ESP8266/ESP32 UMTX2 Jailbreak Host for PlayStation 5 (FW 1.00–5.50)
Lightweight web server for ESP8266/ESP32 boards that hosts the PlayStation 5 UMTX2 Jailbreak for firmware versions 1.00–5.50, with minor modifications to enable caching and data compression. The following payloads are available: etaHEN, byepervisor, elfldr, kstuff, kstuff-toggle, ftpsrv and webkit-cache-remover.
Note: This project works on all ESP8266/ESP32 boards that have at least 4 MB flash. For ESP32-S3 boards with 16 MB flash, consider using Stuey-81's PS5_EZ_Host project instead.
Quick Setup Guide
WiFi Details
- SSID:
PS5_WEB_AP - Password:
password
Prerequisites
The exploit page cannot be opened from the PS5 User’s Guide page, so you must use ESP Host or any other browser app that can access http://10.1.1.1/index.html.
Note: If you want to access the exploit page from the PS5 User’s Guide page, consider using 0x1iii1ii’s PS5-Server fork instead.
Step-by-Step Installation and Usage
-
Download the latest version of the precompiled
.binfile from the releases page and flash it to your ESP8266/ESP32 using NodeMCU PyFlasher (Windows, MacOS) or esptool (Windows, MacOS, Linux). -
Connect your PS5 to the ESP8266/ESP32's WiFi and access the exploit page from ESP Host. Once the page is cached, you can disconnect from the internet and jailbreak your PS5 offline in the future.
Additional steps for v2.00
The new etaHEN v2.4B build exceeds 4 MB after compression, which is larger than the available space on ESP8266/ESP32 board. As a workaround, etaHEN.bin will be stored on the PS5 filesystem instead and loaded from there.
As I couldn't escape the sandbox limitations from within the payloads page even after running the kernel exploit, the path for etaHEN will be rather obscure for now: /user/home/<user-id>/webkit/shell/esp-payloads. FTP into your PS5 and put etaHEN.bin file in this exact folder (you will most likely have to create it).
<user-id> is the account directory for the user you run the exploit from. If uncertain, either add etaHEN.bin file for all users or run cache-remover payload, which will show you the <user-id> in a notification box.
Note: Any version of etaHEN (or even other payload entirely) will work, as long as the path is correct and you name it etaHEN.bin. No etaHEN will be preloaded on the ESP8266/ESP32 board starting from v2.00.
Credits
Inspired by stooged's PS5-Server project and frwololo's PS4_PS5-ESP8266-Server project.