libpspexploit.c

#include "libpspexploit.h"
#include <pspsuspend.h>

static int AddressInRange(u32 addr, u32 lower, u32 higher){
    return (addr >= lower && addr < higher);
}

/*
 * These functions are ment for using when initial kernel access has been
 * granted, for example through the mean of a kernel exploit.
 */
void pspXploitScanKernelFunctions(KernelFunctions* kfuncs){

    memset(kfuncs, 0, sizeof(KernelFunctions));

    kfuncs->KernelIOOpen = (void*)pspXploitFindFunction("sceIOFileManager", "IoFileMgrForUser", 0x109F50BC);
    kfuncs->KernelIORead = (void*)pspXploitFindFunction("sceIOFileManager", "IoFileMgrForUser", 0x6A638D83);
    kfuncs->KernelIOLSeek = (void*)pspXploitFindFunction("sceIOFileManager", "IoFileMgrForUser", 0x27EB27B8);
    kfuncs->KernelIOClose = (void*)pspXploitFindFunction("sceIOFileManager", "IoFileMgrForUser", 0x810C4BC3);
    kfuncs->KernelIOWrite = (void*)pspXploitFindFunction("sceIOFileManager", "IoFileMgrForUser", 0x42EC03AC);
    kfuncs->KernelIOMkdir = (void*)pspXploitFindFunction("sceIOFileManager", "IoFileMgrForUser", 0x06A70004);
    kfuncs->KernelIORmdir = (void*)pspXploitFindFunction("sceIOFileManager", "IoFileMgrForUser", 0x1117C65F);
    kfuncs->KernelIODopen = (void*)pspXploitFindFunction("sceIOFileManager", "IoFileMgrForUser", 0xB29DDF9C);
    kfuncs->KernelIODread = (void*)pspXploitFindFunction("sceIOFileManager", "IoFileMgrForUser", 0xE3EB004C);
    kfuncs->KernelIODclose = (void*)pspXploitFindFunction("sceIOFileManager", "IoFileMgrForUser", 0xEB092469);
    kfuncs->KernelIOGetStat = (void*)pspXploitFindFunction("sceIOFileManager", "IoFileMgrForUser", 0xACE946E8);
    kfuncs->KernelIORemove = (void*)pspXploitFindFunction("sceIOFileManager", "IoFileMgrForUser", 0xF27A9C51);
    kfuncs->IoAssign = (void*)pspXploitFindFunction("sceIOFileManager", "IoFileMgrForUser", 0xB2A628C1);
    kfuncs->IoUnassign = (void*)pspXploitFindFunction("sceIOFileManager", "IoFileMgrForUser", 0x6D08A871);
    
    kfuncs->KernelAllocPartitionMemory = (void*)pspXploitFindFunction("sceSystemMemoryManager", "SysMemUserForUser", 0x237DBD4F);
    kfuncs->KernelGetBlockHeadAddr = (void*)pspXploitFindFunction("sceSystemMemoryManager", "SysMemUserForUser", 0x9D9A5BA1);
    kfuncs->KernelFreePartitionMemory = (void*)pspXploitFindFunction("sceSystemMemoryManager", "SysMemUserForUser", 0xB6D61D02);

    kfuncs->KernelIcacheInvalidateAll = (void*)pspXploitFindFunction("sceSystemMemoryManager", "UtilsForKernel", 0x920F104A);
    kfuncs->KernelDcacheWritebackInvalidateAll = (void*)pspXploitFindFunction("sceSystemMemoryManager", "UtilsForKernel", 0xB435DEC5);
    kfuncs->KernelDcacheInvalidateRange = (void*)pspXploitFindFunction("sceSystemMemoryManager", "UtilsForKernel", 0xBFA98062);
    kfuncs->KernelGzipDecompress = (void*)pspXploitFindFunction("sceSystemMemoryManager", "UtilsForKernel", 0x78934841);
    
    kfuncs->KernelCreateThread = (void*)pspXploitFindFunction("sceThreadManager", "ThreadManForUser", 0x446D8DE6);
    kfuncs->KernelStartThread = (void*)pspXploitFindFunction("sceThreadManager", "ThreadManForUser", 0xF475845D);
    kfuncs->KernelDelayThread = (void*)pspXploitFindFunction("sceThreadManager", "ThreadManForUser", 0xCEADEB47);
    kfuncs->KernelExitThread = (void*)pspXploitFindFunction("sceThreadManager", "ThreadManForUser", 0xAA73C935);
    kfuncs->KernelDeleteThread = (void*)pspXploitFindFunction("sceThreadManager", "ThreadManForUser", 0x9FA03CD3);
    kfuncs->waitThreadEnd = (void*)pspXploitFindFunction("sceThreadManager", "ThreadManForUser", 0x278C0DF5);

    #ifdef DEBUG
    for (int i=0; i<sizeof(KernelFunctions); i+=4){
        u32 ptr = *(u32*)((u32)kfuncs + i);
        if (ptr == 0) pspDebugScreenPrintf("WARNING: could not find function %d\n", i);
    }
    #endif
}

u32 pspXploitFindImportRange(char *libname, u32 nid, u32 lower, u32 higher){
    u32 i;
    for(i = lower; i < higher; i += 4) {
        SceLibraryStubTable *stub = (SceLibraryStubTable *)i;

        if((stub->libname != libname) && AddressInRange((u32)stub->libname, lower, higher) \
            && AddressInRange((u32)stub->nidtable, lower, higher) && AddressInRange((u32)stub->stubtable, lower, higher)) {
            if(strcmp(libname, stub->libname) == 0) {
                u32 *table =(u32*)stub->nidtable;

                int j;
                for(j = 0; j < stub->stubcount; j++) {
                    if(table[j] == nid) {
                        return ((u32)stub->stubtable + (j * 8));
                    }
                }
            }
        }
    }

    return 0;
}

u32 pspXploitFindImportVolatileRam(char *libname, u32 nid){
    return pspXploitFindImportRange(libname, nid, 0x08400000, 0x08800000);
}

u32 pspXploitFindImportUserRam(char *libname, u32 nid){
    return pspXploitFindImportRange(libname, nid, 0x08800000, 0x0A000000);
}

int pspXploitOpenP5(int mode)
{
    SceUtilitySavedataParam dialog;

    memset(&dialog, 0, sizeof(SceUtilitySavedataParam));
    dialog.base.size = sizeof(SceUtilitySavedataParam);

    dialog.base.language = 1;
    dialog.base.buttonSwap = 1;
    dialog.base.graphicsThread = 0x11;
    dialog.base.accessThread = 0x13;
    dialog.base.fontThread = 0x12;
    dialog.base.soundThread = 0x10;

    dialog.mode = mode;

    #ifdef DEBUG
    pspDebugScreenPrintf("Opening savedata utility to resolve p5 stubs\n");
    #endif

    sceKernelVolatileMemUnlock(0);

    sceUtilitySavedataInitStart(&dialog);

    // Wait for the dialog to initialize
    int status;
    while ((status = sceUtilitySavedataGetStatus()) < 2)
    {
        sceKernelDelayThread(100);
        //if (status < 0) return 0; // error
    }
    return 1;
}

// Runs the savedata dialog loop
int pspXploitCloseP5()
{

    int running = 1;
    int last_status = -1;

    #ifdef DEBUG
    pspDebugScreenPrintf("Closing savedata utility\n");
    #endif

    while(running) 
    {
        int status = sceUtilitySavedataGetStatus();
        
        if (status != last_status)
        {
            last_status = status;
        }
        switch(status)
        {
            case PSP_UTILITY_DIALOG_VISIBLE:
                sceUtilitySavedataUpdate(1);
                break;

            case PSP_UTILITY_DIALOG_QUIT:
                sceUtilitySavedataShutdownStart();
                break;

            case PSP_UTILITY_DIALOG_NONE:
                running = 0;
                break;

            case PSP_UTILITY_DIALOG_FINISHED:
                break;
            default:
                if (status < 0) // sceUtilitySavedataGetStatus returned error?
                    return 0;
                break;
        }
        sceKernelDelayThread(100);
    }
    return 1;
}

u32 pspXploitFindFunctionFromUsermode(const char *library, u32 nid, void* buf, u32 size)
{
    u32 addr;
    u32 start_addr = (u32)buf;
    size_t library_len = strlen(library);
  
    if (buf) {
        u32 maxaddr = start_addr+size;
        for (addr=start_addr; addr < maxaddr; addr += 4) {
          
            if (memcmp((const char*)addr, library, library_len) == 0) {
                u32 libaddr = (addr-start_addr) + 0x88000000;

                while (*(u32*)(addr -= 4) != libaddr) {
                    if (addr <= start_addr){
                        return 0;
                    }
                };

                u32 exports = (u32)(*(u16*)(addr + 10) + *(u8*)(addr + 9));
                u32 jump = exports * 4;

                addr = *(u32*)(addr + 12);
                addr -= 0x88000000;
                addr += start_addr;

                while (exports--) {
                    if (*(u32*)addr == nid){
                        return *(u32*)(addr + jump);
                    }
                    addr += 4;
                }

                return 0;
            }
        }
    }
    return 0;
}

static u32 FindSysMemStruct(){
    static u32 sysmem = 0;
    if (sysmem != 0) return sysmem;
    
    for (u32 kaddr = 0x88000000; kaddr < 0x88400000; kaddr += 4) {
        if (strcmp((const char *)kaddr, "sceSystemMemoryManager") == 0) {
            if (AddressInRange(_lw(kaddr-8), 0x88000000, 0x88400000)
                && _lw(kaddr+0x64) == 0x88000000
                && _lw(kaddr+0x68) ){
                    sysmem = kaddr-8;
                    return sysmem;
            }
        }
    }
    return 0;
}

u32 pspXploitFindModuleByName(const char *modulename){
    u32 mod = FindSysMemStruct();
    while (mod){
        if (strcmp((const char *)(mod+8), modulename) == 0){
            return mod;
        }
        mod = _lw(mod);
    }
    return 0;
}

u32 pspXploitFindTextAddrByName(const char *modulename)
{
    u32 mod = pspXploitFindModuleByName(modulename);

    if (mod)
        return *(u32*)(mod + 0x6C);

    return 0;
}

u32 pspXploitFindFunction(const char *module, const char *library, u32 nid)
{
    //u32 addr = pspXploitFindTextAddrByName(module);
    SceModule* mod = (SceModule*)pspXploitFindModuleByName(module);
    
    if (mod) {
        // Fetch Export Table Start Address
        void * entTab = mod->ent_top;
        
        // Iterate Exports
        for (unsigned int i = 0; i < mod->ent_size;)
        {
            // Cast Export Table Entry
            struct SceLibraryEntryTable * entry = (struct SceLibraryEntryTable *)(entTab + i);
            
            // Found Matching Library
            if(entry->libname != NULL && 0 == strcmp(entry->libname, library))
            {
                // Accumulate Function and Variable Exports
                unsigned int total = entry->stubcount + entry->vstubcount;
                
                // NID + Address Table
                unsigned int * vars = entry->entrytable;
                
                // Exports available
                if(total > 0)
                {
                    // Iterate Exports
                    for(unsigned int j = 0; j < total; j++)
                    {
                        // Found Matching NID
                        if(vars[j] == nid) return vars[total + j];
                    }
                }
            }
            
            // Move Pointer
            i += (entry->len * 4);
        }
    }
    return 0;
}

// Set User Level
int pspXploitSetUserLevel(int level)
{

    static int (*KernelGetUserLevel)() = NULL;
    if (!KernelGetUserLevel) KernelGetUserLevel =(int(*)()) pspXploitFindFunction("sceThreadManager", "ThreadManForKernel", 0xF6427665);

    // Backup User Level
    int previouslevel = KernelGetUserLevel();
    
    u32 _sceKernelReleaseThreadEventHandler = pspXploitFindFunction("sceThreadManager", "ThreadManForUser", 0x72F3C145);

    u32 addr = _sceKernelReleaseThreadEventHandler + 0x4;
    do {
        addr += 4;
    } while ((_lw(addr)&0xFFF00000) != 0x24B00000);
    
    u32 threadman_userlevel_struct = _lh(_sceKernelReleaseThreadEventHandler + 0x4)<<16;
    threadman_userlevel_struct += (short)_lh(addr);

    // Set User Level
    _sw((level ^ 8) << 28, *(unsigned int *)(threadman_userlevel_struct) + 0x14);
    
    // Flush Cache
    int (*KernelDcacheWritebackInvalidateAll)() = (void*)pspXploitFindFunction("sceSystemMemoryManager", "UtilsForKernel", 0xB435DEC5);
    KernelDcacheWritebackInvalidateAll();
    
    // Return previous User Level
    return previouslevel;
}

u32 pspXploitFindAnyJAL(u32 addr, int reversed, int skip){
    if (addr != 0)
    {
        int add = 4;
        if (reversed)
            add = -4;
        for(;;addr+=add) {
            if ((_lw(addr) >= 0x0C000000) && (_lw(addr) < 0x10000000)){
                if (skip == 0)
                    return (((_lw(addr) & 0x03FFFFFF) << 2) | 0x80000000);
                else
                    skip--;
            }
        }
    }

    return 0;
}

u32 pspXploitFindFirstBEQ(u32 addr){
    for (;;addr+=4){
        if ((_lw(addr) & 0xFC000000) == 0x10000000)
            return addr;
    }
    return 0;
}

u32 pspXploitFindRefInGlobals(char* libname, u32 addr, u32 ptr){
    while (strcmp(libname, (char*)addr))
        addr++;
    
    if (addr%4)
        addr &= -0x4; // align to 4 bytes

    while (_lw(addr += 4) != ptr);
    
    return addr;
}

void pspXploitPatchAccurateError(u32 text_addr, u32 text_size, u16 error)
{
    u32 counter = 0;
    u32 text_end = text_addr+text_size;

    for (; text_addr < text_end; text_addr += 4)
    {
        u32 code = _lw(text_addr);

        if ((code & 0xFC00FFFF) == (0x34000000|error))
        {
            counter++;
            _sw((code & 0xFFFF0000) | (0xA000 + counter), text_addr);
        }
    }
}

int pspXploitIsKernel(){
    u32 ra;
    __asm__ volatile ("move %0, $ra;" : "=r"(ra));
    return (ra&0x80000000) != 0;
}