Implement the daemon-side Host Service handlers that the SDK client already
sends, and the two descriptor flags the SDK defines beyond auto-start.
- session: add LOG/NOTIFY/CONFIG_GET/CONFIG_SET commands and a HostServices
interface injected by the daemon; NOTIFY is gated by the Notify capability
- daemon: route log to LOG_*, notify to the toast, and config to a persistent
per-plugin ConfigStore under the plugin install root
- manager: honor LONG_RUNNING (crash supervision on reconcile) and
STOP_SUPPORTED (graceful SIGTERM vs immediate SIGKILL)
- tests: cover host-service gating/config round-trip and the new flags
- fix(fps): measure PS4 BC frame rate with a remote GNM detour
and hide the pkg install result code in the finish notification
- feat(utils): integrate ShadowMount+ alongside the FTPSRV service
for game scanning, mounting and installation
- feat(DPI): add the packet package server (pkgserver) with its
Web UI and full REST/SSE API surface
- feat(tests): add new host test suites (multipart, builtin
services, pkg XML, FPS formula, toolbox i18n/route, language)
- build: add Docker support for building and running the tests
- docs: update credits, README, architecture, util-arch, api and
third-party documentation; add contributor credit and i18n keys
- i18n: remove the pkg finish result code from every locale
Ed25519 signing no longer adds useful friction. Drop
libonion_integrity, tools/elf_sign, and the XOR integrity toasts
so builds no longer sign daemon.elf.
Notifications look up notify.* keys instead of English source
strings. Toolbox interpolations go through toolbox_i18n::format so
zh/en word order lives in the JSON catalogs.
Firmware reasserts its own curve after a one-shot /dev/icc_fan
ioctl. Rewrite the configured threshold every 2s independently of
the app-jailbreak listener, and reuse the shared cooling constants.
Keep redistribution and integrity notices out of ELF .rodata by storing
XOR+position-math blobs and decoding at runtime, so casual string search
cannot locate and patch them. Covers toolbox XML banner, bootstrapper
debug toasts, and the shared integrity failure path in daemon.
Add onion_trial_gate_ex(notify_ok) so daemon can revalidate without
re-showing remaining-days or redistribution notices already shown by
the bootstrapper boot gate.
Add libonion_integrity (Ed25519 self-check + signed-image verify) and
host sign/verify tools. Bootstrapper now verifies the embedded daemon
and runs the beta trial gate before launching private elfldr, util, or
daemon. Stop writing OnionHEN.bin under /data/OnionHEN; link kernel_sys
from bootstrapper for device serial used by trial.
Drop per-device Ed25519 licenses and TCP install in favor of a build-time
seal plus sealed trial.state anti-rollback. Rename libonion_activation to
libonion_trial, show beta notices in daemon toast and toolbox UI, remove
unused V_FW, and set author to 麒麟/0xp0co.
Introduce a self-contained libonion_activation module for internal-test
license checks, with compile-time public-key injection, debug-style
toasts, and shared notification i18n. Disable with
ONION_ENABLE_BETA_ACTIVATION=OFF when the beta gate is no longer needed.
ps5-payload-sdk v0.41 changed kernel_get/set_ucred_attrs from a uint64_t
value at ucred+0x83 to a 32-byte buffer starting at ucred+0x80. Update
jb_apply_privileges to use the new prototype and set attrs[3] = 0x80 so
the ptrace-capable sceAttr byte (still at +0x83) matches Hijacker.
There were seven ways to log, each invented where the previous one was not
reachable:
OnionHEN_log libonion_platform, the only one with a file sink
shellui_log libonion_ipc, klog only — because it did not depend on
libonion_platform
game_log same body as shellui_log
onion_ipc_log same body again
logf libonion_ipc's IPC server, with a sink the host had to
register
log_msg onion_elfldr_server
crash_log util's fault handler, plus a second copy in common/
boot_log bootstrapper's fault handler
klog_printf / klog_puts / printf / puts, called directly
A message's destination therefore depended on which module happened to emit
it: ShellUI's ~300 records went to volatile klog and never reached a log file,
while the daemon's went to klog, stdout and disk.
Everything now goes through the LOG_* macros. All seven legacy entry points
are gone, and klog_printf survives only as a sink inside log.c.
The bare -nostdlib libraries deliberately did not get their own backend. Those
flags only affect the static library's own link step; each is linked into a
host with full libc and pthread, which is why they already called vsnprintf.
A second backend would have recreated the split this removes.
Levels were inferred from message text rather than applied uniformly — the old
entry points carried no severity, so a blanket mapping would either bury real
failures at debug or promote routine chatter to error. Result: 291 error, 63
warn, 140 info, 309 debug.
Consequences worth noting:
* ShellUI records now reach the log file, so a user report finally contains
what the injected process did. In release builds most of them are debug
and compile out, so this costs nothing on a retail unit.
* The IPC server's log-sink injection is gone; both servers registered the
same forwarder.
* common/backtrace.cpp and backtrace.hpp are deleted. That was a third copy
of the frame walking plus its own crash_log, and every caller of
printBacktrace/printBacktraceForCrash had already been commented out.
* Fault handlers use onion_log_emergency, so crash records go to the same
file as everything else instead of a separate crash log.
The shared entry point carries a printf format attribute, which the old
shellui_log explicitly avoided. That attribute found seven real format
defects: %p given typed pointers, %lx given a MonoObject*, %p given a
uint64_t, and %u given an unsigned long. Four of them only compile in debug
builds, so they had gone unnoticed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adds [logging] level to the shared config schema, applied on every settings
load — so BREW_RELOAD_SETTINGS re-applies it and a user can raise verbosity
for a bug report without a debug payload or a reboot.
libonion_settings stays independent of libonion_platform, so the level
constants exist in both. onion/log_settings.hpp is the single place that sees
both headers and static_asserts that they still agree; it also clamps a
request to what the build actually compiled in and reports the effective
level back, so asking for trace in a release build logs why it stayed at
info rather than silently ignoring the setting.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
source/include mixed libhijacker's private implementation headers (util.hpp
with its hand-rolled UniquePtr/String/Vector, plus kernel/, elf/, dbg/,
hijacker/) with genuinely cross-module contracts, and the whole directory was
pulled in as -isystem, so any module could reach libhijacker internals and
every warning in those headers was suppressed.
Move the libhijacker-private headers to source/libhijacker/include and expose
it as a PUBLIC include directory, so the two modules that actually use it —
util for hijacker.hpp, shellui for SHA-1 — now declare that dependency.
Split sha1.hpp: the public-domain SHA-1 goes to third_party/sha1, while
NID_KEY, Sha1 and genSha1 (which needed libhijacker's StringView) move into
the nid.hpp that uses them. shellui only ever wanted the plain digest.
Drop source/include's SYSTEM marker now that it holds only first-party
contracts. That surfaced problems -isystem had been hiding:
* 68 format-string mismatches in dbg.hpp, printing uintptr_t with %llx
* freebsd-helper.h redefining PROT_* and TRACEBUF over the SDK's
* ini.h's header-only helpers declared static rather than static inline
The GNU extensions that TYPE_BEGIN/TYPE_FIELD rely on are now silenced per
header instead of by the blanket -isystem.
Also drop three redundant util.hpp includes (bootstrapper, shellui) that
referenced none of its symbols, and fix backtrace.hpp being included through
relative ../include paths.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
aydencharles