Softmod

This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "Softmod" – news · newspapers · books · scholar · JSTOR (March 2008) (Learn how and when to remove this message)

A softmod (short for software modification) is a method of using software to modify the intended behavior of hardware, such as computer hardware, or video game consoles in a way that can overcome restrictions of the firmware, or install custom firmware.^[1]

Many softmods are exploits combined, known as exploit chains. The first requirement is being able to run unsigned code, known as userland exploits. Web browsers are very common vectors for this, most of which use the WebKit browser engine, which is notably open source and as a result, vulnerabilities are widely known. Another common vector of userland exploit are savegame exploits, which are specially crafted savegame files that exploit vulnerabilities in a game's code allowing for unsigned code. The second requirement is privilege escalation, typically compromising the kernel, unlocking secure parts of the system. Depending on the security architecture, additional privilege escalation may be required, such as defeating a hypervisor.

Other examples of softmods are maliciously signed firmware, such as custom firmware on the PlayStation 3, which was made possible due to the master key being released, or gaining control of a process that is very early in the boot cycle, such as the Fusée Gelée Boot ROM vulnerability for the Nintendo Switch.

Softmods may be permanent (e.g. custom firmware) or temporary (e.g. homebrew enabler) that persist until powering off. Softmods are especially popular among video game consoles, in which they usually enable a homebrew environment that allow execution of unsigned code. Compared to installing a modchip, a softmod is generally preferred (if available) due to not requiring having to open up the device and perform soldering, which could damage the device hardware. However, attempting to softmod can still damage a device, especially if instructions are not followed correctly. In some cases, it can lead to bricking.

Softmods may be used to install or load an alternative operating system (e.g. a Linux distribution) on a device, as well as reinstate functionality that was removed from the official firmware, such as "OtherOS" on the PlayStation 3.

If a softmodded console connects to its online service, (such as Nintendo Switch Online on the Nintendo Switch) the console may be banned from the service permanently. Softmods void warranty due to tampering with device function and as a result, vendors will not honour any existing warranty policy if sent in for repair.

Due to commonly being used to circumvent digital rights management, softmodding is seen as a tool to enable piracy, although the act of softmodding in itself may not be illegal.

In January 2011, security researcher Geohot and associates of the hacking group known as fail0verflow were sued by Sony for jailbreaking the PlayStation 3.^[2] Sony and Geohot later settled the case out of court, with Geohot agreeing not to reverse engineer any Sony product in the future.^[3]

In Japan, softmods were outlawed as part of new legislation in 2018 which made savegame editing and console modding illegal.^[4]

The original PlayStation can be softmodded with the TonyHax exploit.^[5] The exploit is compatible with all North American and European consoles except the launch model (SCPH-100x), but is not compatible with Japanese consoles. It is also compatible with early versions of the PlayStation 2 (SCPH-3900x or older), although only for booting PS1 discs. TonyHax can be booted either with a gamesave exploit (usually Tony Hawk's Pro Skater 2, 3, or 4, hence the name, but several other games are also supported), or except on the PS2, directly from a specially-flashed memory card. The exploit allows the console to boot homebrew, foreign-region games, and CD-R copies. Some PlayStation models are partially incompatible (slow load times, skipping audio and video) with phthalocyanine CD-Rs, preferring the older standard cyanine discs. TonyHax is not a permanent exploit; the drive is re-locked when the console is powered off or rebooted, requiring the user to re-load the exploit every time a CD-R or foreign game is booted.

An older method was to boot an original legitimate disc with the lid close sense button held down, quickly swap the disc with a CD-R copy or foreign disc, remove that disc and reinsert the original, and then swap for the CD-R or foreign disc again. This had to be carefully timed, and if done incorrectly could damage the drive or disc(s).

The PlayStation 2 has various methods of achieving a softmod.

Disc swapping was used early on to bypass the PlayStation 2 copy protection, by taking advantage of certain trigger discs such as 007: Agent Under Fire or Swap Magic, homebrew could be loaded. This was done by inserting the trigger disc, blocking the lid open sensor then hotswapping with a homebrew disc. Although difficult to execute correctly, the universality of the method was often used in order to softmod.

One of the earliest softmods developed — the Independence Exploit — allows the PlayStation 2 to run homebrew by exploiting a buffer overflow in the BIOS code responsible for loading original PlayStation games. This method, however, only works on models V10 and lower, excluding the PlayStation 2 slim, while still requiring a disc to be burned.^[6]

FreeMcBoot is an exploit that works on all models except the SCPH-9000x series with BIOS v2.30 and up.^[7] It requires no trigger disc and is able to directly load ELFs from the memory card.

Fortuna, Funtuna, and Opentuna are another form of memory card exploit. Unlike FreeMcBoot, they will work on the SCPH-9000x model, and they are compatible with third-party memory cards that do not support MagicGate.

HD Loader is an exploit for PS2 models with the hard drive peripheral.

FreeDVDBoot is an exploit discovered in 2020 that requires burning a disc image loaded with a payload onto a DVD-R. It is compatible with a range of PlayStation 2 models and works by exploiting a buffer overflow in the PS2's DVD video functionality.^[8]

MechaPwn^[9] is an exploit that permanently unlocks the DVD drive of the slim PS2 (and some later revisions of the fat PS2), allowing PS1 and PS2 discs from any region to be booted. PS1 CD-R copies can be booted directly from the PS2's built-in menu; PS2 CD-R/DVD-R copies require additional software to bypass the PlayStation 2 logo check.

In August 2024, a savegame exploit affecting multiple consoles and generations called TonyHawksProStrcpy^[10] was released, which is present in multiple Tony Hawk's titles for the PlayStation 2. It can be used to execute unsigned code.

The PlayStation 3 has a couple of methods to achieve a softmod. All models of PS3 can be softmodded.

Consoles that have factory installed (minimum firmware) version 3.55 or lower can install CFW (custom firmware) which is unofficial firmware. This includes: all fat models, slim 20xx and 21xx models, and earlier 25xx models - the latter only if the console was manufactured before December 2010 (datecode 0D or less is guaranteed; 1A is maybe). Later slim 25xx, slim 30xx, and all super slim models cannot install CFW.

Installing CFW was made possible with code signing after the PS3's master key was leaked.^[11] Sony changed the key with firmware 3.56. If a vulnerable console has official firmware above 3.55 installed, the flash can be patched via a WebKit exploit which allows for a CFW install. Should the patching process be interrupted (e.g. power outage), it can brick the console.

CFW allows the running of homebrew, load game backups, bypass region checks, enter Factory Service Mode, change fan speed, RSX speed, grant access to root keys, as well as run PS2 ISOs on unsupported backwards compatible models (via software emulation). Some CFW implementations reinstate features Sony removed such as "OtherOS".

The most supported PS3 CFW is Evilnat Cobra.^[12]

The other softmod is PS3HEN^[13] (HEN). HEN is supported by all PS3 models. In order to use HEN, it is required to install HFW (hybrid firmware), another kind of unofficial firmware. This is a tether softmod, meaning HEN has to be enabled every time the console is powered on.

HEN allows the running of homebrew, load game backups, bypass region checks, change fan speeds, and play installed PS2 Classics PKGs. The hypervisor (HV) is still active and periodically checks if the current code being executed is unsigned; there is a small chance it can lead to the console becoming unresponsive or shutting down, making HEN less stable than CFW.

The PlayStation 4 has ways to achieve a softmod. Most require a userland exploit as the entry point, which can be either WebKit vulnerabilities in the PS4 Web Browser, a specially crafted Blu-ray disk, a modified media app, or a savegame exploit. All models of PS4 can be softmodded. They are all tether exploits meaning they have to be performed every time the console is powered on, although some exploits may be persisted using rest mode.

Softmodding a PS4 allows for running homebrew, loading game backups, bypass region checks, and change fan and CPU/GPU speeds. Some payloads can boot the PS4 into a Linux distribution, although this is not permanent and the console will revert to Orbis OS on reboot.

Known firmware versions that allow for a softmod are: 1.76,^[14] 4.05,^[15], 4.55,^[16] 4.74,^[17] 5.05/5.07,^[18] 6.72,^[19] 7.02,^[20] 7.55,^[21] 9.00,^[22] 11.00,^[23] 12.02,^{[24][25][26][27]} 12.52,^[28] 13.00.^[29]

The PlayStation 5 has ways to achieve a softmod. They rely on a userland exploit as the entry point, which can be either WebKit vulnerabilities in the PS5 Web Browser, a specially crafted Blu-ray disc, a modified media app, or a savegame exploit. All models of PS5 can be softmodded. They are all tether exploits meaning they have to be performed every time the console is powered on, although some exploits may be persisted using rest mode.

Softmodding a PS5 allows for running homebrew, load game backups, modify the PS4 backwards compatibility blacklist, install and run PS4 "FPKGs" (including PS4 homebrew and PS1/PS2/PS4 game backups), and change fan speeds. A softmodded PS5 is also capable of playing patched PS4 titles above the PS4 frame rate cap of 60 FPS, such as Bloodborne, at higher frame rates such as 120 FPS.

Known firmware versions that allow for a softmod are: 2.70,^[30] 4.51,^[31][32] 5.50,^[33] 7.61,^[34] 10.01,^[35][36] 12.00.^[37]

It is worth noting exploits up to 4.51 compromise the kernel and hypervisor (HV), while the higher firmware exploits only compromise the kernel; using a HV exploit provides better stability than just a kernel exploit. Besides stability, there are currently no major differences in functionality for either softmod.

The kernel exploit that led to the 6.72^[19] PS4 jailbreak was patched a few months prior to the release of the PS5, which was reintroduced on the PS5 with 3.00 firmware, affecting up to 4.51^[31] firmware. The kernel exploit that led to the 12.02^[24] PS4 jailbreak could also be used to jailbreak the PS5, and affected up to 10.01^[36] firmware. In addition, the kernel exploit that led to the 13.00^[29] PS4 jailbreak could also be used to jailbreak the PS5, and affected up to 12.00^[37] firmware.

In June 2023, a payload called libhijacker^[38] was disclosed, which allows running homebrew without the need of a HV exploit, which works by creating a new, separate process by interacting with the PS5's Daemon, effectively acting as a background ELF loader. This is notable over previous ELF loaders such as the WebKit or Blu-ray methods since those ELF loaders were terminated when the corresponding process was stopped. Another advantage of this new method is that the newly separate process is not confined to the fixed maximum resource allocation of the WebKit or BD-J processes.

In July 2023, security researcher Flatz disclosed^[39] that they had read access to the PS5's Platform Secure Processor (PSP) which is one of the most protected parts of the system and contains crucial keys for decryption.

In October 2024, security researcher SpecterDev disclosed^[30] two exploit chains that compromise the hypervisor, which affect firmware versions up to 2.70.

In January 2026, a payload called BackPork^[40] was disclosed, which allows for backporting PS5 games to lower firmwares that officially only work on higher firmwares.

In March 2026, scene developer Gezine disclosed^[37] a PS2 savegame exploit chain which included a JIT compiler exploit. This is notable because it achieves arbitrary native userland code execution, which means even without being chained with a kernel exploit, it is possible to run some homebrew, such as emulators.

It is possible to softmod almost any PlayStation Portable. Using various exploits (such as the TIFF exploit or specially crafted savegames from games such as Grand Theft Auto: Liberty City Stories, Lumines, and later GripShift) or original unprotected firmware, the user can run a modified version of the PSPs updater, that will install custom firmware. This newer firmware allows the booting of ISOs, as well as running unauthorized (homebrew) code. A popular way of running homebrew code to softmod the PSP is by using the Infinity method. The most recent CFW(Custom FirmWare) right now is ARK-4 that can be used on any PSP model and it also allows WPA2 Wi-Fi to be connected.

The PlayStation Vita can also be softmodded, with the most notorious methods being using: HENkaku Web Exploit, h–encore, and h-encore².

The Xbox used to include a font exploit installed through exploits in savegame code for MechAssault, Splinter Cell, 007: Agent Under Fire, and Tony Hawk's Pro Skater 4. Usage of the Splinter Cell or Tony Hawk's Pro Skater 4 disc is generally recommended as any version of the game will run the exploit, whereas certain production runs of Mechassault and Agent Under Fire are needed to use the exploit. Originally, via a piece of software called "MechInstaller" created by members of the Xbox-linux team, an additional option could be added to the Xbox Dashboard for booting Linux.

The font hack works by exploiting a buffer underflow in the Xbox font loader which is part of the dashboard. Unfortunately, since the Xbox requires the clock to be valid, and the dashboard itself is where one sets the clock, there is a problem if the RTC backup capacitor discharges. The Xbox will detect that the clock is not set and therefore force the dashboard to be loaded; the dashboard then reboots due to the buffer overflow exploit. Upon restarting, the Xbox detects the clock is invalid and the process repeats. This problem became known as the "clockloop".^[41]

In August 2024, a savegame exploit affecting multiple consoles and generations called TonyHawksProStrcpy^[10] was released, which is present in multiple Tony Hawk's titles for the Xbox. It can be used to execute unsigned code.

All models of Xbox 360 can be softmodded.

Softmodding an Xbox 360 allows users to run homebrew, load game backups (including original Xbox), bypass region checks, and change fan speeds. Some payloads can boot the Xbox 360 into a Linux distribution, although this is not permanent and the console will revert to the Xbox system software on reboot.

Shortly after the release of the Xbox 360, ways were found to modify the firmware of the DVD drive of the console. This allows the system to play games from "backup" (non-original) game discs. This requires opening of the console but no additional hardware such as a modchip is permanently installed into the system. Microsoft responded by introducing console ban system. If the data stream from the DVD drive indicated signs of unauthorized use, Microsoft would permanently ban the console from using the Xbox Live service. The ban never expires and can only be fixed by purchasing another console. Other measures, such as introducing new hardware revisions to prevent modifications and checking/updating the drive firmware during dashboard updates, have been made too.

In January 2007, a HV (hypervisor) exploit was patched with dashboard 2.0.4552.0,^[42] where it could be leveraged in some previous dashboards (2.0.4532.0 and 2.0.4548.0), which granted full control over the console. This was commonly chained with a modified version of the King Kong video game for the Xbox 360, made possible using an Xbox 360 with a modified DVD drive that was able to boot unofficial game copies. It was discovered the King Kong game contained poorly coded shaders which could be specially crafted to allow for arbitrary code execution. This became known as the infamous King Kong exploit.

In August 2024, a savegame exploit affecting multiple consoles and generations called TonyHawksProStrcpy^[10] was released, which is present in Tony Hawk's American Wasteland for the Xbox 360. It can be used to execute unsigned code. The Xbox version of the game does not contain the exploit on the Xbox 360.

In March 2025, a HV exploit called Bad Update was disclosed^[43] which affected all dashboards up to and including the latest version (2.0.17559.0 at the time of release). This exploit chain uses a savegame exploit as the entry point, granting full control over the console. It requires a specially crafted USB flash drive. It is a tether exploit meaning it has to be performed every time the console is powered on. Unlike the JTAG/RGH hardmod exploits which could only be applied to specific Xbox 360 models, this softmod works on all models.

In September 2025, an exploit chain called A Bad Avatar was disclosed^[44] which is a variant of the Bad Update exploit chain. Instead of using a savegame exploit as the entry point, it uses a specially crafted offline Xbox Avatar. This was simplified even further with the release of A Bad Avatar HDD^[45] which does not require a specially crafted USB flash drive, instead using the internal storage.

The Xbox One went through its lifecycle without having its security compromised. However, in June 2024, a userland exploit was disclosed for a Microsoft Store app called Game Script that had a bug which allowed for arbitrary code execution. Microsoft removed the app from the store a few days after disclosure, effectively patching the vulnerability for those who did not have it downloaded already.

A couple of weeks later, the same developer who published the userland exploit released a follow-up release which achieves kernel access while in Retail mode. This is roughly equivalent in functionality if the console was in Developer mode. Due to the Xbox One's security architecture, the console security is still mostly intact and further mitigations are necessary in order to become a HEN (homebrew enabler).

A payload exists that starts a reverse shell on the console over the network, which for example can be used to browse the console's filesystem and create directories.

The Xbox Series X and Series S are vulnerable to the same exploits for the Xbox One, and similarly have security measures where the console security is still mostly intact and further mitigations are necessary in order to become a HEN (homebrew enabler).

There was an exploit within the game Phantasy Star Online port for the GameCube. It used the network adapter to download a malicious update containing unsigned code.

In August 2024, a savegame exploit affecting multiple consoles and generations called TonyHawksProStrcpy^[10] was released, which is present in multiple Tony Hawk's titles for the GameCube. It can be used to execute unsigned code.

The first known softmod for the Wii is known as the Twilight hack,^[46] a savegame exploit for the Wii version of The Legend of Zelda: Twilight Princess. This allowed users to run unsigned code .dol/.elf files.

The Twilight hack was superseded by the development of Bannerbomb,^[47] which allowed for executing unsigned code without relying on an exploit within a game. Bannerbomb worked by using a malformed banner to inject a loader program into the Wii Menu program in memory. As the Wii Menu crashed, an unsigned executable was executed.

Bannerbomb was superseded by Letterbomb,^[48] which used a glitch in the Wii Message Board to crash the Wii Menu.

FlashHax^[49] superseded Letterbomb, which used an exploit in the Wii's End-user license agreement to run unsigned code, requiring the Internet Channel to be installed.

str2hax^[50] superseded FlashHax, which simplified the process even further. str2hax uses a custom DNS server to redirect the Wii's End-user license agreement page to a modified page that executes unsigned code, without the need for the Internet Channel.

BlueBomb^[51] was later released that leveraged a Bluetooth exploit, in particular used to softmod the Wii Mini which could not use the Internet Browser as an exploit entry point.

Exploits typically allowed the install of the Homebrew Channel, an unofficial Wii channel which acted as a gateway to run unofficial Wii applications.

A large homebrew community emerged for the Wii, leading to developments such as the Homebrew Channel, third-party games, media players, and the loading of Wii and GameCube game backups.

The Wii U can be softmodded with various exploits. The easiest way to softmod a Wii U is WebKit vulnerabilities in the Wii U Internet Browser. Softmodding a Wii U can allow for a custom firmware install.

The most supported CFW is Aroma.^[52]

Softmodding a Wii U allows for homebrew, unlock GameCube backwards compatibility, load game backups, bypass region checks, and change fan and CPU/GPU speeds. Softmodding a Wii U does not automatically softmod the virtual Wii (vWii), although softmodding the Wii U beforehand can make softmodding the vWii easier.

Previously, a few Virtual DS games could be exploited with specially crafted savegames to install CFW. However, after the eShop closure this method is now impossible to do unless the game was downloaded pre-closure.

All versions of the Nintendo DS as well as the Nintendo DS Lite can be softmodded using FlashMe: an exploit that can be installed using any PassMe compatible flashcart. The exploit consists of shorting two pins with any metallic object to make the NAND containing the firmware writable. The custom firmware looks and acts exactly the same as the original DS firmware except for the fact you will not need a PassMe or Passcard to boot DS roms from Slot-2 flashcarts anymore. The standard version of FlashMe removes the DS intro screen (including the Warning screen) when booting up. This method also allows for a scrapped DS Lite AV/Out feature to be used again with a Hardmod^[53]

The Nintendo DSi made it easier to softmod the console with the introduction of an SD card slot. The easiest method method was the Memory Pit exploit released in 2019. When the camera application is used to take a photo, it creates a file called pit.bin to store metadata information. This file is always located at sd:/private/ds/app/484E494A on the SD card.^[54] By modifying this file, a buffer overflow is created, crashing the system.^[55] External tools like Unlaunch write directly to the NAND storage of the DSi and creates a cold-boot scenario (i.e. the console can directly launch into the custom firmware without having to use other apps). Custom UI environments have been created, most notably TWiLight Menu++ which facilitates other programs like nds-bootstrap to launch homebrew software.

All models of Nintendo 3DS (and its Nintendo 2DS sibling) can be softmodded, including the 'New' refresh models. Softmods work up to and including the latest firmware revisions. Since the closure of the Nintendo eShop for the 2DS/3DS in 2023, softmodding has become popular in order to reinstate features that are now officially defunct.

In August 2013, the first flash cartridge for the 3DS was released, dubbed Gateway.^[56] It allowed running game backups, partially defeating some security of the 3DS.

In August 2015, the first public CFW (custom firmware) ReiNAND was released.^[57] It allowed for homebrew, NAND redirection (EmuNAND), and running game backups.

In April 2016, an exploit called arm9loaderhax was released.^[58] This resulted in early code execution, and allowed for CFW installs.

In May 2017, an exploit called boot9strap was released.^[59] This resulted in even earlier code execution than the arm9loaderhax exploit, and as a result allowed for more control of the system.

The most supported 3DS custom firmware is known as Luma3DS, based on ReiNAND but with many improvements. It contains features such as running non-system menu payloads on boot, installing homebrew titles to the main menu, bypassing region checks, and overclocking the CPU/GPU.

Early versions of the Nintendo Switch known as "V1 Unpatched" are vulnerable to a ReCovery Mode (RCM) hardware exploit^[60] by holding the Volume Up button, Power button, and Tegra home button (not usually accessible to consumers), which boots the device into RCM, then connecting via USB to another device which is able to push payloads. Tegra refers to the chip the Nintendo Switch uses, the Tegra X1. This was an oversight as RCM was intended to be used by Nintendo to service consoles and not the consumer themselves. It was discovered the Tegra home button could be emulated by shorting pin 10 on the right Joy-Con rail, initializing RCM. Once in this mode, an additional exploit in the Switch USB drivers can be leveraged to push payloads via USB to a Switch while in RCM to execute unsigned code, such as install CFW (custom firmware). The RCM exploit is hardware based and cannot be patched by software fixes. Later revisions of the Tegra X1 had the RCM exploit patched.

Some firmware revisions have had a limited number of softmods emerge, although if updated the exploits will have been patched.

The softmods allow running homebrew, installing CFW (RCM exploit), bypassing region checks, loading game backups, and changing fan and CPU/GPU speeds. With the RCM exploit it is also possible to install an Android distribution as an additional boot option, in which the device becomes much more versatile for cross platform play (such as the Xbox Game Pass), allowing games from other platforms to be played. The Joy-Con are fully functional in an Android environment, making it a strong competitor for tablet gaming.

The most supported Nintendo Switch CFW is Atmosphère.^[61]

Nintendo has put safeguards in place where if a console tries to connect to a Nintendo server with an unauthorized copy of a game installed, the device may eventually be banned after sending telemetry data to Nintendo servers.^[62] This ban is permanent and tied to the console itself, blocking access to most online features.^[63]

In December 2023, a group of hackers unveiled the first flash cartridge for the Switch, dubbed the Mig Switch.^[64] The cartridge accepts a microSD card that contains game backups, and the user can alternate between the loaded game by re-inserting the cartridge. If the user uses online features of a backed-up game at the same time the original cartridge is used online, Nintendo may ban the console from online functions.^[65] The Mig Switch currently works on all models and firmware of the original Switch.

The Mig Flash flash cartridge (previously known as Mig Switch) is compatible with the Nintendo Switch 2 for playing Switch 1 games. Nintendo have banned consoles from online functions if they detect the Mig Flash.^[66]

Some DVD drives, such as those made by Lite-on, can be softmodded to ignore region coding, allow clearing of the drive's learned media calibration data, and enable DVD+R to DVD-ROM book type coding that is persistent across reboots. This is distinct from cross-flashing the drive or installing unofficial firmware, and does not modify the drive's firmware.^[67]