PS5 Relapse Exploit

Supported firmware: 7.00 through 13.60.

Usage

• In the network settings, set Primary DNS to 45.56.67.85 (Recommended)
• Run python3 serve.py locally, or open https://ntfargo.github.io/Relapse-Exploit/ on the PS5.
• The kernel stage loads payloads/kexp_2026_05_25.bin and payloads/elfldr-ps5-1360.elf; after a successful run, the ELF loader listens on port 9021.

Local hosting and sending payloads

1. Keep the computer and your PS5 on the same trusted LAN. Check the PS5 firmware and IPv4 address in Settings → System → System Software → Console Information and Settings → Network → Connection Status → View Connection Status.

2. From this repository, run python3 serve.py. Open its printed http://COMPUTER_LAN_IP:8000/ URL in the PS5 browser and wait for elfldr is listening on port 9021. If address discovery selects a VPN/interface the PS5 cannot reach, use the computer's LAN IP instead. Allow incoming TCP 8000 on your LAN if your firewall blocks hosting; do not expose this server to the internet.

3. In another terminal, send an ELF you have independently verified supports your firmware. Replace the example PS5 IP and file path:

   python3 send_payloads.py 192.168.1.22 /path/to/compatible-payload.elf
   

   To send several files, list their paths in the intended order. Options: --port 9021, --timeout 10, --delay 2 (seconds). Relative paths are resolved from your terminal's current directory. All files are checked before connecting; a transfer error stops the sequence without retrying.

The sender assumes the screenshot's raw-TCP convention: one connection per ELF, with EOF after the bytes. This protocol has not been independently verified against the bundled loader. Preflight checks basic ELF identity fields, not complete ELF validity or firmware compatibility. It requires a loader supporting that protocol and reports bytes sent, not successful execution. The delay does not prove the previous payload finished; send files separately and check the console when needed. Do not use the sender to transmit the kernel-stage .bin.

For firmware 13.60, the bundled loader is named accordingly, but filenames and ELF headers do not establish compatibility. This repository does not establish that your kstuff, shadowmountplus, or etaHEN builds support 13.60 or should be chained together. Follow each payload's release documentation; no default payload sequence is assumed.

Connection refused usually means the loader is not listening yet or has stopped. A timeout can indicate a wrong IP, firewall, or Wi-Fi client isolation. Check the console before retrying: an interrupted transfer may have partially delivered a payload.

Run the local sender checks (no PS5 required): python3 -m unittest test_send_payloads.py.

Stability notes

Webkit may need several attempts, reload the page if the browser stalls. The kernel exploit may hang or panic the console, so reboot before trying again if that happens.

Exploit chain

Browser stage uses JSC info leaks and a structured clone object pool mismatch to corrupt a typedarray. The kernel stage combines a address leak with an aio_multi_wait uaf race to establish kernel r/w.

Credits

• Sonic_Iso: Kernel Exploit
• Jordy: Webkit Exploit and Kernel Bug
• ntfargo: Exploit Dev
• ufm42: Exploit Dev
• Dr. Yenyen: Testing

Other helps:

• TheFlow, SlidyBat, Flatz, cow, nhk, bollarz, Sleirsgoevy, EchoStretch, EarthOnion.

Disclaimer

This project is intended for educational and security research purposes only. It does not endorse piracy, unauthorized access, or misuse of commercial devices. Use it only on devices you own or are authorized to test, and comply with applicable laws and regulations.

The software is provided as-is, without warranty. You assume the risks of using it, including system instability, data loss, and account bans. The maintainers accept no liability for resulting damage.