BlackBox is built from Orbit Store's code

Published by the Orbit Store project on 12 October 2026. Checked against every BlackBox release still online: v1.0.5, v1.0.6, v1.0.7 and v1.0.8.

BlackBox is a PS5 store whose payload, blackbox.elf, is compiled from Orbit Store's source code. It is released without source code, without a licence file and without saying that it is based on Orbit.

Orbit is free software under the GNU GPL, version 3 or later. Anyone may copy it, change it and release their own version. The licence asks one thing in return: whoever releases a changed version must share its source under the same licence. BlackBox has not done that.

Everything below comes from BlackBox's own public release files and can be checked with standard tools. Check it yourself.

What we're asking for

Forks are welcome; that's the point of the GPL. To keep releasing a changed version of Orbit, BlackBox needs to:

1. Publish the complete source code for every blackbox.elf and PPSA01453.ffpkg it has released, including its own changes and build scripts (GPLv3 section 6). The TV package contains the payload too.
2. Release it under GPL-3.0-or-later, with the licence text (sections 4 and 5).
3. Say that it is a modified version of Orbit Store and keep Orbit's notices (sections 4 and 5a).

What the release files show

BlackBox's payload is not stripped. It still carries the debug information the compiler wrote, which records the name of every source file it was built from. That makes these checks possible without decompiling anything.

1. BlackBox's own build record lists Orbit's source files

blackbox.elf v1.0.8 names 32 application source files. 28 of them are Orbit's, including orbit.h, Orbit's main header. The other four, custom.c, lease.c, messages.c and presence.c, are BlackBox's additions. v1.0.5 and v1.0.7 list the same 28 Orbit files, with three additions (no lease.c).

2. Most of its functions are Orbit's

The debug information places 248 of BlackBox v1.0.8's functions in its application source files. Compared with Orbit 0.9.1, the last Orbit release before the oldest BlackBox files still online were uploaded:

For scale, two consecutive Orbit releases, 0.9.0 and 0.9.1, share 236 of their 240 same-named functions instruction for instruction. Independently written software doesn't put 214 functions under the same names in the same 28 files. The full table, file by file, is in output/v1.0.8.txt.

3. Orbit's launcher, with the name changed

Orbit's launcher/install.c, line 15:

static const unsigned char owner[] = "Orbit Store ORBT00001 launcher v1\n";

The same string in BlackBox:

BlackBoxv2 BLKB00001 launcher v1

7 of the 9 functions in BlackBox's launcher/install.c compile to the same instructions as Orbit's. In v1.0.5 and v1.0.6, the home-screen app manifest the launcher writes still used Orbit's own app ID:

BlackBoxv2 BLKB00001 launcher v1
  "applicationCategoryType": 65536,
  "titleId": "ORBT00001",

That line is gone from v1.0.7 onwards.

4. Orbit's names are still inside

BlackBox v1.0.8 contains functions such as orbit_launcher_ensure, orbit_process_identity, orbit_request_stop and orbit_runtime_image. Its web interface tells users to copy PPSA99177.ffpkg to /data/homebrew/. That is the file name of Orbit's TV app; BlackBox's own TV app is PPSA01453.ffpkg.

5. Orbit's build setup and interface text

• Build directories. Both programs were built in /work, and BlackBox's dependencies were built in /tmp/orbit-deps/, the folder Orbit's tools/build-deps.sh creates.
• Interface text. 96 of the 466 longer messages (30 or more characters) in Orbit 0.9.1's English interface appear word for word in BlackBox. For example:

Keep the partial file to resume later, or delete only the partial file. Downloaded files are never deleted through history cleanup.

6. No source, no licence

BlackBox's README says it is licensed under GPL-3.0-or-later and refers to "the LICENSE file". The repository contains only README.md, catalog and updates. There is no licence file and no source code. Every release contains only blackbox.elf and PPSA01453.ffpkg.

What users say

Posts from PS5 homebrew users who compared the two apps. These are their own words; the evidence above stands on its own.

Exactly the same as a orbit store.. 👎🏻

— Nobody (@Nobody9dw2) October 7, 2026

Bro that's not what we were promised, it's just an exact copy of orbit store

— الكاشف لكذب المخالف (@Kashfalk4b) October 7, 2026

Every single thing, Identical UI, same download sources, same catalogue, even same games placements in UI....Blackbox store is nothing like they've been showing in their videos and even the games they were showing is not in the store because it's an identical copy of Orbit store. pic.twitter.com/o3eUI20l1v

— Saurav Gautam (@iSauravGautam) October 7, 2026

Orbit Store vs Black Box.
Fark var mı izleyip siz karar verin bakalım. pic.twitter.com/aBIvZrmPeg

— Selim (@selimozgun) October 7, 2026

So all the games following what orbit store published, with using his base code on the top of slightly changed UI. At least give credit to him

— Erencan Aypek (@erencanaypek) October 7, 2026

Y'all completely stole Orbit store. https://t.co/WcFqRKKkbP

— July (@YeahNoImballin) October 9, 2026

Black box c’est juste une copie pourrie de Orbit Store… si tu préfères BlackBox alors utilise le vrai

— Fred Blrd (@FBlrd) October 12, 2026

Check it yourself

You need Linux with binutils, curl and python3:

git clone --depth 1 https://github.com/saawant12/blackbox-gpl
sh blackbox-gpl/check.sh v1.0.8

On macOS, or in WSL on Windows, run it in Docker:

docker run --rm -v "$PWD:/w" -w /w debian:trixie sh -c \
  'apt-get update -qq && apt-get install -y -qq binutils binutils-x86-64-linux-gnu curl ca-certificates python3 git &&
   git clone --depth 1 https://github.com/saawant12/blackbox-gpl && sh blackbox-gpl/check.sh v1.0.8'

Without git, download these five files from this page into one folder and run sh check.sh: check.sh, compare.py, ui_strings.py, SHA256SUMS and orbit-v0.9.1-en.json.

check.sh downloads BlackBox's release and Orbit 0.9.1 from GitHub and compares their SHA-256 with SHA256SUMS. It then runs readelf, strings, nm and objdump, plus two short Python scripts: compare.py for functions and ui_strings.py for interface text. The downloaded files are only read, never run. Pass another tag (v1.0.5, v1.0.6, v1.0.7) to check an older release.

Orbit's launcher/install.c and i18n/en.json are in orbit-store-0.9.1-source-bundle.zip, attached to the Orbit 0.9.1 release. orbit-v0.9.1-en.json is a copy of that en.json.

Our full results: v1.0.5 · v1.0.7 · v1.0.8.

Files examined

The files under v1.0.5 and v1.0.6 are identical. They were uploaded on 8 October 2026, after both releases were published, and don't match the checksums BlackBox's update feed listed for v1.0.5 or v1.0.6. BlackBox's feed history also lists releases 1.0.0-beta.1 to 1.0.4 from 6–7 October 2026; their files are no longer online.

Orbit Store 0.9.1, orbit_store.elf: a7ff23dfc0ed5cd7d5c4b05c7e0c0a4e1ea2ee2c91742e00d754122917f8f318

Donations

BlackBox collects donations through Buy Me a Coffee (buymeacoffee.com/blackboxps). Orbit Store is free and doesn't accept donations or payments; money given to BlackBox doesn't reach Orbit's developers.

Thanks

This check started from a report in Orbit issue #58. The numbers on this page come from our own runs of the script above.