# ESP8266/ESP32 UMTX2 Jailbreak Host for PlayStation 5 (FW 1.00–5.50)

![Payloads menu](assets/images/payloads-menu.jpg)

Lightweight web server for ESP8266/ESP32 boards that hosts the [PlayStation 5 UMTX2 Jailbreak](https://github.com/idlesauce/umtx2) for firmware versions 1.00–5.50, with minor modifications to enable caching, data compression and access to additional payloads from the PS5's internal storage.

The following payloads are preloaded: display-user-id, [elfldr](https://github.com/ps5-payload-dev/elfldr), [ftpsrv](https://github.com/ps5-payload-dev/ftpsrv) and remove-cache. You can add/remove additional payloads to/from the PS5's internal storage as described [here](#addremove-additional-payloads-tofrom-the-ps5s-internal-storage).

## Quick Setup Guide

### WiFi Details

- SSID: `PS5_WEB_AP`
- Password: `password`

### Prerequisites

The exploit page cannot be opened from the PS5's _User’s Guide_ page, so you must use [ESP Host](https://www.mediafire.com/file/w4e6hiuwfoj8dnb/esphost.zip) or any other browser app that can access `http://10.1.1.1/index.html`.

**Note:** If you want to access the exploit page from the PS5's _User’s Guide_ page, consider using [0x1iii1ii’s PS5-Server fork](https://github.com/0x1iii1ii/PS5-Server).

### Step-by-Step Installation and Usage

1. Download the latest version of the precompiled `.bin` file from the [releases page](https://github.com/vladimir-cucu/esp-ps5-exploit-server/releases) and flash it to your ESP8266/ESP32 using [NodeMCU PyFlasher](https://github.com/marcelstoer/nodemcu-pyflasher) (Windows, MacOS) or [esptool](https://github.com/espressif/esptool) (Windows, MacOS, Linux).

2. Connect your PS5 to the ESP8266/ESP32's WiFi and access the exploit page from ESP Host. Once the page is cached, you can disconnect from the internet and jailbreak your PS5 offline in the future.

### Add/remove additional payloads to/from the PS5's internal storage

FTP into your PS5 (you can use the preloaded ftpsrv payload) and place the additional payloads at the root of the following folder (you might need to create it first): `/user/home/<user-id>/webkit/shell/esp-payloads`. For example, a valid path for etaHEN payload could be `/user/home/<user-id>/webkit/shell/esp-payloads/etaHEN.bin`. Only `.bin` and `.elf` payloads will be displayed.

**Note:** `<user-id>` is the ID of the current user you run the exploit from. If unsure, you can run the preloaded display-user-id payload, which will display the current user ID in a pop-up notification.

## Credits

Inspired by [stooged's PS5-Server project](https://github.com/stooged/PS5-Server) and [frwololo's PS4_PS5-ESP8266-Server project](https://github.com/frwololo/PS4_PS5-ESP8266-Server).