relapse-exploit-docker/docs/payload-evidence

Payload candidate evidence: kstuff-lite and ShadowMountPlus

Evidence date: 2026-10-02

This directory records a controlled intake and startup smoke test of two payload candidates on a PS5 running firmware 13.20. The verified payloads were sent once, in dependency order, from net-utils01 to the console's ELF loader. No downloaded binary is stored in this repository or left in the server's temporary directory.

The machine-readable handoff for a future payload-manager repository is manifest-2026-10-02.v1.json. It deliberately imports both candidates as disabled and not favorited. Runtime success does not implicitly enable a catalog entry. User state such as active/inactive and favorite must be stored separately from source evidence.

Selected releases

Payload	Release and commit	Release asset	Size	SHA-256
kstuff-lite	v1.11, 85fb88a526e58e357d6f1e626ce05af4acdb8b5d	kstuff.elf	1,737,080	ab9a6cb4d3b1daf139d4d646e402b1cf569071acd64599c936d7a3a6164dc779
ShadowMountPlus	1.7beta3, f0d15ffc46e9237d41cc3555b1cf11362d9a32e0	shadowmountplus.elf	2,437,848	2a7427e20ba7a70bd8cd01e47eb00ee7ca82db82dff3da7884f48f9c3fcbe95a
ShadowMountPlus support bundle	1.7beta3, same commit	ShadowMountPlus_1.7beta3.zip	1,352,255	2fb8edd89f2390a4a6a7b568ed9c5f34db01705781e0f3f386beb6612d29b6aa

The files were downloaded from the release URLs recorded in the manifest. Each locally calculated digest matched the SHA-256 digest returned by GitHub's release API. The ELF inside the ShadowMountPlus ZIP was also byte-for-byte identical to the separately published shadowmountplus.elf.

Static findings

Both payloads are stripped, dynamically linked, position-independent ELF64 x86-64 executables. Static inspection alone cannot establish that a privileged payload is safe.

The kstuff-lite v1.11 release states support for firmware 1.00 through 13.60, which includes the target firmware 13.20. ShadowMountPlus documents kstuff-lite v1.07 or newer as a dependency, so the intended order is kstuff-lite first and ShadowMountPlus second.

ShadowMountPlus contains HTTP, HTTPS and networking support. Its supplied default configuration enables an HTTP API only on loopback 127.0.0.1:10101; automatic AMPR downloading is disabled; mounts are read-only; forced mounts and persistent mounts are disabled. Do not change the API bind address to 0.0.0.0 without a separate firewall and threat review. Upstream also warns that mounting images can cause shutdown problems and data corruption.

Provenance limitations

• GitHub release digests demonstrate that the downloaded bytes match the assets currently registered by GitHub. They do not prove benign behavior.
• Neither release provides a detached signature, SBOM, or build attestation for the ELF. Both referenced source commits are unsigned.
• kstuff-lite's CI downloads a toolchain through a mutable releases/latest URL.
• ShadowMountPlus's workflow checks out build dependencies without immutable commit pins.
• This review did not reproduce either ELF from source. The relationship between each binary and its source commit is therefore asserted by the publisher, not independently proven by a reproducible build.
• A tag and its release assets can be moved or replaced upstream. The payload manager must treat the recorded SHA-256 and size as authoritative and reject any mismatch instead of silently accepting replacement bytes.

Runtime smoke-test evidence

At 2026-10-02T12:42:02Z, the two hash-verified ELFs were sent sequentially from net-utils01 (192.168.20.30) to the PS5 (192.168.40.14) over TCP 9021. The Relapse page had already reached elfldr is listening on port 9021; no R2 action was involved.

The observed sequence was:

1. kstuff.elf v1.11 connected successfully. Its output reported app.db patching and a successful SceShellUI trophy IsServerAvailable patch.
2. After more than two seconds, shadowmountplus.elf 1.7beta3 connected successfully. It detected firmware 13.20, reported kstuff runtime control ready, installed its SceShellCore hooks, started the game lifecycle watcher, synchronized the library with zero games found and started its API on loopback 127.0.0.1:10101.

The effective first-run defaults kept mounts read-only, forced and persistent mounting disabled, automatic AMPR downloads disabled, and the API unavailable to the LAN. The temporary copies of both ELFs were removed from net-utils01 after the send.

This is a startup smoke test only. No image was mounted, and suspend/resume, shutdown, reboot, API actions, gameplay stability and automatic kstuff pause/resume were not tested.

Payload-manager import contract

The manager should:

1. import the versioned JSON manifest without executing or downloading anything;
2. keep catalog evidence separate from per-user enabled and favorite state;
3. fetch an artifact only on explicit request into a quarantine/cache directory;
4. require the exact byte size and SHA-256 before moving it into the usable cache;
5. reject redirects that end outside the expected GitHub release infrastructure, or at minimum record and display the final origin;
6. never resolve a mutable latest URL for these pinned records;
7. enforce dependency and load order: kstuff-lite, confirmation, then ShadowMountPlus;
8. record every send attempt with payload ID, version, digest, target, timestamp, result and operator identity, without storing credentials in the log.

Release discovery may propose newer versions, but it must create a new candidate record and require review. It must never overwrite the evidence for an already approved digest.

For integration with Y2JB Autoloader, keep the manager as the executor of the post-jailbreak chain. The autoloader should stop after Relapse and an externally reachable, reviewed ELF loader are ready. Do not duplicate kstuff-lite or ShadowMountPlus in autoload.txt, because their execution would bypass manager hash checks, dependency handling and audit records. The default loopback-only loader must be replaced or explicitly configured for the LAN integration; access must remain restricted by firewall to 192.168.20.30 → 192.168.40.14:9021.

The first manager profile should encode kstuff-lite, positive startup evidence, at least 4000 ms delay, then ShadowMountPlus. An open port is not positive startup evidence. Runtime state is valid only for the current console boot and must be invalidated after reboot or ambiguous connectivity loss.

Controlled runtime-test procedure

The current Relapse flow ends at elfldr is listening on port 9021; there is no R2 step. Use the following procedure for a repeat test only after explicit operator approval:

1. confirm the PS5 is on firmware 13.20 and the ELF loader is visibly listening;
2. confirm the sender-to-PS5 firewall rule is limited to TCP 9021 on the LAN;
3. re-download and verify kstuff.elf against the recorded size and SHA-256;
4. send only kstuff-lite and record the console result before doing anything else;
5. confirm how the loader accepts the second payload and re-establish it if needed;
6. re-download and verify shadowmountplus.elf, then send it separately;
7. verify the on-console notification and /data/shadowmount/debug.log;
8. leave the API loopback-only and automatic downloads disabled for the first test;
9. avoid suspend, forced shutdown and writable mounts until the basic lifecycle has been observed successfully.

A TCP connection probe is not a payload test. Do not infer runtime success from an open port. Keep each execution as an independent runtime record rather than overwriting this evidence.