A softmod (short for software modification) is a method of using software to modify the intended behavior of hardware, such as computer hardware, or video game consoles in a way that can overcome restrictions of the firmware, or install custom firmware.
Function Many softmods are exploits combined, known as exploit chains. The first requirement is being able to run unsigned code, known as userland exploits. Web browsers are very common vectors for this, most of which use the WebKit browser engine, which is notably open source and as a result, vulnerabilities are widely known. Another common vector of userland exploit are savegame exploits, which are specially crafted savegame files that exploit vulnerabilities in a game's code allowing for unsigned code. The second requirement is privilege escalation, typically compromising the kernel, unlocking secure parts of the system. Depending on the security architecture, additional privilege escalation may be required, such as defeating a hypervisor.
Other examples of softmods are maliciously signed firmware, such as custom firmware on the PlayStation 3, which was made possible due to the master key being released, or gaining control of a process that is very early in the boot cycle, such as the Fusée Gelée Boot ROM vulnerability for the Nintendo Switch.
Softmods may be permanent (e.g. custom firmware) or temporary (e.g. homebrew enabler) that persist until powering off. Softmods are especially popular among video game consoles, in which they usually enable a homebrew environment that allow execution of unsigned code.
Incorrectly attempting to softmod can damage a device, especially if instructions are not followed correctly. In some cases, it can lead to bricking.
Softmods may be used to install or load an alternative operating system (e.g. a Linux distribution) on a device, as well as reinstate functionality that was removed from the official firmware, such as "OtherOS" on the PlayStation 3.
If a softmodded console connects to its online service, (such as Nintendo Switch Online on the Nintendo Switch) the console may be banned from the service permanently. Softmods void warranty due to tampering with device function and as a result, vendors will not honour any existing warranty policy if sent in for repair.
Legality Due to commonly being used to circumvent digital rights management, softmodding is seen as a tool to enable piracy, although the act of softmodding in itself may not be illegal.
In January 2011, security researcher Geohot and associates of the hacking group known as fail0verflow were sued by Sony for jailbreaking the PlayStation 3. Sony and Geohot later settled the case out of court, with Geohot agreeing not to reverse engineer any Sony product in the future.
In Japan, softmods were outlawed as part of new legislation in 2018 which made savegame editing and console modding illegal.
Softmods for video game consoles PlayStation/PSOne The original PlayStation can be softmodded with the TonyHax exploit. The exploit is compatible with all North American and European consoles except the launch model (SCPH-100x), but is not compatible with Japanese consoles. It is also compatible with early versions of the PlayStation 2 (SCPH-3900x or older), although only for booting PS1 discs. TonyHax can be booted either with a gamesave exploit (usually Tony Hawk's Pro Skater 2, 3, or 4, hence the name, but several other games are also supported), or except on the PS2, directly from a specially-flashed memory card. The exploit allows the console to boot homebrew, foreign-region games, and CD-R copies. Some PlayStation models are partially incompatible (slow load times, skipping audio and video) with phthalocyanine CD-Rs, preferring the older standard cyanine discs. TonyHax is not a permanent exploit; the drive is re-locked when the console is powered off or rebooted, requiring the user to re-load the exploit every time a CD-R or foreign game is booted.
An older method was to boot an original legitimate disc with the lid close sense button held down, quickly swap the disc with a CD-R copy or foreign disc, remove that disc and reinsert the original, and then swap for the CD-R or foreign disc again. This had to be carefully timed, and if done incorrectly could damage the drive or disc(s).
PlayStation 2 The PlayStation 2 has various methods of achieving a softmod.
Disc swapping was used early on to bypass the PlayStation 2 copy protection, by taking advantage of certain trigger discs such as 007: Agent Under Fire or Swap Magic, homebrew could be loaded. This was done by inserting the trigger disc, blocking the lid open sensor then hotswapping with a homebrew disc. Although difficult to execute correctly, the universality of the method was often used in order to softmod.
One of the earliest softmods developed — the Independence Exploit — allows the PlayStation 2 to run homebrew by exploiting a buffer overflow in the BIOS code responsible for loading original PlayStation games. This method, however, only works on models V10 and lower, excluding the PlayStation 2 slim, while still requiring a disc to be burned.
FreeMcBoot is an exploit that works on all models except the SCPH-9000x series with BIOS v2.30 and up. It requires no trigger disc and is able to directly load ELFs from the memory card.
Fortuna, Funtuna, and Opentuna are another form of memory card exploit. Unlike FreeMcBoot, they will work on the SCPH-9000x model, and they are compatible with third-party memory cards that do not support MagicGate.
HD Loader is an exploit for PS2 models with the hard drive peripheral.
FreeDVDBoot is an exploit discovered in 2020 that requires burning a disc image loaded with a payload onto a DVD-R. It is compatible with a range of PlayStation 2 models and works by exploiting a buffer overflow in the PS2's DVD video functionality.
MechaPwn is an exploit that permanently unlocks the DVD drive of the slim PS2 (and some later revisions of the fat PS2), allowing PS1 and PS2 discs from any region to be booted. PS1 CD-R copies can be booted directly from the PS2's built-in menu; PS2 CD-R/DVD-R copies require additional software to bypass the PlayStation 2 logo check.
In August 2024, a savegame exploit affecting multiple consoles and generations called TonyHawksProStrcpy was released, which is present in multiple Tony Hawk's titles for the PlayStation 2. It can be used to execute unsigned code.
PlayStation 3 The PlayStation 3 has a couple of methods to achieve a softmod. All models of PS3 can be softmodded.
Consoles that have factory installed (minimum firmware) version 3.55 or lower can install CFW (custom firmware) which is unofficial firmware. This includes: all fat models, slim 20xx and 21xx models, and some slim 25xx models - when manufactured before December 2010 (0C, 0D, 1A datecodes are guaranteed to be exploitable; 1B can be but not always). Later slim 25xx, slim 30xx, and all super slim models cannot install CFW.
Installing CFW was made possible with code signing after the PS3's master key was leaked. Sony changed the key with firmware 3.56. If a vulnerable console has official firmware above 3.55 installed, the flash can be patched via a WebKit exploit enables a CFW install. Should the flash patching process be interrupted (e.g. power outage), it is likely to brick the console.
CFW enables unofficial partial PS2 backwards compatibility, loading PS1/PS2/PS3 game backups, bypass region checks, enter Factory Service Mode, change fan speeds, overclock/underclock GPU, dump root keys.
PS2 backwards compatibility for the PS3 models that contain PS2 hardware (A/B/C/E) can be enhanced by installing modified versions of the emulators, which is only possible with CFW. Also, the PS2 emulator that is done completely through software can have the emulated Emotion Engine (PS2 CPU) overclocked, up to 50% more, which interestingly leads to better performance for some PS2 titles over the PS2 hardware emulators.
Some CFW implementations reinstate the "OtherOS" feature Sony later removed, that allows for loading a Linux distribution.
The most supported PS3 CFW is Evilnat Cobra.
The other main softmod is PS3HEN (HEN). HEN is supported by all PS3 models. In order to use HEN, it is required to install HFW (hybrid firmware), another kind of unofficial firmware. This is a tether softmod, meaning HEN has to be enabled every time the console is powered on.
HEN enables unofficial partial PS2 backwards compatibility (via PS2 Classics installed as PKG file), loading PS1/PS2/PS3 game backups, bypass region checks, and change fan speeds.
The hypervisor (HV) is still active when using HEN, and this can lead to the console crashing/hanging, making HEN less stable than CFW.
PlayStation 4 The PlayStation 4 has ways to achieve a softmod. Most require a userland exploit as the entry point, which can be either WebKit vulnerabilities in the PS4 Web Browser, a Blu-ray disk with a jailbreak image, exploit using PPPoE, a modified media app, or a savegame exploit. All models of PS4 can be softmodded. They are all tether exploits meaning they have to be performed every time the console is powered on, although some exploits may be persisted using rest mode.
Softmodding a PS4 allows for running unsigned code which lets user to load PS1/PS2/PSP/PS4 game backups, bypass region checks, and change fan speeds. Some payloads can boot the PS4 into a Linux distribution, although this is not permanent and the console will revert to Orbis OS on reboot.
The most supported PS4 HEN (Homebrew Enabler) is GoldHEN.
Known firmware versions that allow for a softmod are: 1.76, 4.05,, 4.55, 4.74, 5.05/5.07, 6.72, 7.02, 7.55, 9.00, 11.00, 11.02, 12.02, 12.52, 13.00, 13.52.
PlayStation 5 The PlayStation 5 has ways to achieve a softmod. They rely on a userland exploit as the entry point, which can be either WebKit vulnerabilities in the PS5 Web Browser, a specially crafted Blu-ray disc, a modified media app, or a savegame exploit. All models of PS5 can be softmodded. They are all tether exploits meaning they have to be performed every time the console is powered on, although some exploits may be persisted using rest mode.
Softmodding a PS5 allows for PS4 homebrew, loading PS1/PS2/PSP/PS4/PS5 game backups, modify the PS4 backwards compatibility blacklist, and change fan speeds.
A softmodded PS5 is also capable of playing patched PS4 titles above the PS4 frame rate cap of 30 or 60 FPS, at higher frame rates such as 60 or 120 FPS. Some payloads can boot the PS5 into a Linux distribution, although this is not permanent and the console will revert to Orbis OS on reboot.
Known firmware versions that allow for a softmod are: 2.70, 4.51, 5.50, 6.02, 7.61, 10.01, 11.60, 12.00, 12.70, 13.60.
It is worth noting exploits up to 7.61 can compromise the kernel and hypervisor (HV), while higher firmware exploits compromise the kernel. Having an additional HV exploit is typically more stable than just a kernel exploit, and also allows for deeper modifications to the system, such as booting into a Linux distribution, as well as compromising the ARM Cortex-A53 co-processor. This is notable as compromising the A53 can enable installing and running PS5 "FPKGs". Separate A53 exploits also exist without use of a HV exploit, affecting firmware versions up to 11.60.
Numerous kernel exploits were found to be exploitable on both the PS4 and PS5, leading to new jailbreaks on each console:
Jailbreaks PS4 PS56.724.5112.0210.0113.0012.0013.5213.60