56 lines
3.6 KiB
Markdown
56 lines
3.6 KiB
Markdown
# Phase 1.0D loader-to-entry analysis
|
|
|
|
Status: `RETROARCH_PS5_ENTRY_DIAGNOSTIC_LADDER_BUILT_OFFLINE`.
|
|
Nothing in this phase authorizes a PS5 connection, transfer, or execution.
|
|
|
|
## Source-bound path
|
|
|
|
The analysis binds hardened elfldr commit
|
|
`197623058f509eddde18868dafcb92fdcac66464`, SDK v0.41 commit
|
|
`d2e2e585740362976a39fdd5ccf390f199a7bc37`, and chimera-retroarch
|
|
commit `69b65858ffaee826d70f5c0df61013cd1b0e2048`.
|
|
|
|
| Order | Source operation | Observable marker | Failure status |
|
|
|---:|---|---|---|
|
|
| 1 | elfldr sanity checks the received buffer | none | host receipt and this check remain unobservable |
|
|
| 2 | elfldr reserves/copies segments, applies relative relocations and protections | none | allocation, mapping, copy, protection, or sync can fail |
|
|
| 3 | elfldr creates `payload_args_t`, saves a synthetic return at `RSP-8`, sets entry RIP and passes args in RDI | none | resource setup and register writes can fail |
|
|
| 4 | SDK `_start` clears BSS | none | loader/stack/entry correctness is still required |
|
|
| 5 | `payload_init` calls `__crt_syscall_init`, `__kernel_init`, `__klog_init`, resolves and sets `__isthreaded` | none | any failed setup returns before `main` |
|
|
| 6 | `__patch_init` changes current-process credentials/capability attributes and the permitted syscall-address range | none | exact runtime success and firmware-9.60 behavior are unproven |
|
|
| 7 | `__rtld_init`, dependency opening, relocation and init-array handling | none | a missing module/import or relocation failure can stop before `main` |
|
|
| 8 | canary `main` or RetroArch `main` | C1 or D00 | first Phase-1.0D visible boundary |
|
|
| 9 | profile body and bounded teardown | D01-D12 for early diagnostic | raw boundary result is retained in memory |
|
|
| 10 | `_Exit` selected by the profile | D12 precedes it in the early profile | device exit behavior remains unproven |
|
|
|
|
The earliest possible failure is therefore before `_start`: elfldr receipt,
|
|
validation, mapping, argument-resource construction, or register transfer.
|
|
After entry, the earliest application-independent failure is BSS/SDK CRT
|
|
initialization. Neither C1 nor D00 can distinguish those earlier steps.
|
|
|
|
## Loader and artifact effects
|
|
|
|
The existing loader itself performs process mapping, protection, ptrace-style
|
|
register operations, socket-overlap setup for the SDK argument resources, and
|
|
kernel/process changes in its broader execution path. The normal SDK CRT also
|
|
performs the bounded source-visible writes described above. Phase 1.0D does
|
|
not call any of this: it only builds and audits files offline. These effects
|
|
must not be described as harmless or absent in any later run authorization.
|
|
|
|
No SDK CRT or hardened elfldr source was modified. No freestanding startup was
|
|
introduced. Static model acceptance is not proof of transport, receipt,
|
|
execution, firmware compatibility, visible notification, or safe exit.
|
|
|
|
## Complexity comparison
|
|
|
|
| Artifact | Bytes | Entry | PHDRs / LOADs | Relocations | Imports | DT_NEEDED | BSS bytes | Largest LOAD memory |
|
|
|---|---:|---:|---:|---:|---:|---:|---:|---:|
|
|
| Phase-1.0B smoke | 1,826,216 | `0xfdd70` | 4 / 3 | 1,053 | 140 | 7 | 697,232 | 903,360 |
|
|
| CRT canary | 106,344 | `0x290` | 4 / 3 | 144 | 4 | 2 | 2,512 | 35,312 |
|
|
| early diagnostic | 1,844,664 | `0xfec40` | 4 / 3 | 1,054 | 141 | 7 | 697,616 | 903,744 |
|
|
| lifecycle reference | 112,680 | `0x90` | 4 / 3 | 142 | 2 | 2 | not used as a Phase-1.0D claim | not used as a Phase-1.0D claim |
|
|
|
|
The canary materially reduces size, imports, modules, and relocation volume.
|
|
The comparison can isolate classes of failure in a future authorized ladder;
|
|
it does not establish which class caused Phase 1.0C.
|