How ps5-payload-dev/elfldr works
ps5-payload-elfldr is a persistent PS5 payload loader. A jailbroken exploit first loads the entry ELF; it attaches to SceRedisServer to start a bootstrap, which launches a background socket server. Clients send ELF/SELF data or a URI/HTTP request; the server reads and dispatches the payload to the appropriate execution path. The ELF path uses ptrace to map and run code in a target process; the SELF path writes the image to console storage and execs it. README capabilities include URI-based local/HTTP(S) loading and keeping payload crashes isolated. Some lifecycle details are documented but not shown in sampled implementation excerpts.
Main entry points: socksrv.c Socket server · main.c Entry loader · bootstrap.c Bootstrap launcher · elfldr.c ELF execution
Components 16
Bootstrap
- Entry loader
main.c - Embedded assets
asset.h - Bootstrap launcher
bootstrap.c
Payload ingress
- Socket server
socksrv.c - URI retrieval
uri.c - ELF input
elfldr.c
Payload execution
- SELF input
selfldr.c - ELF execution
elfldr.c - SELF execution
selfldr.c
PS5 platform
- Ptrace operations
pt.c - Console notifications
notify.c
Other components
- Jailbroken exploit
- SceRedisServer
- Payload client
- PS5 process and storage
- URI content source
Connections 20
- Jailbroken exploit → Entry loader: loads ELF
README.md - Entry loader → Embedded assets: embeds bootstrap
main.c - Entry loader → SceRedisServer: attaches to
main.c - Entry loader → Ptrace operations: attaches via
main.c - Entry loader → Bootstrap launcher: executes in target
main.c - Bootstrap launcher → Embedded assets: embeds server
bootstrap.c - Bootstrap launcher → Socket server: spawns
bootstrap.c - Socket server → Payload client: accepts payloads
socksrv.c - Socket server → URI retrieval: fetches URI content
socksrv.c - URI content source → URI retrieval: provides content
README.md - Socket server → ELF input: reads ELF
socksrv.c - Socket server → SELF input: reads SELF
socksrv.c - Socket server → ELF execution: dispatches ELF
socksrv.c - Socket server → SELF execution: dispatches SELF
socksrv.c - ELF execution → Ptrace operations: uses ptrace
elfldr.c - ELF execution → PS5 process and storage: loads process image
elfldr.c - SELF execution → PS5 process and storage: writes and execs
selfldr.c - Entry loader → Console notifications: notifies
main.c - Bootstrap launcher → Console notifications: notifies
bootstrap.c - Socket server → Console notifications: reports address
socksrv.c