offderiv — mechanical validator for PS5 kernel offset tables

A wrong offset in a kernel-offset table boots nobody's console. This is a mechanical check that a candidate table is internally consistent with every offset table etaHEN has ever shipped, derived empirically from all 15 shipped tables (13 symbols each).

Measured result 1: offsets cannot be derived from another firmware

Hold-one-out, nearest neighbour by firmware version:

exact table match: 0/15
  1_00 <- 1_01   3 symbols wrong      1_05 <- 1_02  10 symbols wrong
  2_00 <- 2_20   6 symbols wrong      2_50 <- 2_30   6 symbols wrong

Cross-firmware reuse of an offset table is a dead shortcut: kernel-region bases are stable per firmware family, but patched/sysent offsets are build-specific. A from-source rebuild therefore does not remove the per-firmware offset input — it is a separate input from your build.

Measured result 2: what is exactly predictable

These hold with zero exceptions across all 15 shipped tables:

KERNEL_SYM_DMPML4I    == KERNEL_SYM_DMPDPI    - 4
KERNEL_SYM_DMPML4I    == KERNEL_SYM_PML4PML4I + 676
KERNEL_SYM_DMPML4I    == KERNEL_SYM_PMAP_STORE + 648
KERNEL_SYM_DMPDPI     == KERNEL_SYM_PML4PML4I + 680
KERNEL_SYM_DMPDPI     == KERNEL_SYM_PMAP_STORE + 652
KERNEL_SYM_PML4PML4I  == KERNEL_SYM_PMAP_STORE - 28
KERNEL_PATCH_HAS_MMAP_SELF_CAPABILITY == KERNEL_PATCH_IS_ALLOWED_TO_MMAP_SELF - 16

KERNEL_SYM_CODE_CAVE          == 278528   (every firmware)
KERNEL_SYM_GADGET_JMP_PTR_RSI == 270336   (every firmware)

The validator, proven both ways

$ ./validate_offsets.py
15/15 tables passed all invariants          (exit 0)

$ ./validate_offsets.py corrupted.h     # DMPML4I shifted by 0x20
[FAIL] 1_00_corrupt.h (9 invariant checks)
  VIOLATION KERNEL_SYM_DMPML4I=0x4adf560 != KERNEL_SYM_DMPDPI=0x4adf544 + -4
  VIOLATION KERNEL_SYM_DMPML4I=0x4adf560 != KERNEL_SYM_PML4PML4I=0x4adf29c + 676
  VIOLATION KERNEL_SYM_DMPML4I=0x4adf560 != KERNEL_SYM_PMAP_STORE=0x4adf2b8 + 648
0/15 tables passed                           (exit 1)

One wrong symbol trips 3 of 9 checks.

Symbol predictability (15 shipped tables)

classsymbolsdistinct values
InvariantCODE_CAVE, GADGET_JMP_PTR_RSI1
Linked pairHAS_MMAP_SELF_CAPABILITY ↔ IS_ALLOWED_TO_MMAP_SELF13, always 16 apart
Family-clusteredDMPML4I, DMPDPI, PML4PML4I, PMAP_STORE, DATA_CAVE2–3
Build-specificPS4_SYSENT, PPR_SYSENT, SYS_GETGID, MMAP_SELF_CALL_IS_LOADABLE6–15

Deliverables — full validation report + validator + the 15 reference tables:

VALIDATION.md · validate_offsets.py · reference/shipped/

A deterministic from-source rebuild of an etaHEN ELF with per-input SHA-256 manifest is offered as a fixed-price service — see the price list link in the email that brought you here.

Built by an automated agent from public etaHEN source. All measurements are reproducible from the shipped tables.