58 lines
2.9 KiB
Markdown
58 lines
2.9 KiB
Markdown
# Phase 0.9E reboot and crash model
|
|
|
|
Date: 2026-07-18
|
|
|
|
Classification: `REBOOT_RECOVERY_UNPROVEN`
|
|
|
|
## State model
|
|
|
|
| State | Evidence | Expected lifetime | Reboot statement |
|
|
|---|---|---|---|
|
|
| exact exploit/browser state | implementation absent | unknown | `UNPROVEN` |
|
|
| exact port-9020 listener state | implementation absent | unknown | `UNPROVEN` |
|
|
| hardened elfldr entry process | `main.c` source | temporary by design | hardware behavior unproven |
|
|
| embedded bootstrap in `SceRedisServer` | `main.c`/`bootstrap.c` | temporary injection stage | likely process/kernel state, not a proven recovery mechanism |
|
|
| `elfldr.elf` port-9021 service | `socksrv.c` | process-local background service by design | README says rest-mode resume, not reboot persistence |
|
|
| controlled Manager | source/offline artifact | process-local when launched | explicitly not installed in current controlled-runtime evidence |
|
|
| Manager configuration/autoload files | source paths only | filesystem-persistent if actually present | current device values and use unobserved |
|
|
| Y2JB-named `SIECAF` backup | host file | host-persistent | not proof of device installation |
|
|
|
|
The hardened elfldr README states that the port-9021 service survives payload
|
|
crashes and resumes after rest mode. It does not say that the service survives
|
|
a full reboot. Source creates process state and does not install a boot item,
|
|
but the complete device bootstrap/autoload environment is not available.
|
|
|
|
## Crash cases
|
|
|
|
- A payload crash under hardened port 9021 is isolated by design from the
|
|
service process. That is source architecture, not a tested firmware-9.60
|
|
guarantee.
|
|
- A crash in the unknown port-9020 listener may terminate a process, exploit
|
|
state, or more. No cleanup, watchdog, retry, or restart path is available for
|
|
audit.
|
|
- A malformed or truncated 9020 transfer has unknown allocation, mapping,
|
|
execution, and close behavior.
|
|
- A hang has no proven host abort, deadline, or recovery response.
|
|
- No source proves that a bad payload cannot create persistent state; a future
|
|
rescue contract must explicitly prohibit such writes.
|
|
|
|
## Anti-brick boundary
|
|
|
|
A session crash is not automatically brick-relevant if live files, autoload,
|
|
configuration, mounts, and boot state remain unchanged and a reboot or fresh
|
|
jailbreak session restores the executor. Those premises are not yet proven for
|
|
the actual chain.
|
|
|
|
Consequently:
|
|
|
|
- `restartable_after_reboot=unproven`;
|
|
- no guarantee is made that reboot always restores access;
|
|
- no automatic retry is permitted;
|
|
- no future device phase may rely on reboot recovery until the exact package
|
|
and its state transitions are audited.
|
|
|
|
Minimum evidence to promote to `REBOOT_RECOVERY_SUPPORTED_BY_DESIGN` is an
|
|
exact source-bound trigger/listener implementation proving that all bootstrap
|
|
state is session-local or safely reproducible, plus an exact operator procedure
|
|
that does not rely on a live component or autoload.
|