$ show ps5-linux/ps5-linux-loader
This repository contains the ps5-linux-loader, a PS5 payload that exploits hypervisor vulnerabilities to boot Linux on PlayStation 5 consoles (firmware 3.00-7.61). The payload runs in kernel context, defeats the hypervisor using firmware-specific techniques (TMR relaxation, VMCB patching, ROP chains), loads a Linux kernel and initrd from USB storage, configures GPU/VRAM, disables IOMMU, and triggers a resume from rest mode to boot Linux in bare metal. The code is structured as a monolithic ELF binary with embedded shellcode components for kernel and hypervisor execution. It demonstrates sophisticated low-level system programming, including GPU DMA for physical memory access, IOMMU command submission, and custom page table manipulation. The project is actively maintained with support for multiple firmware versions and includes utilities for dumping device firmwares.
The LLM identified 3 files worth highlighting for reuse:
Implements GPU-based DMA for reading and writing arbitrary physical memory on PS5. It walks GPU page tables, allocates GPU-mapped buffers, and submits PM4 commands to transfer data between CPU and physical addresses. This module is self-contained with its own context struct and offset configuration, making it reusable for other PS5 payloads that require physical memory access without relying on kernel primitives.
Provides IOMMU command buffer submission and physical memory write operations. It initializes the IOMMU context from kernel softc, submits 16-byte commands, and writes 8-byte chunks to physical addresses using completion-wait store. The module is isolated and can be extracted for any PS5 payload needing IOMMU-based physical memory manipulation.
Handles loading of Linux boot files (bzImage, initrd.img, cmdline.txt, vram.txt) from multiple USB mount points with a path-override mechanism. It searches predefined paths, supports a 'path-override.txt' file for custom locations, and allocates memory for the loaded data. This pattern is reusable for any PS5 payload that needs to locate and read files from external storage with fallback logic.