1.4 KiB
Phase 1.0DI: live-acquisition boundary
Status: OFFLINE_WORK_COMPLETE_EXACT_CONSOLE_PERMISSION_REQUIRED
The DH query is ready, but no byte-exact appinfo.db snapshot exists. The
controlled elfldr and Payload Manager expose no binary-safe readback. Official
shsrv v0.7 has a raw cat candidate; audited v0.9-v0.19 routes shell output
through libtelnet NVT text framing, which cannot be treated as byte-exact
database transport. The deployed family and exact binary identity are unknown.
A shell grep is not a substitute: finding the title text does not prove that
it is a tbl_appinfo.titleId row, while no output cannot prove absence. There
is no further offline input that can select a safe acquisition route.
The minimum next observation is the already modelled T2 family fingerprint:
one connection to the console's shsrv port 2323, one exact ASCII batch
help\n, at most 65,536 received bytes and a ten-second hard deadline. The
collector retains only a sanitized source-family classification, never raw
serial, telemetry or transcript. It performs no file read, transfer, payload
execution, title launch, app termination or device write, and permits no retry
or reconnect.
The tracked window is inactive and target-free. A live attempt requires a new exact permission containing a numeric target, run ID and bounded time window. Approval for earlier elfldr runs does not carry to this shsrv observation.