README

kstuff-lite — 1.11-opt

1.11-opt builds on the existing kstuff-lite crypto, FSELF, NPDRM, and loader
work. It reduces UELF/KELF transition cost, makes FPU/CR0 handling safer and
faster, and adds detailed opt-in diagnostics.

 Highlights

- Cached translations for fixed per-CPU kernel objects used on every UELF
  entry, including mappings that cross a physical segment boundary.
- Narrow checked trap-frame and stack reads instead of copying unused frame
  prefixes.
- A single-transition debug-register restore and skipped hardware snapshots
  when the current thread does not own active debug registers.
- A validated, normally fault-free CR0 save/TS-clear chain with mandatory
  per-kernel gadgets and no legacy CR0-capture fallback.
- Fast CR0 entry through a one-shot KELF continuation and deferred CR0 restore
  at the final KELF exit.
- Runtime selection between XSAVEC and XSAVE, with one-time CPUID/XCR0
  discovery and strict save-area validation.
- Expanded opt-in performance and failure metrics through KSTUFF_OBS=1.
- Reuse of the loader's existing kernel pipe by prosper0gdb.

 UELF trap and kernel-memory paths

 Narrow checked frame reads

Trap handlers now read only the portion of a saved stack frame that they use.
fpkg, kekcall, and utility trap handling use checked tail-copy helpers;
mailbox and syscall paths use checked scalar reads and writes. Where the return
address is already known, FSELF handling updates RSP and RIP directly
instead of reading the same value from kernel memory again.

This reduces virt2phys calls and copied bytes without weakening error
handling. A failed read or write returns EFAULT or leaves the request on its
normal fallback path instead of consuming partially read state.

 Fixed mapping caches

The following stable per-CPU objects have cached virtual-to-physical mappings:

- the extended trap frame;
- the justreturn frame;
- the current-thread pointer in pcpu;
- TSS.RSP0;
- the wrmsr argument area;
- the CR0 enter and exit continuation slots.

The cache can represent two physical segments, so an object crossing a page or
mapping boundary does not need to fall back on every access. Initialization is
checked, publication is atomic, and an uncached checked copy remains available
if a mapping cannot be cached.

The UELF page-table setup also spells out the user, writable, present, and
large-page flags explicitly. Direct-map entries are not made global, avoiding
unsafe stale TLB translations when switching between the kernel and UELF CR3.

 Crypto dispatch

During classification, the fake key is retrieved once and passed to the XTS or
HMAC handler. This removes the former has_fake_key() lookup followed by a
second get_fake_key() lookup. XTS and HMAC cache selection also performs one
scan that records both a matching entry and the first free entry.

Unhandled or non-fake messages retain the original kernel path, and linked
message chains are still traversed correctly. Snapshot read failures are
counted and fail safely.

 D

Top issues

Latest release

Kstuff Lite 1.11 Beta Supports Firmware 1.00-13.60

A huge thanks to @sleirsgoevy for the help and creating this project, and to @zecoxao, @flatz, @idlesauce, @buzzer-re, @Al-Azif, @drakmor and everyone else who contributed. Your work and support are greatly appreciated!

🔹 Changelog
Added 13.xx Support
Added 1.xx/2.xx Support @drakmor 
Added Fpkg Upto 11.40 @drakmor 
Performance tuning @drakmor
PS4 media app support @drakmor
Fixed Fpkg For 11.60 @ArkSama 
Fixed int3 For 13.xx @idlesauce 
Added Misc Kit Stuff

 @drakmor put alot of work into fpkg so make sure you thank him..