{
  "artifact": {
    "built": false,
    "execution_eligible": false,
    "filename": null,
    "sha256": null,
    "size": null
  },
  "binary_evidence": {
    "disassembly_sha256": "a4af871eb9bf7df57e3f323972616f48dbffaadfea7afb3976404304cc80ca31",
    "dt_needed": [
      "libSceLibcInternal.sprx",
      "libSceNet.sprx",
      "libkernel_web.sprx"
    ],
    "entry_point": "0x4700",
    "init_fini_array_sizes": {
      "fini_array": 0,
      "init_array": 0,
      "preinit_array": 0
    },
    "load_segments": [
      {
        "file_size": 51455,
        "memory_size": 51455,
        "permissions": "RWE"
      },
      {
        "file_size": 33104,
        "memory_size": 33104,
        "permissions": "RW"
      },
      {
        "file_size": 264688,
        "memory_size": 267000,
        "permissions": "RW"
      }
    ],
    "readelf_report_sha256": "e0526deb23e40a3a8ad6f613dfbc3d5764ceb1cb770ce9e6fa1010c4e83ba9f9",
    "relocations": {
      "relative": 140,
      "total": 164
    },
    "tls_present": false,
    "undefined_dynamic_symbols": [
      "__error",
      "close",
      "execve",
      "free",
      "getpid",
      "kevent",
      "kill",
      "kqueue",
      "malloc",
      "memcpy",
      "memset",
      "open",
      "printf",
      "puts",
      "realloc",
      "recv",
      "rfork_thread",
      "sceKernelSendNotificationRequest",
      "strcmp",
      "strerror",
      "strlen",
      "sysctl",
      "vsnprintf",
      "waitpid"
    ]
  },
  "callgraph": {
    "edges": [
      [
        "Payload Manager /loadpayload:<path>",
        "ps5_launch_elf"
      ],
      [
        "ps5_launch_elf",
        "connect 127.0.0.1:9021"
      ],
      [
        "ps5_launch_elf",
        "send ELF bytes"
      ],
      [
        "serve_elfldr",
        "elfldr_spawn"
      ],
      [
        "elfldr_spawn",
        "rfork_thread"
      ],
      [
        "rfork_thread child",
        "elfldr_rfork_entry"
      ],
      [
        "elfldr_rfork_entry",
        "ptrace PT_TRACE_ME"
      ],
      [
        "elfldr_rfork_entry",
        "execve SceSpZeroConf"
      ],
      [
        "elfldr_spawn parent",
        "pt_syscall 599"
      ],
      [
        "elfldr_spawn parent",
        "install then restore INT3 byte"
      ],
      [
        "elfldr_spawn parent",
        "elfldr_exec"
      ],
      [
        "elfldr_exec",
        "elfldr_raise_privileges"
      ],
      [
        "elfldr_exec",
        "elfldr_prepare_exec"
      ],
      [
        "elfldr_prepare_exec",
        "elfldr_load"
      ],
      [
        "elfldr_prepare_exec",
        "elfldr_payload_args"
      ],
      [
        "elfldr_prepare_exec",
        "push observed RIP at RSP-8"
      ],
      [
        "elfldr_prepare_exec",
        "set RIP=payload entry"
      ],
      [
        "elfldr_prepare_exec",
        "set RDI=payload_args"
      ],
      [
        "elfldr_exec",
        "restore subset of credentials"
      ],
      [
        "elfldr_exec",
        "ptrace PT_DETACH"
      ],
      [
        "payload _start",
        "SDK __patch_init"
      ],
      [
        "payload _start",
        "payload main"
      ],
      [
        "payload _start",
        "payload_terminate"
      ],
      [
        "payload_terminate",
        "return or exit or trap"
      ]
    ],
    "entry": "Payload Manager /loadpayload:<path>",
    "extraction": "reviewed source edges with required-token assertions"
  },
  "decision": "BLOCKED_VERSION_OR_UNBOUNDED_EFFECT",
  "effects": [
    {
      "blocker": false,
      "classification": "EXPECTED_VOLATILE_RUNTIME_EFFECT",
      "evidence": [
        "elfldr/main.c:48-59"
      ],
      "id": "elfldr_first_stage_qaflags_enable",
      "scope": "existing_loader_bootstrap"
    },
    {
      "blocker": true,
      "classification": "UNBOUNDED_OR_UNKNOWN",
      "evidence": [
        "elfldr/main.c:61-105 restores jail/root/caps/authid",
        "UID is changed by elfldr_raise_privileges but is not backed up or restored"
      ],
      "id": "elfldr_first_stage_privilege_restore",
      "scope": "existing_exploit_host_process"
    },
    {
      "blocker": false,
      "classification": "PAYLOAD_PROCESS_LOCAL",
      "evidence": [
        "elfldr/elfldr.c:570-710"
      ],
      "id": "payload_process_creation",
      "scope": "new_SceSpZeroConf_child"
    },
    {
      "blocker": false,
      "classification": "RESTORED_BY_LOADER",
      "evidence": [
        "elfldr/pt.c:35-54"
      ],
      "id": "ptrace_authid_restore_success_path",
      "scope": "elfldr_service_process"
    },
    {
      "blocker": true,
      "classification": "UNBOUNDED_OR_UNKNOWN",
      "evidence": [
        "elfldr/pt.c:50-51 returns after failed restoration",
        "no second restoration or process shutdown is present"
      ],
      "id": "ptrace_authid_restore_failure_path",
      "scope": "elfldr_service_process"
    },
    {
      "blocker": true,
      "classification": "UNBOUNDED_OR_UNKNOWN",
      "evidence": [
        "elfldr/pt.c:238-246",
        "elfldr/pt.c:291-299"
      ],
      "id": "ptrace_single_step_completion",
      "scope": "loader_control_path"
    },
    {
      "blocker": false,
      "classification": "RESTORED_BY_LOADER",
      "evidence": [
        "elfldr/elfldr.c:675-700"
      ],
      "id": "breakpoint_byte",
      "scope": "payload_child"
    },
    {
      "blocker": false,
      "classification": "PAYLOAD_PROCESS_LOCAL",
      "evidence": [
        "elfldr/elfldr.c:669 changes page to RWX",
        "no source edge restores the original protection"
      ],
      "id": "breakpoint_page_permissions",
      "scope": "payload_child"
    },
    {
      "blocker": true,
      "classification": "UNBOUNDED_OR_UNKNOWN",
      "evidence": [
        "elfldr/elfldr.c:447-513 restores jail/root/caps/authid",
        "UID is set to zero and is not restored"
      ],
      "id": "payload_credentials",
      "scope": "payload_child"
    },
    {
      "blocker": true,
      "classification": "UNBOUNDED_OR_UNKNOWN",
      "evidence": [
        "elfldr/elfldr.c:143-343",
        "successful detach has no explicit unmap/close cleanup",
        "cleanup depends on an unproven child termination path"
      ],
      "id": "payload_mapping_args_sockets_pipes",
      "scope": "payload_child"
    },
    {
      "blocker": false,
      "classification": "PAYLOAD_PROCESS_LOCAL",
      "evidence": [
        "sdk/crt/crt.c",
        "sdk/crt/patch.c"
      ],
      "id": "sdk_patch_init",
      "scope": "payload_child"
    },
    {
      "blocker": true,
      "classification": "UNBOUNDED_OR_UNKNOWN",
      "evidence": [
        "sdk/crt/crt.c payload_terminate may return, call exit, or trap",
        "the exact branch for the injected SceSpZeroConf child is not proven"
      ],
      "id": "sdk_termination_branch",
      "scope": "payload_child"
    },
    {
      "blocker": true,
      "classification": "UNBOUNDED_OR_UNKNOWN",
      "evidence": [
        "elfldr/elfldr.c:703-710 detaches and returns the PID",
        "no 2000 ms watchdog, wait, kill, or retry budget is present"
      ],
      "id": "payload_runtime_limit",
      "scope": "detached_payload_child"
    },
    {
      "blocker": true,
      "classification": "UNBOUNDED_OR_UNKNOWN",
      "evidence": [
        "elfldr/socksrv.c:400 ignores SIGCHLD",
        "post-detach exit/resource cleanup semantics are not documented"
      ],
      "id": "child_reaping",
      "scope": "elfldr_service_process"
    },
    {
      "blocker": true,
      "classification": "UNBOUNDED_OR_UNKNOWN",
      "evidence": [
        "pldmgr/http_server.c resolves a path then calls ps5_launch_elf",
        "pldmgr/ps5_launcher.c streams bytes without calculating or checking SHA-256"
      ],
      "id": "payload_manager_launch_hash_binding",
      "scope": "payload_manager_to_elfldr"
    },
    {
      "blocker": true,
      "classification": "PERSISTENT_WRITE",
      "evidence": [
        "pldmgr/http_server.c writes /data/pldmgr/payloads/<name>.tmp",
        "the upload is committed into payload storage"
      ],
      "id": "payload_manager_upload",
      "scope": "payload_manager_storage"
    }
  ],
  "firmware": {
    "device_attested": false,
    "evidence": "user_provided_only",
    "exact": "9.60"
  },
  "hard_blockers": [
    "child_reaping",
    "elfldr_first_stage_privilege_restore",
    "exact_exploit_and_autoloader_identity_unproven",
    "firmware_9_60_not_independently_device_attested",
    "payload_credentials",
    "payload_manager_launch_hash_binding",
    "payload_manager_upload",
    "payload_mapping_args_sockets_pipes",
    "payload_runtime_limit",
    "ptrace_authid_restore_failure_path",
    "ptrace_single_step_completion",
    "return_continuation_after_payload_start_unproven",
    "sdk_termination_branch"
  ],
  "identity": {
    "elfldr": {
      "commit": "699e8bcff03e91e8d6ca6eba281af25c5a58d8c2",
      "dirty": false,
      "installed_asset_hash_match": true,
      "observed_inventory_path": "/data/pldmgr/payloads/elfldr/elfldr_v0.23.elf",
      "observed_inventory_sha256": "092d16ee0ede0c494947efd38d1a17bbd7cc4b022d3858ea898833c188c703e8",
      "observed_inventory_version": "v0.23",
      "release": "v0.23",
      "release_asset_sha256": "092d16ee0ede0c494947efd38d1a17bbd7cc4b022d3858ea898833c188c703e8",
      "release_asset_size": 397000,
      "repository": "https://github.com/ps5-payload-dev/elfldr.git"
    },
    "exact_exploit_autoloader": {
      "identified": false,
      "local_candidate": {
        "filename": "Y2JB-Autoloader-403-1240.zip",
        "sha256": "805e3f87f0c371223619ffc7d3a7b3c0d41a1fae8a8b1171d9e2f162659e8291",
        "size": 504159435,
        "status": "local_backup_candidate_not_installed_identity_proof"
      },
      "status": "UNPROVEN"
    },
    "payload_manager": {
      "commit": "cfbc70f30f419b09bf2b52283f7409e2d3117ee1",
      "dirty": false,
      "installed_asset_hash_match": true,
      "observed_inventory_path": "/data/pldmgr/payloads/pldmgr/pldmgr_v0.3.1.elf",
      "observed_inventory_sha256": "518740adbacccb9094fadb07dd424c53ee290f38306449ccc9d6957fdf813c0b",
      "observed_inventory_version": "v0.3.1",
      "observed_version_endpoint": "0.3.1",
      "release": "v0.3.1",
      "release_asset_sha256": "518740adbacccb9094fadb07dd424c53ee290f38306449ccc9d6957fdf813c0b",
      "repository": "https://github.com/itsPLK/ps5-payload-manager.git"
    },
    "sdk": {
      "commit": "d2e2e585740362976a39fdd5ccf390f199a7bc37",
      "dirty": false,
      "release": "v0.41",
      "repository": "https://github.com/ps5-payload-dev/sdk.git"
    }
  },
  "no_console_actions": {
    "elf_executed": false,
    "elf_transferred": false,
    "gnm": false,
    "raw_port_9021_contacted": false,
    "rendering": false,
    "videoout": false
  },
  "observation_scope": {
    "date": "2026-07-17",
    "payload_manager_routes": [
      "/autoload_status",
      "/get_config",
      "/list_payloads",
      "/log",
      "/sources_list",
      "/version"
    ],
    "payload_manager_routes_read_only": true,
    "strict_status_port_744_result": "ECONNREFUSED"
  },
  "phase": "0.6",
  "schema_version": 1,
  "source_evidence": {
    "elfldr": [
      {
        "normalization": "lf",
        "path": "work/upstream/elfldr-v0.23/main.c",
        "sha256": "51176f0c864af2eb269dff37a7148ec31f72cfa593e7edf85df04685d9639fef",
        "size": 2792
      },
      {
        "normalization": "lf",
        "path": "work/upstream/elfldr-v0.23/elfldr.c",
        "sha256": "2c6ec9f00b346e23bc9fff6b1077072dce7309b59536f420e8578aac9a95fc03",
        "size": 18071
      },
      {
        "normalization": "lf",
        "path": "work/upstream/elfldr-v0.23/elfldr.h",
        "sha256": "48c6840304bf914003d1c9f54efbde7b6ee6317692ddce47443d0c0abf73fe08",
        "size": 1260
      },
      {
        "normalization": "lf",
        "path": "work/upstream/elfldr-v0.23/pt.c",
        "sha256": "8c87c76850587e671b8ad49f1f0e98489a7b1f4bf789da84bcfbb21918d6b046",
        "size": 7489
      },
      {
        "normalization": "lf",
        "path": "work/upstream/elfldr-v0.23/pt.h",
        "sha256": "09a51aef9723f5314b29175875410e55274fa5b4e6708ef7d76599712ae387e4",
        "size": 2391
      },
      {
        "normalization": "lf",
        "path": "work/upstream/elfldr-v0.23/socksrv.c",
        "sha256": "6cc6887969754befa7424da981ea2cc778940c0d45e7bcc7abd99ec1ec39522e",
        "size": 8385
      },
      {
        "normalization": "lf",
        "path": "work/upstream/elfldr-v0.23/Makefile",
        "sha256": "468ac60791fb09885face7d383d0cf43b0fd7afde1c20fb0984d0bb4999fc6fc",
        "size": 1592
      }
    ],
    "payload_manager": [
      {
        "normalization": "lf",
        "path": "work/upstream/pldmgr-v0.3.1/src/ps5_launcher.c",
        "sha256": "082836bfd7a9726f62ea0dad8b7be99a31ab30130bf4f1165bf4bf52acd8673c",
        "size": 4794
      },
      {
        "normalization": "lf",
        "path": "work/upstream/pldmgr-v0.3.1/src/http_server.c",
        "sha256": "362175cb576bcd1e07209987c42fee2cfe515bdd31d1c8588d531570c2ca5a0c",
        "size": 46713
      },
      {
        "normalization": "lf",
        "path": "work/upstream/pldmgr-v0.3.1/src/autoload.c",
        "sha256": "117545fcc3b45e71c97cca2675d772c72fea25523f0ffb66e8b4cf989da32d85",
        "size": 9197
      },
      {
        "normalization": "lf",
        "path": "work/upstream/pldmgr-v0.3.1/src/main.c",
        "sha256": "cd1af1f58f6275828c8a392371ef84a1e9e999a5e76345d0fe8bf3f92f7be51a",
        "size": 7030
      },
      {
        "normalization": "lf",
        "path": "work/upstream/pldmgr-v0.3.1/src/payload_mgr.c",
        "sha256": "65303c3696626fa20eb2d0e7f4da4c51a43d5bc4bc82904f416e7c3b74cf8fb7",
        "size": 18326
      },
      {
        "normalization": "lf",
        "path": "work/upstream/pldmgr-v0.3.1/include/pldmgr.h",
        "sha256": "b1881b943e38a1b8ecdc53e254b0187a011335e5117a36d0ab00e889cb8cb6f5",
        "size": 2450
      },
      {
        "normalization": "lf",
        "path": "work/upstream/pldmgr-v0.3.1/Makefile",
        "sha256": "6d02de74a46c104da3cd373d51911ebea1137190fe61bc6529403cbac5108004",
        "size": 3675
      }
    ],
    "sdk": [
      {
        "normalization": "lf",
        "path": "work/upstream/sdk/crt/crt.c",
        "sha256": "2695ae6cf23f867849590977e47edfd7743caa8f34255e6de9aa9eae9a4e4ea6",
        "size": 4462
      },
      {
        "normalization": "lf",
        "path": "work/upstream/sdk/crt/patch.c",
        "sha256": "a9cf1814874f3c2c4b337a23270a80ff159b2e6247f9781018bbe1def1845deb",
        "size": 2184
      },
      {
        "normalization": "lf",
        "path": "work/upstream/sdk/crt/kernel.c",
        "sha256": "10d2868647b684d7a7f20e029b6a8e792725fa484196a6e00e21c4507469fd12",
        "size": 37992
      },
      {
        "normalization": "lf",
        "path": "work/upstream/sdk/include/ps5/payload.h",
        "sha256": "752279ee971eee0dc1eda7286a0008caaf7cd34a99c7501d054d40866c0b8fdf",
        "size": 1304
      },
      {
        "normalization": "lf",
        "path": "work/upstream/sdk/crt/Makefile",
        "sha256": "4b4d8856ee05b751888bdc70e7ff146692ced7755644c140ff4a02a3cd154512",
        "size": 1596
      }
    ]
  }
}