Patchwork

Patchwork is a security plugin developed by Zaprit and other community contributors. It was first designed to mitigate the risk of the force join exploit in LittleBigPlanet 1, 2 and 3. It is expected to eventually support PlayStation Vita as well as blocking malicious scripts from being loaded in the client.

History

Patchwork came from necessity following the discovery of several critical security vulnerabilities in the LittleBigPlanet client.

Discovery of LittleBigPlanet Client-side Exploits

On December 7, 2024, LBP Union published a security advisory detailing the risk of remote code execution (RCE) attacks when playing in LittleBigPlanet P2P lobbies. This resulted in LBP Union disabling Dive In features for Beacon to encourage players only to play with those that they trust. However, LBP Union was concerned about the possibility of a malicious user forcibly joining another player's session as early as October 16, 2024, according to a discussion in a private Starguard Discord channel.

Later, on May 7, 2025, LBP Union received code from an undisclosed source that was purported to enable force joining another user by creating a forged LittleBigInvite link. Since the exploit was made possible by a vulnerability in the game client, nothing could be done on the server to mitigate the risk; no custom server software by itself could ever make online play safe. Both Minister of Technology Zaprit and Union Space Corps Director Fetetra determined that the code was credible, and advised that Beacon's services be terminated until a solution could be developed. This situation was explained in a security advisory published on May 10.

Seeking a Solution

The solutions proposed by LBP Union in this advisory were:

• A game patch: the only lasting fix, but also the most challenging to achieve due to the closed source code of the game. A game patch would either mitigate force join, prevent malicious scripts from loading, or both.
• Custom RPCN network: would not fix the problem, but would allow LBP Union greater control over who could register an account. Would not help PS3 users.
• Additional client-side software: LBP Union proposed additional software that might be able to support LittleBigPlanet clients at runtime.

The final proposal was pursued independently by Zaprit, creating the Patchwork GitHub repository soon thereafter.

Developing Patchwork

On May 18, Zaprit merged the first nine commits to the repository. He was initially assisted by Jvyden, who made eight commits between May and June that year. Toastbrot236 would contribute commits in July. By May 25, Zaprit reported to the LBP Union Protectors that he and Jackcaver had successfully deployed the Patchwork security plugin on all three main LittleBigPlanet games with the PS3's Homebrew Enabler (HEN). He proposed that UnionPatcher be discontinued in favor of Refresher as LBP Union's recommended Patching software, as Refresher was much more user friendly and implemented Patchwork when patching.

Deploying Patchwork with Refresher

On May 26, maintainers of the Refresher patching software repository on GitHub merged a pull request that began the process of incorporating Patchwork into Refresher. However, this first change only affected PS3 users. It wasn't until June 18 that Refresher would support patching RPCS3 with Patchwork. LBP Union subsequently reopened Beacon on July 1, advising players to use Refresher to re-patch and install Patchwork.

The Plugin

The repository describes Patchwork as follows:

Patchwork is an SPRX module that patches the LittleBigPlanet series of games to fix some of the many security vulnerabilities the games have.

As an SPRX module, Patchwork can run on a PlayStation 3 or RPCS3 without any additional hardware or software after the patching process is complete. Once patched, Patchwork will start as soon as the game is booted so long as the console has syscalls enabled.^{[citation needed]}