relapse-exploit-docker/docs/payload-evidence/README.md

# Payload candidate evidence: kstuff-lite and ShadowMountPlus

Evidence date: 2026-10-02

This directory records a controlled intake and startup smoke test of two payload
candidates on a PS5 running firmware 13.20. The verified payloads were sent once,
in dependency order, from `net-utils01` to the console's ELF loader. No downloaded
binary is stored in this repository or left in the server's temporary directory.

The machine-readable handoff for a future payload-manager repository is
[`manifest-2026-10-02.v1.json`](manifest-2026-10-02.v1.json). It deliberately
imports both candidates as disabled and not favorited. Runtime success does not
implicitly enable a catalog entry. User state such as
active/inactive and favorite must be stored separately from source evidence.

## Selected releases

| Payload | Release and commit | Release asset | Size | SHA-256 |
| --- | --- | --- | ---: | --- |
| kstuff-lite | `v1.11`, `85fb88a526e58e357d6f1e626ce05af4acdb8b5d` | `kstuff.elf` | 1,737,080 | `ab9a6cb4d3b1daf139d4d646e402b1cf569071acd64599c936d7a3a6164dc779` |
| ShadowMountPlus | `1.7beta3`, `f0d15ffc46e9237d41cc3555b1cf11362d9a32e0` | `shadowmountplus.elf` | 2,437,848 | `2a7427e20ba7a70bd8cd01e47eb00ee7ca82db82dff3da7884f48f9c3fcbe95a` |
| ShadowMountPlus support bundle | `1.7beta3`, same commit | `ShadowMountPlus_1.7beta3.zip` | 1,352,255 | `2fb8edd89f2390a4a6a7b568ed9c5f34db01705781e0f3f386beb6612d29b6aa` |

The files were downloaded from the release URLs recorded in the manifest. Each
locally calculated digest matched the SHA-256 digest returned by GitHub's release
API. The ELF inside the ShadowMountPlus ZIP was also byte-for-byte identical to
the separately published `shadowmountplus.elf`.

## Static findings

Both payloads are stripped, dynamically linked, position-independent ELF64 x86-64
executables. Static inspection alone cannot establish that a privileged payload is
safe.

The kstuff-lite v1.11 release states support for firmware 1.00 through 13.60, which
includes the target firmware 13.20. ShadowMountPlus documents kstuff-lite v1.07 or
newer as a dependency, so the intended order is kstuff-lite first and
ShadowMountPlus second.

ShadowMountPlus contains HTTP, HTTPS and networking support. Its supplied default
configuration enables an HTTP API only on loopback `127.0.0.1:10101`; automatic
AMPR downloading is disabled; mounts are read-only; forced mounts and persistent
mounts are disabled. Do not change the API bind address to `0.0.0.0` without a
separate firewall and threat review. Upstream also warns that mounting images can
cause shutdown problems and data corruption.

## Provenance limitations

- GitHub release digests demonstrate that the downloaded bytes match the assets
  currently registered by GitHub. They do not prove benign behavior.
- Neither release provides a detached signature, SBOM, or build attestation for
  the ELF. Both referenced source commits are unsigned.
- kstuff-lite's CI downloads a toolchain through a mutable `releases/latest` URL.
- ShadowMountPlus's workflow checks out build dependencies without immutable
  commit pins.
- This review did not reproduce either ELF from source. The relationship between
  each binary and its source commit is therefore asserted by the publisher, not
  independently proven by a reproducible build.
- A tag and its release assets can be moved or replaced upstream. The payload
  manager must treat the recorded SHA-256 and size as authoritative and reject any
  mismatch instead of silently accepting replacement bytes.

## Runtime smoke-test evidence

At `2026-10-02T12:42:02Z`, the two hash-verified ELFs were sent sequentially from
`net-utils01` (`192.168.20.30`) to the PS5 (`192.168.40.14`) over TCP 9021. The
Relapse page had already reached `elfldr is listening on port 9021`; no R2 action
was involved.

The observed sequence was:

1. `kstuff.elf` v1.11 connected successfully. Its output reported `app.db`
   patching and a successful SceShellUI trophy `IsServerAvailable` patch.
2. After more than two seconds, `shadowmountplus.elf` 1.7beta3 connected
   successfully. It detected firmware 13.20, reported kstuff runtime control ready,
   installed its SceShellCore hooks, started the game lifecycle watcher, synchronized
   the library with zero games found and started its API on loopback
   `127.0.0.1:10101`.

The effective first-run defaults kept mounts read-only, forced and persistent
mounting disabled, automatic AMPR downloads disabled, and the API unavailable to
the LAN. The temporary copies of both ELFs were removed from `net-utils01` after
the send.

This is a startup smoke test only. No image was mounted, and suspend/resume,
shutdown, reboot, API actions, gameplay stability and automatic kstuff
pause/resume were not tested.

## Payload-manager import contract

The manager should:

1. import the versioned JSON manifest without executing or downloading anything;
2. keep catalog evidence separate from per-user `enabled` and `favorite` state;
3. fetch an artifact only on explicit request into a quarantine/cache directory;
4. require the exact byte size and SHA-256 before moving it into the usable cache;
5. reject redirects that end outside the expected GitHub release infrastructure,
   or at minimum record and display the final origin;
6. never resolve a mutable `latest` URL for these pinned records;
7. enforce dependency and load order: kstuff-lite, confirmation, then
   ShadowMountPlus;
8. record every send attempt with payload ID, version, digest, target, timestamp,
   result and operator identity, without storing credentials in the log.

Release discovery may propose newer versions, but it must create a new candidate
record and require review. It must never overwrite the evidence for an already
approved digest.

For integration with Y2JB Autoloader, keep the manager as the executor of the
post-jailbreak chain. The autoloader should stop after Relapse and an externally
reachable, reviewed ELF loader are ready. Do not duplicate kstuff-lite or
ShadowMountPlus in `autoload.txt`, because their execution would bypass manager
hash checks, dependency handling and audit records. The default loopback-only
loader must be replaced or explicitly configured for the LAN integration; access
must remain restricted by firewall to `192.168.20.30 → 192.168.40.14:9021`.

The first manager profile should encode kstuff-lite, positive startup evidence,
at least 4000 ms delay, then ShadowMountPlus. An open port is not positive startup
evidence. Runtime state is valid only for the current console boot and must be
invalidated after reboot or ambiguous connectivity loss.

## Controlled runtime-test procedure

The current Relapse flow ends at `elfldr is listening on port 9021`; there is no R2
step. Use the following procedure for a repeat test only after explicit operator
approval:

1. confirm the PS5 is on firmware 13.20 and the ELF loader is visibly listening;
2. confirm the sender-to-PS5 firewall rule is limited to TCP 9021 on the LAN;
3. re-download and verify `kstuff.elf` against the recorded size and SHA-256;
4. send only kstuff-lite and record the console result before doing anything else;
5. confirm how the loader accepts the second payload and re-establish it if needed;
6. re-download and verify `shadowmountplus.elf`, then send it separately;
7. verify the on-console notification and `/data/shadowmount/debug.log`;
8. leave the API loopback-only and automatic downloads disabled for the first test;
9. avoid suspend, forced shutdown and writable mounts until the basic lifecycle has
   been observed successfully.

A TCP connection probe is not a payload test. Do not infer runtime success from an
open port. Keep each execution as an independent runtime record rather than
overwriting this evidence.