80 lines
3.4 KiB
Markdown
80 lines
3.4 KiB
Markdown
# Phase 1.0AE: minimal BigApp launcher architecture
|
|
|
|
Status: `V07_NONPERSISTENT_LINEAGE_SELECTED_TARGET_IMPLEMENTATION_BLOCKED`
|
|
|
|
Date: 2026-07-29
|
|
|
|
## Objective
|
|
|
|
Identify the shortest public-source route from the proven raw-ELF VideoOut
|
|
failure to one bounded launch-context experiment. This is an offline source
|
|
review. It adds no target source, artifact, socket, transfer or execution.
|
|
|
|
## Source decision
|
|
|
|
Official shsrv v0.19 is not an acceptable base. Its hbldr path can remount
|
|
`/system_ex`, persistently create `FAKE00000`, copy an executable, kill the
|
|
running BigApp and enter unbounded ptrace/wait loops.
|
|
|
|
Official shsrv v0.7 is the selected reference lineage because it launches the
|
|
existing VideoPlayer WebApp title `PPSA01659` and contains no fake-app creation
|
|
or system-ex remount in its hbldr bundle. Selection is not authorization and
|
|
does not prove that the title exists, launches, owns VideoOut or behaves the
|
|
same way on firmware 9.60.
|
|
|
|
## Required minimal callgraph
|
|
|
|
The future design may model only this sequence:
|
|
|
|
1. validate one exact payload hash and fixed argument vector;
|
|
2. query the foreground user;
|
|
3. require that no BigApp is currently running;
|
|
4. attach to the source-proven SystemService parent;
|
|
5. arm bounded fork and exec observation before launch;
|
|
6. request launch of the fixed existing `PPSA01659` title;
|
|
7. detach the parent on every path;
|
|
8. replace only the newly observed child with the exact payload;
|
|
9. restore every temporary instruction and credential mutation;
|
|
10. detach the child or terminate only that newly created child on failure;
|
|
11. emit a bounded inherited result and stop.
|
|
|
|
The architecture must fail closed when a BigApp already exists. It must never
|
|
call `sceSystemServiceKillApp` as part of the experiment.
|
|
|
|
## Removed upstream behavior
|
|
|
|
- general Telnet shell and arbitrary command parsing;
|
|
- PATH search, arbitrary filesystem path and target-side ELF read;
|
|
- `FAKE00000`, `fakeapp_create_if_missing` and `remount_system_ex`;
|
|
- package installation, autoload and persistent writes;
|
|
- `hbdbg`, GDB wait and free-form arguments;
|
|
- arbitrary root/jail broadening unless separately proven indispensable and
|
|
exactly restored;
|
|
- unbounded `waitpid`, `pt_await_child`, `pt_await_exec`, `pt_call` and
|
|
`pt_syscall` loops;
|
|
- killing or replacing any pre-existing process;
|
|
- retry, reconnect and fallback title selection.
|
|
|
|
## Unclosed contracts
|
|
|
|
Target implementation remains blocked until an offline design proves:
|
|
|
|
- a deadline-capable wait primitive for every wait/step boundary;
|
|
- unique child correlation without acting on an unrelated process;
|
|
- complete parent detach and child cleanup for every failure edge;
|
|
- exact restoration of breakpoint bytes, page protections, credentials,
|
|
environment, root and jail changes;
|
|
- bounded ELF size, headers, segments, relocations and allocation;
|
|
- exact firmware-9.60 availability and role of `PPSA01659`, or a fail-closed
|
|
observation that does not install or mutate it;
|
|
- accepted public evidence for every SystemService/UserService declaration;
|
|
- an explicit policy for the unavoidable kernel/ptrace effects.
|
|
|
|
## Decision
|
|
|
|
The persistent v0.19 route is rejected. v0.7 is the preferred public-source
|
|
reference for a nonpersistent BigApp experiment, but copying or compiling it
|
|
is still blocked. The next phase may implement only a host lifecycle model
|
|
with injected fake operations and exhaustive failure cleanup. It may not add
|
|
PS5 headers, target source, syscall numbers, a target build or device action.
|