docs: record PS5 payload and Y2JB tests
This commit is contained in:
@@ -0,0 +1,128 @@
|
||||
# Payload candidate evidence: kstuff-lite and ShadowMountPlus
|
||||
|
||||
Evidence date: 2026-10-02
|
||||
|
||||
This directory records a controlled intake and startup smoke test of two payload
|
||||
candidates on a PS5 running firmware 13.20. The verified payloads were sent once,
|
||||
in dependency order, from `net-utils01` to the console's ELF loader. No downloaded
|
||||
binary is stored in this repository or left in the server's temporary directory.
|
||||
|
||||
The machine-readable handoff for a future payload-manager repository is
|
||||
[`manifest-2026-10-02.v1.json`](manifest-2026-10-02.v1.json). It deliberately
|
||||
imports both candidates as disabled and not favorited. Runtime success does not
|
||||
implicitly enable a catalog entry. User state such as
|
||||
active/inactive and favorite must be stored separately from source evidence.
|
||||
|
||||
## Selected releases
|
||||
|
||||
| Payload | Release and commit | Release asset | Size | SHA-256 |
|
||||
| --- | --- | --- | ---: | --- |
|
||||
| kstuff-lite | `v1.11`, `85fb88a526e58e357d6f1e626ce05af4acdb8b5d` | `kstuff.elf` | 1,737,080 | `ab9a6cb4d3b1daf139d4d646e402b1cf569071acd64599c936d7a3a6164dc779` |
|
||||
| ShadowMountPlus | `1.7beta3`, `f0d15ffc46e9237d41cc3555b1cf11362d9a32e0` | `shadowmountplus.elf` | 2,437,848 | `2a7427e20ba7a70bd8cd01e47eb00ee7ca82db82dff3da7884f48f9c3fcbe95a` |
|
||||
| ShadowMountPlus support bundle | `1.7beta3`, same commit | `ShadowMountPlus_1.7beta3.zip` | 1,352,255 | `2fb8edd89f2390a4a6a7b568ed9c5f34db01705781e0f3f386beb6612d29b6aa` |
|
||||
|
||||
The files were downloaded from the release URLs recorded in the manifest. Each
|
||||
locally calculated digest matched the SHA-256 digest returned by GitHub's release
|
||||
API. The ELF inside the ShadowMountPlus ZIP was also byte-for-byte identical to
|
||||
the separately published `shadowmountplus.elf`.
|
||||
|
||||
## Static findings
|
||||
|
||||
Both payloads are stripped, dynamically linked, position-independent ELF64 x86-64
|
||||
executables. Static inspection alone cannot establish that a privileged payload is
|
||||
safe.
|
||||
|
||||
The kstuff-lite v1.11 release states support for firmware 1.00 through 13.60, which
|
||||
includes the target firmware 13.20. ShadowMountPlus documents kstuff-lite v1.07 or
|
||||
newer as a dependency, so the intended order is kstuff-lite first and
|
||||
ShadowMountPlus second.
|
||||
|
||||
ShadowMountPlus contains HTTP, HTTPS and networking support. Its supplied default
|
||||
configuration enables an HTTP API only on loopback `127.0.0.1:10101`; automatic
|
||||
AMPR downloading is disabled; mounts are read-only; forced mounts and persistent
|
||||
mounts are disabled. Do not change the API bind address to `0.0.0.0` without a
|
||||
separate firewall and threat review. Upstream also warns that mounting images can
|
||||
cause shutdown problems and data corruption.
|
||||
|
||||
## Provenance limitations
|
||||
|
||||
- GitHub release digests demonstrate that the downloaded bytes match the assets
|
||||
currently registered by GitHub. They do not prove benign behavior.
|
||||
- Neither release provides a detached signature, SBOM, or build attestation for
|
||||
the ELF. Both referenced source commits are unsigned.
|
||||
- kstuff-lite's CI downloads a toolchain through a mutable `releases/latest` URL.
|
||||
- ShadowMountPlus's workflow checks out build dependencies without immutable
|
||||
commit pins.
|
||||
- This review did not reproduce either ELF from source. The relationship between
|
||||
each binary and its source commit is therefore asserted by the publisher, not
|
||||
independently proven by a reproducible build.
|
||||
- A tag and its release assets can be moved or replaced upstream. The payload
|
||||
manager must treat the recorded SHA-256 and size as authoritative and reject any
|
||||
mismatch instead of silently accepting replacement bytes.
|
||||
|
||||
## Runtime smoke-test evidence
|
||||
|
||||
At `2026-10-02T12:42:02Z`, the two hash-verified ELFs were sent sequentially from
|
||||
`net-utils01` (`192.168.20.30`) to the PS5 (`192.168.40.14`) over TCP 9021. The
|
||||
Relapse page had already reached `elfldr is listening on port 9021`; no R2 action
|
||||
was involved.
|
||||
|
||||
The observed sequence was:
|
||||
|
||||
1. `kstuff.elf` v1.11 connected successfully. Its output reported `app.db`
|
||||
patching and a successful SceShellUI trophy `IsServerAvailable` patch.
|
||||
2. After more than two seconds, `shadowmountplus.elf` 1.7beta3 connected
|
||||
successfully. It detected firmware 13.20, reported kstuff runtime control ready,
|
||||
installed its SceShellCore hooks, started the game lifecycle watcher, synchronized
|
||||
the library with zero games found and started its API on loopback
|
||||
`127.0.0.1:10101`.
|
||||
|
||||
The effective first-run defaults kept mounts read-only, forced and persistent
|
||||
mounting disabled, automatic AMPR downloads disabled, and the API unavailable to
|
||||
the LAN. The temporary copies of both ELFs were removed from `net-utils01` after
|
||||
the send.
|
||||
|
||||
This is a startup smoke test only. No image was mounted, and suspend/resume,
|
||||
shutdown, reboot, API actions, gameplay stability and automatic kstuff
|
||||
pause/resume were not tested.
|
||||
|
||||
## Payload-manager import contract
|
||||
|
||||
The manager should:
|
||||
|
||||
1. import the versioned JSON manifest without executing or downloading anything;
|
||||
2. keep catalog evidence separate from per-user `enabled` and `favorite` state;
|
||||
3. fetch an artifact only on explicit request into a quarantine/cache directory;
|
||||
4. require the exact byte size and SHA-256 before moving it into the usable cache;
|
||||
5. reject redirects that end outside the expected GitHub release infrastructure,
|
||||
or at minimum record and display the final origin;
|
||||
6. never resolve a mutable `latest` URL for these pinned records;
|
||||
7. enforce dependency and load order: kstuff-lite, confirmation, then
|
||||
ShadowMountPlus;
|
||||
8. record every send attempt with payload ID, version, digest, target, timestamp,
|
||||
result and operator identity, without storing credentials in the log.
|
||||
|
||||
Release discovery may propose newer versions, but it must create a new candidate
|
||||
record and require review. It must never overwrite the evidence for an already
|
||||
approved digest.
|
||||
|
||||
## Controlled runtime-test procedure
|
||||
|
||||
The current Relapse flow ends at `elfldr is listening on port 9021`; there is no R2
|
||||
step. Use the following procedure for a repeat test only after explicit operator
|
||||
approval:
|
||||
|
||||
1. confirm the PS5 is on firmware 13.20 and the ELF loader is visibly listening;
|
||||
2. confirm the sender-to-PS5 firewall rule is limited to TCP 9021 on the LAN;
|
||||
3. re-download and verify `kstuff.elf` against the recorded size and SHA-256;
|
||||
4. send only kstuff-lite and record the console result before doing anything else;
|
||||
5. confirm how the loader accepts the second payload and re-establish it if needed;
|
||||
6. re-download and verify `shadowmountplus.elf`, then send it separately;
|
||||
7. verify the on-console notification and `/data/shadowmount/debug.log`;
|
||||
8. leave the API loopback-only and automatic downloads disabled for the first test;
|
||||
9. avoid suspend, forced shutdown and writable mounts until the basic lifecycle has
|
||||
been observed successfully.
|
||||
|
||||
A TCP connection probe is not a payload test. Do not infer runtime success from an
|
||||
open port. Keep each execution as an independent runtime record rather than
|
||||
overwriting this evidence.
|
||||
Reference in New Issue
Block a user