Skip to content

Validate ELF headers, fail on heap setup errors, add tracked launches - #9

Closed
ItsJokerZz wants to merge 0 commit into
ps5-payload-dev:masterfrom
ItsJokerZz:master
Closed

ItsJokerZz wants to merge 0 commit into
ps5-payload-dev:masterfrom
ItsJokerZz:master

Conversation

@ItsJokerZz

Copy link
Copy Markdown

What changed

elfldr.c

  • elfldr_read rejects headers that are not 64-bit ELF, have a bad section
    header size or count, or point past a 64 MB cap, and checks each section's
    offset and size before using them. These values come straight off the
    network and were used as allocation and receive sizes unchecked.
  • Fixed sizeof(Elf64_Ehdr) where sizeof(Elf64_Shdr) was meant (same
    size, no behaviour change).
  • A failed heap setup now kills the child and fails the spawn. The result
    of elfldr_set_heap_size was ignored before, so the payload would run
    with a default-sized heap.

socksrv.c

  • New optional request prefix: TRACKED, a 32-bit big-endian input
    length, up to 191 bytes of input, then the payload as usual.
  • The payload is spawned with stdio detached from the client socket
    (/dev/null, or a socket pair carrying the input), and the client gets
    back TPID plus the pid, or -1 on failure.
  • When input is given, the loader waits up to 15 s for the payload to
    print PAYLOAD_READY and kills it otherwise.
  • A tracked request ignores the pipe URI option, since its output never
    goes to the client.
  • Requests without the prefix take exactly the same path as before.

Why

A client that launches payloads has no way to learn which process it
started, so it cannot stop or monitor it later. The tracked request gives
it the pid without mixing payload output into the reply. The rest is
hardening found along the way.

This brings the PS5 loader in line with the same changes proposed for the
PS4 loader, so one client can speak the same request to both.

@john-tornblom

Copy link
Copy Markdown
Contributor

Please separate this into two: one with bug fixes which I will likely merge, and a second one for the new feature. I don’t think I will merge the feature as it is designed right now, better to use http get request for this where you can pass parameters.

@ItsJokerZz

Copy link
Copy Markdown
Author

Sounds good- will do.

@ItsJokerZz

ItsJokerZz commented Oct 11, 2026 •

Copy link
Copy Markdown
Author

Bug fixes here on commit 8530ff5

@john-tornblom

Copy link
Copy Markdown
Contributor

What does the max_size constant do? Limit elf file size?

@ItsJokerZz

Copy link
Copy Markdown
Author

It was an upper bound to stop the header's offsets and sizes from overflowing when added together. Checking for overflow directly does the same job without limiting file size, so I'll just remove it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants