81 lines
4.3 KiB
Markdown
81 lines
4.3 KiB
Markdown
# Phase 0.9E independent rescue chain
|
|
|
|
Date: 2026-07-18
|
|
|
|
Decision: `BOOTSTRAP_IMPLEMENTATION_MISSING`
|
|
|
|
## Dependency graph
|
|
|
|
```mermaid
|
|
flowchart LR
|
|
A["Operator trigger<br/>exact artifact missing"]
|
|
B["Y2JB/browser exploit host<br/>opaque candidate only"]
|
|
C["Rudimentary port-9020 listener<br/>implementation missing"]
|
|
D["Host sender<br/>README concept only"]
|
|
E["hardened elfldr-ps5.elf<br/>local reference build"]
|
|
F["embedded bootstrap<br/>source design"]
|
|
G["elfldr service :9021<br/>source design"]
|
|
H["controlled Payload Manager<br/>offline reference build"]
|
|
|
|
A --> B --> C
|
|
D --> C
|
|
C --> E --> F --> G --> H
|
|
```
|
|
|
|
| Node | Environment / side | State | Start/input/output | Dependencies | Device file / autoload | Recovery role | Evidence |
|
|
|---|---|---|---|---|---|---|---|
|
|
| operator trigger | host/browser | unknown | unknown | exact package | unknown | begins jailbreak session | `UNKNOWN` |
|
|
| Y2JB/exploit host | browser/host | unknown | opaque backup candidate | trigger/package | unknown | could recreate 9020 state | `POSSIBLE` |
|
|
| rudimentary loader | PS5 process/kernel context unknown | unknown | presumed listener on 9020 | exploit | unknown | candidate rescue executor | implementation missing |
|
|
| conceptual sender | host | temporary | host connects and streams an ELF per README | working listener | no sender-side device path | sends elfldr | architecture only |
|
|
| hardened elfldr bootstrap | PS5 | temporary entry, then background service design | final ELF embeds bootstrap and service | 9020 execution | source itself does not install, but performs documented process/kernel changes | creates port 9021 | exact local source, not deployed-use proof |
|
|
| elfldr service | PS5 process | background design | listens TCP 9021 | hardened bootstrap | no autoload source path | later payload executor | exact source, hardware unproven |
|
|
| controlled Manager | PS5 process | not installed in evidence | separate launch via elfldr | elfldr 9021 | controlled storage if used; no autoload | management layer | offline reference only |
|
|
|
|
No node before hardened elfldr has a source-bound executable identity.
|
|
|
|
## Required questions
|
|
|
|
1. **Who listens on 9020?** Unknown. The elfldr README calls it a
|
|
“rudimentary ELF loader”; no implementation is present.
|
|
2. **Who starts it?** Presumably the exploit chain, but exact trigger and
|
|
process are unknown.
|
|
3. **Before elfldr?** Architecturally yes; exact implementation proof is
|
|
absent.
|
|
4. **Available again after reboot?** Plausible for a repeatable jailbreak, not
|
|
proven for the used package.
|
|
5. **Requires working elfldr on filesystem?** Architecture says no; exact
|
|
loader proof is absent, so `independent_from_elfldr=unproven`.
|
|
6. **Requires Payload Manager?** Architecture says no; exact proof is absent,
|
|
so `independent_from_payload_manager=unproven`.
|
|
7. **Can it receive a payload directly?** The README assumes an elfldr ELF can
|
|
be sent; limits and exact acceptance are unknown.
|
|
8. **Accepted format?** The sender streams ELF bytes. Server validation,
|
|
container rules, and truncation behavior are unknown.
|
|
9. **Automatic execution?** Required by the described bootstrap, but no server
|
|
source proves it.
|
|
10. **Writes a device file first?** Unknown.
|
|
11. **Can it execute without live replacement?** Plausible, not proven.
|
|
12. **Restart after a payload crash?** Unknown.
|
|
13. **Does reboot remove temporary state?** Plausible, not proven.
|
|
14. **Depends on autoload?** No architectural requirement is documented, but
|
|
actual configuration is absent.
|
|
15. **Works with both later components absent?** Conceptual chain says yes;
|
|
exact implementation is missing.
|
|
16. **Rescue without filesystem write?** Unknown.
|
|
17. **Independent result channel?** No exact result/output contract exists.
|
|
18. **Hardware-unproven aspects:** all process identities, boot persistence,
|
|
port behavior, parser behavior, mapping/entry, file writes, cleanup,
|
|
crash/hang response, and reboot recovery.
|
|
|
|
## Independence decision
|
|
|
|
An architectural diagram alone permits at most
|
|
`PARTIAL_RESCUE_EXECUTOR`. Here, the actual executable implementation itself
|
|
is unavailable, so the more precise required classification is:
|
|
|
|
`BOOTSTRAP_IMPLEMENTATION_MISSING`
|
|
|
|
This does not mean the chain is dependent; it means independence cannot be
|
|
audited. `phase09f_rescue_payload_design_allowed=false`.
|