ESP8266 PlayStation 5 Web Exploit Server

Lightweight web server for ESP8266 that hosts the PlayStation 5 UMTX2 Jailbreak for firmware versions 1.00–5.50, with minor modifications to enable caching. The following payloads are preloaded: etaHEN v2.1b, byepervisor and elfldr.

Quick Setup Guide

Access Point Details

• SSID: PS5_WEB_AP
• Password: password

Step-by-Step Installation and Usage

1. Download and install NodeMCU PyFlasher, or use any other ESP8266 flashing tool of your choice. You will use this tool to flash the precompiled .bin files.

2. (Skip this step if you have ESP Host FPKG installed on your PS5.) Download the esp8266-usersguideredirect-nocache.bin file from the releases page and flash it to your ESP8266. Connect your PS5 to the ESP8266's access point and open the User's Guide to access the exploit page. After successfully jailbreaking your PS5, install ESP Host FPKG.

3. Download the latest version of esp8266-ps5-exploit-server-v1.xx.bin from the releases page and flash it to your ESP8266. Connect your PS5 to the ESP8266's access point and access the exploit page through ESP Host FPKG. Once the page is cached, you can disconnect from the internet and jailbreak your PS5 offline in the future.

Notes

• The esp8266-usersguideredirect-nocache.bin file is intended for one-time use during the initial installation. It does not cache the exploit and serves it at http://10.10.10.10/index.html to avoid conflicts with previously cached versions of the exploit accessed through the User's Guide.

• Starting from v1.11 of esp8266-ps5-exploit-server-v1.xx.bin files, the User's Guide no longer redirects to the exploit page. This change is due to the need for additional DNS and HTTPS servers, which can slow down the initial connection and may cause WiFi instability—especially when using FTP on the PS5.

Configuration and Customization

Changing SSID, Password and/or Payloads

Access http://10.1.1.1/admin.html to customize the access point credentials and/or update the payloads.

When updating payloads, make sure that a valid payload_map.js and cache.appcache are provided, and that the total size of the uploaded payloads does not exceed 2.5MB. byepervisor and elfldr pyalods are loaded from PROGMEM, so you don't need to upload these payloads. However, in order to use byepervisor payload, you need to point to byepervisor.elf in payload_map.js file.

Manually flashing .ino File using Arduino IDE 2.x

To manually flash the .ino file, you can use Arduino IDE 2.x and Arduino LittleFS Upload. It is recommended to select the Flash Size: "4MB (FS: 3MB OTA: ~512KB)" option in the Tools tab in order to have ~2.5MB available for payloads.

Note: To continue redirecting User's Guide to the exploit page after flashing the .ino file, valid self-signed TLS certificate ServerConfig::cert and private key ServerConfig::key should be provided in config.h file. For instance, you could use the certificate and key from frwololo's PS4_PS5-ESP8266-Server project.

Credits

This project uses PROGMEM to store exploit files and necessary payloads, preserving SPIFFS for additional payloads. This approach was inspired by stooged's PS5-Server project and 0x1iii1ii's fork.