Phase 0.9E-R official Y2JB port audit

Date: 2026-07-18

Port-9020 classification: PORT_9020_REFERENCE_ONLY

Exact 9020 search

Every official tag (Y2JB-1.2.1, 1.3, 1.4, 1.5, 1.6) has exactly two 9020 text references:

README.md: a payload_sender.py ... 9020 payload.bin example;
payload_sender.py:29: the same usage example.

No tag contains a socket bind, listen, connect target, parser, mapper, ELF loader, or dispatch function fixed to port 9020. Therefore the example cannot be promoted to an implementation.

Actual Remote JS Loader

At release 1.6 commit 0dbbf4e7e0203af7e5d101a3256c634edf4e3ba2, the implementation is download0/cache/splash_screen/aHR0cHM6Ly93d3cueW91dHViZS5jb20vdHY=/remotejsloader.js.

Lines	Function / block	Contract
2–8	allocation	fixed `MAXSIZE = 500 * 1024`; one 512000-byte receive buffer
10–39	`create_socket`	TCP/IPv4, `SO_REUSEADDR`, `INADDR_ANY`, port 0, backlog 3
41–47	`get_port`	reads assigned ephemeral port
49–88	`setup_socket_until_port_50000`	creates/closes up to 60000 sockets seeking assigned port 50000; falls back to last port
90–105	`recreate_socket`	creates a new ephemeral listener after accept failure
107–119	initial setup	reports actual IP and port
122–209	accept loop	infinite accept/read/decode/eval loop
145–164	receive loop	reads until EOF or 512000 bytes; partial reads accumulate
168–188	validation	rejects empty/error; 1.6 rejects ELF magic only
190–203	dispatch	UTF-8 decode, `eval`, same-connection log writes, close in `finally`

Protocol properties:

server: PS5-side JavaScript listener;
expected port: normally 50000, but explicitly dynamic;
framing: TCP connection close/EOF;
maximum accepted prefix: 512000 bytes;
content: JavaScript; 1.6 rejects only 7f 45 4c 46;
authentication: none;
declared length, version, checksum, or hash: none;
timeout: none;
full-limit rejection: absent; reaching 512000 bytes can dispatch the prefix without proving EOF;
native mapping/entrypoint: absent; received bytes are text-decoded and evaluated;
filesystem write: none in this receive function;
retry behavior: internal listener allocation/recreation loops exist;
crash/hang risk: untrusted JavaScript evaluation, unbounded accept lifetime, blocking reads, and no deadline.

The 1.2.1/1.3 loader uses Git blob 21663be4a0fab6b6a829824946f54706fb1be839; 1.4/1.5 use decb42ba0bbd2bdc8d1568d33b6d772f9fe24d8e; 1.6 uses dd4957530e7a88c889877a7dcb3433642a71e019. Release 1.6 added ELF-magic rejection. Release 1.4 added streaming logs over the accepted connection.

This is a concrete official implementation, but it is not a port-9020 implementation.

Lapse and port 9021

The official chain is:

Remote JS Loader (~50000) → lapse.js → load_aioshellcode → embedded kexp + elfldr bytes → elfldr listener 9021

Relevant source:

payloads/lapse.js:1707-1717 requires load_aioshellcode and rejects firmware above 10.01;
payloads/lapse.js:1725-1734 creates a per-run lapse.fail marker;
payloads/lapse.js:1639 calls load_aioshellcode after exploit setup;
aioshellcode.js:12-24 locates embedded files in sandbox slots;
aioshellcode.js:26-45 maps the kexp binary with JIT shared executable memory;
aioshellcode.js:47-76 starts and joins its thread;
aioshellcode.js:78-90 reads the embedded elfldr into process memory;
aioshellcode.js:107-117 passes pipe state, allproc, elfldr address, and size to the embedded binary;
misc.js:262-302 treats a successful loopback connection to 9021 as a jailbroken/elfldr-running signal;
README.md:127-137 tells the host to send an ELF to 9021 after Lapse.

The port-9021 listener itself is contained in an ELF binary. Y2JB contains no generator or listener source for the 1.6 ELF. Release 1.5 embeds the already pinned public elfldr v0.23 asset byte-for-byte; release 1.6 embeds a distinct binary. No 1.6 elfldr source commit is invented.

Safety classification

The Remote JS Loader is independent of an already running elfldr and Payload Manager at source-architecture level, but deployed use is unbound because the local backup is not an official outer asset. It also uses ~50000, not 9020.

Consequently:

PORT_9020_IMPLEMENTATION_FOUND: false;
PORT_9020_IMPLEMENTATION_PARTIAL: false;
PORT_9020_REFERENCE_ONLY: true;
Phase 0.9F offline design allowed: false.

Security and robustness findings

Finding	Classification	Evidence and consequence
Receiver dispatches UTF-8 through `eval`	`SESSION_CRASH_RISK`	arbitrary JavaScript can hang or terminate the current exploit session
No receiver deadline; infinite accept loop	`SESSION_CRASH_RISK`	blocked reads and repeated listener lifetime have no bounded cleanup
Buffer limit can dispatch without proven EOF	`PROTOCOL_INTEGRITY_RISK`	a 512000-byte prefix can be treated as complete
No length, authentication, checksum, or hash	`PROTOCOL_INTEGRITY_RISK`	source does not bind received bytes to an intended request
Sender has no timeout, acknowledgement, response read, or hash	`PROTOCOL_INTEGRITY_RISK`	local `sendall` completion is not peer receipt or execution proof
Lapse creates `common_temp/lapse.fail`	`UNKNOWN`	source proves a filesystem side effect, but deployed persistence and reboot semantics remain unobserved
Lapse/kexp intentionally changes kernel state	`BRICK_RELEVANT`	it is outside every authorization in this phase and cannot be treated as read-only
Embedded 1.6 elfldr has no source/generator	`UNKNOWN`	listener bounds, parser, mapping, cleanup, and crash behavior cannot be source-audited here
Sender usage errors return implicit success	`HOST_ONLY`	automation could misread a local invocation error; no device action occurred

A session crash is not automatically a brick: the reviewed Remote JS receive function does not itself replace a live file or enable autoload. However, the local backup is unbound and the subsequent Lapse path contains explicit kernel and filesystem effects, so no device-risk conclusion or recovery guarantee is promoted from that source architecture.

Firmware selection and reboot boundary

At release 1.6:

main.js:681-729 identifies supported YouTube app layouts and labels versions 01.000.003, 01.000.030, and 01.009.202 with minimum firmware 4.03, 12.20, and 13.20 respectively;
misc.js:92-108 obtains kern.sdk_version and formats the firmware value;
main.js:967-971 assigns and reports that value;
payloads/lapse.js:1707-1717 requires load_aioshellcode and rejects versions above 10.01.

Thus 9.60 passes the release-source comparison in Lapse. It does not prove that release 1.6 is deployed, that its masks match the device, or that the runtime chain succeeds.

Listener sockets, JavaScript state, mappings, threads, and loaded code are process- or kernel-resident in source architecture. The Y2JB cache and lapse.fail path are filesystem state. Source alone does not prove which state a reboot removes, whether the original trigger remains usable, or whether a crash permits clean restart. The classification stays REBOOT_RECOVERY_UNPROVEN.

7.2 KiB Raw Permalink Blame History Unescape Escape