/
   _____ ___________________ __________.___
  /  _  \\______   \_   ___ \\____    /|   |
/  /_\  \|       _/    \  \/  /     / |   |
/    |    \    |   \     \____/     /_ |   |
\____|__  /____|_  /\______  /_______ \|___|
        \/       \/        \/        \/

Prince of Persia The Lost Crown CUSA36581 DLC Pack v2

DLC Content:

- Warrior Within Outfit (Pre Order Bonus)
- Immortal Outfit
- Prosperity Bird Amulet
- Dark Prince Skin
- Two Thrones Skin
- Mask of Darkness

To access the Outfits, After first boss press Options Button then Triangle to go to Skins. For the Amulet Meet The Mage woman to unlock it and be able to use it. To access the Mask of Darkness expansion you must first complete "The Tiger and Rat" quest and then go to The Haven!

Enjoy

By Arczi and CyB1K

Also from @Pout comes:

• Summum Aeterna (CUSA41257) v1.06 Backported PS4 FPKG

And from @Souchong comes:

• LAIR of the CLOCKWORK GOD (CUSA19485) v1.03 PS4 FPKG
• TASOMASHI: Behind the Twilight (CUSA31503) v1.00 PS4 FPKG

Spoiler: Related X Posts

Netctrl (poops) done porting to ps4 up to 13.00 and now going to finish ps5 port I also want to thanks gezine_dev for the JIT expilot now I can do some magic up to latest FW on both Ps4 and Ps5 will share some cool stuff soon
hv < 5.00 seems to be out soon
a53-code-exec (PS5 A53 Code Execution PoC: PoC for code execution on a53 used by PS5 on fw 02.00) a53 code exec by cragson. gives you enough power to bypass hv using tmr trick
valid for 1.xx, 2.xx, 3.xx, 4.xx, should let you read and write kernel .text
flatz drops this.. everything is coming

• [B]HvExploit java[/B] (includes HvExploit.java, Main.java and TmrRegionConfig.java)

 

[Kenny5050]

2025 is definitely going to be a good year for the PS5, still have mine in the box from launch day waiting for a complete exploit to be released.

so from what I hear they're still working on getting PS5 FPKGs to work? it'll only be a matter of time I'm sure

 

[ivailo ivanov]

The new ui is sick. Also I wonder if I can play FC25 on 11.00

 

[vrushesto]

Hey thanks for the updates. Since portability of all games of ps4 on ps5 it is indeed exciting time to own a ps5.

 

[MrFunkerton]

Late to the game, is this a good time to try to get a lower firmware PS5 and jailbreak it when PS5 PKGs work properly? Or did I miss the boat?

 

[DarkDestro28]

So does anyone have a tutorial how to use it as i'd like to try to use it for updating games etc if it's easy to do lol

 

[ASPSXH]

Liking the new format of having a weekly post summarizing all the events that happened throughout said week + FPKGs. Great work

+Happy October to y'all!

 

[blimblim04]

@MrFunkerton You are never late if you're willing to pay top price for a 4.51 or lower FW PS5.

 

[HAZE348]

permanent with testkit an online functionality possible ?

 

[SantiVenom]

The new UI for the toolkit is clean, but in my opinion, I prefer the older one

Also great to see in the replies that there is more stuff coming! This year has already been great for the PS4 I can't wait to see how the year ends.

 

[youngcs]

Thank you for sharing this news