feat(p2jb): merge upstream P2JB 2.6 and fix elfldr dispatch #11

Closed

lucaszhongsj wants to merge 2 commits from main into main

lucaszhongsj commented

2026-08-30 07:08:04 -05:00

(Migrated from github.com)

Summary

Merges upstream matem6/P2JB-Y2JB-Porting 2.3 → 2.6 into src/p2jb.js, plus local fixes for elfldr delivery in this repo's environment.

Upstream changes merged (2.3 → 2.6)

Per-firmware SECURITY_FLAGS / KERNEL_PMAP_STORE / GVMSPACE offsets (FW 9.00–12.40)
CPU/GPU page-table walks and GPU-DMA write primitive (gpu.setup, PM4 DMA commands)
New stage_debug_menu: enables the debug menu via the GPU channel (security_flags / target_id / qa_flags / utoken_flags)
Dual-path elfldr delivery: kexp (load_aioshellcode) on Y2JB ≥ 1.5, sandbox-slot/USB file on ≤ 1.4
Drops the get_kernel_offset() fallback in ensure_kernel_offset() (upstream 1.3-compat fix — the framework-provided offsets lack the new fields, so the static table is now authoritative)

Local fixes

1. elfldr dispatch (required). Upstream 2.6 dispatches elfldr delivery on version_string, which this repo never defines. Without the fix, get_y2jb_version() returns null and execution falls into the sandbox path, where upstream's hardcoded names (elfldr_1320_v5.elf …) never match this repo's artifact — elfldr would be silently skipped and :9021 would never open. The dispatch now uses capability detection: if load_aioshellcode exists, prefer kexp. Upstream's dual-path semantics are preserved.

2. Sandbox probe uses the build-injected artifact name. TITLE_ID is always assigned before p2jb.js loads in this repo, making the Y2JB-1.3 USB branch structurally dead — and the update package already deploys the built elfldr into the exact splash-cache directory the sandbox path probes. The 1.4/1.3 branching and USB candidate list are dropped; the probe checks a single @@ELFLDR_FILE@@ placeholder substituted at build time (new Makefile sed line), mirroring ELFLDR_NAME in aioshellcode.js. Without the build step the placeholder simply fails file_exists and the loader is skipped, jailbreak unaffected.

Preserved local adaptations

start_p2jb() wrapper and true/false return contract, window.uiLog pipe logging, progress overlay around prepare_fds, 10 s pre-start delay, commented-out worker termination block, CRLF line endings.

Notes

Real change size of the merge commit is +756/−22 (git diff -w), matching upstream's own 2.3→2.6 delta (+754/−53). GitHub shows a larger raw diff only if whitespace is compared; the file keeps its existing CRLF line endings.
stage_debug_menu degrades gracefully in this environment: sceKernelAllocateMainDirectMemory / sceKernelMapNamedDirectMemory are not defined, so gpu.setup() throws and is caught by upstream's try/catch ("GPU debug-menu path failed") — the jailbreak itself is unaffected. Supplying those two symbols in global.js would enable the feature.
node --check passes. Not yet tested on hardware — a full real-device run (jailbreak → kexp elfldr → :9021 → autoload chain) is recommended before merge.

## Summary Merges upstream [matem6/P2JB-Y2JB-Porting](https://github.com/matem6/P2JB-Y2JB-Porting) **2.3 → 2.6** into `src/p2jb.js`, plus local fixes for elfldr delivery in this repo's environment. ## Upstream changes merged (2.3 → 2.6) - Per-firmware `SECURITY_FLAGS` / `KERNEL_PMAP_STORE` / `GVMSPACE` offsets (FW 9.00–12.40) - CPU/GPU page-table walks and GPU-DMA write primitive (`gpu.setup`, PM4 DMA commands) - New `stage_debug_menu`: enables the debug menu via the GPU channel (security_flags / target_id / qa_flags / utoken_flags) - Dual-path elfldr delivery: kexp (`load_aioshellcode`) on Y2JB ≥ 1.5, sandbox-slot/USB file on ≤ 1.4 - Drops the `get_kernel_offset()` fallback in `ensure_kernel_offset()` (upstream 1.3-compat fix — the framework-provided offsets lack the new fields, so the static table is now authoritative) ## Local fixes **1. elfldr dispatch (required).** Upstream 2.6 dispatches elfldr delivery on `version_string`, which this repo never defines. Without the fix, `get_y2jb_version()` returns `null` and execution falls into the sandbox path, where upstream's hardcoded names (`elfldr_1320_v5.elf` …) never match this repo's artifact — elfldr would be silently skipped and `:9021` would never open. The dispatch now uses capability detection: if `load_aioshellcode` exists, prefer kexp. Upstream's dual-path semantics are preserved. **2. Sandbox probe uses the build-injected artifact name.** `TITLE_ID` is always assigned before `p2jb.js` loads in this repo, making the Y2JB-1.3 USB branch structurally dead — and the update package already deploys the built elfldr into the exact splash-cache directory the sandbox path probes. The 1.4/1.3 branching and USB candidate list are dropped; the probe checks a single `@@ELFLDR_FILE@@` placeholder substituted at build time (new Makefile sed line), mirroring `ELFLDR_NAME` in `aioshellcode.js`. Without the build step the placeholder simply fails `file_exists` and the loader is skipped, jailbreak unaffected. ## Preserved local adaptations `start_p2jb()` wrapper and true/false return contract, `window.uiLog` pipe logging, progress overlay around `prepare_fds`, 10 s pre-start delay, commented-out worker termination block, CRLF line endings. ## Notes - Real change size of the merge commit is **+756/−22** (`git diff -w`), matching upstream's own 2.3→2.6 delta (+754/−53). GitHub shows a larger raw diff only if whitespace is compared; the file keeps its existing CRLF line endings. - `stage_debug_menu` degrades gracefully in this environment: `sceKernelAllocateMainDirectMemory` / `sceKernelMapNamedDirectMemory` are not defined, so `gpu.setup()` throws and is caught by upstream's try/catch ("GPU debug-menu path failed") — the jailbreak itself is unaffected. Supplying those two symbols in `global.js` would enable the feature. - `node --check` passes. **Not yet tested on hardware** — a full real-device run (jailbreak → kexp elfldr → `:9021` → autoload chain) is recommended before merge.

najdek commented

2026-08-31 04:15:13 -05:00

(Migrated from github.com)