Lightweight web server for ESP8266/ESP32 boards that hosts the PlayStation 5 UMTX2 Jailbreak for firmware versions 1.00–5.50, with minor modifications to enable caching, data compression and access to additional payloads from the PS5's internal storage.
When you open the exploit page, the jailbreak runs automatically after a 3-second timer (press Cancel to stop it). After the jailbreak completes, the host loads elfldr.elf on port 9021 and auto-runs the payloads listed in autoload.txt from the PS5's internal storage — or falls back to pldmgr.elf if autoload.txt is absent (see Auto-run payloads).
The following payloads are preloaded: display-user-id, elfldr, ftpsrv and remove-cache. You can add/remove additional payloads to/from the PS5's internal storage as described here.
- SSID:
PS5_WEB_AP - Password:
password
The exploit page cannot be opened from the PS5's User’s Guide page, so you must use ESP Host or any other browser app that can access http://10.1.1.1/index.html.
Note: If you want to access the exploit page from the PS5's User’s Guide page, consider using 0x1iii1ii’s PS5-Server fork.
-
Download the latest version of the precompiled
.binfile from the releases page and flash it to your ESP8266/ESP32 using NodeMCU PyFlasher (Windows, MacOS) or esptool (Windows, MacOS, Linux). -
Connect your PS5 to the ESP8266/ESP32's WiFi and access the exploit page from ESP Host. The first time, allow the page to fully cache all its files (watch the toast messages until the offline caching finishes). If you need the exploit to run offline, cancel the automatic jailbreak during this first visit — otherwise you can just let it jailbreak. Once the page is fully cached, you can disconnect from the internet (and the ESP) and jailbreak your PS5 offline in the future: on subsequent visits the cached page runs without needing the server's files.
First-time offline caching: the auto-jailbreak timer is 3 seconds. On the very first load you must press the Cancel button within those 3 seconds — otherwise the jailbreak auto-runs and cancels the offline caching process. Wait until the offline caching completes, then rerun the exploit offline on the next visit.
FTP into your PS5 (you can use the preloaded ftpsrv payload) and place the additional payloads at the root of the following folder (you might need to create it first): /user/home/<user-id>/webkit/shell/esp-payloads. For example, a valid path for etaHEN payload could be /user/home/<user-id>/webkit/shell/esp-payloads/etaHEN.bin. Only .bin and .elf payloads will be displayed.
Note: <user-id> is the ID of the current user you run the exploit from. If unsure, you can run the preloaded display-user-id payload, which will display the current user ID in a pop-up notification.
Place an autoload.txt file in the same esp-payloads folder to auto-run payloads right after the jailbreak completes, without pressing any button. Each line is either a payload filename or a delay:
- A filename (e.g.
ftpsrv.elf) loads that payload from theesp-payloadsfolder. - A line starting with
!followed by milliseconds (e.g.!1000) waits that long before the next payload.
For example, the following autoload.txt loads ftpsrv.elf first, waits 1 second, then loads pldmgr.elf:
ftpsrv.elf
!1000
pldmgr.elf
Lines starting with # and empty lines are ignored. If autoload.txt does not exist, the default pldmgr.elf payload is auto-run as before — but only if pldmgr.elf is present in esp-payloads. If neither exists, the browser stays on the payload menu.
Inspired by stooged's PS5-Server project and frwololo's PS4_PS5-ESP8266-Server project.