XeDumpHV

/*
XeDumpHV : http://www.putlocker.com/file/E0C5C22E50C43716

A simple tool to dump the hypervisor from memory. Hopefully this works on all future kernels. Tested on 14719

Should help those of you trying to crack The Atlas Project or Project Sable.

Don't forget to reverse XeBuild changes to the HV, plus a few other things.

XeDumpHV.xex stores payload at 0x32500 in HV, make sure to reverse that to 0's.

This was built in an attempt to make it easier to dump the HV without checking for systemcall updates. This uses a built in feature of XeBuild patches to execute a payload in HV state.
There are much easier ways to dump the HV(HvxExpansion systemcalls) but usually require updating of offsets or systemcall numbers.

*/


#include <stdio.h> //for sprintf_s
#include <xtl.h>
#include "AtgConsole.h"
#include "AtgUtil.h"
#include "AtgInput.h"
#include "kernel.h"

ATG::Console atg_Con;

void dprintf(const char* s, ...)
{
    va_list argp;
    char temp[512];

    va_start(argp, s);
    vsnprintf_s(temp, 512,512, s, argp);
    va_end(argp);
    atg_Con.Format("%s", temp);
    #ifdef DEBUG_MSG
    DbgPrint("%s", temp);
    #endif
}

// Payload PPC code
/*
    lis %r11, 1
    bl loc_1
loc_1:
    mfspr %r3, %LR
    addi %r3, %r3, 52
loc_2:
    ldu %r4, 8(%r3)
    cmpdi %r4, -1
    beq end
    mtctr %r11
loop_1:
    lbz %r9, 0(%r4)
    stb %r9, 0(%r8)
    addi %r4, %r4, 1
    addi %r8, %r8, 1
    bdnz loop_1
    b loc_2
end:
    addi %r1, %r1, 0x10
    nop
    mtspr %LR, %r12
    blr
    .quad 0x8000010000000000
    .quad 0x8000010200010000
    .quad 0x8000010400020000
    .quad 0x8000010600030000
    .quad 0xFFFFFFFFFFFFFFFF

*/
unsigned char hvPayload[112] = {
    0x3D, 0x60, 0x00, 0x01, 0x48, 0x00, 0x00, 0x05,
    0x7C, 0x68, 0x02, 0xA6, 0x38, 0x63, 0x00, 0x38,
    0xE8, 0x83, 0x00, 0x09, 0x2C, 0x24, 0xFF, 0xFF,
    0x41, 0x82, 0x00, 0x20, 0x7D, 0x69, 0x03, 0xA6,
    0x89, 0x24, 0x00, 0x00, 0x99, 0x28, 0x00, 0x00,
    0x38, 0x84, 0x00, 0x01, 0x39, 0x08, 0x00, 0x01,
    0x42, 0x00, 0xFF, 0xF0, 0x4B, 0xFF, 0xFF, 0xDC,
    0x38, 0x21, 0x00, 0x10, 0x60, 0x00, 0x00, 0x00,
    0x7D, 0x88, 0x03, 0xA6, 0x4E, 0x80, 0x00, 0x20,
    0x80, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x80, 0x00, 0x01, 0x02, 0x00, 0x01, 0x00, 0x00,
    0x80, 0x00, 0x01, 0x04, 0x00, 0x02, 0x00, 0x00,
    0x80, 0x00, 0x01, 0x06, 0x00, 0x03, 0x00, 0x00,
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
};

DWORD __declspec(naked) HvxGetVersion(DWORD magic, DWORD mode, UINT64 dest, UINT64 src, UINT32 len, UINT64 arg_r8)
{
    __asm {
        li      r0, 0 // HvxGetVersion
        sc
        blr
    }
}

VOID __cdecl main()
{
    char* newLine = "---------------------------------------------------\n";
    atg_Con.Create( "game:\\Media\\Fonts\\Arial_12.xpr", 0xFF000000, 0xFFFFFFFF );
    atg_Con.Clear();
    dprintf("Welcome to XeDumpHV!\n    For Kernel: %d\n\n", XboxKrnlVersion->Build);
    dprintf(newLine);
    dprintf("Press A to Dump HV\n");
    dprintf("Press Y to Exit\n");
    dprintf(newLine);
    for (;;)
    {
        ATG::Input::GetMergedInput();

        if (ATG::Input::m_DefaultGamepad.wPressedButtons & XINPUT_GAMEPAD_A )
        {
            dprintf("Dumping HV....\n");
            UINT64 dest = 0x8000010600032500ULL;
            BYTE* pbPayload = (BYTE*)XPhysicalAlloc(0x100, MAXULONG_PTR, 0, PAGE_READWRITE);
            memcpy(pbPayload, hvPayload, 112);
            UINT64 src = 0x8000000000000000ULL + ((DWORD)MmGetPhysicalAddress(pbPayload));
            BYTE* pbHypervisor = (BYTE*)XPhysicalAlloc(0x40000, MAXULONG_PTR, 0, PAGE_READWRITE);
            memset(pbHypervisor, 0, 0x40000);
            UINT64 xArg = 0x8000000000000000ULL + ((DWORD)MmGetPhysicalAddress(pbHypervisor));
            HvxGetVersion(0x72627472, 4, dest, src, 0x40, xArg);

            dprintf("HV dumped\nSaving HV....\n");
            HANDLE hFile;
            DWORD size;
            char hvBuild[255];
            sprintf_s(hvBuild, "GAME:\\HV_%d.bin", XboxKrnlVersion->Build);
            hFile = CreateFile(hvBuild, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
            if(hFile != INVALID_HANDLE_VALUE)
            {
                WriteFile(hFile, pbHypervisor, 0x40000, &size, NULL);
                CloseHandle(hFile);
                dprintf("HV version %d saved\n", XboxKrnlVersion->Build);
            }
            dprintf("Exiting........\n");
            XPhysicalFree(pbPayload);
            XPhysicalFree(pbHypervisor);
            Sleep(2500);
            XLaunchNewImage(XLAUNCH_KEYWORD_DEFAULT_APP, 0);
        }
        else if( ATG::Input::m_DefaultGamepad.wPressedButtons & XINPUT_GAMEPAD_Y )
        {
            XLaunchNewImage(XLAUNCH_KEYWORD_DEFAULT_APP, 0);
            break;
        }
    }

}