feat(release): v0.4.0 - extended firmware support to 7.00-12.70

This release expands coverage from 1.00-5.50 + 9.00-12.00 to
1.00-5.50 + 7.00-12.70, integrates the P2JB chain for newer
firmwares on a forked slopkit, adds a dedicated live progress
UI for the long-running P2JB exploit, and improves autoload
reliability.

Key highlights:
- **Extended Firmware Support (7.00-12.70)**:
  - Expanded poops to 7.00-8.60 (now 7.00-12.00) and integrated
    P2JB for 12.02-12.70 (hour-long chain), alongside existing
    umtx2 (1.00-5.50) with automatic firmware detection.
  - Forked slopkit to itsPLK/slopkit to include P2JB and future
    fixes; unified FORCE_EXPLOIT routing (auto | umtx2 | poops | p2jb).
  - Updated kexp handling to use our forked binary that receives
    offsets via an API table instead of binary-patching the kexp
    on the fly.

- **Already-Jailbroken Shortcut (7.00-12.70)**:
  - If already jailbroken, launching the autoloader shortcut
    skips the kernel exploit and directly autoloads (Payload
    Manager or autoload.txt), so no reboot is required after
    the initial autoloader install to load your payloads —
    especially useful for P2JB after an initial install using
    the PC host to avoid waiting through the hour-long chain
    a second time.

- **P2JB Live Progress & Autoload Reliability**:
  - New live statistics panel for P2JB showing phase and overall
    progress with ETA and worker status.
  - Autoload now polls for elfldr readiness on port 9021 instead
    of a fixed delay, for both fresh and already-jailbroken paths.

- **Docs & Maintenance**:
  - Credits to soniciso1 for 7.00-8.60 and P2JB bring-up.
  - Build tooling updated for the new kexp naming and dual
    slopkit payloads; patch verification covers both chains.

Author: najdek

.github/screenshots/p2jb_ui.jpeg

@@ -3,7 +3,7 @@
 	url = https://github.com/itsPLK/ps5-unified-autoloader.git
 [submodule "third_party/slopkit"]
 	path = third_party/slopkit
-	url = https://github.com/jordyidk/slopkit.git
+	url = https://github.com/itsPLK/slopkit.git
 [submodule "third_party/umtx2"]
 	path = third_party/umtx2
 	url = https://github.com/idlesauce/umtx2.git

.github/screenshots/webkit_autoloader.jpeg

@@ -1,13 +1,14 @@
 # PS5 WebKit Autoloader: Architecture
 
 A persistent entry point for PS5 payloads that runs a WebKit/kernel exploit chain
-and autoloads your payloads fully offline. Two exploit chains are bundled and
+and autoloads your payloads fully offline. Three exploit chains are bundled and
 selected by firmware:
 
-- **umtx2** (FW **1.00–5.50**) — idlesauce's umtx2 exploit.
-- **slopkit** (FW **9.00–12.00**) — the slopkit exploit chain.
+- **umtx2** (FW 1.00–5.50) — idlesauce umtx2 chain (`umtx2/`).
+- **poops** (FW 7.00–12.00) — slopkit poops chain (`slopkit/poops.html`).
+- **p2jb** (FW 12.02–12.70) — slopkit P2JB chain (`slopkit/p2jb.html`). Takes ~1 hour.
 
-Both converge on the same result: a `WKAL00001` homescreen app that runs the
+All three converge on the same result: a `WKAL00001` homescreen app that runs the
 exploit, boots elfldr, and autoloads your payload through it.
 
 ## Repository layout
@@ -40,26 +41,30 @@ instead of the unified-autoloader — so this flow installs the homescreen app.
 ## Frontend (`frontend/autoloader/`)
 
 - A splash screen, a log terminal and a progress bar. The exploit runs in a **hidden**
-  same-origin iframe. On load, `app.js` picks the chain from the firmware in the
-  user-agent (`PlayStation 5/x.xx`): **umtx2** (`umtx2/index.html?autoload=payload.elf`)
-  for 1.00–5.50, **slopkit** (`slopkit/slopkit/poops.html?go=1&auto=1&...`) for 9.00–12.00.
-  Firmware outside both ranges shows a clean error and never arms the iframe.
-- A `FORCE_EXPLOIT` build-time override (or a `?force=` query) bypasses the table so a
-  specific chain can be exercised on any firmware for testing; the exploit's own
-  firmware guard still applies.
+  same-origin iframe. On load, `app.js` picks the chain from the firmware in
+  the user-agent (`PlayStation 5/x.xx`): **umtx2** for 1.00–5.50, **poops** for 7.00–12.00,
+  and **p2jb** for 12.02–12.70.
+- A `FORCE_EXPLOIT` build-time override (`auto | umtx2 | poops | p2jb`; or a `?force=`
+  query) bypasses the table so a specific chain can be exercised on any firmware; the
+  exploit's own firmware guard still applies.
 - umtx2 auto-runs its chain via the `on_load_autorun` sessionStorage key (set by
-  `app.js` before arming); slopkit runs via its `?go=1&auto=1` query.
+  `app.js` before arming); poops and p2jb run via their `?go=1&auto=1` query.
 - On `window.load` the iframe is armed; at script parse it is blanked to `about:blank` so a
   WebProcess-crash page restore never auto-runs the chain. Before arming, `clearSlopkitState()`
-  removes slopkit's one-shot latch and "stopped at …" markers from sessionStorage so every
-  launch restarts the full ladder.
-- `app.js` mirrors the chain's screen/stage/early/summary into the log (errors, stage changes
-  and summary verdicts) and receives the `?autoload` result via `postMessage`.
+  removes the slopkit one-shot latch and "stopped at …" markers from sessionStorage (shared
+  `slopkit-poops:*` keys used by both chains) so every launch restarts the full chain.
+- `app.js` mirrors each chain's screen/stage/early/summary into the log (errors, stage changes
+  and summary verdicts) and receives the `?autoload` result via `postMessage`. For p2jb it
+  additionally parses the exploit's pinned `#livestat` readout (upstream repaints it at 1 Hz)
+  and renders a dedicated statistics panel (`#p2jbStats`) below the log with phase and overall
+  progress bars, clocks, and live worker metrics. While visible, the panel replaces the slim
+  progress bar and collapses once the payload is sent. All DOM updates are change-guarded and
+  polling synchronizes with upstream's 1 Hz ticker so UI updates do not contend with exploit execution.
 
 `payload.elf` is a virtual name: the PC host serves the installer ELF there, the homescreen app
-serves the real unified-autoloader. Both exploits autoload the same `payload.elf`. umtx2 (FW
+serves the real unified-autoloader. All exploits autoload the same `payload.elf`. umtx2 (FW
 1.00–5.50) boots its **own bundled elfldr** (`/app/<version>/umtx2/payloads/elfldr-ps5.elf`, kept
-from the umtx2 submodule like stock umtx2); slopkit (9.00–12.00) boots the **shared elfldr**
+from the umtx2 submodule like stock umtx2); poops and p2jb (7.00–12.70) boot the **shared elfldr**
 (`/app/<version>/shared/elfldr-ps5.elf`).
 
 ## Native installer (`src/`)
@@ -121,7 +126,8 @@ dev server.
   staging handoff (`dist/VERSION`), writes the `__complete__` marker, substitutes the tokens
   in the pointer page and the app's versioned `index.html`, lists the pointer and marker LAST
   in the manifest, and replaces the `[[EXPLOIT_MODE]]` token in `app.js` from the
-  `FORCE_EXPLOIT` env (default `auto`). Unused exploit payloads and assets are filtered out.
+  `FORCE_EXPLOIT` env (`auto | umtx2 | poops | p2jb`, default `auto`). Unused exploit payloads
+  and assets are filtered out.
 - `build_release.sh` builds the ELF in a Dockerized SDK and the host script; CI
   (`.github/workflows/release.yml`) produces the versioned artifacts and the Windows `.exe`.
   `FORCE_EXPLOIT` is forwarded into the Docker build explicitly.
@@ -130,19 +136,24 @@ dev server.
 
 `slopkit` is a pinned, **pristine** submodule. The build copies it to the gitignored
 `frontend/autoloader/slopkit/` and applies `patches/slopkit-autoload.patch` there
-(`tools/apply_slopkit_patch.sh`, run automatically by the Makefile).
+(`tools/apply_slopkit_patch.sh`, run automatically by the Makefile). Its bundled `payloads/`
+dir is embedded as-is apart from the unused `.elf` files it ships — the registry/host filters
+keep only `kexp*.bin` from it, so bumping the submodule never requires script changes.
 
-The patch (in `slopkit/slopkit/poops.html` and `slopkit/slopkit/poops.js`):
+The patch (in `slopkit/slopkit/poops.html`, `poops.js` and `p2jb.html`):
 
 - `?autoload=<name>`: after the chain finishes and elfldr is up, sends the named payload from
-  `../../payloads/`. Upstream's `exactQuery()` (which refuses non-canonical URLs) is relaxed to
-  tolerate the extra `autoload` query key, and the iframe URL is the canonical production query
-  (`go=1&auto=1&production=1&trigger=netcontrol&attempts=8&only=<full ladder>&log=debug&payload=1`)
-  plus `autoload=payload.elf&v=final`.
-- A hidden `payload.elf` entry in slopkit's `PAYLOADS` list so `payloadIsListed()` accepts it.
-- Posts `{type:"wkal", kind:"autoload", ok, bytes}` to the parent page.
-- Loads the **shared elfldr** from `../../shared/elfldr-ps5.elf` instead of its bundled copy
-  (the kexp shellcode stays slopkit's own — it is firmware-specific).
+  `../../payloads/`. Upstream's `exactQuery()` (which refuses non-canonical URLs) is relaxed in
+  both pages to tolerate the extra `autoload` query key. The iframe URLs are the canonical
+  production queries — poops (`go=1&auto=1&production=1&trigger=netcontrol&attempts=8&only=<full
+  ladder>&log=debug&payload=1`) plus `autoload=payload.elf&v=final`, p2jb
+  (`go=1&auto=1&production=1&log=debug&payload=1`) plus the same autoload suffix.
+- A hidden `payload.elf` entry in each page's `PAYLOADS` list so `payloadIsListed()` accepts it.
+- Posts `{type:"wkal", kind:"autoload", ok, bytes}` (or `{ok:false, why}`) to the parent page —
+  poops from the end of its ladder, p2jb from its `showWin()` win handler after a 4 s wait for
+  elfldr to bind port 9021.
+- Loads the **shared elfldr** instead of the bundled copies: poops fetches
+  `../../shared/elfldr-ps5.elf` in `poops.js`, and p2jb's `P2JB_ELF_URL` points at the same file.
 
 To update slopkit: `git -C third_party/slopkit fetch && git -C third_party/slopkit checkout <commit>`,
 re-run the script, and regenerate the patch if it no longer applies
@@ -180,12 +191,11 @@ re-run the script, and regenerate `patches/umtx2-autoload.patch` if it no longer
 
 ## Shared elfldr
 
-slopkit boots the **shared** elfldr, served at `/app/<version>/shared/elfldr-ps5.elf` (staged
-from `frontend/autoloader/shared/`). `tools/download_deps.sh` fetches it from the pinned
+Both slopkit chains boot the **shared** elfldr, served at `/app/<version>/shared/elfldr-ps5.elf`
+(staged from `frontend/autoloader/shared/`). `tools/download_deps.sh` fetches it from the pinned
 `itsPLK/ps5-elfldr` release (tag `ELFLDR_TAG`), sha256-verifies it, and caches the digest in a
 `.sha256` sidecar so offline rebuilds work. umtx2 (FW 1.00–5.50) boots its **own** elfldr from
-the umtx2 submodule instead, matching stock umtx2 behavior. Future shared chain binaries
-(e.g. a kexp) can live in the versioned `/app/<version>/shared/` dir too.
+the umtx2 submodule instead, matching stock umtx2 behavior.
 
 ## Payload dependency
 

.github/screenshots/webkit_autoloader_installer.jpeg

@@ -3,10 +3,13 @@
 </p>
 <h1 align="center">PS5 WebKit Autoloader</h1>
 &nbsp;
-<p align="center">Automatically loads the WebKit exploit and your elf payloads.<br>Supports firmwares <b>1.00&ndash;5.50</b> and <b>9.00&ndash;12.00</b>.</p>
+<p align="center">Automatically loads the WebKit exploit and your elf payloads.<br>Supports firmwares <b>1.00&ndash;5.50</b> and <b>7.00&ndash;12.70</b>.</p>
 
-> [!NOTE]
-> Uses the [umtx2](https://github.com/idlesauce/umtx2) (FW 1.00–5.50) and [slopkit](https://github.com/jordyidk/slopkit) (FW 9.00–12.00) WebKit exploits under the hood with minimal changes (via patch files in `patches/`), so stability should match the originals.
+<p align="center">
+  <a href=".github/screenshots/webkit_autoloader.jpeg"><img src=".github/screenshots/webkit_autoloader.jpeg" width="260" alt="WebKit Autoloader - exploit running" /></a>
+  <a href=".github/screenshots/webkit_autoloader_installer.jpeg"><img src=".github/screenshots/webkit_autoloader_installer.jpeg" width="260" alt="Installer" /></a>
+  <a href=".github/screenshots/p2jb_ui.jpeg"><img src=".github/screenshots/p2jb_ui.jpeg" width="260" alt="P2JB live progress" /></a>
+</p>
 
 <p align="center">
     <b>Other Autoloaders:</b><br>
@@ -43,7 +46,7 @@ If you aren't jailbroken yet, you'll need to host the exploit locally on your PC
 1. Download `webkit-autoloader-host.py` (or the `.exe`) from the [Releases](https://github.com/itsPLK/ps5-webkit-autoloader/releases) and run it on a PC on your network.
 2. On your PS5, set your network's DNS server to your PC's IP address.
 3. Open the **User's Guide** from Settings to run the installer, which adds the **WebKit Autoloader** app to your homescreen.
-4. **Reboot once**, then launch **WebKit Autoloader** from the homescreen.
+4. Launch **WebKit Autoloader** from the homescreen.
 
 ## How to Use
 
@@ -87,7 +90,7 @@ The latest installer payload will re-create the homescreen app and refresh the c
 <Details>
 <Summary><i>How to use a custom ELF Loader?</i></Summary>
 
-On firmwares 9.00–12.00 (slopkit), the autoloader uses a custom version of **elfldr** that only accepts connections from the PS5 itself (localhost). This improves security by preventing unauthorized devices on your network from sending payloads to your console. On firmwares 1.00–5.50 (umtx2), the stock elfldr is booted.
+On firmwares 7.00–12.70 (slopkit: poops and p2jb), the autoloader uses a custom version of **elfldr** that only accepts connections from the PS5 itself (localhost). This improves security by preventing unauthorized devices on your network from sending payloads to your console. On firmwares 1.00–5.50 (umtx2), the stock elfldr is booted.
 
 If you want to use a "normal" ELF Loader that allows sending payloads from any device, you can simply load it through **Payload Manager**.
 
@@ -115,8 +118,9 @@ The technical internals and project architecture are documented in **[ARCHITECTU
 
 ## Credits
 
-* **[idlesauce](https://github.com/idlesauce)** & contributors — [umtx2](https://github.com/idlesauce/umtx2), the WebKit/kernel exploit chain used for firmware 1.00–5.50.
-* **[jordyidk](https://github.com/jordyidk)** & contributors — [slopkit](https://github.com/jordyidk/slopkit), the WebKit/kernel exploit chain used for firmware 9.00–12.00.
+* **[idlesauce](https://github.com/idlesauce)** & contributors — [umtx2](https://github.com/idlesauce/umtx2)
+* **[jordyidk](https://github.com/jordyidk)** & contributors — [slopkit](https://github.com/jordyidk/slopkit)
+* **[soniciso1](https://github.com/soniciso1)** — [pooP2JB](https://github.com/soniciso1/pooP2JB)
 * **[john-tornblom](https://github.com/john-tornblom)** — [ps5-payload-sdk](https://github.com/ps5-payload-dev/sdk/) and [elfldr](https://github.com/ps5-payload-dev/elfldr)
 * **[Mark Adler](https://github.com/madler)** — [puff.c](https://github.com/madler/zlib/tree/master/contrib/puff) (used to decompress embedded frontend files)
 * Everyone else contributing to the PS5 homebrew scene.