A softmod is a method of using software to modify the intended behavior of hardware, such as video cards, sound cards, or game consoles in a way that can overcome restrictions of the firmware, or install custom firmware.[1]
Video cards that can be modified using software to faster versions (without regard to clock speed) usually contain mostly the same hardware. Softmodding a card should not include changing the video card's BIOS, as that is a BIOS flash.[citation needed] Currently only four softmods are known,[citation needed] a Radeon 9500 NP to a 9500 Pro (128 bit) or 9700 (256 bit), a Radeon 9800SE (with 256-bit L-shaped memory layout on the PCB) to a Radeon 9800 Pro, a GeForce 6200 to a 6600, and a GeForce 6800NU to a 6800GT. The act of a softmod usually enables pixel rendering pipelines, though may also include other enhancements. A softmodded card may not always reach the same performance as the real card it has been changed to, but the difference should be very little; and generally not noticeable. The softmodding is not guaranteed to always work; sometimes the pipelines have been disabled for a reason, e.g., a defect that produces artifacts when enabled.
Softmods for Xbox used to include a font exploit installed through exploits in savegame code for MechAssault, Splinter Cell, 007: Agent Under Fire, and Tony Hawk's Pro Skater 4. Usage of the Splinter Cell or Tony Hawk's Pro Skater 4 disc is generally recommended as any version of the game will run the exploit, whereas certain production runs of Mechassault and Agent Under Fire are needed to use the exploit. Originally, via a piece of software called "MechInstaller" created by members of the Xbox-linux team, an additional option could be added to the Xbox Dashboard for booting Linux. The Font-hack works by exploiting a buffer underflow in the Xbox font loader which is part of the dashboard. Unfortunately, since the Xbox requires the clock to be valid and the dashboard itself is where you set the clock there is problem if the RTC backup capacitor discharges. The Xbox will detect that the clock isn't set and therefore force the dashboard to be loaded which then promptly reboots due to the buffer overflow exploit. Upon restarting, the Xbox detects the clock is invalid and the process repeats. This became known as the infamous "clockloop".[2]
There is no whole-system (that will allow full root access and installing homebrew) softmod for Xbox 360 consoles. However, ways were found to modify the firmware of the DVD drive of the console. This allows the system to play games from "backup" (non-original) game discs. This requires opening of the console but no additional hardware such as a modchip is permanently installed into the system. Microsoft responded by introducing console ban system. If the data stream from the DVD drive indicated signs of unauthorized use, Microsoft would permanently ban the console from using Xbox Live service. The ban never expires and can only be fixed by purchasing another console. Other measures, such as introducing new hardware revisions to prevent modifications and checking/updating the drive firmware during dashboard updates, have been made too.
Much like the Xbox, it is possible to softmod almost any PSP. Using various exploits (such as the TIFF exploit or specially crafted savegames from games such as Grand Theft Auto: Liberty City Stories, Lumines, and later GripShift) or original unprotected firmware, the user can run a modified version of the PSPs updater, that will install custom firmware. This newer firmware allows the booting of ISOs, as well as running unauthorized (homebrew) code. A popular way of running homebrew code to softmod the PSP is by using the Infinity method.
Wii softmodding is also closely related to the methods used to softmod Xboxes and PSPs. The first known method of loading unsigned code on a Wii (without a hardware mod) is known as the Twilight hack. This allowed users to run unsigned .dol/.elf files. The exploit was superseded by the development of Bannerbomb, which allows a user to run unsigned code on the console without relying on an exploit within a game. Bannerbomb works by using a malformed banner to inject a loader program into the Wii Menu program in memory. As the Wii Menu crashes, an unsigned executable is executed. Bannerbomb was superseded by Letterbomb, which uses a glitch in the Wii Message Board to crash the Wii Menu and load the .dol/elf file, allowing the user to install the Homebrew Channel.
These types of exploits have enabled the development and use of third-party homebrew applications, such as the Homebrew Channel, third-party games, media players, and many others. It can also be used to launch game backups, and opened the door to videogame copyright infringement. The Wii homebrew community generally discourages the use of the term "softmod" to refer to Wii homebrew in general, as it is considered to have negative connotations due to its association with copyright violation. As hardware modifications do not help the use of third-party software due to the console's security architecture, software modification is implied whenever homebrew software is in use. The term is therefore used to refer to software modifications that perform the same function as existing hardware modifications, that is, those that enable the use of copied games.
The Wii U can be softmodded with various exploits. As of February 2024 the easiest way to softmod a Wii U is by using the DNSpresso exploit which leverages several bugs in the network stack, and achieves kernel access, in addition to having a specially crafted SD card inserted. This works on the latest firmware revisions. This in turn can be used to install CFW (custom firmware). Currently the most supported CFW is Aroma. Other choices of CFW are Mocha, Haxchi, and Tiramasu.
Softmodding a Wii U allows users to run homebrew, load game backups, bypass region checks, and change fan and CPU/GPU speeds. Notably, the Wii U is backwards compatible with Wii games (vWii), however softmodding also unlocks backwards compatibility with GameCube games like its predecessor, as the hardware required to emulate is present on the motherboard - despite this, Nintendo did not implement GameCube disc reading for the Wii U, effectively disabling this backwards compatibility.
USB storage can be used to store games; this is the only way to store and play Wii U games outside of the internal memory. Wii and GameCube games can be played if stored on the specially crafted SD card used to softmod the Wii U, or if they are stored on USB storage.
Previously, a few Virtual DS games could be exploited with specially crafted savegames to install a permanent CFW which is active as soon as the console powers on. However, after the eShop closure this method is now impossible to do unless the game was downloaded pre closure.
The original PlayStation can be softmodded with the TonyHax exploit.[3] The exploit is compatible with all North American and European consoles except the launch model (SCPH-100x), but is not compatible with Japanese consoles. It is also compatible with early versions of the PlayStation 2 (SCPH-3900x or older), although only for booting PS1 discs. TonyHax can be booted either with a gamesave exploit (usually Tony Hawk's Pro Skater 2, 3, or 4, hence the name, but several other games are also supported), or except on the PS2, directly from a specially-flashed memory card. The exploit allows the console to boot homebrew, foreign-region games, and CD-R copies. Some PlayStation models are partially incompatible (slow load times, skipping audio and video) with phthalocyanine CD-Rs, preferring the older standard cyanine discs. TonyHax is not a permanent exploit; the drive is re-locked when the console is powered off or rebooted, requiring the user to re-load the exploit every time a CD-R or foreign game is booted.
An older method was to boot an original legitimate disc with the lid close sense button held down, quickly swap the disc with a CD-R copy or foreign disc, remove that disc and reinsert the original, and then swap for the CD-R or foreign disc again. This had to be carefully timed, and if done incorrectly could damage the drive or disc(s).
The PlayStation 2 has various methods of achieving a softmod.
Disc swapping was used early on to bypass the PlayStation 2 copy protection, by taking advantage of certain trigger discs such as 007: Agent Under Fire or Swap Magic, homebrew could be loaded. This was done by inserting the trigger disc, blocking the lid open sensor then hotswapping with a homebrew disc. Although difficult to execute correctly, the universality of the method was often used in order to softmod.
One of the earliest softmods developed - the Independence Exploit - allows the PlayStation 2 to run homebrew by exploiting a buffer overflow in the BIOS code responsible for loading original PlayStation games. This method, however, only works on models V10 and lower, excluding the PlayStation 2 slim, while still requiring a disc to be burned.[4]
FreeMcBoot is an exploit that works on all models except the SCPH-9000x series with BIOS v2.30 and up.[5] It requires no trigger disc and is able to directly load ELFs from the memory card.
Fortuna, Funtuna, and Opentuna are another form of memory card exploit. Unlike FreeMcBoot, they will work on the SCPH-9000x model, and they are compatible with third-party memory cards that do not support MagicGate.
HD Loader is an exploit for PS2 models with the hard drive peripheral.
FreeDVDBoot is an exploit discovered in 2020 that requires burning a disc image loaded with a payload onto a DVD-R. It is compatible with a range of PlayStation 2 models and works by exploiting a buffer overflow in the PS2's DVD video functionality.[6]
MechaPwn[7] is an exploit that permanently unlocks the DVD drive of the slim PS2 (and some later revisions of the fat PS2), allowing PS1 and PS2 discs from any region to be booted. PS1 CD-R copies can be booted directly from the PS2's built-in menu; PS2 CD-R/DVD-R copies require additional software to bypass the PlayStation 2 logo check.
The PlayStation 3 has a couple of methods to achieve a softmod. They rely on WebKit vulnerabilities in the PS3 Web Browser. All models of PS3 can be softmodded regardless of model.
Consoles that have factory installed (minimum firmware) of version 3.55 or less can be exploited to be flashed with custom firmware (unofficial firmware). This includes all "fat" and "slim" 20xx and 21xx models. Slim 25xx models may be exploitable, but only if their date code is 0D or less; sometimes date code 1A consoles may be on factory installed 3.55, however this should not be relied on. Slim 30xx and all "super slim" models cannot be exploited. These guidelines assume a console has not been taken to Sony to be serviced, as Sony may update the factory installed firmware. Custom firmware can be flashed using either a modchip or a WebKit exploit, which patches the current firmware and forces the console to "downgrade" which in ordinary circumstances would not be possible. Custom firmware grants complete control over the console, having access to LV0 (bootloader), LV1 (hypervisor), and LV2 (kernel). This allows users to run homebrew, load game backups, bypass region checks, change fan and CELL/RSX speeds, grant access to root keys, as well as run PS2 ISOs on unsupported backwards compatible models. Some custom firmware implementations reinstate features Sony removed such as "OtherOS".
Another popular softmod is PS3HEN. This softmod uses a WebKit exploit to install a signed file through the PS3 Web Browser, then uses another WebKit exploit as well as kernel exploit which grants LV2 kernel access when executed. As opposed to custom firmware, this is a tether softmod meaning PS3HEN has to be activated every time the console is powered on, however it supports all models of PS3 consoles. Users on official firmware 4.84 or later need to install hybrid firmware (another type of unofficial firmware), as Sony only removed the WebKit entry point but hybrid firmware reinstates it. This softmod shares a lot of custom firmware features - users can run homebrew, load backups of games, bypass region checks, and change fan speeds. The unofficial PS2 backwards compatibility is diminished as users can only run PS2 Classics encrypted PKGs instead of ISOs. The hypervisor is still intact and periodically checks if the current code being run is unsigned, there is a small chance if the current code is unsigned, it can lead to the console becoming unresponsive or shutting down, making it less stable than custom firmware.
The PlayStation 4 has ways to achieve a softmod. They rely on WebKit vulnerabilities in the PS4 Web Browser combined with a kernel exploit. All models of PS4 can be softmodded. They are all tether exploits meaning they have to be performed every time the console is powered on, although some exploits may be persisted using rest mode.
Softmodding a PS4 allows users to run homebrew, load game backups, bypass region checks, and change fan and CPU/GPU speeds. Some payloads can boot the PS4 into a Linux distribution, although this is not permanent and the console will revert to Orbis OS on reboot.
Notable firmware revisions that result in a softmod are: 1.76, 4.05, 4.74, 5.05/5.07, 6.72, 7.02, 7.55, 9.00, with 5.05/5.07 being the most stable and 9.00 the most stable after that. It is worth noting unlike the other exploits, the 9.00 exploit requires inserting a specially crafted USB flash drive into the console.
In February 2024, security researcher theflow announced[8] that he would present a new PS4 jailbreak proof of concept at TyphoonCon (a security conference) in May 2024. Moreover, the exploit used is unique in that it does not require a userland entry point (such as WebKit), implicating that firmware up to 11.00 is vulnerable.
The PlayStation 5 has ways to achieve a softmod. They rely on a userland exploit, which can be WebKit vulnerabilities in the PS5 Web Browser, or a specially crafted Blu-ray disc, or a PS4 savegame exploit, combined with a kernel (and possibly hypervisor) exploit; depending on the kernel exploit used, may also require a specially crafted USB flash drive. A HV (hypervisor) exploit has not been publicly disclosed, however there are userland and kernel exploit chains which operate within the constraints of the HV and XOM (execute only memory) being active that partially unlocks privileged parts of the system. Like the PS4, they are all tether exploits meaning they have to be performed every time the console is powered on, although some exploits may be persisted using rest mode.
Softmodding a PS5 allows users to run homebrew, load game backups, modify the PS4 backwards compatibility blacklist, run PS4 "FPKGs" (including PS4 homebrew and PS1/PS2/PS4 game backups), change fan speeds, and spoof firmware (which allows the install of games that require an update patch, and can also block updates). However, firmware spoofing will not allow games above the console's true firmware revision to load without the required update patch.
Compared to the previous generation console, a userland and kernel exploit would have been enough to accomplish what is generally regarded as a true jailbreak as the PS4 softmods work by patching the kernel, however the PS5 has added security measures in comparison to the PS4, mainly a HV and XOM which do not allow kernel patching without a hypervisor exploit, and also makes reverse engineering much more difficult. Despite this, several HENs (Homebrew ENablers) have been made that operate within the constraints of the HV and XOM to run unsigned code, even though the security of the PS5 has not been fully defeated.
The IPv6 kernel exploit (which led to the PS4 6.72 firmware jailbreak) was patched on the PS4 a few months prior to the release of the PS5, which was reintroduced on the PS5 with 3.00 firmware and affected up to 4.51 firmware. This is the most commonly used kernel exploit in order to softmod a PS5. The exFAT filesystem kernel exploit that affected PS4 firmware up to 9.00 also affected PS5 firmware up to 4.03.
Firmware 3.00 up to 4.51 is exploitable by a userland and kernel exploit chain. Currently, no publicly known chain compromises the hypervisor.
In June 2023, a payload[9] was disclosed potentially becoming a reliable method of running homebrew which works by creating a new, separate process by interacting with the PS5's Daemon, effectively acting as a background ELF loader. This is notable over previous ELF loaders such as the WebKit or Blu-ray methods since those ELF loaders were terminated when the corresponding process was stopped. Another advantage of this new method is that the newly separate process is not confined to the fixed maximum resource allocation of the WebKit or BD-J processes.
In July 2023, scene developer Flat_z disclosed[10] that they had read access to the PS5's Platform Secure Processor (PSP) which is one of the most protected parts of the system and contains crucial keys for decryption. In addition, they also confirmed they had successfully exploited the hypervisor via a PS4 save game exploit chain. Flat_z said he does not intend to disclose his findings publicly, however he is using these exploits to further reverse engineer the PS5 now that he is able to decrypt more parts of the system.
In November 2023, scene developer LightningMods disclosed[11] that they had managed to load and play a retail PS5 game backup.
In December 2023, scene developer LightningModz updated his Itemzflow homebrew app to support loading PS5 game backups.
The Nintendo 3DS (and its Nintendo 2DS sibling) have become some of the most popular console platforms to softmod, as the procedure requires only the 2DS/3DS itself, and modifying its microSD card. All models of 3DS and 2DS can be softmodded, including the 'New' refresh models. Since the closure of the Nintendo eShop for the 2DS/3DS, softmodding has become popular in order to reinstate features that are now officially defunct.
The most well developed and commonly used CFW (Custom Firmware) is known as Luma3DS. It contains features such as EmuNAND (NAND redirection), running non-system menu payloads on boot, and installing homebrew titles to the main menu. A popular homebrew app used for piracy, known as Freeshop,[12] was shut down by Nintendo with firmware 11.8 by requiring a title key authorization on the Eshop download servers, thus making all NUS downloaders[13] for the 2DS/3DS to no longer function.
Early versions of the Nintendo Switch known as "V1 Unpatched" are vulnerable to a Recovery Mode (RCM) hardware exploit by holding the Volume Up button, Power button, and a mystery button, which boots the device into RCM, then connecting by USB to another device which is able to push payloads. This was an oversight as RCM was intended to be used by Nintendo to service consoles and not the consumer themselves. It was discovered the mystery button could be emulated by shorting the pin on the right JoyCon rail, initializing Recovery Mode. Once in this mode, an additional flaw in the Switch USB drivers can be exploited to push payloads via USB to a Switch while in RCM. The RCM exploit is hardware based so any version of firmware on these "V1 Unpatched" is vulnerable.
Some firmware revisions have had a limited number of softmods emerge, although if updated the exploits will have been patched.
The softmods allow running homebrew, installing custom firmware (RCM exploit), bypass region checks, load game backups, and change fan and CPU/GPU speeds. With the RCM exploit it is also possible to install an Android distribution as an additional boot option, in which the device becomes much more versatile for cross platform play (such as the Xbox Game Pass), allowing games from other platforms to be played. The JoyCons are fully functional in an Android environment, making it a strong competitor for tablet gaming.
Nintendo has put safeguards in place where if a console tries to connect to a Nintendo server with a modified bootloader, or an unauthorised copy of a game is currently loaded, the device will be either bricked instantly, or eventually bricked after sending telemetry data to Nintendo servers. Once bricked, the console will be fingerprinted by Nintendo and will never be able to access a Nintendo server again, blocking access to the eShop, online play, amongst other features.
In December 2023, a group of hackers unveiled the first flash cartridge for the Switch, dubbed the Mig Switch. This cartridge accepts a microSD card that contains game backups, and the user can alternate between the loaded game by re-inserting the cartridge. It is not currently known if backup games loaded via the cartridge will risk the console being banned if the user is online. Mig Switch works on all models and firmware, partially defeating some of the security in order to play game backups, and also run homebrew.
Some DVD drives, such as those made by Lite-on, can be softmodded to ignore region coding, allow clearing of the drive's learned media calibration data, and enable DVD+R to DVD-ROM book type coding that is persistent across reboots. This is distinct from cross-flashing the drive or installing unofficial firmware, and does not modify the drive's firmware.[14]