PS4/PS5 Virtual Controller Bridge

Remote-control a jailbroken PS4 or PS5 from a desktop app, web browser, or BLE controller through an ESP32-WROOM-32U bridge.

Overview · Features · Architecture · Quick Start · Protocol Reference · Credits

Ghostpad is a payload + bridge + client system that creates a virtual DualSense-compatible controller on a jailbroken PS4 or PS5 and forwards controller input over the local network.

The console shell and games see the injected device as a real controller. Input can come from:

• the native Ghostpad Desktop GUI;
• the embedded ESP32 web controller;
• a physical BLE gamepad such as DualSense or DualShock 4;
• keyboard, gamepad, or browser-based controls, depending on the client.

Ghostpad is designed for local-network control, diagnostics, development, and controller redirection workflows.

Compatibility note
Ghostpad targets jailbroken PS4/PS5 environments. Firmware-specific byte patterns may require validation or updates through tools/vda_probe.

• Creates a virtual DualSense through the console virtual device API.
• Receives fixed-size GPAD input packets over TCP.
• Inserts controller reports into the virtual device stream.
• Supports runtime VDA patching for self and SceShellCore.
• Provides optional /dev/klog capture and TCP streaming.
• Supports MBus-based virtual/physical device binding.

• Runs on ESP32-WROOM-32U using ESP-IDF.
• Provides WiFi STA mode with AP fallback.
• Hosts an embedded web controller UI.
• Scans the subnet for PS4/PS5 services.
• Bridges GPAD input to the console over TCP.
• Scans, classifies, and connects to BLE HID controllers.
• Supports TinyUSB HID output for direct USB HID use cases.
• Streams klog data to dashboard clients through WebSocket.

• Native C++17 cross-platform client (GLFW + OpenGL + Dear ImGui).
• Virtual controller UI with real-time gamepad visualizer.
• Keyboard and native gamepad input mappings.
• Advanced macro engine (recording, playback, and customization).
• Integrated console manager with network scanning and auto-deploy workflow.
• Console system actions (reboot, shutdown, rest mode, and disc eject).
• Dedicated diagnostic and testing views (Beeper control, project/profile stores).
• High performance, low latency, and lightweight resource footprint.

                                      TCP 6967
                               GPAD controller input
  ┌─────────────────┐      ───────────────────────────►     ┌─────────────────────┐
  │  Desktop App    │                                       │  PS4 / PS5 Console  │
  │  C++ / ImGui    │      ◄──────── TCP 3434 ────────────  │  ghostpad.elf       │
  └─────────────────┘             klog stream               └──────────┬──────────┘
                                                                       │
                                                                       │
                                                                       ▼
                                                                Virtual DualSense
                                                                via VDA / VDI

  ┌─────────────────┐
  │  Browser UI     │
  │  Web Controller │
  └────────┬────────┘
           ▲
           │ WiFi
           ▼
  ┌─────────────────┐         TCP 6967          ┌─────────────────────┐
  │  ESP32 Bridge   │ ────────────────────────► │  PS4 / PS5 Console  │
  │  Web + BLE HID  │                           │  ghostpad.elf       │
  └────────┬────────┘                           └─────────────────────┘
           ▲
           │
           │ BLE
           ▼
  ┌─────────────────┐
  │  BLE Gamepad    │
  │  DS5 / DS4 etc. │
  └─────────────────┘

cd payload

make PS4_PAYLOAD_SDK=/path/to/ps4-payload-sdk

cd payload

make PS5_PAYLOAD_SDK=/path/to/ps5-payload-sdk

Deploy the generated ghostpad.elf to the console through the ELF loader, typically on port 9021.

cd esp32-ghostpad

cp sdkconfig.private.example sdkconfig.private.defaults
# Edit sdkconfig.private.defaults with your WiFi SSID and password.

source ~/esp/esp-idf/export.sh

idf.py set-target esp32
idf.py build
idf.py -p /dev/cu.usbmodemXXXX flash

After boot, the ESP32 bridge is available at:

http://ghostpad.local

If mDNS is unavailable, use the device IP shown by your router or serial monitor.

cd Ghostpad-native
cmake -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build --config Release

On macOS, this builds the application bundle (ghostpad-native.app). On Linux/macOS, you can run the executable from the build directory:

./build/ghostpad-native

Using Command Prompt or PowerShell, run:

cd Ghostpad-native
cmake -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build --config Release

This produces ghostpad-native.exe in build/ (or build/Release/).

First-time desktop workflow:

1. Start the ELF loader on the console.
2. Run the native Ghostpad GUI.
3. Add the console IP in the Consoles or Settings screen.
4. Click Deploy to load the payload.
5. Click Connect.

The embedded dashboard includes:

• Device Browser — scans the subnet and detects open Ghostpad-related ports.
• Virtual Controller — browser-based controller with keyboard and touch support.
• Klog Viewer — live klog stream through WebSocket.
• BLE Scanner — detects and classifies nearby controllers.
• Settings — WiFi, payload deployment, and firmware information.

The bridge can scan and classify common controllers, including:

• DualSense 0x054C:0x0CE6;
• DualShock 4 0x054C:0x09CC / 0x054C:0x05C4;
• Xbox, Nintendo, and 8BitDo-compatible HID devices.

BLE support includes:

• 30-second active scan window;
• classification scoring by model, appearance, and HID flags;
• DualSense report 0x01 decoding;
• DualShock 4 report 0x11 decoding;
• klog backlog replay for late-connecting dashboard clients.

• WiFi station mode.
• AP fallback: Ghostpad-ESP32 / ghostpad123.
• mDNS hostname: ghostpad.local.
• Subnet scanner with probes for ports 6967, 3434, 9021, and 9090.
• Multi-client klog broadcast.
• Private WiFi credentials stored in sdkconfig.private.defaults and excluded from Git.

Each input report is a fixed 16-byte packet.

Browser clients send JSON frames at approximately 30 Hz:

{
  "buttons": 0,
  "lx": 128,
  "ly": 128,
  "rx": 128,
  "ry": 128,
  "l2": 0,
  "r2": 0,
  "target_ip": "192.168.1.x",
  "seq": 1,
  "ts": 1717430000000
}

The ESP32 bridge returns periodic status frames:

{
  "event": "state",
  "connected": true,
  "tx": 1500,
  "err": 0
}

• ps4-payload-sdk or ps5-payload-sdk;
• LLVM toolchain;
• LLVM_CONFIG pointing to a compatible llvm-config, when required by your SDK setup.

• ESP-IDF v5.3+;
• ESP32-WROOM-32U board;
• USB serial adapter or native USB flashing path supported by your board.

• CMake 3.20+;
• C++17 compiler (GCC, Clang, or MSVC);
• Python 3 (required for automated asset embedding);
• GLFW/OpenGL development libraries (on Linux/Ubuntu, install libx11-dev libxrandr-dev libxinerama-dev libxcursor-dev libxi-dev libgl1-mesa-dev).

cd payload

LLVM_CONFIG=/opt/homebrew/opt/llvm/bin/llvm-config \
PS4_PAYLOAD_SDK=../external/ps4-payload-sdk \
make

Output:

payload/ghostpad.elf

cd payload

PS5_PAYLOAD_SDK=/opt/ps5-payload-sdk make

Output:

payload/ghostpad.elf

cd esp32-ghostpad

cp sdkconfig.private.example sdkconfig.private.defaults
# Edit sdkconfig.private.defaults.

source ~/esp/esp-idf/export.sh

idf.py set-target esp32
idf.py build
idf.py -p /dev/cu.usbmodemXXXX flash

cd Ghostpad-native
cmake -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build --config Release

tools/vda_probe is a diagnostic payload used to validate firmware-specific VDA assumptions.

It can:

• enumerate libScePad exports;
• identify the VDA dispatch function;
• sweep MBus symbols used by the binding flow;
• report instruction bytes for pattern matching in shellui_pad.c.

Build:

cd tools/vda_probe

make PS4_PAYLOAD_SDK=/path/to/sdk

Deploy vda_probe.elf and inspect the console klog output.

payload/
├── main.c
├── shellui_pad.c
├── shellui_pad.h
└── Makefile

esp32-ghostpad/
├── main/
│   ├── main.c
│   ├── wifi_ap.c
│   ├── wifi_ap.h
│   ├── web_server.c
│   ├── web_server.h
│   ├── web_gui.h
│   ├── ble_hid_host.c
│   ├── ble_hid_host.h
│   ├── hid_gamepad.c
│   ├── hid_gamepad.h
│   ├── klog_reader.c
│   ├── klog_reader.h
│   └── CMakeLists.txt
├── sdkconfig.defaults
├── sdkconfig.private.example
├── sdkconfig.private.defaults
└── CMakeLists.txt

Ghostpad-native/
└── C++17 + ImGui + GLFW cross-platform desktop client

tools/
└── vda_probe/
    └── vda_probe.c

git-patch/
└── Development patches

docs/
└── virtualDS5research.md

• Firmware-specific VDA patterns — unsupported firmware builds may require new scan patterns generated with vda_probe.
• Single virtual device — Ghostpad currently manages one virtual controller at a time.
• No haptics or rumble feedback — feedback from PS4/PS5 to the client is not currently forwarded.
• BLE-only controller relay on ESP32 — Bluetooth Classic / BR/EDR is not supported.
• DualSense BLE pairing window — pairing requires the manual PS + Create sequence and a short advertising window.

• Original Ghostpad desktop app: Electron + React GUI (now deprecated).
• Original PS5 payload and VDA research.
• scePadVirtualDeviceAddDevice code-cave patch.
• sceMbusBindDeviceWithUserId / sceMbusDisconnectDevice MBus binding flow.
• Credential elevation and SceShellCore process injection.
• hidDumper companion tool.
• virtualDS5research.md technical write-up.

• ESP32-WROOM-32U bridge firmware.
• WiFi STA/AP with mDNS.
• Embedded web UI.
• BLE HID host using NimBLE scan/connect/classification.
• DualSense and DualShock 4 report decoding.
• TinyUSB HID support.
• Subnet scanner and port probing.
• Klog TCP bridge with multi-client broadcast and backlog replay.
• WebSocket controller streaming and HTTP REST API.
• Controller pulse diagnostics.
• PS4 payload port under __ORBIS__.
• Runtime VDA patching with byte-pattern verification.
• libSceMbus dlopen / dlsym integration.
• Payload-side klog architecture.
• GBND prebind loop and direct MBus bind path.
• VDA probe diagnostic tool.
• Klog parser improvements.
• Native C++ GUI (GLFW + OpenGL + Dear ImGui cross-platform client).

• ps5-payload-sdk and ps4-payload-sdk, including work by John Törnblom and contributors.
• ESP-IDF.
• NimBLE.
• TinyUSB.
• cJSON.
• The PS4/PS5 development community.

Ghostpad is intended for development, research, and local-network experimentation on hardware you own or are authorized to work with. Use it responsibly and in accordance with applicable laws, platform terms, and local regulations.