API tools faq
paste
Advertisement
TheRouletteBoi

PS3 Stuff

TheRouletteBoi
Jan 30th, 2019 (edited)
1,431
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 21.39 KB | None | 0 0
raw download clone embed print report
  1. #define R0      0
  2. #define R1      1
  3. #define R2      2
  4. #define R3      3
  5. #define R4      4
  6. #define R5      5
  7. #define R6      6
  8. #define R7      7
  9. #define R8      8
  10. #define R9      9
  11. #define R10     10
  12. #define R11     11
  13. #define R12     12
  14. #define R13     13
  15. #define R14     14
  16. #define R15     15
  17. #define R16     16
  18. #define R17     17
  19. #define R18     18
  20. #define R19     19
  21. #define R20     20
  22. #define R21     21
  23. #define R22     22
  24. #define R23     23
  25. #define R24     24
  26. #define R25     25
  27. #define R26     26
  28. #define R27     27
  29. #define R28     28
  30. #define R29     29
  31. #define R30     30
  32. #define R31     31
  33. #define SP      1
  34. #define RTOC    2
  35.  
  36. #define MAKE_JUMP(addr, to) *(uint32_t *)(addr) = (0x12 << 26) | ((((to-(addr))>>2)&0xFFFFFF) << 2)
  37. #define MAKE_CALL(addr, to) *(uint32_t *)(addr) = (0x12 << 26) | ((((to-(addr))>>2)&0xffffff) << 2) | 1
  38. #define MAKE_JUMP_ABSOLUTE(addr) *(uint32_t *)(addr) = ((0x12 << 26) | (((((uint64_t)(addr))>>2)&0xFFFFFF) << 2)) | 6 // ba
  39. #define MAKE_CALL_ABSOLUTE(addr) *(uint32_t *)(addr) = ((0x12 << 26) | (((((uint64_t)(addr))>>2)&0xFFFFFF) << 2)) | 3 // bla
  40.  
  41. #define MAKE_JUMP_VALUE(addr, to) ((0x12 << 26) | ((((to-(addr))>>2)&0xFFFFFF) << 2))
  42. #define MAKE_CALL_VALUE(addr, to) ((0x12 << 26) | ((((to-(addr))>>2)&0xFFFFFF) << 2)) | 1
  43. #define MAKE_JUMP_VALUE_ABSOLUTE(addr) ((0x12 << 26) | (((((uint64_t)(addr))>>2)&0xFFFFFF) << 2)) | 6 // ba
  44. #define MAKE_CALL_VALUE_ABSOLUTE(addr) ((0x12 << 26) | (((((uint64_t)(addr))>>2)&0xFFFFFF) << 2)) | 3 // bla
  45.  
  46. #define B(A)    MAKE_JUMP_VALUE(0, A)
  47. #define BL(A)   MAKE_CALL_VALUE(0, A)
  48. #define BA(A)   MAKE_JUMP_VALUE_ABSOLUTE(A)
  49. #define BLA(A)  MAKE_CALL_VALUE_ABSOLUTE(A)
  50.  
  51. #define BLR     0x4E800020
  52. #define BLRL    0x4E800021
  53. #define BCTR    0x4E800420
  54. #define BCTRL   0x4E800421
  55. #define NOP     0x60000000
  56.  
  57. #define MFSPR(SPR, RS) ((31 << 26) | (RS << 21) | (SPR << 16) | (339 << 1))
  58. #define MFLR(RS) MFSPR(8, RS)
  59. #define MFCTR(RS) MFSPR(9, RS)
  60.  
  61. #define MTSPR(SPR, RS) ((31 << 26) | (RS << 21) | (SPR << 16) | (467 << 1))
  62. #define MTLR(RS) MTSPR(8, RS)
  63. #define MTCTR(RS) MTSPR(9, RS)
  64.  
  65. #define OR(RA, RS, RB) (31 << 26) | (RS << 21) | (RA << 16) | (RB << 11) | (444 << 1)
  66. #define ORI(RA, RS, UI) (24 << 26) | (RS << 21) | (RA << 16) | (UI&0xFFFF)
  67. #define ORIS(RA, RS, UI) (25 << 26) | (RS << 21) | (RA << 16) | (UI&0xFFFF)
  68. #define MR(RS, RA) OR(RS, RA, RA)
  69.  
  70. #define ADDI(RT, RA, SI) (14 << 26) | (RT << 21) | (RA << 16) | (SI&0xFFFF)
  71. #define ADDIC(RT, RA, SI) (12 << 26) | (RT << 21) | (RA << 16) | (SI&0xFFFF)
  72. #define LI(RA, UI) ADDI(RA, 0, UI)
  73.  
  74. #define ADDIS(RT, RA, SI) (15 << 26) | (RT << 21) | (RA << 16) | (SI&0xFFFF)
  75. #define LIS(RA, UI) ADDIS(RA, 0, UI)
  76.  
  77. #define LD(RT, DS, RA) (58 << 26) | (RT << 21) | (RA << 16) | ((DS >> 2) << 2)
  78. #define STD(RS, DS, RA) (62 << 26) | (RS << 21) | (RA << 16) | ((DS >> 2) << 2)
  79. #define STDU(RS, DS, RA) ((62 << 26) | (RS << 21) | (RA << 16) | ((DS >> 2) << 2) | 1)
  80.  
  81. #define LWZ(RT, D, RA) (32 << 26) | (RT << 21) | (RA << 16) | D
  82. #define STW(RS, D, RA) (36 << 26) | (RS << 21) | (RA << 16) | D
  83.  
  84. #define RETURN_TRUE LI(R3, 1)
  85. #define RETURN_FALSE LI(R3, 0)
  86.  
  87. #define ALWAYS_BRANCH 0x4800
  88. #define BEQ  0x4182
  89.  
  90.  
  91.  
  92.  
  93.  
  94.  
  95.  
  96.  
  97.  
  98.  
  99.  
  100.  
  101.  
  102.  
  103.  
  104.  
  105.  
  106.  
  107.  
  108.  
  109.  
  110.  
  111.  
  112.  
  113.  
  114.  
  115.  
  116.  
  117.  
  118.  
  119.  
  120.  
  121.  
  122.  
  123.  
  124.  
  125.  
  126.  
  127.  
  128.  
  129.  
  130.  
  131. typedef struct _thread_id_list_t {
  132.     uint32_t type;        // 0x00: 0 = ppu-thread, 2 = spu-thread
  133.     uint32_t pad_0;       // 0x04:
  134.     uint64_t id;          // 0x08: thread id(64bit = ppu, 32bit = spu)
  135.     int32_t ret;          // 0x10: init 0, hold return value of stop this thread
  136.     uint32_t pad_1;       // 0x14:
  137. } thread_id_list_t;
  138.  
  139. int sys_dbg_stop_threads(thread_id_list_t *entries, uint32_t count)
  140. {
  141.     system_call_2(902, (uint64_t)entries, (uint64_t)count);
  142.     return_to_user_prog(int);
  143. }
  144. int sys_dbg_continue_threads(thread_id_list_t *list, uint32_t thr_count)
  145. {
  146.     system_call_2(903, (uint64_t)list, (uint64_t)thr_count);
  147.     return_to_user_prog(int);
  148. }
  149. int sys_dbg_read_thread_register(uint8_t *threadId, uint64_t *registers, uint8_t *_return)
  150. {
  151.     system_call_3(906, (uint64_t)threadId, (uint64_t)registers, (uint64_t)_return);
  152.     return_to_user_prog(int);
  153. }
  154. int sys_dbg_write_thread_register(uint8_t *thr, uint64_t *reg, uint8_t *val)
  155. {
  156.     system_call_3(907, (uint64_t)thr, (uint64_t)reg, (uint64_t)val);
  157.     return_to_user_prog(int);
  158. }
  159. int sys_dbg_get_thread_list()
  160. {
  161.  
  162. }
  163. int sys_dbg_get_thread_info(thr_id_list *thr, uint8_t *info)
  164. {
  165.  
  166. }
  167. uint64_t GetSingleRegister(uint32_t Register)
  168. {
  169.     uint64_t *Return = new uint64_t[2];
  170.     uint32_t *Registers = new uint32_t[1];
  171.  
  172.     Registers[0] = Register;
  173.  
  174.     //sys_dbg_read_thread_register(Parameters.ProcessID, Parameters.threadInfo.ThreadID, Registers);
  175.  
  176.     return Return[0];
  177. }
  178. void SetSingleRegister(uint32_t Register, uint64_t Value)
  179. {
  180.     uint64_t *Return = new uint64_t[1];
  181.     uint32_t *Registers = new uint32_t[1];
  182.  
  183.     Registers[0] = Register;
  184.     Return[0] = Value;
  185.  
  186.     //sys_dbg_write_thread_register(Parameters.ProcessID, Parameters.threadInfo.ThreadID, Registers, Return);
  187. }
  188. void SetSingleRegisterByThreadID(uint64_t ID, uint32_t Register, uint64_t Value)
  189. {
  190.     uint64_t *Return = new uint64_t[1];
  191.     uint32_t *Registers = new uint32_t[1];
  192.  
  193.     Registers[0] = Register;
  194.     Return[0] = Value;
  195.  
  196.     //sys_dbg_write_thread_register(Parameters.ProcessID, ID, Registers);
  197. }
  198.  
  199.  
  200.  
  201.  
  202.  
  203.  
  204.  
  205.  
  206.  
  207.  
  208.  
  209.  
  210.  
  211.  
  212.  
  213.  
  214. #define PS3MAPI_OPCODE_CREATE_PROC_THREAD           0x0048
  215.  
  216. typedef struct
  217. {
  218.     void *unk_0; // ptr to some funcs
  219.     uint64_t unk_8;
  220.     uint32_t unk_10;
  221.     uint32_t unk_14;
  222.     void *unk_18;
  223.     void *unk_20; // same as unk_18? :S
  224.     uint64_t unk_28[3];
  225.     void *unk_40; // same as unk_0?
  226.                   // ...
  227. } *thread_t;
  228.  
  229.  
  230. int ps3mapi_create_process_thread(sys_pid_t pid, thread_t *thread, void *entry, uint64_t arg, uint64_t flags, const char *threadname)
  231. {
  232.     system_call_8(SC_COBRA_SYSCALL8, SYSCALL8_OPCODE_PS3MAPI, PS3MAPI_OPCODE_CREATE_PROC_THREAD, (uint64_t)pid, (uint64_t)thread, (uint64_t)entry, arg, flags, (uint64_t)threadname);
  233.     return_to_user_prog(int);
  234. }
  235.  
  236. ps3mapi_create_process_thread(g_attachedPID, (thread_t *)(INSTALL_ADDR - 0x50), (void *)INSTALL_ADDR, 0, 0, "RPC THREAD");
  237.  
  238.  
  239.  
  240.  
  241.  
  242.  
  243.  
  244.  
  245.  
  246.  
  247.  
  248.  
  249.  
  250.  
  251.  
  252.  
  253.  
  254.  
  255.  
  256.  
  257.  
  258.  
  259.  
  260.  
  261.  
  262.  
  263.  
  264.  
  265. uint8_t* CCAPIStringToArray(const char* s, uint8_t* id)
  266. {
  267.     uint32_t len = strlen(s);
  268.     if (!len)
  269.     {
  270.         return id;
  271.     }
  272.  
  273.     int j = 0;
  274.     uint32_t i;
  275.     for (i = 0; i < (len + 1); i += 2)
  276.     {
  277.         char b[3] = { 0,0,0 };
  278.         strncpy(b, &s[i], 2);
  279.         b[1] = b[1] ? b[1] : '0';
  280.         id[j++] = strtoul(b, NULL, 16);
  281.     }
  282.     return id;
  283. }
  284.  
  285. enum ConsoleIdType
  286. {
  287.     Idps = 0,
  288.     Psid = 1,
  289. };
  290. struct ConsoleId
  291. {
  292.     uint8_t value[16];
  293. };
  294. struct ProcessName
  295. {
  296.     char value[512];
  297. };
  298.  
  299. typedef enum ConsoleIdType ConsoleIdType;
  300. typedef struct ConsoleId ConsoleId;
  301.  
  302.  
  303.  
  304.  
  305. __attribute__((naked)) uint64_t _sys_ccapi_call(uint64_t num, uint64_t a2, uint64_t a3, uint64_t a4, uint64_t a5, uint64_t a6, uint64_t a7, uint64_t a8)
  306. {
  307.     __asm__
  308.     (
  309.         "mflr       %r0;"                   // 7C0802A6
  310.         "std        %r0, 0x10(%r1);"        // F8010010
  311.         "stdu       %r1, -0x70(%r1);"       // F821FF91
  312.         "mr.        %r3, %r3;"              // 7C631B79
  313.         "beq        0x8;"                   // 41820008
  314.         "ccsc;"                             // EF455314
  315.         "addi       %r1, %r1, 0x70;"        // 38210070
  316.         "ld         %r0, 0x10(%r1);"        // E8010010
  317.         "mtlr       %r0;"                   // 7C0803A6
  318.         "blr;"                              // 4E800020
  319.  
  320.         /*
  321.         "mflr      %r0;"                    // 7C0802A6
  322.         "std       %r0, 0x10(%r1);"         // F8010010
  323.         "stdu      %r1, -0x70(%r1);"        // F821FF91
  324.         "ccsc;"                             // EF455314
  325.         "addi      %r1, %r1, 0x70;"         // 38210070
  326.         "ld        %r0, 0x10(%r1);"         // E8010010
  327.         "mtlr      %r0;"                    // 7C0803A6
  328.         "blr;"                              // 4E800020
  329.         */
  330.     );
  331. }
  332.  
  333. #define CcxCall uint64_t __attribute__((naked))
  334.  
  335. template <typename... Args>
  336. static CcxCall sys_ccapi_call(uint32_t num, Args... arg)
  337. {
  338.     __asm__
  339.     (
  340.         "sc;" // replace with ccsc = EF455314
  341.         "blr;"
  342.     );
  343. }
  344.  
  345.  
  346. static uint32_t FindSyscallInstruction(uint32_t address)
  347. {
  348.     while (true)
  349.     {
  350.         if (!*(uint32_t *)address)
  351.         {
  352.             address = (address - 0x4); // 0x4 for each instruction
  353.             break;
  354.         }
  355.         else if (*(uint32_t *)(address) == 0x44000002) // 44000002 sc
  356.         {
  357.             break;
  358.         }
  359.         else
  360.         {
  361.             address = (address + 0x4); // 0x4 for each instruction
  362.         }
  363.     }
  364.  
  365.     return address;
  366. }
  367.  
  368. void ReplaceSyscallInstruction(uint32_t func) // (dex only) dex can only write into sprx functions
  369. {
  370.     // call this function before calling sys_ccapi_call
  371.     opd_s *opd = (opd_s *)(func);
  372.     uint32_t ccsc_syscall_instruction = 0xEF455314; // ccsc = EF455314
  373.  
  374.     uint32_t addr = FindSyscallInstruction(opd->sub);
  375.  
  376.     sys_dbg_write_process_memory(addr, &ccsc_syscall_instruction, 0x4);
  377. }
  378.  
  379.  
  380.  
  381.  
  382.  
  383. int CCAPIEnableSysCall()
  384. {
  385.     return sys_ccapi_call(0x241);
  386. }
  387.  
  388. int CCAPIGetProcessList(uint32_t* npid, uint32_t* pids)
  389. {
  390.     return sys_ccapi_call(0x630, npid, pids);
  391. }
  392.  
  393. int CCAPIGetProcessName(uint32_t pid, ProcessName* name)
  394. {
  395.     return sys_ccapi_call(0x700, pid, name);
  396. }
  397.  
  398. int CCAPISetMemory(sys_pid_t pid, void* destination, size_t size, const void* source)
  399. {
  400.     return sys_ccapi_call(0x123, pid, destination, size, source);
  401. }
  402.  
  403. int CCAPIGetMemory(sys_pid_t pid, void* destination, size_t size, void* source)
  404. {
  405.     return sys_ccapi_call(0x785, pid, destination, size, source);
  406. }
  407.  
  408. int CCAPIAllocatePage(sys_pid_t pid, uint64_t size, uint64_t page_size, uint64_t flags, uint64_t is_executable, uint64_t* kernel_page_adr, uint64_t* game_page_adr)
  409. {
  410.     return sys_ccapi_call(0x977, pid, size, page_size, flags, is_executable, kernel_page_adr, game_page_adr);
  411. }
  412.  
  413. int CCAPICreateProcessThread(uint32_t num, sys_pid_t pid, thread_t* thread, void* entry, uint64_t arg, int prio, size_t stacksize, const char* threadname)
  414. {
  415.     return sys_ccapi_call(0x357, pid, thread, entry, arg, prio, stacksize, threadname);
  416. }
  417.  
  418. int CCAPIDisableTmapiAndSyscall8()
  419. {
  420.     return sys_ccapi_call(0xCCC);
  421. }
  422.  
  423. int CCAPIConsoleShutDown(uint32_t shutdownFlags)
  424. {
  425.     return sys_ccapi_call(0x117, shutdownFlags);
  426. }
  427.  
  428. int CCAPISpoofOFW()
  429. {
  430.     return sys_ccapi_call(0x530);
  431. }
  432. int CCAPISetConsoleIds(ConsoleIdType type, ConsoleId* id)
  433. {
  434.     return sys_ccapi_call(0x780, type, id);
  435. }
  436.  
  437. int CCAPISetConsoleIdsString(ConsoleIdType idType, const char* id)
  438. {
  439.     ConsoleId cid;
  440.     CCAPIStringToArray(id, cid.value);
  441.     return CCAPISetConsoleIds(idType, &cid);
  442. }
  443.  
  444.  
  445.  
  446.  
  447.  
  448. // usage
  449. void main()
  450. {
  451.     ReplaceSyscallInstruction((uint32_t)sys_ccapi_call<>); // CCAPIEnableSysCall, CCAPIDisableTmapiAndSyscall8 & CCAPISpoofOFW
  452.    ReplaceSyscallInstruction((uint32_t)sys_ccapi_call<uint32_t*, uint32_t*>); // CCAPIGetProcessList
  453.    ReplaceSyscallInstruction((uint32_t)sys_ccapi_call<uint32_t, ProcessName*>); // CCAPIGetProcessName
  454.    ReplaceSyscallInstruction((uint32_t)sys_ccapi_call<sys_pid_t, void*, size_t, const void*>); // CCAPISetMemory
  455.    ReplaceSyscallInstruction((uint32_t)sys_ccapi_call<sys_pid_t, void*, size_t, void*>); // CCAPIGetMemory
  456.    ReplaceSyscallInstruction((uint32_t)sys_ccapi_call<sys_pid_t, uint64_t, uint64_t, uint64_t, uint64_t, uint64_t*, uint64_t*>); // CCAPIAllocatePage
  457.    ReplaceSyscallInstruction((uint32_t)sys_ccapi_call<uint32_t, sys_pid_t, thread_t*, void*, uint64_t, int, size_t, const char*>); // CCAPICreateProcessThread
  458.    ReplaceSyscallInstruction((uint32_t)sys_ccapi_call<uint32_t>); // CCAPIConsoleShutDown
  459.    ReplaceSyscallInstruction((uint32_t)sys_ccapi_call<ConsoleIdType, ConsoleId*>); // CCAPISetConsoleIds
  460.  
  461.  
  462.     CCAPIEnableSysCall(0x241);
  463.  
  464.     uint32_t ProcessIds[32];
  465.     uint32_t NProcessIds = sizeof(ProcessIds) / sizeof(ProcessIds[0]);
  466.     CCAPIGetProcessList(&NProcessIds, ProcessIds);
  467.     for (uint32_t i = 0; i < NProcessIds; i++)
  468.     {
  469.         printf("ProcessIds[%i]: 0x%X\n", i, ProcessIds[i]);
  470.         ProcessName name;
  471.         CCAPIGetProcessName(ProcessIds[i], &name);
  472.         printf("name: %s\n", name.value);
  473.     }
  474.  
  475.     char writeBytes[] = { 0xFF, 0xFF, 0xFF, 0xFF };
  476.     CCAPISetMemory(sys_process_getpid(), (void*)0x10000, sizeof(writeBytes), writeBytes); // writing to address 0x10000
  477.  
  478.     char readBytes[4];
  479.     CCAPIGetMemory(sys_process_getpid(), (void*)0x10000, 0x4, &readBytes); // reading from address 0x10000
  480.  
  481.     uint64_t kernel_adr;
  482.     uint64_t game_adr;
  483.     CCAPIAllocatePage(sys_process_getpid(), 0x9D000, 0x100, 0x2F, 0x1, &kernel_adr, &game_adr);
  484.  
  485.     WriteGamePayload(game_adr);
  486.    
  487.     thread_t hello_thrd;
  488.     uint32_t threadOpd[2];
  489.     threadOpd[0] = game_adr;
  490.     threadOpd[1] = 0x00000000;
  491.     CCAPICreateProcessThread(sys_process_getpid(), &hello_thrd, threadOpd, 0, 0x7D0, 0x4000, "payload_thread");
  492.  
  493.     CCAPIDisableTmapiAndSyscall8();
  494.     CCAPISpoofOFW();
  495.     CCAPISetConsoleIdsString(Idps, "00000000000000000000000000000000");
  496.     CCAPIConsoleShutDown(0x100); // shutdown
  497. }
  498.  
  499.  
  500.  
  501.  
  502.  
  503.  
  504.  
  505.  
  506.  
  507. ccapi command id's:
  508. 0x2491   connect
  509. 0x10CAA  unknown
  510. 0x2492   get version   (ccapi version, frimware version) ???
  511. 0x314    get temperature
  512. 0x3341   notify
  513. 0x28AC   ring buzzer
  514. 0x359    set led
  515. 0x1527   get process list
  516. 0x1BA    write process memory
  517. 0xAF     set current idps & psid
  518. 0xF2     set boot idps & psid
  519. 0x4B9A   spoof OFW Mode
  520. 0x32BA   shut down ps3
  521. 0x287    get process name
  522. 0x2491   unknown
  523. 0x265E   unknown
  524. 0x16A    read process memory
  525. 0x13461  unknown
  526. 0x6001   unknown
  527. 0x240F   unknown
  528. 0x1D8B   disable tmapi & syscall8
  529. 0x100F   unknown
  530. 0x6BE    allocate page
  531. 0x1600   create thread
  532.  
  533.  
  534. ccapi syscall command id's:
  535. 0x630   GetProcessList
  536. 0x700   GetProcessName
  537. 0x123   WriteProcessMemory
  538. 0x785   ReadProcessMemory
  539. 0x977   ProcessAllocatePage
  540. 0x357   ProcessThreadCreate
  541. 0xCCC   DisableTmapiSyscall8
  542. 0x780   SetIdps
  543. 0x780   SetPsid
  544. 0x530   SpoofOfwMode
  545. 0x241   EnableSyscall
  546. 0x117   ConsoleShutDown
  547. 0x450   unknown
  548. 0x750   unknown
  549. 0x211   unknown
  550.  
  551.  
  552.  
  553.  
  554.  
  555.  
  556.  
  557.  
  558.  
  559.  
  560.  
  561.  
  562.  
  563.  
  564.  
  565.  
  566.  
  567.  
  568.  
  569.  
  570.  
  571. #define SYSCALL_PTR(n)              ((SYSCALL_TABLE) + ( 8 * (n)))
  572. uint64_t LV2_OFFSET_ON_LV1 = 0x08000000ULL;
  573. uint64_t peek_lv2(uint64_t addr)
  574. {
  575.    system_call_1(8, addr + LV2_OFFSET_ON_LV1); // peek lv1 on lv2 offset
  576.     return (uint64_t)p1;
  577. }
  578. void poke_lv2(uint64_t addr, uint64_t value)
  579. {
  580.    system_call_2(9, addr + LV2_OFFSET_ON_LV1, value); // poke lv1 on lv2 offset
  581. }
  582.  
  583. // dex only. cex consoles do not have syscall 904
  584. // This will block use of syscall 904 sys_dbg_read_process_memory making it impossible to break point, read memory using sprx or RTM tools.
  585. void ToggleAntiDebugging(bool toggle)
  586. {
  587.     // syscall table address for 4.80 to 4.84 DEX
  588.     uint64_t SYSCALL_TABLE = 0x800000000038A4E8ULL;
  589.  
  590.     constexpr uint16_t readProcessMemSyscallNum = 904;
  591.     uint64_t backupSyscallAddr = peek_lv2(SYSCALL_PTR(readProcessMemSyscallNum));
  592.  
  593.     if (backupSyscallAddr == 0)
  594.         return;
  595.  
  596.     if (toggle)
  597.     {
  598.         poke_lv2(SYSCALL_PTR(readProcessMemSyscallNum), peek_lv2(SYSCALL_TABLE));
  599.     }
  600.     else
  601.     {
  602.         poke_lv2(SYSCALL_PTR(readProcessMemSyscallNum), backupSyscallAddr);
  603.     }
  604. }
  605.  
  606.  
  607.  
  608.  
  609.  
  610.  
  611.  
  612.  
  613.  
  614.  
  615.  
  616.  
  617.  
  618.  
  619.  
  620.  
  621.  
  622.  
  623.  
  624.  
  625.  
  626.  
  627.  
  628.  
  629.  
  630.  
  631.  
  632.  
  633.  
  634.  
  635.  
  636.  
  637.  
  638.  
  639.  
  640.  
  641.  
  642.  
  643. // Temporarily write process memory. Credit to haxxxen (original author)
  644.  
  645. // all kernel offsets are for 4.84 DEX
  646. #define SC_NR  0x0                      // number of syscall
  647. #define ENTRY  0x80000000000017E0ULL    // entry offset
  648. #define CODE   0x80000000000017F8ULL    // code offset
  649. #define SC_TBL  0x800000000038A4E8ULL
  650. #define PROC_RTOC_ENTRY  0x8000000000376FF0ULL
  651.  
  652. void make_syscall(int32_t symbol)
  653. {
  654.     PokeLv2(CODE, (uint64_t)((0x48000000 | ((symbol - CODE) & 0x03FFFFFC)) << 32));
  655.     PokeLv2(ENTRY, CODE);
  656.     //old_sc = PeekLv2(SC_TBL + (SC_NR * 8));
  657.     PokeLv2(SC_TBL + (SC_NR * 8), ENTRY);
  658. }
  659.  
  660. void kill_syscall()
  661. {
  662.     PokeLv2(ENTRY, 0);
  663.     PokeLv2(CODE, 0);
  664.     //PokeLv2(SC_TBL + (SC_NR * 8), old_sc);
  665.     sys_timer_usleep(1);
  666. }
  667.  
  668. int32_t lv2_extend_kstack(uint64_t arg)
  669. {
  670.     make_syscall(0x73BF4);                          // extend_kstack()
  671.  
  672.     system_call_1(SC_NR, arg);
  673.     int32_t ret = (int32_t)p1;
  674.  
  675.     kill_syscall();
  676.  
  677.     return ret;
  678. }
  679.  
  680. uint64_t lv2_malloc(uint32_t size, int32_t align)
  681. {
  682.     make_syscall(0x681F4);                                 // malloc()
  683.  
  684.     system_call_3(SC_NR, (uint64_t)size, (uint64_t)align, 0);
  685.     uint64_t ret = p1;
  686.  
  687.     kill_syscall();
  688.  
  689.     return ret;
  690. }
  691.  
  692. int32_t lv2_copy_from_user(void* src, uint64_t dst, int32_t size)
  693. {
  694.     make_syscall(0x100D0);                               // copy_from_user()
  695.  
  696.     system_call_3(SC_NR, (uint64_t)(uint32_t)src, dst, (uint64_t)size);
  697.     int32_t ret = (int32_t)p1;
  698.  
  699.     kill_syscall();
  700.  
  701.     return ret;
  702. }
  703.  
  704. int32_t lv2_copy_to_user(uint64_t src, void* dst, int32_t size)
  705. {
  706.     make_syscall(0xFEB4);                               // copy_to_user()
  707.  
  708.     system_call_3(SC_NR, src, (uint64_t)(uint32_t)dst, (uint64_t)size);
  709.     int32_t ret = (int32_t)p1;
  710.  
  711.     kill_syscall();
  712.  
  713.     return ret;
  714. }
  715.  
  716. int32_t lv2_dealloc(uint64_t alloc_addr, int32_t align)
  717. {
  718.     make_syscall(0x68630);                                 // dealloc()
  719.  
  720.     system_call_2(SC_NR, alloc_addr, (uint64_t)align);
  721.     int32_t ret = (int32_t)p1;
  722.  
  723.     kill_syscall();
  724.  
  725.     return ret;
  726. }
  727.  
  728. int32_t lv2_get_process_object_entry_and_address_by_id(uint32_t proc_id, uint64_t* obj_addr, uint64_t* obj_entry)
  729. {
  730.     uint64_t patch = 0x409E0024E80100B0ULL;
  731.     uint64_t org = 0;
  732.  
  733.  
  734.     make_syscall(0x91420);              // get_process_object_entry_and_address_by_id()
  735.  
  736.     // patch target type check
  737.     org = PeekLv2(0x800000000009145CULL);     // dump original code
  738.     PokeLv2(0x800000000009145CULL, patch);    // write patch
  739.  
  740.     // execute syscall
  741.     system_call_3(SC_NR, (uint64_t)proc_id, (uint64_t)(uint32_t)obj_addr, (uint64_t)(uint32_t)obj_entry);
  742.     int32_t ret = (int32_t)p1;
  743.  
  744.     PokeLv2(0x800000000009145CULL, org);  // unpatch
  745.  
  746.     kill_syscall();
  747.  
  748.     return ret;
  749. }
  750.  
  751. int32_t lv2_unreserve_object(uint64_t obj_list, uint64_t obj_entry)
  752. {
  753.     make_syscall(0x11F5C);                          // unreserve_id()
  754.  
  755.     system_call_2(SC_NR, obj_list, obj_entry);
  756.     int32_t ret = (int32_t)p1;
  757.  
  758.     kill_syscall();
  759.  
  760.     return ret;
  761. }
  762.  
  763. int32_t lv2_write_process_memory(uint64_t proc_obj, uint64_t proc_ea, uint64_t alloc_addr, int32_t buf_size, uint8_t flag)
  764. {
  765.     make_syscall(0x26E658);                              // write_process_memory()
  766.  
  767.     system_call_5(SC_NR, proc_obj, proc_ea, alloc_addr, (uint64_t)buf_size, (uint64_t)flag);
  768.     int32_t ret = (int32_t)p1;
  769.  
  770.     kill_syscall();
  771.  
  772.     return ret;
  773. }
  774.  
  775. int32_t lv2_read_process_memory(uint64_t proc_obj, uint64_t proc_ea, uint64_t alloc_addr, int32_t buf_size)
  776. {
  777.     make_syscall(0x26E7E4);                              // read_process_memory()
  778.  
  779.     system_call_4(SC_NR, proc_obj, proc_ea, alloc_addr, (uint64_t)buf_size);
  780.     int32_t ret = (int32_t)p1;
  781.  
  782.     kill_syscall();
  783.  
  784.     return ret;
  785. }
  786.  
  787. int32_t test_read_write_proc_mem(uint8_t mode, uint32_t proc_id, uint64_t proc_ea, uint32_t buf_size, void* buf)
  788. {
  789.     int32_t ret = -1;
  790.     uint64_t obj_list, obj_addr, obj_entry;
  791.  
  792.  
  793.     obj_list = PeekLv2(PeekLv2(PROC_RTOC_ENTRY));
  794.     //obj_list = *(uint64_t*)(*(uint64_t*)PROC_RTOC_ENTRY);
  795.  
  796.     if ((buf_size == 0) || (!buf))
  797.         return 0x80010409; // LV2DBG_EINVAL
  798.  
  799.       // get process object
  800.     if ((ret = lv2_get_process_object_entry_and_address_by_id(proc_id, &obj_addr, &obj_entry)) != 0)
  801.         return ret;
  802.  
  803.     if (mode) // write to process memory
  804.     {
  805.         if ((ret = lv2_write_process_memory(obj_addr, proc_ea, (uint64_t)(uint32_t)buf, buf_size, 1)) != 0)
  806.         {
  807.             ret = 0x8001000D; // EFAULT
  808.             goto end;
  809.         }
  810.     }
  811.     else     // read from process memory
  812.     {
  813.         if ((ret = lv2_read_process_memory(obj_addr, proc_ea, (uint64_t)(uint32_t)buf, buf_size)) != 0)
  814.         {
  815.             ret = 0x8001000D; // EFAULT
  816.             goto end;
  817.         }
  818.     }
  819.  
  820. end:
  821.     lv2_unreserve_object(obj_list, obj_entry);
  822.  
  823.     return ret;
  824. }
  825.  
  826. int32_t read_write_proc_mem(uint8_t mode, uint32_t proc_id, uint64_t proc_ea, uint32_t buf_size, void* buf)
  827. {
  828.     int32_t ret = -1;
  829.     uint64_t obj_list = 0, obj_addr = 0, obj_entry = 0, alloc_addr = 0;
  830.  
  831.  
  832.     ret = lv2_extend_kstack(0);
  833.  
  834.     if ((buf_size == 0) || (!buf))
  835.         return 0x80010409; // LV2DBG_EINVAL
  836.  
  837.     obj_list = PeekLv2(PeekLv2(PROC_RTOC_ENTRY));
  838.  
  839.     if ((ret = lv2_get_process_object_entry_and_address_by_id(proc_id, &obj_addr, &obj_entry)) != 0)
  840.         return ret;
  841.  
  842.     alloc_addr = lv2_malloc(buf_size, 0xD);
  843.     if (!alloc_addr)
  844.     {
  845.         ret = 0x80010408; // LV2DBG_ENOMEM
  846.         goto end;
  847.     }
  848.  
  849.     if (mode) // write to process memory
  850.     {
  851.         if ((ret = lv2_copy_from_user(buf, alloc_addr, buf_size)) != 0)
  852.             goto end;
  853.  
  854.         if ((ret = lv2_write_process_memory(obj_addr, proc_ea, alloc_addr, buf_size, 1)) != 0)
  855.         {
  856.             ret = 0x8001000D; // EFAULT
  857.             goto end;
  858.         }
  859.     }
  860.     else     // read from process memory
  861.     {
  862.         if ((ret = lv2_read_process_memory(obj_addr, proc_ea, alloc_addr, buf_size)) != 0)
  863.         {
  864.             ret = 0x8001000D; // EFAULT
  865.             goto end;
  866.         }
  867.  
  868.         lv2_unreserve_object(obj_list, obj_entry);
  869.         obj_entry = 0;
  870.  
  871.         ret = lv2_copy_to_user(alloc_addr, buf, buf_size);
  872.     }
  873.  
  874. end:
  875.     if (obj_entry)
  876.         lv2_unreserve_object(obj_list, obj_entry);
  877.  
  878.     if (alloc_addr)
  879.         lv2_dealloc(alloc_addr, 0xD);
  880.  
  881.     return ret;
  882. }
  883.  
  884.  
  885.  
  886. // run in main()
  887. vsh::printf("temporarily write process\n");
  888. uint32_t proc_id = vsh::GetGameProcessID();
  889. vsh::printf("proc_id 0x%X\n", proc_id);
  890. uint32_t start = 0x10000;
  891. char bytes[] = { 0x12, 0x34, 0x56, 0x78 };
  892. int res = read_write_proc_mem(1, proc_id, start, sizeof(bytes), bytes);
  893. //int res = test_read_write_proc_mem(1, proc_id, start, sizeof(bytes), &bytes);
  894. vsh::printf("result 0x%X\n", res);
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!