The-Homebrew-Cloud
/
PayloadFromRPX
mirror of https://github.com/wiiu-env/PayloadFromRPX.git
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Format via clang-format

This commit is contained in:
Maschell 2022-03-05 17:00:58 +01:00
parent f74dd732b0
commit de4405ecf9
20 changed files with 502 additions and 404 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
.clang-format Normal file
View File

@ -0,0 +1,67 @@
# Generated from CLion C/C++ Code Style settings
BasedOnStyle: LLVM
AccessModifierOffset: -4
AlignAfterOpenBracket: Align
AlignConsecutiveAssignments: Consecutive
AlignConsecutiveMacros: AcrossEmptyLinesAndComments
AlignOperands: Align
AllowAllArgumentsOnNextLine: false
AllowAllConstructorInitializersOnNextLine: false
AllowAllParametersOfDeclarationOnNextLine: false
AllowShortBlocksOnASingleLine: Always
AllowShortCaseLabelsOnASingleLine: false
AllowShortFunctionsOnASingleLine: All
AllowShortIfStatementsOnASingleLine: Always
AllowShortLambdasOnASingleLine: All
AllowShortLoopsOnASingleLine: true
AlwaysBreakAfterReturnType: None
AlwaysBreakTemplateDeclarations: Yes
BreakBeforeBraces: Custom
BraceWrapping:
AfterCaseLabel: false
AfterClass: false
AfterControlStatement: Never
AfterEnum: false
AfterFunction: false
AfterNamespace: false
AfterUnion: false
BeforeCatch: false
BeforeElse: false
IndentBraces: false
SplitEmptyFunction: false
SplitEmptyRecord: true
BreakBeforeBinaryOperators: None
BreakBeforeTernaryOperators: true
BreakConstructorInitializers: BeforeColon
BreakInheritanceList: BeforeColon
ColumnLimit: 0
CompactNamespaces: false
ContinuationIndentWidth: 8
IndentCaseLabels: true
IndentPPDirectives: None
IndentWidth: 4
KeepEmptyLinesAtTheStartOfBlocks: true
MaxEmptyLinesToKeep: 2
NamespaceIndentation: All
ObjCSpaceAfterProperty: false
ObjCSpaceBeforeProtocolList: true
PointerAlignment: Right
ReflowComments: false
SpaceAfterCStyleCast: true
SpaceAfterLogicalNot: false
SpaceAfterTemplateKeyword: false
SpaceBeforeAssignmentOperators: true
SpaceBeforeCpp11BracedList: false
SpaceBeforeCtorInitializerColon: true
SpaceBeforeInheritanceColon: true
SpaceBeforeParens: ControlStatements
SpaceBeforeRangeBasedForLoopColon: true
SpaceInEmptyParentheses: false
SpacesBeforeTrailingComments: 1
SpacesInAngles: false
SpacesInCStyleCastParentheses: false
SpacesInContainerLiterals: false
SpacesInParentheses: false
SpacesInSquareBrackets: false
TabWidth: 4
UseTab: Never

8
.github/workflows/ci.yml vendored
View File

@ -6,8 +6,16 @@ on:
- master
jobs:
clang-format:
runs-on: ubuntu-18.04
steps:
- uses: actions/checkout@v2
- name: clang-format
run: |
docker run --rm -v ${PWD}:/src wiiuenv/clang-format:13.0.0-2 -r ./source
build-binary:
runs-on: ubuntu-18.04
needs: clang-format
steps:
- uses: actions/checkout@v2
- name: build binary

8
.github/workflows/pr.yml vendored
View File

@ -3,8 +3,16 @@ name: CI-PR
on: [pull_request]
jobs:
clang-format:
runs-on: ubuntu-18.04
steps:
- uses: actions/checkout@v2
- name: clang-format
run: |
docker run --rm -v ${PWD}:/src wiiuenv/clang-format:13.0.0-2 -r ./source
build-binary:
runs-on: ubuntu-18.04
needs: clang-format
steps:
- uses: actions/checkout@v2
- name: build binary

5
README.md
View File

@ -63,6 +63,11 @@ docker run -it --rm -v ${PWD}:/project payloadfromrpx-builder make
docker run -it --rm -v ${PWD}:/project payloadfromrpx-builder make clean
```
## Format the code via docker
`docker run --rm -v ${PWD}:/src wiiuenv/clang-format:13.0.0-2 -r ./source -i`
## Credits
- orboditilt
- Maschell

15
source/ElfUtils.c
View File

@ -1,13 +1,13 @@
#include <stdio.h>
#include <string.h>
#include <coreinit/debug.h>
#include <coreinit/cache.h>
#include <coreinit/debug.h>
#include <coreinit/memdefaultheap.h>
#include <whb/sdcard.h>
#include <utils/logger.h>
#include <whb/file.h>
#include <whb/log.h>
#include <utils/logger.h>
#include <whb/sdcard.h>
#include "elf_abi.h"
@ -33,7 +33,7 @@ int32_t LoadFileToMem(const char *relativefilepath, char **fileOut, uint32_t *si
goto exit;
}
exit:
exit:
WHBUnmountSdCard();
return result;
}
@ -61,10 +61,7 @@ uint32_t load_loader_elf_from_sd(unsigned char *baseAddress, const char *relativ
static unsigned int get_section(unsigned char *data, const char *name, unsigned int *size, unsigned int *addr, int fail_on_not_found) {
Elf32_Ehdr *ehdr = (Elf32_Ehdr *) data;
if (!data
|| !IS_ELF (*ehdr)
|| (ehdr->e_type != ET_EXEC)
|| (ehdr->e_machine != EM_PPC)) {
if (!data || !IS_ELF(*ehdr) || (ehdr->e_type != ET_EXEC) || (ehdr->e_machine != EM_PPC)) {
OSFatal("Invalid elf file");
}
@ -118,7 +115,6 @@ static void InstallMain(void *data_elf) {
memcpy((void *) (main_rodata_addr), (void *) main_rodata, main_rodata_len);
DCFlushRange((void *) main_rodata_addr, main_rodata_len);
ICInvalidateRange((void *) main_rodata_addr, main_rodata_len);
}
// get the .data section
@ -144,5 +140,4 @@ static void InstallMain(void *data_elf) {
DCFlushRange((void *) main_bss_addr, main_bss_len);
ICInvalidateRange((void *) main_bss_addr, main_bss_len);
}
}

1
source/elf_abi.h
View File

@ -1,3 +1,4 @@
// clang-format off
/*
* Copyright (c) 1995, 1996, 2001, 2002
* Erik Theisen. All rights reserved.

56
source/gx2sploit.cpp
View File

@ -1,20 +1,19 @@
#include <coreinit/core.h>
#include <coreinit/memory.h>
#include <coreinit/debug.h>
#include <coreinit/thread.h>
#include <coreinit/cache.h>
#include <coreinit/dynload.h>
#include <coreinit/thread.h>
#include <coreinit/exit.h>
#include <sysapp/launch.h>
#include <gx2/state.h>
#include <coreinit/memorymap.h>
#include <whb/log.h>
#include <malloc.h>
#include <cstring>
#include <utils/logger.h>
#include "ElfUtils.h"
#include "gx2sploit.h"
#include "ElfUtils.h"
#include <coreinit/cache.h>
#include <coreinit/core.h>
#include <coreinit/debug.h>
#include <coreinit/dynload.h>
#include <coreinit/exit.h>
#include <coreinit/memory.h>
#include <coreinit/memorymap.h>
#include <coreinit/thread.h>
#include <cstring>
#include <gx2/state.h>
#include <malloc.h>
#include <sysapp/launch.h>
#include <utils/logger.h>
#include <whb/log.h>
#define JIT_ADDRESS 0x01800000
@ -49,7 +48,7 @@ static void *find_gadget(uint32_t code[], uint32_t length, uint32_t gadgets_star
/* Chadderz's kernel write function */
void __attribute__((noinline)) kern_write(const void *addr, uint32_t value) {
asm volatile (
asm volatile(
"li 3,1\n"
"li 4,0\n"
"mr 5,%1\n"
@ -65,8 +64,7 @@ void __attribute__((noinline)) kern_write(const void *addr, uint32_t value) {
:
: "r"(addr), "r"(value)
: "memory", "ctr", "lr", "0", "3", "4", "5", "6", "7", "8", "9", "10",
"11", "12"
);
"11", "12");
}
extern "C" void OSSwitchSecCodeGenMode(int);
@ -75,7 +73,7 @@ int exploitThread(int argc, char **argv) {
OSDynLoad_Module gx2_handle;
OSDynLoad_Acquire("gx2.rpl", &gx2_handle);
void (*pGX2SetSemaphore)(uint64_t *sem, int action);
void (*pGX2SetSemaphore)(uint64_t * sem, int action);
OSDynLoad_FindExport(gx2_handle, 0, "GX2SetSemaphore", (void **) &pGX2SetSemaphore);
uint32_t set_semaphore = ((uint32_t) pGX2SetSemaphore) + 0x2C;
@ -107,7 +105,7 @@ int exploitThread(int argc, char **argv) {
uint32_t gx2data[] = {0xfc2a0000};
uint32_t gx2data_addr = (uint32_t) find_gadget(gx2data, 0x04, 0x10000000);
uint32_t doflush[] = {0xba810008, 0x8001003c, 0x7c0803a6, 0x38210038, 0x4e800020, 0x9421ffe0, 0xbf61000c, 0x7c0802a6, 0x7c7e1b78, 0x7c9f2378, 0x90010024};
void (*do_flush)(uint32_t arg0, uint32_t arg1) = (void (*)(uint32_t, uint32_t)) (((uint32_t) find_gadget(doflush, 0x2C, 0x01000000)) + 0x14);
void (*do_flush)(uint32_t arg0, uint32_t arg1) = (void (*)(uint32_t, uint32_t))(((uint32_t) find_gadget(doflush, 0x2C, 0x01000000)) + 0x14);
/* Modify a next ptr on the heap */
uint32_t kpaddr = KERN_HEAP_PHYS + STARTID_OFFSET;
@ -186,15 +184,23 @@ static void SCSetupIBAT4DBAT5() {
// 00800000-01000000 => 30800000-31000000 (read/write, user/supervisor)
unsigned int ibat4u = 0x008000FF;
unsigned int ibat4l = 0x30800012;
asm volatile("mtspr 560, %0" : : "r" (ibat4u));
asm volatile("mtspr 561, %0" : : "r" (ibat4l));
asm volatile("mtspr 560, %0"
:
: "r"(ibat4u));
asm volatile("mtspr 561, %0"
:
: "r"(ibat4l));
// Give our and the kernel full data access rights.
// 00800000-01000000 => 30800000-31000000 (read/write, user/supervisor)
unsigned int dbat5u = ibat4u;
unsigned int dbat5l = ibat4l;
asm volatile("mtspr 570, %0" : : "r" (dbat5u));
asm volatile("mtspr 571, %0" : : "r" (dbat5l));
asm volatile("mtspr 570, %0"
:
: "r"(dbat5u));
asm volatile("mtspr 571, %0"
:
: "r"(dbat5l));
asm volatile("eieio; isync");
}

2
source/gx2sploit.h
View File

@ -4,6 +4,8 @@
extern "C" {
#endif
#include <stdint.h>
#define KERN_SYSCALL_TBL_1 0xFFE84C70 // unknown
#define KERN_SYSCALL_TBL_2 0xFFE85070 // works with games
#define KERN_SYSCALL_TBL_3 0xFFE85470 // works with loader

12
source/ios_exploit.c
View File

@ -1,9 +1,9 @@
#include <string.h>
#include <stdio.h>
#include <coreinit/cache.h>
#include <coreinit/thread.h>
#include <coreinit/ios.h>
#include "ios_exploit.h"
#include <coreinit/cache.h>
#include <coreinit/ios.h>
#include <coreinit/thread.h>
#include <stdio.h>
#include <string.h>
#define CHAIN_START 0x1016AD40
#define SOURCE (0x120000)
@ -230,7 +230,7 @@ static const int final_chain[] = {
0x0, // 0x1F0
0x101063db, // 0x1F4 POP {R1,R2,R5,PC}
0x0, // 0x1F8
sizeof(ios_kernel),// 0x1FC our code size
sizeof(ios_kernel), // 0x1FC our code size
0x0, // 0x200
0x10123983, // 0x204 POP {R1,R3,R4,R6,PC}
0x00140000, // 0x208 our code source location

1
source/ios_kernel/source/elf_abi.h
View File

@ -1,3 +1,4 @@
// clang-format off
/*
* Copyright (c) 1995, 1996, 2001, 2002
* Erik Theisen. All rights reserved.

6
source/ios_kernel/source/elf_patcher.c
View File

@ -21,16 +21,14 @@
* 3. This notice may not be removed or altered from any source
* distribution.
***************************************************************************/
#include "types.h"
#include "elf_abi.h"
#include "types.h"
#include "utils.h"
static Elf32_Phdr *get_section(u32 data, u32 vaddr) {
Elf32_Ehdr *ehdr = (Elf32_Ehdr *) data;
if (!IS_ELF (*ehdr)
|| (ehdr->e_type != ET_EXEC)
|| (ehdr->e_machine != EM_ARM)) {
if (!IS_ELF(*ehdr) || (ehdr->e_type != ET_EXEC) || (ehdr->e_machine != EM_ARM)) {
return 0;
}

8
source/ios_kernel/source/elf_patcher.h
View File

@ -26,10 +26,10 @@
#include "types.h"
#define ARM_B(addr, func) (0xEA000000 | ((((u32)(func) - (u32)(addr) - 8) >> 2) & 0x00FFFFFF)) // +-32MB
#define ARM_BL(addr, func) (0xEB000000 | ((((u32)(func) - (u32)(addr) - 8) >> 2) & 0x00FFFFFF)) // +-32MB
#define THUMB_B(addr, func) ((0xE000 | ((((u32)(func) - (u32)(addr) - 4) >> 1) & 0x7FF))) // +-2KB
#define THUMB_BL(addr, func) ((0xF000F800 | ((((u32)(func) - (u32)(addr) - 4) >> 1) & 0x0FFF)) | ((((u32)(func) - (u32)(addr) - 4) << 4) & 0x7FFF000)) // +-4MB
#define ARM_B(addr, func) (0xEA000000 | ((((u32) (func) - (u32) (addr) -8) >> 2) & 0x00FFFFFF)) // +-32MB
#define ARM_BL(addr, func) (0xEB000000 | ((((u32) (func) - (u32) (addr) -8) >> 2) & 0x00FFFFFF)) // +-32MB
#define THUMB_B(addr, func) ((0xE000 | ((((u32) (func) - (u32) (addr) -4) >> 1) & 0x7FF))) // +-2KB
#define THUMB_BL(addr, func) ((0xF000F800 | ((((u32) (func) - (u32) (addr) -4) >> 1) & 0x0FFF)) | ((((u32) (func) - (u32) (addr) -4) << 4) & 0x7FFF000)) // +-4MB
typedef struct {
u32 address;

10
source/ios_kernel/source/instant_patches.c
View File

@ -21,13 +21,13 @@
* 3. This notice may not be removed or altered from any source
* distribution.
***************************************************************************/
#include "utils.h"
#include "types.h"
#include "kernel_patches.h"
#include "types.h"
#include "utils.h"
#define mcp_rodata_phys(addr) ((u32)(addr) - 0x05060000 + 0x08220000)
#define mcp_data_phys(addr) ((u32)(addr) - 0x05074000 + 0x08234000)
#define acp_phys(addr) ((u32)(addr) - 0xE0000000 + 0x12900000)
#define mcp_rodata_phys(addr) ((u32) (addr) -0x05060000 + 0x08220000)
#define mcp_data_phys(addr) ((u32) (addr) -0x05074000 + 0x08234000)
#define acp_phys(addr) ((u32) (addr) -0xE0000000 + 0x12900000)
void instant_patches_setup(void) {
// fix 10 minute timeout that crashes MCP after 10 minutes of booting

5
source/ios_kernel/source/kernel_patches.c
View File

@ -21,9 +21,9 @@
* 3. This notice may not be removed or altered from any source
* distribution.
***************************************************************************/
#include "types.h"
#include "elf_patcher.h"
#include "kernel_patches.h"
#include "elf_patcher.h"
#include "types.h"
#include "utils.h"
extern void __KERNEL_CODE_START(void);
@ -58,4 +58,3 @@ void kernel_run_patches(u32 ios_elf_start) {
section_write_word(ios_elf_start, 0xe22b2a78, 0x00000000);
section_write_word(ios_elf_start, 0xe204fb68, 0xe3a00000);
}

4
source/ios_kernel/source/main.c
View File

@ -21,9 +21,9 @@
* 3. This notice may not be removed or altered from any source
* distribution.
***************************************************************************/
#include "instant_patches.h"
#include "types.h"
#include "utils.h"
#include "instant_patches.h"
#define USB_PHYS_CODE_BASE 0x101312D0
@ -32,6 +32,7 @@ typedef struct {
u8 data[0];
} payload_info_t;
// clang-format off
static const char repairData_set_fault_behavior[] = {
0xE1, 0x2F, 0xFF, 0x1E, 0xE9, 0x2D, 0x40, 0x30, 0xE5, 0x93, 0x20, 0x00, 0xE1, 0xA0, 0x40, 0x00,
0xE5, 0x92, 0x30, 0x54, 0xE1, 0xA0, 0x50, 0x01, 0xE3, 0x53, 0x00, 0x01, 0x0A, 0x00, 0x00, 0x02,
@ -55,6 +56,7 @@ static const char repairData_usb_root_thread[] = {
0xE2, 0x4D, 0xDE, 0x17, 0xEB, 0x00, 0xB9, 0x92, 0xE3, 0xA0, 0x10, 0x00, 0xE3, 0xA0, 0x20, 0x03,
0xE5, 0x9F, 0x0E, 0x68, 0xEB, 0x00, 0xB3, 0x20,
};
// clang-format on
int _main() {
void (*invalidate_icache)() = (void (*)()) 0x0812DCF0;

27
source/ios_kernel/source/utils.h
View File

@ -26,28 +26,35 @@
#define ALIGN4(x) (((x) + 3) & ~3)
#define kernel_memcpy ((void * (*)(void*, const void*, int))0x08131D04)
#define kernel_memset ((void *(*)(void*, int, unsigned int))0x08131DA0)
#define kernel_strncpy ((char *(*)(char*, const char*, unsigned int))0x081329B8)
#define disable_interrupts ((int(*)())0x0812E778)
#define enable_interrupts ((int(*)(int))0x0812E78C)
#define kernel_bsp_command_5 ((int (*)(const char*, int offset, const char*, int size, void *buffer))0x0812EC40)
#define kernel_memcpy ((void *(*) (void *, const void *, int) ) 0x08131D04)
#define kernel_memset ((void *(*) (void *, int, unsigned int) ) 0x08131DA0)
#define kernel_strncpy ((char *(*) (char *, const char *, unsigned int) ) 0x081329B8)
#define disable_interrupts ((int (*)()) 0x0812E778)
#define enable_interrupts ((int (*)(int)) 0x0812E78C)
#define kernel_bsp_command_5 ((int (*)(const char *, int offset, const char *, int size, void *buffer)) 0x0812EC40)
void reverse_memcpy(void *dest, const void *src, unsigned int size);
static inline unsigned int disable_mmu(void) {
unsigned int control_register = 0;
asm volatile("MRC p15, 0, %0, c1, c0, 0" : "=r" (control_register));
asm volatile("MCR p15, 0, %0, c1, c0, 0" : : "r" (control_register & 0xFFFFEFFA));
asm volatile("MRC p15, 0, %0, c1, c0, 0"
: "=r"(control_register));
asm volatile("MCR p15, 0, %0, c1, c0, 0"
:
: "r"(control_register & 0xFFFFEFFA));
return control_register;
}
static inline void restore_mmu(unsigned int control_register) {
asm volatile("MCR p15, 0, %0, c1, c0, 0" : : "r" (control_register));
asm volatile("MCR p15, 0, %0, c1, c0, 0"
:
: "r"(control_register));
}
static inline void set_domain_register(unsigned int domain_register) {
asm volatile("MCR p15, 0, %0, c3, c0, 0" : : "r" (domain_register));
asm volatile("MCR p15, 0, %0, c3, c0, 0"
:
: "r"(domain_register));
}
#endif

1
source/ios_usb/source/main.c
View File

@ -20,5 +20,4 @@ void _main() {
"newlr: .word 0x1012EACC\n"
"newr0: .word 0x10146080\n"
"newpc: .word 0x10111164\n");
}

24
source/main.cpp
View File

@ -1,25 +1,25 @@
#include <coreinit/time.h>
#include <cstdio>
#include <cstring>
#include <coreinit/time.h>
#include <coreinit/foreground.h>
#include <nn/act/client_cpp.h>
#include <proc_ui/procui.h>
#include <coreinit/thread.h>
#include <coreinit/screen.h>
#include <coreinit/thread.h>
#include <proc_ui/procui.h>
#include <whb/log.h>
#include <whb/log_udp.h>
#include <sysapp/launch.h>
#include <sysapp/title.h>
#include <coreinit/cache.h>
#include <vpad/input.h>
#include <string>
#include "utils/logger.h"
#include "ElfUtils.h"
#include "ios_exploit.h"
#include "utils/logger.h"
#include <coreinit/cache.h>
#include <string>
#include <sysapp/launch.h>
#include <sysapp/title.h>
#include <vpad/input.h>
#include <whb/log.h>
#include <whb/log_udp.h>
#include "gx2sploit.h"
@ -145,7 +145,7 @@ int main(int argc, char **argv) {
return 0;
}
void forceDefaultTitleIDToWiiUMenu() {// Restore the default title id to the normal Wii U Menu.
void forceDefaultTitleIDToWiiUMenu() { // Restore the default title id to the normal Wii U Menu.
unsigned long long sysmenuIdUll = _SYSGetSystemApplicationTitleId(SYSTEM_APP_ID_HOME_MENU);
memcpy((void *) 0xF417FFF0, &sysmenuIdUll, 8);
DCStoreRange((void *) 0xF417FFF0, 0x8);

8
source/utils/logger.h
View File

@ -1,7 +1,7 @@
#pragma once
#include <whb/log.h>
#include <string.h>
#include <whb/log.h>
#ifdef __cplusplus
extern "C" {
@ -10,11 +10,11 @@ extern "C" {
#define __FILENAME_X__ (strrchr(__FILE__, '\\') ? strrchr(__FILE__, '\\') + 1 : __FILE__)
#define __FILENAME__ (strrchr(__FILE__, '/') ? strrchr(__FILE__, '/') + 1 : __FILENAME_X__)
#define DEBUG_FUNCTION_LINE(FMT, ARGS...)do { \
WHBLogPrintf("[%23s]%30s@L%04d: " FMT "",__FILENAME__,__FUNCTION__, __LINE__, ## ARGS); \
#define DEBUG_FUNCTION_LINE(FMT, ARGS...) \
do { \
WHBLogPrintf("[%23s]%30s@L%04d: " FMT "", __FILENAME__, __FUNCTION__, __LINE__, ##ARGS); \
} while (0)
#ifdef __cplusplus
}
#endif