Firmware Support

Firmware Support

Firmware	Status	Notes
13.60	✅ Tested	Developed and verified on hardware (PS5 Phat & Slim).
13.20	⚠️ Untested	Offsets + 13xx shellcode restored from upstream.
13.00	⚠️ Untested	Offsets + 13xx shellcode restored from upstream.

Any other firmware is refused by the payload.

How it works

The exploit abuses the rest-mode startup_mp hypercall (the same bug targeted by Byepervisor-Reborn). On S3 resume startup_mp runs on core 0 to initialise AP cores and takes a reset vector; while the AP cores start, an insecure Nested Page Table configuration applies, giving R/W into the hypervisor's address space.

The payload:

1. Detects the running firmware (kernel_get_fw_version) and selects the matching offset table (off_1300, off_1320, off_1360).
2. Selects the correct kernel shellcode:
   • 13.60 → stock_shellcode_kernel_1360 (committed).
   • 13.00 / 13.20 → shellcode_kernel_13xx_bin (committed, built from upstream sources with -DFW_13XX_PORT=1).
3. Prepares the Linux image + resume, defeats the hypervisor, and enters rest mode.

Because both shellcode blobs are committed, a plain make produces the payload — there are no sub-builds.

Adding another firmware

Support is offset-driven. To add a firmware you need:

• a new offset_list table in source/offsets.c (all 60 qwords — see the struct in include/offsets.h);
• a case 0xXXXX: in set_offsets() in source/utils.c;
• the firmware accepted in source/main.c and in hv_defeat_13xx.c;
• a compatible kernel shellcode blob (13xx-port build) if the default one does not fit.

Offsets must come from a real kernel dump — never guess them.