Publish Chimera GFX source

2026-09-03 03:27:14 +02:00
commit a6037502d7
828 changed files with 100454 additions and 0 deletions
@@ -0,0 +1,115 @@
+# Phase 0.9D existing-stack readback feasibility
+
+Date: 2026-07-18
+Decision: `BLOCKED_NO_READBACK_PATH`
+
+## Route search, in required order
+
+| Order | Candidate | Source result | Binary framing | Short-read / EOF / size | Decision |
+|---:|---|---|---|---|---|
+| 1 | Payload Manager download | no endpoint exists | absent | absent | `ABSENT` |
+| 2 | Payload Manager file read | internal reads are not returned to HTTP client | absent | absent | `ABSENT` |
+| 3 | elfldr response or host pipe | controlled route returns fixed status text and disables payload stdio; legacy stdio requires a payload process | no file protocol | no file completeness contract | rejected |
+| 4 | exploit host | README sends host-to-PS5; implementation absent | no reverse framing | unproven | rejected |
+| 5 | browser/USB host | browser uploads toward PS5; USB move writes device storage | reverse direction or mutating | no host-copy contract | rejected |
+| 6 | repository tools | deploy scripts send through port 9021 only | no reverse framing | absent | rejected |
+| 7 | no route | all audited paths exhausted | — | — | selected |
+
+Hardened elfldr `socksrv.c:288-375` sends only rejection, error, or
+`Controlled payload exited` status. The payload data is discarded after
+loading and controlled stdio is `-1`. Controlled Manager
+`verified_launcher.c:31-184` verifies and sends a descriptor to elfldr and then
+closes; `ps5_launcher.c:18-69` exposes connect/send/close only. Neither side
+contains a receive path for component bytes.
+
+## Flag semantics
+
+### `server_active_flag`
+
+- Declaration and initial value: static volatile integer initialized to zero,
+  `src/log_server.c:20-23`.
+- Sole writer: `log_server_set_active()` assigns one.
+- Sole reader: `pldmgr_server_is_active()`, used by
+  `src/autoload.c:101` only to suppress fallback notification behavior while a
+  browser/server request has occurred.
+- Reset: none in the process.
+- Lifetime: process-local; it cannot persist as this variable after process
+  exit or reboot. Exact manager process lifetime on hardware is unobserved.
+- No source path connects it to filesystem writes, autoload enablement,
+  payload launch, request authorization, shutdown, or boot configuration.
+- Disconnect does not reset it; a crash/process exit destroys the process
+  state.
+
+Classification: `LOW_VOLATILE`, not `ANTI_BRICK_CRITICAL`. Because there is no
+reset semantic within the running process, any otherwise observational route
+remains `PARTIAL` and a future permission must explicitly accept this effect,
+log-ring changes, connection state, buffers, sockets, and counters.
+
+### `autoload_triggered`
+
+- Declaration/initial value: static volatile integer zero,
+  `src/autoload.c:31`.
+- Writers: `pldmgr_autoload_get_status()` sets one (`:45`);
+  `pldmgr_autoload_reset()` sets zero (`:235`).
+- Readers: autoload worker wait logic at `:82-86`.
+- `/autoload_status` calls the mutating getter before building its response
+  (`src/http_server.c:1037-1041`).
+- Reset is explicit clear/resume logic, not disconnect cleanup.
+- It is process-local, but can change worker timing and therefore launch
+  behavior while that process exists.
+
+Classification: `HIGH_FUNCTIONAL`. `/autoload_status` is excluded from
+Windows 1 and 2. The later duplicate route at `http_server.c:1104-1111` is
+unreachable because the first identical comparison already matches.
+
+## Path inventory
+
+| Literal path | Source | Meaning | Live status | Evidence |
+|---|---|---|---|---|
+| `/data/pldmgr` | controlled Manager `include/pldmgr.h:8` | base device directory | configured default only | source literal |
+| `/data/pldmgr/payloads` | same `:12` | payload storage | configured default only | source literal |
+| `/data/pldmgr/autoload.txt` | same `:9` | Manager autoload list | configured default only | source literal |
+| `/data/pldmgr/pldmgr_config.txt` | same `:10` | Manager config | configured default only | source literal |
+| `/data/pldmgr/repository_cache.json` | same `:11` | repository cache | configured default only | source literal |
+| `/data/pldmgr/sources.json` | same `:14` | repository sources | configured default only | source literal |
+| `/mnt/usb0/pldmgr` … `/mnt/usb7/pldmgr` | `payload_mgr.c:201-218` | USB scan roots | possible source directories | source literal/pattern |
+| `/data/pldmgr/payloads/chimera-controlled` | controlled Manager source/profile | controlled staging directory | explicitly not installed | offline candidate only |
+| `/data/pldmgr/payloads/elfldr/elfldr_v0.23.elf` | historical Phase-0.6 manifest/tool input | stock identity reference | not runtime-observed | `reference_only` |
+| `/data/pldmgr/payloads/pldmgr/pldmgr_v0.3.1.elf` | historical Phase-0.6 manifest/tool input | stock identity reference | not runtime-observed | `reference_only` |
+| `/data/payload.elf` | elfldr README example | generic manual launch example | not a current mapping | documentation example |
+| `/user/temp/payload_<pid>.self` | elfldr self-loader source | temporary converted image | runtime-generated, not component live path | source template |
+| `/system/vsh/app/NPXS40112/eboot.bin` | elfldr bootstrap source | injection victim executable | not an elfldr installation path | source literal |
+
+No audited input binds an actual live elfldr or Manager object to a current
+path. The package/reference paths and configured defaults therefore produce
+`PATH_CONFLICT`; no future readback window may guess.
+
+## Readback decision matrix
+
+- `NEW_OBSERVER_FEASIBILITY`: `BLOCKED`
+- `EXISTING_STACK_MANUAL_FACT_COLLECTION`: `PARTIAL`
+- `EXISTING_STACK_SINGLE_READBACK`: `BLOCKED_NO_READBACK_PATH`
+- `EXISTING_STACK_REPEAT_READBACK`: `BLOCKED`
+- `ELFLDR_INDEPENDENT_RECOVERY`: `PARTIAL`
+- `PAYLOAD_MANAGER_INDEPENDENT_RECOVERY`: `PARTIAL`
+- `SIDE_BY_SIDE_FEASIBILITY`: `BLOCKED`
+- `DEVICE_WRITE`: `NOT_AUTHORIZED`
+- `TARGET_EXECUTION`: `NOT_AUTHORIZED`
+- `INSTALLATION`: `NOT_AUTHORIZED`
+
+There is no possible first readback component: the component-risk order cannot
+override an absent transport. A missing metadata query would merely reduce a
+copy to `SOURCE_MAPPING_PARTIAL`; here the earlier condition—getting complete
+binary bytes—already fails.
+
+## Explicitly acceptable only after later consent
+
+A future read-only request could reasonably entail sockets, temporary buffers,
+heap allocation, connection/request counters, scheduler activity, cache or
+atime effects, audit/process/network accounting, stdout logging, ring logging,
+and a process-local `server_active_flag=1`. These effects are not claimed
+absent. They are acceptable only if the chosen route has no device-file write,
+launch, autoload, service, or persistent configuration effect and the
+artifact-specific permission names them.
+
+No such permission is requested in Phase 0.9D.