PS5 Hypervisor Exploit Released up to 13.60! (Byepervisor Reborn)

Summary

The video covers the release of Byepervisor Reborn, a standalone PS5 hypervisor exploit. The underlying vulnerability was fixed in firmware 14.10. The release is described as a developer-focused starting point, not a complete jailbreak package: it does not currently include HEN, patches, or other tools for running Linux or fake packages.

How the exploit works

During PS5 standby recovery, the system initializes its other processor cores while they use an unprotected nested-page-table configuration. The exploit takes advantage of this window to run code with read/write access to hypervisor memory. It follows a standby-based approach similar to Spectre’s earlier public hypervisor exploit.

The release is reported to support firmware 13.0, 13.20, and 13.60, with test builds and work underway for older versions. The developers say it may be adaptable to other firmware, but firmware 14.0 would also require a suitable kernel exploit.

Demonstration and setup tips

The video demonstrates the process on firmware 13.60:

1. Set the PS5’s USB ports to “Always” in the standby power-saving settings.
2. Run the existing jailbreak.
3. Load the Byepervisor Reborn payload. The presenter notes that it is still being tested and advises against loading it alongside other payloads for stability.
4. Confirm that the payload identifies the console model. Regular PS5 and PS5 Pro systems may use different addresses.
5. Put the console into rest mode and wait until the orange light stops flashing and remains steady.
6. Wake the console. A notification displaying the first eight bytes of kernel.text indicates that the exploit succeeded and execution-only memory protection was bypassed.

Why it matters—and what remains to be done

A working hypervisor exploit could eventually enable Linux on firmware up to 13.60, extending beyond the previously described Linux limit of 7.61. It could also help bring fake-package support to newer firmware, potentially simplifying game loading and avoiding some existing file-size and performance issues.

These are potential future capabilities, not features provided by this release alone. Linux payloads and other supporting software still need updates, and the exploit is not yet a complete solution for regular users.

Featured developers and sources

SonicISO, Geordi, Chendo Chap, The Flow, Spectre, Echo Stretch, Earthshion, and Arc Samer are mentioned. The video also refers to HackerOne and GitHub.