HyperHEN
An all-in-one HEN and Toolbox for PlayStation 5

Features · Run · Build · Configuration · Technical overview · Credits

HyperHEN is a modular payload stack for the PS5. One entry ELF prepares the system, injects a ShellUI Toolbox,
and then runs overlays, cheats, payloads, and background services.

HyperHEN v0.9.2 combines exact firmware routing, the source-built HyperCore, one common automount owner, firmware-gated Toolbox services, and a fully HyperHEN-branded native Settings interface. The visual system uses a unified 64 px icon family and a progressive APNG HyperCore emblem. Firmware image decoders that do not play APNG display its complete first frame, so animation never gates the UI.

HyperHEN is a practical homebrew stack for jailbroken PS5 consoles.

The combined HyperCore has console-log validation on firmware 5.00. Its additional firmware profiles are compatibility data, not proof of runtime validation. Exact modern profiles from 6.00 through 11.40 use A53/PPR; 11.60 and the listed 12.xx profiles use a reduced HyperCore route with PPR-dependent behavior disabled. Unsupported or non-exact profiles fail closed.

The complete exact profile list and each startup gate are documented in the technical overview.

• ShellUI Toolbox — a settings page injected into the PS5 ShellUI
• System preparation — raise privileges, remount filesystems, and block the update partition
• HyperCore — source-built kstuff + A53/PPR + BackPork in one embedded component, loaded by default
• Hypervisor route — source-built Byepervisor Reborn stage embedded for FW 13.00, 13.20, and 13.60; it completes through Rest Mode before HyperCore continues
• Legacy HEN route — source-built internal engine with exact profiles for 1.00–4.51; selected automatically before the common automount stage
• 5.xx Hypervisor route — source-built Byepervisor stage for 5.00, 5.02, 5.10, and 5.50; selected automatically before HyperCore
• 11.60/12.xx compatibility route — exact 11.60, 12.00, 12.02, 12.20, 12.40, 12.60, and 12.70 profiles start HyperCore without PPR, then require the runtime core check before Automount, Toolbox, plugins, or HyperDPI can continue
• Limited 13.xx route — 13.40 and 13.42 start only the utility/userland layer; HyperCore, Automount, daemon/Toolbox, HyperDPI, plugins, and payload auto-start remain disabled
• Plugin runtime — discovers, validates, starts, stops, and removes descriptor-bearing plugin ELFs
• Built-in debug services — Toolbox switches for klogsrv (3232), ftpsrv (2121), and the LAN ELF loader (9025), with process-aware start/stop handling
• HyperHEN Automount — source-built ShadowMountPlus engine embedded as a common post-HEN stage for image, title, USB, and fakelib mount lifecycle
• Remote Play pairing — enable the native PS5 Remote Play service, generate a pairing PIN, and register a client from the Network section
• User payload manager — start and stop user-provided .elf payloads, with optional auto-start
• Game overlay — an in-game bar for FPS, CPU, GPU, RAM, temperatures, and network info
• Cheat engine — local JSON, SHN, MC4, and ShnExt files that can be toggled at runtime
• HyperDPI — source-built browser package installer embedded in HyperHEN, with dynamic Toolbox controls
• HyperLinux Boot — source-built pLinux5-NG/ps5-linux-loader engine embedded behind a penguin entry in Advanced Debug; a one-shot clean-boot handoff keeps it isolated from HyperCore
• Startup voice — plays the embedded “HyperHEN START!” cue after the selected firmware engine is ready; enabled by default and optional in the Toolbox
• Console tools — account activation, external HDD, Title IDs, fan control, shortcuts, and game options
• App jailbreak — allowlisted homebrew can ask the daemon for extra privileges through a sandbox FIFO
• Resilient runtime — the critical daemon and utility daemon run apart; the main daemon can restart the utility
• Shared configuration — the Toolbox and daemons use one versioned config.ini

HyperHEN does not include a kernel exploit. The first hop still needs an external elfldr on 9021. After that, HyperHEN starts its own private loader on 9020 for later ELF and user-payload launches.

Open Advanced Debug → HyperLinux Boot to arm the embedded Linux loader. Because the upstream Linux boot path is incompatible with kstuff already being active, the button deliberately does not launch it in the current session. Fully reboot the console and start HyperHEN once: the bootstrapper consumes the one-shot marker and hands off to HyperLinux before HyperCore starts.

A prepared USB must contain bzImage and initrd.img either at its root or in PS5/Linux/. Rest Mode USB power must be set to Always and HDMI Device Link must be disabled. Exact profiles are 3.00, 3.10, 3.20, 3.21, 4.00, 4.02, 4.03, 4.50, 4.51, 5.00, 5.02, 5.10, 5.50, 6.00, 6.02, 6.50, 7.00, 7.01, 7.20, 7.40, 7.60, 7.61, plus the experimental 13.20 path. Other firmware revisions fail closed.

1. A jailbroken PS5
2. An external PS5 elfldr listening on port 9021 for the first hop

1. Run the kernel exploit and start the external elfldr service.
2. Send HyperHEN.elf through the loader your exploit host provides.
3. HyperHEN selects the exact internal firmware engine automatically. On FW 13.00, 13.20, or 13.60, follow the HyperHEN Hypervisor notification: enter Rest Mode once and resume. On the listed exact 11.60/12.xx profiles, wait for the compatibility-mode notification and the HyperCore runtime check.
4. Open PS5 Settings and enter the HyperHEN Toolbox where the selected route provides it. FW 13.40 and 13.42 intentionally run utility-only and do not inject the Toolbox.

Startup is sequential. After the first hop, HyperHEN uses its own hyperhen_elfldr.elf on port 9020 and keeps 9021 only as a fallback.

HyperHEN.elf → bootstrapper → exact firmware route → HyperHEN Automount → daemon/Toolbox where available

External plugins are discovered and started by the daemon after HyperCore is ready.

The Toolbox Plugins page manages both native HyperHEN plugin ELFs and etaHEN-compatible .plugin containers installed in /data/HyperHEN/plugins. HyperHEN validates the container identity and its embedded ELF separately, launches only the embedded ELF through the private loader, and preserves the plugin ID as the spawned process name. The existing start, stop, reload, delete, and next-boot auto-start controls apply to both formats.

Game-process .prx and .sprx modules remain isolated from standalone plugin processes. Their catalog is managed from Toolbox → SPRX, using /data/HyperHEN/sprx/catalog.ini with exact title-ID targeting. A structurally valid container does not guarantee compatibility with every game build or third-party plugin API.

Advanced Debug includes three independent switches: the kernel-log server on TCP 3232, the FTP server on TCP 2121, and the LAN ELF loader on TCP 9025. HyperHEN installs the two verified upstream payload images under /data/HyperHEN/tools, builds the LAN loader from source, launches each through its private loader, and records the returned process identity so the same switch can stop only the service it started. These unauthenticated development services must be used only on a trusted local network.

The separate onionHEN-ftpsrv-plugin remains supported as an optional plugin when a separately configurable FTP instance is preferred. Do not enable two FTP listeners on the same port.

HyperHEN embeds ShadowMountPlus as hyperhen_automount.elf and starts it only after the selected firmware route is ready. It is the sole active automount owner. Before HyperCore starts, the bootstrapper claims the kstuff automount sentinel; HyperCore's native scanner and integrated BackPork monitor then stay paused while HyperHEN Automount owns the lifecycle. If automount initialization fails, ownership is released instead of leaving two mount engines active.

The optional SceShellCore bridge is enabled only for exact offsets present in the supplied ShadowMountPlus table. Missing revisions are not approximated; the base scanner/mount service remains separate from those optional hooks. When the verified bridge is unavailable, the shared lifecycle watcher uses an offset-free SysCore child event to prepare package redirects and fakelib layers inside the pre-exec window. This supplies the legacy backport path on 1.05, 1.10, 1.11, 1.13, and 4.02 without inventing ShellCore offsets; verified profiles continue to use the earlier firmware-specific bridge.

HyperDPI is compiled from the pinned GPL source, embedded in the main payload, and launched from memory after the HyperHEN daemon is ready. No DPIV00001.elf, sidecar download, or file under /data/HyperHEN/plugins is required. Its dynamic Toolbox page provides enable, API port, WebUI port, and restart controls. The browser retains chunked uploads, queue management, staged-file reuse, and SSE progress. The default WebUI URL is http://<console>:12800.

The listeners are disabled on first boot. HyperDPI has no client authentication and listens on all console interfaces when enabled, so use it only on a trusted local network and stop it when finished. Settings are stored in /data/HyperHEN/HyperDPI.ini; uploads are staged under /user/data/HyperHEN/pkgs.

Remote Play pairing is available from Toolbox → Network → Remote Play. The current account must already be activated. If it is not, HyperHEN blocks the Remote Play page and directs you to Toolbox → Account → Account activation. Once the account is activated, HyperHEN enables the Remote Play registry setting and displays the pairing PIN. Enter that PIN in the official Remote Play client while the page is open; HyperHEN uses the native PS5 Remote Play service to confirm the registered device.

The feature provides pairing and registration only. Video streaming and client transport remain handled by Sony's native Remote Play service.

Place standalone payloads in:

/data/HyperHEN/payloads/

Only plain .elf files are supported. Auto-start can be turned on in the Toolbox; HyperHEN remembers that choice with a matching .auto_start file next to the ELF.

All .elf filenames use the same Payload page, loader, and auto-start flow. A recorded running instance is left running by later launch and auto-start requests. HyperHEN plugins are a separate category and belong in /data/HyperHEN/plugins/.

Put cheat files in one directory. Names are TITLEID_VERSION, with an optional process and 8-hex source ID:

/data/HyperHEN/cheats/<TITLE_ID>_<VERSION>[_<PROCESS>][_<SOURCE_ID>].json
/data/HyperHEN/cheats/<TITLE_ID>_<VERSION>[_<PROCESS>][_<SOURCE_ID>].shn
/data/HyperHEN/cheats/<TITLE_ID>_<VERSION>[_<PROCESS>][_<SOURCE_ID>].mc4
/data/HyperHEN/cheats/<TITLE_ID>_<VERSION>[_<PROCESS>][_<SOURCE_ID>].ShnExt

PROCESS is optional. SOURCE_ID is a stable physical-source discriminator. HyperHEN loads every compatible source for the title/version/process, so independent JSON, SHN, MC4 and ShnExt files can coexist. A source with an explicit process is only used for that process; a source without one is generic.

Cheats load from disk. If a file changes, HyperHEN reloads it without restarting the whole stack.

DOWNLOAD_CHEATS downloads a cheat catalog ZIP over HTTPS (GitHub or cnb.cool), extracts the cheats/ tree, and copies json/, shn/, and mc4/ files into this directory with their original names. [cheats] mirror=auto uses cnb.cool when the UI/system language is Simplified Chinese, otherwise GitHub.

export PS5_PAYLOAD_SDK=/path/to/ps5-payload-sdk
./scripts/build.sh --jobs 8

The script validates the vendored dependencies, builds HyperCore and HyperHEN Automount locally, and then builds the embed chain in the required order. It never downloads or accepts a precompiled kstuff or automount ELF.

For the reproducible Docker build:

docker compose build hyperhen-build
docker compose run --rm hyperhen-build

Run ./scripts/build.sh --help for the complete option list.

Final build outputs stay in build/. HyperCore's upstream Makefiles also create intermediate objects below third_party/kstuff-a53/; no generated ELF is accepted from the upstream artifacts/ directory.

Host tests cover settings, IPC, payload helpers, cheat parsers, relocation, Toolbox routing, and shared platform code:

make -C source/util/tests clean
make -C source/util/tests test -j8

Linking the host tests needs Keystone on KEYSTONE_PREFIX (default: /opt/homebrew).

HyperHEN reads and writes the same config in two places:

/data/HyperHEN/config.ini
/user/data/HyperHEN/config.ini

Most options can be changed in the Toolbox. The format is schema_version=1. If no file exists, HyperHEN writes a commented default from config.ini.example.

.
├── assets/                    Project artwork
├── docs/                      Architecture and technical notes
├── scripts/                   Build, dependency, and host-side helpers
├── source/                    In-tree PS5 sources
│   ├── bootstrapper/          Startup and embedded payload chain
│   ├── daemon/                Critical daemon and Toolbox injection
│   ├── util/                  Utility daemon, IPC, and cheats
│   ├── shellui/               Toolbox and ShellUI hooks
│   ├── i18n/                  Shared Toolbox / notification locale catalogs
│   ├── unpacker/              Final HyperHEN payload wrapper
│   ├── libonion_*/            Shared in-tree libraries
│   ├── common/                Shared low-level implementations
│   └── platform/ps5/stubs/    PS5 system-library link stubs
├── third_party/               Vendored dependencies, including source-pinned HyperCore
├── tools/                     Repository-side generators
└── build/                     Generated build outputs (ignored)

See the architecture document for the module and IPC map and the HyperCore integration note for source, startup, exclusivity, and firmware boundaries. The components and technical overview records the complete firmware-routing matrix, startup contract, embedded and external dependencies, pinned revisions, licensing boundaries, and validation status.

1. Before loading HyperHEN, make sure the external elfldr is reachable on port 9021.
2. Make sure the payload was built for this firmware with a complete PS5 Payload SDK.
3. If the selected route provides the Toolbox and it does not appear, wait for util → HyperCore → Automount → daemon to finish and check the logs. FW 13.40/13.42 intentionally have no Toolbox.
4. If HyperCore does not build, run ./scripts/sync_dependencies.sh; it reports the exact missing vendored source.
5. When you report a problem, include firmware, exploit host, SDK version, build type, logs, and steps to reproduce.

See CONTRIBUTING.md.

HyperHEN exists because of the PS5 homebrew and reverse-engineering community.

HyperHEN integration, product identity, firmware-route orchestration, release engineering, and project maintenance: MICHELE MEDIA.

• OnionHEN — original modular stack, retained under GPLv3 with its copyright notices and internal onion::* compatibility API
• etaHEN — LightningMods and contributors; source base of this tree
• GoldHEN — SiSTR0 and contributors; the PS4 all-in-one HEN this project takes after

• kstuff-lite — EchoStretch, sleirsgoevy, and contributors; Rest Mode Toolbox recovery follows its SceSysCore NOTE_EXEC watch for NPXS40087 and wait for libSceNpTrophy.sprx / libSceNpTrophy2.sprx
• ps5-payload-manager — itsplk; listen-socket rebind after Rest Mode (Unix IPC and TCP accept-fail self-heal) follows this project
• HEN-Cheats-Collection — TeeKay87; the community cheat collection downloaded by the built-in cheat sync
• PHU Games Tools — ArkSama; the in-game FPS counter follows PHU Games Tools skip-hook sampling (/dev/dce scanout and DMAP reads of libSceAgcDriver)

• PS5 Payload SDK — Prospero toolchain and headers
• elfldr — John Törnblom; external first-hop loader on port 9021. HyperHEN also builds isolated private (9020) and debug-LAN (9025) loader variants from its retained in-tree loader source
• klogsrv — John Törnblom, with current port/quiet argument work by Al-Azif; the verified upstream PS5 ELF is embedded for the Toolbox log-server switch
• ftpsrv — John Törnblom, with current-tree contributions from EchoStretch, Al-Azif, Matthew Vanek, and Gezine; the verified upstream PS5 ELF is embedded for the Toolbox FTP switch
• kstuff-a53 — integrated source snapshot combining the kstuff-lite base with A53/PPR and BackPork
• Byepervisor Reborn — supplied hypervisor-stage source integrated for its exact 13.00, 13.20, and 13.60 offsets
• Byepervisor 5.xx — supplied source integrated for its exact 5.00, 5.02, 5.10, and 5.50 profiles
• ps5-hen — supplied source integrated for its exact 1.00–4.51 profile set
• kstuff-lite — EchoStretch, sleirsgoevy, and contributors; HyperCore base
• ppr-patch — drakmor; A53/PPR integration base
• BackPork — BestPig; process monitor and fakelib mount base
• a53-code-exec — A53 technical reference; its ELF is not embedded
• onionHEN-ftpsrv-plugin — optional external FTP server plugin based on drakmor/ftpsrv
• ShadowMountPlus — Drakmor and contributors; source-built and embedded as the exclusive HyperHEN Automount engine
• onionHEN DPI v2 plugin — GPL source base for the embedded, HyperHEN-branded HyperDPI service
• onionHEN Plugin SDK — pinned compatibility ABI used by the embedded HyperDPI client
• pLinux5-NG and ps5-linux-loader — embedded HyperLinux boot engine and penguin artwork; exact firmware profiles are gated at runtime
• libhijacker — astrelsky; process hijack and kernel R/W
• NineS — buzzer-re; ShellUI injection
• cJSON — JSON parsing
• 7-Zip LZMA SDK — unpacker decompression
• miniz — cheat-file decompression
• Keystone Engine — ShnExt assembly support
• BearSSL — cryptographic support vendored at the HyperCore-pinned revision
• LibTomCrypt — cryptographic support vendored at the HyperCore-pinned revision
• ISA-L Crypto — cryptographic support vendored at the HyperCore-pinned revision

The exact provenance, revisions, inclusion form, firmware scope, and license boundary for every major component are recorded in the technical overview and the per-component HYPERHEN_VENDOR_LOCK.md files under third_party/.

Thanks as well to everyone else who tested, researched, or sent usable feedback.

This project is licensed under the GNU General Public License v3.0. Third-party components retain their respective licenses and notices; third_party/hyperlinux retains its AGPL-3.0 and GPL-3.0 terms. See THIRD_PARTY_NOTICES.md before redistribution.

HyperHEN is an unofficial homebrew project and is not affiliated with Sony Interactive Entertainment. Use it only on hardware you own and at your own risk. No warranty is provided.