Payload Injection Using PS3MAPI in webMAN MOD: Complete Implementation Guide

Yes, webMAN MOD already implements a complete payload injection subsystem using PS3MAPI that exposes the /payload.ps3mapi HTTP endpoint to load binaries into target process memory.

The webMAN MOD project (aldostools/webman-mod) integrates a fully functional payload injection using PS3MAPI framework that allows direct binary injection into running processes via HTTP requests. This capability leverages the PlayStation 3 Memory API (PS3MAPI) interface to perform low-level memory allocation, file loading, and syscall execution without requiring external tools. When enabled, the system creates a dedicated server thread that listens for injection commands and handles memory mapping automatically.

How PS3MAPI Payload Injection Works

The implementation follows a layered architecture that routes HTTP commands through the webMAN MOD command handler down to the PS3MAPI syscall interface. When the server receives a request at the /payload.ps3mapi endpoint, it parses the target process ID and payload file path, then invokes the StartGamePayload function to map the binary into executable memory segments and commence execution.

Enabling PS3MAPI Support

Before using payload injection, you must ensure PS3MAPI support is compiled and enabled in your webMAN MOD configuration.

In main.c, the PS3MAPI server thread is conditionally started based on the PS3MAPI preprocessor definition:

#ifdef PS3MAPI
    sys_ppu_thread_create(&thread_id_ps3mapi, ps3mapi_thread, ...);
#endif

According to the source code in main.c (lines 571-579), this thread creation only occurs when the PS3MAPI flag is defined during compilation and the user has enabled the feature via the web interface at /setup.ps3.

The HTTP Endpoint for Payload Injection

The command dispatcher in include/cmd/ps3mapi.h monitors incoming HTTP requests for the specific /payload.ps3mapi path:

if(islike(param, "/payload.ps3mapi")) 
    ps3mapi_payload(pbuffer, html, param);

As implemented in include/cmd/ps3mapi.h (lines 83-86), this routing function forwards the request parameters to the payload handler, which extracts the proc (process ID) and file query parameters.

Core Implementation Files

main.c – Thread Initialization

The PS3MAPI server infrastructure begins in main.c where the system creates the background thread responsible for handling API requests. This thread runs independently of the main web server and manages the syscall interface to the PS3 kernel through the ps3mapi_thread function.

ps3mapi.h – High-Level Payload API

The ps3mapi_payload() function defined in include/ps3mapi/ps3mapi.h (lines 1199-1225) serves as the primary orchestrator. It performs the following operations:

• Parses the proc parameter to identify the target process ID
• Reads the payload file from the specified path (defaulting to /dev_hdd0/payload.bin)
• Handles the optional unload flag to free allocated memory
• Invokes StartGamePayload() to execute the injection

uint64_t executableMemoryAddress = StartGamePayload(pid, payload, 
    0x7D0, 0x4000, pageTable, error_msg);

ps3mapi_payload.h – Low-Level Injection Logic

The actual memory manipulation occurs in include/ps3mapi/ps3mapi_payload.h (lines 1500-1535) within the StartGamePayload() function. This implementation performs:

• Memory allocation in the target process address space
• Binary file loading from the filesystem
• PS3MAPI syscall execution using SYSCALL8_OPCODE_RUN_PAYLOAD or SYSCALL8_OPCODE_RUN_PAYLOAD_DYNAMIC

system_call_3(SC_COBRA_SYSCALL8, SYSCALL8_OPCODE_RUN_PAYLOAD, ...);

www_client.h – Web Interface

The user-facing interface is generated in include/www/www_client.h (lines 1180-1194), which renders an HTML form for payload submission. This form posts to /payload.ps3mapi and allows users to specify the target process and payload file through a browser interface at /home.ps3mapi.

Practical Usage Examples

To inject a payload into a running process, send an HTTP GET request to the webMAN MOD server with the appropriate query parameters.

Injecting a payload into process 0x1234abcd:

curl "http://192.168.1.42/payload.ps3mapi?proc=0x1234abcd&file=/dev_hdd0/payload.bin"

The server returns a confirmation message containing "Loaded" upon successful injection. If you omit the file parameter, the system defaults to /dev_hdd0/payload.bin.

To unload a previously injected payload and free the allocated memory:

curl "http://192.168.1.42/payload.ps3mapi?proc=0x1234abcd&unload"

Summary

• webMAN MOD includes a complete payload injection using PS3MAPI subsystem that requires no additional plugins when compiled with PS3MAPI support.
• The /payload.ps3mapi HTTP endpoint accepts proc (process ID) and file (binary path) parameters to execute injection.
• The implementation spans main.c (thread creation), include/cmd/ps3mapi.h (command routing), include/ps3mapi/ps3mapi.h (parameter parsing), and include/ps3mapi/ps3mapi_payload.h (syscall execution).
• Users can inject payloads via simple HTTP requests or the built-in web interface at /home.ps3mapi.
• The unload parameter allows safe removal of payloads by deallocating process memory through the PS3MAPI interface.

Frequently Asked Questions

Is payload injection built into webMAN MOD or does it require additional plugins?

Payload injection is built directly into webMAN MOD when compiled with the PS3MAPI preprocessor definition. The functionality resides entirely within the webMAN MOD binary and exposes the /payload.ps3mapi endpoint without requiring external tools or kernel modules beyond the standard PS3MAPI support.

What file format should the payload binary use?

The payload must be a raw binary file (typically named payload.bin) placed on the PS3 filesystem, usually at /dev_hdd0/payload.bin. The StartGamePayload function in include/ps3mapi/ps3mapi_payload.h loads this binary directly into executable memory without additional format conversion or ELF parsing.

How do I unload a previously injected payload?

Append the unload query parameter to the endpoint URL: /payload.ps3mapi?proc=0x1234abcd&unload. This triggers the memory deallocation routine in ps3mapi_payload(), freeing the allocated pages from the target process address space via PS3MAPI syscalls.

Can I inject payloads into any process or only specific games?

The proc parameter accepts any valid process ID (PID) accessible through PS3MAPI. You can inject into game processes, system processes, or any running executable that the PS3MAPI server has permission to access, provided you know the hexadecimal PID value and the process has sufficient privileges for memory mapping operations.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}