ghostldr

ghostldr runs PS4 game dumps and OpenOrbis homebrew inside Star Wars Racer Revenge (SWRR) on a stock PS5. It uses Luac0re's userland JIT exploit: no kernel exploit, no jailbreak.

You need a PS5 with SWRR (US CUSA03474 or EU CUSA03492) and Luac0re 2.4b, your own game dump, an exFAT USB drive (recommended; installing into SWRR's saved data needs none), and a computer with Python 3.11+. No game files are included.

Full demo, 3½ minutes (MP4): from Luac0re's loader to Ghost's gameplay.

What works

• Games run from a USB drive plugged into the PS5: no install step, and they load faster than installed ones (docs/usb.md). This is the recommended way. Games can also be installed into SWRR's saved data instead, with no drive.
• Ghost of Tsushima v2.18 (CUSA11456) plays. It is the most tested title.
• Bloodborne 1.09 (CUSA00900) reaches gameplay, with its large executable spread over several JIT buffers and no memory plan yet.
• OpenOrbis homebrew runs (details).
• An FTP server on the PS5 while a game runs, to put more games onto the drive in it (docs/ftp.md).
• An ELF loader without a game: send OpenOrbis or freestanding ELF payloads to it with nc, and their output comes back on the connection. Userland only, no kernel exploit (docs/elfldr.md).
• A boot with no computer: two files sent with nc or a payload-sender app start a game or the ELF loader, with nothing on the computer serving files (below).
• Other games boot as far as their imports and memory allow.
• PS4 consoles are experimental: Ghost's code runs on a 12.02 PS4, but SWRR's memory budget there is 2.5 GiB, so Ghost doesn't fit and stops before it starts. Games load from saved data there, not from a USB drive (docs/ps4.md).
• Jak X instead of SWRR (EU CUSA07992 1.04, with UltraC0re) is experimental: Ghost plays there, in its PS4 Pro mode, from its own install in Jak X's save data (docs/jakx.md).

Getting started

Download the latest release and follow docs/using-the-release.md.

Prefer not to use a terminal? The desktop app walks through the same steps: find the console, check the setup, copy a game to a USB drive (or install it into SWRR's saved data), and play. The release page has an installer for macOS, Windows and Linux with Python included, and the release zip has it in app/ (with Python 3.11+).

Quick start, from the release folder. Copy your dump to an exFAT USB drive plugged into the computer (any folder name works; docs/usb.md says what goes on the drive):

python3 ghostldr.py copy /path/to/CUSA11456/app0

Plug the drive into the PS5, start SWRR, click the right half of the touchpad at PRESS START, then OPTIONS → HALL OF FAME until Luac0re's loader listens on port 9026. Check the setup once, then boot:

python3 ghostldr.py doctor

python3 ghostldr.py boot

With several games on the drive, the game selector shows them on the TV; boot CUSA11456 (or boot ghost) starts one straight away. python3 ghostldr.py check shows what the PS5 will find on a drive, and python3 ghostldr.py --help lists every command.

No drive? Install the game into SWRR's saved data instead, once per title (about 40 minutes for Ghost), from the SWRR region you will play in, with the loader listening:

python3 ghostldr.py install /path/to/CUSA11456/app0

Then restart SWRR, start Luac0re again, and python3 ghostldr.py boot: with no game on a drive, it boots the installed ones.

The computer's firewall must let Python receive on UDP 18194 and TCP 18195–18196.

Boot with no computer

No Python, no tools, and nothing on the computer serving files during the boot: the release page also has ghostldr.lua, ghostldr-ext.bin and ghostldr-elfldr.bin. With Luac0re's loader listening, send two files with nc (or a payload-sender app), where CONSOLE is the PS5's address:

nc CONSOLE 9026 < ghostldr.lua
nc CONSOLE 9021 < ghostldr-ext.bin

The first opens TCP 9021 on the PS5 and waits five minutes for the second; a jailbroken console's own ELF loader already has 9021, so there it opens 9022. The TV says which, with the PS5's address, in the dialog where Luac0re shows its own text, and then what happened. The second boots a game as ghostldr.py boot does: one on a USB drive in the PS5, else an installed one, with the game selector when there are several. Its log comes back on the same connection. Send ghostldr-elfldr.bin instead to start the ELF loader. The three files must come from the same release.

After the first time, send only ghostldr.lua. It keeps the last bundle in SWRR's saved data (a 16 MiB save container, GLDRCACHE). On a PS5 the ELF loader then starts on 9021 at once, and the TV counts down five seconds to the games: press OK (or ○) to stay in the ELF loader instead. A new release asks for its bundle again by itself. docs/using-the-release.md has the details.

Documentation

• Using the release: download to gameplay, step by step.
• USB drives: games on a USB drive, the recommended way: what goes on the drive, copying, checking.
• Ghost on a stock PS5: the same from source, with more troubleshooting.
• Compatibility: other games, homebrew, profiles, reading the log.
• Game selector: the picker for several games, on a drive or installed.
• FTP server: the console's files over FTP while a title runs.
• ELF loader: run ELF payloads in SWRR without a game, and build them.
• Web manager: save backup and restore from a browser.
• Host tooling: ghostldr.py's commands, run.py doctor, the boot preflight, the stub report.
• ghostfs: container names and the title catalogue.
• PS4: status and the diagnostic to run.
• Jak X: ghostldr in Jak X with UltraC0re, and what differs from SWRR.
• Architecture: repository layout, the core, host tools, dev setup.
• Runtime extension: the NID table and HLE families.

Building from source

You need macOS or Linux, Python 3.11+ and LLVM 18 (clang, ld.lld, llvm-objcopy, llvm-nm). Fetch the PS4 symbol names and Luac0re 2.4b into build/:

tools/fetch_deps.sh

Build the core, extension and selector. The default is Homebrew's llvm@18; add LLVM=/path/to/llvm/bin for another.

make -C ghostldr/native

run.py boot without --no-build runs this itself. The tests are described in docs/architecture.md.

License and credits

MIT, see LICENSE. It covers ghostldr's own code only; Luac0re, ps4libdoc and ps5-payload-sdk keep their own licenses. The selector's built-in font is under the SIL Open Font License 1.1 (OFL.txt).

• Luac0re, by Gezine and contributors (MIT).
• mast1c0re, by CTurt and McCaulay.
• PS4 symbol names from idc/ps4libdoc.
• ps5-payload-sdk, by John Törnblom (dev payloads only).
• Noto Sans, by the Noto Project Authors (the selector's font).
• shadPS4, used only as a reference for how system functions behave. No shadPS4 code is included.