diff --git a/docs/injecting.md b/docs/injecting.md
new file mode 100644
index 0000000..ca2aa69
--- /dev/null
+++ b/docs/injecting.md
@@ -0,0 +1,107 @@
+# Injecting OrbisRPC into the PS4 — the complete guide
+
+This exists because getting a payload to *execute* took longer than
+writing the payload. Everything below was learned on a real 9.00 console.
+
+## You need first
+
+- PS4 on 9.00, jailbroken with GoldHEN (2.4b18+ recommended — older
+  payloader builds segfault on ELF files, see below).
+- Console and computer on the same network. Find the PS4 IP:
+  Settings → Network → View Connection Status (ours is `192.168.1.136`).
+- The payload file: `build-sdk/orbisrpc_sdk.elf` (built via
+  `./scripts/build_sdk.sh`).
+
+## Method 1 — elfldr (recommended)
+
+elfldr is a proper ELF loader that runs payloads as separate processes.
+
+1. Get it listening. Either load `elfldr.elf` through GoldHEN's payloader
+   page once, or keep it running — it serves on **port 9021** until reboot.
+2. Send the payload with a raw TCP connection, then close the write side:
+
+```python
+import socket
+data = open("build-sdk/orbisrpc_sdk.elf", "rb").read()
+s = socket.socket()
+s.settimeout(25)
+s.connect(("192.168.1.136", 9021))
+s.sendall(data)
+try:
+    s.shutdown(socket.SHUT_WR)  # signals end-of-payload
+except OSError:
+    pass
+s.close()
+```
+
+3. Verify it runs: within ~20 seconds `/data/orbisRPC/log.txt` must contain
+   `orbisRPC payload boot`. No file = it never executed.
+
+## Method 2 — GoldHEN BinLoader server (port 9020)
+
+The classic route (NetCat tools, phone apps, scripts all speak it).
+
+1. Arm it: tap **BinLoader** in the exploit host menu (NOT the GoldHEN
+   settings payloader page — different loader).
+2. Within seconds, fire blind — **one single connection carrying the full
+   payload, no port check first**:
+
+```python
+import socket
+data = open("build-sdk/orbisrpc_sdk.elf", "rb").read()
+s = socket.socket()
+s.settimeout(25)
+s.connect(("192.168.1.136", 9020))
+s.sendall(data)
+s.close()
+```
+
+3. Same verification: look for `orbisRPC payload boot` in the log.
+
+### THE ONE-SHOT RULE (read this twice)
+
+GoldHEN's BinLoader arms **once**. Any empty port check (`connect_ex`,
+`nc -z`, port scanners) connects with nothing to send and **burns the
+arm** — the real payload then arrives at a dead listener. Sequence is
+always: tap → say go → fire immediately → verify. Never probe first.
+
+## Method 3 — in-app injector
+
+The OrbisRPC setup app injects over loopback itself
+(`127.0.0.1:9020`, fallback `9090`) from its menu. Needs a listening
+loader exactly like Method 2.
+
+## Method 4 — sender page (no PC tools)
+
+`https://SirHumza.github.io/orbisrpc-host/` in the PS4 browser
+auto-sends the bundled backend to the console's own loader and prints
+the result on screen.
+
+## What NOT to use
+
+- **GoldHEN settings payloader page**: on GoldHEN ≤ 2.4 (pre-b18.5
+  lineage) its loader thread segfaults (`SIGSEGV`, null read in
+  `GoldHENLoader`) on every ELF — including 90KB hello-worlds. The klog
+  prints `payload launched successfully` and then dies. If you see this,
+  update GoldHEN, don't rebuild the payload.
+- **Raw SELF files**: the page expects ELF (`\x7fELF`). SELF uploads
+  report "invalid payload".
+
+## Troubleshooting
+
+| Symptom | Meaning | Fix |
+|---|---|---|
+| `Connection refused` on 9020/9090 | No listener armed | Tap BinLoader / open payloader page, retry instantly |
+| `payload launched successfully` then silence, no log | Loader segfault (see above) | Update GoldHEN ≥ v2.4b18.5, use BinLoader server |
+| `Error handling payload` | Loader rejected the bytes | Re-check file integrity (`shasum`), resend |
+| Log exists but `FATAL: token rejected (4004)` | Token rotated/dead | Fresh token into `/data/orbisRPC/config.json`, relaunch |
+| Multiple `Payload` processes in process list | Old instances piled up | Reboot clears them; the daemon's lock prevents recurrence |
+
+## Watching it work
+
+- Kernel log (loader events, faults): TCP `192.168.1.136:3232`, raw stream.
+- Daemon log: `/data/orbisRPC/log.txt` via FTP (`192.168.1.136:2121`,
+  anonymous). Absent file = payload never executed, full stop.
+- Process list: `sysctl kern.proc` (see `scripts/ps4_watch.py`) — look
+  for `Payload` and `eboot.bin` entries.
+- Final proof: Discord profile shows the game + ticking timer.