gh-SvenGDK/SharpProspero
Watch
1
0
Fork
You've already forked SharpProspero
 0
Code Issues 1 Pull requests 1 Releases 3 Activity

Payload crashes elfldr on load #2

New issue
Open
opened 2026-08-17 15:41:25 -05:00 by lchmagKekse · 6 comments
lchmagKekse commented 2026-08-17 15:41:25 -05:00 (Migrated from github.com)

What I expected

A payload built from the prospero-payload-httpd template to load and start serving HTTP on the port it opens

What happened instead

elfldr crashes as soon as the payload loads, every time. The payload never serves anything

Steps to reproduce

  • dotnet new prospero-payload-httpd -n test, build with build.ps1
  • Send it with sharpprospero-bindgen payload --send --host <ip> --file test.elf once elfldr is listening
  • Elfldr crashes, payload does not execute, same result with the plain prospero-payload template, unmodified

Console

Firmware the console runs: 11.20
Entrypoint: New webkit userland and poops

Build

Attached

  • Core dump (if it crashed)
  • Kernel log covering only the moment the module ran
  • The module folder as a zip

coredump.zip
klog.txt

### What I expected A payload built from the prospero-payload-httpd template to load and start serving HTTP on the port it opens ### What happened instead elfldr crashes as soon as the payload loads, every time. The payload never serves anything ### Steps to reproduce - `dotnet new prospero-payload-httpd -n test`, build with build.ps1 - Send it with `sharpprospero-bindgen payload --send --host <ip> --file test.elf` once elfldr is listening - Elfldr crashes, payload does not execute, same result with the plain prospero-payload template, unmodified ### Console Firmware the console runs: 11.20 Entrypoint: New webkit userland and poops ### Build - Built from: 80d6018dd0b12d78361cfec987896fc633dc521f and also with v0.6 ### Attached - [x] Core dump (if it crashed) - [x] Kernel log covering only the moment the module ran - [ ] The module folder as a zip [coredump.zip](https://github.com/user-attachments/files/31153995/coredump.zip) [klog.txt](https://github.com/user-attachments/files/31153999/klog.txt)
SvenGDK commented 2026-08-18 11:18:44 -05:00 (Migrated from github.com)

Thanks for your report, I'm currently working on this specific issue and will release an update soon with some new templates.

Thanks for your report, I'm currently working on this specific issue and will release an update soon with some new templates.
❤️ 1
SvenGDK commented 2026-08-28 02:40:40 -05:00 (Migrated from github.com)

The update is now live on the repo, please check it out.

The update is now live on the repo, please check it out.
lchmagKekse commented 2026-08-31 12:33:56 -05:00 (Migrated from github.com)

elfldr is no longer crashing after the update, thank you.

However, I still can’t get any of the payloads to actually do anything. I tested the following samples:

  • prospero-payload-list-files
  • prospero-payload-hwinfo
  • prospero-payload-notify
  • prospero-payload-httpd
  • prospero-payload-browser

They all appear to load successfully, but none of them produce any observable result. For example, the HTTP payload doesn’t start a server, the notify payload doesn’t display a notification, and I don’t see any output from the other samples either.

klog when loading a payload:

<88> EXEC /system/vsh/app/NPXS40112/eboot.bin [unspecified], vm#0, dmem#0 abi=native category=unknown <950377 msec>
<118>[SceShellCore] VM Stats: RSS 1139.9 0.0, kernel 404.0 0.0, wire count 466.4 0.0, swap out 0.0, page table CPU 5960/8192 GPU 124/8192
<118>[SceShellCore] FMEM   1.8/   4.3   0.0/   0.0 NPXS40095 SceSysAvControl.elf
<118>[SceShellCore] FMEM  15.0/ 107.5   0.0/   0.0 NPXS45091 SceSysCore.elf
<118>[SceShellCore] FMEM  35.8/  63.9   0.0/   0.0 NPXS40096 orbis_audiod.elf
<118>[SceShellCore] FMEM   8.4/  34.5   0.0/   0.0 NPXS40135 AgcCompositor.elf
<118>[SceShellCore] FMEM  75.4/ 726.6   0.0/   0.0 NPXS40082 SceShellCore
<118>[SceShellCore] FMEM 600.3/5844.3   0.0/   0.0 NPXS40087 SceShellUI
<118>[SceShellCore] FMEM   5.0/  23.5   0.0/   0.0 NPXS40100 SceAvCapture
<118>[SceShellCore] FMEM  16.8/  89.2   0.0/   0.0 NPXS40102 SceRemotePlay
<118>[SceShellCore] FMEM   3.2/  34.9   0.0/   0.0 NPXS40091 SceUpdatePupUtil
<118>[SceShellCore] FMEM  10.6/  48.3   0.0/   0.0 NPXS40142 SceGameLiveStreaming
<118>[SceShellCore] FMEM  42.1/ 109.7   0.0/   0.0 NPXS40109 ScePartyDaemon
<118>[SceShellCore] FMEM   6.8/  46.1   0.0/   0.0 NPXS40039 SceMediaCoreServer
<118>[SceShellCore] FMEM   7.5/  34.8   0.0/   0.0 NPXS40153 ScePsNowClientDaemon
<118>[SceShellCore] FMEM   4.4/  20.5   0.0/   0.0 NPXS40112 SceSpZeroConf
<118>[SceShellCore] FMEM   3.7/  20.3   0.0/   0.0 NPXS40101 SceSocialScreenMgr
<118>[SceShellCore] FMEM  21.0/  85.8   0.0/   0.0 NPXS40094 SceVoiceAndAgent
<118>[SceShellCore] FMEM   5.8/  30.8   0.0/   0.0 NPXS40028 SceRedisServer
<118>[SceShellCore] FMEM  48.6/ 755.9   0.0/   0.0 NPXS40000 SceJSCd
<118>[SceShellCore] FMEM  11.8/  46.8   0.0/   0.0 NPXS40085 SceSystemLogger2
<118>[SceShellCore] FMEM   4.3/  27.7   0.0/   0.0 NPXS40173 SceVrTrackerDaemon
<118>[SceShellCore] FMEM  11.4/ 153.7   0.0/   0.0 NPXS40210 SceDiscordDaemon
<118>[SceShellCore] FMEM   2.7/  13.7   0.0/   0.0 NPXS45093 fs_cleaner.elf
<118>[SceShellCore] FMEM  14.8/ 170.3   0.0/   0.0 NPXS40109 webrtc_daemon.self
<118>[SceShellCore] FMEM  25.0/ 490.9   0.0/   0.0 NPXS40039 SceVideoCore2K
<118>[SceShellCore] FMEM  63.5/ 135.3   0.0/   0.0 NPXS40087 SceNKUIProcess
<118>[SceShellCore] FMEM  55.8/ 131.9   0.0/   0.0 NPXS40087 SceNKNetworkProcess
<118>[SceShellCore] FMEM   6.5/  20.9   0.0/   0.0 elfldr.elf
<118>[SceShellCore] FMEM   3.1/  16.6   0.0/   0.0 klogsrv.elf
<118>[SceShellCore] FMEM   4.8/  18.5   0.0/   0.0 payload.elf

doctor.ps1 output if that matters:

PS C:\PS5\SharpProspero> .\doctor.ps1
SharpProspero environment check
-------------------------------
[ ok ] .NET 10 SDK
        10.0.400
[ ok ] Linux compile host (WSL + .NET 10)
        wsl present
[ ok ] SDK root (SHARPPROSPERO_ROOT)
        C:\PS5\SharpProspero
-------------------------------
Ready to build and test. Building a module runs the compile step on Linux (via WSL on Windows).
elfldr is no longer crashing after the update, thank you. However, I still can’t get any of the payloads to actually do anything. I tested the following samples: - prospero-payload-list-files - prospero-payload-hwinfo - prospero-payload-notify - prospero-payload-httpd - prospero-payload-browser They all appear to load successfully, but none of them produce any observable result. For example, the HTTP payload doesn’t start a server, the notify payload doesn’t display a notification, and I don’t see any output from the other samples either. klog when loading a payload: ``` <88> EXEC /system/vsh/app/NPXS40112/eboot.bin [unspecified], vm#0, dmem#0 abi=native category=unknown <950377 msec> <118>[SceShellCore] VM Stats: RSS 1139.9 0.0, kernel 404.0 0.0, wire count 466.4 0.0, swap out 0.0, page table CPU 5960/8192 GPU 124/8192 <118>[SceShellCore] FMEM 1.8/ 4.3 0.0/ 0.0 NPXS40095 SceSysAvControl.elf <118>[SceShellCore] FMEM 15.0/ 107.5 0.0/ 0.0 NPXS45091 SceSysCore.elf <118>[SceShellCore] FMEM 35.8/ 63.9 0.0/ 0.0 NPXS40096 orbis_audiod.elf <118>[SceShellCore] FMEM 8.4/ 34.5 0.0/ 0.0 NPXS40135 AgcCompositor.elf <118>[SceShellCore] FMEM 75.4/ 726.6 0.0/ 0.0 NPXS40082 SceShellCore <118>[SceShellCore] FMEM 600.3/5844.3 0.0/ 0.0 NPXS40087 SceShellUI <118>[SceShellCore] FMEM 5.0/ 23.5 0.0/ 0.0 NPXS40100 SceAvCapture <118>[SceShellCore] FMEM 16.8/ 89.2 0.0/ 0.0 NPXS40102 SceRemotePlay <118>[SceShellCore] FMEM 3.2/ 34.9 0.0/ 0.0 NPXS40091 SceUpdatePupUtil <118>[SceShellCore] FMEM 10.6/ 48.3 0.0/ 0.0 NPXS40142 SceGameLiveStreaming <118>[SceShellCore] FMEM 42.1/ 109.7 0.0/ 0.0 NPXS40109 ScePartyDaemon <118>[SceShellCore] FMEM 6.8/ 46.1 0.0/ 0.0 NPXS40039 SceMediaCoreServer <118>[SceShellCore] FMEM 7.5/ 34.8 0.0/ 0.0 NPXS40153 ScePsNowClientDaemon <118>[SceShellCore] FMEM 4.4/ 20.5 0.0/ 0.0 NPXS40112 SceSpZeroConf <118>[SceShellCore] FMEM 3.7/ 20.3 0.0/ 0.0 NPXS40101 SceSocialScreenMgr <118>[SceShellCore] FMEM 21.0/ 85.8 0.0/ 0.0 NPXS40094 SceVoiceAndAgent <118>[SceShellCore] FMEM 5.8/ 30.8 0.0/ 0.0 NPXS40028 SceRedisServer <118>[SceShellCore] FMEM 48.6/ 755.9 0.0/ 0.0 NPXS40000 SceJSCd <118>[SceShellCore] FMEM 11.8/ 46.8 0.0/ 0.0 NPXS40085 SceSystemLogger2 <118>[SceShellCore] FMEM 4.3/ 27.7 0.0/ 0.0 NPXS40173 SceVrTrackerDaemon <118>[SceShellCore] FMEM 11.4/ 153.7 0.0/ 0.0 NPXS40210 SceDiscordDaemon <118>[SceShellCore] FMEM 2.7/ 13.7 0.0/ 0.0 NPXS45093 fs_cleaner.elf <118>[SceShellCore] FMEM 14.8/ 170.3 0.0/ 0.0 NPXS40109 webrtc_daemon.self <118>[SceShellCore] FMEM 25.0/ 490.9 0.0/ 0.0 NPXS40039 SceVideoCore2K <118>[SceShellCore] FMEM 63.5/ 135.3 0.0/ 0.0 NPXS40087 SceNKUIProcess <118>[SceShellCore] FMEM 55.8/ 131.9 0.0/ 0.0 NPXS40087 SceNKNetworkProcess <118>[SceShellCore] FMEM 6.5/ 20.9 0.0/ 0.0 elfldr.elf <118>[SceShellCore] FMEM 3.1/ 16.6 0.0/ 0.0 klogsrv.elf <118>[SceShellCore] FMEM 4.8/ 18.5 0.0/ 0.0 payload.elf ``` doctor.ps1 output if that matters: ``` PS C:\PS5\SharpProspero> .\doctor.ps1 SharpProspero environment check ------------------------------- [ ok ] .NET 10 SDK 10.0.400 [ ok ] Linux compile host (WSL + .NET 10) wsl present [ ok ] SDK root (SHARPPROSPERO_ROOT) C:\PS5\SharpProspero ------------------------------- Ready to build and test. Building a module runs the compile step on Linux (via WSL on Windows). ```
Zorian1337 commented 2026-09-22 03:47:35 -05:00 (Migrated from github.com)

The update is now live on the repo, please check it out.

Thanks for your report, I'm currently working on this specific issue and will release an update soon with some new templates.

FW: 12.20
payload is crashing on load.

Used default payload samples/prospero-payload-echo for this test.

#
# A user thread receives a fatal signal
#
# signal: 4 (SIGILL)
# thread ID: 101668
# thread name: SceSpZeroConfMain
# proc ID: 317
# proc name: payload.elf
# reason: privileged instruction fault
#
# registers:
# rax: 0000000000000000  rbx: 00000007eeffbdb8
# rcx: 00000008000005bc  rdx: 0000000880000b40
# rsi: 0000000080020000  rdi: 0000000000000000
# rbp: 00000007eeffbd60  rsp: 00000007eeffbd30
# r8 : 0000000000000000  r9 : 0000000000000000
# r10: 0000000000000000  r11: 0000000000000246
# r12: 0000000800088318  r13: 0000000880000b60
# r14: 0000000000000001  r15: 00000000ffffffff
# rip: 0000000200030326  eflags: 00010246
# lbf: ffffffffffffffff  lbt: ffffffffffffffff
# lb0: ffffffffffffffff  lb1: ffffffffffffffff
# lb2: ffffffffffffffff  lb3: ffffffffffffffff
# lb4: ffffffffffffffff  lb5: ffffffffffffffff
# lb6: ffffffffffffffff  lb7: ffffffffffffffff
#
# backtrace:
copyin: SceSpZeroConfMain has nonsleeping lock
# 00000000004000ab
# 0000000000000000
#
# dynamic libraries:
# /system/vsh/app/NPXS40112/eboot.bin
#  xotext: 0000000000400000:0000000000454000 nsegs: 4
#  fingerprint: f17eb46891caf6359a4f09730b2a03b400000000
# /system/common/lib/libkernel_sys.sprx
#  xotext: 0000000800000000:000000080004c000 nsegs: 4
#  fingerprint: 05c4a88478dad8151575c25ceff8777000000000
# /system/common/lib/libSceLibcInternal.sprx
#  xotext: 00000008000a8000:00000008001d8000 nsegs: 4
#  fingerprint: 66f970ddae81e36ea32f29f94490ea2600000000
# /system/common/lib/libSceSysmodule.sprx
#  xotext: 0000000800274000:0000000800280000 nsegs: 4
#  fingerprint: e07d22c61679cf6f4c6824c7ae8814a700000000
# /system/common/lib/libSceNet.sprx
#  xotext: 00000008002a0000:00000008002d4000 nsegs: 4
#  fingerprint: acf301586d5b414869a9c186a0819d9700000000

sorry this is no coredump.zip I couldn't find anything of the sort.

> The update is now live on the repo, please check it out. > Thanks for your report, I'm currently working on this specific issue and will release an update soon with some new templates. FW: 12.20 payload is crashing on load. Used default payload `samples/prospero-payload-echo` for this test. ``` # # A user thread receives a fatal signal # # signal: 4 (SIGILL) # thread ID: 101668 # thread name: SceSpZeroConfMain # proc ID: 317 # proc name: payload.elf # reason: privileged instruction fault # # registers: # rax: 0000000000000000 rbx: 00000007eeffbdb8 # rcx: 00000008000005bc rdx: 0000000880000b40 # rsi: 0000000080020000 rdi: 0000000000000000 # rbp: 00000007eeffbd60 rsp: 00000007eeffbd30 # r8 : 0000000000000000 r9 : 0000000000000000 # r10: 0000000000000000 r11: 0000000000000246 # r12: 0000000800088318 r13: 0000000880000b60 # r14: 0000000000000001 r15: 00000000ffffffff # rip: 0000000200030326 eflags: 00010246 # lbf: ffffffffffffffff lbt: ffffffffffffffff # lb0: ffffffffffffffff lb1: ffffffffffffffff # lb2: ffffffffffffffff lb3: ffffffffffffffff # lb4: ffffffffffffffff lb5: ffffffffffffffff # lb6: ffffffffffffffff lb7: ffffffffffffffff # # backtrace: copyin: SceSpZeroConfMain has nonsleeping lock # 00000000004000ab # 0000000000000000 # # dynamic libraries: # /system/vsh/app/NPXS40112/eboot.bin # xotext: 0000000000400000:0000000000454000 nsegs: 4 # fingerprint: f17eb46891caf6359a4f09730b2a03b400000000 # /system/common/lib/libkernel_sys.sprx # xotext: 0000000800000000:000000080004c000 nsegs: 4 # fingerprint: 05c4a88478dad8151575c25ceff8777000000000 # /system/common/lib/libSceLibcInternal.sprx # xotext: 00000008000a8000:00000008001d8000 nsegs: 4 # fingerprint: 66f970ddae81e36ea32f29f94490ea2600000000 # /system/common/lib/libSceSysmodule.sprx # xotext: 0000000800274000:0000000800280000 nsegs: 4 # fingerprint: e07d22c61679cf6f4c6824c7ae8814a700000000 # /system/common/lib/libSceNet.sprx # xotext: 00000008002a0000:00000008002d4000 nsegs: 4 # fingerprint: acf301586d5b414869a9c186a0819d9700000000 ``` sorry this is no coredump.zip I couldn't find anything of the sort.
SvenGDK commented 2026-09-22 10:27:28 -05:00 (Migrated from github.com)

The update is now live on the repo, please check it out.

Thanks for your report, I'm currently working on this specific issue and will release an update soon with some new templates.

FW: 12.20 payload is crashing on load.

Used default payload samples/prospero-payload-echo for this test.

#
# A user thread receives a fatal signal
#
# signal: 4 (SIGILL)
# thread ID: 101668
# thread name: SceSpZeroConfMain
# proc ID: 317
# proc name: payload.elf
# reason: privileged instruction fault
#
# registers:
# rax: 0000000000000000  rbx: 00000007eeffbdb8
# rcx: 00000008000005bc  rdx: 0000000880000b40
# rsi: 0000000080020000  rdi: 0000000000000000
# rbp: 00000007eeffbd60  rsp: 00000007eeffbd30
# r8 : 0000000000000000  r9 : 0000000000000000
# r10: 0000000000000000  r11: 0000000000000246
# r12: 0000000800088318  r13: 0000000880000b60
# r14: 0000000000000001  r15: 00000000ffffffff
# rip: 0000000200030326  eflags: 00010246
# lbf: ffffffffffffffff  lbt: ffffffffffffffff
# lb0: ffffffffffffffff  lb1: ffffffffffffffff
# lb2: ffffffffffffffff  lb3: ffffffffffffffff
# lb4: ffffffffffffffff  lb5: ffffffffffffffff
# lb6: ffffffffffffffff  lb7: ffffffffffffffff
#
# backtrace:
copyin: SceSpZeroConfMain has nonsleeping lock
# 00000000004000ab
# 0000000000000000
#
# dynamic libraries:
# /system/vsh/app/NPXS40112/eboot.bin
#  xotext: 0000000000400000:0000000000454000 nsegs: 4
#  fingerprint: f17eb46891caf6359a4f09730b2a03b400000000
# /system/common/lib/libkernel_sys.sprx
#  xotext: 0000000800000000:000000080004c000 nsegs: 4
#  fingerprint: 05c4a88478dad8151575c25ceff8777000000000
# /system/common/lib/libSceLibcInternal.sprx
#  xotext: 00000008000a8000:00000008001d8000 nsegs: 4
#  fingerprint: 66f970ddae81e36ea32f29f94490ea2600000000
# /system/common/lib/libSceSysmodule.sprx
#  xotext: 0000000800274000:0000000800280000 nsegs: 4
#  fingerprint: e07d22c61679cf6f4c6824c7ae8814a700000000
# /system/common/lib/libSceNet.sprx
#  xotext: 00000008002a0000:00000008002d4000 nsegs: 4
#  fingerprint: acf301586d5b414869a9c186a0819d9700000000

sorry this is no coredump.zip I couldn't find anything of the sort.

Thanks for the report, this firmware is not yet properly supported and will be added in a future update.

> > The update is now live on the repo, please check it out. > > > Thanks for your report, I'm currently working on this specific issue and will release an update soon with some new templates. > > FW: 12.20 payload is crashing on load. > > Used default payload `samples/prospero-payload-echo` for this test. > > ``` > # > # A user thread receives a fatal signal > # > # signal: 4 (SIGILL) > # thread ID: 101668 > # thread name: SceSpZeroConfMain > # proc ID: 317 > # proc name: payload.elf > # reason: privileged instruction fault > # > # registers: > # rax: 0000000000000000 rbx: 00000007eeffbdb8 > # rcx: 00000008000005bc rdx: 0000000880000b40 > # rsi: 0000000080020000 rdi: 0000000000000000 > # rbp: 00000007eeffbd60 rsp: 00000007eeffbd30 > # r8 : 0000000000000000 r9 : 0000000000000000 > # r10: 0000000000000000 r11: 0000000000000246 > # r12: 0000000800088318 r13: 0000000880000b60 > # r14: 0000000000000001 r15: 00000000ffffffff > # rip: 0000000200030326 eflags: 00010246 > # lbf: ffffffffffffffff lbt: ffffffffffffffff > # lb0: ffffffffffffffff lb1: ffffffffffffffff > # lb2: ffffffffffffffff lb3: ffffffffffffffff > # lb4: ffffffffffffffff lb5: ffffffffffffffff > # lb6: ffffffffffffffff lb7: ffffffffffffffff > # > # backtrace: > copyin: SceSpZeroConfMain has nonsleeping lock > # 00000000004000ab > # 0000000000000000 > # > # dynamic libraries: > # /system/vsh/app/NPXS40112/eboot.bin > # xotext: 0000000000400000:0000000000454000 nsegs: 4 > # fingerprint: f17eb46891caf6359a4f09730b2a03b400000000 > # /system/common/lib/libkernel_sys.sprx > # xotext: 0000000800000000:000000080004c000 nsegs: 4 > # fingerprint: 05c4a88478dad8151575c25ceff8777000000000 > # /system/common/lib/libSceLibcInternal.sprx > # xotext: 00000008000a8000:00000008001d8000 nsegs: 4 > # fingerprint: 66f970ddae81e36ea32f29f94490ea2600000000 > # /system/common/lib/libSceSysmodule.sprx > # xotext: 0000000800274000:0000000800280000 nsegs: 4 > # fingerprint: e07d22c61679cf6f4c6824c7ae8814a700000000 > # /system/common/lib/libSceNet.sprx > # xotext: 00000008002a0000:00000008002d4000 nsegs: 4 > # fingerprint: acf301586d5b414869a9c186a0819d9700000000 > ``` > > sorry this is no coredump.zip I couldn't find anything of the sort. Thanks for the report, this firmware is not yet properly supported and will be added in a future update.
Zorian1337 commented 2026-09-22 11:06:55 -05:00 (Migrated from github.com)

If you need any other information let me know willing to help out however I can

If you need any other information let me know willing to help out however I can
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
archive/20260923T053730Z-rescue/Gudui/codex/shaderinfo-relative-pointers
archive/20260923T053730Z-rescue/tags/gpu-cl-stable-2026-08-30
v0.8
v0.6
v0.5
Labels
Clear labels   
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
question
Further information is requested

  
wontfix
This will not be worked on

No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
gh-SvenGDK/SharpProspero#2
No description provided.