116 lines
6.6 KiB
Markdown
116 lines
6.6 KiB
Markdown
# Phase 0.9D existing-stack readback feasibility
|
|
|
|
Date: 2026-07-18
|
|
Decision: `BLOCKED_NO_READBACK_PATH`
|
|
|
|
## Route search, in required order
|
|
|
|
| Order | Candidate | Source result | Binary framing | Short-read / EOF / size | Decision |
|
|
|---:|---|---|---|---|---|
|
|
| 1 | Payload Manager download | no endpoint exists | absent | absent | `ABSENT` |
|
|
| 2 | Payload Manager file read | internal reads are not returned to HTTP client | absent | absent | `ABSENT` |
|
|
| 3 | elfldr response or host pipe | controlled route returns fixed status text and disables payload stdio; legacy stdio requires a payload process | no file protocol | no file completeness contract | rejected |
|
|
| 4 | exploit host | README sends host-to-PS5; implementation absent | no reverse framing | unproven | rejected |
|
|
| 5 | browser/USB host | browser uploads toward PS5; USB move writes device storage | reverse direction or mutating | no host-copy contract | rejected |
|
|
| 6 | repository tools | deploy scripts send through port 9021 only | no reverse framing | absent | rejected |
|
|
| 7 | no route | all audited paths exhausted | — | — | selected |
|
|
|
|
Hardened elfldr `socksrv.c:288-375` sends only rejection, error, or
|
|
`Controlled payload exited` status. The payload data is discarded after
|
|
loading and controlled stdio is `-1`. Controlled Manager
|
|
`verified_launcher.c:31-184` verifies and sends a descriptor to elfldr and then
|
|
closes; `ps5_launcher.c:18-69` exposes connect/send/close only. Neither side
|
|
contains a receive path for component bytes.
|
|
|
|
## Flag semantics
|
|
|
|
### `server_active_flag`
|
|
|
|
- Declaration and initial value: static volatile integer initialized to zero,
|
|
`src/log_server.c:20-23`.
|
|
- Sole writer: `log_server_set_active()` assigns one.
|
|
- Sole reader: `pldmgr_server_is_active()`, used by
|
|
`src/autoload.c:101` only to suppress fallback notification behavior while a
|
|
browser/server request has occurred.
|
|
- Reset: none in the process.
|
|
- Lifetime: process-local; it cannot persist as this variable after process
|
|
exit or reboot. Exact manager process lifetime on hardware is unobserved.
|
|
- No source path connects it to filesystem writes, autoload enablement,
|
|
payload launch, request authorization, shutdown, or boot configuration.
|
|
- Disconnect does not reset it; a crash/process exit destroys the process
|
|
state.
|
|
|
|
Classification: `LOW_VOLATILE`, not `ANTI_BRICK_CRITICAL`. Because there is no
|
|
reset semantic within the running process, any otherwise observational route
|
|
remains `PARTIAL` and a future permission must explicitly accept this effect,
|
|
log-ring changes, connection state, buffers, sockets, and counters.
|
|
|
|
### `autoload_triggered`
|
|
|
|
- Declaration/initial value: static volatile integer zero,
|
|
`src/autoload.c:31`.
|
|
- Writers: `pldmgr_autoload_get_status()` sets one (`:45`);
|
|
`pldmgr_autoload_reset()` sets zero (`:235`).
|
|
- Readers: autoload worker wait logic at `:82-86`.
|
|
- `/autoload_status` calls the mutating getter before building its response
|
|
(`src/http_server.c:1037-1041`).
|
|
- Reset is explicit clear/resume logic, not disconnect cleanup.
|
|
- It is process-local, but can change worker timing and therefore launch
|
|
behavior while that process exists.
|
|
|
|
Classification: `HIGH_FUNCTIONAL`. `/autoload_status` is excluded from
|
|
Windows 1 and 2. The later duplicate route at `http_server.c:1104-1111` is
|
|
unreachable because the first identical comparison already matches.
|
|
|
|
## Path inventory
|
|
|
|
| Literal path | Source | Meaning | Live status | Evidence |
|
|
|---|---|---|---|---|
|
|
| `/data/pldmgr` | controlled Manager `include/pldmgr.h:8` | base device directory | configured default only | source literal |
|
|
| `/data/pldmgr/payloads` | same `:12` | payload storage | configured default only | source literal |
|
|
| `/data/pldmgr/autoload.txt` | same `:9` | Manager autoload list | configured default only | source literal |
|
|
| `/data/pldmgr/pldmgr_config.txt` | same `:10` | Manager config | configured default only | source literal |
|
|
| `/data/pldmgr/repository_cache.json` | same `:11` | repository cache | configured default only | source literal |
|
|
| `/data/pldmgr/sources.json` | same `:14` | repository sources | configured default only | source literal |
|
|
| `/mnt/usb0/pldmgr` … `/mnt/usb7/pldmgr` | `payload_mgr.c:201-218` | USB scan roots | possible source directories | source literal/pattern |
|
|
| `/data/pldmgr/payloads/chimera-controlled` | controlled Manager source/profile | controlled staging directory | explicitly not installed | offline candidate only |
|
|
| `/data/pldmgr/payloads/elfldr/elfldr_v0.23.elf` | historical Phase-0.6 manifest/tool input | stock identity reference | not runtime-observed | `reference_only` |
|
|
| `/data/pldmgr/payloads/pldmgr/pldmgr_v0.3.1.elf` | historical Phase-0.6 manifest/tool input | stock identity reference | not runtime-observed | `reference_only` |
|
|
| `/data/payload.elf` | elfldr README example | generic manual launch example | not a current mapping | documentation example |
|
|
| `/user/temp/payload_<pid>.self` | elfldr self-loader source | temporary converted image | runtime-generated, not component live path | source template |
|
|
| `/system/vsh/app/NPXS40112/eboot.bin` | elfldr bootstrap source | injection victim executable | not an elfldr installation path | source literal |
|
|
|
|
No audited input binds an actual live elfldr or Manager object to a current
|
|
path. The package/reference paths and configured defaults therefore produce
|
|
`PATH_CONFLICT`; no future readback window may guess.
|
|
|
|
## Readback decision matrix
|
|
|
|
- `NEW_OBSERVER_FEASIBILITY`: `BLOCKED`
|
|
- `EXISTING_STACK_MANUAL_FACT_COLLECTION`: `PARTIAL`
|
|
- `EXISTING_STACK_SINGLE_READBACK`: `BLOCKED_NO_READBACK_PATH`
|
|
- `EXISTING_STACK_REPEAT_READBACK`: `BLOCKED`
|
|
- `ELFLDR_INDEPENDENT_RECOVERY`: `PARTIAL`
|
|
- `PAYLOAD_MANAGER_INDEPENDENT_RECOVERY`: `PARTIAL`
|
|
- `SIDE_BY_SIDE_FEASIBILITY`: `BLOCKED`
|
|
- `DEVICE_WRITE`: `NOT_AUTHORIZED`
|
|
- `TARGET_EXECUTION`: `NOT_AUTHORIZED`
|
|
- `INSTALLATION`: `NOT_AUTHORIZED`
|
|
|
|
There is no possible first readback component: the component-risk order cannot
|
|
override an absent transport. A missing metadata query would merely reduce a
|
|
copy to `SOURCE_MAPPING_PARTIAL`; here the earlier condition—getting complete
|
|
binary bytes—already fails.
|
|
|
|
## Explicitly acceptable only after later consent
|
|
|
|
A future read-only request could reasonably entail sockets, temporary buffers,
|
|
heap allocation, connection/request counters, scheduler activity, cache or
|
|
atime effects, audit/process/network accounting, stdout logging, ring logging,
|
|
and a process-local `server_active_flag=1`. These effects are not claimed
|
|
absent. They are acceptable only if the chosen route has no device-file write,
|
|
launch, autoload, service, or persistent configuration effect and the
|
|
artifact-specific permission names them.
|
|
|
|
No such permission is requested in Phase 0.9D.
|