Research / PlayStation 5

PS5 firmware 14.10 research

Project notes, findings, and experiment results. By Marwan Mohamed.

Research tooling fund

Claude Max 20x

Help fund the $250 CAD plan for cross-referencing the full PS5 research corpus and analyzing kernel attack surfaces.

Contribute via PayPal The research stays public.
Funding goal
Amount raised$3.28 / $250 CAD

Current total reported in the repository README.

14.10 kernel research progress

Evidence-weighted milestone estimate · Audited October 18, 2026

30/100

Strong userland research; kernel read/write is not demonstrated on 14.10. The 30/100 score is a subjective milestone estimate, not time remaining, odds of success, or an objective fraction of unknown work. Hypervisor bypass is excluded.

How the estimate is calculated
Judgment-based weights, with evidence required for each point
MilestonePoints / weight
14.10 research environment10 / 10
Probe tooling and captured evidence10 / 10
Target characterization10 / 15
Validated 14.10 kernel vulnerability0 / 20
Demonstrated 14.10 kernel read/write0 / 25
Repeatable complete kernel exploit0 / 20

230 Lua probe files · 247 result captures. Artifact counts are not exploit coverage. The complete scoped syscall survey and controlled CClosure dispatch are counted under target characterization; the kernel vulnerability, kernel read/write, and complete-exploit gates remain unearned. Probe 45c's earlier fn_addr/ROP and W^X-bypass claims remain retracted; the later CClosure redirect is a separate userland primitive. 13.60 results are not credited as 14.10 exploitation.

October 18 update: Target characterization rose to 10/15 after the scoped syscall survey. The project reports 17 KASLR techniques tested, with all tested paths blocked or unsuccessful. No 14.10 kernel image is available to validate a kernel candidate.

Read the current repository assessment · View scoring data · Download site scoring data
GitHub repositoryLatest update14.10 status13.60 projectContributeDonate

OCTOBER 18, 2026 · RESEARCH UPDATE

Latest research update

CClosure dispatch. The README now records the writable CClosure +0x20 field as an arbitrary function-dispatch primitive. Probe 56c directly demonstrates four redirects between existing Lua C functions and their expected return values. This is a confirmed userland capability; it does not establish kernel access or a complete kernel exploit chain. Read the probe log · Finding 82.

KASLR status. The Phase 14 summary reports 17 techniques tested, with every tested path blocked or unsuccessful on 14.10. The README documents the results, including AF_ROUTE sanitization, process-only VM-map results, and blocked or lethal syscall paths. This is the current KASLR wall, not proof that no future technique can work. Read the current status.

Selector 624. Probe 52b reports a stable +5 return delta per mmap. A separate follow-up saw 0xD31 six times, but does not independently establish native dispatch or the selector’s meaning. Follow-up evidence and limits.

13.60 offline analysis. A Ghidra review traces the retained +0x1c4 field through specific write-lock paths in a 13.60-labeled dataset. Acquisition authenticity remains unresolved, so this is not 14.10 kernel evidence. Analysis and limitations.

14.10 status: The README reports no validated kernel vulnerability, kernel read/write, or complete kernel exploit. Hypervisor bypass is also not demonstrated. The audited milestone estimate is 30/100; it is a subjective rubric score, not a probability or percent of work complete.

Historical diagram showing the old path from Lua userland toward kernel access; kernel read/write and hypervisor bypass remain unachieved.
Historical diagram of the earlier fn_addr/ROP model, retracted by probe 45c. The separate CClosure redirect was later confirmed as a userland dispatch primitive; kernel read/write remains unachieved. Open full size

The findings, probe logs, and analysis reports are linked above; each result is limited to its recorded scope.

Current work on 14.10

Phase 14 completed the scoped Sony syscall survey. The current repository describes 14.10 as a KASLR wall: its tested address-discovery paths did not yield kernel access, while several strong userland primitives are confirmed.

Project status by research area
UserlandCClosure +0x20 dispatch, heap R/W, tested syscall invocation, and a 317-region process map are documented
KASLR17 techniques tested; all tested paths blocked or unsuccessful
Kernel vulnerabilityNot demonstrated on 14.10
Kernel read/writeNot demonstrated on 14.10
Complete exploit / hypervisorNot demonstrated on 14.10
Repository architecture diagram connecting the Lua userland process and its interfaces to kernel subsystems. The filtered syscall path is shown separately from the alternate path.
Historical architecture diagram; the fn_addr/ROP execution model was later invalidated by probe 45c. Open full size

Current constraints

  • W^X and execute-only memory limit process-level code execution.
  • The confirmed CClosure redirect is a userland primitive; kernel read/write is still unproven.
  • The tested KASLR routes have not disclosed a kernel address on 14.10.
  • 13.60-labeled static artifacts do not prove behavior or exploitability on 14.10.

Each result is scoped to its recorded experiment. The findings and raw results distinguish observations from interpretations and open questions.

For individual experiments, start with PROBE_INDEX.md. For the sequence of work, read the changelog.

Contributing

Research findings and code analysis are welcome. Include the firmware version, the relevant experiment, and the output behind the finding.

Read CONTRIBUTING.md before opening a pull request. Questions and corrections can go in GitHub issues.

Funding goal: $250 CAD for Claude Max 20x; $3.28 raised at the latest README update. Contribute via PayPal.

Research diagram

Scroll to inspect the image. Press Escape or Close to return.