PS5 WebKit Autoloader

MikePinku fork — by MikePinku

 

Automatically loads the WebKit exploit and your elf payloads.
Supports firmwares 1.00–5.50 and 7.00–13.60.

Firmware	Chain
1.00 – 5.50	umtx2 (PSFree-based, restored in this fork)
7.00 – 12.00	Poops
7.00 – 13.60 (except 9.05, 11.40)	Relapse
9.05, 11.40	Poops (Relapse does not support these)

Why this fork?

Upstream itsPLK/ps5-webkit-autoloader dropped firmware 1.00–5.50 when it moved to its unified architecture. This fork keeps that unified base and restores the low-firmware umtx2 chain alongside Poops and Relapse, with a fresh coat of paint:

• Three chains, one installer. The installer asks only when your firmware genuinely supports more than one chain; otherwise it just picks the right one.
• Old firmwares get the same offline treatment. The umtx2 chain is cached the same way as Poops/Relapse, so a 1.00–5.50 console also works fully offline after the one-time setup, with a homescreen shortcut.
• Redesigned UI (dark pink theme) across the installer, the autoloader page and the PC host, with English/French toggle on the autoloader page.
• Firmware-aware guidance. The installer prompt badges the recommended chain for your detected firmware — the same table the PC host uses.
• Cold-boot friendly. The autoloader page has a Boot wait setting (Off / 15s / 30s, remembered across boots) that briefly holds the exploit back when the cached page fires right after power-on. Tap anywhere to skip the wait.
• Better PC setup host. The single-file webkit-autoloader-host.py now carries the whole setup docroot — a firmware router page, both standalone chain pages and the multi-file umtx2 chain — and serves every text file with an explicit UTF-8 charset.

Everything below works the same as upstream, because this fork is built on its architecture.

Why WebKit Autoloader?

WebKit exploits are usually loaded by pointing your PS5's DNS at some server hosted by someone on the internet. That means you're putting your trust in whoever runs that server — and if it goes down, changes, or disappears, your setup breaks.

This autoloader does it differently:

• Fully offline, no third-party DNS. After a one-time install from your PC, everything is served straight from your PS5. There's nothing external to go down or change behind your back.
• One-time setup, then a homescreen shortcut. Once it's installed, you don't need a PC or the internet — just launch "WebKit Autoloader" from the homescreen and you're done.
• Payloads loaded the way you already know. After the exploit chain runs, your payloads are sent via Payload Manager, or a custom autoload.txt.

Setup Instructions

There are two ways to set up the autoloader, depending on whether you're already jailbroken.

Already jailbroken? Just load the installer ELF

1. Download webkit-autoloader-installer_vX.Y.Z.elf from the Releases page.
2. Send it to your PS5 with elfldr, or launch it from Payload Manager.
3. The installer opens the browser to cache the autoloader page (choose a chain if prompted; on 1.00–5.50 umtx2 is picked for you), creates the WebKit Autoloader app on the homescreen, and exits.
4. Reboot once, then launch WebKit Autoloader from the homescreen.

Not jailbroken yet

If you aren't jailbroken yet, you'll need to host the exploit locally on your PC for the initial setup:

1. Download webkit-autoloader-host.py (or the .exe) from the Releases and run it on a PC on your network.
2. On your PS5, set your network's DNS server to your PC's IP address.
3. Open the User's Guide from Settings — the host routes your firmware to the right chain automatically and installs the WebKit Autoloader app on the homescreen.
4. Reboot once, then launch WebKit Autoloader from the homescreen.

How to Use

There are two ways to configure payloads:

🟢 Option 1: Payload Manager

If no autoload.txt config is found, the autoloader will automatically launch Payload Manager — a fully-featured PS5 payload manager with a web UI. This lets you configure and send payloads directly from your browser, without needing to manually set up config files or transfer ELF files ahead of time.

Just run the autoloader — if there's nothing configured, Payload Manager starts automatically.

Note: Payload Manager also has its own built-in autoload feature, which lets you configure payloads to load automatically on startup — all managed through its web UI. This is separate from the autoload.txt mechanism described below.

---

⚙️ Option 2: Manual Config (autoload.txt)

For a fixed, automated payload chain, you can configure payloads manually:

• Create a directory named ps5_autoloader.
• Inside this directory, place your .elf / .bin files, and an autoload.txt file.
  • In autoload.txt, list the files you want to load, one filename per line.
  • Filenames are case-sensitive — ensure each name exactly matches the file.
  • You can add lines like !1000 to make the loader wait 1000 ms before sending the next payload.
• Put the ps5_autoloader directory in one of these locations (priority order - highest first):
  • Root of a USB drive
  • Internal drive: /data/ps5_autoloader

Note: When an autoload.txt config is found, Payload Manager is not launched automatically. If you also want Payload Manager available, place pldmgr.elf in your ps5_autoloader directory and add it to autoload.txt.

Additional Info

How to update the autoloader?

The autoloader content is cached on the console, so updating is exactly the same as the initial install. Simply follow the Setup Instructions using the new release files.

The latest installer payload will re-create the homescreen app and refresh the cached page for you. Your payloads and autoload.txt on USB / internal storage are never touched.

How to use a custom ELF Loader?

The autoloader uses a custom version of elfldr that only accepts connections from the PS5 itself (localhost). This improves security by preventing unauthorized devices on your network from sending payloads to your console.

If you want to use a "normal" ELF Loader that allows sending payloads from any device, you can simply load it through Payload Manager.

Alternatively, if you are using a manual config file (autoload.txt):

1. Place your custom ELF Loader (e.g. elfldr.elf) in the ps5_autoloader directory.
2. Add elfldr.elf to your autoload.txt.
3. Note: If you are loading other payloads right after elfldr.elf in your autoload.txt, add a sleep command immediately after it (like !4000 to sleep for 4 seconds) to give the new ELF Loader time to start up and listen before subsequent payloads are sent.

Example autoload.txt:

# Load custom ELF Loader
elfldr.elf
# Give it 4 seconds to start up (only needed if sending more payloads)
!4000
# Send other payloads
etaHEN.elf

---

For developers

If you want to create or test your own WebKit payloads, check out ps5-webkit-remote-loader, which this project is based on. It lets you send and run JavaScript payloads directly over the network on port 9027.

Build both release artifacts with ./build_release.sh (Docker required). Run make test for the offline checks (payloads, installer, exploit-selection flow, umtx2 patch, host router and the UI's log-string contract), make umtx2-prepare to (re)generate the umtx2 chain after a submodule update, make dev for a local page preview of every chain, and make host to build the PC setup host. See ARCHITECTURE.md for the build and cache layout, and pc-host/README.md for the host's options.

Credits

This fork stands on the shoulders of a lot of people:

• itsPLK — ps5-webkit-autoloader, the unified architecture this fork extends, plus ps5-elfldr and ps5-unified-autoloader
• idlesauce & contributors — umtx2, the FW 1.00–5.50 chain restored by this fork, building on abc's PSFree and the psfree-lapse team's work
• shahrilnet & n0llptr — the original umtx kernel exploit research
• jordyidk & contributors — slopkit (Poops)
• soniciso1, ntfargo & contributors — Relapse
• john-tornblom — ps5-payload-sdk and elfldr
• SpecterDev, ChendoChap, SlidyBat, flat_z, SocraticBliss, zecoxao and everyone in the PS5 R&D Discord whose kernel research and offsets the chains rely on
• See ps5-webkit-remote-loader for runtime and toolchain credits.

Disclaimer

This tool is provided as-is for research and development purposes only. Use at your own risk. The developers are not responsible for any damage, data loss, or consequences resulting from the use of this software.

License

This project is licensed under the GPL-3.0 License — see LICENSE. It is a fork of itsPLK/ps5-webkit-autoloader, and all upstream credits apply.