ESP8266/ESP32 UMTX2 Jailbreak Host for PlayStation 5 (FW 1.00–5.50)
Lightweight web server for ESP8266/ESP32 boards that hosts the PlayStation 5 UMTX2 Jailbreak for firmware versions 1.00–5.50, with minor modifications to enable caching, data compression and access to additional payloads from the PS5's internal storage.
The following payloads are preloaded: display-user-id, elfldr, ftpsrv and remove-cache. You can add/remove additional payloads to/from the PS5's internal storage as described here.
Quick Setup Guide
WiFi Details
- SSID:
PS5_WEB_AP - Password:
password
Prerequisites
The exploit page cannot be opened from the PS5's User’s Guide page, so you must use ESP Host or any other browser app that can access http://10.1.1.1/index.html.
Note: If you want to access the exploit page from the PS5's User’s Guide page, consider using 0x1iii1ii’s PS5-Server fork.
Step-by-Step Installation and Usage
-
Download the latest version of the precompiled
.binfile from the releases page and flash it to your ESP8266/ESP32 using NodeMCU PyFlasher (Windows, MacOS) or esptool (Windows, MacOS, Linux). -
Connect your PS5 to the ESP8266/ESP32's WiFi and access the exploit page from ESP Host. Once the page is cached, you can disconnect from the internet and jailbreak your PS5 offline in the future.
Add/remove additional payloads to/from the PS5's internal storage
FTP into your PS5 (you can use the preloaded ftpsrv payload) and place the additional payloads at the root of the following folder (you might need to create it first): /user/home/<user-id>/webkit/shell/esp-payloads. For example, a valid path for etaHEN payload could be /user/home/<user-id>/webkit/shell/esp-payloads/etaHEN.bin. Only .bin and .elf payloads will be displayed.
Note: <user-id> is the ID of the current user you run the exploit from. If unsure, you can run the preloaded display-user-id payload, which will display the current user ID in a pop-up notification.
Credits
Inspired by stooged's PS5-Server project and frwololo's PS4_PS5-ESP8266-Server project.