remove compatibility issue payloads.

README.md

@@ -5,7 +5,6 @@ Supported firmware: 7.00 through 13.60.
 - In the network settings, set Primary DNS to `45.56.67.85` (Recommended)
 - Run `python serve.py` locally, or open https://ntfargo.github.io/Relapse-Exploit/ on the PS5.
 - The default payloads are stored in `payloads/` after a successful run, the ELF loader listens on port `9021`.
-- After elfldr starts on port `9021`, you can press R2 to send `kstuff.elf`, `shadowmountplus.elf`, then `etaHEN.elf`.
 
 ## Stability notes
 Webkit may need several attempts, reload the page if the browser stalls. The kernel exploit may hang or panic the console, so reboot before trying again if that happens.
@@ -14,9 +13,9 @@ Webkit may need several attempts, reload the page if the browser stalls. The ker
 Browser stage uses JSC info leaks and a structured clone object pool mismatch to corrupt a typedarray. The kernel stage combines a address leak with an `aio_multi_wait` uaf race to establish kernel r/w.
 
 ## Credits
-ntfargo, ufm42, Sonic-Iso, Jordy, Dr. Yenyen, TheFlow, SlidyBat,  Flatz, cow, nhk, bollarz, Sleirsgoevy, EchoStretch, EarthOnion.
-
+ntfargo, ufm42, Sonic_Iso, Jordy, Dr. Yenyen, TheFlow, SlidyBat,  Flatz, cow, nhk, bollarz, Sleirsgoevy, EchoStretch, EarthOnion.
+ 
 ## Disclaimer
 This project is intended for **educational and security research purposes only**. It does not endorse piracy, unauthorized access, or misuse of commercial devices. Use it only on devices you own or are authorized to test, and comply with applicable laws and regulations.
 
-The software is provided as-is, without warranty. You assume the risks of using it, including system instability, data loss, and account bans. The maintainers accept no liability for resulting damage. 
+The software is provided as-is, without warranty. You assume the risks of using it, including system instability, data loss, and account bans. The maintainers accept no liability for resulting damage.

src/kexp.js

@@ -118,55 +118,6 @@ async function mapElf(name, p, chain) {
   return { base, size: elf.length };
 }
 
-async function connectToElfldr(p, chain) {
-  const address = p.malloc(16);
-  p.write8(address, new int64(0, 0));
-  p.write8(address.add32(8), new int64(0, 0));
-  p.write4(address, 0x3d230210); // AF_INET, port 9021
-  p.write4(address.add32(4), 0x0100007f); // 127.0.0.1
-
-  for (let attempt = 0; attempt < 40; attempt++) {
-    const socket = await chain.syscall(SYS_SOCKET, 2, 1, 0);
-    const fd = socket.low | 0;
-    if (fd >= 0) {
-      const connected = await chain.syscall(SYS_CONNECT, fd, address, 16);
-      if ((connected.low >>> 0) === 0) return fd;
-      await chain.syscall(SYS_CLOSE, fd);
-    }
-    await new Promise((resolve) => setTimeout(resolve, 250));
-  }
-
-  throw new Error("elfldr is not listening on port 9021");
-}
-
-async function sendElf(name, payload, p, chain) {
-  const fd = await connectToElfldr(p, chain);
-  try {
-    for (let offset = 0; offset < payload.size;) {
-      const length = Math.min(0x10000, payload.size - offset);
-      const written = (await chain.syscall(SYS_WRITE, fd, payload.base.add32(offset), length)).low | 0;
-      if (written <= 0) throw new Error(name + " socket write failed");
-      offset += written;
-    }
-  } finally {
-    await chain.syscall(SYS_CLOSE, fd);
-  }
-}
-
-export async function loadOptionalPayloads(p, chain, log) {
-  log("preparing optional payloads");
-  const kstuff = await mapElf("kstuff.elf", p, chain);
-  const shadowmount = await mapElf("shadowmountplus.elf", p, chain);
-  const etaHEN = await mapElf("etaHEN.elf", p, chain);
-  await sendElf("kstuff.elf", kstuff, p, chain);
-  log("kstuff.elf sent");
-  await new Promise((resolve) => setTimeout(resolve, 3000));
-  await sendElf("shadowmountplus.elf", shadowmount, p, chain);
-  log("shadowmountplus.elf sent");
-  await sendElf("etaHEN.elf", etaHEN, p, chain);
-  log("etaHEN.elf sent");
-}
-
 function patchShellcode(blob, symbols) {
   if (blob.length !== SHELLCODE.size)
     throw new Error("kexp: expected " + SHELLCODE.size + " bytes, got " + blob.length);

src/main.js

@@ -80,18 +80,6 @@ function log(message, type = "log") {
   window.writeLog(message, type);
 }
 
-function watchR2(onPress) {
-  function onKey(event) {
-    if (event.key !== "F8" || event.code !== "Unidentified") return;
-    window.removeEventListener("keydown", onKey, true);
-    event.preventDefault();
-    onPress();
-  }
-
-  log("press R2 to load kstuff, shadowmountplus and etaHEN", "info");
-  window.addEventListener("keydown", onKey, true);
-}
-
 const ROP_WAIT_MS = 20000;
 
 function jbmark(tag, detail) {
@@ -281,14 +269,6 @@ async function main(userlandRW) {
   if (result.payloads) {
     log("kernel exploit complete", "info");
     log("elfldr is listening on port 9021", "info");
-    watchR2(async () => {
-      try {
-        const { loadOptionalPayloads } = await import("./kexp.js");
-        await loadOptionalPayloads(p, chain, (message) => log(message, "info"));
-      } catch (error) {
-        log(error instanceof Error ? error.message : String(error), "error");
-      }
-    });
   } else {
     log("kernel chain complete: root and sandbox escape are active", "info");
   }