Remote Lua Loader for PS4 and PS5 Exploit Research

Remote Lua Loader is a PlayStation 4 and PlayStation 5 research tool that exploits a vulnerability in games built with the Artemis game engine. Since these games support Lua scripting, the loader can use modified save files to execute custom Lua scripts, providing researchers with a potential entry point for further console security research.

The project focuses on loading Lua scripts onto compatible consoles over a network. Although its current capabilities are limited to Lua execution, the technique may help researchers investigate additional vulnerabilities and exploit development opportunities. It does not, by itself, provide a kernel exploit or guarantee privileged access to the console.

Key Features of Remote Lua Loader

• Firmware compatibility: The project is designed to avoid reliance on a single specific firmware version. Actual compatibility depends on the console, game version, and exploit conditions.
• Supported games: Listed titles include Raspberry Cube, Aibeya, Hamidashi Creative, Hamidashi Creative Demo, Aikagi Kimi to Issho ni Pack, and Aikagi 2.
• Network-based script loading: Users can send Lua scripts to a compatible console over the network for execution through the loader.
• Modified save-file technique: The exploit relies on preparing a specially crafted save file that triggers the Lua-loading mechanism when a supported game starts.
• Exploit research potential: The project provides a starting point for studying game-engine behavior, console vulnerabilities, and possible follow-on exploit techniques.

How Remote Lua Loader Works

The loader uses the way supported Artemis engine games process save data and Lua scripts. A modified save file is prepared for a compatible title, allowing the game to load a custom Lua script during startup. Once the setup is complete, scripts can be delivered over the network and executed through the loader.

This approach demonstrates how a vulnerability in a game can become a research entry point for examining the wider console environment. However, Lua-level code execution should not be confused with kernel-level access. Further vulnerabilities and additional exploit development would be required to reach more privileged system components.

Setup and Requirements

The project repository contains the setup instructions, supported-game details, and required preparation steps. Before attempting to use the tool, review the official documentation and confirm that the selected game and console configuration are compatible.

1. Open the Remote Lua Loader GitHub repository.
2. Read the SETUP.md documentation for the current requirements and installation procedure.
3. Prepare the save data according to the repository instructions for a supported game.
4. Configure the network connection and Lua-loading process as documented by the project.
5. Test only with consoles and game copies you own or are explicitly authorized to examine.

For related security research, explore this guide to digital forensics tools, which covers utilities used to investigate and analyze digital systems.

Contributors and Community Research

Remote Lua Loader builds on work shared by several members of the console research community. Gezine initially identified the vulnerability and shared the concept. Flatz contributed ideas and Lua implementations, while Null_ptr helped with testing and development discussions. Specter and Chendo provided insights from their WebKit implementations, and Al-azif shared SDK components and information related to FTP server functionality.

These contributions illustrate how collaborative vulnerability research can help researchers understand undocumented behavior and develop experimental tools. The project’s future capabilities depend on further investigation, testing, and the discovery of additional weaknesses.

Limitations and Security Considerations

Remote Lua Loader currently focuses on executing Lua scripts through supported games. Compatibility can vary with game updates, save-file formats, and console configurations. Researchers should consult the repository for the latest supported titles and known limitations rather than assuming universal PS4 or PS5 compatibility.

Use the tool only for authorized research and avoid running untrusted scripts. Arbitrary code execution can affect game data and system behavior, while modifying save files may cause data loss. Any future kernel-level exploitation remains a research possibility, not a capability guaranteed by the loader.