60 lines
3.1 KiB
Markdown
60 lines
3.1 KiB
Markdown
# Phase 1.0EA: expanded launch evidence and cleanup audit
|
|
|
|
Status: `NEW_FW960_LNC_CANDIDATE_FOUND_ABI_AND_CLEANUP_GATES_STILL_BLOCKED`
|
|
|
|
This phase is a bounded public-source and offline source-history audit. It
|
|
creates no target source or artifact and performs no PS5 operation.
|
|
|
|
## Newly reviewed candidate
|
|
|
|
The public `phantomptr/ps5upload` repository was bound at commit
|
|
`978add1864eb54351eaddbd242634282ef3cd120`. Its current ShellUI RPC source is
|
|
Git blob `b30d17bd0068affd5b4d42550953bc6bd44203f7`; its ptrace implementation is
|
|
blob `6b68f26995f746df5b2b0b9fd1495432304e8f35`.
|
|
|
|
Commit `e3875ffba7cb08e017dcdb537d045af3fddc133d` first introduced the reviewed
|
|
route and states that game launch through `sceLncUtilLaunchApp` worked on
|
|
firmware 9.60. The implementation constructs a packed 24-byte local parameter
|
|
with size, user ID, options, crash-report and check fields, then remotely calls
|
|
the export from `SceShellUI`. This is useful independent implementation and
|
|
operator-report evidence for a different launch API. It is not independent ABI
|
|
provenance: the introducing commit supplies no public specification, header,
|
|
binary-derived layout proof or second implementation lineage for that
|
|
parameter layout. Exact-name searches for the layout fields produced no other
|
|
qualifying public source.
|
|
|
|
The route also does not satisfy the Chimera end state. It starts a registered
|
|
title; it does not bind or replace that title's process with the exact embedded
|
|
RetroArch ELF. The previously reviewed shsrv replacement lineage would still
|
|
be required for that second operation, so finding the LNC launch candidate does
|
|
not remove the replacement ABI or composition gates.
|
|
|
|
## Cleanup findings
|
|
|
|
The candidate cannot be imported as a bounded lifecycle implementation:
|
|
|
|
- attach, remote-call and single-step paths use blocking `waitpid` without an
|
|
absolute deadline;
|
|
- launch cleanup discards `pt_munmap` and `pt_detach` results;
|
|
- the tracked-attached flag is cleared even when detach fails;
|
|
- a dispatched call with unreadable completion is promoted to soft success;
|
|
- register restoration and authid restoration include best-effort failures;
|
|
- an authid restore failure is logged and execution continues with elevated
|
|
process state until a later operation might repair it;
|
|
- its retry/fallback semantics exceed the Chimera one-shot contract.
|
|
|
|
These are source facts about the candidate, not claims about an observed PS5
|
|
failure. The existing Chimera host ownership models remain useful, but no
|
|
source-bound target composition currently replaces these failure behaviors
|
|
with absolute deadlines, verified restoration and terminal ownership.
|
|
|
|
## Decision and next step
|
|
|
|
The direct embedded route selected by DZ remains the minimum architecture, but
|
|
target source and build remain blocked. The next gate requires either an
|
|
independent public specification or two demonstrably independent,
|
|
firmware-applicable implementations that agree on the complete launch and
|
|
replacement ABI, followed by a target-source composition whose every blocking
|
|
wait, mapping, register, credential, attach and detach edge has a deadline and
|
|
verified cleanup result. Console permission is not yet actionable.
|