Installed Games and Applications
—
Settings
Each section opens to its own controls. All changes are applied
live and saved to /data/elf-arsenal/config.ini so
they survive a redeploy.
🎨 Appearance
⏱ How Long To Beat (HLTB) Vercel proxy + per-title progress bars in Activity
https://hltb-proxy-sand.vercel.app/). The api/search path is appended automatically. Deploy your own free proxy: upload the hltb-proxy/ folder from the repo to a new GitHub repo, log into Vercel, and create a project from it.⚙ Kstuff & auto-toggle kernel patcher + klog auto-pause
payloads/kstuff-lowfw.elf).
/data/shadowmount/shadowmountplus.elf.
Both .elf direct releases and .zip
archives are supported — for zip releases (1.6beta9+),
Elf Arsenal unpacks shadowmountplus.elf
automatically.
📀 ShadowMountPlus Loading…
/data/shadowmount/shadowmountplus.elf. SMP is
no longer bundled — install via the picker above first.
When the elf is present, the daemon auto-starts at every
Elf Arsenal boot.
Show default paths
/user/appmeta/<TITLE_ID>/icon0.png
(and friends) didn't propagate during the mount. Elf Arsenal
runs a background watcher that periodically diffs
/user/app/ against /user/appmeta/ and
copies the missing icons / pic art / param.json
from each game's sce_sys/. Runs even if SMP is off
(it works on whatever is in /user/app/).
30 s. Lower means quicker recovery after
mounting a new disk; higher means less I/O. Range 5–600.
🎮 Cheat engine Loading status…
- Connect any FTP client (FileZilla, WinSCP, Cyberduck, the Files app on iOS, etc.) to your PS5:
Host: your-ps5-ip · Port: 2121 · User: anonymous · Password: (blank)
- Navigate to
/data/elf-arsenal/cheats/(the folder is created automatically on boot). - Upload your cheat JSON file. Name it
<TITLE_ID>.json— for examplePPSA01411.jsonfor Spider-Man Miles Morales. The file'stitle_idfield must also match. - Back here, hit Refresh cheats below; the toggles for that game appear once it's the foreground app.
{
"title_id": "PPSA01411",
"name": "Game Name (optional)",
"cheats": [
{
"name": "Infinite Health",
"mods": [
{ "offset": "0x12340", "on": "9090", "off": "0102", "absolute": false }
]
}
]
}
Offsets default to relative to the eboot image base; set
"absolute": true for raw addresses. Hex strings may
use spaces, dashes, or colons as separators.
json.txt index and grabs every
cheat file in the chosen repository into
/data/elf-arsenal/cheats/. The progress bar
ticks per file; once the loop finishes a verification pass
confirms every expected file landed on disk and surfaces
any missing names. Hundreds of files — a few minutes over LAN,
longer on Wi-Fi.
/data/elf-arsenal/patches/<TITLE_ID>.{json,shn,mc4}
(or the per-format subdirs). Per-pid one-shot: a patch set
doesn't re-fire while the same game stays running.
/data/elf-arsenal/patches/PPSA12345.json/data/elf-arsenal/patches/PPSA12345.shn/data/elf-arsenal/patches/PPSA12345.mc4Per-format subdirs (cleaner organization):
/data/elf-arsenal/patches/json/PPSA12345.json/data/elf-arsenal/patches/shn/PPSA12345.shn/data/elf-arsenal/patches/mc4/PPSA12345.mc4
🚀 Y2JB autoloader sync refresh elf-arsenal.elf in every ps5_autoloader/ folder
itsPLK/ps5-y2jb-autoloader
drops payloads into ps5_autoloader/ folders on
USB or in /data/. This panel finds every such
folder that already contains a Elf Arsenal build and replaces
the ELF with the latest release pulled from
git.etawen.dev. The variant in place
(elf-arsenal.elf vs sonic-loader-no-etahen.elf)
is preserved per folder; autoload.txt is left
untouched. YT-sandbox paths are intentionally skipped.
🧩 Managed Payloads auto-update third-party ELFs loaded by y2jb-autoloader
Elf Arsenal can keep selected third-party PS5 payloads up to date.
Each entry maps a GitHub repo to a stable filename that lives in
your ps5_autoloader/ folders (and
/data/pldmgr/payloads/ if pldmgr is installed). When
you turn Auto on boot on for a payload that's
already installed, Elf Arsenal pulls the latest release on every
boot and atomically replaces the ELF in place. Default entry:
itsPLK/ps5-payload-manager
(pldmgr.elf).
Paste a GitHub repo URL (or owner/repo) and click
🔍 Lookup latest. The form auto-fills the display
name (from the repo), an asset glob (derived from the matched
filename), and the install filename (the stock release asset
name). Tweak any field if needed, then hit Add.
Pick an .elf on your PC. It'll be written to
/data/ps5_autoloader/<filename> (and
/data/pldmgr/payloads/<filename> if that
directory exists) and added to the registry as a local entry —
no GitHub source, so auto-update is off by default.
🛒 PKG Zone catalog cached weekly · manual refresh
The PKG Zone tab mirrors the pkg-zone.com catalog locally. The cache is refreshed automatically once every 7 days of PS5 system time so we don't hammer LightningMods' server. Restarting Elf Arsenal does not force a refresh — only an explicit click below (or the Refresh button on the PKG Zone page itself) does.
🐷 BackPork per-game fakelib union-mount payload
fakelib folder over the game's library path so you
can sideload patched prx/sprx files.
Place replacement libraries in
<PPSAxxxxx>/fakelib/ inside the game's
installation folder. Disabled by default because
it conflicts with ShadowMountPlus's built-in fakelib watcher;
if you turn this on, set backport_fakelib=0 in
/data/shadowmount/config.ini first.
🌐 nanoDNS local DNS forwarder for community domains
127.0.0.1:53 and resolves community domains
(git.etawen.dev, etc.) so the home-screen tile
auto-install + lazy-fetched payloads work without changing the
PS5's DNS settings. On by default. Turn off if
you run your own DNS forwarder upstream — Elf Arsenal still
works, you just lose community-domain resolution.
🏠 Elf Arsenal UI pkg auto-update refresh the home-screen tile every boot
elf-arsenal-tile.pkg from
git.etawen.dev
and reinstalls the PS5 home-screen tile so the launchable
icon stays in sync with the loader payload.
On by default. Turn off if you're pinned
to a specific tile build, or have installed a custom tile
pkg by hand and don't want it overwritten on the next boot.
The setting persists across reboots.
💾 App Dumper EchoStretch/ps5-app-dumper (1.08-sl1 fork) — per-USB config + skip-existing resume
/mnt/usbN, walks /mnt/sandbox/pfsmnt,
and copies every mounted app + patch tree to
<usb>/PS5/<TITLE_ID>/. Watch the system
notifications for progress.
Re-seed configs drops a fresh config.ini
on any newly-plugged USB that doesn't have one yet (idempotent —
existing configs are left alone).
📦 Homebrew installer download & extract payloads + launcher PKG
Downloads & extracts payloads from
ps5-payload-dev/websrv releases
into /data/homebrew/. Big assets like RetroArch take a while
— leave the page open until you see the toast.
http://127.0.0.1:6969/, no browser bookmarks
needed. The PKG is re-fetched on every boot so the tile
stays in sync with the latest published version.
📦 PKG Installer DPI-backed local + URL installs
📥 Install any .pkg file staged · paste path · 📂 Browse PC
.pkg into /data/elf-arsenal/pkgs/
(port 2121, anonymous), pick it from the
dropdown and hit Install. Paths under any other
/data/... directory also work — just paste
the full path. The whole /data/elf-arsenal/pkgs/
directory is wiped on every Elf Arsenal boot, so PKGs
aren't retained between sessions.
📡 Install PKG by URL (RemotePKG) DPI streams the PKG from a remote URL
127.0.0.1:9040. DPI streams
the PKG from the remote server straight into the system
installer — no local staging required. Local-PKG installs
in the section above route through the same DPI daemon.
📡 FTP server …
2121+N if its preferred port is busy). Whichever
daemon is active, SL+ always passes -p PORT so
the actual listening port matches what you set above.
Saving a new port automatically kills the running daemon and respawns it on the new port — no need to re-send Elf Arsenal. Resend payload kills + respawns the daemon on the current port without changing it.
TYPE I for binary or TYPE A for
ASCII). Binary / ASCII force the
per-session default server-side regardless of what the
client sends — useful when a client keeps defaulting to
ASCII and corrupting binary uploads with CRLF rewrites.
zftpd — the seregonwar/zftpd implementation (Sony retry suppression net filter, larger but more permissive). Auth + transfer-type controls don't apply when zftpd is selected — port still does.
Switching automatically TERMs the current daemon and respawns the chosen one on the configured port.
🐧 PS5 Linux loader …
/data/elf-arsenal/dl/ps5-linux-loader.elfSource: github.com/ps5-linux/ps5-linux-loader (latest release pulled from the GitHub API on demand). Elf Arsenal auto-downloads on first boot if the file isn't cached yet, so the Linux tab in the top nav is usually ready by the time you open this page.
.tmp → rename, can't half-
write) and bumps the recorded version tag.
🧩 Background services …
/dev/klog to TCP :3232.
Powers the in-page Klog viewer and remote
nc <ip> 3232 tails. Disabling kills the
listener — the Klog viewer goes dark until re-enabled.
Default ON.
_UnlockTrophy events via
libSceNpUniversalDataSystem for any running
PPSA/PPSB/CUSA process that has a list file dropped in
/data/elf-arsenal/trophy-unlocks/. Default OFF
— flip this on if the legacy launcher-patch unlocker above
doesn't latch on your firmware (mostly relevant on 7.xx +).
- Sign in to the profile you want trophies on. If you previously ran NP fake sign-in on this profile, run NP fake sign-out from the section below first and reboot — trophies cannot earn while a forged account is in the registry.
- Launch the game once from the home
screen. The daemon needs the game's process to be running
so it can call
sceNpUnivDataSystemPostEventwith the right NPCommId. Sit on the title screen for ~5 seconds, then back out to home if you don't want to play. - Open the Klog tab (top nav). Look for
the line
[trophy-uds] tracking pid=… NPWR…— that confirms the daemon has latched onto the game. If you don't see it, the game's NPCommId isn't registered yet; relaunch the title. - Drop a trophy list at
/data/elf-arsenal/trophy-unlocks/<TITLE_ID>.txtvia FTP (port 2121, anonymous). Format is one trophy id per line —0throughN(0-indexed). Use0..63to fire every possible slot; the daemon silently no-ops on ids the game doesn't define, so over-firing is safe. - Wait ~3 seconds. The daemon scans the
drop dir every tick. Each accepted unlock posts a system
notification and writes
TRPTITLE.DATaccountId / progress fields for the foreground user. - Verify in the Trophies app. Exit the game, open Trophies from the home screen, find the title — earned trophies should appear with timestamps. If the title is missing entirely, see the NP fake sign-out section below.
- (Optional) Bulk mode. If you want
every trophy in every running PPSA/PPSB/CUSA game to
fire at once, drop
0..63(literally that text on one line) at/data/elf-arsenal/trophy-unlocks/_ALL.txt. The daemon broadcasts the range to every tracked pid.
🌡 Fan control /dev/icc_fan threshold (pinned)
Sets the fan threshold via /dev/icc_fan ioctl
(0xC01C8F07). Same approach used by
Scene-Collective/ps4-fan-threshold.
Lower temperatures spin the fan up sooner.
🖼 Avatar Maker PNG/JPG → DXT5 DDS (avatar64/128/260/440)
Drop in a picture and we'll convert it to the four DXT5
.dds files the PS5 uses for profile avatars
(avatar64.dds, 128, 260,
440). Same pipeline as
earthonion/np-fake-signin/gen_dat/png_to_dds.py.
Preview each size, switch between centre-crop and fit-with-padding,
then Apply to copy the four files into your target avatar folder.
stb_image can decode.
User1 — 0x1396ECE8) and copies the four
avatar64.dds/128/260/440
files plus the source avatar.png
into /system_data/priv/cache/profile/0x<userId>/.
The directory is created if missing.
avatar.png are copied into this folder.
🪪 NP fake sign-in earthonion/np-fake-signin sub-payload
Spawns np-fake-signin.elf
(from earthonion/np-fake-signin)
to inject a fake PSN sign-in for the current foreground user. The
payload patches the system registry (sceRegMgrSet*)
and per-user auth.dat / config.dat on
disk, then ShellCore picks up the new state on the next login.
Reboot is required for the changes to take.
git.etawen.dev and caches it at
/data/elf-arsenal/np-fake-signin.elf. Subsequent
clicks read from disk directly. Delete that file over FTP if
you want to force a fresh fetch.
…
TRPTITLE.DAT; once the registry holds a forged FNV-hashed id, every
unlock writes the wrong account and the Trophies app hides the title. If you
want trophies back on this profile, run NP fake sign-out in the
section below, reboot, and let SceShellCore rebuild the TRPTITLE.DAT entries
on next title launch.
🚪 NP fake sign-out undo np-fake-signin for trophies
Spawns np-fake-signout.elf for the current foreground user.
Zeros every registry key the signin set (REG_KEY_ACCOUNT_ID,
REG_KEY_SIGNIN_FLAG, email, online id, country, locale, etc.),
truncates /system_data/priv/home/<uid>/config.dat from
offset 0x4C onward back to all-zero (the pre-signin shape),
and removes account.dat / token.dat /
auth.dat if present. Reboot is required for
libSceNpManager to drop its cached view.
TRPTITLE.DAT entries with accountId = 0 on next
title launch, so unlocks land normally instead of being routed to a forged
account.
🛡 Backups & Restore automatic snapshots of every console-state change
Elf Arsenal automatically snapshots
/system_data/priv/mms/app.db,
appinfo.db, and per-user
config.dat before the features that
mutate them — trophy-unlocker, NP fake sign-in / sign-out /
restore, autoloader migration. Snapshots live at
/data/elf-arsenal/backups/<tag>/<timestamp>/
with a manifest mapping each saved file back to its original
path. Tap "Restore" on any snapshot below to revert
— a reboot is required for the restored state to take effect
everywhere (most subsystems only re-read these files at boot).
Note: PKG installs are not auto-snapshotted in this build — the install pipeline blocks the snapshot path from a worker thread and we can't take it cleanly there. Before installing anything risky, tap "📸 Dump registry" below to take a manual anchor.
app.db + appinfo.db at every boot,
right before the trophy-unlocker daemon spawns. The gold
initial snapshot taken on first boot is
also preserved forever. When OFF the boot-time snapshot is
skipped; existing snapshots stay on disk untouched.
app.db, appinfo.db,
addcont.db, notification2.db, plus
any reg* file in /system_data/priv/mms/
in the background. Watch the status line for "finished".
🔁 NP account restore earthonion/np-account-restore sub-payload
Spawns np-restore-account.elf
(from earthonion/np-account-restore)
which reads config.dat for the foreground user and
writes every field verbatim into the system registry. No patching —
pure restore from existing dat files. Reboot is required.
…
🪪 Offline account activation ps5-payload-dev/offact (registry only)
Lists every user slot stored in the system registry on this
console (up to 16). For each slot you can:
Auto-activate (writes a synthetic id
derived from the slot name + type=np +
flags=0x1002), Edit ID (type a
custom ID, hit Save and the slot is fully activated in one
shot), or Clear the activation. None of this
requires signing into the user — Elf Arsenal writes the
registry directly via sceRegMgr*. Logic vendored
from
ps5-payload-dev/offact.
auth.dat / config.dat. Activate here
→ reboot → run NP fake sign-in.
🧄 Garlic Worker & SaveMgr community save processing for garlicsaves.com
Leaving it on helps the entire community: every active worker cuts the queue at garlicsaves.com so users get their saves back faster, and the impact is dramatic right after a new kernel exploit drops and demand spikes.
30s. Lower values = faster job pickup at
a small bandwidth cost. Written to
/data/garlic/config.ini; the worker re-reads it on
each cycle, so changes apply within one poll without restarting.