CheatSpecter

A real-time modding tool for jailbroken PS5 consoles that runs in a web browser. Open it on a Mac, Windows or Linux machine, or on your phone, and it talks to the ps5debug-NG payload running on the console.

For single-player games you own. There is nothing here for online play.

What it does

For people who just want cheats:

• Find the console. Consoles running the debugger are discovered on the network; no IP typing unless discovery is blocked.
• See what is running. Name, icon, title ID and version of the game on screen.
• Your game library. Every installed game with its platform (PS5 or PS4) and size, and a Start button that boots it from the page.
• Cheats as switches. Matching cheat tables are looked up online for the running game and shown as toggles. Before a cheat is switched on, the bytes in the game's memory are compared with what the table expects; a cheat for the wrong build is left off instead of corrupting the game.
• Import table files: CheatSpecter's own .cspector format and the community JSON, SHN and MC4 formats.
• Save your own cheats to the PS5 or to the device you are on. On the PS5 they are kept as /data/cheatspecter/cheats/<title id>-<version>.cspector and load by themselves whenever that game is running, from any device.

The library, game names and icons, starting games and saving to the PS5 need the CheatSpecter payload on the console (payload/cheatspecter.elf), because the debugger cannot do those things. Everything else works with ps5debug-NG alone.

For people who make them:

• Find a value, known or unknown ("a bar with no number"), narrow it down as it changes, edit it, hold it. "Auto" searches the common number types at once when you do not know how the game stores it.
• Find what writes to it. A hardware watchpoint lists the instructions that touch a value, and one click turns "the instruction that lowers my ammo" into a saved cheat.
• Memory view: live hex, the selected bytes read as every number type, follow pointers, write values or raw bytes.
• Code view: disassembly, byte-pattern search, and per-instruction actions (disable it, hook it, follow a call, copy a signature).
• Make it survive restarts: a pointer-path search from the game's executable to a value on the heap.
• Your own table, with five kinds of entry: byte patches (located by signature so they survive game updates, and able to change several places under one switch), held values, injected assembly through a code cave, calls to the game's own functions, and scripts (JavaScript with a small API for reading, writing, calling and switching other entries). Export it to share, or as a GoldHEN table where the format allows.

The maker features need ps5debug-NG specifically; with the original ps5debug the table switches still work.

What has run on a real PS5 (firmware 13.60, ps5debug-NG 1.3.2): finding the running game, its name and icon, the game library, loading community tables, known-value searches, watchpoints, byte patches located by offset and by pattern, and saving and auto-loading .cspector files on the console.

Only tested against the built-in mock console so far: injected code, function calls, scripts, the pointer-path search, unknown-value searches, starting a game from the library, and PS4 titles.

Things that can crash a game

These come from how debugging a live process works, not from bugs to be fixed later. The app says so at the point of use; they are collected here.

• Tracing attaches a debugger to the game. If the browser tab is closed mid-trace, the console detaches without disarming the watchpoint and the game may die at the next hit. Press Stop first.
• Injected code is written while the game keeps running. Switch a hook on at a quiet moment. A hook replaces at least five bytes; if that spans several instructions and the game jumps into the middle of them, it crashes.
• Function calls borrow a game thread. The function must return within about two seconds, and one that returns -1 is retried by the console up to seven times.
• Scripts and imported entries that run code are held for review before first use. Read them. Only use tables from people you trust.

Run it

Double-click Start CheatSpecter.command (macOS) or Start CheatSpecter.bat (Windows). It installs on first run, starts the bridge and opens the browser. Needs Node.js 20.19 or newer.

From a terminal:

npm install
npm start          # real console
npm run demo       # adds a pretend PS5 so you can click around without one

Tracing ("what writes to this") makes the console connect back to this computer on TCP port 755, so the firewall has to let that in; macOS will ask the first time. npm run demo uses a different port and is for the pretend console only.

The start-up message lists the address to open from a phone on the same Wi-Fi.

On the PS5, load ps5debug-NG first (etaHEN can start it from its toolbox). It shows a "loaded" notification when ready.

How it fits together

 Browser (any device)            Computer                    PS5
┌──────────────────────┐   ┌──────────────────┐   ┌──────────────────────┐
│ web app              │   │ bridge/server.mjs│   │ ps5debug-NG          │
│  protocol client     │◄─►│  WebSocket ⇄ TCP │◄─►│  TCP 744             │
│  scanner, cheats     │ WS│  serves the app  │TCP│                      │
└──────────┬───────────┘   └──────────────────┘   └──────────────────────┘
           │ HTTPS
           ▼
   cheat table collections (GitHub)

Browsers cannot open raw TCP sockets, so something has to relay. There are two ways to run that relay, and the web app is identical in both:

• On a computer (bridge/server.mjs), as drawn above. This is what the launcher starts, and what has been exercised most.
• On the console itself (payload/). A small ELF serves the app and relays to the debugger locally, so nothing is installed anywhere and any device just opens http://<PS5 IP>:8744. See payload/README.md.

Cheat tables are fetched by the browser, so the console itself never needs internet access.

Path	What it is
src/lib/ps5debug.ts	The debugger's wire protocol
src/lib/scanner.ts	Known-value, unknown-value and Auto scans
mcp/server.ts	The same library as MCP tools for Claude
src/lib/cheats.ts	Community cheat tables: parsing, state detection, applying
src/lib/table.ts	CheatSpecter's own table format and the runner that applies it
src/lib/locations.ts	Signatures, offsets and pointer paths, resolved to addresses
src/lib/tracer.ts	"What writes to this address"
src/lib/pointerscan.ts	Pointer-path search
src/lib/script.ts	The script API and its sandbox
src/lib/x86.ts	Disassembly, relocation and signatures (iced-x86, in a worker)
src/lib/catalog.ts	Online table lookup and offline cache
src/ui/	The interface (React, Tailwind)
src/components/	shadcn/ui and Kibo UI components, added with the shadcn CLI
bridge/server.mjs	WebSocket-to-TCP relay, discovery, static files
payload/	The on-console ELF: the same relay in C, with the app embedded
mock/mock-ps5.mjs	Pretend console with a tiny simulated game
cheats/	Drop table files here to have them offered alongside the online ones
test/	End-to-end tests: client → bridge → mock

Development

npm run dev        # Vite with hot reload + bridge + demo console
npm test           # needs Node 22.18+ (the tests import the TypeScript directly)
npm run typecheck

Where cheat tables come from

Tables are read at runtime from these community collections, in their original location. Nothing from them is copied into this repository.

• etaHEN PS5 Cheats
• GoldHEN Cheat Repository
• HEN Cheats Collection

All three formats they publish are read: JSON, SHN and MC4. When a repository has the same table in several formats, the JSON one is used.

Using it from Claude (MCP)

npm run mcp builds mcp/cheatspecter-<version>.mcpb, a desktop extension for the Claude app. Open the file to install it and enter the PS5's address when asked. Claude then has tools to see what is running, search and read memory, find the code that changes a value, disassemble, and save cheats to the same .cspector file the web app loads. It runs on your computer and talks to the payload on the console; nothing is installed on the PS5.

To run it by hand instead: CHEATSPECTER_HOST=<ps5 address> node mcp/build/server/index.mjs speaks MCP over stdin/stdout.

The .cspector format

A .cspector file is minified JSON:

{"format":"cheatspecter","formatVersion":1,
 "game":{"name":"…","titleId":"PPSA07391","version":"01.009.000"},
 "cheats":[{"name":"Infinite ammo","type":"patch","at":{"kind":"module","offset":"0x2040"},"on":"909090","off":"FF4B28"}]}

type is one of patch, value, inject, call or script. A patch can carry "more": [{"at": …, "on": "…", "off": "…"}] for further places changed by the same switch. A formatted copy loads the same as a minified one.

Safety notes

• The bridge only relays to private network addresses on the debugger's port, and only accepts WebSocket connections from the page it served.
• Anyone on your network can reach the debugger directly on port 744 anyway; the bridge does not make that better or worse. Use a network you trust.

License

GPL-3.0-only, matching ps5debug-NG, whose protocol this implements and whose handler logic the mock console follows.