9S is an ELF injector for the PS5 that is able to manually map an ELF file inside a remote process and execute it in a remote thread. For more details on how it works, I’ve documented the internals here.
To build the project, you will need John Törnblom's SDK. After installation, simply edit the Makefile with the correct PS5 IP address:
Use a simple make to build the project:
make
To send to the PS5 just hit:
make test
The injector will run a TCP server on port 9033. The protocol is simple; it waits for a process target name and an ELF file to be sent in the same packet. The process name is limited to 256 characters, so it must be 256 bytes plus the ELF file. You can use send_injection_elf.py to facilitate your work:
python3 send_injection_elf.py SceShellUI hello_world.elf PS5_IP_ADDRESS
The original concept for this project can be found in this commit, which involved using the .text section from libraries to map the ELF file. This approach did not work because we don't have permissions to mprotect executable areas, causing crashes when accessing writable variables. However, this remains a useful technique for injecting small shellcodes.