ESP8266 PlayStation 5 Web Exploit Server
Lightweight web server for ESP8266 that hosts the PlayStation 5 UMTX2 Jailbreak for firmware versions 1.00–5.50, with minor modifications to enable caching. The following payloads are preloaded: etaHEN v2.1b, byepervisor, kstuff, kstuff-toggle and elfldr.
Note: ESP32 support will be added in the coming weeks, once I get my hands on one.
Quick Setup Guide
WiFi Details
- SSID:
PS5_WEB_AP - Password:
password
Step-by-Step Installation and Usage
-
Download and install NodeMCU PyFlasher. You will use this tool to flash the precompiled
.binfile. -
(Skip this step if you have ESP Host FPKG installed on your PS5!) Download the
esp8266-usersguideredirect-nopayloads.binfile from the releases page and flash it to your ESP8266. Connect your PS5 to the ESP8266's WiFi and open the User's Guide to access the exploit page. After successfully jailbreaking your PS5, install ESP Host FPKG and follow the next step. -
Download the
esp8266-ps5-exploit-server-v1.xx.binfile from the releases page and flash it to your ESP8266. Connect your PS5 to the ESP8266's WiFi and access the exploit page through ESP Host FPKG. Once the page is cached, you can disconnect from the internet and jailbreak your PS5 offline in the future.
Additional details
-
The
esp8266-usersguideredirect-nopayloads.binfile is intended for one-time use during the initial installation. It does not cache the exploit and serves it at a different URL in order to avoid conflicts with previously cached versions of the exploit accessed through the User's Guide. -
When using
esp8266-ps5-exploit-server-v1.xx.bin, the User's Guide no longer redirects to the exploit page. This is because additional DNS and HTTPS servers need to run for the redirect to function, which can slow down the initial connection and may cause WiFi instability—especially when using FTP on the PS5.
Configuration and Customization
Screenshot of the Admin Page hosted at http://10.1.1.1/admin.html.
Changing WiFi SSID and Password
Access http://10.1.1.1/admin.html to change the WiFi SSID and Password. SSID has to be at least 4 characters long and should contain at most 32 characters. Password has to be at least 8 characters long and should contain at most 64 characters.
Changing payloads
Access http://10.1.1.1/admin.html to change the payloads. When updating payloads, make sure that a valid payload_map.js and cache.appcache are provided, and that the total size of the uploaded payloads does not exceed 2.5MB. byepervisor, kstuff-toggle and elfldr are loaded from PROGMEM, so you don't need to upload these payloads.
Manually flashing .ino File using Arduino IDE 2.x
To manually flash the .ino file, you can use Arduino IDE 2.x and Arduino LittleFS Upload. It is recommended to select the Flash Size: "4MB (FS: 3MB OTA: ~512KB)" option in the Tools tab in order to have ~2.5MB available for payloads.
Note: To continue redirecting User's Guide to the exploit page after flashing the .ino file, valid self-signed TLS certificate ServerConfig::cert and private key ServerConfig::key should be provided in config.h file. For instance, you could use the certificate and key from frwololo's PS4_PS5-ESP8266-Server project.
Credits
This project uses PROGMEM to store exploit files and necessary payloads, preserving SPIFFS for additional payloads. This approach was inspired by stooged's PS5-Server project and 0x1iii1ii's fork.