The-Homebrew-Cloud
/
MochaPayload
mirror of https://github.com/wiiu-env/MochaPayload.git
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
MochaPayload/source/ios_mcp/source/mcp_loadfile.c

371 lines
15 KiB
C
Raw Blame History

/* Patch for MCP_LoadFile (ioctl 0x53).
* Also adds a sibling ioctl, 0x64, that allows setting a custom path to a main RPX
*
* Reference for most of the types and whatever:
* https://github.com/exjam/decaf-emu/tree/ios/src/libdecaf/src/ios/mcp
*
* This is a proof of concept, and shouldn't be used until it's cleaned up a bit.
* Co-authored by exjam, Maschell and QuarkTheAwesome
*
* Flow of calls:
* - kernel loads system libraries, app rpx or user calls OSDynLoad
* - goes to loader.elf, which will call ioctl 0x53
* - with fileType = LOAD_FILE_CAFE_OS
* - on failure, again with LOAD_FILE_PROCESS_CODE
* - on failure, again with LOAD_FILE_SYS_DATA_CODE
* - each request routes here where we can do whatever
*/
#include "../../common/ipc_defs.h"
#include "../../common/kernel_commands.h"
#include "fsa.h"
#include "imports.h"
#include "ipc_types.h"
#include "logger.h"
#include "svc.h"
#include <mocha/commands.h>
#include <stdio.h>
#include <string.h>
int (*const real_MCP_LoadFile)(ipcmessage *msg) = (void *) 0x0501CAA8 + 1; //+1 for thumb
int (*const MCP_DoLoadFile)(const char *path, const char *path2, void *outputBuffer, uint32_t outLength, uint32_t pos, int *bytesRead, uint32_t unk) = (void *) 0x05017248 + 1;
static int MCP_LoadCustomFile(int target, char *path, int filesize, int fileoffset, void *out_buffer, int buffer_len, int pos);
static bool replace_valid = false;
static bool skipPPCSetup = false;
static bool doWantReplaceRPX = false;
static bool replace_target_device = 0;
static uint32_t rep_filesize = 0;
static uint32_t rep_fileoffset = 0;
static char rpxpath[256];
#define log(fmt, ...) log_printf("%s: " fmt, __FUNCTION__, __VA_ARGS__)
#define FAIL_ON(cond, val) \
if (cond) { \
log(#cond " (%08X)", val); \
return 29; \
}
int _MCP_LoadFile_patch(ipcmessage *msg) {
FAIL_ON(!msg->ioctl.buffer_in, 0);
FAIL_ON(msg->ioctl.length_in != 0x12D8, msg->ioctl.length_in);
FAIL_ON(!msg->ioctl.buffer_io, 0);
FAIL_ON(!msg->ioctl.length_io, 0);
MCPLoadFileRequest *request = (MCPLoadFileRequest *) msg->ioctl.buffer_in;
//dumpHex(request, sizeof(MCPLoadFileRequest));
//DEBUG_FUNCTION_LINE("msg->ioctl.buffer_io = %p, msg->ioctl.length_io = 0x%X\n", msg->ioctl.buffer_io, msg->ioctl.length_io);
//DEBUG_FUNCTION_LINE("request->type = %d, request->pos = %d, request->name = \"%s\"\n", request->type, request->pos, request->name);
LoadRPXTargetEnum replace_target = replace_target_device;
int replace_filesize = rep_filesize;
int replace_fileoffset = rep_fileoffset;
char *replace_path = rpxpath;
if (strlen(request->name) > 1 && request->name[strlen(request->name) - 1] == 'x') {
if (strncmp(request->name, "safe.rpx", strlen("safe.rpx")) != 0) {
//DEBUG_FUNCTION_LINE("set replace_valid to false\n");
replace_valid = false;
} else if (request->pos == 0) {
if (replace_valid) {
//DEBUG_FUNCTION_LINE("set doWantReplaceRPX to true\n");
doWantReplaceRPX = true;
}
}
}
if (strncmp(request->name, "men.rpx", strlen("men.rpx")) == 0) {
rpxpath[0] = '\0';
if (skipPPCSetup) {
snprintf(rpxpath, sizeof(rpxpath) - 1, "%s/men.rpx", &((char *) 0x05119F00)[19]); // Copy in environment path
} else {
snprintf(rpxpath, sizeof(rpxpath) - 1, "%s/root.rpx", &((char *) 0x05119F00)[19]); // Copy in environment path
}
// At startup we want to hook into the Wii U Menu by replacing the men.rpx with a file from the SD Card
// The replacement may restart the application to execute a kernel exploit.
// The men.rpx is hooked until the "IPC_CUSTOM_MEN_RPX_HOOK_COMPLETED" command is passed to IOCTL 0x100.
// If the loading of the replacement file fails, the Wii U Menu is loaded normally.
replace_target = LOAD_RPX_TARGET_SD_CARD;
replace_filesize = 0; // unknown
replace_fileoffset = 0;
} else if (strncmp(request->name, "safe.rpx", strlen("safe.rpx")) == 0) {
// if we don't explicitly replace files, we do want replace the Health and Safety app with the HBL
if (request->pos == 0 && !doWantReplaceRPX) {
replace_path = "wiiu/apps/homebrew_launcher/homebrew_launcher.rpx";
replace_target = LOAD_RPX_TARGET_SD_CARD;
//doWantReplaceXML = false;
doWantReplaceRPX = true;
replace_filesize = 0; // unknown
replace_fileoffset = 0;
}
} else if (!doWantReplaceRPX) {
doWantReplaceRPX = false; // Only replace it once.
replace_path = NULL;
return real_MCP_LoadFile(msg);
}
if (replace_path != NULL && strlen(replace_path) > 0) {
doWantReplaceRPX = false; // Only replace it once.
int result = MCP_LoadCustomFile(replace_target, replace_path, replace_filesize, replace_fileoffset, msg->ioctl.buffer_io, msg->ioctl.length_io, request->pos);
if (result >= 0) {
return result;
}
} else {
DEBUG_FUNCTION_LINE("replace_path was NULL\n");
}
return real_MCP_LoadFile(msg);
}
// Set filesize to 0 if unknown.
static int MCP_LoadCustomFile(int target, char *path, int filesize, int fileoffset, void *buffer_out, int buffer_len, int pos) {
if (path == NULL || (filesize > 0 && (pos > filesize))) {
return 0;
}
char filepath[256];
memset(filepath, 0, sizeof(filepath));
strncpy(filepath, path, sizeof(filepath) - 1);
char mountpath[] = "/vol/storage_iosu_homebrew";
if (target == LOAD_RPX_TARGET_SD_CARD) {
int fsa_h = svcOpen("/dev/fsa", 0);
int mount_res = FSA_Mount(fsa_h, "/dev/sdcard01", mountpath, 2, NULL, 0);
svcClose(fsa_h);
strncpy(filepath, mountpath, sizeof(filepath) - 1);
strncat(filepath, "/", (sizeof(filepath) - 1) - strlen(filepath));
strncat(filepath, path, (sizeof(filepath) - 1) - strlen(filepath));
}
DEBUG_FUNCTION_LINE("Load custom path \"%s\"\n", filepath);
int bytesRead = 0;
int result = MCP_DoLoadFile(filepath, NULL, buffer_out, buffer_len, pos + fileoffset, &bytesRead, 0);
//log("MCP_DoLoadFile returned %d, bytesRead = %d pos %d \n", result, bytesRead, pos + fileoffset);
if (result >= 0) {
if (bytesRead <= 0) {
result = 0;
} else {
if (filesize > 0 && (bytesRead + pos > filesize)) {
result = filesize - pos;
} else {
result = bytesRead;
}
}
}
if (result < 0x400000 && target == LOAD_RPX_TARGET_SD_CARD) {
int fsa_h = svcOpen("/dev/fsa", 0);
int unmount_res = FSA_Unmount(fsa_h, mountpath, 0x80000002);
svcClose(fsa_h);
}
return result;
}
int _MCP_ReadCOSXml_patch(uint32_t u1, uint32_t u2, MCPPPrepareTitleInfo *xmlData) {
int (*const real_MCP_ReadCOSXml_patch)(uint32_t u1, uint32_t u2, MCPPPrepareTitleInfo * xmlData) = (void *) 0x050024ec + 1; //+1 for thumb
int res = real_MCP_ReadCOSXml_patch(u1, u2, xmlData);
/*
For some reason ONE PIECE Unlimited World Red softlocks when it has full FSA permissions.
*/
if (xmlData->titleId != 0x0005000010175C00 && // ONE PIECE Unlimited World Red USA
xmlData->titleId != 0x0005000010175D00 && // ONE PIECE Unlimited World Red EUR
xmlData->titleId != 0x0005000010148000) { // ONE PIECE Unlimited World Red JPN
// Give us sd access!
xmlData->permissions[4].mask = 0xFFFFFFFFFFFFFFFF;
}
/*
For some reason Mass Effects 3 softlocks when it has full ACP permissions.
*/
if (xmlData->titleId != 0x000500001010DC00 && // Mass Effect 3 Special Edition USA
xmlData->titleId != 0x000500001010F500 && // Mass Effect 3 Special Edition EUR
xmlData->titleId != 0x0005000010113000) { // Mass Effect 3 Special Edition JPN
// Give all titles permission to use ACP
xmlData->permissions[10].mask = 0xFFFFFFFFFFFFFFFF;
}
// if we replace the RPX we want to increase the max_codesize and give us full permission!
if (replace_valid) {
if (xmlData->titleId == 0x000500101004E000 ||
xmlData->titleId == 0x000500101004E100 ||
xmlData->titleId == 0x000500101004E200) {
xmlData->codegen_size = 0x02000000;
xmlData->codegen_core = 0x80000001;
xmlData->max_size = 0x40000000;
// Set maximum codesize to 64 MiB
xmlData->max_codesize = 0x04000000;
xmlData->avail_size = 0;
xmlData->overlay_arena = 0;
// Give us full permissions everywhere
for (uint32_t i = 0; i < 19; i++) {
xmlData->permissions[i].mask = 0xFFFFFFFFFFFFFFFF;
}
xmlData->default_stack0_size = 0;
xmlData->default_stack1_size = 0;
xmlData->default_stack2_size = 0;
xmlData->default_redzone0_size = 0;
xmlData->default_redzone1_size = 0;
xmlData->default_redzone2_size = 0;
xmlData->exception_stack0_size = 0x00001000;
xmlData->exception_stack1_size = 0x00001000;
xmlData->exception_stack2_size = 0x00001000;
}
}
// When the PPC Kernel reboots we replace the men.rpx to set up our PPC side again
// for this the Wii U Menu temporarily gets replaced by our root.rpx and needs code gen access
if (!skipPPCSetup) {
if (xmlData->titleId == 0x0005001010040000 ||
xmlData->titleId == 0x0005001010040100 ||
xmlData->titleId == 0x0005001010040200) {
xmlData->codegen_size = 0x02000000;
xmlData->codegen_core = 0x80000001;
xmlData->max_codesize = 0x02800000;
}
}
return res;
}
extern int _startMainThread(void);
/* RPX replacement! Call this ioctl to replace the next loaded RPX with an arbitrary path.
DO NOT RETURN 0, this affects the codepaths back in the IOSU code */
int _MCP_ioctl100_patch(ipcmessage *msg) {
/* Give some method to detect this ioctl's prescence, even if the other args are bad */
if (msg->ioctl.buffer_io && msg->ioctl.length_io >= sizeof(u32)) {
*(u32 *) msg->ioctl.buffer_io = 1;
}
FAIL_ON(!msg->ioctl.buffer_in, 0);
FAIL_ON(!msg->ioctl.length_in, 0);
if (msg->ioctl.buffer_in && msg->ioctl.length_in >= 4) {
int command = msg->ioctl.buffer_in[0];
switch (command) {
case IPC_CUSTOM_MEN_RPX_HOOK_COMPLETED: {
DEBUG_FUNCTION_LINE("IPC_CUSTOM_MEN_RPX_HOOK_COMPLETED\n");
skipPPCSetup = true;
break;
}
case IPC_CUSTOM_LOAD_CUSTOM_RPX: {
DEBUG_FUNCTION_LINE("IPC_CUSTOM_LOAD_CUSTOM_RPX\n");
if (msg->ioctl.length_in >= 0x110) {
int target = msg->ioctl.buffer_in[0x04 / 0x04];
if (target == LOAD_RPX_TARGET_EXTRA_REVERT_PREPARE) {
doWantReplaceRPX = false;
replace_valid = false;
return 0;
}
if (target != LOAD_RPX_TARGET_SD_CARD) {
return 29;
}
int filesize = msg->ioctl.buffer_in[0x08 / 0x04];
int fileoffset = msg->ioctl.buffer_in[0x0C / 0x04];
char *str_ptr = (char *) &msg->ioctl.buffer_in[0x10 / 0x04];
memset(rpxpath, 0, sizeof(rpxpath));
strncpy(rpxpath, str_ptr, 256 - 1);
rep_filesize = filesize;
rep_fileoffset = fileoffset;
doWantReplaceRPX = true;
//doWantReplaceXML = true;
replace_valid = true;
DEBUG_FUNCTION_LINE("Will load %s for next title from target: %d (offset %d, filesize %d)\n", rpxpath, target, rep_fileoffset, rep_filesize);
return 0;
} else {
return 29;
}
break;
}
case IPC_CUSTOM_START_MCP_THREAD: {
_startMainThread();
return 0;
break;
}
case IPC_CUSTOM_COPY_ENVIRONMENT_PATH: {
if (msg->ioctl.buffer_io && msg->ioctl.length_io >= 0x100) {
strncpy((char *) msg->ioctl.buffer_io, (void *) 0x05119F00, 0xFF);
return 0;
} else {
return 29;
}
}
case IPC_CUSTOM_START_USB_LOGGING: {
if (*((uint32_t *) 0x050290dc) == 0x42424242) {
// Skip syslog after a reload
break;
}
// set the flag to not run this twice.
svcCustomKernelCommand(KERNEL_WRITE32, 0x050290dc, 0x42424242);
// Patch MCP debugmode check for usb syslog
svcCustomKernelCommand(KERNEL_WRITE32, 0x050290d8, 0x20004770);
// Patch TEST to allow usb syslog
svcCustomKernelCommand(KERNEL_WRITE32, 0xe4007828, 0xe3a00000);
usleep(1000 * 10);
int handle = svcOpen("/dev/testproc1", 0);
if (handle > 0) {
svcResume(handle);
svcClose(handle);
}
handle = svcOpen("/dev/usb_syslog", 0);
if (handle > 0) {
svcResume(handle);
svcClose(handle);
}
bool showCompleteLog = msg->ioctl.buffer_in && msg->ioctl.length_in >= 0x08 && msg->ioctl.buffer_in[1] == 1;
if (!showCompleteLog) {
// Kill existing syslogs to avoid long catch up
uint32_t *bufferPtr = (uint32_t *) (*(uint32_t *) 0x05095ecc);
bufferPtr[0] = 0;
bufferPtr[1] = 0;
}
break;
}
case IPC_CUSTOM_GET_MOCHA_API_VERSION: {
if (msg->ioctl.buffer_io && msg->ioctl.length_io >= 8) {
msg->ioctl.buffer_io[0] = 0xCAFEBABE;
msg->ioctl.buffer_io[1] = MOCHA_API_VERSION;
return 0;
} else {
return 29;
}
break;
}
default: {
}
}
} else {
return 29;
}
return 0;
}
Reference in New Issue View Git Blame Copy Permalink