WIP: Document external elfldr helper-payload elevation proof #1

Closed

blackbearreloaded wants to merge 0 commits from feature/sandbox-elevation-poc into main

blackbearreloaded commented

2026-08-30 10:20:00 -05:00

(Migrated from github.com)

Summary

This PR demonstrates the original external helper-payload elevation design.
It does not add a privilege API to kstuff.

The sandboxed application:

confirms that opening /data is denied;
connects to an already-running elfldr on loopback TCP port 9021;
sends a separate, bundled helper ELF to elfldr; and
waits for that privileged helper payload to locate the exact PPSA99790
process and elevate it externally.

After the helper succeeds, the application writes, reopens, reads, and
byte-verifies /data/hello-from-sandbox.txt.

The helper recognizes only PPSA99790. It is an additional executable payload
that must be transmitted and run for each elevation attempt; it is not code
that executes inside the sandboxed application itself.

This PR also adds repository-relative source, metadata, presentation, asset,
and app-root-file build inputs, plus make sandbox-elevation-ffpfsc and focused
documentation.

Relationship to the newer design

This proof predates the direct kstuff request implemented by
PR #2.
PR #2 removes the additional elfldr payload and instead lets the application
request a predefined, caller-only data-access profile from compatible kstuff.

Validation

Host checks passed under WSL:

make format-check
make lint
make test (3 GoogleTest and 5 tooling integration tests)
make app (default boilerplate regression build)
make sandbox-elevation-ffpfsc

Hardware validation passed on PS5 firmware 6.02 using the exact attached
package:

the sandboxed open failed first with 0x80020002;
the separately submitted helper reported firmware 06020004, the exact
target PID, and result=0;
FTP retrieval confirmed /data/hello-from-sandbox.txt contained:

hello from the sandboxed app
pid=239 before_open=80020002 write_read=verified

the title closed normally, ShadowMount released its runtime layers, and FTP
2121, klog 3232, and elfldr 9021 remained healthy.

Artifact

PPSA99790.ffpfsc (11,730,944 bytes)

SHA-256: 4e69a70388ae611231617457090aa613b5838fd7b7d167795fd2b6c4a9ec6f44

The package is attached in a PR comment.

Scope

This example requires an owner-started compatible kstuff/kernel-payload
environment and elfldr on TCP port 9021. It is not enabled by default, does
not change console settings, and does not claim compatibility beyond the
validated environment.

## Summary This PR demonstrates the original **external helper-payload** elevation design. It does not add a privilege API to kstuff. The sandboxed application: 1. confirms that opening `/data` is denied; 2. connects to an already-running elfldr on loopback TCP port `9021`; 3. sends a separate, bundled helper ELF to elfldr; and 4. waits for that privileged helper payload to locate the exact `PPSA99790` process and elevate it externally. After the helper succeeds, the application writes, reopens, reads, and byte-verifies `/data/hello-from-sandbox.txt`. The helper recognizes only `PPSA99790`. It is an additional executable payload that must be transmitted and run for each elevation attempt; it is not code that executes inside the sandboxed application itself. This PR also adds repository-relative source, metadata, presentation, asset, and app-root-file build inputs, plus `make sandbox-elevation-ffpfsc` and focused documentation. ## Relationship to the newer design This proof predates the direct kstuff request implemented by [PR #2](https://github.com/blackbearreloaded/ps5-native-app-boilerplate/pull/2). PR #2 removes the additional elfldr payload and instead lets the application request a predefined, caller-only data-access profile from compatible kstuff. ## Validation Host checks passed under WSL: - `make format-check` - `make lint` - `make test` (3 GoogleTest and 5 tooling integration tests) - `make app` (default boilerplate regression build) - `make sandbox-elevation-ffpfsc` Hardware validation passed on PS5 firmware 6.02 using the exact attached package: - the sandboxed open failed first with `0x80020002`; - the separately submitted helper reported firmware `06020004`, the exact target PID, and `result=0`; - FTP retrieval confirmed `/data/hello-from-sandbox.txt` contained: ```text hello from the sandboxed app pid=239 before_open=80020002 write_read=verified ``` - the title closed normally, ShadowMount released its runtime layers, and FTP `2121`, klog `3232`, and elfldr `9021` remained healthy. ## Artifact `PPSA99790.ffpfsc` (11,730,944 bytes) SHA-256: `4e69a70388ae611231617457090aa613b5838fd7b7d167795fd2b6c4a9ec6f44` The package is attached in a PR comment. ## Scope This example requires an owner-started compatible kstuff/kernel-payload environment and elfldr on TCP port `9021`. It is not enabled by default, does not change console settings, and does not claim compatibility beyond the validated environment.

blackbearreloaded commented

2026-08-30 10:22:02 -05:00

(Migrated from github.com)

Hardware-validated FFPFSC for this PR:

Download PPSA99790.ffpfsc
Size: 11,730,944 bytes
SHA-256: 4e69a70388ae611231617457090aa613b5838fd7b7d167795fd2b6c4a9ec6f44

The artifact produced /data/hello-from-sandbox.txt with hello from the sandboxed app on firmware 6.02 and closed cleanly afterward.

Hardware-validated FFPFSC for this PR: - [Download `PPSA99790.ffpfsc`](https://github.com/blackbearreloaded/ps5-native-app-boilerplate/releases/download/pr-1-sandbox-elevation-poc/PPSA99790.ffpfsc) - Size: 11,730,944 bytes - SHA-256: `4e69a70388ae611231617457090aa613b5838fd7b7d167795fd2b6c4a9ec6f44` The artifact produced `/data/hello-from-sandbox.txt` with `hello from the sandboxed app` on firmware 6.02 and closed cleanly afterward.