# Payload Injection Using PS3MAPI in webMAN MOD: Complete Implementation Guide

> Learn how to implement payload injection using PS3MAPI within webMAN MOD. This guide details the complete subsystem and the /payload.ps3mapi endpoint for loading binaries.

- Repository: [Aldo Vargas/webman-mod](https://github.com/aldostools/webman-mod)
- Tags: how-to-guide
- Published: 2026-02-24

---

**Yes, webMAN MOD already implements a complete payload injection subsystem using PS3MAPI that exposes the `/payload.ps3mapi` HTTP endpoint to load binaries into target process memory.**

The webMAN MOD project (`aldostools/webman-mod`) integrates a fully functional **payload injection using PS3MAPI** framework that allows direct binary injection into running processes via HTTP requests. This capability leverages the PlayStation 3 Memory API (PS3MAPI) interface to perform low-level memory allocation, file loading, and syscall execution without requiring external tools. When enabled, the system creates a dedicated server thread that listens for injection commands and handles memory mapping automatically.

## How PS3MAPI Payload Injection Works

The implementation follows a layered architecture that routes HTTP commands through the webMAN MOD command handler down to the PS3MAPI syscall interface. When the server receives a request at the `/payload.ps3mapi` endpoint, it parses the target process ID and payload file path, then invokes the `StartGamePayload` function to map the binary into executable memory segments and commence execution.

## Enabling PS3MAPI Support

Before using payload injection, you must ensure PS3MAPI support is compiled and enabled in your webMAN MOD configuration.

In [`main.c`](https://github.com/aldostools/webman-mod/blob/main/main.c), the PS3MAPI server thread is conditionally started based on the `PS3MAPI` preprocessor definition:

```c
#ifdef PS3MAPI
    sys_ppu_thread_create(&thread_id_ps3mapi, ps3mapi_thread, ...);
#endif

```

According to the source code in [`main.c`](https://github.com/aldostools/webman-mod/blob/main/main.c) (lines 571-579), this thread creation only occurs when the `PS3MAPI` flag is defined during compilation and the user has enabled the feature via the web interface at `/setup.ps3`.

## The HTTP Endpoint for Payload Injection

The command dispatcher in [`include/cmd/ps3mapi.h`](https://github.com/aldostools/webman-mod/blob/main/include/cmd/ps3mapi.h) monitors incoming HTTP requests for the specific `/payload.ps3mapi` path:

```c
if(islike(param, "/payload.ps3mapi")) 
    ps3mapi_payload(pbuffer, html, param);

```

As implemented in [`include/cmd/ps3mapi.h`](https://github.com/aldostools/webman-mod/blob/main/include/cmd/ps3mapi.h) (lines 83-86), this routing function forwards the request parameters to the payload handler, which extracts the `proc` (process ID) and `file` query parameters.

## Core Implementation Files

### main.c – Thread Initialization

The PS3MAPI server infrastructure begins in [`main.c`](https://github.com/aldostools/webman-mod/blob/main/main.c) where the system creates the background thread responsible for handling API requests. This thread runs independently of the main web server and manages the syscall interface to the PS3 kernel through the `ps3mapi_thread` function.

### ps3mapi.h – High-Level Payload API

The `ps3mapi_payload()` function defined in [`include/ps3mapi/ps3mapi.h`](https://github.com/aldostools/webman-mod/blob/main/include/ps3mapi/ps3mapi.h) (lines 1199-1225) serves as the primary orchestrator. It performs the following operations:

- Parses the `proc` parameter to identify the target process ID
- Reads the payload file from the specified path (defaulting to `/dev_hdd0/payload.bin`)
- Handles the optional `unload` flag to free allocated memory
- Invokes `StartGamePayload()` to execute the injection

```c
uint64_t executableMemoryAddress = StartGamePayload(pid, payload, 
    0x7D0, 0x4000, pageTable, error_msg);

```

### ps3mapi_payload.h – Low-Level Injection Logic

The actual memory manipulation occurs in [`include/ps3mapi/ps3mapi_payload.h`](https://github.com/aldostools/webman-mod/blob/main/include/ps3mapi/ps3mapi_payload.h) (lines 1500-1535) within the `StartGamePayload()` function. This implementation performs:

- Memory allocation in the target process address space
- Binary file loading from the filesystem
- PS3MAPI syscall execution using `SYSCALL8_OPCODE_RUN_PAYLOAD` or `SYSCALL8_OPCODE_RUN_PAYLOAD_DYNAMIC`

```c
system_call_3(SC_COBRA_SYSCALL8, SYSCALL8_OPCODE_RUN_PAYLOAD, ...);

```

### www_client.h – Web Interface

The user-facing interface is generated in [`include/www/www_client.h`](https://github.com/aldostools/webman-mod/blob/main/include/www/www_client.h) (lines 1180-1194), which renders an HTML form for payload submission. This form posts to `/payload.ps3mapi` and allows users to specify the target process and payload file through a browser interface at `/home.ps3mapi`.

## Practical Usage Examples

To inject a payload into a running process, send an HTTP GET request to the webMAN MOD server with the appropriate query parameters.

Injecting a payload into process `0x1234abcd`:

```bash
curl "http://192.168.1.42/payload.ps3mapi?proc=0x1234abcd&file=/dev_hdd0/payload.bin"

```

The server returns a confirmation message containing "Loaded" upon successful injection. If you omit the `file` parameter, the system defaults to `/dev_hdd0/payload.bin`.

To unload a previously injected payload and free the allocated memory:

```bash
curl "http://192.168.1.42/payload.ps3mapi?proc=0x1234abcd&unload"

```

## Summary

- webMAN MOD includes a complete **payload injection using PS3MAPI** subsystem that requires no additional plugins when compiled with `PS3MAPI` support.
- The `/payload.ps3mapi` HTTP endpoint accepts `proc` (process ID) and `file` (binary path) parameters to execute injection.
- The implementation spans [`main.c`](https://github.com/aldostools/webman-mod/blob/main/main.c) (thread creation), [`include/cmd/ps3mapi.h`](https://github.com/aldostools/webman-mod/blob/main/include/cmd/ps3mapi.h) (command routing), [`include/ps3mapi/ps3mapi.h`](https://github.com/aldostools/webman-mod/blob/main/include/ps3mapi/ps3mapi.h) (parameter parsing), and [`include/ps3mapi/ps3mapi_payload.h`](https://github.com/aldostools/webman-mod/blob/main/include/ps3mapi/ps3mapi_payload.h) (syscall execution).
- Users can inject payloads via simple HTTP requests or the built-in web interface at `/home.ps3mapi`.
- The `unload` parameter allows safe removal of payloads by deallocating process memory through the PS3MAPI interface.

## Frequently Asked Questions

### Is payload injection built into webMAN MOD or does it require additional plugins?

Payload injection is built directly into webMAN MOD when compiled with the `PS3MAPI` preprocessor definition. The functionality resides entirely within the webMAN MOD binary and exposes the `/payload.ps3mapi` endpoint without requiring external tools or kernel modules beyond the standard PS3MAPI support.

### What file format should the payload binary use?

The payload must be a raw binary file (typically named `payload.bin`) placed on the PS3 filesystem, usually at `/dev_hdd0/payload.bin`. The `StartGamePayload` function in [`include/ps3mapi/ps3mapi_payload.h`](https://github.com/aldostools/webman-mod/blob/main/include/ps3mapi/ps3mapi_payload.h) loads this binary directly into executable memory without additional format conversion or ELF parsing.

### How do I unload a previously injected payload?

Append the `unload` query parameter to the endpoint URL: `/payload.ps3mapi?proc=0x1234abcd&unload`. This triggers the memory deallocation routine in `ps3mapi_payload()`, freeing the allocated pages from the target process address space via PS3MAPI syscalls.

### Can I inject payloads into any process or only specific games?

The `proc` parameter accepts any valid process ID (PID) accessible through PS3MAPI. You can inject into game processes, system processes, or any running executable that the PS3MAPI server has permission to access, provided you know the hexadecimal PID value and the process has sufficient privileges for memory mapping operations.