This release expands coverage from 1.00-5.50 + 9.00-12.00 to
1.00-5.50 + 7.00-12.70, integrates the P2JB chain for newer
firmwares on a forked slopkit, adds a dedicated live progress
UI for the long-running P2JB exploit, and improves autoload
reliability.
Key highlights:
- **Extended Firmware Support (7.00-12.70)**:
- Expanded poops to 7.00-8.60 (now 7.00-12.00) and integrated
P2JB for 12.02-12.70 (hour-long chain), alongside existing
umtx2 (1.00-5.50) with automatic firmware detection.
- Forked slopkit to itsPLK/slopkit to include P2JB and future
fixes; unified FORCE_EXPLOIT routing (auto | umtx2 | poops | p2jb).
- Updated kexp handling to use our forked binary that receives
offsets via an API table instead of binary-patching the kexp
on the fly.
- **Already-Jailbroken Shortcut (7.00-12.70)**:
- If already jailbroken, launching the autoloader shortcut
skips the kernel exploit and directly autoloads (Payload
Manager or autoload.txt), so no reboot is required after
the initial autoloader install to load your payloads —
especially useful for P2JB after an initial install using
the PC host to avoid waiting through the hour-long chain
a second time.
- **P2JB Live Progress & Autoload Reliability**:
- New live statistics panel for P2JB showing phase and overall
progress with ETA and worker status.
- Autoload now polls for elfldr readiness on port 9021 instead
of a fixed delay, for both fresh and already-jailbroken paths.
- **Docs & Maintenance**:
- Credits to soniciso1 for 7.00-8.60 and P2JB bring-up.
- Build tooling updated for the new kexp naming and dual
slopkit payloads; patch verification covers both chains.
When AppCache download fails due to corrupted on-disk WebKit data, the
installer page detects the failure and presents a prompt offering to wipe the
current user's webkit data (/user/home/<userid>/webkit/shell/) and retry.
- Add webkit_cleaner module to safely wipe webkit/shell for the foreground user
- Add /clear-webkit-data and /exit HTTP server routes and lifecycle handling
- Pass uid parameter to the installer page to display the exact target path
- Support one-shot retry (?retry=1) with persistent error reporting and clean exit
- Add corruption simulation build modes (SIMULATE=1|2) and helper script for testing
This release introduces umtx2 exploit support for FW 1.00–5.50, switches slopkit to a secure custom elfldr (matching the other autoloaders), brings major cache resiliency improvements to prevent corruption, and polishes the installer UI and repository structure.
Key highlights:
- **umtx2 Exploit Integration (FW 1.00–5.50)**:
- Integrated umtx2 alongside slopkit with automatic firmware detection from the User-Agent.
- Exploit runs isolated inside a hidden iframe with live console mirroring and real-time progress updates.
- Automated payload delivery via native main-loop event dispatch.
- State persistence across WebProcess crash-restores using sessionStorage (`wkal_autoload`).
- Post-autoload iframe unloading for umtx2 to prevent out-of-memory browser dialogs.
- Uses stock bundled elfldr for the umtx2 chain (as newer elfldr builds failed to load properly with umtx2).
- **Custom Localhost elfldr for slopkit (FW 9.00–12.00)**:
- Switched slopkit chain to use a custom localhost-only `ps5-elfldr`, matching Y2JB / BD-JB / Lua autoloaders.
- Enhances security by restricting incoming payload connections to the console itself (127.0.0.1) — most autoloader users do not need an open network port listening on the PS5.
- A standard network-facing elfldr can still be used via Payload Manager or manual `autoload.txt` config (see README for instructions).
- **Cache Resiliency & Offline Installer Enhancements**:
- Versioned application directory layout (`/app/<version>/`) and `__complete__` cache manifest marker prevent partial cache corruption during network drops or early browser exit.
- Stable pointer page (`/app/index.html`) verifies cache completeness before redirection.
- Homescreen shortcut creation is deferred until caching is 100% complete via the `/install` route.
- Live verbose installer logging and visual progress bar in the installer UI.
- Dynamic AppCache manifest filtering based on detected firmware and build flags (`FORCE_EXPLOIT`).
- Recursive directory creation (`mkdir_p`) ensuring fresh PS5 systems install without errors.
- **Repository Structure & Upstream Updates**:
- Reorganized patch diffs into dedicated `patches/` directory and consolidated scripts into `tools/`.
- Updated upstream slopkit submodule to commit 6153152.
- Added on-demand pre-release build workflow with custom version tagging.
Add a dedicated Pre-Release On-Demand workflow that builds from the dev
branch (branch input, default dev) and publishes a GitHub release marked
as --prerelease, with an optional custom version suffix input.
Extend tools/gen_version.py with a 'pre-release' BUILD_TYPE
(0.0.1-pre-<hash>) and a CUSTOM_VERSION env var that appends a custom
string to the base version (0.0.1-umtx2-test), which also shows in the
PS5 homescreen app title (param.json). build_release.sh now passes
CUSTOM_VERSION into the Docker build.
Pin the slopkit submodule to the latest upstream (9.05 offsets, PLDMGR
payload, native 4 MiB PAYLOAD_MAX_SIZE, renderNav refactor) and regenerate
the autoloader patch for the rewritten poops.html:
- drop the redundant PAYLOAD_MAX_SIZE hunk (native upstream)
- move the hidden payload.elf tile into the new payloadGrid
- relax exactQuery() to tolerate the autoload query key
- use the canonical production URL (go/auto/production/trigger/attempts/
only/log/payload/v=41) for the exploit iframe
- bump offsets cache-bust fallback to ?v=19 and widen log filter to STAGE0
- bump version to 0.2.1
The autoloader now redirects the browser straight to slopkit's poops.html
instead of loading it in a hidden same-origin iframe, matching the
environment the original exploit runs in (reported iframe success-rate
drops). index.html becomes a thin splash + redirect stub; poops.html is
re-skinned in the autoloader style (no cat, terminal-style log, versioned
footer) via the patch file.
Bump version to 0.2.0.
This commit replaces the stubbed demo flow with a real WebKit/kernel exploit chain, introducing significant performance optimizations and safety features for public testing.
Exploit Integration:
- Slopkit is pinned as a pristine git submodule in `third_party/slopkit`.
- Integration is isolated via `tools/slopkit-autoload.patch`, adding an `?autoload=<payload>` query parameter, a 4 MiB payload limit, a hidden menu tile, and a `postMessage` result emitter.
User Interface & Experience:
- The autoloader UI intelligently mirrors slopkit's live screen, stage, and summary logs.
- Added a full-screen test-build gate forcing explicit user continuation to prevent accidental crash loops.
- Applied a "PRE-RELEASE / TEST BUILD" hazard strip across all pages.
- Added a collapsible debug frame for monitoring the exploit.
Payload & Asset Optimization:
- Vendored `puff.c` (`src/inflate.c`) for on-the-fly raw DEFLATE decompression.
- The installer ELF now compresses embedded frontend assets and filters out heavy, unused slopkit payloads (saving several MiB).
- The PC host now serves the installer ELF directly as the autoload payload for the one-time setup.
AppCache & Dependencies:
- Mitigated PS5 caching issues via a versioned master URL (`?v=`) and cache-busting exact-match asset entries in the manifest.
- Introduced `scripts/download_deps.sh` to securely fetch and sha256-verify the pinned `ps5-unified-autoloader` release asset.
- Updated `Makefile` for payload-deps and ensured CI checks out submodules.
najdek