Phase 1.0S: official shsrv/hbldr provenance

Status: BIGAPP_CONTEXT_SOURCE_PROVEN_DEPLOYED_IDENTITY_UNPROVEN_DEVICE_PATH_BLOCKED

Date: 2026-07-22

This phase acquired and inspected only the official public ps5-payload-dev/shsrv Git source. No downloaded code was built or executed. No PS5 address was used, no connection or request was made, and no target source, target artifact, transfer package, installation package, or device client was created.

Provenance boundary

The official repository is https://github.com/ps5-payload-dev/shsrv. During the audit its master, latest release tag v0.19, and commit all resolved to 6f320637d56d344a0e7797753099e33238bbf146; the tree object is c26ce02b6c3ca4202993e039b3db7c28c353dee4. The clean, detached historical v0.7 worktree resolves to commit 74287f5db6b20320efd7892d7b29cf438fe7cb98 and tree 7184968c702afe038551bf3228cc25f455388bb6.

These source identities prove official implementations, not which shsrv binary—if any—is installed or running on the target PS5. No locally supplied shsrv/hbldr binary, package receipt, deployment log, or byte-exact device identity was found. The deployed identity remains UNPROVEN.

Why v0.7 and v0.19 are both relevant

The Phase-1.0Q LakeSnes source at commit a2db690123649c7ffbc68a663af31efb3a41bf3f states that shsrv v0.7 or later is required and launches the emulator with hbldr. Therefore v0.7 is the oldest source-bound implementation relevant to that port documentation. Version v0.19 is the latest official release inspected during Phase 1.0S.

The hbldr family began at commit 4a70b50eecab853408f0a93a579b90428369fa09 as an experimental loader that injects an ELF into a web application. The significant lineage is:

Point	Commit/tag	Source-proven behavior
introduction	`4a70b50eecab853408f0a93a579b90428369fa09`	inject an ELF into a webapp process
LakeSnes minimum	`v0.7`, `74287f5...`	launch VideoPlayer BigApp `PPSA01659`, replace its process image
fake-game transition	`18e9a62aea801b5a1be4a692dba76bf5381e9fcb`	attach homebrew to a created fake game
first release containing transition	`v0.8`	fake-app/system-ex path present
current official release	`v0.19`, `6f32063...`	launch `FAKE00000`, replace its process image

An official tag or source lineage is not deployed-use proof. The current device may use no shsrv, a historical build, a current build, or a modified binary.

Exact source identities

v0.19

File	Size	SHA-256
`README.md`	3,546	`4855fa2adbe1fc0c7aa0174aa3275742d9b9aba3d818ae09cf2722a89b06cd34`
`shsrv.c`	5,293	`6ec71b4eb6c2bc1159f21568c1c9834f8aecac8d8881113bf09cf8981be19ee3`
`sh.c`	13,278	`3c4b7f76efdd157436ed4b353ee1b550bf3ff9df17c147b4762b767982fc8253`
`elfldr.c`	17,911	`4aa31f5a942681f8d88281b9713f087ced8963de842438cacad1088933f8e785`
`bundles/hbldr/main.c`	1,520	`6fa519888f79fe0458a983a517073c1eccc61239edfbe40d607f69b6b38a8af4`
`bundles/hbldr/hbldr.c`	13,438	`0096f86a00fdedcbc7509db47eb0f54dbc3e487d37e699f3de79048bac001be9`

v0.7

File	Size	SHA-256
`README.md`	3,248	`3d16e46416dd07940fcde1190a6ab558348bc80263da615331dda0f3eb6183ed`
`shsrv.c`	4,716	`66197d08308180fe923aa8aedc91bd5025f08938156ae3092ea2c69d0ad0be57`
`sh.c`	8,449	`bf97bc6dd3f49345ad8da9a29b28a5d6bcde5e53a6f32c60a538d6e187c7e05a`
`elfldr.c`	17,920	`1ff6cfa1300a95e8be48e5f7adc1413e3384ba04ea266c167fcd441ef20197d1`
`bundles/hbldr/main.c`	7,134	`2081ece2f7d0a7e9b392660696c2a44802f64680365607e742b37dcf3223a55a`

PacBrew relationship

PacBrew commit c2abcfcb60f569128abd0e8e70ad03a67bee5ea7 contains an shsrv recipe that clones the official repository, uses pkgver=git, and declares sha256sums=('SKIP'). It installs shsrv.elf, but does not pin the fetched shsrv commit or prove which package was installed on the target. It is SOURCE_REPOSITORY_ASSOCIATION, not byte-exact deployment provenance.

Proven and unproven conclusions

SOURCE_PROVEN:

the official hbldr family creates or launches a BigApp and replaces that process with the requested ELF;
v0.7 and v0.19 differ materially from raw elfldr's SceSpZeroConf process;
both variants read the target ELF from a device path;
both may terminate the currently running BigApp and perform kernel/ptrace process mutations;
v0.19 may remount and persistently populate /system_ex/app/FAKE00000.

UNPROVEN:

which shsrv/hbldr binary is deployed;
whether FAKE00000 already exists on the target;
whether the launcher works on the specific firmware-9.60 runtime;
whether BigApp substitution provides the missing VideoOut permission;
whether it would make the exact RetroArch first submit succeed;
crash, cleanup, reboot, and visibility behavior on the target.

The source difference is a STRONG_SOURCE_CANDIDATE_NOT_PROVEN_ROOT_CAUSE. It does not authorize using hbldr, staging an ELF, connecting to shsrv, or creating a replacement launcher.

5.0 KiB Raw Blame History