[PS5 Scene] Installing PKG Files on PlayStation 5 Consoles via Sony’s API – A Step-by-Step Tutorial Explains How to Create Your Own Server for Sending PKG Files

By /

Developer LightingMods has not only officially released the updates for etaHEN and Itemzflow , but has also published an in-depth article that explains in detail the installation procedure for the PKG files.

The document begins with an introduction that refers to the work of Flatz , who years ago published a guide for installing packages (PKG) on PlayStation 4 using the BGFT (Background File Transfer) system.

https://platform.twitter.com/embed/Tweet.html?creatorScreenName=Checcolin80&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOltdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2ZvbGxvd2VyX2NvdW50X3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9iYWNrZW5kIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19yZWZzcmNfc2Vzc2lvbiI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfZm9zbnJfc29mdF9pbnRlcnZlbnRpb25zX2VuYWJsZWQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X21peGVkX21lZGlhXzE1ODk3Ijp7ImJ1Y2tldCI6InRyZWF0bWVudCIsInZlcnNpb24iOm51bGx9LCJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3Nob3dfYmlyZHdhdGNoX3Bpdm90c19lbmFibGVkIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdXNlX3Byb2ZpbGVfaW1hZ2Vfc2hhcGVfZW5hYmxlZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfbGVnYWN5X3RpbWVsaW5lX3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1905746173874655395&lang=it&origin=https%3A%2F%2Fwww.biteyourconsole.net%2F2025%2F03%2F29%2Fscena-ps5-installare-file-pkg-su-console-playstation-5-tramite-lapi-di-sony-un-tutorial-passo-dopo-passo-spiega-come-creare-il-proprio-server-per-linvio-di-file-pkg%2F&sessionId=1e6a0efd2a539fd8f461e2a9454b556f3d879af5&siteScreenName=BiteYourConsole&theme=light&widgetsVersion=2615f7e52b7e0%3A1702314776716&width=550px

However, this method is no longer valid for PlayStation 5 consoles . Hence the new procedure, which takes up and updates the work of Flatz , offering a specific guide for the new generation console.

Prerequisites

To implement this new solution, there are a few key requirements. The first is a privilege escalation method, or a way to gain elevated permissions on the PlayStation 5 system .

One possibility is to change the Auth ID within the ucred structure to that of ShellCore ( ), the core component of the PlayStation 50x3800000000000010 system interface .

Alternatively, for FPKG packages (modified files for homebrew), you can use the IPC jailbreak command provided by etaHEN , an AIO payload for the PlayStation 5 .

For integrated solutions, instead, you can take advantage of automatic privilege management via the etaHEN plugin system or the ps5-payload-dev SDK .

Additionally, you need to load and initialize the system module libSceAppInstUtil.sprx, which is located in /system/common/lib/.

This module is automatically handled if you develop plugins for etaHEN or ELF executables with the correct SDK, as long as the library link is configured appropriately.

Step 1: Identify the problem

The first step is to understand why the old Flatz BGFT method no longer works. All function calls return the error sceBgftServiceIntDownloadRegisterTaskBy*0x80990006( SCE_BGFT_ERROR_NOT_SUPPORTED) , even with proper initialization and a valid Auth ID.

Analyzing BGFT IPC calls inside ShellCore, it turns out that this error is not a bug, but an intentional choice by Sony: the PlayStation 5 console no longer supports the BGFT system for installing packages, making it necessary to find an alternative.

An example of code is shown (the FUN_0100ee70e function DownloadRegisterTaskByStorageEx) which highlights how the system always returns this error, confirming that BGFT has been abandoned.

uint  FUN_0100ee70 (Session *session, int user_id, int entitlement_type, char *id, char *package_type,
                  char *package_sub_type, char *content_url, char *content_name, char *icon_path,
                  char *sku_id, char *playgo_scenario_id, char *release_date, size_t package_size,
                  bgft_task_option_t options, uint slot, void *result) {

  undefined auVar1 [ 32 ];
   long lVar2;
   pid_t pid;
   uint uVar3;
   uint uVar4;
  bgft_download_param args;
  
  lVar2 = __stack_chk_guard;
  if (session == NULL ) {
    uVar4 = 0x80990050 ;
  }
  else {
    pid = (*session-> _vptr -> getClientPid )(session);
    uVar3 = check_authid (pid);
    uVar4 = 0x80990007 ;
     if (uVar3 == 1 ) {
      args. _60_4_ = 0 ;
      args. content_url = content_url;
      auVar1. _8_8_ = icon_path;
      auVar1. _0_8_ = content_name;
      auVar1. _16_8_ = sku_id;
      auVar1. _24_8_ = 0 ;
      args. _24_32_ = auVar1 << 0x40 ;
      args. options = options;
      args. playgo_scenario_id = playgo_scenario_id;
      args. release_date = release_date;
      args. package_size = package_size;
      args. user_id = user_id;
      args. entitlement_type = entitlement_type;
      args. id = id;
      args. package_type = package_type;
      args. package_sub_type = package_sub_type;
      uVar4 = DownloadRegisterTaskByStorageEx (&args,result);
    }
  }
  if (__stack_chk_guard == lVar2) {
     return uVar4;
  }

  __stack_chk_fail ();
}

uint  DownloadRegisterTaskByStorageEx (bgft_download_param *param_1, void *param_2) {
   printf ( " [BGFT] ERROR: [%d] " , 0x18 );
   puts ( " NOT SUPPORTED API " );
   return  0x80990006 ;
}

Step 2: Find the new function to install PKGs

With the BGFT method out of the way, LightningMods decides to focus on the PlayStation 5 ‘s system user interface , called ShellUI , which handles features like the Debug Settings menu, including the Package Installer service.

By reverse engineering ShellUI , using tools like DnSpy to analyze Mono Modules (a framework Sony uses for its interface), it turns out that the PS5 uses an implementation called UI3 Settings , an evolution of the UI (early PS4) and UI2 (later PS4) versions.

Within this structure, the key functions for installing PKGs are identified: ExecuteInstalland OnUpdate, along with their associated data structures ( mTargetListfor the package queue and mInstallIndexfor identifying the target package).

However, these functions cannot be called directly via standard mono methods, requiring an alternative approach. The provided C# code shows how ExecuteInstallto start the installation and OnUpdatemonitor the status, using the AppInstUtilWrapper.

private  Task < int >  ExecuteInstall ( ) 
{ 
	return  Task . Run < int > ( delegate ( ) 
	{ 
		this . Lock ( ) ; 
		AppInstUtilWrapper . SceAppInstallPkgInfo  sceAppInstallPkgInfo  =  default ( AppInstUtilWrapper . SceAppInstallPkgInfo ) ; 
		string [ ]  array  =  new  string [ 30 ] ; 
		string [ ]  array2  =  new  string [ 64 ] ; 
		string [ ]  array3  =  new  string [ 64 ] ; 
		for  ( int  i  =  0 ;  i  <  array ; i ++ ) { array [ i ] = " " ;​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​AppInstUtilWrapper . AppInstUtilInstallByPackage ( this . mTargetList [ this . mInstallIndex ] , "" , "" , "" , "" , "" , 0U , false , ref sceAppInstallPkgInfo , array , array2 , array3 ) ; 
		
			  
		
		        
		
			  
		
		        
		
			  
		
		               
		if  ( num  ==  0 ) 
		{ 
			this . mTimer  =  new  UITimer ( 0.1f ,  true ) ; 
			UITimer  uitimer  =  this . mTimer ; 
			uitimer . Executed  =  ( UITimer . ExecutedHandler ) Delegate . Combine ( uitimer . Executed ,  new  UITimer . ExecutedHandler ( this . OnUpdate ) ) ; 
			this . mTimer . Start ( ) ; 
		} 
		else 
		{ 
			this . Unlock ( ) ; 
		} 
		return  num ; 
	} ) ; 
}

private  bool  OnUpdate ( ) 
{ 
	ShellCoreUtilWrapper . sceShellCoreUtilResetAutoPowerDownTimer ( ) ; 
	AppInstUtilWrapper . SceAppInstallStatusInstalled  sceAppInstallStatusInstalled  =  default ( AppInstUtilWrapper . SceAppInstallStatusInstalled ) ; 
	int  num  =  AppInstUtilWrapper . AppInstUtilGetInstallStatus ( this . mContentId ,  ref  sceAppInstallStatusInstalled ) ; 
	if  ( num  ==  0 ) 
	{ 
		if  ( sceAppInstallStatusInstalled . total_size  !=  0UL ) 
		{ 
			this . mProgressBar . Progress  =  sceAppInstallStatusInstalled . downloaded_size  /  sceAppInstallStatusInstalled . total_size ; 
		} 
		if  ( sceAppInstallStatusInstalled . status  ==  "playable"  ||  sceAppInstallStatusInstalled . status  ==  "error"  ||  sceAppInstallStatusInstalled . status  ==  "none" ) 
		{ 
			this . Unlock ( ) ; 
			this . mTimer . Stop ( ) ; 
			if  ( sceAppInstallStatusInstalled . status  ==  "error"  ||  sceAppInstallStatusInstalled . status  ==  "none" ) 
			{ 
				int  error_code  =  sceAppInstallStatusInstalled . error_info . error_code ; 
				this . ShowError ( error_code ) ; 
				return  false ; 
			} 
			this . Next ( ) ; 
		} 
		return  false ; 
	} 
	this . Unlock ( ) ; 
	this . mTimer. Stop ( ) ; 
	this . ShowErrorDialog ( num ) ; 
	return  false ; 
}

Step 3: Using sceAppInstUtilInstallByPackage in C/C++

To move from mono code to native C/C++ code, additional reverse engineering work is required, since directly replicating mono definitions leads to the SCE_APP_INSTALLER_ERROR_PARAM.

This error arises from a parameter mismatch, as mono wrappers handle transformations that are not obvious in high-level code.

By decompiling the underlying native implementation, LightningMods discovers the true structure of the parameters required by sceAppInstUtilInstallByPackage, which differs significantly from the managed versions, especially in memory management and parameter passing.

A decompiled function ( UndefinedFunction_001b8aa0) is shown, revealing how the native function accepts three structures: MetaInfo (with information like URI and content name), SceAppInstallPkgInfo (details about the package), and PlayGoInfo (additional data like languages ​​and IDs).

It also turns out that the uri parameter supports both local paths (e.g. /data/test.pkg) and remote URLs (e.g. http://127.0.0.1/test.pkg ), offering flexibility similar to update management on the PS4.

Step 4: Using sceAppInstUtilGetInstallStatus in C/C++

The feature sceAppInstUtilGetInstallStatusis then explained as a tool to monitor the installation status.

This function is similar to its C# counterpart and requires a native structure SceAppInstallStatusInstalled, which includes details such as download percentage, status (e.g. “playable” or “error”), and error information.

content_idLightningMods then decides to convert the managed structures into C/C++ equivalents with proper alignment, allowing you to track the installation progress using the package’s content ID ( ).

This step is essential for creating custom interfaces with progress bars and error handling.

Step 5: Combine functions to replace BGFT

Finally, the author describes how to integrate sceAppInstUtilInstallByPackageand sceAppInstUtilGetInstallStatusreplicate the functionality of BGFT .

The process starts with the initialization of the module libSceAppInstUtil.sprxvia sceAppInstUtilInitialize, a mandatory step to avoid crashes.

Then, you start the installation with sceAppInstUtilInstallByPackage, which runs asynchronously, and monitor the progress with sceAppInstUtilGetInstallStatusin a loop. This allows you to track the progress (percentage completed), detect errors, and know when the installation is completed successfully.

A C code example is provided showing the entire flow, from initialization to installation of a PKG file, with logs to track the results.

int ret = sceAppInstUtilInitialize();
 if (ret){
    printf ( " sceAppInstUtilInitialize failed: 0x%08X \n " , ret);
    return - 1 ;
}

PlayGoInfo arg3;
SceAppInstallPkgInfo pkg_info;
( void )memset(&arg3, 0 , sizeof (arg3));

for ( size_t i = 0 ; i < NUM_LANGUAGES; i++) {
     strncpy (arg3. languages ​​[i], " " , sizeof (arg3. languages ​​[i]) - 1 );
}

for ( size_t i = 0 ; i < NUM_IDS; i++) {
      strncpy (arg3. playgo_scenario_ids [i], " " ,
                 sizeof ( playgo_scenario_id_t ) - 1 );
      strncpy (*arg3. content_ids , " " , sizeof ( content_id_t ) - 1 );
}

MetaInfo in = {
    . uri = " /path/to/pkg.pkg " ,
    . ex_uri = " " ,
    . playgo_scenario_id = " " ,
    . content_id = " " ,
    . content_name = " PKG TITLE " ,
    . icon_url = " "
};

int num = sceAppInstUtilInstallByPackage(&in, &pkg_info, &arg3);
 if (num == 0 ) {
     puts ( " Download and Install console Task initiated " );
} else {
     printf ( " DPI: Install failed with error code %d \n " , num);
}
float prog = 0 ;
SceAppInstallStatusInstalled status;

while (strcmp(status.status, " playable " ) != 0 ) {
     sceAppInstUtilGetInstallStatus (pkg_info. content_id , &status);
    
    if (status. total_size != 0 ) {
        prog = (( float )status. downloaded_size / status. total_size ) * 100 . 0f ;
    }

    printf ( " DPI: Status: %s | error: %d | progress %.2f%% (%llu/%llu) \n " ,
               status. status , status. error_info . error_code ,
               prog, status. downloaded_size , status. total_size );
}

Extra

The writeup also includes a list of error codes ( AppInstErrorCodes) that may occur during installation, such as lack of space ( SCE_APP_INSTALLER_ERROR_NOSPACE) or incorrect parameters ( SCE_APP_INSTALLER_ERROR_PARAM) .

Source: x.com

Dịch Vụ Chép Game Tại TP.HCM – Hỗ Trợ Tất Cả Quận

Chép Game Ổ Cứng Ngoài Giá Rẻ – Hỗ Trợ PS, Xbox, Nintendo, PC

Dịch Vụ Chép Game PSP Giá Rẻ – Game Việt Hóa Cập Nhật Mới Nhất

Dịch Vụ Chép Game PSVITA Giá Rẻ – Game Việt Hóa Cập Nhật Mới Nhất

Dịch Vụ Chép Game PS2 Giá Rẻ – Game Việt Hóa Cập Nhật Mới Nhất

Dịch Vụ Chép Game NINTENDO SWITCH Giá Rẻ – Game Việt Hóa Cập Nhật Mới Nhất

Dịch Vụ Chép Game PS5 Giá Rẻ – Game Việt Hóa Cập Nhật Mới Nhất

Dịch Vụ Chép Game XBOX 360 Giá Rẻ – Game Việt Hóa Cập Nhật Mới Nhất

Dịch Vụ Chép Game PS3 Giá Rẻ – Game Việt Hóa Cập Nhật Mới Nhất

Dịch Vụ Chép Game PS4 Giá Rẻ – Game Việt Hóa Cập Nhật Mới Nhất

Dịch Vụ Chép Game PC Giá Rẻ – Game Việt Hóa Cập Nhật Mới Nhất

Leave a Comment

Email của bạn sẽ không được hiển thị công khai. Các trường bắt buộc được đánh dấu *

0
    0
    Chọn game
    Giỏ game trốngTrở lại trang
    Liên hệ zalo : 0987929209
    Thêm game
    Scroll to Top