A major development has emerged in PlayStation 5 security research. Developers from the PS5Dev community have publicly released Byepervisor Reborn, a hypervisor exploit that opens new possibilities for PS5 system modification and homebrew development.
The project is available on GitHub and currently provides support for firmware 13.20 and 13.60, with firmware 13.00 listed as untested. The underlying vulnerability may affect versions as early as 6.xx, although these versions are not yet fully supported by the released code.
WHAT MAKES THIS DIFFERENT FROM RELAPSE?
Relapse provides a way to gain kernel-level access on compatible PS5 firmware. Byepervisor Reborn goes a step further by targeting the hypervisor, a security layer that controls access to protected system resources.
The exploit takes advantage of a weakness in the PS5's rest-mode recovery process. During this process, certain CPU cores temporarily operate with memory permissions that can expose protected hypervisor memory.
By exploiting this behaviour, researchers can gain read-and-write access to parts of the hypervisor's memory and make further system modifications possible.
DOES THIS MEAN A FULL PS5 JAILBREAK IS AVAILABLE?
Not yet. The developers clearly state that Byepervisor Reborn is a foundation for further development rather than a ready-to-use jailbreak.
The current release requires an existing kernel exploit chain and ELF loader. It does not include HEN patches or a complete installation package for ordinary users.
However, this is an important step because developers now have public code they can study, modify and use to build more advanced tools.
WHAT ABOUT PS5 PRO AND FIRMWARE 14.00?
The released payload includes separate memory handling for standard PS5 and PS5 Pro consoles.
The developers also suggest that the underlying vulnerability could potentially be used on firmware 14.00 with modifications. However, the public release does not support 14.00, and there is no confirmed public kernel exploit chain for that firmware in the project's documentation.
WHY THIS MATTERS
The release could accelerate development of more capable homebrew applications, system research tools and future jailbreak features.
For now, the most important distinction is that hypervisor exploitation has been made public, while a complete user-friendly jailbreak based on this release has not.
Source
Technical vulnerability analysis:
https://github.com/soniciso1/ps5-hv-writeups/blob/main/s3-resume-startup_mp-ap-launch.md
