3.6 KiB
Phase 1.0D loader-to-entry analysis
Status: RETROARCH_PS5_ENTRY_DIAGNOSTIC_LADDER_BUILT_OFFLINE.
Nothing in this phase authorizes a PS5 connection, transfer, or execution.
Source-bound path
The analysis binds hardened elfldr commit
197623058f509eddde18868dafcb92fdcac66464, SDK v0.41 commit
d2e2e585740362976a39fdd5ccf390f199a7bc37, and chimera-retroarch
commit 69b65858ffaee826d70f5c0df61013cd1b0e2048.
| Order | Source operation | Observable marker | Failure status |
|---|---|---|---|
| 1 | elfldr sanity checks the received buffer | none | host receipt and this check remain unobservable |
| 2 | elfldr reserves/copies segments, applies relative relocations and protections | none | allocation, mapping, copy, protection, or sync can fail |
| 3 | elfldr creates payload_args_t, saves a synthetic return at RSP-8, sets entry RIP and passes args in RDI |
none | resource setup and register writes can fail |
| 4 | SDK _start clears BSS |
none | loader/stack/entry correctness is still required |
| 5 | payload_init calls __crt_syscall_init, __kernel_init, __klog_init, resolves and sets __isthreaded |
none | any failed setup returns before main |
| 6 | __patch_init changes current-process credentials/capability attributes and the permitted syscall-address range |
none | exact runtime success and firmware-9.60 behavior are unproven |
| 7 | __rtld_init, dependency opening, relocation and init-array handling |
none | a missing module/import or relocation failure can stop before main |
| 8 | canary main or RetroArch main |
C1 or D00 | first Phase-1.0D visible boundary |
| 9 | profile body and bounded teardown | D01-D12 for early diagnostic | raw boundary result is retained in memory |
| 10 | _Exit selected by the profile |
D12 precedes it in the early profile | device exit behavior remains unproven |
The earliest possible failure is therefore before _start: elfldr receipt,
validation, mapping, argument-resource construction, or register transfer.
After entry, the earliest application-independent failure is BSS/SDK CRT
initialization. Neither C1 nor D00 can distinguish those earlier steps.
Loader and artifact effects
The existing loader itself performs process mapping, protection, ptrace-style register operations, socket-overlap setup for the SDK argument resources, and kernel/process changes in its broader execution path. The normal SDK CRT also performs the bounded source-visible writes described above. Phase 1.0D does not call any of this: it only builds and audits files offline. These effects must not be described as harmless or absent in any later run authorization.
No SDK CRT or hardened elfldr source was modified. No freestanding startup was introduced. Static model acceptance is not proof of transport, receipt, execution, firmware compatibility, visible notification, or safe exit.
Complexity comparison
| Artifact | Bytes | Entry | PHDRs / LOADs | Relocations | Imports | DT_NEEDED | BSS bytes | Largest LOAD memory |
|---|---|---|---|---|---|---|---|---|
| Phase-1.0B smoke | 1,826,216 | 0xfdd70 |
4 / 3 | 1,053 | 140 | 7 | 697,232 | 903,360 |
| CRT canary | 106,344 | 0x290 |
4 / 3 | 144 | 4 | 2 | 2,512 | 35,312 |
| early diagnostic | 1,844,664 | 0xfec40 |
4 / 3 | 1,054 | 141 | 7 | 697,616 | 903,744 |
| lifecycle reference | 112,680 | 0x90 |
4 / 3 | 142 | 2 | 2 | not used as a Phase-1.0D claim | not used as a Phase-1.0D claim |
The canary materially reduces size, imports, modules, and relocation volume. The comparison can isolate classes of failure in a future authorized ladder; it does not establish which class caused Phase 1.0C.