Drop per-device Ed25519 licenses and TCP install in favor of a build-time
seal plus sealed trial.state anti-rollback. Rename libonion_activation to
libonion_trial, show beta notices in daemon toast and toolbox UI, remove
unused V_FW, and set author to 麒麟/0xp0co.
There were seven ways to log, each invented where the previous one was not
reachable:
OnionHEN_log libonion_platform, the only one with a file sink
shellui_log libonion_ipc, klog only — because it did not depend on
libonion_platform
game_log same body as shellui_log
onion_ipc_log same body again
logf libonion_ipc's IPC server, with a sink the host had to
register
log_msg onion_elfldr_server
crash_log util's fault handler, plus a second copy in common/
boot_log bootstrapper's fault handler
klog_printf / klog_puts / printf / puts, called directly
A message's destination therefore depended on which module happened to emit
it: ShellUI's ~300 records went to volatile klog and never reached a log file,
while the daemon's went to klog, stdout and disk.
Everything now goes through the LOG_* macros. All seven legacy entry points
are gone, and klog_printf survives only as a sink inside log.c.
The bare -nostdlib libraries deliberately did not get their own backend. Those
flags only affect the static library's own link step; each is linked into a
host with full libc and pthread, which is why they already called vsnprintf.
A second backend would have recreated the split this removes.
Levels were inferred from message text rather than applied uniformly — the old
entry points carried no severity, so a blanket mapping would either bury real
failures at debug or promote routine chatter to error. Result: 291 error, 63
warn, 140 info, 309 debug.
Consequences worth noting:
* ShellUI records now reach the log file, so a user report finally contains
what the injected process did. In release builds most of them are debug
and compile out, so this costs nothing on a retail unit.
* The IPC server's log-sink injection is gone; both servers registered the
same forwarder.
* common/backtrace.cpp and backtrace.hpp are deleted. That was a third copy
of the frame walking plus its own crash_log, and every caller of
printBacktrace/printBacktraceForCrash had already been commented out.
* Fault handlers use onion_log_emergency, so crash records go to the same
file as everything else instead of a separate crash log.
The shared entry point carries a printf format attribute, which the old
shellui_log explicitly avoided. That attribute found seven real format
defects: %p given typed pointers, %lx given a MonoObject*, %p given a
uint64_t, and %u given an unsigned long. Four of them only compile in debug
builds, so they had gone unnoticed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
source/include mixed libhijacker's private implementation headers (util.hpp
with its hand-rolled UniquePtr/String/Vector, plus kernel/, elf/, dbg/,
hijacker/) with genuinely cross-module contracts, and the whole directory was
pulled in as -isystem, so any module could reach libhijacker internals and
every warning in those headers was suppressed.
Move the libhijacker-private headers to source/libhijacker/include and expose
it as a PUBLIC include directory, so the two modules that actually use it —
util for hijacker.hpp, shellui for SHA-1 — now declare that dependency.
Split sha1.hpp: the public-domain SHA-1 goes to third_party/sha1, while
NID_KEY, Sha1 and genSha1 (which needed libhijacker's StringView) move into
the nid.hpp that uses them. shellui only ever wanted the plain digest.
Drop source/include's SYSTEM marker now that it holds only first-party
contracts. That surfaced problems -isystem had been hiding:
* 68 format-string mismatches in dbg.hpp, printing uintptr_t with %llx
* freebsd-helper.h redefining PROT_* and TRACEBUF over the SDK's
* ini.h's header-only helpers declared static rather than static inline
The GNU extensions that TYPE_BEGIN/TYPE_FIELD rely on are now silenced per
header instead of by the blanket -isystem.
Also drop three redundant util.hpp includes (bootstrapper, shellui) that
referenced none of its symbols, and fix backtrace.hpp being included through
relative ../include paths.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
get_ip_address had three independent implementations (shellui, util, daemon)
because each module also carried its own copy of SceNetCtlInfo and its own
prototype for sceNetCtlGetInfo, with the pointer typed as SceNetCtlInfo* in
two of them and void* in the third.
The shellui and util copies stored the result in an unsigned int and tested
`ret < 0`, which is never true for an unsigned value. Their error branch was
unreachable, so a failed lookup returned success, left not_connected clear,
and copied an uninitialised SceNetCtlInfo to the caller instead of the
IP NOT FOUND placeholder. util's rest-mode network-recovery retry keys off
that return value and therefore never ran.
Declare the netctl ABI once in source/include/ps5/net_ctl.h, add
onion_net_get_ip_address to libonion_platform with an explicit buffer-size
contract, and keep util's not_connected latch in util where it belongs.
Cover the status mapping, the placeholder length and buffer validation with
host tests.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Drop source/include/global.h and mempack.h. The two headers include each
other and nothing else in the tree includes either, so the VideoOut, ScePad
and vector-math declarations they carry have been unreachable since the
etaHEN import.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Move exact Title IDs and prefix matching into the shared config schema while retaining safe defaults for existing or invalid configurations.
Validate and deduplicate allowlist entries, support explicit none values, and update host tests and configuration documentation.
Restore ITEM00001 to the app-jailbreak allowlist so the Itemzflow loader can complete its legacy handshake.
Reserve the removed dumper command at 0x9000004, lock the released critical IPC ordinals with host tests, and document the remaining legacy socket compatibility gap.
Require user payloads to launch through :9020 with an exact PID response, removing the :9021 fallback and process-snapshot PID inference.
Supervise the private loader from daemon, recover it through :9021 before restarting util through :9020, and protect synchronous launches with a bounded busy marker.
Add strict loader tests, update runtime documentation, and remove obsolete elfldr and process-snapshot compatibility APIs.
Generate shared version metadata from an exact Git tag, falling back to dirty-YYMMDD-SHA for untagged or modified trees. Show the version and author in the startup toast and reuse the generated version across ShellUI.
Remove FPS calculation from the shellui monitor bar while keeping CPU,
GPU, RAM, and IP metrics, and delete the full game-process inject path
(fps_elf, fps.prx, SHM) so titles are no longer soft-injected.
Clear any legacy fps_overlay ready marker on daemon/shellui start, and
bound CPU sampling retries so a stuck probe cannot block other metrics.
Drop the ShellUI dump menu entry and OnionHEN?Dump URI handling. Replace
dumper_utils with file_copy_utils for generic IPC copy/size helpers only.
Also drop WIP wording from the cheats menu label.
Rename product, namespaces, libraries, paths, and assets from Orion/orion
to Onion/onion across the tree. TCP stack-shutdown magic is now ONIO
(0x4F4E494F) to match the corrected branding.
Ship the PHU-style ShellUI top bar and file SHM channel for FPS samples.
Soft-inject fps_elf without process suspend (suspend+ptrace hung titles).
Document and gate the confirmed freeze: DetourFunction on the linked
sceGnmSubmitAndFlipCommandBuffersForWorkload entry (prologue size 17)
freezes games even after a 20s defer. Keep ORION_FPS_ARM_GNM_HOOK=0 so
inject only opens SHM until a safe flip probe is verified.
See docs/fps-overlay-known-issues.md.
Add BREW_SHUTDOWN_STACK (0xDEAD0002): kill util.elf, ForceKill SceShellUI,
then exit the crit daemon. Expose the same sequence on TCP port 9048 with
ORIO magic frames so a PC can tear down OrionHEN over the LAN.
Provide scripts/shutdown_orion.py (kill_daemon.py becomes a thin alias) and
IPC_Client::ShutdownStack for on-console Unix clients.
Remove the .plugin package format and rename the stack to payload-only:
liborion_plugin → liborion_payload, IPC LAUNCH_PAYLOAD, UI payloads.xml,
and bootstrapper/util/shellui load paths under .../payloads/*.elf.
Delete dead package header validation, make_plugin_app staging, and
plugin-named lists/handlers; keep Sony Settings.Plugins resource namespace
and system_settings plugin= attributes (platform, not our format).
patch_checker always claimed "Coming out of Rest Mode" even when util
restarted mid-session because util_booted was sticky. Pass rest_resume
explicitly: only rest paths show rest copy and apply rest delay. Clear
util_booted/fps_overlay in bootstrapper so re-HEN does not look like a
prior boot.
Serialize IPC_Client with a per-target mutex and full-frame send/recv plus
NUL-terminated payloads. Escape reply JSON vars, null-check daemon FS paths,
handle BREW_UTIL_TEST_CONNECTION, and track BREW_LAST_RET from the last reply.
Introduce SettingsStore (mutex snapshot/update), dual-path config mtime gating,
and fan IPC persistence to twin config files. Stop cold-start toolbox delay on
util_booted; fix jailbreak hijack retry to stop only when dead or maxed.
Add host tests for IPC wire helpers, toolbox timing policy, and hijack retry.
Delete error_translator.hpp, microhttpd.h, and libmicrohttpd.a left after
removing DirectPKGInstaller. Strip unused AppInst types from util/daemon,
drop SceAppInstUtil link where no longer needed, remove dead dpi/kernelrw
thread stubs, drop the toolbox microhttpd credit, and refresh README.
Delete DirectPKGInstaller and the toolbox DPI toggle. Remove the custom
background package installer (custompkginstaller XML generation and
id_pkg_ handlers). Package install remains the stock PkgInstaller link
in OrionHEN_toolbox.xml. Leave BREW_UTIL_UNUSED_DPI ordinal for IPC
compatibility.
Add suites for liborion_platform (fs/log/notify), richer settings and ready
flag cases, and msg.hpp protocol ordinals. Link real platform sources under
ORION_HOST_TEST; fix DaemonCommands to unsigned so high-bit opcodes are
well-formed. Rename host binary to orion-host-tests.
Replace fps_enabled / util_first_boot file flags with orion_ready names
(fps_overlay, util_booted). Route util toolbox enable through
IPC_Client::EnableToolbox and drop dead network* transport facades from
util msg.cpp. Document daemon/shellui seams in arch.md.
Drop unused hello_world ELF blob, sqlite headers/lib, and orphan
demo headers. Replace the 14k SCE error dump with a ~300-entry
install/BGFT table for DPI, cutting ~7MB from the source tree.
Replace fixed post-spawn sleeps with named markers under
/system_tmp/orion_ready. util/daemon/kstuff/toolbox publish ready; bootstrapper
and toolbox inject wait with timeouts. Keep legacy toolbox_online as alias.
Move util cheats orchestration to C++ (CheatService, Repository, Applier,
IMemoryBackend, ICheatParser factory for json/shn/mc4 with ShnExt C adapter).
Drop the obsolete RELOAD_CHEATS UI/IPC path; reloads use file-signature hot
reload only. Document util cheats architecture under docs/util_arch.
Drop decrypt_self/decrypt_dir and related SELF header types from the
critical daemon. Keep BREW_DECRYPT_DIR as an unused ordinal for
compatibility; callers receive a hard failure.
Hexwell