Added 7.0x Support (#36)

* Added support for the remaining 5xx firmwares.

* Added 7.0x Support

* Added GAD_POP_RSP_RET To 5.xx

.gitignore

@@ -0,0 +1,7 @@
+bin/
+shellcode_0607/shellcode_0607.h
+shellcode_kernel/shellcode_kernel.h
+shellcode_hv/shellcode_hv.h
+*.elf
+*.bin
+*.o

Makefile

@@ -1,37 +1,42 @@
-.PHONY: all clean
-
-ifndef PS5_PAYLOAD_SDK
-    PS5_PAYLOAD_SDK = /opt/ps5-payload-sdk/
-endif
-
-include $(PS5_PAYLOAD_SDK)/toolchain/prospero.mk
-
-BIN := bin/ps5-linux-loader.elf
-SRC := $(wildcard source/*.c)
-OBJS := $(SRC:.c=.o)
-
-CFLAGS  := -std=c23 -Wall -Iinclude -Ishellcode_hypervisor -Ishellcode_kernel
-LDFLAGS :=
-
-SC_HV_H := shellcode_hypervisor/shellcode_hypervisor.h
-SC_K_H  := shellcode_kernel/shellcode_kernel.h
-
-all: $(SC_HV_H) $(SC_K_H) $(BIN)
-
-$(SC_HV_H):
-	$(MAKE) -C shellcode_hypervisor
-
-$(SC_K_H):
-	$(MAKE) -C shellcode_kernel
-
-$(OBJS): %.o: %.c
-	$(CC) $(CFLAGS) -c -o $@ $<
-
-$(BIN): $(OBJS)
-	@mkdir -p $(dir $@)
-	$(CC) $(OBJS) $(LDFLAGS) -o $@
-
-clean:
-	rm -f $(BIN) $(OBJS)
-	$(MAKE) -C shellcode_hypervisor clean
-	$(MAKE) -C shellcode_kernel clean
+.PHONY: all clean
+
+ifndef PS5_PAYLOAD_SDK
+    PS5_PAYLOAD_SDK = /opt/ps5-payload-sdk/
+endif
+
+include $(PS5_PAYLOAD_SDK)/toolchain/prospero.mk
+
+BIN := bin/ps5-linux-loader.elf
+SRC := $(wildcard source/*.c)
+OBJS := $(SRC:.c=.o)
+
+CFLAGS  := -std=c23 -Wall -Iinclude -Ishellcode_hv -Ishellcode_kernel
+LDFLAGS :=
+
+SC_0607_H := shellcode_0607/shellcode_0607.h
+SC_HV_H := shellcode_hv/shellcode_hv.h
+SC_K_H  := shellcode_kernel/shellcode_kernel.h
+
+all: $(SC_0607_H) $(SC_HV_H) $(SC_K_H) $(BIN)
+
+$(SC_0607_H):
+	$(MAKE) -C shellcode_0607
+
+$(SC_HV_H):
+	$(MAKE) -C shellcode_hv
+
+$(SC_K_H):
+	$(MAKE) -C shellcode_kernel
+
+$(OBJS): %.o: %.c
+	$(CC) $(CFLAGS) -c -o $@ $<
+
+$(BIN): $(OBJS)
+	@mkdir -p $(dir $@)
+	$(CC) $(OBJS) $(LDFLAGS) -o $@
+
+clean:
+	rm -f $(BIN) $(OBJS)
+	$(MAKE) -C shellcode_0607 clean
+	$(MAKE) -C shellcode_hv clean
+	$(MAKE) -C shellcode_kernel clean

README.md

@@ -1,66 +1,73 @@
 # ps5-linux
 
-**ps5-linux** leverages a patched HV vulnerability to transform your PS5 Phat console running **3.xx or 4.xx firmwares** into a highly capable Linux PC, unlocking its full hardware potential for desktop use. Powered by 8 CPU cores (16 threads) at **3.5 GHz** and a GPU at **2.23 GHz**, it provides enough performance to run Steam games and various emulators with impressive fluidity. It supports HDMI 4K60 video and audio output. Furthermore, it allows you to utilize an **M.2 SSD** as a dedicated Linux partition, as well as all USB ports on the console.
+**ps5-linux** leverages patched HV vulnerabilities to transform your **PS5 Phat and Slim** console running **3.00-7.61 firmwares** into a highly capable Linux PC, unlocking its full hardware potential for desktop use. Powered by 8 CPU cores (16 threads) at **3.5 GHz** and a GPU at **2.23 GHz**, it provides enough performance to run Steam games and various emulators with impressive fluidity.
+
+Features:
+
+- HDMI 4K60 video and audio output
+- M.2 SSD as dedicated Linux partition
+- All USB ports usable for peripherals
+- BD drive usable via custom ahci driver
+- Internal Bluetooth usable via custom xhci driver
+- Ethernet port usable via custom gbe driver
 
 ![Alt Text](logo.webp)
 
 ## PS5 firmware
 
-*ps5-linux* is currently only supported on PS5 Phat on 3.xx and 4.xx firmwares.
+*ps5-linux* is only supported on PS5 Phat and Slim on the following firmwares:
 
-- **3.00**, **3.10**, **3.20**, **3.21**, without M.2 support
+- **3.00**, **3.10**, **3.20**, **3.21** without M.2 support
 - **4.00**, **4.02**, **4.03**, **4.50**, **4.51** with M.2 support
+- **5.00**, **5.02**, **5.10**, **5.50** with M.2 support
+- **6.00**, **6.02**, **6.50** with M.2 support
+- **7.00**, **7.01**, **7.20**, **7.40**, **7.60**, **7.61** with M.2 support
 
 Support for 1.xx and 2.xx firmwares may be added in the future, but we will not prioritize this effort.
 
-Support for 5.xx firmwares may be added in the future, but for those firmwares, Linux will run within the GameOS VM, thus it will have less features (still unknown what limitations there will be) and it may not perform as good.
-
-If you want to update to a specific firmware, [download the correct PUP](https://darthsternie.net/ps5-firmwares/) and follow the [official guide](https://www.playstation.com/en-us/support/hardware/reinstall-playstation-system-software-safe-mode) to upgrade your PS5.
+If you are on firmwares in-between or you want to update to a specific firmware, [download the correct PUP](https://darthsternie.net/ps5-firmwares/) and follow the [official guide](https://www.playstation.com/en-us/support/hardware/reinstall-playstation-system-software-safe-mode) to upgrade your PS5. **Obviously you cannot downgrade.**
 
 ## Hardwares
 
 To run *ps5-linux*, you need some required and optional hardwares:
 
 - **Required**: USB drive with minimum 64GB (ideally external SSD) to install and run Linux.
-- **Required**: USB Ethernet/WLAN adapter for internet access.
 - **Required**: USB keyboard/mouse (dongles supported too).
+- *Optional*: USB WLAN adapter for WLAN internet access.
 - *Optional*: M.2 SSD compatible on PS5 (see [official guide](https://www.playstation.com/en-us/support/hardware/ps5-install-m2-ssd)) to run Linux from SSD.
 - *Optional*: Bluetooth dongle to connect with PS5 DualSense controller.
 
 
 ## Configure PS5 settings
 
-- **Required**: Enable Rest Mode features:
+- **VERY IMPORTANT**: Enable Rest Mode features:
   - Go to `Settings` → `System` → `Power Saving` → `Features Available in Rest Mode` and set `Supply Power to USB Ports` to `Always`.
-- **Required**: Disable HDMI Device Link:
+- **VERY IMPORTANT**: Disable HDMI Device Link:
   - Go to `Settings` → `HDMI` → `Enable HDMI Device Link`
 - *Recommended*: Disable automatic updates:
   - Go to `Settings` → `System Software` → `System Software Update and Settings`
 - *Recommended*: Disable automatic error reporting:
   - Go to `Settings` → `System Software` → `Report System Software Errors Automatically`
 
+If you reset your PS5 settings or reinstall the FW, you need to reapply these settings again.
+
 ## Installation
 
 ### 1. Get a Linux image
 
-#### Linux/macOS:
+#### Pre-built images
 
-```bash
-git clone https://github.com/ps5-linux/ps5-linux-image
-cd ps5-linux-image
-chmod +x ./build_image.sh
-./build_image.sh --distro ubuntu2604
-```
+You can download them from [ps5-linux-image](https://github.com/ps5-linux/ps5-linux-image/releases/tag/latest). Recommended is `ps5-ubuntu2604.img.xz`. Unpack the `.xz` file.
 
-#### Windows (WSL2):
+#### Build your own image
 
-If WSL2 is not installed yet, run this in PowerShell or CMD as administrator, then restart:
+If you use Windows,  run this in PowerShell or CMD as administrator to install WSL
 
 ```bash
 wsl --install
 ```
 
-Then open WSL and set up Docker:
+Install docker:
 
 ```bash
 sudo apt update
@@ -69,12 +76,6 @@ sudo service docker start
 sudo usermod -aG docker $USER
 ```
 
-Restart WSL from PowerShell/CMD:
-
-```bash
-wsl --shutdown
-```
-
 Then clone and build:
 
 ```bash
@@ -99,36 +100,7 @@ sudo dd if=output/ps5-ubuntu2604.img of=/dev/sdX bs=4M status=progress conv=fsyn
 
 #### Windows (Balena Etcher):
 
-Download Balena Etcher, select the .img file, select your USB drive, click Flash.
-
-#### Windows (WSL2 + usbipd):
-
-Install usbipd in PowerShell as administrator:
-
-```bash
-winget install usbipd
-```
-
-Plug in your USB drive, list devices and find the busid of your drive:
-
-```bash
-usbipd list
-```
-
-Bind and attach it to WSL (replace 5-3 with your busid):
-
-```bash
-usbipd bind --busid 5-3
-usbipd attach --busid 5-3 --wsl
-```
-
-Then flash from WSL:
-
-```bash
-lsblk  # confirm the drive appeared, e.g. /dev/sdb
-sudo wipefs -a /dev/sdX
-sudo dd if=output/ps5-ubuntu2604.img of=/dev/sdX bs=4M status=progress
-```
+Download [Balena Etcher](https://etcher.balena.io/), select the `.img` file, select your USB drive, click Flash.
 
 ### 3. Plug the USB drive into your PS5
 
@@ -139,16 +111,29 @@ The following USB ports are supported for booting:
 
 The front top Type-A port is USB 2.0 which is slower and thus not recommended.
 
-### 4. Run the jailbreak exploit
+### 4. Run the jailbreak
 
-1. Clone https://github.com/idlesauce/umtx2
+#### Firmware 3.00-5.50
+
+1. Clone via: `git clone https://github.com/idlesauce/umtx2`
 2. Configure fakedns via `dns.conf` to point `manuals.playstation.net` to your PCs IP address
-3. Run fake dns: `python fakedns.py -c dns.conf`
-4. Run HTTPS server: `python host.py`
+3. Run fake dns: `sudo python fakedns.py -c dns.conf`
+4. In a different terminal, run HTTPS server: `sudo python host.py`
 5. Go into PS5 advanced network settings and set primary DNS to your PCs IP address and leave secondary at `0.0.0.0`
 6. Go to user manual in settings and accept untrusted certificate prompt, run.
 
-#### 5. Send the payload
+#### Firmware 6.00-7.61
+
+1. Install Y2JB by following https://github.com/Gezine/Y2JB.
+2. Run kernel exploit: `python3 payload_sender.py $PS5IP 50000 payloads/lapse.js`
+
+### 5. Send the payload
+If you're on ARM64 Linux, first install the x86-64 cross-compilation tools before:
+
+```bash
+sudo apt install gcc-x86-64-linux-gnu binutils-x86-64-linux-gnu
+```
+
 Either download [ps5-linux-loader.elf](https://github.com/ps5-linux/ps5-linux-loader/releases/), or install [ps5-payload-sdk](https://github.com/ps5-payload-dev/sdk) and compile it yourself:
 
 ```bash
@@ -157,21 +142,24 @@ cd ps5-linux-loader
 make
 ```
 
-Find your PS5 IP at `Settings → Network → View Connection Status`.
+Send the payload with your `$PS5IP` (shown on the page):
 
 ```bash
-socat -t 99999999 - TCP:192.168.178.127:9021 < ps5-linux-loader.elf
+socat -t 99999999 - TCP:$PS5IP:9021 < ps5-linux-loader.elf
 ```
 
-If all is successful, the payload will automatically go into rest mode. Wait until the orange LED stops blinking and becomes static. Only then, press the power button again to boot your PS5 into Linux. If the boot is successful, **the LED should turn white**. If it boots back into PS5 OS, then it's because you pressed the power button too early. Or, you did not enable rest mode features as described above.
+If all is successful, the payload will automatically go into rest mode. Wait until the orange LED stops blinking and becomes static. Only then, press the power button again to boot your PS5 into Linux. If the boot is successful, **the LED should turn white**. If it boots back into PS5 OS, then it's because you pressed the power button too early. Or, you did not enable rest mode features as described above. If it freezes instead of going into rest mode, then it is likely because you have etahen/kstuff enabled, which is incompatible. Disable them.
 
 If the LED is white, but you still have a blackscreen then:
 
+- Try removing `video=DP-1:1920x1080@60` line in cmdline.txt.
+- Try setting HDCP on or off (try both).
 - Try different monitors or capture cards, ideally with different resolutions. Currently, some monitors have issues.
 - Try setting `amdgpu.force_1080p=1` in `cmdline.txt` in the FAT32 partition of the USB drive.
 
 If none of this helps, please report the issue in our [Discord server](https://discord.gg/PeMGVB7BAm) and provide your EDID information.
 
+
 ## First Boot
 
 Configure your system and memorize your login password.
@@ -180,37 +168,61 @@ Then, there are certain settings and commands we recommend doing:
 
 1. Disable screen saver, as it is currently buggy.
 
-2. Install Firefox:
+2. Possibly, you have to disable and reenable your Wired/WLAN connection to get internet connection.
 
+3. Hold packages to prevent updating the kernel when doing `apt upgrade`:
    ```bash
-   snap install firefox
-   sudo snap refresh mesa-2404 --channel=latest/edge
+   sudo apt-mark hold linux-generic linux-generic-hwe-24.04 linux-generic-hwe-26.04 linux-image-generic linux-image-generic-hwe-24.04 linux-image-generic-hwe-26.04 linux-headers-generic linux-headers-generic-hwe-24.04 linux-headers-generic-hwe-26.04
    ```
 
-3. Clone our [ps5-linux-tools](https://github.com/ps5-linux/ps5-linux-tools):
+4. Install Firefox:
 
    ```bash
+   sudo snap install firefox
+   ```
+
+5. Update mesa:
+
+   ```bash
+   sudo snap refresh mesa-2404 --channel=latest/edge
+   sudo add-apt-repository ppa:kisak/kisak-mesa
+   sudo apt update
+   sudo apt upgrade
+   ```
+
+6. Clone our [ps5-linux-tools](https://github.com/ps5-linux/ps5-linux-tools):
+
+   ```bash
+   sudo apt install zlib1g-dev
    git clone https://github.com/ps5-linux/ps5-linux-tools
+   cd ps5-linux-tools
+   make
+   ```
+
+7. If you have a Marvell WLAN chip (`lspci -nn` shows `40:00.7 Ethernet controller [0200]: Marvell Technology Group Ltd. Device [1b4b:2b56] (rev 02)`), then you can install the WLAN driver:
+
+   ```bash
+   git clone https://github.com/ps5-linux/ps5-linux-mwifiex
+   cd ps5-linux-mwifiex
+   sudo ./install.sh
    ```
 
 ## M.2 installation
 
 You can use a M.2 SSD exclusively for Linux (which means you cannot use it for PS5 game storage).
 
-1. Attach the M.SSD and boot Linux on your PS5.
-
-2. Run these commands to initialize your M.2:
+1. Attach the M.2 SSD by following the [official guide](https://www.playstation.com/en-us/support/hardware/ps5-install-m2-ssd).
+2. **VERY IMPORTANT**: If you used the M2. SSD for games before, reformat it on the PS5 under `Settings` → `Storage` → `M.2 SSD Storage`.
+3. Boot Linux on your PS5 and run these commands to initialize your M.2:
 
 ```bash
-sudo apt install zlib1g-dev
 cd ps5-linux-tools
-gcc -o m2_init m2_init.c -lz
 sudo ./m2_init
 ```
 
-3. Reboot via `sudo reboot`. If your PS5 asks you to format your M.2 again, please report this issue to us in our [Discord server](https://discord.gg/PeMGVB7BAm) and provide your M.2 model and storage size.
-4. Relaunch Linux on your PS5.
-5. Copy the `ps5-ubuntu2604.img` image that you built during installation or rebuild it on your PS5. Then, install it onto your M.2:
+4. Reboot via `sudo reboot`. If your PS5 asks you to format your M.2 again, please report this issue to us in our [Discord server](https://discord.gg/PeMGVB7BAm) and provide your M.2 model and storage size.
+5. Relaunch Linux on your PS5.
+6. Copy the `ps5-ubuntu2604.img` image that you built during installation or rebuild it on your PS5. Then, install it onto your M.2:
 
 ```bash
 cd ps5-linux-tools
@@ -226,7 +238,9 @@ chmod +x ./m2_exec.sh
 sudo ./m2_exec.sh
 ```
 
-In order to always boot Linux from your M.2, you can edit the label at `/boot/efi/cmdline.txt` from `root=LABEL=ubuntu2604` to `root=LABEL=ubuntu2604-m2`.
+Then follow the same instructions again as the previous section.
+
+In order to always boot Linux from your M.2, you can edit the label at `/boot/efi/cmdline.txt` from `root=LABEL=ubuntu2604` to `root=LABEL=ubuntu2604-m2`. You will still require a USB drive with the FAT32, but you can reformat the ext4 partition.
 
 ## Fan & boost control
 
@@ -234,37 +248,46 @@ We provide a simple tool that allows you to boost your CPU to 3500Mhz and GPU to
 
 ```bash
 cd ps5-linux-tools
-gcc -o ps5_control ps5_control.c
 sudo ./ps5_control --fan on
 sudo ./ps5_control --boost on
 ```
 
 Always turn on fan when your turn on boost, as this is what the official PS5 OS does.
 
+## Updating ps5-linux
+
+For any future ps5-linux updates, you can download the `.deb` or `.pkg.tar.zst` on your PS5 from [ps5-linux-patches](https://github.com/ps5-linux/ps5-linux-patches/releases) and install them like normal packages.
+
 ## FAQ
 
+- Q: Will higher >=8.00 firmwares be supported?
+  - A: No.
+- Q: Why can I not use M.2 on 3.xx?
+  - A: Because the PS5 fails to boot with it attached.
 - Q: Can I dual-boot Linux and PS5 OS?
   - A: No, this is a soft-mod. You need to re-run the exploit in order to boot into Linux.
 - Q: Can I put Linux into standby and resume?
   - A: No, this is not supported. We may however add a shutdown feature that puts your PS5 into rest-mode allowing you to relaunch Linux when powering up again.
-
 - Q: Can I continue using my PS5 if I install Linux?
   - A: Yes, the internal SSD is not modified
 - Q: Can I use the PS5's NIC/WLAN module in Linux?
-  - A: In theory yes, but someone needs to write or adapt drivers to use them.
-- Q: Will higher >=6.xx firmwares be supported?
-  - A: No.
+  - A: WLAN is only supported for Marvell chipsets at the moment. Ethernet is supported on all models.
 - Q: Does the DualSense controller work?
-  - A: Via a Bluetooth dongle. Built-in Bluetooth is not yet supported.
+  - A: Yes, via internal Bluetooth as well as Bluetooth dongle.
 - Q: What resolutions and refresh rates are supported?
-  - A: So far only 1080p, 1440p and 2160p at 60Hz. 120Hz or 30Hz may be added in the future.
-
+  - A: 1080p, 1440p and 2160p at 60Hz are broadly supported. 1440p@120Hz has been the only confirmed working on the DELL S3225QC yet. 120Hz or 30Hz may be added in the future.
+- Q: After reboot, I get a "Repairing" screen and "Your PS5 wasn't turned off properly." screen. Is that normal?
+  - A: Yes, and it's harmless.
 
 ## Tips and tricks
 
+- If you see graphical issues in your games, add the environment variable `RADV_DEBUG=nohiz` as [recommended for BC250](https://elektricm.github.io/amd-bc250-docs/drivers/environment/#critical-environment-variables) as well.
 - You can adjust the kernel cmdline in `cmdline.txt` in the FAT32 partition.
 - You can adjust the VRAM size in `vram.txt` in the FAT32 partition. By default, it uses 512MB (0x20000000) which enables [Dynamic VRAM allocation](https://elektricm.github.io/amd-bc250-docs/bios/flashing/#why-flash-the-bios).
 - Monitor hotswap may work, but it will not change resolution automatically.
+- Some monitors have a black screen if a video=DP-1: parameter is set in `cmdline.txt`. Confirmed working without `video=DP-1:1920x1080@60` on:
+  - MSI MAG274Q QD E2, DELL S2721DGF, DELL U2515H (1440p@60Hz)
+  - Possibly also: LG 27GL850, Lenovo Legion Y27q, ViewSonic Elite XG270QG
 
 Many configurations, tips and tricks from the [AMD BC250 Documentation](https://elektricm.github.io/amd-bc250-docs/) also apply to PS5.
 
@@ -290,8 +313,9 @@ Join our [Discord server](https://discord.gg/PeMGVB7BAm) to celebrate Linux on P
 - [theflow](https://github.com/TheOfficialFloW): [ps5-linux-loader](https://github.com/ps5-linux/ps5-linux-loader), [ps5-linux-patches](https://github.com/ps5-linux/ps5-linux-patches), [ps5-linux-tools](https://github.com/ps5-linux/ps5-linux-tools)
 - [c0w](https://github.com/c0w-ar): [ps5-linux-loader](https://github.com/ps5-linux/ps5-linux-loader)
 - [resulknad](https://github.com/resulknad): [ps5-linux-image](https://github.com/ps5-linux/ps5-linux-image)
+- [rmuxnet](https://github.com/rmuxnet): [ps5 ethernet driver](https://github.com/ps5-linux/ps5-linux-patches/commit/643e214d7bd37f292045fc0dbb821e421f7a3e47)
 - [fail0verflow](https://github.com/fail0verflow): [prosperous](https://github.com/fail0verflow/prosperous)
-- [flatz](github.com/flatz): [HV exploit](https://gist.github.com/flatz/620ddda6d64acca6d1c990dc3080ac0e)
+- [flatz](https://github.com/flatz): [HV exploit](https://gist.github.com/flatz/620ddda6d64acca6d1c990dc3080ac0e)
 - [cragson](https://github.com/cragson): [HV expoit implementation](https://github.com/cragson/ps5-hen)
 - [john-tornblom](https://github.com/john-tornblom): [PS5 SDK](https://github.com/ps5-payload-dev/sdk)
 - [echostretch](https://github.com/echostretch): Offsets and testing

include/config.h

@@ -1,34 +1,38 @@
-#ifndef CONFIG_H
-#define CONFIG_H
-
-#define PAGE_SIZE 0x4000ULL
-
-// This is used to allocate resources for HV shellcode and Linux boot
-#define cave 0x100000000ULL
-#define cave_hv_paging cave
-#define cave_hv_code                                                           \
-  cave_hv_paging + 0x3000ULL // Leave space for 3 pages but we only use 2 for
-                             // 1GB 1:1 mapping
-#define cave_linux_files cave_hv_code + 0x2000ULL
-#define cave_linux_info cave_linux_files
-#define cave_bzImage cave_linux_info + PAGE_SIZE
-// #define cave_initrd     // Allocated dynamically after bzImage
-
-#define hv_base_rsp (cave + 0x10000000ULL)
-#define hv_stack_size 0x1000ULL
-
-// This is used as transitional storage from ProsperoOS to Kernel shellcode
-#define kernel_cave_files 0xFFFF800000000000
-#define kernel_cave_linux_info kernel_cave_files
-#define kernel_cave_bzImage kernel_cave_linux_info + PAGE_SIZE
-// #define kernel_cave_initrd   // Allocated dynamically after bzImage
-
-// Linux boot config
-#define VRAM_SIZE (512ULL * 1024 * 1024)
-#define CMD_LINE                                                               \
-  "root=/dev/sda2 rw rootwait console=ttyTitania0 console=tty0 "               \
-  "video=DP-1:1920x1080@60 mitigations=off idle=halt pci=pcie_bus_perf"
-
-#define DEBUG 0 // Toggle to 0 to disable logs
-
-#endif
+#ifndef CONFIG_H
+#define CONFIG_H
+
+#define PAGE_SIZE 0x4000ULL
+
+// This is used to allocate resources for HV shellcode and Linux boot
+#define cave 0x100000000ULL
+#define cave_hv_paging cave
+#define cave_hv_code                                                           \
+  cave_hv_paging + 0x3000ULL // Leave space for 3 pages but we only use 2 for
+                             // 1GB 1:1 mapping
+#define cave_linux_files cave_hv_code + 0x2000ULL
+#define cave_linux_info cave_linux_files
+#define cave_bzImage cave_linux_info + PAGE_SIZE
+// #define cave_initrd     // Allocated dynamically after bzImage
+
+#define hv_base_rsp (cave + 0x10000000ULL)
+#define hv_stack_size 0x1000ULL
+
+// This is used as transitional storage from ProsperoOS to Kernel shellcode
+#define kernel_cave 0xFFFF800000000000
+#define kernel_cave_shellcode kernel_cave
+#define kernel_cave_shellcode_0761 kernel_cave_shellcode + PAGE_SIZE + PAGE_SIZE
+#define kernel_cave_files kernel_cave_shellcode_0761 + PAGE_SIZE
+#define kernel_cave_linux_info kernel_cave_files
+#define kernel_cave_bzImage kernel_cave_linux_info + PAGE_SIZE
+
+// #define kernel_cave_initrd   // Allocated dynamically after bzImage
+
+// Linux boot config
+#define VRAM_SIZE (512ULL * 1024 * 1024)
+#define CMD_LINE                                                               \
+  "root=/dev/sda2 rw rootwait console=ttyTitania0 console=tty0 "               \
+  "video=DP-1:1920x1080@60 mitigations=off idle=halt pci=pcie_bus_perf"
+
+#define DEBUG 0 // Toggle to 0 to disable logs
+
+#endif

include/firmware.h

@@ -0,0 +1,6 @@
+#ifndef FIRMWARE_H
+#define FIRMWARE_H
+
+int dump_device_firmwares(const char *boot_file_path);
+
+#endif

include/gpu.h

@@ -1,70 +1,70 @@
-/*** Source: ps5-hen by cragson ***/
-
-#ifndef GPU_H
-#define GPU_H
-
-#include <stdint.h>
-
-#define GPU_PDE_VALID_BIT 0
-#define GPU_PDE_IS_PTE_BIT 54
-#define GPU_PDE_TF_BIT 56
-#define GPU_PDE_BLOCK_FRAG_BIT 59
-#define GPU_PDE_ADDR_MASK 0x0000FFFFFFFFFFC0ULL
-
-#define PROT_GPU_READ 0x10
-#define PROT_GPU_WRITE 0x20
-#define MAP_NO_COALESCE 0x00400000
-
-#define GPU_SUBMIT_IOCTL 0xC0108102
-
-#define PM4_TYPE3 3
-#define PM4_SHADER_COMPUTE 1
-#define PM4_OPCODE_DMA_DATA 0x50
-#define PM4_OPCODE_INDIRECT_BUF 0x3F
-
-struct gpu_kernel_offsets {
-  uint64_t proc_vmspace;       // proc->p_vmspace offset
-  uint64_t vmspace_vm_vmid;    // vmspace->vm_vmid offset
-  uint64_t data_base_gvmspace; // offset from kernel data base to gvmspace array
-  uint64_t sizeof_gvmspace;    // size of each gvmspace entry
-  uint64_t gvmspace_page_dir_va; // gvmspace->page_dir_va offset (GPU PDB2)
-  uint64_t gvmspace_size;        // gvmspace->size offset
-  uint64_t gvmspace_start_va;    // gvmspace->start_va offset
-};
-
-struct gpu_ctx {
-  int fd;          // /dev/gc file descriptor
-  int initialized; // 1 if gpu_init() succeeded
-
-  uint64_t victim_va;   // CPU VA of victim buffer (GPU PTE remapped)
-  uint64_t transfer_va; // CPU VA of transfer/staging buffer
-  uint64_t cmd_va;      // CPU VA of PM4 command buffer
-
-  uint64_t victim_real_pa; // original physical address of victim buffer
-  uint64_t victim_ptbe_va; // kernel VA of the GPU PTE for victim buffer
-  uint64_t cleared_ptbe;   // GPU PTE with physical address cleared (template)
-  uint64_t page_size; // GPU page size for victim allocation (should be 2MB)
-  uint64_t dmem_size; // allocation size (2MB)
-};
-
-void gpu_set_offsets(struct gpu_kernel_offsets *offsets);
-
-int gpu_init(void);
-int gpu_init_internal(void);
-
-int gpu_test(void);
-
-int gpu_read_phys(uint64_t phys_addr, void *out_buf, uint32_t size);
-uint8_t gpu_read_phys1(uint64_t phys_addr);
-uint32_t gpu_read_phys4(uint64_t phys_addr);
-uint64_t gpu_read_phys8(uint64_t phys_addr);
-
-int gpu_write_phys(uint64_t phys_addr, const void *in_buf, uint32_t size);
-void gpu_write_phys4(uint64_t phys_addr, uint32_t value);
-void gpu_write_phys8(uint64_t phys_addr, uint64_t value);
-
-void gpu_cleanup(void);
-
-struct gpu_ctx *gpu_get_ctx(void);
-
-#endif
+/*** Source: ps5-hen by cragson ***/
+
+#ifndef GPU_H
+#define GPU_H
+
+#include <stdint.h>
+
+#define GPU_PDE_VALID_BIT 0
+#define GPU_PDE_IS_PTE_BIT 54
+#define GPU_PDE_TF_BIT 56
+#define GPU_PDE_BLOCK_FRAG_BIT 59
+#define GPU_PDE_ADDR_MASK 0x0000FFFFFFFFFFC0ULL
+
+#define PROT_GPU_READ 0x10
+#define PROT_GPU_WRITE 0x20
+#define MAP_NO_COALESCE 0x00400000
+
+#define GPU_SUBMIT_IOCTL 0xC0108102
+
+#define PM4_TYPE3 3
+#define PM4_SHADER_COMPUTE 1
+#define PM4_OPCODE_DMA_DATA 0x50
+#define PM4_OPCODE_INDIRECT_BUF 0x3F
+
+struct gpu_kernel_offsets {
+  uint64_t proc_vmspace;       // proc->p_vmspace offset
+  uint64_t vmspace_vm_vmid;    // vmspace->vm_vmid offset
+  uint64_t data_base_gvmspace; // offset from kernel data base to gvmspace array
+  uint64_t sizeof_gvmspace;    // size of each gvmspace entry
+  uint64_t gvmspace_page_dir_va; // gvmspace->page_dir_va offset (GPU PDB2)
+  uint64_t gvmspace_size;        // gvmspace->size offset
+  uint64_t gvmspace_start_va;    // gvmspace->start_va offset
+};
+
+struct gpu_ctx {
+  int fd;          // /dev/gc file descriptor
+  int initialized; // 1 if gpu_init() succeeded
+
+  uint64_t victim_va;   // CPU VA of victim buffer (GPU PTE remapped)
+  uint64_t transfer_va; // CPU VA of transfer/staging buffer
+  uint64_t cmd_va;      // CPU VA of PM4 command buffer
+
+  uint64_t victim_real_pa; // original physical address of victim buffer
+  uint64_t victim_ptbe_va; // kernel VA of the GPU PTE for victim buffer
+  uint64_t cleared_ptbe;   // GPU PTE with physical address cleared (template)
+  uint64_t page_size; // GPU page size for victim allocation (should be 2MB)
+  uint64_t dmem_size; // allocation size (2MB)
+};
+
+void gpu_set_offsets(struct gpu_kernel_offsets *offsets);
+
+int gpu_init(void);
+int gpu_init_internal(void);
+
+int gpu_test(void);
+
+int gpu_read_phys(uint64_t phys_addr, void *out_buf, uint32_t size);
+uint8_t gpu_read_phys1(uint64_t phys_addr);
+uint32_t gpu_read_phys4(uint64_t phys_addr);
+uint64_t gpu_read_phys8(uint64_t phys_addr);
+
+int gpu_write_phys(uint64_t phys_addr, const void *in_buf, uint32_t size);
+void gpu_write_phys4(uint64_t phys_addr, uint32_t value);
+void gpu_write_phys8(uint64_t phys_addr, uint64_t value);
+
+void gpu_cleanup(void);
+
+struct gpu_ctx *gpu_get_ctx(void);
+
+#endif

include/hv_defeat.h

@@ -1,19 +0,0 @@
-#ifndef HV_DEFEAT_H
-#define HV_DEFEAT_H
-
-#include "iommu.h"
-#include <stdint.h>
-
-int hv_defeat(void);
-int stage1_tmr_relax(void);
-int stage2_find_vmcbs(void);
-uint64_t get_vmcb(int core);
-int iommu_selftest(void);
-int stage3_patch_vmcbs(void);
-int stage4_force_vmcb_reload(void);
-int stage5_remove_xotext(void);
-int stage6_kernel_pmap_invalidate_all(void);
-int stage7_install_kexec(void);
-int kexec(uint64_t fptr);
-
-#endif

include/hv_defeat_0304.h

@@ -0,0 +1,11 @@
+#ifndef HV_DEFEAT_0304_H
+#define HV_DEFEAT_0304_H
+
+#include <stddef.h>
+
+int hv_defeat_0304(void *shellcode_kernel, size_t shellcode_kernel_len);
+int stage1_tmr_relax(void);
+int stage2_patch_vmcbs(void);
+int stage3_force_vmcb_reload(void);
+
+#endif

include/hv_defeat_0506.h

@@ -0,0 +1,8 @@
+#ifndef HV_DEFEAT_0506_H
+#define HV_DEFEAT_0506_H
+
+#include <stddef.h>
+
+int hv_defeat_0506(void *shellcode_kernel, size_t shellcode_kernel_len);
+
+#endif

include/hv_defeat_0607.h

@@ -0,0 +1,8 @@
+#ifndef HV_DEFEAT_0607_H
+#define HV_DEFEAT_0607_H
+
+#include <stddef.h>
+
+int hv_defeat_0607(void *shellcode_kernel, size_t shellcode_kernel_len);
+
+#endif

include/iommu.h

@@ -1,46 +1,46 @@
-/*** Source: ps5-hen by cragson ***/
-
-#ifndef IOMMU_H
-#define IOMMU_H
-
-#include <stdint.h>
-
-// Command buffer MMIO offsets
-#define IOMMU_MMIO_CB_HEAD 0xa000
-#define IOMMU_MMIO_CB_TAIL 0xa008
-
-// Queue constants
-#define IOMMU_CB_SIZE 0x2000
-#define IOMMU_CB_MASK (IOMMU_CB_SIZE - 1)
-#define IOMMU_CMD_ENTRY_SIZE 0x10
-
-// IOMMU softc field offsets
-#define IOMMU_SC_MMIO_VA 0x40
-#define IOMMU_SC_CB2_PTR 0x78
-#define IOMMU_SC_CB3_PTR 0x80
-#define IOMMU_SC_EB_PTR 0x60b90
-
-typedef struct _iommu_ctx {
-  uint64_t cb2_base; // kernel VA of command buffer 2 (hv terminology)
-  uint64_t cb3_base; // kernel VA of command buffer 3 (hv terminology)
-  uint64_t eb_base;  // kernel VA of event buffer
-  uint64_t mmio_va;  // DMAP VA of IOMMU MMIO base
-} iommu_ctx;
-
-extern iommu_ctx iommu_store;
-extern iommu_ctx *iommu;
-
-int iommu_init(void);
-
-// Submit a single 16-byte command and wait for completion
-void iommu_submit_cmd(const void *cmd);
-// Write 8 bytes to a physical address using IOMMU completion wait store
-void iommu_write8_pa(uint64_t pa, uint64_t val);
-
-// Write 4 bytes to a physical address
-void iommu_write4_pa(uint64_t pa, uint32_t val);
-
-// Write arbitrary length to a physical address in 8-byte chunks
-void iommu_write_pa(uint64_t pa, const void *data, uint32_t len);
-
-#endif
+/*** Source: ps5-hen by cragson ***/
+
+#ifndef IOMMU_H
+#define IOMMU_H
+
+#include <stdint.h>
+
+// Command buffer MMIO offsets
+#define IOMMU_MMIO_CB_HEAD 0xa000
+#define IOMMU_MMIO_CB_TAIL 0xa008
+
+// Queue constants
+#define IOMMU_CB_SIZE 0x2000
+#define IOMMU_CB_MASK (IOMMU_CB_SIZE - 1)
+#define IOMMU_CMD_ENTRY_SIZE 0x10
+
+// IOMMU softc field offsets
+#define IOMMU_SC_MMIO_VA 0x40
+#define IOMMU_SC_CB2_PTR 0x78
+#define IOMMU_SC_CB3_PTR 0x80
+#define IOMMU_SC_EB_PTR 0x60b90
+
+typedef struct _iommu_ctx {
+  uint64_t cb2_base; // kernel VA of command buffer 2 (hv terminology)
+  uint64_t cb3_base; // kernel VA of command buffer 3 (hv terminology)
+  uint64_t eb_base;  // kernel VA of event buffer
+  uint64_t mmio_va;  // DMAP VA of IOMMU MMIO base
+} iommu_ctx;
+
+extern iommu_ctx iommu_store;
+extern iommu_ctx *iommu;
+
+int iommu_init(void);
+
+// Submit a single 16-byte command and wait for completion
+void iommu_submit_cmd(const void *cmd);
+// Write 8 bytes to a physical address using IOMMU completion wait store
+void iommu_write8_pa(uint64_t pa, uint64_t val);
+
+// Write 4 bytes to a physical address
+void iommu_write4_pa(uint64_t pa, uint32_t val);
+
+// Write arbitrary length to a physical address in 8-byte chunks
+void iommu_write_pa(uint64_t pa, const void *data, uint32_t len);
+
+#endif

include/linux.h

@@ -2,6 +2,7 @@
 #define __LINUX_H__
 
 #include <stdint.h>
+#include <unistd.h>
 
 #define X86_SUBARCH_PS5 5
 
@@ -104,4 +105,22 @@ struct boot_params {
   uint8_t _pad9[276];                                           // 0xeec
 } __attribute__((packed));
 
+typedef struct {
+  uint64_t start;
+  uint64_t end;
+} tmr;
+
+struct linux_info {
+  uintptr_t linux_info; // PA of linux_info
+  uintptr_t bzimage;
+  size_t bzimage_size;
+  uintptr_t initrd;
+  size_t initrd_size;
+  size_t vram_size;
+  int kit_type;
+  int n_tmrs;
+  tmr tmrs[64];
+  char cmdline[2048];
+};
+
 #endif

include/loader.h

@@ -1,10 +1,11 @@
-#include "utils.h"
-#include <stdint.h>
-
-static uint64_t alloc_page(void);
-static void install_page(uintptr_t pml4, vm_offset_t va, vm_paddr_t pa,
-                         int bits);
-void pte_store(uintptr_t ptep, uint64_t pte);
-static int read_file(const char *path, void *buf, size_t bufsize);
-static void trim_newline(char *s);
-int fetch_linux(struct linux_info *info);
+#ifndef LOADER_H
+#define LOADER_H
+#include "utils.h"
+
+void install_page(uintptr_t pml4, vm_offset_t va, vm_paddr_t pa, int bits);
+void pte_store(uintptr_t ptep, uint64_t pte);
+int read_file(const char *path, void *buf, size_t bufsize);
+void trim_newline(char *s);
+int fetch_linux(struct linux_info *info);
+
+#endif

include/main.h

@@ -1,8 +1,8 @@
-#ifndef MAIN_H
-#define MAIN_H
-
-int main(void);
-int setup_env(void);
-int prepare_resume(void);
-
-#endif
+#ifndef MAIN_H
+#define MAIN_H
+
+int main(void);
+int setup_env(void);
+int prepare_resume(void);
+
+#endif

include/offsets.h

@@ -1,50 +1,78 @@
-#ifndef OFFSETS_H
-#define OFFSETS_H
-
-#include <stdint.h>
-
-typedef struct _offset_list {
-  uint64_t PMAP_STORE;
-  uint64_t HV_VCPU;           // Needed for 1.xx and 2.xx
-  uint64_t HV_VCPU_CPUID;     // Needed for 1.xx and 2.xx
-  uint64_t HV_VCPU_ARRAY_OFF; // Needed for 1.xx and 2.xx
-  uint64_t HV_VCPU_STRIDE;    // Needed for 1.xx and 2.xx
-  uint64_t HV_VCPU_VMCB_PTR;  // Needed for 1.xx and 2.xx
-  uint64_t KERNEL_CODE_CAVE;
-  uint64_t KERNEL_DATA_CAVE;
-  uint64_t IOMMU_SOFTC;
-  uint64_t VMSPACE_VM_VMID;
-  uint64_t VMSPACE_VM_PMAP;
-  uint64_t PMAP_PM_PML4;
-  uint64_t PMAP_PM_CR3;
-  uint64_t DATA_BASE_GVMSPACE;
-  uint64_t HOOK_ACPI_WAKEUP_MACHDEP;
-  uint64_t FUN_PRINTF;
-  uint64_t FUN_VA_TO_PA;
-  uint64_t FUN_HV_IOMMU_SET_BUFFERS;
-  uint64_t FUN_HV_IOMM_WAIT_COMPLETION;
-  uint64_t FUN_SMP_RENDEZVOUS;
-  uint64_t FUN_SMP_NO_RENDEVOUS_BARRIER;
-  uint64_t HV_HANDLE_VMEXIT_PA;
-  uint64_t HV_CODE_CAVE_PA;
-  uint64_t HV_UART_OVERRIDE_PA;
-  uint64_t G_VBIOS;
-  uint64_t FUN_TRANSMITTER_CONTROL;
-  uint64_t FUN_MP3_INITIALIZE;
-  uint64_t FUN_MP3_INVOKE;
-  uint64_t KERNEL_UART_OVERRIDE;
-  uint64_t KERNEL_DEBUG_PATCH;
-  uint64_t KERNEL_CFI_CHECK;
-} offset_list;
-
-extern offset_list off_0300;
-extern offset_list off_0310;
-extern offset_list off_0320;
-extern offset_list off_0321;
-extern offset_list off_0400;
-extern offset_list off_0402;
-extern offset_list off_0403;
-extern offset_list off_0450;
-extern offset_list off_0451;
-
-#endif
+#ifndef OFFSETS_H
+#define OFFSETS_H
+
+#include <stdint.h>
+
+typedef struct _offset_list {
+  /* Loader utils */
+  uint64_t IOMMU_SOFTC;
+  uint64_t VMSPACE_VM_VMID;
+  uint64_t VMSPACE_VM_PMAP;
+  uint64_t DATA_BASE_GVMSPACE;
+  /* Offsets for 5.00-6.02 hv exploit */
+  uint64_t ACPIGBL_FACS;
+  uint64_t IDT;
+  uint64_t COMMON_TSS;
+  uint64_t STOPPED_CPUS;
+  uint64_t FUN_STOP_CPUS;
+  uint64_t FUN_AS_LAPIC_EOI;
+  uint64_t FUN_HV_UNMAP_PT_TMR;
+  uint64_t FUN_MEMCPY;
+  uint64_t GAD_ADD_RSP_28_POP_RBP_RET;
+  uint64_t GAD_IRETQ;
+  uint64_t GAD_POP_RAX_RET;
+  uint64_t GAD_POP_RDI_RET;
+  uint64_t GAD_POP_RSI_RET;
+  uint64_t GAD_POP_RDX_RET;
+  uint64_t GAD_POP_RCX_RET;
+  uint64_t GAD_POP_RSP_RET;
+  uint64_t GAD_WRMSR_RET;
+  uint64_t GAD_MOV_QWORD_PTR_RDI_RSI_POP_RBP_RET;
+  /* Shellcode Kernel */
+  uint64_t HOOK_ACPI_WAKEUP_MACHDEP;
+  uint64_t KERNEL_CODE_CAVE;
+  uint64_t FUN_PRINTF;
+  uint64_t FUN_HV_IOMMU_SET_BUFFERS;
+  uint64_t FUN_HV_IOMM_WAIT_COMPLETION;
+  uint64_t FUN_SMP_RENDEZVOUS;
+  uint64_t FUN_SMP_NO_RENDEVOUS_BARRIER;
+  /* Shellcode HV */
+  uint64_t HV_CODE_CAVE_PA;
+  uint64_t HV_HANDLE_VMEXIT_PA;
+  /* Patches on Kernel */
+  uint64_t KERNEL_UART_OVERRIDE;
+  uint64_t KERNEL_CFI_CHECK;
+  /* Internal functions to prepare boot */
+  uint64_t G_VBIOS;
+  uint64_t FUN_TRANSMITTER_CONTROL;
+  uint64_t FUN_MP3_INITIALIZE;
+  uint64_t FUN_MP3_INVOKE;
+  /* Wifi FW */
+  uint64_t PS5_WIFI_FW_OFFSET;
+  uint64_t PS5_WIFI_FW_SIZE;
+} offset_list;
+
+extern offset_list off_0300;
+extern offset_list off_0310;
+extern offset_list off_0320;
+extern offset_list off_0321;
+extern offset_list off_0400;
+extern offset_list off_0402;
+extern offset_list off_0403;
+extern offset_list off_0450;
+extern offset_list off_0451;
+extern offset_list off_0500;
+extern offset_list off_0502;
+extern offset_list off_0510;
+extern offset_list off_0550;
+extern offset_list off_0600;
+extern offset_list off_0602;
+extern offset_list off_0650;
+extern offset_list off_0700;
+extern offset_list off_0701;
+extern offset_list off_0720;
+extern offset_list off_0740;
+extern offset_list off_0760;
+extern offset_list off_0761;
+
+#endif

include/prepare_resume.h

@@ -0,0 +1,12 @@
+#ifndef PREPARE_RESUME_H
+#define PREPARE_RESUME_H
+#include "utils.h"
+
+extern struct linux_info linux_i;
+
+int prepare_resume(void **shellcode_kernel, size_t *shellcode_kernel_len);
+uint64_t prepare_sck_args(void);
+int update_sck_args_ptr(uint64_t shellcode, uint64_t args);
+void hook_call_near(uint64_t hook, uint64_t dst);
+
+#endif

include/tmr.h

@@ -1,19 +1,19 @@
-#ifndef TMR_H
-#define TMR_H
-
-#include <stdint.h>
-
-#define ECAM_B0D18F2 dmap + (0xF0000000ULL + 0x18ULL * 0x8000 + 2 * 0x1000)
-#define TMR_INDEX_OFF 0x80
-#define TMR_DATA_OFF 0x84
-
-#define TMR_BASE(n) ((n) * 0x10 + 0x00)
-#define TMR_LIMIT(n) ((n) * 0x10 + 0x04)
-#define TMR_CONFIG(n) ((n) * 0x10 + 0x08)
-#define TMR_REQUESTORS(n) ((n) * 0x10 + 0x0C)
-#define TMR_CFG_PERMISSIVE 0x3F07
-
-uint32_t tmr_read(uint32_t addr);
-void tmr_write(uint32_t addr, uint32_t val);
-
-#endif
+#ifndef TMR_H
+#define TMR_H
+
+#include <stdint.h>
+
+#define ECAM_B0D18F2 dmap + (0xF0000000ULL + 0x18ULL * 0x8000 + 2 * 0x1000)
+#define TMR_INDEX_OFF 0x80
+#define TMR_DATA_OFF 0x84
+
+#define TMR_BASE(n) ((n) * 0x10 + 0x00)
+#define TMR_LIMIT(n) ((n) * 0x10 + 0x04)
+#define TMR_CONFIG(n) ((n) * 0x10 + 0x08)
+#define TMR_REQUESTORS(n) ((n) * 0x10 + 0x0C)
+#define TMR_CFG_PERMISSIVE 0x3F07
+
+uint32_t tmr_read(uint32_t addr);
+void tmr_write(uint32_t addr, uint32_t val);
+
+#endif

include/utils.h

@@ -1,159 +1,175 @@
-#ifndef UTILS_H
-#define UTILS_H
-
-#include "offsets.h"
-#include <ps5/kernel.h>
-#include <stdarg.h>
-#include <stdint.h>
-#include <string.h>
-
-int sceKernelGetCurrentCpu();
-int sceKernelSendNotificationRequest(int, void *, size_t, int);
-int sceKernelOpenEventFlag(void*, const char *);
-int sceKernelNotifySystemSuspendStart(void);
-int sceKernelSetEventFlag(void *, int);
-int sceKernelCloseEventFlag(void*);
-
-typedef struct _sysent {
-  uint32_t n_arg;
-  uint32_t pad;
-  uint64_t sy_call;
-  uint64_t sy_auevent;
-  uint64_t sy_systrace_args;
-  uint32_t sy_entry;
-  uint32_t sy_return;
-  uint32_t sy_flags;
-  uint32_t sy_thrcnt;
-} sysent;
-
-typedef struct __flat_pmap {
-  uint64_t mtx_name_ptr;
-  uint64_t mtx_flags;
-  uint64_t mtx_data;
-  uint64_t mtx_lock;
-  uint64_t pm_pml4;
-  uint64_t pm_cr3;
-} flat_pmap;
-
-struct linux_info {
-  uintptr_t bzimage;
-  size_t bzimage_size;
-  uintptr_t initrd;
-  size_t initrd_size;
-  size_t vram_size;
-  char cmdline[2048];
-  uintptr_t linux_info; // PA of linux_info
-};
-
-/** These vars are global for the payload to simplify things */
-extern offset_list env_offset;    // Defined on utils.c
-extern uint64_t ktext;            // Defined on utils.c
-extern uint64_t kdata;            // Defined on utils.c
-extern uint64_t dmap;             // Defined on utils.c
-extern uint64_t cr3;              // Defined on utils.c
-extern uint32_t fw;               // Defined on utils.c
-extern uint64_t vmcb_pa[16];      // Defined on hv_defeat.c
-extern struct linux_info linux_i; // Declared on main.c
-
-static inline void kwrite(uint64_t ka, void *src, uint64_t len) {
-  kernel_copyin(src, ka, len);
-}
-
-static inline void kwrite64(uint64_t dst, uint64_t val) {
-  kernel_copyin(&val, dst, 8);
-}
-
-static inline void kwrite32(uint64_t dst, uint32_t val) {
-  kernel_copyin(&val, dst, 4);
-}
-
-static inline void kwrite8(uint64_t dst, uint8_t val) {
-  kernel_copyin(&val, dst, 1);
-}
-
-static inline void kread(uint64_t ka, void *dst, uint64_t len) {
-  kernel_copyout(ka, dst, len);
-}
-
-static inline uint64_t kread64(uint64_t src) {
-  uint64_t val;
-  kernel_copyout(src, &val, 8);
-  return val;
-}
-
-static inline uint32_t kread32(uint64_t src) {
-  uint32_t val;
-  kernel_copyout(src, &val, 4);
-  return val;
-}
-
-static inline uint8_t kread8(uint64_t src) {
-  uint8_t val;
-  kernel_copyout(src, &val, 1);
-  return val;
-}
-
-int set_offsets(void);
-int init_global_vars(void);
-uint64_t get_offset_va(uint64_t offset);
-
-// Defines for Page management
-#define ALIGN_UP(size, align) (((size) + (align) - 1) & ~((align) - 1))
-#define INKERNEL(va) (va & 0xFFFF000000000000)
-
-enum page_bits {
-  P = 0,
-  RW,
-  US,
-  PWT,
-  PCD,
-  A,
-  D,
-  PS,
-  G,
-  XO = 58,
-  PK = 59,
-  NX = 63
-};
-
-#define PG_B_P (1ULL << P)
-#define PG_B_RW (1ULL << RW)
-#define PAGE_P(x) (x & (1ULL << P))
-#define PAGE_RW(x) (x & (1ULL << RW))
-#define PAGE_PS(x) (x & (1ULL << PS))
-#define PAGE_XO(x) (x & (1ULL << XO))
-#define PAGE_CLEAR_XO(x) (x &= ~(1ULL << XO))
-#define PAGE_CLEAR_G(x) (x &= ~(1ULL << G))
-#define PAGE_SET_RW(x) (x |= (1ULL << RW))
-#define PAGE_PA(x) (x & 0x000FFFFFFFFFF000ULL)
-#define P_SIZE(l) ((l == 1) ? (1ULL << 30) : (1ULL << 21))
-
-#define pmap_pml4e_index(va) ((va >> 39) & 0x1FF)
-#define pmap_pdpe_index(va) ((va >> 30) & 0x1FF)
-#define pmap_pde_index(va) ((va >> 21) & 0x1FF)
-#define pmap_pte_index(va) ((va >> 12) & 0x1FF)
-
-uint64_t va_to_pa_user(uint64_t va);
-uint64_t va_to_pa_kernel(uint64_t va);
-uint64_t va_to_pa_custom(uint64_t va, uint64_t cr3_custom);
-uint64_t pa_to_dmap(uint64_t pa);
-void page_chain_set_rw(uint64_t va);
-uint64_t page_remove_global(uint64_t va);
-
-uint64_t getpmap(uint64_t proc_ptr);
-uint64_t get_pml4(uint64_t pmap);
-
-int pin_to_core(int n);
-int pin_to_first_available_core(void);
-void unpin(void);
-void notify(const char *fmt, ...);
-void notify_internal(uint8_t *msg);
-void enter_rest_mode(void);
-
-#if DEBUG
-#define DEBUG_PRINT(fmt, ...) printf(fmt, ##__VA_ARGS__)
-#else
-#define DEBUG_PRINT(fmt, ...)
-#endif
-
-#endif
+#ifndef UTILS_H
+#define UTILS_H
+
+#include "linux.h"
+#include "offsets.h"
+#include <ps5/kernel.h>
+#include <stdarg.h>
+#include <string.h>
+
+int sceKernelGetCurrentCpu();
+int sceKernelSendNotificationRequest(int, void *, size_t, int);
+int sceKernelOpenEventFlag(void *, const char *);
+int sceKernelNotifySystemSuspendStart(void);
+int sceKernelSetEventFlag(void *, int);
+int sceKernelCloseEventFlag(void *);
+
+typedef struct _sysent {
+  uint32_t n_arg;
+  uint32_t pad;
+  uint64_t sy_call;
+  uint64_t sy_auevent;
+  uint64_t sy_systrace_args;
+  uint32_t sy_entry;
+  uint32_t sy_return;
+  uint32_t sy_flags;
+  uint32_t sy_thrcnt;
+} sysent;
+
+typedef struct __flat_pmap {
+  uint64_t mtx_name_ptr;
+  uint64_t mtx_flags;
+  uint64_t mtx_data;
+  uint64_t mtx_lock;
+  uint64_t pm_pml4;
+  uint64_t pm_cr3;
+} flat_pmap;
+
+/** These vars are global for the payload to simplify things */
+extern offset_list env_offset;    // Defined on utils.c
+extern uint64_t ktext;            // Defined on utils.c
+extern uint64_t kdata;            // Defined on utils.c
+extern uint64_t dmap;             // Defined on utils.c
+extern uint64_t cr3;              // Defined on utils.c
+extern uint32_t fw;               // Defined on utils.c
+extern uint64_t vmcb_pa[16];      // Defined on hv_defeat.c
+extern struct linux_info linux_i; // Declared on main.c
+
+int setup_env(void);
+
+static inline void kwrite_large(uint64_t ka, void *src, uint64_t len) {
+  uint32_t CHUNK = 0x1000;
+  uint64_t written = 0;
+  while (written < len) {
+    uint32_t n = (len - written > CHUNK) ? CHUNK : (uint32_t)(len - written);
+    kernel_copyin(src + written, ka + written, n);
+    written += n;
+  }
+}
+
+static inline void kwrite(uint64_t ka, void *src, uint64_t len) {
+  kernel_copyin(src, ka, len);
+}
+
+static inline void kwrite64(uint64_t dst, uint64_t val) {
+  kernel_copyin(&val, dst, 8);
+}
+
+static inline void kwrite32(uint64_t dst, uint32_t val) {
+  kernel_copyin(&val, dst, 4);
+}
+
+static inline void kwrite8(uint64_t dst, uint8_t val) {
+  kernel_copyin(&val, dst, 1);
+}
+
+static inline void kread(uint64_t ka, void *dst, uint64_t len) {
+  kernel_copyout(ka, dst, len);
+}
+
+static inline uint64_t kread64(uint64_t src) {
+  uint64_t val;
+  kernel_copyout(src, &val, 8);
+  return val;
+}
+
+static inline uint32_t kread32(uint64_t src) {
+  uint32_t val;
+  kernel_copyout(src, &val, 4);
+  return val;
+}
+
+static inline uint8_t kread8(uint64_t src) {
+  uint8_t val;
+  kernel_copyout(src, &val, 1);
+  return val;
+}
+
+int set_offsets(void);
+int init_global_vars(void);
+uint64_t get_offset_va(uint64_t offset);
+
+// Defines for Page management
+#define ALIGN_UP(size, align) (((size) + (align) - 1) & ~((align) - 1))
+#define INKERNEL(va) (va & 0xFFFF000000000000)
+
+enum page_bits {
+  P = 0,
+  RW,
+  US,
+  PWT,
+  PCD,
+  A,
+  D,
+  PS,
+  G,
+  XO = 58,
+  PK = 59,
+  NX = 63
+};
+
+#define PG_B_P (1ULL << P)
+#define PG_B_RW (1ULL << RW)
+#define PAGE_P(x) (x & (1ULL << P))
+#define PAGE_RW(x) (x & (1ULL << RW))
+#define PAGE_PS(x) (x & (1ULL << PS))
+#define PAGE_XO(x) (x & (1ULL << XO))
+#define PAGE_CLEAR_XO(x) (x &= ~(1ULL << XO))
+#define PAGE_CLEAR_G(x) (x &= ~(1ULL << G))
+#define PAGE_SET_RW(x) (x |= (1ULL << RW))
+#define PAGE_PA(x) (x & 0x000FFFFFFFFFF000ULL)
+#define P_SIZE(l) ((l == 1) ? (1ULL << 30) : (1ULL << 21))
+
+#define pmap_pml4e_index(va) ((va >> 39) & 0x1FF)
+#define pmap_pdpe_index(va) ((va >> 30) & 0x1FF)
+#define pmap_pde_index(va) ((va >> 21) & 0x1FF)
+#define pmap_pte_index(va) ((va >> 12) & 0x1FF)
+
+uint64_t vtophys_user(uint64_t va);
+uint64_t vtophys(uint64_t va);
+uint64_t vtophys_custom(uint64_t va, uint64_t cr3_custom);
+uint64_t pa_to_dmap(uint64_t pa);
+void page_chain_set_rw(uint64_t va);
+uint64_t page_remove_global(uint64_t va);
+
+uint64_t getpmap(uint64_t proc_ptr);
+uint64_t get_pml4(uint64_t pmap);
+
+int pin_to_core(int n);
+int pin_to_first_available_core(void);
+void unpin(void);
+void notify(const char *fmt, ...);
+void notify_internal(uint8_t *msg);
+void enter_rest_mode(void);
+
+#if DEBUG
+#define DEBUG_PRINT(fmt, ...) printf(fmt, ##__VA_ARGS__)
+#else
+#define DEBUG_PRINT(fmt, ...)
+#endif
+
+bool if_exists(const char *path);
+bool sceKernelIsTestKit(void);
+bool sceKernelIsDevKit(void);
+
+enum kit_type { KIT_RETAIL, KIT_TESTKIT, KIT_DEVKIT };
+
+enum kit_type get_kit_type(void);
+
+#define MINI_SYSCORE_PID 1
+
+uint64_t alloc_page(void);
+void pte_store(uintptr_t ptep, uint64_t pte);
+void install_page(uintptr_t pml4, vm_offset_t va, vm_paddr_t pa, int bits);
+void install_page_syscore(vm_offset_t va, vm_paddr_t pa, int bits);
+#endif

shellcode_0607/Makefile

@@ -0,0 +1,34 @@
+ifeq ($(shell uname -m),aarch64)
+CC      = x86_64-linux-gnu-gcc
+LD      = x86_64-linux-gnu-ld
+OBJCOPY = x86_64-linux-gnu-objcopy
+else
+CC      = gcc
+LD      = ld
+OBJCOPY = objcopy
+endif
+CFLAGS  = -O2 -fno-stack-protector -ffreestanding -nostdlib -fcf-protection=none -mno-sse -mno-sse2 -m64
+LDFLAGS = -T linker.ld -Wl,--no-warn-rwx-segments
+TARGET  = shellcode_0607.elf
+TEXT_BIN = shellcode_0607.bin
+dump = shellcode_0607.h
+
+SRC = main.c utils.c
+OBJ = $(SRC:.c=.o)
+
+all: $(dump)
+
+$(TARGET): $(OBJ)
+	$(CC) $(CFLAGS) $(LDFLAGS) $(OBJ) -o $(TARGET)
+
+%.o: %.c
+	$(CC) $(CFLAGS) -c $< -o $@
+
+$(TEXT_BIN): $(TARGET)
+	$(OBJCOPY) -O binary -j .shell_code $(TARGET) $(TEXT_BIN)
+
+clean:
+	rm -f $(OBJ) $(TARGET) $(TEXT_BIN) $(dump)
+
+$(dump): $(TEXT_BIN)
+	xxd -i $(TEXT_BIN) > $(dump)

shellcode_0607/linker.ld

@@ -1,18 +1,18 @@
-/* linker.ld */
-ENTRY(main)
-
-SECTIONS
-{
-    . = 0x1000; /* 0x1000 to avoid warnings from linker */
-    /* Place our custom header first */
-    .shell_code :
-    {
-        *(.entry_point)
-        *(.text)
-        *(.text.*)
-        *(.data*)
-        *(.rodata*)
-        *(.bss)
-        *(.bss.*)
-    }
-}
+/* linker.ld */
+ENTRY(main)
+
+SECTIONS
+{
+    . = 0x1000; /* 0x1000 to avoid warnings from linker */
+    /* Place our custom header first */
+    .shell_code :
+    {
+        *(.entry_point)
+        *(.text)
+        *(.text.*)
+        *(.data*)
+        *(.rodata*)
+        *(.bss)
+        *(.bss.*)
+    }
+}