HOME

TheInfoList



OR:

A softmod (short for software modification) is a method of using software to modify the intended behavior of hardware, such as
computer hardware Computer hardware includes the physical parts of a computer, such as the central processing unit (CPU), random-access memory (RAM), motherboard, computer data storage, graphics card, sound card, and computer case. It includes external devices ...
, or
video game console A video game console is an electronic device that Input/output, outputs a video signal or image to display a video game that can typically be played with a game controller. These may be home video game console, home consoles, which are generally ...
s in a way that can overcome restrictions of the
firmware In computing Computing is any goal-oriented activity requiring, benefiting from, or creating computer, computing machinery. It includes the study and experimentation of algorithmic processes, and the development of both computer hardware, h ...
, or install custom firmware.


Function

Many softmods are exploits combined together, known as exploit chains. The first requirement is being able to run
unsigned code Code signing is the process of digitally Digital signatures and law, signing executables and scripting language, scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was signed. The process ...
, known as userland exploits.
Web browser A web browser, often shortened to browser, is an application for accessing websites. When a user requests a web page from a particular website, the browser retrieves its files from a web server and then displays the page on the user's scr ...
s are very common vectors for this, most of which use the
WebKit WebKit is a browser engine primarily used in Apple's Safari web browser, as well as all web browsers on iOS and iPadOS. WebKit is also used by the PlayStation consoles starting with the PS3, the Tizen mobile operating systems, the Amazon K ...
browser engine A browser engine (also known as a layout engine or rendering engine) is a core software component of every major web browser. The primary job of a browser engine is to transform HTML documents and other resources of a web page into an interacti ...
, which is notably
open source Open source is source code that is made freely available for possible modification and redistribution. Products include permission to use and view the source code, design documents, or content of the product. The open source model is a decentrali ...
and as a result, vulnerabilities are widely known. Another common vector of userland exploit are savegame exploits, which are specially crafted savegame files that exploit vulnerabilities in a game's code allowing for unsigned code. The second requirement is
privilege escalation Privilege escalation is the act of exploiting a Software bug, bug, a Product defect, design flaw, or a configuration oversight in an operating system or software application to gain elevated access to resource (computer science), resources that ar ...
, typically compromising the kernel, unlocking secure parts of the system. Depending on the security architecture, additional privilege escalation may be required, such as defeating a
hypervisor A hypervisor, also known as a virtual machine monitor (VMM) or virtualizer, is a type of computer software, firmware or hardware that creates and runs virtual machines. A computer on which a hypervisor runs one or more virtual machines is called ...
. Other examples of softmods are maliciously signed firmware, such as custom firmware on the
PlayStation 3 The PlayStation 3 (PS3) is a home video game console developed and marketed by Sony Computer Entertainment (SCE). It is the successor to the PlayStation 2, and both are part of the PlayStation brand of consoles. The PS3 was first released on ...
, which was made possible due to the master key being released, or gaining control of a process that is very early in the boot cycle, such as the Fusée Gelée
Boot ROM Boot ROM is a piece of read-only memory (ROM) that is used for booting a computer system. It contains instructions that are run after the CPU is reset to the reset vector, and it typically loads a bootloader. There are two types of boot ROM: ...
vulnerability for the
Nintendo Switch The is a video game console developed by Nintendo and released worldwide in most regions on March 3, 2017. Released in the middle of the Eighth generation of video game consoles, eighth generation of home consoles, the Switch succeeded the ...
. Softmods may be permanent (e.g. custom firmware) or temporary (e.g. homebrew enabler) that persist until powering off. Softmods are especially popular among video game consoles, in which they usually enable a homebrew environment that allow execution of unsigned code. Compared to installing a
modchip A modchip (short for modification chip) is a small electronic device used to alter or disable artificial restrictions of computers or entertainment devices. Modchips are mainly used in video game consoles, but also in some DVD or Blu-ray players ...
, a softmod is generally preferred (if available) due to not requiring having to open up the device and perform
soldering Soldering (; ) is a process of joining two metal surfaces together using a filler metal called solder. The soldering process involves heating the surfaces to be joined and melting the solder, which is then allowed to cool and solidify, creatin ...
, which could damage the device hardware. However, attempting to softmod can still damage a device, especially if instructions are not followed correctly. In some cases, it can lead to
bricking A brick (or bricked device) is a mobile device A mobile device or handheld device is a computer small enough to hold and operate in hand. Mobile devices are typically battery-powered and possess a flat-panel display and one or more built-i ...
. Softmods may be used to install or load an alternative operating system (e.g. a
Linux distribution A Linux distribution, often abbreviated as distro, is an operating system that includes the Linux kernel for its kernel functionality. Although the name does not imply product distribution per se, a distro—if distributed on its own—is oft ...
) on a device, as well as reinstate functionality that was removed from the official firmware, such as "OtherOS" on the PlayStation 3. If a softmodded console connects to its online service, (such as
Nintendo Switch Online Nintendo Switch Online (NSO) is an online subscription service operated by Nintendo for its video game consoles, the Nintendo Switch and Nintendo Switch 2. The service is Nintendo's third-generation online service after Nintendo Wi-Fi Connect ...
on the Nintendo Switch) the console may be banned from the service permanently. Softmods void
warranty In law, a warranty is an expressed or implied promise or assurance of some kind. The term's meaning varies across legal subjects. In property law, it refers to a covenant by the grantor of a deed. In insurance law, it refers to a promise by the ...
due to tampering with device function and as a result, vendors will not honour any existing warranty policy if sent in for repair.


Legality

Due to commonly being used to circumvent
digital rights management Digital rights management (DRM) is the management of legal access to digital content. Various tools or technological protection measures, such as access control technologies, can restrict the use of proprietary hardware and copyrighted works. DRM ...
, softmodding is seen as a tool to enable
piracy Piracy is an act of robbery or criminal violence by ship or boat-borne attackers upon another ship or a coastal area, typically with the goal of stealing cargo and valuable goods, or taking hostages. Those who conduct acts of piracy are call ...
, although the act of softmodding in itself may not be illegal. In January 2011, security researcher Geohot and associates of the hacking group known as ''fail0verflow'' were sued by Sony for jailbreaking the PlayStation 3. Sony and Geohot later settled the case out of court, with Geohot agreeing not to reverse engineer any Sony product in the future. In Japan, softmods were outlawed as part of new legislation in 2018 which made savegame editing and console modding illegal.


Softmods for video game consoles


PlayStation/PSOne

The original
PlayStation is a video gaming brand owned and produced by Sony Interactive Entertainment (SIE), a division of Japanese conglomerate Sony. Its flagship products consists of a series of home video game consoles produced under the brand; it also consists ...
can be softmodded with the TonyHax exploit. The exploit is compatible with all North American and European consoles except the launch model (SCPH-100x), but is not compatible with Japanese consoles. It is also compatible with early versions of the PlayStation 2 (SCPH-3900x or older), although only for booting PS1 discs. TonyHax can be booted either with a gamesave exploit (usually Tony Hawk's Pro Skater 2, 3, or 4, hence the name, but several other games are also supported), or except on the PS2, directly from a specially-flashed memory card. The exploit allows the console to boot homebrew, foreign-region games, and
CD-R CD-R (Compact disc-recordable) is a digital media, digital optical disc data storage device, storage format. A CD-R disc is a compact disc that can only be Write once read many, written once and read arbitrarily many times. CD-R discs (CD-Rs) ...
copies. Some PlayStation models are partially incompatible (slow load times, skipping audio and video) with phthalocyanine CD-Rs, preferring the older standard
cyanine Cyanines, also referred to as tetramethylindo(di)-carbocyanines are a synthetic dye family belonging to the polymethine group. Although the name derives etymologically from terms for shades of blue, the cyanine family covers the electromagnetic s ...
discs. TonyHax is not a permanent exploit; the drive is re-locked when the console is powered off or rebooted, requiring the user to re-load the exploit every time a CD-R or foreign game is booted. An older method was to boot an original legitimate disc with the lid close sense button held down, quickly swap the disc with a CD-R copy or foreign disc, remove that disc and reinsert the original, and then swap for the CD-R or foreign disc again. This had to be carefully timed, and if done incorrectly could damage the drive or disc(s).


PlayStation 2

The
PlayStation 2 The PlayStation 2 (PS2) is a home video game console developed and marketed by Sony Interactive Entertainment, Sony Computer Entertainment. It was first released in Japan on 4 March 2000, in North America on 26 October, in Europe on 24 Novembe ...
has various methods of achieving a softmod. Disc swapping was used early on to bypass the PlayStation 2 copy protection, by taking advantage of certain trigger discs such as ''007: Agent Under Fire'' or Swap Magic, homebrew could be loaded. This was done by inserting the trigger disc, blocking the lid open sensor then hotswapping with a homebrew disc. Although difficult to execute correctly, the universality of the method was often used in order to softmod. One of the earliest softmods developed — the Independence Exploit — allows the PlayStation 2 to run homebrew by exploiting a buffer overflow in the BIOS code responsible for loading original PlayStation games. This method, however, only works on models V10 and lower, excluding the PlayStation 2 slim, while still requiring a disc to be burned. FreeMcBoot is an exploit that works on all models except the SCPH-9000x series with BIOS v2.30 and up. It requires no trigger disc and is able to directly load ELFs from the memory card. Fortuna, Funtuna, and Opentuna are another form of memory card exploit. Unlike FreeMcBoot, they will work on the SCPH-9000x model, and they are compatible with third-party memory cards that do not support
MagicGate MagicGate (MG) is a Digital rights management, copy-protection technology introduced by Sony in 1999 as part of the Secure Digital Music Initiative (SDMI). It works by encrypting the content on the device and using MagicGate chips in both the s ...
. HD Loader is an exploit for PS2 models with the hard drive peripheral. FreeDVDBoot is an exploit discovered in 2020 that requires burning a disc image loaded with a payload onto a DVD-R. It is compatible with a range of PlayStation 2 models and works by exploiting a buffer overflow in the PS2's DVD video functionality. MechaPwn is an exploit that permanently unlocks the DVD drive of the slim PS2 (and some later revisions of the fat PS2), allowing PS1 and PS2 discs from any region to be booted. PS1 CD-R copies can be booted directly from the PS2's built-in menu; PS2 CD-R/DVD-R copies require additional software to bypass the PlayStation 2 logo check. In August 2024, a savegame exploit affecting multiple consoles and generations called ''TonyHawksProStrcpy'' was released, which is present in multiple
Tony Hawk's ''Tony Hawk's'' is a series of skateboarding video games published by Activision and endorsed by the Tony Hawk, American professional skateboarder of the same name. From 1999 to 2007, the series was primarily developed for Home video game conso ...
titles for the PlayStation 2. It can be used to execute unsigned code.


PlayStation 3

The
PlayStation 3 The PlayStation 3 (PS3) is a home video game console developed and marketed by Sony Computer Entertainment (SCE). It is the successor to the PlayStation 2, and both are part of the PlayStation brand of consoles. The PS3 was first released on ...
has a couple of methods to achieve a softmod. All models of PS3 can be softmodded. Consoles that have factory installed (minimum firmware) version 3.55 or lower can install CFW (
custom firmware Custom firmware, also known as aftermarket firmware, is an unofficial new or modified version of firmware created by third parties on devices such as video game consoles, mobile phones, and various embedded system, embedded device types to provide ...
) which is unofficial firmware. This includes: all fat models, slim 20xx and 21xx models, and 25xx models - the latter only if the console was manufactured before December 2010 (datecode 0D or less is guaranteed; 1A is maybe). These guidelines assume a console has not been taken to Sony to be serviced, as Sony may update the factory installed firmware. Slim 30xx and all super slim models cannot currently install CFW. Installing CFW was made possible with
code signing Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was signed. The process employs the use of a cryptographic hash to va ...
after the PS3's master key was leaked. Sony changed the key with firmware 3.56. If a vulnerable console has official firmware above 3.55 installed, the flash can be patched via a WebKit exploit which enables a CFW install. Should the patching process be interrupted (e.g.
power outage A power outage, also called a blackout, a power failure, a power blackout, a power loss, a power cut, or a power out is the complete loss of the electrical power network supply to an end user. There are many causes of power failures in an el ...
), it can
brick A brick is a type of construction material used to build walls, pavements and other elements in masonry construction. Properly, the term ''brick'' denotes a unit primarily composed of clay. But is now also used informally to denote building un ...
the console. CFW grants complete control over the console, having access to LV0 (bootloader), LV1 (hypervisor), and LV2 (kernel/GameOS). This allows the running of homebrew, load game backups, bypass region checks, enter Factory Service Mode, change fan speed, RSX speed, grant access to root keys, as well as run PS2 ISOs on unsupported backwards compatible models (via software emulation). Some CFW implementations reinstate features Sony removed such as "OtherOS". The most supported PS3 CFW is ''Evilnat Cobra''. The other softmod is ''PS3HEN'' (HEN). HEN is supported by all PS3 models. In order to use HEN, it is required to install HFW (hybrid firmware), another kind of unofficial firmware. During the HEN setup process, a WebKit exploit is used to install a signed file through the PS3 Web Browser which sets up HEN on the PS3's storage. This adds a shortcut to enable HEN whenever the console is powered on, which leverages additional exploits to grant LV2 kernel/GameOS access. As such, this is a tether softmod, meaning HEN has to be activated every time the console is powered on. This softmod shares core CFW features - running homebrew, load backups of games, bypass region checks, change fan speeds, and play installed PS2 Classics PKGs. The unofficial PS2 backwards compatibility is diminished as users can only run PS2 Classics encrypted PKGs instead of ISOs. Also, the hypervisor (HV) is still active and periodically checks if the current code being executed is unsigned; there is a small chance it can lead to the console becoming unresponsive or shutting down, making HEN less stable than CFW. In March 2025, a hardware-software HV exploit called ''BadHTAB'' was disclosed. It grants access to LV1 (HV) on non-CFW consoles, allowing for some CFW features such as loading a
Linux distribution A Linux distribution, often abbreviated as distro, is an operating system that includes the Linux kernel for its kernel functionality. Although the name does not imply product distribution per se, a distro—if distributed on its own—is oft ...
that HEN does not support. This is a tether softmod and will need to be activated every time the console is powered on.


PlayStation 4

The
PlayStation 4 The PlayStation 4 (PS4) is a home video game console developed by Sony Interactive Entertainment. Announced as the successor to the PlayStation 3 in February 2013, it was launched on November 15, 2013, in North America, November 29, 2013, in ...
has ways to achieve a softmod. Most require a userland exploit as the entry point, which can be either
WebKit WebKit is a browser engine primarily used in Apple's Safari web browser, as well as all web browsers on iOS and iPadOS. WebKit is also used by the PlayStation consoles starting with the PS3, the Tizen mobile operating systems, the Amazon K ...
vulnerabilities in the PS4 Web Browser, or a savegame exploit. All models of PS4 can be softmodded. They are all tether exploits meaning they have to be performed every time the console is powered on, although some exploits may be persisted using rest mode. Softmodding a PS4 allows for homebrew, loading game backups, bypass region checks, and change fan and CPU/GPU speeds. Some payloads can boot the PS4 into a
Linux distribution A Linux distribution, often abbreviated as distro, is an operating system that includes the Linux kernel for its kernel functionality. Although the name does not imply product distribution per se, a distro—if distributed on its own—is oft ...
, although this is not permanent and the console will revert to Orbis OS on reboot. Known firmware versions that allow for a softmod are: 1.76, 4.05, 4.74, 5.05/5.07, 6.72, 7.02, 7.55, 9.00, 11.00, 12.02. It is worth noting the 9.00 exploit requires inserting a specially crafted
USB flash drive A flash drive (also thumb drive, memory stick, and pen drive/pendrive) is a data storage device that includes flash memory with an integrated USB interface. A typical USB drive is removable, rewritable, and smaller than an optical disc, and u ...
into the console, and the 11.00 exploit to connect to a malicious
PPPoE The Point-to-Point Protocol over Ethernet (PPPoE) is a network protocol for Encapsulation (networking), encapsulating Point-to-Point Protocol (PPP) frames inside Ethernet frames. It appeared in 1999, in the context of the boom of DSL as the solu ...
server over the
network Network, networking and networked may refer to: Science and technology * Network theory, the study of graphs as a representation of relations between discrete objects * Network science, an academic field that studies complex networks Mathematics ...
.


PlayStation 5

The
PlayStation 5 The PlayStation 5 (PS5) is a home video game console developed by Sony Interactive Entertainment. It was announced as the successor to the PlayStation 4 in April 2019, was launched on November 12, 2020, in Australia, Japan, New Zealand, North ...
has ways to achieve a softmod. They rely on a userland exploit, which can be either
WebKit WebKit is a browser engine primarily used in Apple's Safari web browser, as well as all web browsers on iOS and iPadOS. WebKit is also used by the PlayStation consoles starting with the PS3, the Tizen mobile operating systems, the Amazon K ...
vulnerabilities in the PS5 Web Browser, a specially crafted
Blu-ray Blu-ray (Blu-ray Disc or BD) is a digital optical disc data storage format designed to supersede the DVD format. It was invented and developed in 2005 and released worldwide on June 20, 2006, capable of storing several hours of high-defin ...
disc, or a savegame exploit, that is combined with a kernel (and optionally
hypervisor A hypervisor, also known as a virtual machine monitor (VMM) or virtualizer, is a type of computer software, firmware or hardware that creates and runs virtual machines. A computer on which a hypervisor runs one or more virtual machines is called ...
) exploit. They are all tether exploits meaning they have to be performed every time the console is powered on, although some exploits may be persisted using rest mode. Softmodding a PS5 allows running homebrew, load game backups, modify the PS4 backwards compatibility blacklist, install and run PS4 "FPKGs" (including PS4 homebrew and PS1/PS2/PS4 game backups), change fan speeds, and spoof firmware (which allows the install of games that require an update patch, and can also block updates). However, firmware spoofing will not allow games above the console's true firmware revision to load without the required update patch. The PS5 is also capable of playing patched PS4 titles above the PS4
frame rate Frame rate, most commonly expressed in frame/s, or FPS, is typically the frequency (rate) at which consecutive images (Film frame, frames) are captured or displayed. This definition applies to film and video cameras, computer animation, and moti ...
cap of 60 FPS, such as
Bloodborne is a 2015 action role-playing game developed by FromSoftware and published by Sony Computer Entertainment for the PlayStation 4. The game follows a Hunter through the decrepit Gothic, Victorian-era–inspired city of Yharnam, whose inhabita ...
, at higher frame rates e.g. 120 FPS. Compared to its predecessor the PS4, a userland and kernel exploit would have been enough to accomplish what is generally regarded as a true jailbreak by patching the kernel, however the PS5 has added security measures in comparison, mainly a hypervisor (HV) and eXecute Only Memory (XOM) which do not allow kernel patching - as a result not all kernel exploits on the PS5 can be leveraged due to these additional measures, and makes reverse engineering much more difficult. Despite this, several HENs (Homebrew ENablers) have been made that operate within the constraints of the HV and XOM to defeat enough security to enable a homebrew environment. After the first public HV exploit, HENs were adjusted to operate with the HV compromised (including the XOM being deactivated), providing better stability and functionality than HENs that don't leverage a HV exploit since kernel patching is now possible. Known firmware versions that allow for a softmod are: 2.50, 4.51, 5.50, 7.61, 10.01. It is worth noting the 2.50 exploit compromises the kernel and HV, while the exploits up to 10.01 only compromise the kernel. The IPv6 kernel exploit on the PS4 that led to the 6.72 jailbreak was patched a few months prior to the release of the PS5, which was reintroduced on the PS5 with 3.00 firmware and affected up to 4.51 firmware. The exFAT filesystem kernel exploit that led to the 9.00 jailbreak also affected PS5 firmware up to 4.03, however due to additional protections on the PS5 it is not possible to use this to softmod the PS5. The
PPPoE The Point-to-Point Protocol over Ethernet (PPPoE) is a network protocol for Encapsulation (networking), encapsulating Point-to-Point Protocol (PPP) frames inside Ethernet frames. It appeared in 1999, in the context of the boom of DSL as the solu ...
kernel exploit that led to the PS4 11.00 jailbreak also affected PS5 firmware up to 8.20, and is not known to softmod the PS5. The lapse kernel exploit that led to the PS4 12.02 jailbreak could also be used to jailbreak the PS5, and affected up to 10.01 firmware. In June 2023, a payload called ''libhijacker'' was disclosed, becoming a reliable method of running homebrew and partially circumvents the HV, which works by creating a new, separate process by interacting with the PS5's
Daemon A demon is a malevolent supernatural being, evil spirit or fiend in religion, occultism, literature, fiction, mythology and folklore. Demon, daemon or dæmon may also refer to: Entertainment Fictional entities * Daemon (G.I. Joe), a character ...
, effectively acting as a background ELF loader. This is notable over previous ELF loaders such as the WebKit or Blu-ray methods since those ELF loaders were terminated when the corresponding process was stopped. Another advantage of this new method is that the newly separate process is not confined to the fixed maximum resource allocation of the WebKit or BD-J processes. In July 2023, security researcher ''Flat_z'' disclosed that they had read access to the PS5's Platform Secure Processor (PSP) which is one of the most protected parts of the system and contains crucial keys for decryption. In addition, they also confirmed they had successfully exploited the HV via a save game exploit chain. ''Flat_z'' said he does not intend to disclose his findings publicly, however he is using these exploits to further reverse engineer the PS5 now that he is able to decrypt more parts of the system. In November 2023, scene developer ''LightningMods'' disclosed that they had managed to load and play a retail PS5 game backup. In December 2023, scene developer ''LightningMods'' updated his ''Itemzflow'' homebrew to support loading PS5 game backups. In September 2024, a kernel exploit was disclosed for
FreeBSD FreeBSD is a free-software Unix-like operating system descended from the Berkeley Software Distribution (BSD). The first version was released in 1993 developed from 386BSD, one of the first fully functional and free Unix clones on affordable ...
11, which the PS5 software is based on. It can be leveraged on the PS5, which affects all firmware versions up to 7.61. The bug is not present in FreeBSD 9 and as such the PS4 is unaffected. In October 2024, security researcher ''SpecterDev'' disclosed two exploit chains that compromise the hypervisor, which affect all firmware versions up to 2.50.


PlayStation Portable

It is possible to softmod almost any
PlayStation Portable The PlayStation Portable (PSP) is a handheld game console developed and marketed by Sony Interactive Entertainment, Sony Computer Entertainment. It was first released in Japan on December 12, 2004, in North America on March 24, 2005, and in PA ...
. Using various exploits (such as the
TIFF Tag Image File Format or Tagged Image File Format, commonly known by the abbreviations TIFF or TIF, is an image file format for storing raster graphics images, popular among graphic artists, the publishing industry, and photographers. TIFF is w ...
exploit or specially crafted savegames from games such as '' Grand Theft Auto: Liberty City Stories'', ''
Lumines (pronounced as "Loo-min-ess") is a puzzle video game series developed by Q Entertainment. The core objective of the games is to survive by rotating and aligning 2×2 blocks varying between two colors to form 2×2 squares of a single color whi ...
'', and later '' GripShift'') or original unprotected firmware, the user can run a modified version of the PSPs updater, that will install custom firmware. This newer firmware allows the booting of ISOs, as well as running unauthorized ( homebrew) code. A popular way of running homebrew code to softmod the PSP is by using the Infinity method. The most recent CFW(Custom FirmWare) right now is ARK-4 that can be used on any PSP model and it also allows WPA2 Wi-Fi to be connected.


PlayStation Vita

The
PlayStation Vita The PlayStation Vita (PS Vita) is a handheld game console developed and marketed by Sony Computer Entertainment. It was first released in Japan on December 17, 2011, then in other international territories on February 22, 2012, and was produced ...
can also be softmodded, with the most notorious methods being using: HENkaku Web Exploit, h-encore and h-encore².


Xbox

The
Xbox Xbox is a video gaming brand that consists of four main home video game console lines, as well as application software, applications (games), the streaming media, streaming service Xbox Cloud Gaming, and online services such as the Xbox networ ...
used to include a font exploit installed through exploits in savegame code for '' MechAssault'', '' Splinter Cell'', '' 007: Agent Under Fire'', and ''
Tony Hawk's Pro Skater 4 ''Tony Hawk's Pro Skater 4'' is a 2002 skateboarding game developed by Neversoft and published by Activision under their Activision O2 label. The game was ported by different developers to various systems. It is the fourth installment in the ' ...
''. Usage of the ''Splinter Cell'' or ''Tony Hawk's Pro Skater 4'' disc is generally recommended as any version of the game will run the exploit, whereas certain production runs of Mechassault and ''Agent Under Fire'' are needed to use the exploit. Originally, via a piece of software called "MechInstaller" created by members of the Xbox-linux team, an additional option could be added to the Xbox Dashboard for booting
Linux Linux ( ) is a family of open source Unix-like operating systems based on the Linux kernel, an kernel (operating system), operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically package manager, pac ...
. The font hack works by exploiting a buffer underflow in the Xbox font loader which is part of the dashboard. Unfortunately, since the Xbox requires the clock to be valid, and the dashboard itself is where one sets the clock, there is a problem if the RTC backup capacitor discharges. The Xbox will detect that the clock is not set and therefore force the dashboard to be loaded; the dashboard then reboots due to the buffer overflow exploit. Upon restarting, the Xbox detects the clock is invalid and the process repeats. This problem became known as the "clockloop". In August 2024, a savegame exploit affecting multiple consoles and generations called ''TonyHawksProStrcpy'' was released, which is present in multiple
Tony Hawk's ''Tony Hawk's'' is a series of skateboarding video games published by Activision and endorsed by the Tony Hawk, American professional skateboarder of the same name. From 1999 to 2007, the series was primarily developed for Home video game conso ...
titles for the Xbox. It can be used to execute unsigned code.


Xbox 360

All models of
Xbox 360 The Xbox 360 is a home video game console developed by Microsoft. As the successor to the Xbox (console), original Xbox, it is the second console in the Xbox#Consoles, Xbox series. It was officially unveiled on MTV on May 12, 2005, with detail ...
can be softmodded. Softmodding an Xbox 360 allows users to run homebrew, load game backups (including original
Xbox Xbox is a video gaming brand that consists of four main home video game console lines, as well as application software, applications (games), the streaming media, streaming service Xbox Cloud Gaming, and online services such as the Xbox networ ...
), bypass region checks, and change fan speeds. Some payloads can boot the Xbox 360 into a
Linux distribution A Linux distribution, often abbreviated as distro, is an operating system that includes the Linux kernel for its kernel functionality. Although the name does not imply product distribution per se, a distro—if distributed on its own—is oft ...
, although this is not permanent and the console will revert to the
Xbox system software The Xbox system software is the operating system developed exclusively for Microsoft's Xbox home video game consoles. Across the four generations of Xbox consoles, the software has been based on a version of Microsoft Windows and incorporating Di ...
on reboot. Shortly after the release of the Xbox 360, ways were found to modify the firmware of the
DVD drive In computing, an optical disc drive (ODD) is a disc drive that uses laser light or electromagnetic waves within or near the visible light spectrum as part of the process of reading or writing data to or from optical discs. Some drives can onl ...
of the console. This allows the system to play games from "backup" (non-original) game discs. This requires opening of the console but no additional hardware such as a
modchip A modchip (short for modification chip) is a small electronic device used to alter or disable artificial restrictions of computers or entertainment devices. Modchips are mainly used in video game consoles, but also in some DVD or Blu-ray players ...
is permanently installed into the system. Microsoft responded by introducing console ban system. If the data stream from the DVD drive indicated signs of unauthorized use, Microsoft would permanently ban the console from using the
Xbox Live The Xbox network, formerly known and commonly referred to as Xbox Live, is an online multiplayer gaming and digital media delivery service created and operated by Microsoft Gaming for the Xbox brand. It was first made available to the origina ...
service. The ban never expires and can only be fixed by purchasing another console. Other measures, such as introducing new hardware revisions to prevent modifications and checking/updating the drive firmware during dashboard updates, have been made too. In January 2007, a HV (hypervisor) exploit was patched with dashboard 2.0.4552.0, where it could be leveraged in some previous dashboards (2.0.4532.0 and 2.0.4548.0), which granted full control over the console. This was commonly chained with a modified version of the
King Kong King Kong, also referred to simply as Kong, is a fictional giant monster resembling a gorilla, who has appeared in various media since 1933. The character has since become an international pop culture icon,Erb, Cynthia, 1998, ''Tracking Kin ...
video game for the Xbox 360, made possible using an Xbox 360 with a modified DVD drive that was able to boot unofficial game copies. It was discovered the King Kong game contained poorly coded
shader In computer graphics, a shader is a computer program that calculates the appropriate levels of light, darkness, and color during the rendering of a 3D scene—a process known as '' shading''. Shaders have evolved to perform a variety of s ...
s which could be specially crafted to allow for arbitrary code execution. This became known as the infamous King Kong exploit. In August 2024, a savegame exploit affecting multiple consoles and generations called ''TonyHawksProStrcpy'' was released, which is present in Tony Hawk's American Wasteland for the Xbox 360. It can be used to execute unsigned code. The
Xbox Xbox is a video gaming brand that consists of four main home video game console lines, as well as application software, applications (games), the streaming media, streaming service Xbox Cloud Gaming, and online services such as the Xbox networ ...
version of the game does not contain the exploit on the Xbox 360. In March 2025, a HV exploit called ''Bad Update'' was disclosed which affected all dashboards up to and including the latest version (2.0.17559.0 at the time of release). This exploit chain uses a savegame exploit as the entry point, granting full control over the console. It requires a specially crafted
USB flash drive A flash drive (also thumb drive, memory stick, and pen drive/pendrive) is a data storage device that includes flash memory with an integrated USB interface. A typical USB drive is removable, rewritable, and smaller than an optical disc, and u ...
. It is a tether exploit meaning it has to be performed every time the console is powered on. On release, the exploit was configured to use a Tony Hawk's American Wasteland savegame as the entry point, a disk game that is not common. However, a couple days later the game Rock Band Blitz was added, which has a trial version, that can be played from a USB flash drive. Unlike the JTAG/RGH hardmod exploits which could only be applied to specific Xbox 360 models, this softmod works on all models. In March 2025, a payload called ''FreeMyXe'' was disclosed which was designed to be used alongside the ''Bad Update'' exploit chain. It patches the HV and kernel to run
unsigned code Code signing is the process of digitally Digital signatures and law, signing executables and scripting language, scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was signed. The process ...
, effectively acting as a HEN (Homebrew ENabler).


Xbox One

The
Xbox One The Xbox One is a home video game console developed by Microsoft. Announced in May 2013, it is the successor to Xbox 360 and the third console in the Xbox#Consoles, Xbox series. It was first released in North America, parts of Europe, Austra ...
went through its lifecycle without having its security compromised. However, in June 2024, a userland exploit was disclosed for a
Microsoft Store The Microsoft Store (formerly known as the Windows Store) is a digital distribution platform operated by Microsoft. It was created as an app store for Windows 8 as the primary means of distributing Universal Windows Platform apps. With ...
app called Game Script that had a bug which allowed for arbitrary code execution. Microsoft removed the app from the store a few days after disclosure, effectively patching the vulnerability for those who did not have it downloaded already. A couple of weeks later, the same developer who published the userland exploit released a follow-up release which achieves kernel access while in Retail mode. This is roughly equivalent in functionality if the console was in Developer mode. Due to the Xbox One's security architecture, the console security is still mostly intact and further mitigations are necessary in order to become a HEN (homebrew enabler). A payload exists that starts a reverse shell on the console over the network, which for example can be used to browse the console's filesystem and create directories.


Xbox Series X and Series S

The
Xbox Series X and Series S The Xbox Series X and Xbox Series S are the fourth generation of consoles in the Xbox series, succeeding the previous generation's Xbox One. Released on November 10, 2020, the higher-end Xbox Series X and lower-end Xbox Series S are part o ...
are vulnerable to the same exploits for the Xbox One, and similarly have security measures where the console security is still mostly intact and further mitigations are necessary in order to become a HEN (homebrew enabler).


GameCube

There was an exploit within the game Phantasy Star Online port for the GameCube. It used the network adapter to download a malicious update containing unsigned code. In August 2024, a savegame exploit affecting multiple consoles and generations called ''TonyHawksProStrcpy'' was released, which is present in multiple
Tony Hawk's ''Tony Hawk's'' is a series of skateboarding video games published by Activision and endorsed by the Tony Hawk, American professional skateboarder of the same name. From 1999 to 2007, the series was primarily developed for Home video game conso ...
titles for the
GameCube The is a PowerPC-based home video game console developed and marketed by Nintendo. It was released in Japan on September 14, 2001, in North America on November 18, 2001, in Europe on May 3, 2002, and in Australia on May 17, 2002. It is the suc ...
. It can be used to execute unsigned code.


Wii

The first known softmod for the
Wii The Wii ( ) is a home video game console developed and marketed by Nintendo. It was released on November 19, 2006, in North America, and in December 2006 for most other regions of the world. It is Nintendo's fifth major home game console, f ...
is known as the Twilight hack, a savegame exploit for the Wii version of The Legend of Zelda: Twilight Princess. This allowed users to run
unsigned code Code signing is the process of digitally Digital signatures and law, signing executables and scripting language, scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was signed. The process ...
/ .elf files. The Twilight hack was superseded by the development of Bannerbomb, which allowed for executing unsigned code without relying on an exploit within a game. Bannerbomb worked by using a malformed banner to inject a loader program into the
Wii Menu The Wii system software is a set of updatable firmware versions and a software frontend on the Wii, a home video game console. Updates, which could be downloaded over the Internet or read from a Nintendo optical discs#Wii Optical Disc, game dis ...
program in
memory Memory is the faculty of the mind by which data or information is encoded, stored, and retrieved when needed. It is the retention of information over time for the purpose of influencing future action. If past events could not be remembe ...
. As the Wii Menu crashed, an unsigned executable was executed. Bannerbomb was superseded by Letterbomb, which used a glitch in the
Wii Message Board The Wii system software is a set of updatable firmware versions and a software frontend on the Wii, a home video game console. Updates, which could be downloaded over the Internet or read from a game disc, allowed Nintendo to add additional ...
to crash the Wii Menu. FlashHax superseded Letterbomb, which used an exploit in the Wii's
End-user license agreement An end-user license agreement or EULA () is a legal contract between a software supplier and a customer or end-user. The practice of selling licenses to rather than copies of software predates the recognition of software copyright, which has ...
to run unsigned code, requiring the Internet Channel to be installed. str2hax superseded FlashHax, which simplified the process even further. str2hax uses a custom DNS server to redirect the Wii's End-user license agreement page to a modified page that executes unsigned code, without the need for the Internet Channel. BlueBomb was later released that leveraged a
Bluetooth Bluetooth is a short-range wireless technology standard that is used for exchanging data between fixed and mobile devices over short distances and building personal area networks (PANs). In the most widely used mode, transmission power is li ...
exploit, in particular used to softmod the Wii Mini which could not use the Internet Browser as an exploit entry point. Exploits typically allowed the install of the Homebrew Channel, an unofficial Wii channel which acted as a gateway to run unofficial Wii applications. A large homebrew community emerged for the Wii, leading to developments such as the Homebrew Channel, third-party games, media players, and the loading of Wii and
GameCube The is a PowerPC-based home video game console developed and marketed by Nintendo. It was released in Japan on September 14, 2001, in North America on November 18, 2001, in Europe on May 3, 2002, and in Australia on May 17, 2002. It is the suc ...
game backups.


Wii U

The
Wii U The Wii U ( ) is a home video game console developed by Nintendo as the successor to the Wii. Released in late 2012, it is the first eighth-generation video game console and competed with Microsoft's Xbox One and Sony's PlayStation 4. The W ...
can be softmodded with various exploits. The easiest way to softmod a Wii U is
WebKit WebKit is a browser engine primarily used in Apple's Safari web browser, as well as all web browsers on iOS and iPadOS. WebKit is also used by the PlayStation consoles starting with the PS3, the Tizen mobile operating systems, the Amazon K ...
vulnerabilities in the Wii U Internet Browser. Softmodding a Wii U can allow for a
custom firmware Custom firmware, also known as aftermarket firmware, is an unofficial new or modified version of firmware created by third parties on devices such as video game consoles, mobile phones, and various embedded system, embedded device types to provide ...
install. The most supported CFW is ''Aroma''. Softmodding a Wii U allows for homebrew, unlock GameCube backwards compatibility, load game backups, bypass region checks, and change fan and CPU/GPU speeds. Softmodding a Wii U does not automatically softmod the virtual Wii (vWii), although softmodding the Wii U beforehand can make softmodding the vWii easier. Previously, a few ''Virtual DS'' games could be exploited with specially crafted savegames to install CFW. However, after the eShop closure this method is now impossible to do unless the game was downloaded pre-closure.


Nintendo DS/DS Lite

All versions of the
Nintendo DS The is a foldable handheld game console produced by Nintendo, released globally across 2004 and 2005. The DS, an initialism for "Developers' System" or "Dual Screen", introduced distinctive new features to handheld games: two LCD screens worki ...
as well as the
Nintendo DS Lite The is a foldable handheld game console produced by Nintendo, released globally across 2004 and 2005. The DS, an initialism for "Developers' System" or "Dual Screen", introduced distinctive new features to handheld games: two LCD screens worki ...
can be softmodded using FlashMe: an exploit that can be installed using any PassMe compatible flashcart. The exploit consists of shorting two pins with any metallic object to make the NAND containing the firmware writable. The custom firmware looks and acts exactly the same as the original DS firmware except for the fact you will not need a PassMe or Passcard to boot DS roms from Slot-2 flashcarts anymore. The standard version of FlashMe removes the DS intro screen (including the Warning screen) when booting up. This method also allows for a scrapped DS Lite AV/Out feature to be used again with a Hardmod


Nintendo DSi/DSi XL

The
Nintendo DSi The is a foldable dual-screen handheld game console released by Nintendo. The console launched in Japan on November 1, 2008, and worldwide beginning in April 2009. It is the third iteration of the Nintendo DS, and its primary market rival was ...
made it easier to softmod the console with the introduction of an
SD card Secure Digital (SD) is a proprietary, non-volatile, flash memory card format developed by the SD Association (SDA). Owing to their compact size, SD cards have been widely adopted in a variety of portable consumer electronics, including dig ...
slot. The easiest method method was the Memory Pit exploit released in 2019. When the
camera A camera is an instrument used to capture and store images and videos, either digitally via an electronic image sensor, or chemically via a light-sensitive material such as photographic film. As a pivotal technology in the fields of photograp ...
application is used to take a photo, it creates a file called pit.bin to store
metadata Metadata (or metainformation) is "data that provides information about other data", but not the content of the data itself, such as the text of a message or the image itself. There are many distinct types of metadata, including: * Descriptive ...
information. This file is always located at sd:/private/ds/app/484E494A on the
SD card Secure Digital (SD) is a proprietary, non-volatile, flash memory card format developed by the SD Association (SDA). Owing to their compact size, SD cards have been widely adopted in a variety of portable consumer electronics, including dig ...
. By modifying this file, a buffer overflow is created, crashing the system. External tools like Unlaunch write directly to the NAND storage of the DSi and creates a cold-boot scenario (i.e. the console can directly launch into the custom firmware without having to use other apps). Custom UI environments have been created, most notably TWiLight Menu++ which facilitates other programs like nds-bootstrap to launch homebrew software.


Nintendo 2DS/3DS

The
Nintendo 3DS The is a foldable dual-screen handheld game console produced by Nintendo. Announced in March 2010 as the successor to the Nintendo DS, the console was released originally on February 26, 2011 and went through various revisions in its lifetime, ...
(and its
Nintendo 2DS The Nintendo 2DS is a handheld game console produced by Nintendo. Announced in August 2013, the device was released in North America, Europe and Australia on October 12, 2013. The Nintendo 2DS is an entry-level version of the Nintendo 3DS which ...
sibling) have become some of the most popular console platforms to softmod, as the procedure requires only the 2DS/3DS itself, and modifying its
microSD card Secure Digital (SD) is a proprietary hardware, proprietary, non-volatile memory, non-volatile, flash memory card format developed by the SD Association (SDA). Owing to their compact size, SD cards have been widely adopted in a variety of port ...
. All models of 3DS and 2DS can be softmodded, including the 'New' refresh models. Since the closure of the
Nintendo eShop The is a digital distribution service for the Nintendo Switch and the Nintendo Switch 2, and formerly available via the Nintendo Network for the Wii U and Nintendo 3DS. Launched in June 2011 on the Nintendo 3DS, the Nintendo eShop served ...
for the 2DS/3DS, softmodding has become popular in order to reinstate features that are now officially defunct. The most well developed and commonly used CFW (Custom Firmware) is known as Luma3DS. It contains features such as EmuNAND (NAND redirection), running non-system menu payloads on boot, and installing homebrew titles to the main menu. A popular homebrew app used for piracy, known as Freeshop, was shut down by Nintendo with firmware 11.8 by requiring a title key authorization on the Eshop download servers, thus making all NUS downloaders for the 2DS/3DS to no longer function. The new way to download games is Hshop, it works the same as Eshop, making it perfect replacement to Eshop that closed in 2023. Also nds-bootstrap can be used for playing DS games on 2DS/3DS


Nintendo Switch

Early versions of the
Nintendo Switch The is a video game console developed by Nintendo and released worldwide in most regions on March 3, 2017. Released in the middle of the Eighth generation of video game consoles, eighth generation of home consoles, the Switch succeeded the ...
known as "V1 Unpatched" are vulnerable to a ReCovery Mode (RCM) hardware exploit by holding the Volume Up button, Power button, and Tegra home button (not usually accessible to consumers), which boots the device into RCM, then connecting via USB to another device which is able to push payloads. Tegra refers to the chip the Nintendo Switch uses, the Tegra X1. This was an oversight as RCM was intended to be used by Nintendo to service consoles and not the consumer themselves. It was discovered the Tegra home button could be emulated by
shorting In finance, being short in an asset means investing in such a way that the investor will profit if the market value of the asset falls. This is the opposite of the more common long position, where the investor will profit if the market value ...
pin 10 on the right
Joy-Con Joy-Con are the primary game controllers for the Nintendo Switch, a hybrid video game console. A set of Joy-Con consists of two individual units, each containing an analog stick and an array of buttons. They can be used while attached to the mai ...
rail, initializing RCM. Once in this mode, an additional exploit in the Switch USB drivers can be leveraged to push payloads via USB to a Switch while in RCM to execute
unsigned code Code signing is the process of digitally Digital signatures and law, signing executables and scripting language, scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was signed. The process ...
, such as install CFW (custom firmware). The RCM exploit is hardware based and cannot be patched by software fixes. Later revisions of the Tegra X1 had the RCM exploit patched. Some firmware revisions have had a limited number of softmods emerge, although if updated the exploits will have been patched. The softmods allow running homebrew, installing CFW (RCM exploit), bypassing region checks, loading game backups, and changing fan and CPU/GPU speeds. With the RCM exploit it is also possible to install an Android distribution as an additional boot option, in which the device becomes much more versatile for cross platform play (such as the
Xbox Game Pass The Xbox Game Pass is a subscription service as part of Xbox and offered by Microsoft Gaming. Launched on June 1, 2017, the service allows users to download and play video games via video game consoles, Microsoft Windows, Android, iOS, iPad ...
), allowing games from other platforms to be played. The Joy-Con are fully functional in an Android environment, making it a strong competitor for tablet gaming. The most supported Nintendo Switch CFW is Atmosphère. Nintendo has put safeguards in place where if a console tries to connect to a Nintendo server with an unauthorised copy of a game installed, the device eventually be banned after sending telemetry data to Nintendo servers. Once banned, the console will be fingerprinted by Nintendo and will never be able to access a Nintendo server again, blocking access to the eShop and online play, amongst other features. In December 2023, a group of hackers unveiled the first flash cartridge for the Switch, dubbed the Mig Switch. This cartridge accepts a
microSD Secure Digital (SD) is a proprietary hardware, proprietary, non-volatile memory, non-volatile, flash memory card format developed by the SD Association (SDA). Owing to their compact size, SD cards have been widely adopted in a variety of port ...
card that contains game backups, and the user can alternate between the loaded game by re-inserting the cartridge. The Mig Switch is safe to use online as long as an officially backed up game is used. If the cartridge used pirated files or is used by someone else the Switch will be flagged and banned.{{cn}] Mig Switch works on all models and firmware, partially defeating some of the security in order to play game backups.


Computer DVD drives

Some DVD drives, such as those made by Lite-on, can be softmodded to ignore DVD region code, region coding, allow clearing of the drive's learned media calibration data, and enable DVD+R to DVD-ROM
book type The book type is a field of four bits at the start of every DVD (in the physical format information section of the control data block) that indicates what the physical format of the disc is. Many devices will use this field to determine how the ...
coding that is persistent across reboots. This is distinct from cross-flashing the drive or installing unofficial firmware, and does not modify the drive's firmware.EEPROM Utility
''Myce.''


References

{{Reflist Microsoft video game consoles Nintendo hardware Sony consoles