The-Homebrew-Cloud/MochaPayload
2
0
Fork 0
mirror of https://github.com/wiiu-env/MochaPayload.git synced 2024-11-13 03:35:07 +01:00
Code Issues Packages Projects Releases Wiki Activity

Formatting

Browse Source
This commit is contained in:
Maschell 2021-09-23 18:52:20 +02:00
parent 35f046172e
commit f1b866f1ce
12 changed files with 73 additions and 76 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
source/common/ipc_defs.h
View File

@ -10,7 +10,7 @@
#define CHECK_OFFSET(Type, Offset, Field) \
static_assert(offsetof(Type, Field) == Offset, \
#Type "::" #Field " must be at offset " #Offset)
typedef struct __attribute__((packed)) {
uint64_t title_id;
uint64_t boss_id;
@ -133,7 +133,7 @@ typedef struct __attribute__((packed)) {
uint32_t groupId;
uint32_t cmdFlags;
char argstr[4096];
char* argv[64];
char *argv[64];
uint32_t max_size;
uint32_t avail_size;
uint32_t codegen_size;

32
source/crt.c
View File

@ -1,30 +1,36 @@
void __init_wut_malloc();
void __init_wut_newlib();
void __init_wut_stdcpp();
void __init_wut_devoptab();
void __attribute__((weak)) __init_wut_socket();
void __fini_wut_malloc();
void __fini_wut_newlib();
void __fini_wut_stdcpp();
void __fini_wut_devoptab();
void __attribute__((weak)) __fini_wut_socket();
void __attribute__((weak))
__init_wut_()
{
__init_wut_malloc();
__init_wut_newlib();
__init_wut_stdcpp();
__init_wut_devoptab();
if (&__init_wut_socket) __init_wut_socket();
__init_wut_() {
__init_wut_malloc();
__init_wut_newlib();
__init_wut_stdcpp();
__init_wut_devoptab();
if (&__init_wut_socket) __init_wut_socket();
}
void __attribute__((weak))
__fini_wut_()
{
__fini_wut_devoptab();
__fini_wut_stdcpp();
__fini_wut_newlib();
__fini_wut_malloc();
__fini_wut_() {
__fini_wut_devoptab();
__fini_wut_stdcpp();
__fini_wut_newlib();
__fini_wut_malloc();
}

5
source/ios_exploit.c
View File

@ -1,5 +1,4 @@
#include <string.h>
#include <stdio.h>
#include <coreinit/cache.h>
#include <coreinit/thread.h>
#include <coreinit/ios.h>
@ -349,11 +348,11 @@ int ExecuteIOSExploit() {
int dummy[2];
dummy[0] = 0x050B817C;
dummy[1] = *((uint32_t*) 0xF417FFF0);
dummy[1] = *((uint32_t *) 0xF417FFF0);
IOS_Ioctl(iosuhaxFd, 0x07, &dummy, sizeof(dummy), &dummy, sizeof(dummy)); // IOCTL_KERN_WRITE32
dummy[0] = 0x050B8180;
dummy[1] = *((uint32_t*) 0xF417FFF4);
dummy[1] = *((uint32_t *) 0xF417FFF4);
IOS_Ioctl(iosuhaxFd, 0x07, &dummy, sizeof(dummy), &dummy, sizeof(dummy)); // IOCTL_KERN_WRITE32
//! do not run patches again as that will most likely crash

6
source/ios_kernel/source/instant_patches.c
View File

@ -50,14 +50,14 @@ void instant_patches_setup(void) {
// patch FSA raw access
*(volatile u32 *) 0x1070FAE8 = 0x05812070;
*(volatile u32 *) 0x1070FAEC = 0xEAFFFFF9;
// patch /dev/odm IOCTL 0x06 to return the disc key if in_buf[0] > 2.
*(volatile u32 *) 0x10739948 = 0xe3a0b001; // mov r11, 0x01
*(volatile u32 *) 0x1073994C = 0xe3a07020; // mov r7, 0x20
*(volatile u32 *) 0x10739950 = 0xea000013; // b LAB_107399a8
int (*_iosMapSharedUserExecution)(void *descr) = (void *) 0x08124F88;
// patch kernel dev node registration
*(volatile u32 *) 0x081430B4 = 1;
@ -69,7 +69,7 @@ void instant_patches_setup(void) {
// allow custom bootLogoTex and bootMovie.h264
*(volatile u32 *) (0xE0030D68 - 0xE0000000 + 0x12900000) = 0xE3A00000; // mov r0, #0
*(volatile u32 *) (0xE0030D34 - 0xE0000000 + 0x12900000) = 0xE3A00000; // mov r0, #0
// Patch update check
*(volatile u32 *) (0xe22830e0 - 0xe2280000 + 0x13140000) = 0x00000000;
*(volatile u32 *) (0xe22b2a78 - 0xe2280000 + 0x13140000) = 0x00000000;

4
source/ios_kernel/source/kernel_patches.c
View File

@ -111,12 +111,12 @@ void kernel_run_patches(u32 ios_elf_start) {
section_write_word(ios_elf_start, 0x10739948, 0xe3a0b001);
section_write_word(ios_elf_start, 0x1073994C, 0xe3a07020);
section_write_word(ios_elf_start, 0x10739950, 0xea000013);
// update check
section_write_word(ios_elf_start, 0xe22830e0, 0x00000000);
section_write_word(ios_elf_start, 0xe22b2a78, 0x00000000);
section_write_word(ios_elf_start, 0xe204fb68, 0xe3a00000);
section_write_word(ios_elf_start, 0x0812CD2C, ARM_B(0x0812CD2C, kernel_syscall_0x81));
u32 patch_count = (u32) (((u8 *) kernel_patches_table_end) - ((u8 *) kernel_patches_table)) / sizeof(patch_table_t);

16
source/ios_mcp/source/fsa.c
View File

@ -57,17 +57,17 @@ int FSA_Unmount(int fd, char *path, u32 flags) {
return ret;
}
int FSA_FlushVolume(int fd, char* volume_path) {
u8* iobuf = allocIobuf();
u32* inbuf = (u32*)iobuf;
u32* outbuf = (u32*)&iobuf[0x520];
int FSA_FlushVolume(int fd, char *volume_path) {
u8 *iobuf = allocIobuf();
u32 *inbuf = (u32 *) iobuf;
u32 *outbuf = (u32 *) &iobuf[0x520];
strncpy((char*)&inbuf[0x01], volume_path, 0x27F);
strncpy((char *) &inbuf[0x01], volume_path, 0x27F);
int ret = svcIoctl(fd, 0x1B, inbuf, 0x520, outbuf, 0x293);
int ret = svcIoctl(fd, 0x1B, inbuf, 0x520, outbuf, 0x293);
freeIobuf(iobuf);
return ret;
freeIobuf(iobuf);
return ret;
}
int FSA_MakeDir(int fd, char *path, u32 flags) {

2
source/ios_mcp/source/fsa.h
View File

@ -31,7 +31,7 @@ int FSA_Mount(int fd, char *device_path, char *volume_path, u32 flags, char *arg
int FSA_Unmount(int fd, char *path, u32 flags);
int FSA_FlushVolume(int fd, char* volume_path);
int FSA_FlushVolume(int fd, char *volume_path);
int FSA_GetDeviceInfo(int fd, char *device_path, int type, u32 *out_data);

6
source/ios_mcp/source/ipc.c
View File

@ -110,8 +110,8 @@ static int ipc_ioctl(ipcmessage *message) {
memcpy(arguments, message->ioctl.buffer_in + 1, (size_arguments < 8 * 4) ? size_arguments : (8 * 4));
// return error code as data
message->ioctl.buffer_io[0] = ((int (*const)(u32, u32, u32, u32, u32, u32, u32, u32)) (MCP_SVC_BASE + svc_id * 8))(arguments[0], arguments[1], arguments[2], arguments[3], arguments[4], arguments[5], arguments[6],
arguments[7]);
message->ioctl.buffer_io[0] = ((int (*const)(u32, u32, u32, u32, u32, u32, u32, u32)) (MCP_SVC_BASE + svc_id * 8))(arguments[0], arguments[1], arguments[2], arguments[3], arguments[4],
arguments[5], arguments[6], arguments[7]);
}
break;
}
@ -364,7 +364,7 @@ static int ipc_ioctl(ipcmessage *message) {
}
case IOCTL_FSA_FLUSHVOLUME: {
int fd = message->ioctl.buffer_in[0];
char *path = ((char *)message->ioctl.buffer_in) + message->ioctl.buffer_in[1];
char *path = ((char *) message->ioctl.buffer_in) + message->ioctl.buffer_in[1];
message->ioctl.buffer_io[0] = FSA_FlushVolume(fd, path);
break;

6
source/ios_mcp/source/main.c
View File

@ -1,11 +1,5 @@
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include "wupserver.h"
#include "ipc.h"
#include "svc.h"
#include "text.h"
#include "../../common/kernel_commands.h"
static int threadsStarted = 0;

59
source/ios_mcp/source/mcp_loadfile.c
View File

@ -21,7 +21,6 @@
#include "../../common/ipc_defs.h"
#include "fsa.h"
#include "svc.h"
#include "utils.h"
#include <string.h>
int (*const real_MCP_LoadFile)(ipcmessage *msg) = (void *) 0x0501CAA8 + 1; //+1 for thumb
@ -62,12 +61,12 @@ int _MCP_LoadFile_patch(ipcmessage *msg) {
int replace_fileoffset = rep_fileoffset;
char *replace_path = rpxpath;
if(strlen(request->name) > 1 && request->name[strlen(request->name)-1] == 'x'){
if (strlen(request->name) > 1 && request->name[strlen(request->name) - 1] == 'x') {
if (strncmp(request->name, "safe.rpx", strlen("safe.rpx")) != 0) {
//DEBUG_FUNCTION_LINE("set replace_valid to false\n");
replace_valid = false;
}else if(request->pos == 0){
if(replace_valid){
} else if (request->pos == 0) {
if (replace_valid) {
//DEBUG_FUNCTION_LINE("set doWantReplaceRPX to true\n");
doWantReplaceRPX = true;
}
@ -95,7 +94,7 @@ int _MCP_LoadFile_patch(ipcmessage *msg) {
replace_filesize = 0; // unknown
replace_fileoffset = 0;
}
}else if(!doWantReplaceRPX){
} else if (!doWantReplaceRPX) {
doWantReplaceRPX = false; // Only replace it once.
replace_path = NULL;
return real_MCP_LoadFile(msg);
@ -108,7 +107,7 @@ int _MCP_LoadFile_patch(ipcmessage *msg) {
if (result >= 0) {
return result;
}
}else{
} else {
DEBUG_FUNCTION_LINE("replace_path was NULL\n");
}
@ -165,7 +164,7 @@ int _MCP_ReadCOSXml_patch(uint32_t u1, uint32_t u2, MCPPPrepareTitleInfo *xmlDat
int (*const real_MCP_ReadCOSXml_patch)(uint32_t u1, uint32_t u2, MCPPPrepareTitleInfo *xmlData) = (void *) 0x050024ec + 1; //+1 for thumb
int res = real_MCP_ReadCOSXml_patch(u1, u2, xmlData);
// Give us sd access!
xmlData->permissions[4].mask = 0xFFFFFFFFFFFFFFFF;
@ -174,32 +173,32 @@ int _MCP_ReadCOSXml_patch(uint32_t u1, uint32_t u2, MCPPPrepareTitleInfo *xmlDat
if (xmlData->titleId == 0x000500101004E000 ||
xmlData->titleId == 0x000500101004E100 ||
xmlData->titleId == 0x000500101004E200) {
xmlData->codegen_size = 0x02000000;
xmlData->codegen_core = 0x80000001;
xmlData->max_size = 0x40000000;
// Set maximum codesize to 64 MiB
xmlData->max_codesize = 0x04000000;
xmlData->avail_size = 0;
xmlData->overlay_arena = 0;
xmlData->codegen_size = 0x02000000;
xmlData->codegen_core = 0x80000001;
xmlData->max_size = 0x40000000;
// Give us full permissions everywhere
for (uint32_t i = 0; i < 19; i++) {
xmlData->permissions[i].mask = 0xFFFFFFFFFFFFFFFF;
}
xmlData->default_stack0_size = 0;
xmlData->default_stack1_size = 0;
xmlData->default_stack2_size = 0;
xmlData->default_redzone0_size = 0;
xmlData->default_redzone1_size = 0;
xmlData->default_redzone2_size = 0;
xmlData->exception_stack0_size = 0x00001000;
xmlData->exception_stack1_size = 0x00001000;
xmlData->exception_stack2_size = 0x00001000;
// Set maximum codesize to 64 MiB
xmlData->max_codesize = 0x04000000;
xmlData->avail_size = 0;
xmlData->overlay_arena = 0;
// Give us full permissions everywhere
for (uint32_t i = 0; i < 19; i++) {
xmlData->permissions[i].mask = 0xFFFFFFFFFFFFFFFF;
}
xmlData->default_stack0_size = 0;
xmlData->default_stack1_size = 0;
xmlData->default_stack2_size = 0;
xmlData->default_redzone0_size = 0;
xmlData->default_redzone1_size = 0;
xmlData->default_redzone2_size = 0;
xmlData->exception_stack0_size = 0x00001000;
xmlData->exception_stack1_size = 0x00001000;
xmlData->exception_stack2_size = 0x00001000;
}
}
// When the PPC Kernel reboots we replace the men.rpx to set up our PPC side again
// for this the Wii U Menu temporarily gets replaced by our root.rpx and needs code gen access
if (!skipPPCSetup) {

3
source/ios_mcp/source/wupserver.c
View File

@ -55,7 +55,8 @@ static int serverCommandHandler(u32 *command_buffer, u32 length) {
// return error code as data
out_length = 8;
command_buffer[1] = ((int (*const)(u32, u32, u32, u32, u32, u32, u32, u32)) (MCP_SVC_BASE + svc_id * 8))(arguments[0], arguments[1], arguments[2], arguments[3], arguments[4], arguments[5], arguments[6], arguments[7]);
command_buffer[1] = ((int (*const)(u32, u32, u32, u32, u32, u32, u32, u32)) (MCP_SVC_BASE + svc_id * 8))(arguments[0], arguments[1], arguments[2], arguments[3], arguments[4], arguments[5],
arguments[6], arguments[7]);
}
break;
case 3:

6
source/main.cpp
View File

@ -1,6 +1,4 @@
#include <stdio.h>
#include <string.h>
#include <string>
#include <cstring>
#include <coreinit/cache.h>
#include <coreinit/ios.h>
@ -15,7 +13,7 @@
int main(int argc, char **argv) {
WHBLogUdpInit();
WHBLogPrintf("Hello from mocha");
uint64_t sysmenuIdUll = _SYSGetSystemApplicationTitleId(SYSTEM_APP_ID_HOME_MENU);
memcpy((void *) 0xF417FFF0, &sysmenuIdUll, 8);
DCStoreRange((void *) 0xF417FFF0, 0x8);