Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
c4856cd
Add 12.50 / 12.52 support
ArabPixel Dec 19, 2025
e82e513
12.5x fixes
ArabPixel Dec 31, 2025
3d7a545
12.5x fixes and 13.0x support
ArabPixel Dec 31, 2025
454680a
Remakeing Makefile
ArabPixel Jan 5, 2026
46968b9
Add fixed offset for gpu_devid_is_9924 for 12.50 FW
feeRnt Feb 14, 2026
841cd78
Merge pull request #1 from feeRnt/master
ArabPixel Feb 14, 2026
4c23b71
switch vram to mb & add 256/512mb server payloads
rmuxnet Mar 22, 2026
e5a7213
Merge pull request #2 from rmuxnet/master
ArabPixel Mar 22, 2026
88cf532
Merg PS4 Pro payloads in PS4 FAT/SLIM payloads + Support for PS4 7.50
ArabPixel Mar 27, 2026
a3161a4
Add PS4 8.xx Support
ArabPixel Mar 28, 2026
60f6acf
add 128MB support
rmuxnet Mar 28, 2026
837a49c
Merge pull request #3 from rmuxnet/master
ArabPixel Mar 28, 2026
3c25188
Add 7.55 to Readme as supported firmware
ArabPixel Mar 28, 2026
2769dd6
Add support for ``/user/system/boot/`` boot path as a backup if the h…
ArabPixel Mar 28, 2026
e9ddc48
feat: unified AIO payload architecture and kexec deduplication
rmuxnet Mar 31, 2026
b424fee
Merge pull request #4 from rmuxnet/aio-refactor
ArabPixel Apr 1, 2026
2469ce6
Unitfy Baikal and non baikal payloads in one.
ArabPixel Apr 2, 2026
bbcf07f
Change output folder to payloads and name to linux-size
ArabPixel Apr 2, 2026
7280a37
Update Readme
ArabPixel Apr 2, 2026
99e7618
Proper alerts in main-aio.c
ArabPixel Apr 2, 2026
4ace3c6
Remove debug logs
ArabPixel Apr 2, 2026
90c6fb1
Update README.md
h5d7r Apr 3, 2026
7d4e727
Merge pull request #5 from h5d7r/master
ArabPixel Apr 3, 2026
f688fba
Add missing cases to normalize fw version
ArabPixel Apr 3, 2026
346dc31
Refactor PS4 payloads build workflow in GitHub Actions
m2k7m Apr 6, 2026
24c6f55
Merge pull request #6 from m2k7m/master
ArabPixel Apr 6, 2026
fc64aee
Update README.md
ArabPixel Apr 6, 2026
2469d80
Fix 10.50 offsets
ArabPixel Apr 7, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
44 changes: 25 additions & 19 deletions .github/workflows/build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ on:
branches:
- master
pull_request:
workflow_dispatch: # Allows the workflow to be invoked manually from the Actions tab

jobs:
build:
Expand All @@ -19,31 +20,36 @@ jobs:
sudo apt-get update
sudo apt-get install -y build-essential clang llvm yasm zip

- name: Build PS4 payloads in linux/
- name: Build PS4 payloads in linux
run: |
cd linux
make

- name: Collect artifacts
- name: Count generated files
run: |
mkdir -p artifacts/bin artifacts/elf
find linux/fw* -name '*.bin' -exec cp --parents {} artifacts/bin/ \;
find linux/fw* -name '*.elf' -exec cp --parents {} artifacts/elf/ \;
echo "Counting generated payloads in linux..."

BIN_COUNT=$(find linux -name 'linux-*.bin' | wc -l)
ELF_COUNT=$(find linux -name 'linux-*.elf' | wc -l)

echo "Found $BIN_COUNT linux-*.bin files."
echo "Found $ELF_COUNT linux-*.elf files."

# Export counts to GitHub ENV
echo "BIN_COUNT=$BIN_COUNT" >> $GITHUB_ENV
echo "ELF_COUNT=$ELF_COUNT" >> $GITHUB_ENV

- name: Zip artifacts
- name: Collect artifacts
run: |
cd artifacts
zip -r ps4-payloads-bin.zip bin
zip -r ps4-payloads-elf.zip elf
mkdir -p artifacts/bin artifacts/elf

find linux -name 'linux-*.bin' -exec cp {} artifacts/bin/ \;
find linux -name 'linux-*.elf' -exec cp {} artifacts/elf/ \;

- name: Create GitHub Release and upload assets
uses: softprops/action-gh-release@v2
- name: Upload artifacts to GitHub Actions
uses: actions/upload-artifact@v4
with:
tag_name: v${{ github.run_number }}
name: "PS4 Payloads Release v${{ github.run_number }}"
body: "Automated build of PS4 payloads."
files: |
artifacts/ps4-payloads-bin.zip
artifacts/ps4-payloads-elf.zip
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
name: ps4-linux-payloads
path: |
artifacts/bin
artifacts/elf
16 changes: 16 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
# Compiled Object files
*.o

# Static libraries
*.a

# Executables and Binaries
*.elf
*.bin

# Archives
*.zip

# Build output directories (adjust if your folder is named differently)
fw_aio/
lib/syscalls.asm
95 changes: 72 additions & 23 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,19 +1,22 @@
# ![PS4](https://img.shields.io/badge/-PS4-003791?style=flat&logo=PlayStation) Linux Payloads for FW 5.05 - 12.02
# ![PS4](https://img.shields.io/badge/-PS4-003791?style=flat&logo=PlayStation) Linux Payloads for FW 5.05 - 13.02
(Southbridge: Aeolia & Belize(2) & Baikal)

**Linux-Payloads** kexec for PlayStation 4.

The host with precompiled Linux payloads only works with GoldHEN v2.4b18.5/v2.4b18.6 BinLoader. Just open the web browser and cache the host—it will also work offline too.
https://ps4boot.github.io [▶️ click](https://www.youtube.com/watch?v=T3rXMWw6nIM)
The host with precompiled Linux payloads works well with GoldHEN's PayLoader. Just open the web browser and cache the host—it will also work offline too.
[PSFree-Enhanced](https://arabpixel.github.io/PSFree-Enhanced)

you’ll find Linux payloads for your firmware, along with some extra payloads. The rest are already included in GoldHEN.
There's also a great [Linux setup guide by DionKill](https://dionkill.github.io/ps4-linux-tutorial/)


# Supported Firmwares

* FW 5.05 ✅
* FW 6.72 ✅
* FW 7.00 / 7.02(?) ✅
* FW 7.00 / 7.01 / 7.02 ✅
* FW 7.50 / 7.51 / 7.55 ✅
* FW 8.00 / 8.01 / 8.03 ✅
* FW 8.50 / 8.52 ✅
* FW 9.00 ✅
* FW 9.03 / 9.04 ✅
* FW 9.50 / 9.51 / 9.60 ✅
Expand All @@ -23,38 +26,61 @@ you’ll find Linux payloads for your firmware, along with some extra payloads.
* FW 11.02 ✅
* FW 11.50 / 11.52 ✅
* FW 12.00 / 12.02 ✅
* FW 12.50 / 12.52 ✅
* FW 13.00 ✅
* FW 13.02(?) ✅

## Info
The internal path by default is at: ``/data/linux/boot``, however it'll also check for ``/user/system/boot/`` in case it was not found.

## New
- Automatic boot files placement – The kernel (bzImage) and initramfs.cpio.gz are now automatically copied to /data/linux/boot on the internal drive from the external fat32 partition. Why? No external drive is needed to boot into the rescue shell, only first time.
the rest is coming from the initramfs.cpio.gz init configuration
so you can go into the rescue shell without a usb stick just upload the ``bzImage`` and ``initramfs.cpio.gz`` over ftp to your PS4 Drive:

- RTC time passed to initramfs – The current time from OrbisOS is added to the kernel command line (time=CURRENTTIME), ensuring the correct time is set at boot instead of defaulting to 1970, even if the RTC hardware cannot be read directly. Why? why not. but you need a prepared initramfs that reads the Time from the cmdline and set the time.
``/data/linux/boot/[bzimage,initramfs.cpio.gz]``

or
``/user/system/boot/[bzimage,initramfs.cpio.gz]``

## Info
the internal path by default is at: ``/data/linux/boot``
the rest is coming from the initramfs.cpio.gz init configuration
so you can go into the rescue shell without a usb stick just upload the ``bzImage`` and ``initramfs.cpio.gz`` over ftp to your PS4 Drive
``/data/linux/boot/[bzimage,initramfs.cpio.gz]``
and of course it will work too with a USB / HDD Drive. USB have highest prio so if a USB is connected he will use this bzImage and initramfs.cpio.gz from there
and of course it will work too with a USB / HDD Drive. USB have highest priority. If a USB is connected, it will use the bzImage and initramfs.cpio.gz from there .

bootargs.txt you can also add a textfile for changing the cmdline.
vram.txt with this you can change the vram over a textfile.
### vram.txt
Control VRAM size via a plain text file containing a number in **MB** (not GB).

| vram.txt value | VRAM allocated
|:-:|:-:|
| `32` | 32 MB
| `64` | 64 MB
| `128` | 128 MB
| `256` | 256 MB
| `512` | 512 MB
| `1024` | 1 GB
| `2048` | 2 GB
| `3072` | 3 GB
| `4096` | 4 GB

Default is 1024 MB (1 GB) if vram.txt is missing or invalid. Minimum is **32 MB**.

## Server Use (Low VRAM Payloads)

## Note
* With new GoldHEN Version v2.4b18.5/v2.4b18.6 use .elf`s Files instead of .bin it works better 100% Success.
- **Why 32MB, 64MB, 128MB, 256MB, 512MB?** The idea behind these low VRAM payloads is for users who are repurposing the PS4 as a server for RAM and CPU intensive tasks. If you're just running server stuff headless, you don't need 1GB+ of memory wasted on the GPU. Using these payloads frees up that shared unified memory to be used as regular system RAM instead.

* Don`t use PRO Payloads for Phat or Slim.
- **How to use:**
- **Option 1:** Just run the payload with the desired VRAM size (e.g. `-32mb`, `-64mb`, etc.).
- **Option 2:** Add the value (e.g. `32`, `64`, `128`, etc.) into your `vram.txt` file to set it manually. Don't use these if you plan on gaming or using heavy desktop graphics!
> Note: vram.txt takes priority. if `vram.txt` is present it'll ignore any other payload value you load and use the specified value from `vram.txt`

## Notes
* If you face a black screen, make sure to use a kernel from an up-to-date guide.
* Use .elf`s files instead of .bin whenever possible.
* if you need UART just add this to the cmdline i have disabled .... just for now on newer Kernel it doesnt work.

Aeolia/Belize: ``console=uart8250,mmio32,0xd0340000``

Baikal: ``console=uart8250,mmio32,0xC890E000``


## Compile
git clone https://github.com/ps4boot/ps4-linux-payloads
## How to Compile
git clone https://github.com/ArabPixel/ps4-linux-payloads
cd ps4-linux-payloads/linux
make

Expand All @@ -63,6 +89,29 @@ Baikal: ``console=uart8250,mmio32,0xC890E000``
* marcan, shuffle2, eeply, rancido, valeryy, ethylamine, Joonie86 (Linux)
* sleirsgoevy (for the script and better exploit FW 672)
* AlAzif / KiwiDog / Specter / Celesteblue / ChendoChap / zecoxao / SocraticBliss / ctn123 (Exploit and Fun Stuff for the Console)
* bestpig / EchoStretch / EinTim23 / tihmstar (Offsets)
* others ...
* bestpig / EchoStretch / EinTim23 / tihmstar / ArabPixel (Offsets)
* Contributors
* others ...


## Change log
- PS4 PRO, Southbridge and firmware version run-time detection [v24b](https://github.com/ArabPixel/ps4-linux-payloads/releases/tag/v24b)
- No more separate Baikal or PRO payloads
- firmware agnostic payload. AKA one payload works for all supported firmware versions

- Backup files path [v23](https://github.com/ArabPixel/ps4-linux-payloads/releases/tag/v23)
- Looks for the files in ``/user/system/boot/`` if they weren't found in the default path ``/data/linux/boot/``

- Complete support for PS4 7.xx and 8.xx. [v23](https://github.com/ArabPixel/ps4-linux-payloads/releases/tag/v23)

- Sub-1GB VRAM payloads [v22](https://github.com/ArabPixel/ps4-linux-payloads/releases/tag/v22)
- Added 128mb, 256mb etc.. payload sizes for PS4 used as a headless server where GPU memory is largely unused. Set `vram.txt` to `128`, `256` or `512` (MB) to use them.
- **32 VRAM payloads are now supported.**

- PS4 12.5x, 13.0x Support. [v21.5](https://github.com/ArabPixel/ps4-linux-payloads/releases/tag/v21.5)

- Automatic boot files placement – The kernel (bzImage) and initramfs.cpio.gz are now automatically copied to /data/linux/boot on the internal drive from the external fat32 partition. Why? No external drive is needed to boot into the rescue shell, only first time.

- RTC time passed to initramfs – The current time from OrbisOS is added to the kernel command line (time=CURRENTTIME), ensuring the correct time is set at boot instead of defaulting to 1970, even if the RTC hardware cannot be read directly. Why? why not. but you need a prepared initramfs that reads the Time from the cmdline and set the time.

bootargs.txt you can also add a textfile for changing the cmdline.
8 changes: 4 additions & 4 deletions freebsd-headers/ps4-offsets/1050.h
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,13 @@
#define kernel_offset_xfast_syscall 0x1c0
#define kernel_offset_allproc 0x02269f30
#define kernel_offset_vmspace_acquire_ref 0x00476140
#define kernel_offset_vmspace_free 0x0x00475f70
#define kernel_offset_vmspace_free 0x00475f70
#define kernel_offset_printf 0x00450e80
#define kernel_offset_kmem_alloc 0x0036e120
#define kernel_offset_kernel_map 0x021a9250
#define kernel_offset_kmem_alloc 0x428960
#define kernel_offset_kernel_map 0x22A9250
#define kernel_offset_sysent 0x011029c0
#define kernel_offset_proc_rwmem 0x004244a0
#define kernel_offset_copyin 0x000d7560

#define kernel_patch_kmem_alloc_1 0x00428a2c
#define kernel_patch_kmem_alloc_2 0x00428a33
#define kernel_patch_kmem_alloc_2 0x00428a34
14 changes: 14 additions & 0 deletions freebsd-headers/ps4-offsets/1250.h
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
#pragma once
#define kernel_offset_xfast_syscall 0x1c0
#define kernel_offset_allproc 0x1B28538
#define kernel_offset_vmspace_acquire_ref 0x2F6F60
#define kernel_offset_vmspace_free 0x2F6D90
#define kernel_offset_printf 0x2E0420
#define kernel_offset_kmem_alloc 0x465A20
#define kernel_offset_kernel_map 0x22D1D50
#define kernel_offset_sysent 0x1102B70
#define kernel_offset_proc_rwmem 0x365FE0
#define kernel_offset_copyin 0x2BD6B0

#define kernel_patch_kmem_alloc_1 0x465AEC
#define kernel_patch_kmem_alloc_2 0x465AF4
14 changes: 14 additions & 0 deletions freebsd-headers/ps4-offsets/1300.h
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
#pragma once
#define kernel_offset_xfast_syscall 0x1c0
#define kernel_offset_allproc 0x1b28538
#define kernel_offset_vmspace_acquire_ref 0x2F6F80
#define kernel_offset_vmspace_free 0x2F6DB0
#define kernel_offset_printf 0x2E0440
#define kernel_offset_kmem_alloc 0x465A40
#define kernel_offset_kernel_map 0x22D1D50
#define kernel_offset_sysent 0x1102B70
#define kernel_offset_proc_rwmem 0x366000
#define kernel_offset_copyin 0x2BD6D0

#define kernel_patch_kmem_alloc_1 0x465B0C
#define kernel_patch_kmem_alloc_2 0x465B14
14 changes: 14 additions & 0 deletions freebsd-headers/ps4-offsets/1302.h
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
#pragma once
#define kernel_offset_xfast_syscall 0x1c0
#define kernel_offset_allproc 0x1b28538
#define kernel_offset_vmspace_acquire_ref 0x2F6F90
#define kernel_offset_vmspace_free 0x2F6DC0
#define kernel_offset_printf 0x2E0450
#define kernel_offset_kmem_alloc 0x465A50
#define kernel_offset_kernel_map 0x22D1D50
#define kernel_offset_sysent 0x1102B70
#define kernel_offset_proc_rwmem 0x366010
#define kernel_offset_copyin 0x2BD6E0

#define kernel_patch_kmem_alloc_1 0x465B1C
#define kernel_patch_kmem_alloc_2 0x465B24
13 changes: 13 additions & 0 deletions freebsd-headers/ps4-offsets/750.h
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
#pragma once
#define kernel_offset_xfast_syscall 0x1c0
#define kernel_offset_allproc 0x213C828
#define kernel_offset_vmspace_acquire_ref 0x2FC290
#define kernel_offset_vmspace_free 0x2FC0C0
#define kernel_offset_printf 0x26F740
#define kernel_offset_kmem_alloc 0x1753E0
#define kernel_offset_kernel_map 0x21405B8
#define kernel_offset_sysent 0x1122340
#define kernel_offset_proc_rwmem 0x361310

#define kernel_patch_kmem_alloc_1 0x1754AC
#define kernel_patch_kmem_alloc_2 0x1754B4
13 changes: 13 additions & 0 deletions freebsd-headers/ps4-offsets/800.h
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
#pragma once
#define kernel_offset_xfast_syscall 0x1c0
#define kernel_offset_allproc 0x1B244E0
#define kernel_offset_vmspace_acquire_ref 0x3E74E0
#define kernel_offset_vmspace_free 0x3E7310
#define kernel_offset_printf 0x430AE0
#define kernel_offset_kmem_alloc 0x1B3F0
#define kernel_offset_kernel_map 0x1B243E0
#define kernel_offset_sysent 0x10FC4D0
#define kernel_offset_proc_rwmem 0x173770

#define kernel_patch_kmem_alloc_1 0x1B4BC
#define kernel_patch_kmem_alloc_2 0x1B4C4
14 changes: 14 additions & 0 deletions freebsd-headers/ps4-offsets/850.h
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
#pragma once
#define kernel_offset_xfast_syscall 0x1c0
#define kernel_offset_allproc 0x1BD72D8
#define kernel_offset_vmspace_acquire_ref 0x148530
#define kernel_offset_vmspace_free 0x148360
#define kernel_offset_printf 0x15D570
#define kernel_offset_kmem_alloc 0x2199A0
#define kernel_offset_kernel_map 0x1C64228
#define kernel_offset_sysent 0x10FC5C0
#define kernel_offset_proc_rwmem 0x131B50
#define kernel_offset_copyin 0x3A42E0

#define kernel_patch_kmem_alloc_1 0x219A6C
#define kernel_patch_kmem_alloc_2 0x219A74
24 changes: 24 additions & 0 deletions freebsd-headers/ps4-offsets/kernel.h
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,15 @@
#ifdef __7_00__
#include "700.h"
#else
#ifdef __7_50__
#include "750.h"
#else
#ifdef __8_00__
#include "800.h"
#else
#ifdef __8_50__
#include "850.h"
#else
#ifdef __9_00__
#include "900.h"
#else
Expand Down Expand Up @@ -34,6 +43,15 @@
#ifdef __12_00__
#include "1200.h"
#else
#ifdef __12_50__
#include "1250.h"
#else
#ifdef __13_00__
#include "1300.h"
#else
#ifdef __13_02__
#include "1302.h"
#else
#error "unsupported firmware"
#endif
#endif
Expand All @@ -47,3 +65,9 @@
#endif
#endif
#endif
#endif
#endif
#endif
#endif
#endif
#endif
Loading